@moda-ai/cli 1.55.10 → 1.55.12

package/dist/{cli-d3c95kks.js → cli-90hb4ng0.js}

@@ -6,55 +6,34 @@ import {
   $isSeq,
   $parseDocument,
   $stringify,
-  assertFlags,
-  assertPositionals,
   backfillPromptSource,
-  callControlAPI,
-  callDataAPI,
   inventoryFiles,
   normalizeHarnessReport,
-  readHarnessSyncState,
-  renderDoctorHuman,
-  renderStatusHuman,
   require_typescript,
   resolvePromptSource,
-  safePromptEvidencePath,
-  scanHarness,
-  setPlatformTenantOverride
-} from "./cli-v27q5dvh.js";
+  safePromptEvidencePath
+} from "./cli-m0fa54ny.js";
 import {
-  SKILL_SOURCE_HARNESS,
-  SKILL_SOURCE_INTEGRATION_BUNDLED,
-  claudeSkillToCursorRule,
-  detectAgents,
-  pruneManagedSkillPaths,
-  readSkillsManifest,
-  writeSkillsManifest
-} from "./cli-ssfq84k5.js";
+  createCommandContext
+} from "./cli-4x9w6ey7.js";
 import {
-  isAuthSessionValid,
-  loadAuthSession
-} from "./cli-4f0p8erk.js";
+  assertFlags,
+  assertPositionals
+} from "./cli-k7vwt56h.js";
+import {
+  callControlAPI,
+  callDataAPI
+} from "./cli-ryd7nzke.js";
+import {
+  setPlatformTenantOverride
+} from "./cli-09rr5smg.js";
 import {
   CliInputError,
   EXIT_ERROR,
   EXIT_OK,
-  createCommandContext,
-  ensureSecretFilePermissions,
-  getActiveProfile,
-  getModaPaths,
-  isLoopbackBaseUrl,
-  loadProfileConfig,
-  recordApiRequest,
-  resolveApiKey,
   resolveApiTenantId,
-  resolveIngestUrl,
-  resolveModaBaseUrl,
-  resolveSecretReference,
-  resolveTenantId,
-  secretFilePathFromRef,
   validateConfig
-} from "./cli-0qnghzg4.js";
+} from "./cli-kwz900s4.js";
 import {
   __commonJS,
   __require,
@@ -6752,7 +6731,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-0tnqw849.js");
+    const { analyzeHarnessPrompts } = await import("./harness-9psndqtm.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),
@@ -7082,7 +7061,7 @@ async function migratePromptManifest(options = {}) {
   let addedSources = [];
   let pendingSources = [];
   if (options.discover) {
-    const { analyzeHarnessPrompts } = await import("./harness-0tnqw849.js");
+    const { analyzeHarnessPrompts } = await import("./harness-9psndqtm.js");
     const result = await analyzeHarnessPrompts({
       rootDir: root,
       existing: manifest.sources,
@@ -7527,1698 +7506,4 @@ function asRecordValue(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 
-// src/skills.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
-import {
-  existsSync as existsSync4,
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync3,
-  readdirSync,
-  readFileSync as readFileSync3,
-  writeFileSync as writeFileSync4
-} from "node:fs";
-import { basename, dirname as dirname4, join as join3, relative as relative2 } from "node:path";
-
-// src/agents-md.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join2 } from "node:path";
-var AGENTS_MD_FILENAME = "AGENTS.md";
-var FIXES_BLOCK_BEGIN = "<!-- moda:fixes:begin -->";
-var FIXES_BLOCK_END = "<!-- moda:fixes:end -->";
-function renderFixesBlock() {
-  return [
-    FIXES_BLOCK_BEGIN,
-    "## Fixing production issues with Moda (managed block — edits inside are overwritten by moda-cli)",
-    "",
-    "Moda supplies the production evidence; you propose and make the fix yourself.",
-    "",
-    "- Find what to fix: `moda investigate` ranks tool failures, user frustrations,",
-    "  and top Problems with evidence; `moda problems` ranks cross-signal Problems",
-    "  by root cause; `moda failures` lists tool failures only.",
-    "- Read the evidence before editing: `moda problem <problem_id>` (dossier),",
-    "  `moda problem <problem_id> --evidence` (attribution rationales and anchors),",
-    "  `moda problem <problem_id> --traces` (affected traces),",
-    "  `moda tool-failure-detail <tool_name>` (failing calls in context), and",
-    "  `moda context <conversation_id>` (the messages around a turn; `--all` for",
-    "  the whole trace).",
-    "- Propose the change in the code, prompt, tool definition, or skill that",
-    "  causes the issue, and cite the Moda problem or trace ids it is based on",
-    "  in the PR description.",
-    "- Prompts live in `.moda/prompts.yml` (version 2: `prompt_paths` globs plus",
-    "  `sources:` mappings for prompts defined in code); after `moda prompts sync`,",
-    "  pass `prompt: lock.prompts['<key>']` to createThinkTelemetry/createAI7Telemetry.",
-    "- After the fix ships, record it with",
-    "  `moda problem-feedback <problem_id> --action=mark_fixed`; if the issue",
-    "  is detected again, the Problem comes back.",
-    FIXES_BLOCK_END
-  ].join(`
-`);
-}
-function upsertManagedBlock(existing, block) {
-  if (existing === null) {
-    return `${block}
-`;
-  }
-  const beginIdx = existing.indexOf(FIXES_BLOCK_BEGIN);
-  const endIdx = existing.indexOf(FIXES_BLOCK_END);
-  if (beginIdx !== -1 && endIdx !== -1 && endIdx >= beginIdx) {
-    const before = existing.slice(0, beginIdx);
-    const after = existing.slice(endIdx + FIXES_BLOCK_END.length);
-    return `${before}${block}${after}`;
-  }
-  const separator = existing === "" || existing.endsWith(`
-
-`) ? "" : existing.endsWith(`
-`) ? `
-` : `
-
-`;
-  return `${existing}${separator}${block}
-`;
-}
-function writeFileIfChanged(filePath, content) {
-  try {
-    mkdirSync2(dirname3(filePath), { recursive: true });
-    if (existsSync3(filePath)) {
-      const current = readFileSync2(filePath, "utf8");
-      if (current === content)
-        return "unchanged";
-      writeFileSync3(filePath, content);
-      return "updated";
-    }
-    writeFileSync3(filePath, content);
-    return "wrote";
-  } catch {
-    return "failed";
-  }
-}
-function upsertFixesAgentsBlock(cwd) {
-  const filePath = join2(cwd, AGENTS_MD_FILENAME);
-  let existing = null;
-  if (existsSync3(filePath)) {
-    try {
-      existing = readFileSync2(filePath, "utf8");
-    } catch {
-      return { path: AGENTS_MD_FILENAME, status: "failed" };
-    }
-  }
-  const next = upsertManagedBlock(existing, renderFixesBlock());
-  return { path: AGENTS_MD_FILENAME, status: writeFileIfChanged(filePath, next) };
-}
-
-// src/skills.ts
-var SKILLS_REQUEST_TIMEOUT_MS = 15000;
-var VALID_STATUSES = new Set(["approved", "proposed", "all"]);
-var SKILL_PROPOSALS_MANIFEST_PATH = join3(".moda", "skill-proposals.yml");
-async function fetchSkills(status) {
-  const apiKey = resolveApiKey();
-  if (!apiKey) {
-    throw new CliInputError("No Moda API key found. Run `moda init` first (or set MODA_API_KEY).");
-  }
-  const ingestUrl = resolveIngestUrl().replace(/\/$/, "");
-  const url = `${ingestUrl}/v1/skills?status=${encodeURIComponent(status)}`;
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), SKILLS_REQUEST_TIMEOUT_MS);
-  let response;
-  try {
-    recordApiRequest();
-    response = await fetch(url, {
-      headers: { Authorization: `Bearer ${apiKey}` },
-      signal: controller.signal
-    });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    throw new Error(`Network error: failed to reach ${ingestUrl} (${message})`);
-  } finally {
-    clearTimeout(timeout);
-  }
-  if (!response.ok) {
-    const body = await response.text().catch(() => "");
-    throw new Error(`Failed to fetch skills (HTTP ${response.status}): ${body.slice(0, 200)}`);
-  }
-  const data = await response.json();
-  if (!data.success) {
-    throw new Error(data.message || "Failed to fetch skills");
-  }
-  const skills = Array.isArray(data.skills) ? data.skills : [];
-  const release = data.release && typeof data.release === "object" ? data.release : null;
-  return {
-    skills,
-    tenantId: data.tenant_id || resolveTenantId() || "",
-    release,
-    releaseKey: releaseKeyFor(release, skills, status),
-    status
-  };
-}
-async function skillRunsRequest(url) {
-  const apiKey = resolveApiKey();
-  if (!apiKey) {
-    throw new CliInputError("No Moda API key found. Run `moda init` first (or set MODA_API_KEY).");
-  }
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), SKILLS_REQUEST_TIMEOUT_MS);
-  let response;
-  try {
-    recordApiRequest();
