@moda-ai/cli 1.55.26 → 1.55.28

package/dist/cli-k4tqwah4.js

@@ -0,0 +1,89 @@
+// src/errors.ts
+class CliInputError extends Error {
+  usage;
+  reason;
+  details;
+  constructor(message, usage, reason, details) {
+    super(message);
+    this.usage = usage;
+    this.reason = reason;
+    this.details = details;
+    this.name = "CliInputError";
+  }
+}
+var inputDetails = new WeakMap;
+function attachInputDetails(error, details) {
+  inputDetails.set(error, details);
+}
+function inputDetailsOf(error) {
+  if (error instanceof CliInputError && error.details)
+    return error.details;
+  return error !== null && typeof error === "object" ? inputDetails.get(error) : undefined;
+}
+
+class CliAccessError extends Error {
+  guidance;
+  constructor(message, options = {}) {
+    super(message);
+    this.name = "CliAccessError";
+    this.guidance = options.guidance;
+  }
+}
+
+class CliInputRequiredError extends Error {
+  input_request;
+  constructor(message, input_request, usage) {
+    super(message);
+    this.input_request = input_request;
+    this.name = "CliInputRequiredError";
+    if (usage)
+      this.usage = usage;
+  }
+  usage;
+}
+
+class CliAuthError extends Error {
+  auth;
+  constructor(message, auth, usage) {
+    super(message);
+    this.auth = auth;
+    this.name = "CliAuthError";
+    if (usage)
+      this.usage = usage;
+  }
+  usage;
+}
+
+class CliNotFoundError extends Error {
+  entity;
+  id;
+  usage;
+  constructor(entity, id, message, usage) {
+    super(message ?? `No ${entity} found for id "${id}" in this tenant.`);
+    this.entity = entity;
+    this.id = id;
+    this.usage = usage;
+    this.name = "CliNotFoundError";
+  }
+}
+
+class CliCancellationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CliCancellationError";
+  }
+}
+function isNetworkLikeError(error) {
+  return error instanceof Error && (error.message.startsWith("Network error:") || error.message.startsWith("Request timed out") || error.name === "AbortError" || /(?:ECONNRESET|ECONNREFUSED|ETIMEDOUT|ENOTFOUND|socket hang up)/i.test(error.message));
+}
+function isApiLikeError(error) {
+  return error instanceof Error && (error.name === "ApiError" || ("statusCode" in error) && typeof error.statusCode === "number");
+}
+function apiErrorStatus(error) {
+  if (!isApiLikeError(error))
+    return;
+  const status = error.statusCode;
+  return typeof status === "number" ? status : undefined;
+}
+
+export { CliInputError, attachInputDetails, inputDetailsOf, CliAccessError, CliInputRequiredError, CliAuthError, CliNotFoundError, CliCancellationError, isNetworkLikeError, isApiLikeError, apiErrorStatus };

package/dist/{cli-8tfk8qeb.js → cli-mg5zv4s6.js}

@@ -1,30 +1,33 @@
+import {
+  SKILL_SOURCE_HARNESS,
+  SKILL_SOURCE_INTEGRATION_BUNDLED,
+  claudeSkillToCursorRule,
+  detectAgents,
+  pruneManagedSkillPaths,
+  readSkillsManifest,
+  writeSkillsManifest
+} from "./cli-8dtnwp9r.js";
 import {
   createCommandContext
-} from "./cli-cdrvjva5.js";
+} from "./cli-dr6x0zv7.js";
 import {
   assertFlags,
   assertPositionals,
   writeDryRun
-} from "./cli-jgfm7w1r.js";
+} from "./cli-n2hng3gv.js";
 import {
   callControlAPI
-} from "./cli-jtyvbd8d.js";
+} from "./cli-e23g9ywa.js";
 import {
-  CliInputError,
   recordApiRequest,
   resolveApiKey,
   resolveIngestUrl,
-  resolveTenantId
-} from "./cli-sqsjd08w.js";
+  resolveTenantId,
+  shellArg
+} from "./cli-99p2jh28.js";
 import {
-  SKILL_SOURCE_HARNESS,
-  SKILL_SOURCE_INTEGRATION_BUNDLED,
-  claudeSkillToCursorRule,
-  detectAgents,
-  pruneManagedSkillPaths,
-  readSkillsManifest,
-  writeSkillsManifest
-} from "./cli-8dtnwp9r.js";
+  CliInputError
+} from "./cli-k4tqwah4.js";
 import {
   __require
 } from "./cli-0v6na3yp.js";
@@ -672,7 +675,7 @@ async function runSkillsCommand(input) {
         "accepted: true",
         result.generation_run_id && `generation_run_id: ${result.generation_run_id}`,
         result.message && `message: ${result.message}`,
-        result.generation_run_id && `follow progress: moda skills status ${result.generation_run_id}`
+        result.generation_run_id && `follow progress: moda skills status ${shellArg(result.generation_run_id)}`
       ].filter(Boolean).join(`
 `));
     } else {

