@moda-ai/cli 1.55.10 → 1.55.11

package/dist/cli-11fevr8y.js

@@ -0,0 +1,811 @@
+import {
+  isAuthSessionValid,
+  loadAuthSession
+} from "./cli-t4jjhn3g.js";
+import {
+  inspectPromptManifest
+} from "./cli-fq7kk77e.js";
+import {
+  readHarnessSyncState,
+  renderDoctorHuman,
+  renderStatusHuman,
+  scanHarness
+} from "./cli-m857n028.js";
+import {
+  callDataAPI
+} from "./cli-tmqd1f0m.js";
+import {
+  ensureSecretFilePermissions,
+  getActiveProfile,
+  getModaPaths,
+  isLoopbackBaseUrl,
+  loadProfileConfig,
+  recordApiRequest,
+  resolveApiKey,
+  resolveIngestUrl,
+  resolveModaBaseUrl,
+  resolveSecretReference,
+  resolveTenantId,
+  secretFilePathFromRef
+} from "./cli-429zt7g4.js";
+
+// src/doctor.ts
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+async function runDoctorCommand(context) {
+  const report = await buildDoctorReport(context, {
+    offline: context.flags.offline === "true"
+  });
+  if (context.outputMode === "human") {
+    if (!context.quiet)
+      console.log(renderDoctorHuman(report));
+    return { exitCode: 0 };
+  }
+  context.output.writeData(report, {
+    status: report.summary.fail > 0 ? "error" : "success",
+    ...doctorAgentWriteOptions(report, "doctor")
+  });
+  return { exitCode: 0 };
+}
+async function runStatusCommand(context) {
+  const report = await buildDoctorReport(context, {
+    offline: context.flags.offline === "true" || context.flags.online !== "true"
+  });
+  const topBroken = firstBrokenCheck(report.checks);
+  const statusPayload = {
+    schemaVersion: "status.v0.1",
+    generatedAt: report.generatedAt,
+    status: report.summary.status,
+    activeProfile: report.profile.active,
+    auth: {
+      apiKey: resolveApiKey() ? "configured" : "missing"
+    },
+    workspace: {
+      tenantId: resolveTenantId() ?? null,
+      baseUrl: resolveModaBaseUrl(),
+      ingestUrl: resolveIngestUrl()
+    },
+    dataFlow: checkStatus(report.checks, "cloud_data_flow"),
+    harness: checkStatus(report.checks, "harness_manifest_current"),
+    harnessSync: checkStatus(report.checks, "harness_sync_state_present"),
+    harnessReport: "skipped",
+    shadowSpark: "skipped",
+    prompts: checkStatus(report.checks, "prompts_discovered"),
+    skills: checkStatus(report.checks, "skills_discovered"),
+    topBrokenCheck: topBroken ? {
+      id: topBroken.id,
+      status: topBroken.status,
+      severity: topBroken.severity,
+      nextCommand: topBroken.nextCommand
+    } : null,
+    nextCommands: report.nextCommands.slice(0, 3)
+  };
+  if (context.outputMode === "human") {
+    if (!context.quiet)
+      console.log(renderStatusHuman(statusPayload));
+    return { exitCode: 0 };
+  }
+  context.output.writeData(statusPayload, {
+    status: report.summary.fail > 0 ? "error" : "success",
+    ...doctorAgentWriteOptions(report, "status")
+  });
+  return { exitCode: 0 };
+}
+async function buildDoctorReport(context, options) {
+  const checks = [];
+  const profileConfig = loadProfileConfig({ env: context.env });
+  const activeProfile = getActiveProfile({ profile: context.profile, env: context.env });
+  const paths = getModaPaths({ env: context.env });
+  const profileOptions = { profile: context.profile, env: context.env };
+  const apiKey = resolveApiKey(profileOptions);
+  const tenantId = resolveTenantId(profileOptions);
+  const baseUrl = resolveModaBaseUrl(profileOptions);
+  const ingestUrl = resolveIngestUrl(profileOptions);
+  checks.push({
+    id: "active_profile_resolves",
+    group: "config",
+    title: "Active profile resolves",
+    status: activeProfile ? "pass" : "fail",
+    severity: activeProfile ? "info" : "critical",
+    evidence: [
+      { label: "active_profile", value: profileConfig.active_profile },
+      { label: "environment", value: activeProfile.environment }
+    ],
+    remediation: activeProfile ? undefined : "Create or select a Moda profile.",