-    response = await fetch(url, {
-      headers: { Authorization: `Bearer ${apiKey}` },
-      signal: controller.signal
-    });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    throw new Error(`Network error: failed to reach ${url} (${message})`);
-  } finally {
-    clearTimeout(timeout);
-  }
-  const text = await response.text().catch(() => "");
-  if (!response.ok && response.status !== 404) {
-    throw new Error(`Failed to fetch run status (HTTP ${response.status}): ${text.slice(0, 200)}`);
-  }
-  let body = {};
-  try {
-    body = text ? JSON.parse(text) : {};
-  } catch {
-    body = {};
-  }
-  return { status: response.status, body };
-}
-async function fetchSkillRunStatus(runId) {
-  const ingestUrl = resolveIngestUrl().replace(/\/$/, "");
-  let resolvedRunId = runId;
-  if (!resolvedRunId) {
-    const list = await skillRunsRequest(`${ingestUrl}/v1/skills/runs?limit=1`);
-    const listBody = list.body;
-    const latest = Array.isArray(listBody.runs) ? listBody.runs[0] : undefined;
-    if (!latest)
-      return { run: null, events: [] };
-    resolvedRunId = latest.generation_run_id;
-    if (!resolvedRunId)
-      return { run: latest, events: [] };
-  }
-  const detail = await skillRunsRequest(`${ingestUrl}/v1/skills/runs/${encodeURIComponent(resolvedRunId)}`);
-  if (detail.status === 404) {
-    if (runId) {
-      throw new CliInputError(`No skill generation run found with id '${runId}'`);
-    }
-    return { run: null, events: [] };
-  }
-  const detailBody = detail.body;
-  return {
-    run: detailBody.run ?? null,
-    events: Array.isArray(detailBody.events) ? detailBody.events : []
-  };
-}
-var STATUS_HUMAN_EVENT_LIMIT = 10;
-function formatRunStatusHuman(run, events) {
-  const counters = run.counters ?? {};
-  const lines = [
-    run.generation_run_id && `run: ${run.generation_run_id}`,
-    `status: ${run.status || "unknown"}`,
-    run.current_stage && `stage: ${run.current_stage}`,
-    run.outcome && `outcome: ${run.outcome}`,
-    `processed: ${Number(counters.sessions_processed ?? 0)}`,
-    `failed: ${Number(counters.sessions_failed ?? 0)}`,
-    Number(counters.distilled_skills_generated ?? 0) > 0 && `distilled: ${Number(counters.distilled_skills_generated ?? 0)}`,
-    Number(counters.skills_indexed ?? 0) > 0 && `indexed: ${Number(counters.skills_indexed ?? 0)}`,
-    (run.generated_skill_ids?.length ?? 0) > 0 && `skills: ${(run.generated_skill_ids ?? []).join(", ")}`,
-    run.error && `error: ${run.error}`,
-    run.started_at && `started: ${run.started_at}`,
-    run.updated_at && `updated: ${run.updated_at}`
-  ].filter(Boolean);
-  if (events.length > 0) {
-    lines.push("recent events (newest first):");
-    for (const event of events.slice(0, STATUS_HUMAN_EVENT_LIMIT)) {
-      lines.push(`  ${[event.created_at, event.level, event.stage, event.message].filter(Boolean).join("  ")}`);
-    }
-  }
-  return lines.join(`
-`);
-}
-function writeIfChanged(filePath, content) {
-  try {
-    mkdirSync3(dirname4(filePath), { recursive: true });
-    if (existsSync4(filePath)) {
-      const current = readFileSync3(filePath, "utf8");
-      if (current === content)
-        return "unchanged";
-      writeFileSync4(filePath, content);
-      return "updated";
-    }
-    writeFileSync4(filePath, content);
-    return "wrote";
-  } catch {
-    return "failed";
-  }
-}
-async function pullSkills(options = {}) {
-  const status = options.status ?? "approved";
-  const cwd = options.cwd ?? process.cwd();
-  const log = (msg) => {
-    if (!options.silent)
-      console.log(msg);
-  };
-  const fetched = await fetchSkills(status);
-  const { skills } = fetched;
-  const summary = {
-    total: skills.length,
-    pruned: 0,
-    wrote: 0,
-    updated: 0,
-    unchanged: 0,
-    failed: 0
-  };
-  if (skills.length === 0) {
-    log("  No skills to pull yet.");
-    return summary;
-  }
-  const previousManifest = readSkillsManifest(cwd);
-  const preservedIntegrationRecords = (previousManifest?.records ?? []).filter((record) => record.source === SKILL_SOURCE_INTEGRATION_BUNDLED);
-  if (previousManifest && previousManifest.managedPaths.length > 0 && previousManifest.releaseKey !== fetched.releaseKey) {
-    const integrationPaths = new Set(preservedIntegrationRecords.flatMap((record) => record.paths));
-    const harnessPaths = previousManifest.managedPaths.filter((path) => !integrationPaths.has(path));
-    if (harnessPaths.length > 0) {
-      summary.pruned = pruneManagedSkillPaths(cwd, harnessPaths, log);
-    }
-  }
-  const agents = detectAgents();
-  const writeCursor = agents.includes("Cursor") || existsSync4(join3(cwd, ".cursor"));
-  const records = [];
-  for (const skill of skills) {
-    if (!skill.skill_id || !skill.skill_md) {
-      summary.failed++;
-      continue;
-    }
-    const safeId = basename(skill.skill_id);
-    if (!safeId || !/^[A-Za-z0-9_-]+$/.test(safeId)) {
-      summary.failed++;
-      log(`  skipped invalid skill_id: ${JSON.stringify(skill.skill_id).slice(0, 80)}`);
-      continue;
-    }
-    const claudePath = join3(cwd, ".claude", "skills", safeId, "SKILL.md");
-    const claudeStatus = writeIfChanged(claudePath, skill.skill_md);
-    const claudeRelativePath = `.claude/skills/${safeId}/SKILL.md`;
-    recordOutcome(summary, claudeStatus, log, claudeRelativePath);
-    const paths = [];
-    if (claudeStatus !== "failed")
-      paths.push(claudeRelativePath);
-    if (writeCursor) {
-      const cursorPath = join3(cwd, ".cursor", "rules", `${safeId}.mdc`);
-      const cursorStatus = writeIfChanged(cursorPath, claudeSkillToCursorRule(skill.skill_md));
-      const cursorRelativePath = `.cursor/rules/${safeId}.mdc`;
-      recordOutcome(summary, cursorStatus, log, cursorRelativePath);
-      if (cursorStatus !== "failed")
-        paths.push(cursorRelativePath);
-    }
-    if (paths.length > 0) {
-      records.push({
-        skillId: safeId,
-        contentHash: sha2562(skill.skill_md),
-        source: SKILL_SOURCE_HARNESS,
-        paths
-      });
-    }
-  }
-  writeSkillsManifest(cwd, manifestHeaderFor(fetched), [...records, ...preservedIntegrationRecords]);
-  return summary;
-}
-function recordOutcome(summary, status, log, relativePath) {
-  switch (status) {
-    case "wrote":
-      summary.wrote++;
-      log(`  wrote ${relativePath}`);
-      break;
-    case "updated":
-      summary.updated++;
-      log(`  updated ${relativePath}`);
-      break;
-    case "unchanged":
-      summary.unchanged++;
-      break;
-    case "failed":
-      summary.failed++;
-      log(`  failed ${relativePath}`);
-      break;
-  }
-}
-var SKILLS_DIR = join3(".claude", "skills");
-var SKILL_FILE = "SKILL.md";
-var MAX_SKILL_WALK_DEPTH = 4;
-async function runSkillSync(flags = {}, profileOptions = {}, options = {}) {
-  const cwd = options.cwd ?? process.cwd();
-  const dryRun = flags["dry-run"] === "true";
-  const agentsMd = dryRun ? undefined : upsertFixesAgentsBlock(cwd);
-  const skills = discoverLocalSkills(cwd);
-  if (skills.length === 0) {
-    return { synced: [], dryRun, ...agentsMd ? { agentsMd } : {} };
-  }
-  const sourceCommit = getGitCommit2(cwd);
-  const response = await callControlAPI("/skills/sync", {
-    method: "POST",
-    body: JSON.stringify({
-      skills: skills.map((skill) => ({
-        key: skill.key,
-        name: skill.name,
-        description: skill.description,
-        skillMd: skill.skillMd,
-        sourcePath: skill.sourcePath,
-        contentHash: skill.contentHash,
-        sourceCommit
-      })),
-      sourceCommit,
-      dryRun
-    })
-  }, profileOptions);
-  return { synced: response.synced ?? [], dryRun, ...agentsMd ? { agentsMd } : {} };
-}
-function discoverLocalSkills(cwd) {
-  const skillsRoot = join3(cwd, SKILLS_DIR);
-  if (!existsSync4(skillsRoot))
-    return [];
-  const managed = new Set(managedSkillPaths(cwd));
-  const skills = [];
-  for (const absPath of walkSkillFiles(skillsRoot, 0)) {
-    const sourcePath = relative2(cwd, absPath).replace(/\\/g, "/");
