@moda-ai/cli 1.52.0 → 1.54.0

package/README.md

@@ -106,8 +106,9 @@ Legacy aliases (same behavior, kept for existing scripts): `moda conversations`
 Prompt management:
 
 ```bash
-moda prompts init                                # Create .moda/prompts.yml
+moda prompts init                                # Create .moda/prompts.yml (version 2)
 moda prompts status                              # Read-only local prompt status
+moda prompts migrate --dry-run                   # Preview a version 1 -> 2 manifest rewrite
 moda prompts sync                                # Upload changed prompt versions
 moda prompts promote support.triage --label=prod --version=pver_abc123
 ```
@@ -176,7 +177,10 @@ results on stdout remain unchanged; `--quiet` suppresses progress and
 `--watch` starts with analysis and then watches mapped definitions; re-run sync
 to discover new sources that do not affect an existing mapping. You can also
 run `harness analyze --experimental --concern=prompts` and import its report
-with `prompts init --from-harness=<report>`. Discovery reports partial coverage:
+with `prompts init --from-harness=<report>`. Older reports are normalized and
+prompts without a `promptSource` are mapped from `sourcePath` when unambiguous;
+prompts that still do not resolve are returned in `skipped` with a reason, and the
+import fails only when none resolve. Discovery reports partial coverage:
 finding a prompt fragment does not prove that every composition or model call
 has been covered.
 
@@ -239,6 +243,14 @@ sources:
       - path: config/policy.txt
 ```
 
+Manifests from older CLIs say `version: 1`. Those CLIs matched `.prompt.*` files
+anywhere in the repository; patterns are now exact globs from the repository root.
+`prompts status` reports `zeroMatchPatterns` and `legacyOnlyFiles` (files only the
+old discovery found), and `moda prompts migrate [--dry-run] [--discover]` rewrites
+the manifest to version 2, adding those files as explicit paths so their keys and
+lockfile entries are unchanged. The lockfile `contentHash` is
+`computePromptContentHash` from `@moda-ai/cli/prompt-hash` (`PROMPT_HASH_VERSION` 1).
+
 Selectors support named TypeScript/JavaScript/Python definitions and JSON Pointer
 selection in JSON/YAML. Python resolution requires `python3`; the helper parses
 ASTs without importing customer modules. Static literals and supported constant

package/dist/{cli-he2wb4hd.js → cli-9250ckvg.js}

@@ -182903,6 +182903,19 @@ function discoverStructuredPromptSources(rootDir, sourcePath) {
   walk(value, [], 0, []);
   return sources;
 }
+function backfillPromptSource(rootDir, artifact) {
+  if (artifact.promptSource)
+    return artifact.promptSource;
+  if (!artifact.sourcePath)
+    return;
+  if (/\.(?:[cm]?[jt]sx?|py)$/.test(artifact.sourcePath)) {
+    const candidates = discoverCodePromptSources(rootDir, artifact.sourcePath);
+    const name = (artifact.name ?? "").replace(/[^a-z0-9]/gi, "").toLowerCase();
+    const matching = candidates.filter((source) => source.selector?.symbol?.replace(/[^a-z0-9]/gi, "").toLowerCase() === name);
+    return matching.length === 1 ? matching[0] : undefined;
+  }
+  return { key: artifact.id, path: artifact.sourcePath };
+}
 function discoverCodePromptSources(rootDir, sourcePath) {
   return discoverCodePromptCandidates(rootDir, sourcePath).map((candidate) => candidate.source);
 }
@@ -184857,7 +184870,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-gbty3k66.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-075xzdvp.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -185501,19 +185514,10 @@ function repairExternalAnalystReport(report, rootDir, options = {}) {
     if (artifact.type !== "prompt")
       continue;
     try {
-      if (!artifact.promptSource && artifact.sourcePath) {
-        if (/\.(?:[cm]?[jt]sx?|py)$/.test(artifact.sourcePath)) {
-          const candidates = discoverCodePromptSources(rootDir, artifact.sourcePath);
-          const name = artifact.name.replace(/[^a-z0-9]/gi, "").toLowerCase();
-          const matching = candidates.filter((source2) => source2.selector?.symbol?.replace(/[^a-z0-9]/gi, "").toLowerCase() === name);
-          if (matching.length === 1)
-            artifact.promptSource = matching[0];
-        } else {
-          artifact.promptSource = { key: artifact.id, path: artifact.sourcePath };
-        }
-      }
-      if (!artifact.promptSource)
+      const backfilled = backfillPromptSource(rootDir, artifact);
+      if (!backfilled)
         continue;
+      artifact.promptSource = backfilled;
       const source = resolvePromptSource(rootDir, artifact.promptSource);
       artifact.body = source.content;
       artifact.sourceDefinition = source.sourceDefinition;
@@ -188911,4 +188915,4 @@ function hashText(text) {
   return createHash4("sha256").update(text).digest("hex");
 }
 
-export { ApiError, callDataAPI, callControlAPI, getApiRequestCount, resetApiRequestCount, $parseDocument, $stringify, require_typescript, inspectCodeSelectors, inspectPythonSelectors, resolvePromptSource, assertFlags, assertPositionals, runUsersCommand, runUserCommand, runProblemReopenCommand, runSignalsManagementCommand, SIGNALS_MANAGEMENT_SUBCOMMANDS, unknownSignalsSubcommandError, shouldColorTerminalOutput, terminalStyles, stripAnsi2 as stripAnsi, renderMarkdownForTerminal, HARNESS_REPORT_PATH, HARNESS_REPORT_APPROVAL_PATH, HARNESS_ANALYZE_CONCERNS, validateHarnessReport, readHarnessReport, hashHarnessReport, hashStableJson, startRemoteAnalyze, pollRemoteAnalyzeUntilDone, isRecoverableRemoteRun, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, renderDoctorHuman, renderStatusHuman, renderInitBanner, renderInitStep, renderInitNote, renderInitSetupPlan, renderInitComplete, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, repairExternalAnalystReport, deriveRelationshipsFromGraph, mergeDeterministicArtifacts, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, readHarnessSyncState, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId2 as stableId, titleFromId2 as titleFromId, promptNameFromPath };
+export { ApiError, callDataAPI, callControlAPI, getApiRequestCount, resetApiRequestCount, $isSeq, $parseDocument, $stringify, require_typescript, inspectCodeSelectors, inspectPythonSelectors, resolvePromptSource, backfillPromptSource, HARNESS_REPORT_PATH, HARNESS_REPORT_APPROVAL_PATH, HARNESS_ANALYZE_CONCERNS, validateHarnessReport, readHarnessReport, normalizeHarnessReport, hashHarnessReport, hashStableJson, assertFlags, assertPositionals, runUsersCommand, runUserCommand, runProblemReopenCommand, runSignalsManagementCommand, SIGNALS_MANAGEMENT_SUBCOMMANDS, unknownSignalsSubcommandError, shouldColorTerminalOutput, terminalStyles, stripAnsi2 as stripAnsi, renderMarkdownForTerminal, startRemoteAnalyze, pollRemoteAnalyzeUntilDone, isRecoverableRemoteRun, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, renderDoctorHuman, renderStatusHuman, renderInitBanner, renderInitStep, renderInitNote, renderInitSetupPlan, renderInitComplete, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, repairExternalAnalystReport, deriveRelationshipsFromGraph, mergeDeterministicArtifacts, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, readHarnessSyncState, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId2 as stableId, titleFromId2 as titleFromId, promptNameFromPath };

package/dist/{cli-ha40mgy1.js → cli-a2jq9yd5.js}

@@ -1,11 +1,18 @@
 import {
+  computePromptContentHash,
+  stableJson
+} from "./cli-mm48br00.js";
+import {
+  $isSeq,
   $parseDocument,
   $stringify,
   assertFlags,
   assertPositionals,
+  backfillPromptSource,
   callControlAPI,
   callDataAPI,
   inventoryFiles,
+  normalizeHarnessReport,
   readHarnessSyncState,
   renderDoctorHuman,
   renderStatusHuman,
@@ -13,7 +20,7 @@ import {
   resolvePromptSource,
   safePromptEvidencePath,
   scanHarness
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import {
   SKILL_SOURCE_HARNESS,
   SKILL_SOURCE_INTEGRATION_BUNDLED,
@@ -6463,6 +6470,7 @@ function checkPromptAttribution(rootDir, keys) {
 var MODA_DIR = ".moda";
 var MANIFEST_PATH = join(MODA_DIR, "prompts.yml");
 var LOCK_PATH = join(MODA_DIR, "prompts.lock.json");
+var DISCOVERY_IGNORE = ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/build/**", "**/.env*", "**/*.pem", "**/*.key"];
 var DEFAULT_PROMPT_PATHS = [
   "prompts/**/*.prompt.md",
   "prompts/**/*.prompt.json",
@@ -6473,6 +6481,7 @@ var PROMPT_WRITE_SUBCOMMAND_FLAGS = {
   init: ["from-harness"],
   status: [],
   diff: [],
+  migrate: ["dry-run", "discover"],
   sync: [
     "dry-run",
     "from-harness",
@@ -6577,18 +6586,41 @@ async function runPromptsCommand(input, legacyFlags, legacyProfileOptions) {
           kind: "prompt_manifest",
           path: init.manifestPath,
           description: init.created ? "Prompt discovery manifest created by this run." : "Prompt discovery manifest already existed; left unchanged."