+    nextCommand: activeProfile ? undefined : "moda profiles list"
+  });
+  checks.push({
+    id: "api_key_resolves",
+    group: "config",
+    title: "API key resolves",
+    status: apiKey ? "pass" : "fail",
+    severity: apiKey ? "info" : "critical",
+    evidence: [{ label: "source", value: apiKey ? "environment/profile/config" : "none" }],
+    remediation: apiKey ? undefined : "Authenticate and create a tenant API key.",
+    nextCommand: apiKey ? undefined : "moda init"
+  });
+  checks.push({
+    id: "tenant_resolves",
+    group: "config",
+    title: "Tenant/workspace resolves",
+    status: tenantId ? "pass" : "warning",
+    severity: tenantId ? "info" : "warning",
+    evidence: [{ label: "tenant_id", value: tenantId ? "configured" : "missing" }],
+    remediation: tenantId ? undefined : "Select a tenant during init or set MODA_TENANT_ID.",
+    nextCommand: tenantId ? undefined : "moda init"
+  });
+  checks.push(authTokenCheck(context, Boolean(apiKey)));
+  checks.push(configPermissionCheck(paths.legacyConfigPath));
+  if (activeProfile.api_key_ref) {
+    const secretPath = secretFilePathFromRef(activeProfile.api_key_ref);
+    if (secretPath)
+      checks.push(secretPermissionCheck(secretPath));
+    checks.push({
+      id: "profile_api_key_ref_resolves",
+      group: "config",
+      title: "Profile API key reference resolves",
+      status: resolveSecretReference(activeProfile.api_key_ref) ? "pass" : "warning",
+      severity: "warning",
+      evidence: [{ label: "api_key_ref", value: activeProfile.api_key_ref }],
+      remediation: "Create or update the profile API key reference.",
+      nextCommand: "moda profiles create"
+    });
+  }
+  checks.push(urlCheck("base_url_valid", "config", "Base URL is valid", baseUrl));
+  checks.push(urlCheck("ingest_url_valid", "config", "Ingest URL is valid", ingestUrl));
+  checks.push(localBaseUrlCheck(activeProfile.environment, baseUrl));
+  const manifestPath = join(context.cwd, ".moda", "harness.json");
+  const manifestExists = existsSync(manifestPath);
+  checks.push({
+    id: "harness_manifest_exists",
+    group: "harness",
+    title: "Harness manifest exists",
+    status: manifestExists ? "pass" : "warning",
+    severity: manifestExists ? "info" : "warning",
+    evidence: [{ label: "path", value: ".moda/harness.json" }],
+    remediation: manifestExists ? undefined : "Run `moda harness scan --summary` to scan the project and write a harness manifest.",
+    nextCommand: manifestExists ? undefined : "moda harness scan --summary"
+  });
+  checks.push(harnessCurrentCheck(context.cwd, manifestPath, manifestExists, tenantId));
+  checks.push(harnessSyncStateCheck(context.cwd));
+  checks.push(promptsDiscoveredCheck(context.cwd));
+  checks.push(discoveryCheck("skills_discovered", "harness", "Skills are discovered", context.cwd, [
+    "skills",
+    ".claude/skills",
+    ".cursor/rules"
+  ], "moda skills pull"));
+  checks.push(discoveryCheck("evals_discovered", "harness", "Evals/tests are discovered", context.cwd, [
+    "evals",
+    "tests",
+    "__tests__"
+  ]));
+  checks.push(validationEventPathCheck(ingestUrl));
+  if (options.offline || !apiKey) {
+    checks.push(...offlineCloudChecks(options.offline));
+  } else {
+    checks.push(...await cloudDataFlowChecks(ingestUrl, apiKey));
+  }
+  const nextCommands = nextCommandsForChecks(checks);
+  const summary = summarizeChecks(checks);
+  return {
+    schemaVersion: "doctor.v0.1",
+    generatedAt: new Date().toISOString(),
+    profile: {
+      active: activeProfile.name,
+      requested: context.profile
+    },
+    summary,
+    checks,
+    nextCommands,
+    fixPlan: checks.filter((check) => check.status === "fail" || check.status === "warning").map((check) => ({
+      checkId: check.id,
+      command: check.nextCommand,
+      action: check.remediation ?? "Review this diagnostic."