-    if (managed.has(sourcePath))
-      continue;
-    const key = basename(dirname4(absPath));
-    if (key === "moda-cli" || !/^[A-Za-z0-9_-]+$/.test(key))
-      continue;
-    let content;
-    try {
-      content = readFileSync3(absPath, "utf8");
-    } catch {
-      continue;
-    }
-    if (!content.trim())
-      continue;
-    const { name, description } = parseSkillFrontmatter(content, key);
-    skills.push({
-      key,
-      name,
-      description,
-      skillMd: content,
-      sourcePath,
-      contentHash: sha2562(content)
-    });
-  }
-  return skills.sort((a, b) => a.key.localeCompare(b.key));
-}
-function managedSkillPaths(cwd) {
-  const manifest = readSkillsManifest(cwd);
-  if (!manifest)
-    return [];
-  return manifest.managedPaths.filter((path) => path.startsWith(".claude/skills/") && path.endsWith("/SKILL.md"));
-}
-function walkSkillFiles(dir, depth) {
-  if (depth > MAX_SKILL_WALK_DEPTH)
-    return [];
-  let entries;
-  try {
-    entries = readdirSync(dir);
-  } catch {
-    return [];
-  }
-  const files = [];
-  for (const entry of entries) {
-    const fullPath = join3(dir, entry);
-    let stat;
-    try {
-      stat = lstatSync2(fullPath);
-    } catch {
-      continue;
-    }
-    if (stat.isSymbolicLink())
-      continue;
-    if (stat.isDirectory()) {
-      files.push(...walkSkillFiles(fullPath, depth + 1));
-    } else if (stat.isFile() && entry === SKILL_FILE) {
-      files.push(fullPath);
-    }
-  }
-  return files;
-}
-function parseSkillFrontmatter(raw, fallbackKey) {
-  let name = fallbackKey;
-  let description;
-  if (raw.startsWith("---")) {
-    const end = raw.indexOf(`
----`, 3);
-    if (end !== -1) {
-      const frontmatter = raw.slice(3, end);
-      const nameMatch = frontmatter.match(/^name:\s*(.+)$/m);
-      const descMatch = frontmatter.match(/^description:\s*(.+)$/m);
-      if (nameMatch)
-        name = stripQuotes(nameMatch[1].trim()) || fallbackKey;
-      if (descMatch)
-        description = stripQuotes(descMatch[1].trim()) || undefined;
-    }
-  }
-  return { name, description };
-}
-function stripQuotes(value) {
-  return value.replace(/^["']|["']$/g, "");
-}
-function getGitCommit2(cwd) {
-  try {
-    return execFileSync2("git", ["rev-parse", "HEAD"], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return;
-  }
-}
-async function fetchSkillProposals(flags, profileOptions = {}) {
-  const params = new URLSearchParams;
-  if (flags["generation-run-id"])
-    params.set("generationRunId", flags["generation-run-id"]);
-  const status = flags.status ?? "ready_for_pr";
-  if (status !== "all")
-    params.set("status", status);
-  if (flags["tenant-id"])
-    params.set("tenantId", flags["tenant-id"]);
-  const suffix = params.toString() ? `?${params.toString()}` : "";
-  const response = await callControlAPI(`/skills/proposals${suffix}`, { method: "GET" }, profileOptions);
-  return Array.isArray(response.proposals) ? response.proposals : [];
-}
-async function applySkillProposal(proposalId, flags, profileOptions = {}, options = {}) {
-  const cwd = options.cwd ?? process.cwd();
-  const params = new URLSearchParams;
-  if (flags["tenant-id"])
-    params.set("tenantId", flags["tenant-id"]);
-  const suffix = params.toString() ? `?${params.toString()}` : "";
-  const proposal = await callControlAPI(`/skills/proposals/${encodeURIComponent(proposalId)}${suffix}`, { method: "GET" }, profileOptions);
-  if (!proposal.skillMd?.trim()) {
-    throw new CliInputError(`Proposal ${proposalId} does not include SKILL.md content`);
-  }
-  const safeId = safeSkillId(proposal.skillId);
-  const relativePath = `.claude/skills/${safeId}/SKILL.md`;
-  const writeStatus = writeIfChanged(join3(cwd, relativePath), proposal.skillMd);
-  if (writeStatus === "failed") {
-    throw new Error(`Failed to write ${relativePath}`);
-  }
-  writeSkillProposalManifest(cwd, proposal, relativePath);
-  let acknowledged = true;
-  let ackError;
-  try {
-    await callControlAPI(`/skills/proposals/${encodeURIComponent(proposalId)}/mark-applied${suffix}`, {
-      method: "POST",
-      body: JSON.stringify({ appliedBy: "moda-cli" })
-    }, profileOptions);
-  } catch (err) {
-    acknowledged = false;
-    ackError = err instanceof Error ? err.message : String(err);
-  }
-  return {
-    proposalId,
-    skillId: proposal.skillId,
-    path: relativePath,
-    status: writeStatus,
-    acknowledged,
-    ackError
-  };
-}
-function safeSkillId(skillId) {
-  const safeId = basename(skillId || "");
-  if (!safeId || !/^[A-Za-z0-9_-]+$/.test(safeId)) {
-    throw new CliInputError(`Invalid skill_id in proposal: ${JSON.stringify(skillId).slice(0, 80)}`);
-  }
-  return safeId;
-}
-function writeSkillProposalManifest(cwd, proposal, relativePath) {
-  const manifestPath = join3(cwd, SKILL_PROPOSALS_MANIFEST_PATH);
-  mkdirSync3(dirname4(manifestPath), { recursive: true });
-  const existing = existsSync4(manifestPath) ? readFileSync3(manifestPath, "utf8") : `applied_proposals:
-`;
-  const entry = [
-    `  - proposal_id: "${escapeYamlString(proposal.proposalId)}"`,
-    `    skill_id: "${escapeYamlString(proposal.skillId)}"`,
-    `    skill_family_id: "${escapeYamlString(proposal.skillFamilyId)}"`,
-    `    skill_version: ${Number(proposal.skillVersion || 0)}`,
-    `    generation_run_id: "${escapeYamlString(proposal.generationRunId)}"`,
-    `    clustering_run_id: "${escapeYamlString(proposal.clusteringRunId)}"`,
-    `    topic_id: "${escapeYamlString(proposal.topicId)}"`,
-    `    replay_set_id: "${escapeYamlString(proposal.replaySetId)}"`,
-    `    delta_pass_rate: ${Number(proposal.deltaPassRate || 0)}`,
-    `    path: "${escapeYamlString(relativePath)}"`,
-    `    applied_at: "${new Date().toISOString()}"`
-  ].join(`
-`);
-  const prefix = existing.endsWith(`
-`) ? existing : `${existing}
-`;
-  writeFileSync4(manifestPath, `${prefix}${entry}
-`);
-}
-function escapeYamlString(value) {
-  return String(value ?? "").replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
-}
-function formatProposalRate(value) {
-  return `${(Number(value || 0) * 100).toFixed(1)}%`;
-}
-var SKILLS_SUBCOMMAND_FLAGS = {
-  gen: [
-    "replay",
-    "source",
-    "wait",
-    "clustering-poll-seconds",
-    "clustering-run-id",
-    "clustering-timeout-seconds",
-    "end-at",
-    "eval-set-id",
-    "force-reprocess",
-    "harness-url",
-    "improve-candidates",
-    "improvement-rounds",
-    "lookback-hours",
-    "max-cluster-pct",
-    "max-sessions",
-    "max-traces",
-    "no-clustering",
-    "no-replay",
-    "replay-set-id",
-    "reprocess-segments",
-    "start-at",
-    "tenant-id",
-    "wait-for-completion"
-  ],
-  status: ["run-id"],
-  pull: ["status"],
-  proposals: ["status", "generation-run-id", "tenant-id"],
-  proposal: ["proposal-id", "tenant-id"],
-  install: ["list"]
-};
-async function runSkillsCommand(input) {
-  const context = "output" in input ? input : createCommandContext({
-    command: input.command,
-    positional: input.positional,
-    positionals: input.positionals,
-    flags: input.flags
-  }, {
-    outputMode: input.flags.agent === "true" ? "agent" : input.flags.json === "true" ? "json" : "human"
-  });
-  const sub = context.positional;
-  const positionals = context.positionals ?? (sub ? [sub] : []);
-  const flags = context.flags;
-  if (sub && SKILLS_SUBCOMMAND_FLAGS[sub])
-    assertFlags(`skills ${sub}`, flags, SKILLS_SUBCOMMAND_FLAGS[sub]);
-  if (sub === "gen") {
-    const result = await generateSkills(flags);
-    if (context.outputMode !== "human") {
-      context.output.writeData(result, {
-        status: Number(result.sessions_failed ?? 0) > 0 ? "error" : "success"
-      });
-    } else if (result.accepted) {
-      console.log([
-        "accepted: true",
-        result.generation_run_id && `generation_run_id: ${result.generation_run_id}`,
-        result.message && `message: ${result.message}`,
-        result.generation_run_id && `follow progress: moda skills status ${result.generation_run_id}`