-        }]
+        }],
+        ...imported?.skipped.length ? { warnings: [harnessSkipWarning(imported)] } : {}
       });
       break;
     }
-    case "status":
-      context.output.writeData(await getPromptStatus());
+    case "status": {
+      const status = await getPromptStatus();
+      const warnings = promptManifestWarnings(status);
+      context.output.writeData(status, warnings.length > 0 ? { warnings } : undefined);
       break;
+    }
+    case "migrate": {
+      assertPositionals("prompts migrate", positionals, 1, "moda prompts migrate [--dry-run] [--discover]");
+      const result = await migratePromptManifest({
+        dryRun: flags["dry-run"] === "true",
+        discover: flags.discover === "true",
+        env: profileOptions.env
+      });
+      context.output.writeData(result, {
+        summary: {
+          text: !result.changed ? `${MANIFEST_PATH} is already version 2 with nothing to add.` : `${result.dryRun ? "Would migrate" : "Migrated"} ${MANIFEST_PATH} from version ${result.fromVersion} to 2: ${result.addedPaths.length} legacy-discovered path(s), ${result.addedSources.length} discovered source(s) added.`,
+          confidence: "high"
+        },
+        ...result.changed && !result.dryRun ? {
+          artifacts: [{ kind: "prompt_manifest", path: result.manifestPath, description: "Prompt manifest rewritten to version 2." }]
+        } : {},
+        ...migrateWarnings(result).length > 0 ? { warnings: migrateWarnings(result) } : {}
+      });
+      break;
+    }
     case "diff": {
       const status = await getPromptStatus();
       const differing = status.prompts.filter((row) => row.state !== "unchanged");
       const tracked = existsSync2(MANIFEST_PATH);
-      const untrackedWarning = tracked ? [] : [
+      const diffWarnings = tracked ? promptManifestWarnings(status) : [
         `No ${MANIFEST_PATH} here, so diff has no last sync to compare against: it only covers prompts tracked by \`moda prompts sync\`${differing.length > 0 ? ", and every discovered prompt file lists as new" : ""}. For a registry manifest, preview with \`moda registry push --dry-run\`.`
       ];
       context.output.writeData({
@@ -6601,7 +6633,7 @@ async function runPromptsCommand(input, legacyFlags, legacyProfileOptions) {
           text: !tracked ? differing.length === 0 ? `Not a prompts-sync project (no ${MANIFEST_PATH}) and no prompt files found; diff has nothing to compare.` : `Not a prompts-sync project (no ${MANIFEST_PATH}): ${differing.length} discovered prompt file(s) are untracked and would be new on \`moda prompts sync\`.` : differing.length === 0 ? "No prompt differs from the last sync." : `${differing.length} prompt(s) differ from the last sync (changed ${status.changed}, new ${status.new}, deleted ${status.deleted}).`,
           confidence: "high"
         },
-        ...untrackedWarning.length > 0 ? { warnings: untrackedWarning } : {}
+        ...diffWarnings.length > 0 ? { warnings: diffWarnings } : {}
       });
       break;
     }
@@ -6625,7 +6657,7 @@ async function runPromptsCommand(input, legacyFlags, legacyProfileOptions) {
       await runPromptRegistryRead(subcommand, positionals, flags, profileOptions, context);
       break;
     default:
-      throw new Error(`Unknown prompts command '${subcommand}'. Use init, status, diff, sync, promote, ab, propose, list, show, proposals, usage, replay-runs, or decide.`);
+      throw new Error(`Unknown prompts command '${subcommand}'. Use init, status, diff, migrate, sync, promote, ab, propose, list, show, proposals, usage, replay-runs, or decide.`);
   }
   return 0;
 }
@@ -6640,7 +6672,7 @@ async function initPrompts(options = {}) {
   if (!existsSync2(MANIFEST_PATH)) {
     assertContainedSource(cwd, MODA_DIR);
     try {
-      writeFileSync2(manifestPath, ["version: 1", "prompt_paths:", ...DEFAULT_PROMPT_PATHS.map((path) => `  - "${path}"`), ""].join(`
+      writeFileSync2(manifestPath, ["version: 2", "prompt_paths:", ...DEFAULT_PROMPT_PATHS.map((path) => `  - "${path}"`), "sources: []", ""].join(`
 `), { flag: "wx" });
       created = true;
     } catch (error) {
@@ -6698,20 +6730,26 @@ async function runPromptSync(flags, profileOptions, options = {}) {
   }
 }
 async function runPromptSyncExclusive(flags, profileOptions, options) {
+  let harnessImport;
   if (flags["from-harness"] && flags["dry-run"] !== "true")
-    importHarnessPromptSources(flags["from-harness"]);
+    harnessImport = importHarnessPromptSources(flags["from-harness"]);
   if (flags["dry-run"] !== "true")
     await initPrompts({ silent: true });
   const manifest = readManifest();
   const originalManifestHash = hashFile(MANIFEST_PATH);
-  let extraSources = flags["from-harness"] && flags["dry-run"] === "true" ? readHarnessSources(flags["from-harness"]) : [];
+  let extraSources = [];
+  if (flags["from-harness"] && flags["dry-run"] === "true") {
+    const read = readHarnessSources(flags["from-harness"]);
+    extraSources = read.sources;
+    harnessImport = read.result;
+  }
   mergePromptSources(manifest.sources, extraSources);
   const established = discoverPrompts(extraSources);
   let discovery;
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-s13wvdxt.js");
+    const { analyzeHarnessPrompts } = await import("./harness-sd44jsaw.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),
@@ -6761,7 +6799,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   if (prompts.length === 0) {
     if (!dryRun && flags["allow-untrack"] === "true")
       writeLock([], []);
-    return { synced: [], dryRun, discovery, attribution };
+    return { synced: [], dryRun, discovery, attribution, ...harnessImport ? { harnessImport } : {} };
   }
   const signature = stableJson(prompts);
   const response = await callControlAPI("/prompts/sync", {
@@ -6793,7 +6831,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
       atomicWrite(MANIFEST_PATH, manifestUpdate);
     writeLock(prompts, synced);
   }
-  return { synced: response.synced ?? [], dryRun, discovery, attribution };
+  return { synced: response.synced ?? [], dryRun, discovery, attribution, ...harnessImport ? { harnessImport } : {} };
 }
 function writePromptSyncProgress(message, context, quiet = false) {
   if (quiet || context?.quiet)
@@ -6813,10 +6851,12 @@ async function syncPromptsOnce(flags, profileOptions, context) {
     synced: result.synced,
     discovery: result.discovery,
     attribution: result.attribution,
+    ...result.harnessImport ? { harnessImport: result.harnessImport } : {},
     lockfile: result.dryRun ? undefined : LOCK_PATH
   };
+  const skippedWarning = result.harnessImport?.skipped.length ? [harnessSkipWarning(result.harnessImport)] : [];
   if (context)
-    context.output.writeData(payload);
+    context.output.writeData(payload, skippedWarning.length ? { warnings: skippedWarning } : undefined);
   else
     printJson(payload);
   if (!result.dryRun && result.synced.length === 0 && result.discovery?.candidates?.length) {