+    }))
+  };
+}
+function authTokenCheck(context, hasApiKey) {
+  const session = loadAuthSession({
+    profile: context.profile,
+    env: context.env,
+    includeExpired: true
+  });
+  const valid = isAuthSessionValid(session);
+  if (!valid && hasApiKey) {
+    return {
+      id: "auth_token_valid",
+      group: "config",
+      title: "Browser auth token is valid",
+      status: "skipped",
+      severity: "info",
+      evidence: [{ label: "reason", value: "api key configured" }]
+    };
+  }
+  return {
+    id: "auth_token_valid",
+    group: "config",
+    title: "Browser auth token is valid",
+    status: valid ? "pass" : "warning",
+    severity: valid ? "info" : "warning",
+    evidence: [
+      { label: "token", value: session ? "present" : "missing" },
+      ...session ? [{ label: "expires_at", value: new Date(session.expires_at * 1000).toISOString() }] : []
+    ],
+    remediation: valid ? undefined : "Refresh browser authentication.",
+    nextCommand: valid ? undefined : "moda init"
+  };
+}
+function configPermissionCheck(path) {
+  if (!existsSync(path)) {
+    return {
+      id: "config_file_permissions",
+      group: "config",
+      title: "Config file permissions",
+      status: "skipped",
+      severity: "info",
+      evidence: [{ label: "path", value: path }]
+    };
+  }
+  const permission = ensureSecretFilePermissions(path);
+  return {
+    id: "config_file_permissions",
+    group: "config",
+    title: "Config file permissions",
+    status: permission.secure ? "pass" : "fail",
+    severity: permission.secure ? "info" : "critical",
+    evidence: [
+      { label: "path", value: path },
+      { label: "mode", value: permission.mode ?? "unknown" }
+    ],
+    remediation: permission.secure ? undefined : "Restrict config file permissions to the current user."
+  };
+}
+function secretPermissionCheck(path) {
+  const permission = ensureSecretFilePermissions(path);
+  return {
+    id: "secret_file_permissions",
+    group: "config",
+    title: "Secret file permissions",
+    status: permission.secure ? "pass" : "fail",
+    severity: permission.secure ? "info" : "critical",
+    evidence: [
+      { label: "path", value: path },
+      { label: "mode", value: permission.mode ?? "unknown" }
+    ],
+    remediation: permission.secure ? undefined : "Restrict secret file permissions to the current user."