-      ].filter(Boolean).join(`
-`));
-    } else {
-      console.log([
-        `processed: ${result.sessions_processed ?? 0}`,
-        `failed: ${result.sessions_failed ?? 0}`,
-        `pending: ${result.sessions_pending ?? 0}`,
-        `pending_found: ${result.pending_sessions_found ?? 0}`,
-        `distilled: ${Number(result.cluster_result?.distilled_skills_generated ?? 0)}`,
-        `indexed: ${Number(result.cluster_result?.skills_indexed ?? 0)}`,
-        result.distillation_skipped && `distillation skipped: ${result.distillation_skip_reason || "unknown"}`
-      ].filter(Boolean).join(`
-`));
-    }
-    return Number(result.sessions_failed ?? 0) > 0 ? 1 : 0;
-  }
-  if (sub === "status") {
-    const runId = positionals[1] || flags["run-id"] || undefined;
-    const { run, events } = await fetchSkillRunStatus(runId);
-    if (context.outputMode !== "human") {
-      context.output.writeData({ run, events }, { status: run?.status === "failed" ? "error" : "success" });
-    } else if (!run) {
-      console.log("No skill generation runs found yet. Start one with `moda skills gen`.");
-    } else {
-      console.log(formatRunStatusHuman(run, events));
-    }
-    return run?.status === "failed" ? 1 : 0;
-  }
-  if (sub === "proposals" && positionals[1] === "list") {
-    const proposals = await fetchSkillProposals(flags, { profile: context.profile });
-    if (flags.json === "true") {
-      console.log(JSON.stringify({ proposals }));
-    } else if (proposals.length === 0) {
-      console.log("No skill proposals found.");
-    } else {
-      for (const proposal of proposals) {
-        console.log([
-          proposal.proposalId,
-          proposal.proposalStatus,
-          `${proposal.skillId}@v${proposal.skillVersion}`,
-          `delta=${formatProposalRate(proposal.deltaPassRate)}`,
-          `baseline=${formatProposalRate(proposal.baselinePassRate)}`,
-          `candidate=${formatProposalRate(proposal.candidatePassRate)}`,
-          proposal.name
-        ].filter(Boolean).join("\t"));
-      }
-    }
-    return 0;
-  }
-  if (sub === "proposal" && positionals[1] === "apply") {
-    const proposalId = positionals[2] || flags["proposal-id"];
-    if (!proposalId) {
-      throw new CliInputError("A proposal id is required", "Usage: moda skills proposal apply <proposal-id>");
-    }
-    const result = await applySkillProposal(proposalId, flags, { profile: context.profile });
-    if (flags.json === "true") {
-      console.log(JSON.stringify(result));
-    } else {
-      console.log([
-        `${result.status} ${result.path}`,
-        result.acknowledged ? "acknowledged: true" : "acknowledged: false"
-      ].join(`
-`));
-    }
-    if (!result.acknowledged) {
-      console.error(`Warning: wrote ${result.path} but failed to acknowledge proposal ${proposalId} on the server` + (result.ackError ? ` (${result.ackError})` : "") + ". The proposal is still listed as ready — re-run `moda skills proposal apply` to acknowledge it.");
-      return 1;
-    }
-    return 0;
-  }
-  if (sub === "list" || sub === "show" || sub === "policy") {
-    return runSkillRegistryCommand(sub, positionals, flags, context);
-  }
-  if (sub === "sync") {
-    assertFlags("skills sync", flags, ["dry-run"]);
-    const result = await runSkillSync(flags, { profile: context.profile, env: context.env });
-    context.output.writeData({
-      synced: result.synced,
-      dryRun: result.dryRun,
-      ...result.agentsMd ? { agentsMd: result.agentsMd } : {}
-    });
-    return 0;
-  }
-  if (sub === "install") {
-    return runSkillsInstall(context, positionals.slice(1));
-  }
-  if (sub !== "pull") {
-    throw new CliInputError(sub ? `Unknown skills subcommand '${sub}'` : "A skills subcommand is required", "Usage: moda skills gen [--source=all|sdk] [--max-sessions=N (default 200)] [--lookback-hours=N (default 720)] [--max-traces=N] [--improvement-rounds=1-3] [--start-at=ISO] [--end-at=ISO] [--replay] [--replay-set-id=ID] [--reprocess-segments] [--force-reprocess] [--wait] | moda skills status [run-id] | moda skills proposals list [--status=ready_for_pr] | moda skills proposal apply <proposal-id> | moda skills pull [--status=approved|proposed|all] | moda skills sync [--dry-run] | moda skills install [--list] <id...>");
-  }
-  const status = (flags.status ?? "approved").toLowerCase();
-  if (!VALID_STATUSES.has(status)) {
-    throw new CliInputError(`Invalid --status '${status}'`, `Must be one of: ${[...VALID_STATUSES].join(", ")}`);
-  }
-  const summary = await pullSkills({ status, silent: context.outputMode !== "human" });
-  const parts = [
-    summary.pruned && `${summary.pruned} pruned`,
-    summary.wrote && `${summary.wrote} written`,
-    summary.updated && `${summary.updated} updated`,
-    summary.unchanged && `${summary.unchanged} unchanged`,
-    summary.failed && `${summary.failed} failed`
-  ].filter(Boolean);
-  if (context.outputMode === "human" && summary.total > 0) {
-    console.log(`  Done — ${parts.join(", ") || "no changes"}`);
-  }
-  if (context.outputMode !== "human") {
-    context.output.writeData({ status, summary });
-  }
-  return summary.failed > 0 ? 1 : 0;
-}
-async function generateSkills(flags) {
-  const apiKey = resolveApiKey();
-  if (!apiKey) {
-    throw new CliInputError("No Moda API key found. Run `moda init` first (or set MODA_API_KEY).");
-  }
-  const tenantId = flags["tenant-id"] || resolveTenantId();
-  const directHarnessUrl = flags["harness-url"] || process.env.MODA_SKILL_HARNESS_URL;
-  if (directHarnessUrl && !tenantId) {
-    throw new CliInputError("No Moda tenant id found. Run `moda init` first (or set MODA_TENANT_ID / --tenant-id).");
-  }
-  const endpoint = directHarnessUrl ? `${directHarnessUrl.replace(/\/+$/, "")}/skills/generate` : `${resolveIngestUrl().replace(/\/+$/, "")}/v1/skills/generate`;
-  const waitForCompletion = flags.wait === "true" || flags["wait-for-completion"] === "true";
-  const forceReprocess = flags["force-reprocess"] === "true";
-  const source = normalizeSkillSource(flags.source);
-  if (source === "coding_agent") {
-    console.error("Note: --source=coding-agent is deprecated for skills gen (SDK-only). The run will find no coding-agent sessions; use --source=all or --source=sdk.");
-  }
-  const body = compactObject({
-    tenant_id: tenantId || undefined,
-    max_sessions: parseScopeInt(flags["max-sessions"], "max-sessions"),
-    lookback_hours: parseScopeInt(flags["lookback-hours"], "lookback-hours"),
-    start_at: flags["start-at"] || undefined,
-    end_at: flags["end-at"] || undefined,
-    clustering_run_id: flags["clustering-run-id"] || undefined,
-    replay_set_id: flags["replay-set-id"] || flags["eval-set-id"] || undefined,
-    run_clustering: flags["no-clustering"] !== "true",
-    source,
-    clustering_timeout_seconds: parsePositiveInt3(flags["clustering-timeout-seconds"], 7200),
-    clustering_poll_seconds: parsePositiveInt3(flags["clustering-poll-seconds"], 15),
-    max_cluster_pct: parseOptionalFloat(flags["max-cluster-pct"]),
-    reprocess_segments: flags["reprocess-segments"] === "true" || forceReprocess,
-    run_replay: flags.replay === "true" && flags["no-replay"] !== "true",
-    max_traces: parseScopeInt(flags["max-traces"], "max-traces"),
-    improve_candidates: flags["improve-candidates"] === "true",
-    improvement_rounds: parseScopeInt(flags["improvement-rounds"], "improvement-rounds", MAX_IMPROVEMENT_ROUNDS) ?? 2,
-    force_reprocess: forceReprocess,
-    wait_for_completion: waitForCompletion
-  });
-  const headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "Content-Type": "application/json"
-  };
-  if (tenantId)
-    headers["X-Moda-Tenant-Id"] = tenantId;
-  recordApiRequest();
-  const response = await fetch(endpoint, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(body)
-  });
-  if (!response.ok) {
-    const text = await response.text().catch(() => "");
-    throw new Error(`Failed to generate skills (HTTP ${response.status}): ${text.slice(0, 200)}`);
-  }