@@ -6885,9 +6925,15 @@ async function getPromptStatus() {
       });
     }
   }
+  const inspection = inspectPromptManifest();
   return {
     manifest: MANIFEST_PATH,
     lockfile: LOCK_PATH,
+    manifestVersion: inspection.manifestVersion,
+    legacyManifest: inspection.legacyManifest,
+    zeroMatchPatterns: inspection.zeroMatchPatterns,
+    legacyOnlyFiles: inspection.legacyOnlyFiles,
+    sources: inspection.sources,
     total: rows.length,
     changed: rows.filter((row) => row.state === "changed").length,
     new: rows.filter((row) => row.state === "new").length,
@@ -6896,7 +6942,9 @@ async function getPromptStatus() {
   };
 }
 function discoverPrompts(extraSources = []) {
-  const manifest = readManifest();
+  return discoverManifestPrompts(readManifest(), extraSources);
+}
+function discoverManifestPrompts(manifest, extraSources = []) {
   const root = process.cwd();
   for (const pattern of manifest.promptPaths) {
     const positive = pattern.startsWith("!") ? pattern.slice(1) : pattern;
@@ -6912,7 +6960,7 @@ function discoverPrompts(extraSources = []) {
     followSymbolicLinks: false,
     dot: true,
     unique: true,
-    ignore: ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/build/**", "**/.env*", "**/*.pem", "**/*.key"]
+    ignore: DISCOVERY_IGNORE
   }).sort();
   const sources = new Map(manifest.sources.map((source) => [source.key, source]));
   for (const source of extraSources)
@@ -6934,6 +6982,185 @@ function discoverPrompts(extraSources = []) {
   }
   return prompts.sort((a, b) => a.key.localeCompare(b.key));
 }
+var LEGACY_PROMPT_SUFFIXES = [".prompt.md", ".prompt.json", ".prompt.yaml", ".prompt.yml"];
+function repoPath(root, path) {
+  return relative(root, resolve4(root, path)).replaceAll("\\", "/");
+}
+function globPromptFiles(root, patterns, ignore = []) {
+  if (patterns.length === 0)
+    return [];
+  return import_fast_glob.default.sync(patterns, {
+    cwd: root,
+    onlyFiles: true,
+    followSymbolicLinks: false,
+    dot: true,
+    unique: true,
+    ignore: [...DISCOVERY_IGNORE, ...ignore]
+  }).sort();
+}
+function inspectPromptManifest(root = process.cwd()) {
+  const manifest = readManifest(root);
+  const safe = (pattern) => !isAbsolute3(pattern) && !pattern.split(/[\\/]/).includes("..");
+  const positives = manifest.promptPaths.filter((pattern) => !pattern.startsWith("!") && safe(pattern));
+  const negations = manifest.promptPaths.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1));
+  const patterns = manifest.promptPaths.filter((pattern) => !pattern.startsWith("!")).map((pattern) => ({
+    pattern,
+    matches: safe(pattern) ? globPromptFiles(root, [pattern], negations).length : 0
+  }));
+  const matched = new Set(globPromptFiles(root, positives, negations));
+  const owned = new Set(manifest.sources.map((source) => repoPath(root, source.path)));
+  const suffixes = [...new Set(manifest.promptPaths.filter((pattern) => pattern.includes(".prompt.")).flatMap((pattern) => LEGACY_PROMPT_SUFFIXES.filter((suffix) => pattern.endsWith(suffix))))];
+  const legacySuffixes = suffixes.length ? suffixes : [".prompt.md", ".prompt.json"];
+  const tracked = manifest.version === 2 ? lockedSourcePaths(root) : null;
+  const legacyOnlyFiles = manifest.version === null ? [] : globPromptFiles(root, legacySuffixes.map((suffix) => `**/*${suffix}`), negations).filter((path) => !matched.has(path) && !owned.has(path) && (!tracked || tracked.has(path)));
+  return {
+    manifestExists: manifest.version !== null,
+    manifestVersion: manifest.version,
+    legacyManifest: manifest.version === 1,
+    patterns,
+    zeroMatchPatterns: patterns.filter((row) => row.matches === 0).map((row) => row.pattern),
+    sources: manifest.sources.length,
+    matchedFiles: matched.size,
+    legacyOnlyFiles
+  };
+}
+function lockedSourcePaths(root) {
+  const lockPath = resolve4(root, LOCK_PATH);
+  if (!existsSync2(lockPath))
+    return new Set;
+  try {
+    const lock = JSON.parse(readFileSync(lockPath, "utf8"));
+    return new Set(Object.values(lock.prompts ?? {}).filter((entry) => entry.sourcePath).map((entry) => repoPath(root, String(entry.sourcePath))));
+  } catch {
+    return new Set;
+  }
+}
+function promptManifestWarnings(inspection) {
+  if (inspection.manifestVersion === null)
+    return [];
+  const warnings = [];
+  const legacyCount = inspection.legacyOnlyFiles.length;
+  if (legacyCount > 0) {
+    const sample = inspection.legacyOnlyFiles.slice(0, 3).join(", ");
+    warnings.push(`${legacyCount} prompt file(s) (${sample}${legacyCount > 3 ? ", ..." : ""}) were discovered by older CLIs but match no ${MANIFEST_PATH} pattern now: patterns are exact globs from the repository root. Run \`moda prompts migrate --dry-run\`, then \`moda prompts migrate\`, to keep them tracked under their existing keys.`);
+  }
+  if (inspection.zeroMatchPatterns.length > 0) {
+    warnings.push(`prompt_paths pattern(s) match no files: ${inspection.zeroMatchPatterns.join(", ")}. Fix the globs (relative to the repository root), map code-defined prompts under \`sources:\`, or preview discovery with \`moda prompts sync --dry-run\`.`);
+  }
+  if (inspection.legacyManifest && warnings.length > 0) {
+    warnings.push(`${MANIFEST_PATH} is a version 1 manifest; \`moda prompts migrate\` rewrites it to version 2 (explicit prompt_paths plus a sources: list).`);
+  }
+  return warnings;
+}
+function migrateWarnings(result) {
+  const warnings = [];
+  if (result.zeroMatchPatterns.length > 0) {
+    warnings.push(`Kept prompt_paths pattern(s) that match no files: ${result.zeroMatchPatterns.join(", ")}. Fix or remove them.`);
+  }
+  if (result.pendingSources.length > 0) {
+    const sample = result.pendingSources.slice(0, 3).map((source) => source.key).join(", ");
+    warnings.push(`${result.pendingSources.length} code-defined prompt candidate(s) (${sample}${result.pendingSources.length > 3 ? ", ..." : ""}) were found but not added: --discover never runs an analyst, and code mappings need independent verification. Run \`${HARNESS_REANALYZE_COMMAND}\`, then \`moda prompts sync --from-harness\`, or map them under \`sources:\` yourself. See pendingSources.`);
+  }
+  return warnings;
+}
+async function migratePromptManifest(options = {}) {
+  const root = process.cwd();
+  const manifestPath = resolve4(root, MANIFEST_PATH);
+  if (!existsSync2(manifestPath)) {
+    throw new CliInputError(`No ${MANIFEST_PATH} to migrate in ${root}.`, "Run `moda prompts init` to create a version 2 manifest.");
+  }
+  const original = readFileSync(manifestPath, "utf8");
+  const manifest = readManifest(root);
+  const inspection = inspectPromptManifest(root);
+  const addedPaths = inspection.legacyOnlyFiles;
+  const addedPatterns = addedPaths.map((path) => import_fast_glob.default.escapePath(path));
+  const promptPaths = [...manifest.promptPaths, ...addedPatterns];
+  let sources = manifest.sources;
+  let addedSources = [];
+  let pendingSources = [];
+  if (options.discover) {
+    const { analyzeHarnessPrompts } = await import("./harness-sd44jsaw.js");