+  };
+}
+function urlCheck(id, group, title, value) {
+  let valid = false;
+  try {
+    const parsed = new URL(value);
+    valid = parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    valid = false;
+  }
+  return {
+    id,
+    group,
+    title,
+    status: valid ? "pass" : "fail",
+    severity: valid ? "info" : "critical",
+    evidence: [{ label: "url", value }],
+    remediation: valid ? undefined : "Configure a valid http(s) URL.",
+    nextCommand: valid ? undefined : "moda profiles create"
+  };
+}
+function localBaseUrlCheck(environment, baseUrl) {
+  if (environment !== "local") {
+    return {
+      id: "local_base_url_frontend",
+      group: "config",
+      title: "Local base URL targets the frontend",
+      status: "skipped",
+      severity: "info",
+      evidence: [{ label: "environment", value: environment }]
+    };
+  }
+  let port = null;
+  let loopback = false;
+  try {
+    const parsed = new URL(baseUrl);
+    loopback = isLoopbackBaseUrl(baseUrl);
+    port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+  } catch {
+    return {
+      id: "local_base_url_frontend",
+      group: "config",
+      title: "Local base URL targets the frontend",
+      status: "fail",
+      severity: "critical",
+      evidence: [{ label: "base_url", value: baseUrl }],
+      remediation: "Set the local profile base URL to the frontend origin (http://localhost:3000).",
+      nextCommand: "moda profiles create local --environment local --base-url http://localhost:3000"
+    };
+  }
+  const looksLikeBackend = loopback && (port === "3001" || port === "3002");
+  if (looksLikeBackend) {
+    return {
+      id: "local_base_url_frontend",
+      group: "config",
+      title: "Local base URL targets the frontend",
+      status: "warning",
+      severity: "warning",
+      evidence: [
+        { label: "base_url", value: baseUrl },
+        { label: "port", value: port ?? "unknown" }
+      ],
+      remediation: "Local CLI auth and control APIs are served by the frontend. " + "Use http://localhost:3000 (or your worktree frontend port), not the backend :3001.",
+      nextCommand: "moda profiles create local --environment local --base-url http://localhost:3000 --use"
+    };
+  }
+  if (!loopback) {
+    return {
+      id: "local_base_url_frontend",
+      group: "config",
+      title: "Local base URL targets the frontend",
+      status: "warning",
+      severity: "warning",
+      evidence: [{ label: "base_url", value: baseUrl }],
+      remediation: "Local profile should use a loopback frontend URL (http://localhost:3000). " + "Activate with `moda profiles use local` or set MODA_PROFILE=local.",
+      nextCommand: "moda profiles use local"
+    };
+  }
+  return {
+    id: "local_base_url_frontend",
+    group: "config",
+    title: "Local base URL targets the frontend",
+    status: "pass",
+    severity: "info",
+    evidence: [{ label: "base_url", value: baseUrl }]
+  };
+}
+function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId) {
+  if (!manifestExists) {
+    return {
+      id: "harness_manifest_current",
+      group: "harness",
+      title: "Harness manifest matches scanner output",
+      status: "skipped",
+      severity: "info",
+      evidence: [{ label: "reason", value: "manifest missing" }],
+      nextCommand: "moda harness scan --summary"
+    };
+  }
+  try {
+    const current = scanHarness({
+      rootDir: cwd,
+      scannerVersion: "doctor",
+      tenantId,
+      tenantSource: tenantId ? "env_or_config" : undefined
+    });
+    const saved = JSON.parse(readFileSync(manifestPath, "utf8"));
+    const savedHash = stableGraphHash(saved);
+    const currentHash = stableGraphHash(current);
+    const matches = savedHash === currentHash;
+    return {
+      id: "harness_manifest_current",
+      group: "harness",
+      title: "Harness manifest matches scanner output",
+      status: matches ? "pass" : "warning",