-  return await response.json();
-}
-var MAX_IMPROVEMENT_ROUNDS = 3;
-function parseScopeInt(value, flag, max) {
-  if (value === undefined)
-    return;
-  const parsed = /^\d+$/.test(value.trim()) ? Number.parseInt(value, 10) : Number.NaN;
-  if (!Number.isFinite(parsed) || parsed < 1) {
-    throw new CliInputError(`--${flag}=${value} is not a positive integer, so nothing was sent.`, `0 would mean unlimited server-side; omit --${flag} for the server default, or pass a number of 1 or more.`);
-  }
-  if (max !== undefined && parsed > max) {
-    throw new CliInputError(`--${flag}=${value} is above the maximum of ${max}, so nothing was sent.`);
-  }
-  return parsed;
-}
-function parsePositiveInt3(value, fallback) {
-  if (!value)
-    return fallback;
-  const parsed = Number.parseInt(value, 10);
-  return Number.isFinite(parsed) && parsed >= 0 ? parsed : fallback;
-}
-function parseOptionalFloat(value) {
-  if (!value)
-    return;
-  const parsed = Number.parseFloat(value);
-  return Number.isFinite(parsed) ? parsed : undefined;
-}
-function compactObject(input) {
-  return Object.fromEntries(Object.entries(input).filter(([, value]) => value !== undefined));
-}
-function normalizeSkillSource(value) {
-  const normalized = (value || "all").toLowerCase().replace(/-/g, "_");
-  if (["all", "sdk", "coding_agent"].includes(normalized))
-    return normalized;
-  return "all";
-}
-function releaseKeyFor(release, skills, status) {
-  if (release?.generation_run_id)
-    return `${status}:run:${release.generation_run_id}`;
-  if (Number(release?.generation_version || 0) > 0) {
-    return `${status}:version:${Number(release?.generation_version)}`;
-  }
-  return `${status}:legacy:${sha2562(JSON.stringify(skills.map((skill) => ({
-    skill_id: skill.skill_id,
-    hash: sha2562(skill.skill_md || "")
-  })).sort((a, b) => a.skill_id.localeCompare(b.skill_id))))}`;
-}
-function manifestHeaderFor(fetched) {
-  const release = fetched.release;
-  return {
-    tenantId: fetched.tenantId,
-    releaseKey: fetched.releaseKey,
-    statusFilter: fetched.status,
-    generationRunId: release?.generation_run_id || "",
-    generationVersion: Number(release?.generation_version || 0),
-    releasedAt: release?.released_at || ""
-  };
-}
-function sha2562(input) {
-  return createHash2("sha256").update(input).digest("hex");
-}
-async function runSkillsInstall(context, ids) {
-  const { installIntegrationSkill, readBundledIndex, readBundledSkillMd } = await import("./skills-bundled-mdmhzfsr.js");
-  const index = readBundledIndex();
-  if (context.flags.list === "true" || ids.length === 0) {
-    if (!index) {
-      throw new CliInputError("This CLI build has no bundled integration guides", "Install a published @moda-ai/cli, or run `bun run bundle:skills` in apps/moda-cli.");
-    }
-    const skills = index.skills.map((skill) => ({
-      id: skill.id,
-      version: skill.version,
-      language: skill.targets.language,
-      summary: skill.summary
-    }));
-    if (context.outputMode !== "human") {
-      context.output.writeData({ skills });
-    } else {
-      for (const skill of skills)
-        console.log(`${skill.id}	${skill.version}	${skill.summary}`);
-      if (ids.length === 0 && context.flags.list !== "true") {
-        console.error("Install one or more with: moda skills install <id...>");
-      }
-    }
-    return 0;
-  }
-  const unknown = ids.filter((id) => !/^[a-z0-9-]+$/.test(id) || readBundledSkillMd(id) === null);
-  if (unknown.length > 0) {
-    throw new CliInputError(`Not bundled with this CLI: ${unknown.map((id) => JSON.stringify(id).slice(0, 80)).join(", ")}`, "List the bundled guides with: moda skills install --list");
-  }
-  const results = [];
-  for (const id of ids) {
-    try {
-      results.push(installIntegrationSkill(id));
-    } catch (error) {
-      const done = results.map((result) => result.skillId);
-      throw new CliInputError(error instanceof Error ? error.message : String(error), done.length > 0 ? `Already installed before the failure: ${done.join(", ")}. Fix the error and rerun; installed guides are left as they are.` : "List the bundled guides with: moda skills install --list");
-    }
-  }
-  if (context.outputMode !== "human") {
-    context.output.writeData({ installed: results });
-  } else {
-    for (const result of results) {
-      console.log(`${result.status} ${result.skillId}`);
-      for (const path of result.paths)
-        console.log(`  ${path}`);
-    }
-  }
-  return 0;
-}
-var RESERVED_SKILL_PATHS = new Set(["inbox", "library", "observed", "runs", "sync", "surface", "families", "proposals"]);
-async function runSkillRegistryCommand(sub, positionals, flags, context) {
-  const profileOptions = { profile: context.profile, env: context.env };
-  assertFlags(`skills ${sub}`, flags, sub === "policy" ? ["live", "local", "dry-run"] : []);
-  assertPositionals(`skills ${sub}`, positionals, sub === "list" ? 1 : 2, sub === "list" ? "moda skills list" : `moda skills ${sub} <key>${sub === "policy" ? " --live|--local" : ""}`);
-  if (sub === "list") {
-    context.output.writeData(await callControlAPI("/skills", {}, profileOptions));
-    return 0;
-  }
-  const idOrKey = positionals[1];
-  if (!idOrKey) {
-    throw new CliInputError(`A skill key or id is required for skills ${sub}.`, sub === "show" ? "Usage: moda skills show <key>" : "Usage: moda skills policy <key> --live|--local");
-  }
-  if (RESERVED_SKILL_PATHS.has(idOrKey)) {
-    throw new CliInputError(`'${idOrKey}' is a reserved path, so this skill must be addressed by its id.`, "Find the id (skill_…) with `moda skills list`, then pass that instead of the key.");
-  }
-  if (sub === "show") {
-    context.output.writeData(await callControlAPI(`/skills/${encodeURIComponent(idOrKey)}`, {}, profileOptions));
-    return 0;
-  }
-  const live = flags.live === "true";
-  const local = flags.local === "true";
-  if (live === local) {
-    throw new CliInputError("Pass exactly one of --live or --local.", "Usage: moda skills policy <key> --live|--local");
-  }
-  const surfacePolicy = live ? "include" : "local_only";
-  if (context.dryRun) {
-    context.output.writeData({ dryRun: true, planned: { method: "PATCH", endpoint: `/api/skills/${encodeURIComponent(idOrKey)}/surface-policy`, body: { surfacePolicy } } });
-    return 0;
-  }
-  context.output.writeData(await callControlAPI(`/skills/${encodeURIComponent(idOrKey)}/surface-policy`, { method: "PATCH", body: JSON.stringify({ surfacePolicy }) }, profileOptions, { retries: 0 }));
-  return 0;
-}
-
-// src/doctor.ts
-import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
-import { join as join4 } from "node:path";
-async function runDoctorCommand(context) {
-  const report = await buildDoctorReport(context, {
-    offline: context.flags.offline === "true"
-  });
-  if (context.outputMode === "human") {
-    if (!context.quiet)
-      console.log(renderDoctorHuman(report));
-    return { exitCode: 0 };
-  }
-  context.output.writeData(report, {
-    status: report.summary.fail > 0 ? "error" : "success",
-    ...doctorAgentWriteOptions(report, "doctor")
-  });
-  return { exitCode: 0 };
-}
-async function runStatusCommand(context) {
-  const report = await buildDoctorReport(context, {
-    offline: context.flags.offline === "true" || context.flags.online !== "true"
-  });
-  const topBroken = firstBrokenCheck(report.checks);
-  const statusPayload = {
-    schemaVersion: "status.v0.1",
-    generatedAt: report.generatedAt,
-    status: report.summary.status,
-    activeProfile: report.profile.active,
-    auth: {
-      apiKey: resolveApiKey() ? "configured" : "missing"
-    },
-    workspace: {
-      tenantId: resolveTenantId() ?? null,
-      baseUrl: resolveModaBaseUrl(),
-      ingestUrl: resolveIngestUrl()
-    },
-    dataFlow: checkStatus(report.checks, "cloud_data_flow"),
-    harness: checkStatus(report.checks, "harness_manifest_current"),
-    harnessSync: checkStatus(report.checks, "harness_sync_state_present"),
-    harnessReport: "skipped",