+    const result = await analyzeHarnessPrompts({
+      rootDir: root,
+      existing: manifest.sources,
+      flags: { analyst: "local-scan" },
+      env: options.env ?? process.env,
+      dryRun: true
+    });
+    const negations = promptPaths.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1));
+    const claimed = new Set([
+      ...globPromptFiles(root, promptPaths.filter((pattern) => !pattern.startsWith("!"))),
+      ...globPromptFiles(root, negations)
+    ]);
+    const existingKeys = new Set(sources.map((source) => source.key));
+    const found = result.sources.filter((source) => !existingKeys.has(source.key) && !claimed.has(repoPath(root, source.path)));
+    sources = mergePromptSources(sources, found);
+    addedSources = found.map((source) => source.key).sort();
+    pendingSources = (result.pending ?? []).filter((candidate) => !existingKeys.has(candidate.source.key) && !claimed.has(repoPath(root, candidate.source.path))).map((candidate) => ({
+      key: candidate.source.key,
+      path: candidate.source.path,
+      ...candidate.source.selector?.symbol ? { symbol: candidate.source.selector.symbol } : {},
+      reason: candidate.reason ?? "Awaiting independent semantic verification"
+    })).sort((a, b) => a.key.localeCompare(b.key));
+  }
+  try {
+    discoverManifestPrompts({ version: 2, promptPaths, sources });
+  } catch (error) {
+    throw new CliInputError(`Cannot migrate ${MANIFEST_PATH}: ${error instanceof Error ? error.message : String(error)}`, `Give the conflicting prompt a unique \`key:\` (frontmatter or ${MANIFEST_PATH} sources), then rerun \`moda prompts migrate --dry-run\`. Nothing was written.`);
+  }
+  const expected = stableJson({ version: 2, prompt_paths: promptPaths, sources });
+  const serialize = (inPlace) => {
+    const doc = $parseDocument(original, { uniqueKeys: true });
+    doc.set("version", 2);
+    const pathsNode = doc.get("prompt_paths", true);
+    if (inPlace && $isSeq(pathsNode)) {
+      for (const pattern of addedPatterns)
+        pathsNode.items.push(doc.createNode(pattern));
+    } else {
+      doc.set("prompt_paths", promptPaths);
+    }
+    const existingKeys = new Set(manifest.sources.map((source) => source.key));
+    const newSources = sources.filter((source) => !existingKeys.has(source.key));
+    const sourcesNode = doc.get("sources", true);
+    if (inPlace && $isSeq(sourcesNode)) {
+      for (const source of newSources)
+        sourcesNode.items.push(doc.createNode(source));
+    } else if (!inPlace || newSources.length > 0 || sourcesNode === undefined) {
+      doc.set("sources", sources);
+    }
+    return doc.toString();
+  };
+  const matchesExpected = (text) => {
+    const parsed = $parseDocument(text, { uniqueKeys: true }).toJS({ maxAliasCount: 20 }) ?? {};
+    return stableJson({ version: parsed.version, prompt_paths: parsed.prompt_paths ?? [], sources: parsed.sources ?? [] }) === expected;
+  };
+  let content = serialize(true);
+  if (!matchesExpected(content))
+    content = serialize(false);
+  if (!matchesExpected(content)) {
+    throw new CliInputError(`Cannot migrate ${MANIFEST_PATH}: the rewritten manifest does not round-trip (shared YAML anchors or aliases?). Nothing was written.`, `Replace anchors/aliases in prompt_paths and sources with plain lists, then rerun \`moda prompts migrate --dry-run\`.`);
+  }
+  const changed = content !== original;
+  if (!options.dryRun && changed) {
+    if (hashFile(MANIFEST_PATH) !== sha256(original))
+      throw new Error(`${MANIFEST_PATH} changed during migration. Retry.`);
+    atomicWrite(MANIFEST_PATH, content);
+  }
+  return {
+    manifest: MANIFEST_PATH,
+    manifestPath,
+    dryRun: options.dryRun === true,
+    changed,
+    fromVersion: manifest.version ?? 2,
+    toVersion: 2,
+    addedPaths,
+    addedSources,
+    pendingSources,
+    zeroMatchPatterns: inspection.zeroMatchPatterns,
+    promptPaths,
+    content
+  };
+}
 function assertContainedSource(root, path) {
   const abs = resolve4(root, path);
   const rel = relative(realpathSync(root), realpathSync(abs));
@@ -6987,18 +7214,6 @@ function parsePromptFile(absPath) {
   });
 }
 function normalizePrompt(prompt) {
-  const normalized = stableJson({
-    key: prompt.key,
-    content: prompt.content,
-    systemPrompt: prompt.systemPrompt ?? null,
-    messages: prompt.messages ?? [],
-    variables: prompt.variables ?? [],
-    variablesSchema: prompt.variablesSchema ?? {},
-    modelConfig: prompt.modelConfig ?? {},
-    toolRefs: prompt.toolRefs ?? [],
-    responseSchema: prompt.responseSchema ?? null,
-    ...prompt.sourceDefinition ? { sourceDefinition: promptSourceHashPayload(prompt.sourceDefinition) } : {}
-  });
   return {
     key: prompt.key,
     name: prompt.name || prompt.key,
@@ -7013,28 +7228,14 @@ function normalizePrompt(prompt) {
     modelConfig: prompt.modelConfig,
     toolRefs: prompt.toolRefs,
     responseSchema: prompt.responseSchema,
-    contentHash: sha256(normalized)
+    contentHash: computePromptContentHash(prompt)
   };
 }
-function promptSourceHashPayload(definition) {
-  return {
-    kind: definition.kind,
-    source: definition.source,
-    ...["text", "messages"].includes(definition.kind) ? {
-      sourceHash: definition.sourceHash
-    } : ["builder", "template"].includes(definition.kind) ? {
-      sourceHash: definition.sourceHash,
-      dependencies: definition.dependencies,
-      coverage: definition.coverage,
-      unresolved: definition.unresolved
-    } : {}
-  };
-}
-function readManifest() {
-  if (!existsSync2(MANIFEST_PATH))
-    return { promptPaths: DEFAULT_PROMPT_PATHS, sources: [] };
-  assertContainedSource(process.cwd(), MANIFEST_PATH);
-  const doc = $parseDocument(readFileSync(MANIFEST_PATH, "utf8"), { uniqueKeys: true });
+function readManifest(root = process.cwd()) {
+  if (!existsSync2(resolve4(root, MANIFEST_PATH)))
+    return { version: null, promptPaths: DEFAULT_PROMPT_PATHS, sources: [] };
+  assertContainedSource(root, MANIFEST_PATH);
+  const doc = $parseDocument(readFileSync(resolve4(root, MANIFEST_PATH), "utf8"), { uniqueKeys: true });
   if (doc.errors.length)
     throw new Error(`Invalid ${MANIFEST_PATH}: ${doc.errors[0].message}`);
   const parsed = doc.toJS({ maxAliasCount: 20 });
@@ -7055,33 +7256,96 @@ function readManifest() {
       throw new Error(`Duplicate prompt source key '${source.key}'.`);
     seen.add(source.key);
   }
-  return { promptPaths: parsed.prompt_paths ?? (parsed.version === 1 ? DEFAULT_PROMPT_PATHS : []), sources };
+  return { version: parsed.version, promptPaths: parsed.prompt_paths ?? (parsed.version === 1 ? DEFAULT_PROMPT_PATHS : []), sources };
 }
+var HARNESS_REANALYZE_COMMAND = "moda harness analyze --experimental --concern=prompts";
 function readHarnessSources(reportPath) {
   const selected = reportPath === "true" ? ".moda/harness-report.json" : reportPath;
   assertContainedSource(process.cwd(), selected);