+      severity: matches ? "info" : "warning",
+      evidence: [
+        { label: "saved_hash", value: savedHash.slice(0, 12) },
+        { label: "current_hash", value: currentHash.slice(0, 12) },
+        ...matches ? [] : [{ label: "diff", value: "Manifest hash differs from fresh scanner output." }]
+      ],
+      remediation: matches ? undefined : "Refresh the local harness manifest.",
+      nextCommand: matches ? undefined : "moda harness scan --summary"
+    };
+  } catch (err) {
+    return {
+      id: "harness_manifest_current",
+      group: "harness",
+      title: "Harness manifest matches scanner output",
+      status: "fail",
+      severity: "critical",
+      evidence: [{ label: "error", value: err instanceof Error ? err.message : String(err) }],
+      remediation: "Regenerate the harness manifest.",
+      nextCommand: "moda harness scan --summary"
+    };
+  }
+}
+function harnessSyncStateCheck(cwd) {
+  const state = readHarnessSyncState(cwd);
+  if (!state) {
+    return {
+      id: "harness_sync_state_present",
+      group: "harness",
+      title: "Harness sync state exists",
+      status: "warning",
+      severity: "warning",
+      evidence: [{ label: "path", value: ".moda/sync-state.json" }],
+      remediation: "Sync the harness graph so Moda can correlate local state with cloud state.",
+      nextCommand: "moda harness sync --dry-run"
+    };
+  }
+  return {
+    id: "harness_sync_state_present",
+    group: "harness",
+    title: "Harness sync state exists",
+    status: "pass",
+    severity: "info",
+    evidence: [
+      { label: "updated_at", value: state.updatedAt },
+      { label: "profile", value: state.profile },
+      { label: "harness_id", value: state.harnessId },
+      { label: "remote_version_id", value: state.remote.versionId || "none" }
+    ]
+  };
+}
+function promptsDiscoveredCheck(cwd) {
+  const base = { id: "prompts_discovered", group: "harness", title: "Prompts are discovered" };
+  if (!existsSync(join(cwd, ".moda", "prompts.yml"))) {
+    return discoveryCheck(base.id, base.group, base.title, cwd, ["prompts", ".moda/prompts.yml"], "moda prompts init");
+  }
+  let inspection;
+  try {
+    inspection = inspectPromptManifest(cwd);
+  } catch (error) {
+    return {
+      ...base,
+      status: "fail",
+      severity: "warning",
+      evidence: [{ label: "manifest", value: ".moda/prompts.yml" }, { label: "error", value: error instanceof Error ? error.message : String(error) }],
+      remediation: "Fix .moda/prompts.yml (version, prompt_paths, sources).",
+      nextCommand: "moda prompts status"
+    };
+  }
+  const evidence = [
+    { label: "manifest", value: `.moda/prompts.yml (version ${inspection.manifestVersion})` },
+    { label: "matched_files", value: String(inspection.matchedFiles) },
+    { label: "sources", value: String(inspection.sources) },
+    ...inspection.zeroMatchPatterns.length > 0 ? [{ label: "zero_match_patterns", value: inspection.zeroMatchPatterns.join(", ") }] : [],
+    ...inspection.legacyOnlyFiles.length > 0 ? [{
+      label: "legacy_only_files",
+      value: `${inspection.legacyOnlyFiles.length} (${inspection.legacyOnlyFiles.slice(0, 3).join(", ")}${inspection.legacyOnlyFiles.length > 3 ? ", ..." : ""})`
+    }] : []
+  ];
+  if (inspection.legacyOnlyFiles.length > 0) {
+    return {
+      ...base,
+      status: "warning",
+      severity: "warning",
+      evidence,
+      remediation: "Prompt files found by older CLIs no longer match the manifest globs (they are exact paths from the repository root). Migrate the manifest to keep them tracked under their existing keys.",
+      nextCommand: "moda prompts migrate --dry-run"
+    };
+  }
+  if (inspection.matchedFiles === 0 && inspection.sources === 0) {
+    return {
+      ...base,
+      status: "warning",
+      severity: "warning",
+      evidence,