package/dist/{cli-jgfm7w1r.js → cli-n2hng3gv.js}

@@ -2,17 +2,20 @@ import {
   ApiError,
   callControlAPI,
   callDataAPI
-} from "./cli-jtyvbd8d.js";
+} from "./cli-e23g9ywa.js";
 import {
-  CliAccessError,
-  CliInputError,
   continuationCommand,
   embeddedTenantIdFromApiKey,
   isPlatformApiKey,
   resolveApiKey,
   resolveApiTenantId,
-  setPlatformTenantOverride
-} from "./cli-sqsjd08w.js";
+  setPlatformTenantOverride,
+  shellArg
+} from "./cli-99p2jh28.js";
+import {
+  CliAccessError,
+  CliInputError
+} from "./cli-k4tqwah4.js";
 
 // src/schemas.ts
 import { z } from "zod";
@@ -1332,7 +1335,7 @@ var SIGNALS_MANAGEMENT_SUBCOMMANDS = new Set([
 ]);
 function unknownSignalsSubcommandError(sub, args = []) {
   if (sub === "archive") {
-    const id = args[0] ?? "<signal_id>";
+    const id = args[0] ? shellArg(args[0]) : "<signal_id>";
     return new CliInputError(`Unknown signals subcommand 'archive': archiving a signal is dashboard-only, so nothing was sent.`, `To stop a signal from running, pause it: moda signals pause ${id}. Drafts can be deleted with moda signals delete ${id}.`);
   }
   return new CliInputError(`Unknown signals subcommand '${sub}', so nothing was sent. Valid subcommands: ${[...SIGNALS_MANAGEMENT_SUBCOMMANDS].join(", ")}.`, `Bare 'moda signals' lists custom signals; 'moda signal <signal_id>' opens one. Usage:

package/dist/cli-ns5fcnkz.js

@@ -0,0 +1,341 @@
+// ../../packages/harness-snapshot/src/policy.ts
+var MAX_SCANNED_FILE_BYTES = 512 * 1024;
+var DEFAULT_MAX_INVENTORY_FILES = 12000;
+var DEFAULT_MAX_INVENTORY_TEXT_BYTES = 48 * 1024 * 1024;
+var MAX_SNAPSHOT_BODY_BYTES = 4500000;
+var MAX_RECORDED_SKIPS = 1000;
+var SKIPPED_DIRS = new Set([
+  ".angular",
+  ".cache",
+  ".expo",
+  ".git",
+  ".hg",
+  ".idea",
+  ".svn",
+  ".next",
+  ".nuxt",
+  ".output",
+  ".parcel-cache",
+  ".pytest_cache",
+  ".ruff_cache",
+  ".serverless",
+  ".sst",
+  ".turbo",
+  ".wrangler",
+  ".wrangler-shared",
+  ".moda",
+  ".moda-test",
+  ".moda-test-home",
+  ".moda-cli-workspaces",
+  ".moda-cli-benchmarks",
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  "out",
+  "target",
+  "logs",
+  "tmp",
+  "temp",
+  "__pycache__",
+  ".venv",
+  "venv"
+]);
+var SKIPPED_PATH_PREFIXES = [
+  ".claude/worktrees",
+  ".codex/environments"
+];
+function posixNormalize(path) {
+  const absolute = path.startsWith("/");
+  const parts = path.split("/").filter((part) => part !== "" && part !== ".");
+  const normalized = parts.join("/");
+  return absolute ? `/${normalized}` : normalized;
+}
+function basename(path) {
+  const normalized = posixNormalize(path);
+  const index = normalized.lastIndexOf("/");
+  return index === -1 ? normalized : normalized.slice(index + 1);
+}
+function extname(path) {
+  const name = basename(path);
+  const index = name.lastIndexOf(".");
+  return index <= 0 ? "" : name.slice(index);
+}
+function isSkippedDir(path) {
+  return SKIPPED_DIRS.has(basename(path));
+}
+function isSkippedPathPrefix(path) {
+  const normalized = posixNormalize(path);
+  return SKIPPED_PATH_PREFIXES.some((prefix) => normalized === prefix || normalized.startsWith(`${prefix}/`));
+}
+function isSourceFile(path) {
+  return /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(path);
+}
+function isPackageOrLockfile(path) {
+  return path === "package.json" || path === "pyproject.toml" || path === "bun.lock" || path === "bun.lockb" || path === "pnpm-lock.yaml" || path === "yarn.lock";
+}
+function isPromptLikePath(path) {
+  return /(^|\/)prompts?\//i.test(path) && /\.(prompt\.)?(md|json|ya?ml)$/i.test(path);
+}
+function isSkillLikePath(path) {
+  return /(^|\/)(\.claude\/skills|\.cursor\/rules|skills?)\//i.test(path) && /\.(md|mdc)$/i.test(path);
+}
+function isEvalLikePath(path) {
+  return /(^|\/)(evals?|tests?|__tests__)\//i.test(path) && /\.(ts|tsx|js|mjs|py|json|ya?ml)$/i.test(path);
+}
+function isDeploymentLikePath(path) {
+  return /(^|\/)(wrangler\.toml|vercel\.json|render\.ya?ml|railway\.json|Dockerfile|docker-compose\.ya?ml)$/i.test(path) || /^\.github\/workflows\/[^/]+\.ya?ml$/i.test(path);
+}
+function isDeveloperAgentConfigPath(path) {
+  return path === ".claude/settings.json" || path === ".codex/hooks.json" || path === ".cursor/hooks.json";
+}
+function isReadmeOrAgents(path) {
+  const name = basename(path);
+  return name === "README.md" || name === "AGENTS.md";
+}
+function shouldInventoryFile(path) {
+  const normalized = posixNormalize(path);
+  const name = basename(normalized);
+  const extension = extname(normalized).toLowerCase();
+  if (isSourceFile(normalized))
+    return true;
+  if (isPackageOrLockfile(normalized))
+    return true;
+  if (isPromptLikePath(normalized))
+    return true;
+  if (isSkillLikePath(normalized))
+    return true;
+  if (isEvalLikePath(normalized))
+    return true;
+  if (isDeploymentLikePath(normalized))
+    return true;
+  if (isDeveloperAgentConfigPath(normalized))
+    return true;
+  if (isReadmeOrAgents(normalized))
+    return true;
+  return extension === ".toml" && (name === "pyproject.toml" || name === "wrangler.toml");
+}
+function isTextFile(path) {
+  const extension = extname(path).toLowerCase();
+  return [
+    "",
+    ".cjs",
+    ".js",
+    ".json",
+    ".jsx",
+    ".md",
+    ".mdc",
+    ".mjs",
+    ".py",
+    ".toml",
+    ".ts",
+    ".tsx",
+    ".txt",
+    ".yaml",
+    ".yml"
+  ].includes(extension);
+}
+function isSecretishPath(path) {
+  const name = basename(path).toLowerCase();
+  return name === ".env" || name.startsWith(".env.") || name.includes("secret") || name.includes("private-key") || name.endsWith(".pem");
+}
+
+// ../../packages/harness-snapshot/src/redact.ts
+var REDACTED = "[REDACTED]";
+var MAX_DEPTH = 256;
+var SECRET_KEYS = new Set([
+  "api_key",
+  "apikey",
+  "token",
+  "access_token",
+  "authorization",
+  "secret",
+  "password",
+  "cli_token"
+]);
+var SECRET_PATTERNS = [
+  { pattern: /\bmoda_sk_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bmoda_pk_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bmoda_ct_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bBearer\s+([A-Za-z0-9._~+/-]+=*)\b/gi, prefixLength: 8 },
+  { pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bsk-ant-api\d{2}-[A-Za-z0-9_-]{20,}\b/g, prefixLength: 12 },
+  { pattern: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\b/g, prefixLength: 8 },
+  { pattern: /\bAKIA[A-Z0-9]{16}\b/g, prefixLength: 8 },
+  { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, prefixLength: 8 },
+  { pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g, prefixLength: 8 },
+  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, prefixLength: 8 }