-  const report = JSON.parse(readFileSync(resolve4(selected), "utf8"));
-  if (!Array.isArray(report?.graph?.artifacts))
-    throw new Error("Expected a harness report with graph.artifacts.");
-  const artifacts = report.graph.artifacts.filter((artifact) => artifact.type === "prompt");
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(resolve4(selected), "utf8"));
+  } catch (error) {
+    throw new CliInputError(`Could not read harness report ${selected}: ${error instanceof Error ? error.message : String(error)}.`, `Regenerate it with \`${HARNESS_REANALYZE_COMMAND}\`.`);
+  }
+  const record = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  const graph = record.graph && typeof record.graph === "object" ? record.graph : undefined;
+  const schemaVersion = typeof record.schemaVersion === "string" ? record.schemaVersion : typeof graph?.schemaVersion === "string" ? graph.schemaVersion : typeof graph?.graphSchemaVersion === "string" ? graph.graphSchemaVersion : null;
+  const schemaLabel = schemaVersion ?? "no schemaVersion";
+  if (!graph) {
+    throw new CliInputError(`${selected} is not a harness report with a graph (schema: ${schemaLabel}). Regenerate it with \`${HARNESS_REANALYZE_COMMAND}\`.`);
+  }
+  const report = normalizeHarnessReport(raw);
+  const artifacts = (report.graph.artifacts ?? []).filter((artifact) => artifact.type === "prompt");
   const sources = [];
+  const skipped = [];
+  const tracked = [];
+  const root = process.cwd();
+  const manifest = readManifest(root);
+  const negations = manifest.promptPaths.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1));
+  const globbed = new Set(globPromptFiles(root, manifest.promptPaths.filter((pattern) => !pattern.startsWith("!")), negations));
+  const ownedKeys = new Map(manifest.sources.map((source) => [repoPath(root, source.path), source.key]));
   for (const artifact of artifacts) {
-    if (!artifact.promptSource)
-      throw new Error(`Harness prompt '${artifact.name ?? artifact.id}' has no verified source mapping. Run harness analyze --concern=prompts; legacy body snippets cannot be registered.`);
-    const resolved = resolvePromptSource(process.cwd(), artifact.promptSource);
-    sources.push(resolved.sourceDefinition.source);
+    const label = String(artifact.name ?? artifact.id ?? "unnamed prompt");
+    let mapping;
+    try {
+      mapping = backfillPromptSource(process.cwd(), artifact);
+    } catch (error) {
+      skipped.push({ artifact: label, reason: `source mapping could not be derived: ${error instanceof Error ? error.message : String(error)}` });
+      continue;
+    }
+    if (!mapping) {
+      skipped.push({
+        artifact: label,
+        reason: artifact.sourcePath ? `no promptSource, and no single definition in ${artifact.sourcePath} matches its name` : "no promptSource or sourcePath (legacy body snippets cannot be registered)"
+      });
+      continue;
+    }
+    if (!artifact.promptSource && !mapping.selector) {
+      const path = repoPath(root, mapping.path);
+      const nativeFile = /\.prompt\.(md|json)$/i.test(path);
+      const ownedKey = ownedKeys.get(path);
+      if (ownedKey !== undefined || globbed.has(path)) {
+        let key = ownedKey ?? keyFromPath(path);
+        try {
+          if (ownedKey === undefined && nativeFile)
+            key = parsePromptFile(resolve4(root, path)).key;
+        } catch {}
+        tracked.push({ artifact: label, key, path });
+        continue;
+      }
+      if (nativeFile) {
+        skipped.push({
+          artifact: label,
+          reason: `${path} is a dedicated prompt file; add it to prompt_paths (\`moda prompts migrate\` adds files older CLIs discovered) so it keeps its own key and parser`
+        });
+        continue;
+      }
+      if (/\.prompt\.ya?ml$/i.test(path))
+        mapping = { ...mapping, key: keyFromPath(path) };
+    }
+    try {
+      sources.push(resolvePromptSource(process.cwd(), mapping).sourceDefinition.source);
+    } catch (error) {
+      skipped.push({ artifact: label, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  if (!sources.length && !tracked.length) {
+    const detail = skipped.length ? ` ${skipped.length} prompt artifact(s) skipped: ${skipped.slice(0, 5).map((skip) => `'${skip.artifact}' (${skip.reason})`).join("; ")}${skipped.length > 5 ? "; ..." : ""}.` : " It contains no prompt artifacts.";
+    throw new CliInputError(`Harness report ${selected} (schema: ${schemaLabel}) has no prompt that maps to current source.${detail} Regenerate it with \`${HARNESS_REANALYZE_COMMAND}\`.`, `Or map prompts directly under \`sources:\` in ${MANIFEST_PATH}.`);
   }
-  if (!sources.length)
-    throw new Error("Harness report contains no mapped prompts to register.");
-  return sources;
+  return { sources, result: { report: selected, schemaVersion, registered: sources.map((source) => source.key), skipped, tracked } };
+}
+function harnessSkipWarning(result) {
+  return `${result.skipped.length} harness prompt(s) skipped (registered ${result.registered.length}): ${result.skipped.slice(0, 3).map((skip) => `'${skip.artifact}' (${skip.reason})`).join("; ")}${result.skipped.length > 3 ? "; ..." : ""}. See harnessImport.skipped; regenerate the report with \`${HARNESS_REANALYZE_COMMAND}\` to map them.`;
 }
 function importHarnessPromptSources(reportPath = ".moda/harness-report.json") {
-  const sources = readHarnessSources(reportPath);
+  const { sources, result } = readHarnessSources(reportPath);
   const manifest = readManifest();
   const merged = mergePromptSources(manifest.sources, sources);
   discoverPrompts(sources);
   atomicWrite(MANIFEST_PATH, $stringify({ version: 2, prompt_paths: manifest.promptPaths, sources: merged }));
-  return { registered: sources.map((source) => source.key) };
+  return result;
 }
 function mergePromptSources(existingSources, sources) {
   const merged = new Map(existingSources.map((source) => [source.key, source]));
@@ -7174,17 +7438,6 @@ function getGitCommit() {
     return;
   }
 }
-function stableJson(value) {
-  return JSON.stringify(sortJson(value));
-}
-function sortJson(value) {
-  if (Array.isArray(value))
-    return value.map(sortJson);
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sortJson(item)]));
-  }
-  return value;
-}
 function sha256(input) {
   return createHash("sha256").update(input).digest("hex");
 }
@@ -7304,6 +7557,9 @@ function renderFixesBlock() {
     "- Propose the change in the code, prompt, tool definition, or skill that",
     "  causes the issue, and cite the Moda problem or trace ids it is based on",
     "  in the PR description.",
+    "- Prompts live in `.moda/prompts.yml` (version 2: `prompt_paths` globs plus",
+    "  `sources:` mappings for prompts defined in code); after `moda prompts sync`,",
+    "  pass `prompt: lock.prompts['<key>']` to createThinkTelemetry/createAI7Telemetry.",
     "- After the fix ships, record it with",
     "  `moda problem-feedback <problem_id> --action=mark_fixed`; if the issue",
     "  is detected again, the Problem comes back.",