+      remediation: "The prompt manifest matches no files and maps no sources, so sync registers nothing. Fix prompt_paths or preview source discovery.",
+      nextCommand: "moda prompts sync --dry-run"
+    };
+  }
+  return { ...base, status: "pass", severity: "info", evidence };
+}
+function discoveryCheck(id, group, title, cwd, relativePaths, nextCommand) {
+  const found = relativePaths.filter((path) => existsSync(join(cwd, path)));
+  return {
+    id,
+    group,
+    title,
+    status: found.length > 0 ? "pass" : "warning",
+    severity: found.length > 0 ? "info" : "warning",
+    evidence: [{ label: "paths", value: found.length > 0 ? found.join(", ") : "none" }],
+    remediation: found.length > 0 ? undefined : `Expected one of: ${relativePaths.join(", ")}.`,
+    nextCommand: found.length > 0 ? undefined : nextCommand
+  };
+}
+function validationEventPathCheck(ingestUrl) {
+  return {
+    id: "validation_event_path_defined",
+    group: "cloud",
+    title: "Validation event path is defined",
+    status: "pass",
+    severity: "info",
+    evidence: [{ label: "path", value: `${ingestUrl.replace(/\/+$/, "")}/v1/otel/validation` }]
+  };
+}
+function offlineCloudChecks(isOffline) {
+  const status = isOffline ? "skipped" : "warning";
+  const evidence = [{ label: "mode", value: isOffline ? "offline" : "missing api key" }];
+  const remediation = isOffline ? "Rerun without --offline to check Moda Cloud." : "Configure an API key before checking cloud data flow.";
+  const nextCommand = isOffline ? "moda doctor --online" : "moda init";
+  return [
+    {
+      id: "cloud_api_reachable",
+      group: "cloud",
+      title: "Moda Cloud API is reachable",
+      status,
+      severity: "warning",
+      evidence,
+      remediation,
+      nextCommand
+    },
+    {
+      id: "ingest_endpoint_reachable",
+      group: "cloud",
+      title: "Moda ingest endpoint is reachable",
+      status,
+      severity: "warning",
+      evidence,
+      remediation,
+      nextCommand
+    },
+    {
+      id: "recent_data_flow",
+      group: "cloud",
+      title: "Recent traces/logs/runs exist",
+      status,
+      severity: "warning",
+      evidence,
+      remediation,
+      nextCommand
+    },
+    {
+      id: "cloud_data_flow",
+      group: "cloud",
+      title: "Moda Cloud data flow",
+      status,
+      severity: "warning",
+      evidence,
+      remediation,
+      nextCommand
+    }
+  ];
+}
+async function cloudDataFlowChecks(ingestUrl, apiKey) {
+  let overview;
+  let cloudApiCheck;
+  try {
+    overview = await callDataAPI("/overview?days_back=1");
+    cloudApiCheck = {
+      id: "cloud_api_reachable",
+      group: "cloud",
+      title: "Moda Cloud API is reachable",
+      status: "pass",
+      severity: "info",
+      evidence: [{ label: "overview", value: "reachable" }]
+    };
+  } catch (err) {
+    const error = err instanceof Error ? err.message : String(err);
+    return [
+      {
+        id: "cloud_api_reachable",
+        group: "cloud",
+        title: "Moda Cloud API is reachable",
+        status: "warning",
+        severity: "warning",
+        evidence: [{ label: "error", value: error }],
+        remediation: "Check API key and base URL.",
+        nextCommand: "moda doctor --offline"
+      },
+      {
+        id: "ingest_endpoint_reachable",
+        group: "cloud",
+        title: "Moda ingest endpoint is reachable",
+        status: "skipped",
+        severity: "warning",
+        evidence: [{ label: "reason", value: "cloud API unreachable" }]
+      },
+      {
+        id: "recent_data_flow",
+        group: "cloud",
+        title: "Recent traces/logs/runs exist",
+        status: "skipped",
+        severity: "warning",
+        evidence: [{ label: "reason", value: "overview unavailable" }]
+      },
+      {
+        id: "cloud_data_flow",
+        group: "cloud",
+        title: "Moda Cloud data flow",
+        status: "warning",