-    shadowSpark: "skipped",
-    prompts: checkStatus(report.checks, "prompts_discovered"),
-    skills: checkStatus(report.checks, "skills_discovered"),
-    topBrokenCheck: topBroken ? {
-      id: topBroken.id,
-      status: topBroken.status,
-      severity: topBroken.severity,
-      nextCommand: topBroken.nextCommand
-    } : null,
-    nextCommands: report.nextCommands.slice(0, 3)
-  };
-  if (context.outputMode === "human") {
-    if (!context.quiet)
-      console.log(renderStatusHuman(statusPayload));
-    return { exitCode: 0 };
-  }
-  context.output.writeData(statusPayload, {
-    status: report.summary.fail > 0 ? "error" : "success",
-    ...doctorAgentWriteOptions(report, "status")
-  });
-  return { exitCode: 0 };
-}
-async function buildDoctorReport(context, options) {
-  const checks = [];
-  const profileConfig = loadProfileConfig({ env: context.env });
-  const activeProfile = getActiveProfile({ profile: context.profile, env: context.env });
-  const paths = getModaPaths({ env: context.env });
-  const profileOptions = { profile: context.profile, env: context.env };
-  const apiKey = resolveApiKey(profileOptions);
-  const tenantId = resolveTenantId(profileOptions);
-  const baseUrl = resolveModaBaseUrl(profileOptions);
-  const ingestUrl = resolveIngestUrl(profileOptions);
-  checks.push({
-    id: "active_profile_resolves",
-    group: "config",
-    title: "Active profile resolves",
-    status: activeProfile ? "pass" : "fail",
-    severity: activeProfile ? "info" : "critical",
-    evidence: [
-      { label: "active_profile", value: profileConfig.active_profile },
-      { label: "environment", value: activeProfile.environment }
-    ],
-    remediation: activeProfile ? undefined : "Create or select a Moda profile.",
-    nextCommand: activeProfile ? undefined : "moda profiles list"
-  });
-  checks.push({
-    id: "api_key_resolves",
-    group: "config",
-    title: "API key resolves",
-    status: apiKey ? "pass" : "fail",
-    severity: apiKey ? "info" : "critical",
-    evidence: [{ label: "source", value: apiKey ? "environment/profile/config" : "none" }],
-    remediation: apiKey ? undefined : "Authenticate and create a tenant API key.",
-    nextCommand: apiKey ? undefined : "moda init"
-  });
-  checks.push({
-    id: "tenant_resolves",
-    group: "config",
-    title: "Tenant/workspace resolves",
-    status: tenantId ? "pass" : "warning",
-    severity: tenantId ? "info" : "warning",
-    evidence: [{ label: "tenant_id", value: tenantId ? "configured" : "missing" }],
-    remediation: tenantId ? undefined : "Select a tenant during init or set MODA_TENANT_ID.",
-    nextCommand: tenantId ? undefined : "moda init"
-  });
-  checks.push(authTokenCheck(context, Boolean(apiKey)));
-  checks.push(configPermissionCheck(paths.legacyConfigPath));
-  if (activeProfile.api_key_ref) {
-    const secretPath = secretFilePathFromRef(activeProfile.api_key_ref);
-    if (secretPath)
-      checks.push(secretPermissionCheck(secretPath));
-    checks.push({
-      id: "profile_api_key_ref_resolves",
-      group: "config",
-      title: "Profile API key reference resolves",
-      status: resolveSecretReference(activeProfile.api_key_ref) ? "pass" : "warning",
-      severity: "warning",
-      evidence: [{ label: "api_key_ref", value: activeProfile.api_key_ref }],
-      remediation: "Create or update the profile API key reference.",
-      nextCommand: "moda profiles create"
-    });
-  }
-  checks.push(urlCheck("base_url_valid", "config", "Base URL is valid", baseUrl));
-  checks.push(urlCheck("ingest_url_valid", "config", "Ingest URL is valid", ingestUrl));
-  checks.push(localBaseUrlCheck(activeProfile.environment, baseUrl));
-  const manifestPath = join4(context.cwd, ".moda", "harness.json");
-  const manifestExists = existsSync5(manifestPath);
-  checks.push({
-    id: "harness_manifest_exists",
-    group: "harness",
-    title: "Harness manifest exists",
-    status: manifestExists ? "pass" : "warning",
-    severity: manifestExists ? "info" : "warning",
-    evidence: [{ label: "path", value: ".moda/harness.json" }],
-    remediation: manifestExists ? undefined : "Run `moda harness scan --summary` to scan the project and write a harness manifest.",
-    nextCommand: manifestExists ? undefined : "moda harness scan --summary"
-  });
-  checks.push(harnessCurrentCheck(context.cwd, manifestPath, manifestExists, tenantId));
-  checks.push(harnessSyncStateCheck(context.cwd));
-  checks.push(promptsDiscoveredCheck(context.cwd));
-  checks.push(discoveryCheck("skills_discovered", "harness", "Skills are discovered", context.cwd, [
-    "skills",
-    ".claude/skills",
-    ".cursor/rules"
-  ], "moda skills pull"));
-  checks.push(discoveryCheck("evals_discovered", "harness", "Evals/tests are discovered", context.cwd, [
-    "evals",
-    "tests",
-    "__tests__"
-  ]));
-  checks.push(validationEventPathCheck(ingestUrl));
-  if (options.offline || !apiKey) {
-    checks.push(...offlineCloudChecks(options.offline));
-  } else {
-    checks.push(...await cloudDataFlowChecks(ingestUrl, apiKey));
-  }
-  const nextCommands = nextCommandsForChecks(checks);
-  const summary = summarizeChecks(checks);
-  return {
-    schemaVersion: "doctor.v0.1",
-    generatedAt: new Date().toISOString(),
-    profile: {
-      active: activeProfile.name,
-      requested: context.profile
-    },
-    summary,
-    checks,
-    nextCommands,
-    fixPlan: checks.filter((check) => check.status === "fail" || check.status === "warning").map((check) => ({
-      checkId: check.id,
-      command: check.nextCommand,
-      action: check.remediation ?? "Review this diagnostic."
-    }))
-  };
-}
-function authTokenCheck(context, hasApiKey) {
-  const session = loadAuthSession({
-    profile: context.profile,
-    env: context.env,
-    includeExpired: true
-  });
-  const valid = isAuthSessionValid(session);
-  if (!valid && hasApiKey) {
-    return {
-      id: "auth_token_valid",
-      group: "config",
-      title: "Browser auth token is valid",
-      status: "skipped",
-      severity: "info",
-      evidence: [{ label: "reason", value: "api key configured" }]
-    };
-  }
-  return {
-    id: "auth_token_valid",
-    group: "config",
-    title: "Browser auth token is valid",
-    status: valid ? "pass" : "warning",
-    severity: valid ? "info" : "warning",
-    evidence: [
-      { label: "token", value: session ? "present" : "missing" },
-      ...session ? [{ label: "expires_at", value: new Date(session.expires_at * 1000).toISOString() }] : []
-    ],
-    remediation: valid ? undefined : "Refresh browser authentication.",
-    nextCommand: valid ? undefined : "moda init"
-  };
-}
-function configPermissionCheck(path) {
-  if (!existsSync5(path)) {
-    return {
-      id: "config_file_permissions",
-      group: "config",
-      title: "Config file permissions",
-      status: "skipped",
-      severity: "info",
-      evidence: [{ label: "path", value: path }]
-    };
-  }
-  const permission = ensureSecretFilePermissions(path);
-  return {
-    id: "config_file_permissions",
-    group: "config",
-    title: "Config file permissions",
-    status: permission.secure ? "pass" : "fail",
-    severity: permission.secure ? "info" : "critical",
-    evidence: [
-      { label: "path", value: path },
-      { label: "mode", value: permission.mode ?? "unknown" }
-    ],
-    remediation: permission.secure ? undefined : "Restrict config file permissions to the current user."
-  };
-}
-function secretPermissionCheck(path) {
-  const permission = ensureSecretFilePermissions(path);
-  return {
-    id: "secret_file_permissions",
-    group: "config",
-    title: "Secret file permissions",
-    status: permission.secure ? "pass" : "fail",
-    severity: permission.secure ? "info" : "critical",
-    evidence: [
-      { label: "path", value: path },
-      { label: "mode", value: permission.mode ?? "unknown" }
-    ],
-    remediation: permission.secure ? undefined : "Restrict secret file permissions to the current user."