@@ -8315,10 +8571,7 @@ async function buildDoctorReport(context, options) {
   });
   checks.push(harnessCurrentCheck(context.cwd, manifestPath, manifestExists, tenantId));
   checks.push(harnessSyncStateCheck(context.cwd));
-  checks.push(discoveryCheck("prompts_discovered", "harness", "Prompts are discovered", context.cwd, [
-    "prompts",
-    ".moda/prompts.yml"
-  ], "moda prompts init"));
+  checks.push(promptsDiscoveredCheck(context.cwd));
   checks.push(discoveryCheck("skills_discovered", "harness", "Skills are discovered", context.cwd, [
     "skills",
     ".claude/skills",
@@ -8588,6 +8841,56 @@ function harnessSyncStateCheck(cwd) {
     ]
   };
 }
+function promptsDiscoveredCheck(cwd) {
+  const base = { id: "prompts_discovered", group: "harness", title: "Prompts are discovered" };
+  if (!existsSync5(join4(cwd, ".moda", "prompts.yml"))) {
+    return discoveryCheck(base.id, base.group, base.title, cwd, ["prompts", ".moda/prompts.yml"], "moda prompts init");
+  }
+  let inspection;
+  try {
+    inspection = inspectPromptManifest(cwd);
+  } catch (error) {
+    return {
+      ...base,
+      status: "fail",
+      severity: "warning",
+      evidence: [{ label: "manifest", value: ".moda/prompts.yml" }, { label: "error", value: error instanceof Error ? error.message : String(error) }],
+      remediation: "Fix .moda/prompts.yml (version, prompt_paths, sources).",
+      nextCommand: "moda prompts status"
+    };
+  }
+  const evidence = [
+    { label: "manifest", value: `.moda/prompts.yml (version ${inspection.manifestVersion})` },
+    { label: "matched_files", value: String(inspection.matchedFiles) },
+    { label: "sources", value: String(inspection.sources) },
+    ...inspection.zeroMatchPatterns.length > 0 ? [{ label: "zero_match_patterns", value: inspection.zeroMatchPatterns.join(", ") }] : [],
+    ...inspection.legacyOnlyFiles.length > 0 ? [{
+      label: "legacy_only_files",
+      value: `${inspection.legacyOnlyFiles.length} (${inspection.legacyOnlyFiles.slice(0, 3).join(", ")}${inspection.legacyOnlyFiles.length > 3 ? ", ..." : ""})`
+    }] : []
+  ];
+  if (inspection.legacyOnlyFiles.length > 0) {
+    return {
+      ...base,
+      status: "warning",
+      severity: "warning",
+      evidence,
+      remediation: "Prompt files found by older CLIs no longer match the manifest globs (they are exact paths from the repository root). Migrate the manifest to keep them tracked under their existing keys.",
+      nextCommand: "moda prompts migrate --dry-run"
+    };
+  }
+  if (inspection.matchedFiles === 0 && inspection.sources === 0) {
+    return {
+      ...base,
+      status: "warning",
+      severity: "warning",
+      evidence,
+      remediation: "The prompt manifest matches no files and maps no sources, so sync registers nothing. Fix prompt_paths or preview source discovery.",
+      nextCommand: "moda prompts sync --dry-run"
+    };
+  }
+  return { ...base, status: "pass", severity: "info", evidence };
+}
 function discoveryCheck(id, group, title, cwd, relativePaths, nextCommand) {
   const found = relativePaths.filter((path) => existsSync5(join4(cwd, path)));
   return {
@@ -8884,7 +9187,7 @@ function agentPurposeForCommand(command) {
   return "Inspect or repair Moda setup.";
 }
 function stableGraphHash(graph) {
-  return createHash3("sha256").update(JSON.stringify(sortJson2({
+  return createHash3("sha256").update(JSON.stringify(sortJson({
     ...graph,
     scan: {
       ...graph.scan,
@@ -8894,11 +9197,11 @@ function stableGraphHash(graph) {
     }
   }))).digest("hex");
 }
-function sortJson2(value) {
+function sortJson(value) {
   if (Array.isArray(value))
-    return value.map((item) => sortJson2(item));
+    return value.map((item) => sortJson(item));
   if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sortJson2(item)]));
+    return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sortJson(item)]));
   }
   return value;
 }

package/dist/cli-mm48br00.js

@@ -0,0 +1,47 @@
+// src/prompt-hash.ts
+import { createHash } from "node:crypto";
+var PROMPT_HASH_VERSION = 1;
+function promptSourceHashPayload(definition) {
+  return {
+    kind: definition.kind,
+    source: definition.source,
+    ...["text", "messages"].includes(definition.kind) ? {
+      sourceHash: definition.sourceHash
+    } : ["builder", "template"].includes(definition.kind) ? {
+      sourceHash: definition.sourceHash,
+      dependencies: definition.dependencies,
+      coverage: definition.coverage,
+      unresolved: definition.unresolved
+    } : {}
+  };
+}
+function stableJson(value) {
+  return JSON.stringify(sortJson(value));
+}
+function sortJson(value) {
+  if (Array.isArray(value))
+    return value.map(sortJson);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sortJson(item)]));
+  }
+  return value;
+}
+function promptContentHashPayload(prompt) {
+  return stableJson({
+    key: prompt.key,
+    content: prompt.content,
+    systemPrompt: prompt.systemPrompt ?? null,
+    messages: prompt.messages ?? [],
+    variables: prompt.variables ?? [],
+    variablesSchema: prompt.variablesSchema ?? {},
+    modelConfig: prompt.modelConfig ?? {},
+    toolRefs: prompt.toolRefs ?? [],
+    responseSchema: prompt.responseSchema ?? null,
+    ...prompt.sourceDefinition ? { sourceDefinition: promptSourceHashPayload(prompt.sourceDefinition) } : {}
+  });
+}
+function computePromptContentHash(prompt) {
+  return createHash("sha256").update(promptContentHashPayload(prompt)).digest("hex");
+}
+
+export { PROMPT_HASH_VERSION, promptSourceHashPayload, stableJson, promptContentHashPayload, computePromptContentHash };

package/dist/cli.js

@@ -8,7 +8,8 @@ import {
   runPromptsCommand,
   runSkillsCommand,
   runStatusCommand
-} from "./cli-ha40mgy1.js";
+} from "./cli-a2jq9yd5.js";
+import"./cli-mm48br00.js";
 import {
   ApiError,
   HARNESS_REPORT_APPROVAL_PATH,
@@ -37,7 +38,7 @@ import {
   terminalStyles,
   unknownSignalsSubcommandError,
   validateHarnessReport
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import"./cli-ssfq84k5.js";
 import {
   authFetch,
@@ -2000,6 +2001,20 @@ function nextCommandsFor(fix) {
         }
       ];
     case "UNROUTED":
+      return [
+        {
+          command: `moda fix ${fix.id} --packet`,
+          purpose: "Read the investigation packet — this fix is deliverable as diagnosis.",
+          mutability: "read",
+          requires_approval: false
+        },
+        {
+          command: "moda prompts status",
+          purpose: "If the reason says evidence carries no prompt version: check the prompt lockfile, then pass prompt: lock.prompts['<key>'] to createThinkTelemetry / createAI7Telemetry (docs.moda.dev/prompt-management/attribution).",
+          mutability: "read",
+          requires_approval: false
+        }
+      ];
     case "NO_EVIDENCE":
     case "BLOCKED_COVERAGE":
     case "NO_HEADROOM":
@@ -7963,9 +7978,10 @@ Commands:
   --signal=conversations = --signal=traces. <conversation_id> is the trace ID.