+        severity: "warning",
+        evidence: [{ label: "error", value: error }],
+        remediation: "Check API key, base URL, and whether data has reached Moda.",
+        nextCommand: "moda doctor --offline"
+      }
+    ];
+  }
+  const ingestCheck = await ingestReachabilityCheck(ingestUrl, apiKey);
+  const recentCheck = recentDataFlowCheck(overview);
+  const cloudStatus = cloudApiCheck.status === "pass" && ingestCheck.status === "pass" && recentCheck.status === "pass" ? "pass" : "warning";
+  return [
+    cloudApiCheck,
+    ingestCheck,
+    recentCheck,
+    {
+      id: "cloud_data_flow",
+      group: "cloud",
+      title: "Moda Cloud data flow",
+      status: cloudStatus,
+      severity: cloudStatus === "pass" ? "info" : "warning",
+      evidence: [
+        { label: "cloud_api", value: cloudApiCheck.status },
+        { label: "ingest", value: ingestCheck.status },
+        { label: "recent_data", value: recentCheck.status }
+      ],
+      remediation: cloudStatus === "pass" ? undefined : "Check API key, ingest URL, and whether data has reached Moda.",
+      nextCommand: cloudStatus === "pass" ? undefined : "moda doctor --offline"
+    }
+  ];
+}
+async function ingestReachabilityCheck(ingestUrl, apiKey) {
+  const url = `${ingestUrl.replace(/\/+$/, "")}/`;
+  try {
+    recordApiRequest();
+    const response = await fetch(url, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    return {
+      id: "ingest_endpoint_reachable",
+      group: "cloud",
+      title: "Moda ingest endpoint is reachable",
+      status: "pass",
+      severity: "info",
+      evidence: [
+        { label: "url", value: url },
+        { label: "http_status", value: String(response.status) }
+      ]
+    };
+  } catch (err) {
+    return {
+      id: "ingest_endpoint_reachable",
+      group: "cloud",
+      title: "Moda ingest endpoint is reachable",
+      status: "warning",
+      severity: "warning",
+      evidence: [{ label: "error", value: err instanceof Error ? err.message : String(err) }],
+      remediation: "Check the configured ingest URL and network reachability.",
+      nextCommand: "moda profiles create"
+    };
+  }
+}
+function recentDataFlowCheck(overview) {
+  const data = isRecord(overview) ? overview : {};
+  const conversations = numberAt(data, ["conversations", "total"]);
+  const toolFailures = numberAt(data, ["tool_failures", "total"]);
+  const recentActivity = Array.isArray(data.recent_activity) ? data.recent_activity : [];
+  const lastEventAt = lastActivityTimestamp(recentActivity);
+  const hasData = conversations > 0 || toolFailures > 0 || Boolean(lastEventAt);
+  return {
+    id: "recent_data_flow",
+    group: "cloud",
+    title: "Recent traces/logs/runs exist",
+    status: hasData ? "pass" : "warning",
+    severity: hasData ? "info" : "warning",
+    evidence: [
+      { label: "conversations", value: String(conversations) },
+      { label: "tool_failures", value: String(toolFailures) },
+      { label: "last_event_at", value: lastEventAt ?? "none" }
+    ],
+    remediation: hasData ? undefined : "No recent Moda data was visible in the overview window.",
+    nextCommand: hasData ? undefined : "moda init"
+  };
+}
+function numberAt(value, path) {
+  let cursor = value;
+  for (const key of path) {
+    if (!isRecord(cursor))
+      return 0;
+    cursor = cursor[key];
+  }
+  return typeof cursor === "number" && Number.isFinite(cursor) ? cursor : 0;
+}
+function lastActivityTimestamp(items) {
+  const timestamps = items.map((item) => isRecord(item) && typeof item.timestamp === "string" ? item.timestamp : undefined).filter((item) => Boolean(item)).sort();
+  return timestamps.at(-1);
+}
+function summarizeChecks(checks) {
+  const fail = checks.filter((check) => check.status === "fail").length;
+  const warning = checks.filter((check) => check.status === "warning").length;
+  const skipped = checks.filter((check) => check.status === "skipped").length;