-  };
-}
-function urlCheck(id, group, title, value) {
-  let valid = false;
-  try {
-    const parsed = new URL(value);
-    valid = parsed.protocol === "http:" || parsed.protocol === "https:";
-  } catch {
-    valid = false;
-  }
-  return {
-    id,
-    group,
-    title,
-    status: valid ? "pass" : "fail",
-    severity: valid ? "info" : "critical",
-    evidence: [{ label: "url", value }],
-    remediation: valid ? undefined : "Configure a valid http(s) URL.",
-    nextCommand: valid ? undefined : "moda profiles create"
-  };
-}
-function localBaseUrlCheck(environment, baseUrl) {
-  if (environment !== "local") {
-    return {
-      id: "local_base_url_frontend",
-      group: "config",
-      title: "Local base URL targets the frontend",
-      status: "skipped",
-      severity: "info",
-      evidence: [{ label: "environment", value: environment }]
-    };
-  }
-  let port = null;
-  let loopback = false;
-  try {
-    const parsed = new URL(baseUrl);
-    loopback = isLoopbackBaseUrl(baseUrl);
-    port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
-  } catch {
-    return {
-      id: "local_base_url_frontend",
-      group: "config",
-      title: "Local base URL targets the frontend",
-      status: "fail",
-      severity: "critical",
-      evidence: [{ label: "base_url", value: baseUrl }],
-      remediation: "Set the local profile base URL to the frontend origin (http://localhost:3000).",
-      nextCommand: "moda profiles create local --environment local --base-url http://localhost:3000"
-    };
-  }
-  const looksLikeBackend = loopback && (port === "3001" || port === "3002");
-  if (looksLikeBackend) {
-    return {
-      id: "local_base_url_frontend",
-      group: "config",
-      title: "Local base URL targets the frontend",
-      status: "warning",
-      severity: "warning",
-      evidence: [
-        { label: "base_url", value: baseUrl },
-        { label: "port", value: port ?? "unknown" }
-      ],
-      remediation: "Local CLI auth and control APIs are served by the frontend. " + "Use http://localhost:3000 (or your worktree frontend port), not the backend :3001.",
-      nextCommand: "moda profiles create local --environment local --base-url http://localhost:3000 --use"
-    };
-  }
-  if (!loopback) {
-    return {
-      id: "local_base_url_frontend",
-      group: "config",
-      title: "Local base URL targets the frontend",
-      status: "warning",
-      severity: "warning",
-      evidence: [{ label: "base_url", value: baseUrl }],
-      remediation: "Local profile should use a loopback frontend URL (http://localhost:3000). " + "Activate with `moda profiles use local` or set MODA_PROFILE=local.",
-      nextCommand: "moda profiles use local"
-    };
-  }
-  return {
-    id: "local_base_url_frontend",
-    group: "config",
-    title: "Local base URL targets the frontend",
-    status: "pass",
-    severity: "info",
-    evidence: [{ label: "base_url", value: baseUrl }]
-  };
-}
-function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId) {
-  if (!manifestExists) {
-    return {
-      id: "harness_manifest_current",
-      group: "harness",
-      title: "Harness manifest matches scanner output",
-      status: "skipped",
-      severity: "info",
-      evidence: [{ label: "reason", value: "manifest missing" }],
-      nextCommand: "moda harness scan --summary"
-    };
-  }
-  try {
-    const current = scanHarness({
-      rootDir: cwd,
-      scannerVersion: "doctor",
-      tenantId,
-      tenantSource: tenantId ? "env_or_config" : undefined
-    });
-    const saved = JSON.parse(readFileSync4(manifestPath, "utf8"));
-    const savedHash = stableGraphHash(saved);
-    const currentHash = stableGraphHash(current);
-    const matches = savedHash === currentHash;
-    return {
-      id: "harness_manifest_current",
-      group: "harness",
-      title: "Harness manifest matches scanner output",
-      status: matches ? "pass" : "warning",
-      severity: matches ? "info" : "warning",
-      evidence: [
-        { label: "saved_hash", value: savedHash.slice(0, 12) },
-        { label: "current_hash", value: currentHash.slice(0, 12) },
-        ...matches ? [] : [{ label: "diff", value: "Manifest hash differs from fresh scanner output." }]
-      ],
-      remediation: matches ? undefined : "Refresh the local harness manifest.",
-      nextCommand: matches ? undefined : "moda harness scan --summary"
-    };
-  } catch (err) {
-    return {
-      id: "harness_manifest_current",
-      group: "harness",
-      title: "Harness manifest matches scanner output",
-      status: "fail",
-      severity: "critical",
-      evidence: [{ label: "error", value: err instanceof Error ? err.message : String(err) }],
-      remediation: "Regenerate the harness manifest.",
-      nextCommand: "moda harness scan --summary"
-    };
-  }
-}
-function harnessSyncStateCheck(cwd) {
-  const state = readHarnessSyncState(cwd);
-  if (!state) {
-    return {
-      id: "harness_sync_state_present",
-      group: "harness",
-      title: "Harness sync state exists",
-      status: "warning",
-      severity: "warning",
-      evidence: [{ label: "path", value: ".moda/sync-state.json" }],
-      remediation: "Sync the harness graph so Moda can correlate local state with cloud state.",
-      nextCommand: "moda harness sync --dry-run"
-    };
-  }
-  return {
-    id: "harness_sync_state_present",
-    group: "harness",
-    title: "Harness sync state exists",
-    status: "pass",
-    severity: "info",
-    evidence: [
-      { label: "updated_at", value: state.updatedAt },
-      { label: "profile", value: state.profile },
-      { label: "harness_id", value: state.harnessId },
-      { label: "remote_version_id", value: state.remote.versionId || "none" }
-    ]
-  };
-}
-function promptsDiscoveredCheck(cwd) {
-  const base = { id: "prompts_discovered", group: "harness", title: "Prompts are discovered" };
-  if (!existsSync5(join4(cwd, ".moda", "prompts.yml"))) {
-    return discoveryCheck(base.id, base.group, base.title, cwd, ["prompts", ".moda/prompts.yml"], "moda prompts init");
-  }
-  let inspection;
-  try {
-    inspection = inspectPromptManifest(cwd);
-  } catch (error) {
-    return {
-      ...base,
-      status: "fail",
-      severity: "warning",
-      evidence: [{ label: "manifest", value: ".moda/prompts.yml" }, { label: "error", value: error instanceof Error ? error.message : String(error) }],
-      remediation: "Fix .moda/prompts.yml (version, prompt_paths, sources).",
-      nextCommand: "moda prompts status"
-    };
-  }
-  const evidence = [
-    { label: "manifest", value: `.moda/prompts.yml (version ${inspection.manifestVersion})` },
-    { label: "matched_files", value: String(inspection.matchedFiles) },
-    { label: "sources", value: String(inspection.sources) },
-    ...inspection.zeroMatchPatterns.length > 0 ? [{ label: "zero_match_patterns", value: inspection.zeroMatchPatterns.join(", ") }] : [],
-    ...inspection.legacyOnlyFiles.length > 0 ? [{
-      label: "legacy_only_files",
-      value: `${inspection.legacyOnlyFiles.length} (${inspection.legacyOnlyFiles.slice(0, 3).join(", ")}${inspection.legacyOnlyFiles.length > 3 ? ", ..." : ""})`
-    }] : []
-  ];
-  if (inspection.legacyOnlyFiles.length > 0) {
-    return {
-      ...base,
-      status: "warning",
-      severity: "warning",
-      evidence,
-      remediation: "Prompt files found by older CLIs no longer match the manifest globs (they are exact paths from the repository root). Migrate the manifest to keep them tracked under their existing keys.",
-      nextCommand: "moda prompts migrate --dry-run"
-    };
-  }
-  if (inspection.matchedFiles === 0 && inspection.sources === 0) {
-    return {
-      ...base,
-      status: "warning",
-      severity: "warning",
-      evidence,
-      remediation: "The prompt manifest matches no files and maps no sources, so sync registers nothing. Fix prompt_paths or preview source discovery.",
-      nextCommand: "moda prompts sync --dry-run"
-    };
-  }
-  return { ...base, status: "pass", severity: "info", evidence };
-}
-function discoveryCheck(id, group, title, cwd, relativePaths, nextCommand) {
-  const found = relativePaths.filter((path) => existsSync5(join4(cwd, path)));
-  return {
-    id,
-    group,
-    title,
-    status: found.length > 0 ? "pass" : "warning",
-    severity: found.length > 0 ? "info" : "warning",
-    evidence: [{ label: "paths", value: found.length > 0 ? found.join(", ") : "none" }],
-    remediation: found.length > 0 ? undefined : `Expected one of: ${relativePaths.join(", ")}.`,
-    nextCommand: found.length > 0 ? undefined : nextCommand
-  };
-}
-function validationEventPathCheck(ingestUrl) {
-  return {
-    id: "validation_event_path_defined",
-    group: "cloud",
-    title: "Validation event path is defined",
-    status: "pass",
-    severity: "info",
-    evidence: [{ label: "path", value: `${ingestUrl.replace(/\/+$/, "")}/v1/otel/validation` }]
-  };
-}
-function offlineCloudChecks(isOffline) {
-  const status = isOffline ? "skipped" : "warning";
-  const evidence = [{ label: "mode", value: isOffline ? "offline" : "missing api key" }];
-  const remediation = isOffline ? "Rerun without --offline to check Moda Cloud." : "Configure an API key before checking cloud data flow.";
-  const nextCommand = isOffline ? "moda doctor --online" : "moda init";
-  return [
-    {
-      id: "cloud_api_reachable",
-      group: "cloud",
-      title: "Moda Cloud API is reachable",
-      status,
-      severity: "warning",
-      evidence,
-      remediation,
-      nextCommand
-    },
-    {
-      id: "ingest_endpoint_reachable",
-      group: "cloud",
-      title: "Moda ingest endpoint is reachable",
-      status,
-      severity: "warning",
-      evidence,
-      remediation,
-      nextCommand
-    },
-    {
-      id: "recent_data_flow",
-      group: "cloud",
-      title: "Recent traces/logs/runs exist",
-      status,
-      severity: "warning",
-      evidence,
-      remediation,
-      nextCommand
-    },
-    {
-      id: "cloud_data_flow",