 
   Prompt management:
-  prompts init                     Create .moda/prompts.yml
-  prompts status                   Show local prompt changes
+  prompts init                     Create .moda/prompts.yml (version 2: prompt_paths + sources)
+  prompts status                   Show local prompt changes; warns on globs that match nothing
   prompts diff                     Only changed/new/deleted prompts since last sync
+  prompts migrate [--dry-run]      Rewrite a version 1 .moda/prompts.yml to version 2
   prompts sync                     Analyze prompt sources and upload versions
   prompts sync --watch             Upload again when prompt files change
   prompts list|show|proposals|usage|replay-runs|decide
@@ -10132,7 +10148,7 @@ async function runCommand(command, positional, flags, positionals = positional ?
 function telemetryCommandName(definition) {
   return definition.telemetryCommand ?? definition.name;
 }
-var OFFLINE_PROMPTS_SUBCOMMANDS = new Set(["init", "status", "diff"]);
+var OFFLINE_PROMPTS_SUBCOMMANDS = new Set(["init", "status", "diff", "migrate"]);
 function legacyCommand(metadata) {
   return {
     ...metadata,
@@ -10226,7 +10242,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result",
     handler: async (context) => {
-      const { runInit } = await import("./index-pykaaezb.js");
+      const { runInit } = await import("./index-hn9t95tr.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",
@@ -10980,18 +10996,18 @@ var commandRegistry = createCommandRegistry([
   legacyCommand({
     name: "prompts",
     description: "Manage prompt versions and labels",
-    examples: ["moda prompts init", "moda prompts status", "moda prompts sync", "moda prompts ab --baseline=old.md --candidate=new.md"],
+    examples: ["moda prompts init", "moda prompts status", "moda prompts migrate --dry-run", "moda prompts sync", "moda prompts ab --baseline=old.md --candidate=new.md"],
     subcommands: [
       {
         name: "init",
-        description: "Create .moda/prompts.yml in the current directory (never overwrites)",
+        description: "Create a version 2 .moda/prompts.yml in the current directory (never overwrites). prompt_paths are exact fast-glob patterns from the repository root; sources: maps prompts defined in code (key, path, selector.symbol|pointer, kind, dependencies).",
         usage: "moda prompts init [--from-harness=<report>]",
-        flags: [{ name: "--from-harness=<report>", description: "Register verified source mappings from a harness report; source files stay in place." }],
+        flags: [{ name: "--from-harness=<report>", description: "Register verified source mappings from a harness report (older reports are normalized; prompts without a promptSource are mapped from sourcePath when unambiguous). Unresolvable prompts are returned in imported.skipped with reasons; source files stay in place." }],
         examples: ["moda prompts init", "cd /path/to/project && moda prompts init"]
       },
       {
         name: "status",
-        description: "Show prompt files that changed since the last sync",
+        description: "Show prompt files that changed since the last sync. Also reports prompt_paths patterns that match no files (zeroMatchPatterns) and files only older CLIs discovered (legacyOnlyFiles), with a warning pointing at `moda prompts migrate`.",
         usage: "moda prompts status",
         examples: ["moda prompts status"]
       },
@@ -11001,6 +11017,16 @@ var commandRegistry = createCommandRegistry([
         usage: "moda prompts diff",
         examples: ["moda prompts diff"]
       },
+      {
+        name: "migrate",
+        description: "Rewrite .moda/prompts.yml to version 2: keeps every pattern and source, adds explicit paths for prompt files only the older repo-wide discovery matched (so their lockfile keys keep resolving), and ensures a sources: list. Comments are kept; the write is atomic.",
+        usage: "moda prompts migrate [--dry-run] [--discover]",
+        flags: [
+          { name: "--dry-run", description: "Print the migrated manifest without writing it." },
+          { name: "--discover", description: "Also scan for code-defined prompts (deterministic, no agent calls). Adds only mappings that need no semantic verification; other candidates are listed under pendingSources with the command that verifies them." }
+        ],
+        examples: ["moda prompts migrate --dry-run", "moda prompts migrate", "moda prompts migrate --discover"]
+      },
       {
         name: "sync",
         description: "Analyze prompt sources and upload verified versions to Moda Cloud",
@@ -11009,7 +11035,7 @@ var commandRegistry = createCommandRegistry([
           { name: "--analyst=local-scan|claude|codex|cursor|auto", description: "Defaults to auto: deterministic discovery, installed-agent extension, and independent verification. Use local-scan for no agent calls." },
           { name: "--assist=none", description: "Disable agent fallback, including with an explicit analyst." },
           { name: "--no-analyze", description: "Skip discovery and sync only configured sources." },
-          { name: "--from-harness=<report>", description: "Read and register harness prompt source mappings before sync." },
+          { name: "--from-harness=<report>", description: "Read and register harness prompt source mappings before sync; unresolvable prompts are listed in harnessImport.skipped. Fails only when none resolve (regenerate with `moda harness analyze --experimental --concern=prompts`)." },
           { name: "--allow-untrack", description: "Explicitly remove missing keys from local tracking; registry history remains." },
           { name: "--watch", description: "Analyze before syncing; re-upload when mapped prompt files change." },
           { name: "--dry-run", description: "Preview without saving mappings or registry versions; deterministic unless an analyst is explicitly selected." }

package/dist/{harness-github-actions-gbty3k66.js → harness-github-actions-075xzdvp.js}

@@ -1,6 +1,6 @@
 import {
   buildSourceSnapshot
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import"./cli-ac3p2byq.js";
 import"./cli-0v6na3yp.js";
 

package/dist/{harness-s13wvdxt.js → harness-sd44jsaw.js}

@@ -42,7 +42,7 @@ import {
   writeHarnessAnalyzeResult,
   writeHarnessArtifacts,
   writeHumanProgress
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import"./cli-ac3p2byq.js";
 import"./cli-0v6na3yp.js";
 export {

package/dist/{index-pykaaezb.js → index-hn9t95tr.js}

@@ -3,7 +3,8 @@ import {
   initPrompts,
   runPromptSync,
   runSkillSync
-} from "./cli-ha40mgy1.js";
+} from "./cli-a2jq9yd5.js";
+import"./cli-mm48br00.js";
 import {
   codingAgentDisplayName,
   describeCodingAgentEvent,
@@ -22,7 +23,7 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import {
   bundledSkillsDir,
   installIntegrationSkill,

package/dist/prompt-hash.d.ts

@@ -0,0 +1,36 @@
+/** Version of the canonicalization below. Bump on ANY change to the hashed payload. */
+export declare const PROMPT_HASH_VERSION: 1;
+/** The typed-source definition fields that participate in the hash. */
+export interface PromptHashSourceDefinition {
+    kind: string;
+    source: unknown;
+    sourceHash?: string;
+    dependencies?: unknown;
+    coverage?: unknown;
+    unresolved?: unknown;
+}
+/** Hashed prompt fields; anything else on the object is ignored. */
+export interface PromptHashInput {
+    key: string;
+    content: string;
+    systemPrompt?: string | null;
+    messages?: unknown[] | null;
+    variables?: unknown[] | null;
+    variablesSchema?: Record<string, unknown> | null;
+    modelConfig?: Record<string, unknown> | null;
+    toolRefs?: unknown[] | null;
+    responseSchema?: Record<string, unknown> | null;
+    sourceDefinition?: PromptHashSourceDefinition | null;
+}
+/**
+ * The subset of a typed source definition that is hashed: text/messages hash
+ * their extracted source; builders/templates also hash dependency
+ * fingerprints and coverage, so a fragment edit mints a new version.