+  const pass = checks.filter((check) => check.status === "pass").length;
+  return {
+    status: fail > 0 ? "fail" : warning > 0 ? "warning" : "pass",
+    pass,
+    warning,
+    fail,
+    skipped
+  };
+}
+function nextCommandsForChecks(checks) {
+  return [...new Set(checks.filter((check) => check.status === "fail" || check.status === "warning").map((check) => check.nextCommand).filter((command) => Boolean(command)))];
+}
+function firstBrokenCheck(checks) {
+  return checks.find((check) => check.status === "fail") ?? checks.find((check) => check.status === "warning");
+}
+function checkStatus(checks, id) {
+  return checks.find((check) => check.id === id)?.status ?? "skipped";
+}
+function doctorAgentWriteOptions(report, command) {
+  const broken = report.checks.filter((check) => check.status === "fail" || check.status === "warning");
+  return {
+    summary: `${command} completed with status ${report.summary.status}: ${report.summary.fail} failing checks and ${report.summary.warning} warnings.`,
+    findings: broken.slice(0, 16).map((check) => ({
+      id: check.id,
+      title: check.title,
+      status: check.status,
+      severity: check.severity,
+      description: check.remediation ?? `Doctor check ${check.id} is ${check.status}.`,
+      evidence_ref_ids: [`doctor:${check.id}`]
+    })),
+    evidenceRefs: report.checks.map((check) => ({
+      id: `doctor:${check.id}`,
+      kind: "doctor_check",
+      label: check.title,
+      status: check.status
+    })),
+    recommendedActions: report.fixPlan.slice(0, 16).map((item, index) => ({
+      id: `doctor_action_${index + 1}_${item.checkId}`,
+      title: item.action,
+      command: item.command,
+      rationale: `Doctor check ${item.checkId} is not passing.`,
+      mutability: item.command ? agentMutabilityForCommand(item.command) : "unknown",
+      requires_approval: item.command ? agentCommandRequiresApproval(item.command) : true
+    })),
+    nextCommands: report.nextCommands.slice(0, 16).map((nextCommand) => ({
+      command: nextCommand,
+      purpose: agentPurposeForCommand(nextCommand),
+      mutability: agentMutabilityForCommand(nextCommand),
+      requires_approval: agentCommandRequiresApproval(nextCommand)
+    })),
+    warnings: broken.filter((check) => check.status === "warning").slice(0, 16).map((check) => `${check.title}: ${check.remediation ?? check.status}`)
+  };
+}
+function agentMutabilityForCommand(command) {
+  if (/\bsync\b/.test(command))
+    return "sync";
+  if (/\b(init|install|approve|pull|gen|promote|remove)\b/.test(command))
+    return "write";
+  return "read";
+}
+function agentCommandRequiresApproval(command) {
+  return agentMutabilityForCommand(command) !== "read" && !command.includes("--dry-run");
+}
+function agentPurposeForCommand(command) {
+  if (command.includes("doctor"))
+    return "Re-run Moda diagnostics.";
+  if (command.includes("harness approve"))
+    return "Approve the validated harness report after review.";
+  if (command.includes("harness sync"))
+    return "Sync harness state to Moda Cloud.";
+  if (command.includes("harness scan"))
+    return "Refresh the local harness manifest.";
+  if (command.includes("init"))
+    return "Run Moda onboarding.";
+  return "Inspect or repair Moda setup.";
+}
+function stableGraphHash(graph) {
+  return createHash("sha256").update(JSON.stringify(sortJson({
+    ...graph,
+    scan: {
+      ...graph.scan,
+      createdAt: undefined,
+      scannerVersion: undefined,
+      skipped: undefined
+    }
+  }))).digest("hex");
+}
+function sortJson(value) {
+  if (Array.isArray(value))
+    return value.map((item) => sortJson(item));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sortJson(item)]));
+  }
+  return value;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+export { runDoctorCommand, runStatusCommand, buildDoctorReport, promptsDiscoveredCheck };