-      group: "cloud",
-      title: "Moda Cloud data flow",
-      status,
-      severity: "warning",
-      evidence,
-      remediation,
-      nextCommand
-    }
-  ];
-}
-async function cloudDataFlowChecks(ingestUrl, apiKey) {
-  let overview;
-  let cloudApiCheck;
-  try {
-    overview = await callDataAPI("/overview?days_back=1");
-    cloudApiCheck = {
-      id: "cloud_api_reachable",
-      group: "cloud",
-      title: "Moda Cloud API is reachable",
-      status: "pass",
-      severity: "info",
-      evidence: [{ label: "overview", value: "reachable" }]
-    };
-  } catch (err) {
-    const error = err instanceof Error ? err.message : String(err);
-    return [
-      {
-        id: "cloud_api_reachable",
-        group: "cloud",
-        title: "Moda Cloud API is reachable",
-        status: "warning",
-        severity: "warning",
-        evidence: [{ label: "error", value: error }],
-        remediation: "Check API key and base URL.",
-        nextCommand: "moda doctor --offline"
-      },
-      {
-        id: "ingest_endpoint_reachable",
-        group: "cloud",
-        title: "Moda ingest endpoint is reachable",
-        status: "skipped",
-        severity: "warning",
-        evidence: [{ label: "reason", value: "cloud API unreachable" }]
-      },
-      {
-        id: "recent_data_flow",
-        group: "cloud",
-        title: "Recent traces/logs/runs exist",
-        status: "skipped",
-        severity: "warning",
-        evidence: [{ label: "reason", value: "overview unavailable" }]
-      },
-      {
-        id: "cloud_data_flow",
-        group: "cloud",
-        title: "Moda Cloud data flow",
-        status: "warning",
-        severity: "warning",
-        evidence: [{ label: "error", value: error }],
-        remediation: "Check API key, base URL, and whether data has reached Moda.",
-        nextCommand: "moda doctor --offline"
-      }
-    ];
-  }
-  const ingestCheck = await ingestReachabilityCheck(ingestUrl, apiKey);
-  const recentCheck = recentDataFlowCheck(overview);
-  const cloudStatus = cloudApiCheck.status === "pass" && ingestCheck.status === "pass" && recentCheck.status === "pass" ? "pass" : "warning";
-  return [
-    cloudApiCheck,
-    ingestCheck,
-    recentCheck,
-    {
-      id: "cloud_data_flow",
-      group: "cloud",
-      title: "Moda Cloud data flow",
-      status: cloudStatus,
-      severity: cloudStatus === "pass" ? "info" : "warning",
-      evidence: [
-        { label: "cloud_api", value: cloudApiCheck.status },
-        { label: "ingest", value: ingestCheck.status },
-        { label: "recent_data", value: recentCheck.status }
-      ],
-      remediation: cloudStatus === "pass" ? undefined : "Check API key, ingest URL, and whether data has reached Moda.",
-      nextCommand: cloudStatus === "pass" ? undefined : "moda doctor --offline"
-    }
-  ];
-}
-async function ingestReachabilityCheck(ingestUrl, apiKey) {
-  const url = `${ingestUrl.replace(/\/+$/, "")}/`;
-  try {
-    recordApiRequest();
-    const response = await fetch(url, {
-      method: "GET",
-      headers: { Authorization: `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(1e4)
-    });
-    return {
-      id: "ingest_endpoint_reachable",
-      group: "cloud",
-      title: "Moda ingest endpoint is reachable",
-      status: "pass",
-      severity: "info",
-      evidence: [
-        { label: "url", value: url },
-        { label: "http_status", value: String(response.status) }
-      ]
-    };
-  } catch (err) {
-    return {
-      id: "ingest_endpoint_reachable",
-      group: "cloud",
-      title: "Moda ingest endpoint is reachable",
-      status: "warning",
-      severity: "warning",
-      evidence: [{ label: "error", value: err instanceof Error ? err.message : String(err) }],
-      remediation: "Check the configured ingest URL and network reachability.",
-      nextCommand: "moda profiles create"
-    };
-  }
-}
-function recentDataFlowCheck(overview) {
-  const data = isRecord(overview) ? overview : {};
-  const conversations = numberAt(data, ["conversations", "total"]);
-  const toolFailures = numberAt(data, ["tool_failures", "total"]);
-  const recentActivity = Array.isArray(data.recent_activity) ? data.recent_activity : [];
-  const lastEventAt = lastActivityTimestamp(recentActivity);
-  const hasData = conversations > 0 || toolFailures > 0 || Boolean(lastEventAt);
-  return {
-    id: "recent_data_flow",
-    group: "cloud",
-    title: "Recent traces/logs/runs exist",
-    status: hasData ? "pass" : "warning",
-    severity: hasData ? "info" : "warning",
-    evidence: [
-      { label: "conversations", value: String(conversations) },
-      { label: "tool_failures", value: String(toolFailures) },
-      { label: "last_event_at", value: lastEventAt ?? "none" }
-    ],
-    remediation: hasData ? undefined : "No recent Moda data was visible in the overview window.",
-    nextCommand: hasData ? undefined : "moda init"
-  };
-}
-function numberAt(value, path) {
-  let cursor = value;
-  for (const key of path) {
-    if (!isRecord(cursor))
-      return 0;
-    cursor = cursor[key];
-  }
-  return typeof cursor === "number" && Number.isFinite(cursor) ? cursor : 0;
-}
-function lastActivityTimestamp(items) {
-  const timestamps = items.map((item) => isRecord(item) && typeof item.timestamp === "string" ? item.timestamp : undefined).filter((item) => Boolean(item)).sort();
-  return timestamps.at(-1);
-}
-function summarizeChecks(checks) {
-  const fail = checks.filter((check) => check.status === "fail").length;
-  const warning = checks.filter((check) => check.status === "warning").length;
-  const skipped = checks.filter((check) => check.status === "skipped").length;
-  const pass = checks.filter((check) => check.status === "pass").length;
-  return {
-    status: fail > 0 ? "fail" : warning > 0 ? "warning" : "pass",
-    pass,
-    warning,
-    fail,
-    skipped
-  };
-}
-function nextCommandsForChecks(checks) {
-  return [...new Set(checks.filter((check) => check.status === "fail" || check.status === "warning").map((check) => check.nextCommand).filter((command) => Boolean(command)))];
-}
-function firstBrokenCheck(checks) {
-  return checks.find((check) => check.status === "fail") ?? checks.find((check) => check.status === "warning");
-}
-function checkStatus(checks, id) {
-  return checks.find((check) => check.id === id)?.status ?? "skipped";
-}
-function doctorAgentWriteOptions(report, command) {
-  const broken = report.checks.filter((check) => check.status === "fail" || check.status === "warning");
-  return {
-    summary: `${command} completed with status ${report.summary.status}: ${report.summary.fail} failing checks and ${report.summary.warning} warnings.`,
-    findings: broken.slice(0, 16).map((check) => ({
-      id: check.id,
-      title: check.title,
-      status: check.status,
-      severity: check.severity,
-      description: check.remediation ?? `Doctor check ${check.id} is ${check.status}.`,
-      evidence_ref_ids: [`doctor:${check.id}`]
-    })),
-    evidenceRefs: report.checks.map((check) => ({
-      id: `doctor:${check.id}`,
-      kind: "doctor_check",
-      label: check.title,
-      status: check.status
-    })),
-    recommendedActions: report.fixPlan.slice(0, 16).map((item, index) => ({
-      id: `doctor_action_${index + 1}_${item.checkId}`,
-      title: item.action,
-      command: item.command,
-      rationale: `Doctor check ${item.checkId} is not passing.`,
-      mutability: item.command ? agentMutabilityForCommand(item.command) : "unknown",
-      requires_approval: item.command ? agentCommandRequiresApproval(item.command) : true
-    })),
-    nextCommands: report.nextCommands.slice(0, 16).map((nextCommand) => ({
-      command: nextCommand,
-      purpose: agentPurposeForCommand(nextCommand),
-      mutability: agentMutabilityForCommand(nextCommand),
-      requires_approval: agentCommandRequiresApproval(nextCommand)
-    })),
-    warnings: broken.filter((check) => check.status === "warning").slice(0, 16).map((check) => `${check.title}: ${check.remediation ?? check.status}`)
-  };
-}
-function agentMutabilityForCommand(command) {
-  if (/\bsync\b/.test(command))
-    return "sync";
-  if (/\b(init|install|approve|pull|gen|promote|remove)\b/.test(command))
-    return "write";
-  return "read";
-}
-function agentCommandRequiresApproval(command) {
-  return agentMutabilityForCommand(command) !== "read" && !command.includes("--dry-run");
-}
-function agentPurposeForCommand(command) {
-  if (command.includes("doctor"))
-    return "Re-run Moda diagnostics.";
-  if (command.includes("harness approve"))
-    return "Approve the validated harness report after review.";
-  if (command.includes("harness sync"))
-    return "Sync harness state to Moda Cloud.";
-  if (command.includes("harness scan"))
-    return "Refresh the local harness manifest.";
-  if (command.includes("init"))
-    return "Run Moda onboarding.";
-  return "Inspect or repair Moda setup.";
-}
-function stableGraphHash(graph) {
-  return createHash3("sha256").update(JSON.stringify(sortJson({
-    ...graph,
-    scan: {
-      ...graph.scan,
-      createdAt: undefined,
-      scannerVersion: undefined,
-      skipped: undefined
-    }
-  }))).digest("hex");
-}
-function sortJson(value) {
-  if (Array.isArray(value))
-    return value.map((item) => sortJson(item));
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sortJson(item)]));
-  }
-  return value;
-}
-function isRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
-export { DEFAULT_POLL_INTERVAL_MS, DEFAULT_WAIT_TIMEOUT_MS, fetchLatestRun, runPromptsCommand, initPrompts, runPromptSync, runSkillSync, runSkillsCommand, runDoctorCommand, runStatusCommand, buildDoctorReport };
+export { DEFAULT_POLL_INTERVAL_MS, DEFAULT_WAIT_TIMEOUT_MS, fetchLatestRun, runPromptsCommand, initPrompts, runPromptSync, writePromptSyncProgress, discoverPrompts, inspectPromptManifest, promptManifestWarnings, migratePromptManifest, importHarnessPromptSources, readPromptLock, parsePromptFileForAb, assertReplayablePrompt };