+ */
+export declare function promptSourceHashPayload(definition: PromptHashSourceDefinition): Record<string, unknown>;
+/** JSON.stringify with every object's keys sorted by localeCompare, recursively. */
+export declare function stableJson(value: unknown): string;
+/** The exact string that is hashed (exposed for debugging hash mismatches). */
+export declare function promptContentHashPayload(prompt: PromptHashInput): string;
+/** Lowercase hex SHA-256 of {@link promptContentHashPayload}: the lockfile `contentHash`. */
+export declare function computePromptContentHash(prompt: PromptHashInput): string;

package/dist/prompt-hash.js

@@ -0,0 +1,15 @@
+import {
+  PROMPT_HASH_VERSION,
+  computePromptContentHash,
+  promptContentHashPayload,
+  promptSourceHashPayload,
+  stableJson
+} from "./cli-mm48br00.js";
+import"./cli-0v6na3yp.js";
+export {
+  stableJson,
+  promptSourceHashPayload,
+  promptContentHashPayload,
+  computePromptContentHash,
+  PROMPT_HASH_VERSION
+};

package/dist/prompt-source-mcp.js

@@ -5,7 +5,7 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors,
   safePromptEvidencePath
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import"./cli-ac3p2byq.js";
 import {
   __commonJS,

package/package.json

@@ -1,12 +1,20 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.52.0",
+  "version": "1.54.0",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {
     "cli": "./dist/cli.js",
     "moda": "./dist/cli.js"
   },
+  "exports": {
+    "./prompt-hash": {
+      "types": "./dist/prompt-hash.d.ts",
+      "import": "./dist/prompt-hash.js"
+    },
+    "./package.json": "./package.json",
+    "./*": "./*"
+  },
   "files": [
     "dist/**/*.js",
     "dist/**/*.d.ts",
@@ -21,7 +29,7 @@
   "scripts": {
     "bundle:skills": "bun scripts/bundle-skills.ts",
     "export:admin-manifest": "bun scripts/export-admin-command-manifest.ts",
-    "build": "bun run bundle:skills && tsc --noEmit && bun build ./src/cli.ts ./src/prompt-source-mcp.ts --target=node --format=esm --outdir=dist --splitting --external @inquirer/prompts --external open --external zod",
+    "build": "bun run bundle:skills && tsc --noEmit && tsc -p tsconfig.prompt-hash.json && bun build ./src/cli.ts ./src/prompt-source-mcp.ts ./src/prompt-hash.ts --target=node --format=esm --outdir=dist --splitting --external @inquirer/prompts --external open --external zod",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
     "test": "bun run bundle:skills && vitest run",

package/skills/integration/index.json

@@ -1,11 +1,11 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-12T06:24:12.441Z",
-  "cli_version": "1.52.0",
+  "bundled_at": "2026-10-12T07:41:12.130Z",
+  "cli_version": "1.54.0",
   "skills": [
     {
       "id": "integration-cloudflare-think",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "summary": "Instrument Think on Workers with AI SDK 7, prompt versions, and acknowledged JSON export.",
       "targets": {
         "language": "node",

package/skills/integration/integration-cloudflare-think/SKILL.md

@@ -1,7 +1,7 @@
 ---
 id: integration-cloudflare-think
 name: "Integrate Moda with Cloudflare Think"
-version: 1.1.0
+version: 1.1.1
 category: integration
 targets:
   language: node
@@ -94,7 +94,10 @@ the correct definition was registered.
 Keep memory and variable substitutions separate from reusable template
 versions. Think adds instructions/tools: verify actual system instructions
 on each model span as well as the registry definition.
-Reference: https://docs.moda.dev/prompt-management/attribution
+Reference: https://docs.moda.dev/prompt-management/attribution#cloudflare-think-and-ai-sdk-7
+and, for `.moda/prompts.yml` `sources:` mappings, https://docs.moda.dev/prompt-management/workflow#map-prompts-defined-in-code.
+Without the `prompt` option no trace carries a prompt version, so prompt fixes
+land `UNROUTED` ("top share 0%").
 
 ## 5. Validate through the original application route
 

package/skills/moda-cli/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: moda-cli
-version: 2.7.0
+version: 2.8.0
 description: Query Moda's AI agent trace analytics and manage code-first prompt versions from the terminal — semantic/keyword/hybrid message search, overview KPIs, topic clusters, message context, user frustration detections, tool failures, custom signals, false-positive review of detections, and moda prompts status/sync/promote. Use when the user asks about moda, modaflows, trace or conversation analytics, prompt management, user frustrations, agent observability, tool failure debugging, custom signals, marking a detection as a false positive, wants to find traces or tool calls about a topic, or wants to investigate how their AI agent is performing.
 ---
 
@@ -773,17 +773,63 @@ dropped and `truncation.data.full_output_path` holds every example. Agent output
 Use these only when working on the code-first prompt registry.
 
 ```bash
-moda prompts init                               # create .moda/prompts.yml
-moda prompts status                             # read-only local status
+moda prompts init                               # create .moda/prompts.yml (version 2)
+moda prompts status                             # read-only local status + manifest warnings
 moda prompts diff                               # only changed/new/deleted since last sync
+moda prompts migrate --dry-run                  # preview a version 1 -> 2 manifest rewrite
+moda prompts migrate                            # apply it (atomic; comments kept)
+moda prompts sync --dry-run                     # preview discovery + what would upload
 moda prompts sync                               # upload changed prompt versions
+moda prompts sync --from-harness                # register mappings from .moda/harness-report.json first
 moda prompts sync --watch                       # sync when local prompt hashes change
 moda prompts promote support.triage --label=prod --version=pver_abc123
 ```
 
-`status` and `diff` are read-only. `sync` uploads prompt versions and writes
-`.moda/prompts.lock.json`. `promote` moves a remote `dev`, `staging`, or
-`prod` label to an existing version.
+`status`, `diff` and `migrate --dry-run` are read-only. `sync` uploads prompt
+versions and writes `.moda/prompts.lock.json`. `promote` moves a remote `dev`,
+`staging`, or `prod` label to an existing version.
+
+`.moda/prompts.yml` (version 2) has two ways to point at prompts:
+
+```yaml
+version: 2
+prompt_paths:                 # exact fast-glob patterns from the repo root
+  - "prompts/**/*.prompt.md"
+  - "!prompts/archive/**"
+sources:                      # prompts defined in code or config, mapped in place
+  - key: support.system       # stable registry key (also the lockfile key)
+    path: src/agent.ts
+    selector: { symbol: SYSTEM_PROMPT }    # or { pointer: /support/prompt } for JSON/YAML
+  - key: support.build
+    path: src/prompt.py
+    selector: { symbol: build_prompt }
+    kind: builder             # text | messages | template | builder
+    dependencies:
+      - path: config/policy.txt
+```
+
+- `prompts status` returns `zeroMatchPatterns` (globs that match nothing),
+  `legacyOnlyFiles` and `legacyManifest`. A non-empty `legacyOnlyFiles` means a
+  manifest from an older CLI: those files used to sync (old discovery matched
+  `*.prompt.*` anywhere) but match nothing now. Run `moda prompts migrate
+  --dry-run`, then `moda prompts migrate`; it adds them as explicit paths so
+  their keys and lockfile entries are unchanged (`--discover` also scans for
+  code-defined prompts, but lists unverified ones under `pendingSources`
+  instead of adding them; verify those with `moda harness analyze
+  --experimental --concern=prompts`, then `sync --from-harness`). `moda
+  doctor` reports the same condition on its `prompts_discovered` check.
+- `sync --from-harness` registers what resolves and lists the rest in
+  `harnessImport.skipped` with reasons; it fails only when nothing resolves
+  (regenerate with `moda harness analyze --experimental --concern=prompts`).
+- Lockfile `contentHash` is `computePromptContentHash` from
+  `@moda-ai/cli/prompt-hash` (`PROMPT_HASH_VERSION` 1). Don't reimplement it.
+
+To attribute runtime calls, stamp the lock entry `{ key, promptId, versionId }`
+on telemetry. With Cloudflare Think / AI SDK 7, pass
+`prompt: lock.prompts['<key>']` to `createThinkTelemetry` (`moda-ai/think`) or
+`createAI7Telemetry` (`moda-ai/ai7`). A `moda fix` that lands `UNROUTED` with
+"top share 0%" means the evidence carries no prompt version: wire this up,
+then check `moda prompts status`.
 
 `prompts ab` and `prompts propose --gate` run paid replays. Before sending
 anything they compute planned playouts (cases × seeds × 2 arms) and print it