+];
+function redactDeep(value) {
+  return redactValue(value, 0, new WeakSet);
+}
+function redactValue(value, depth, seen) {
+  if (typeof value === "string")
+    return redactString(value);
+  if (value === null || typeof value !== "object")
+    return value;
+  if (depth >= MAX_DEPTH)
+    return "[MaxDepth]";
+  if (seen.has(value))
+    return "[Circular]";
+  seen.add(value);
+  if (Array.isArray(value)) {
+    try {
+      return value.map((item) => redactValue(item, depth + 1, seen));
+    } finally {
+      seen.delete(value);
+    }
+  }
+  const out = {};
+  try {
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = shouldRedactKey(key) ? redactSecretValue(item) : redactValue(item, depth + 1, seen);
+    }
+  } finally {
+    seen.delete(value);
+  }
+  return out;
+}
+function shouldRedactKey(key) {
+  return SECRET_KEYS.has(key.replace(/[-\s]/g, "_").toLowerCase());
+}
+function redactSecretValue(value) {
+  if (typeof value !== "string")
+    return REDACTED;
+  const redacted = redactString(value);
+  if (redacted !== value)
+    return redacted;
+  if (/^(configured|missing|not_configured|none|present|absent)$/i.test(value))
+    return value;
+  return REDACTED;
+}
+function redactStringWithCount(input) {
+  let text = input;
+  let redactionCount = 0;
+  for (const { pattern, prefixLength } of SECRET_PATTERNS) {
+    text = text.replace(pattern, (match) => {
+      redactionCount += 1;
+      if (/^Bearer\s+/i.test(match)) {
+        const token = match.replace(/^Bearer\s+/i, "");
+        return `Bearer ${token.slice(0, prefixLength)}...[REDACTED]`;
+      }
+      return `${match.slice(0, prefixLength)}...[REDACTED]`;
+    });
+  }
+  return { text, redactionCount };
+}
+function redactString(input) {
+  return redactStringWithCount(input).text;
+}
+function redactSnapshotText(text) {
+  const parts = text.split(/(\r\n|\r|\n)/);
+  let redactionCount = 0;
+  for (let index = 0;index < parts.length; index += 2) {
+    const redacted = redactStringWithCount(parts[index] ?? "");
+    parts[index] = redacted.text;
+    redactionCount += redacted.redactionCount;
+  }
+  return { text: parts.join(""), redactionCount };
+}
+
+// ../../packages/harness-snapshot/src/pack.ts
+function utf8ByteLength(value) {
+  let bytes = 0;
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        index += 1;
+      } else {
+        bytes += 3;
+      }
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+function isValidRelativePath(path) {
+  if (path.length === 0 || path.startsWith("/") || path.includes("\\"))
+    return false;
+  return !path.split("/").some((part) => part === "..");
+}
+function packSnapshot(inputs, opts) {
+  const maxFiles = opts.maxFiles ?? DEFAULT_MAX_INVENTORY_FILES;
+  const maxTextBytes = opts.maxTextBytes ?? DEFAULT_MAX_INVENTORY_TEXT_BYTES;
+  const maxSnapshotBytes = opts.maxSnapshotBytes ?? MAX_SNAPSHOT_BODY_BYTES;
+  const files = [];
+  const skips = [];
+  let inventoryTextBytes = 0;
+  let serializedBytes = 0;
+  let byteCount = 0;
+  let truncated = false;
+  const recordSkip = (path, reason) => {
+    if (skips.length < MAX_RECORDED_SKIPS)
+      skips.push({ path, reason });
+  };
+  const sorted = [...inputs].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+  for (const input of sorted) {
+    if (!isValidRelativePath(input.path)) {
+      recordSkip(input.path, "invalid relative path");
+      continue;
+    }
+    const path = posixNormalize(input.path);
+    if (input.isSymlink) {
+      recordSkip(path, "symlink skipped for safety");
+      continue;
+    }
+    if (isSecretishPath(path)) {
+      recordSkip(path, "secret-bearing path");
+      continue;
+    }
+    if (!shouldInventoryFile(path)) {
+      recordSkip(path, "not an inventory file");
+      continue;
+    }
+    if (!isTextFile(path)) {
+      recordSkip(path, "non-text file");
+      continue;
+    }
+    if (input.byteSize > MAX_SCANNED_FILE_BYTES) {
+      recordSkip(path, "file too large");
+      truncated = true;
+      continue;
+    }
+    if (files.length >= maxFiles || inventoryTextBytes + input.byteSize > maxTextBytes) {
+      recordSkip(path, "inventory budget");
+      truncated = true;
+      continue;
+    }
+    const text = opts.redact === false ? input.text : redactSnapshotText(input.text).text;
+    const file = { path, text };
+    const serializedCost = utf8ByteLength(JSON.stringify(file)) + 1;
+    if (serializedBytes + serializedCost > maxSnapshotBytes) {
+      recordSkip(path, "snapshot budget");
+      truncated = true;
+      break;
+    }
+    files.push(file);
+    inventoryTextBytes += input.byteSize;
+    serializedBytes += serializedCost;
+    byteCount += utf8ByteLength(text);
+  }
+  return {
+    snapshot: {
+      repo: { name: opts.repoName, root: "." },
+      files,
+      truncated,
+      fileCount: files.length,
+      byteCount,
+      ...opts.gitCommit ? { gitCommit: opts.gitCommit } : {}
+    },
+    skips
+  };
+}
+export { MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot };

package/dist/{cli-5g1tv80h.js → cli-ny48a8de.js}

@@ -1,19 +1,18 @@
 import {
   isAuthSessionValid,
   loadAuthSession
-} from "./cli-q6f6vrrr.js";
+} from "./cli-9bgnvth2.js";
 import {
   inspectPromptManifest
-} from "./cli-b4740tnv.js";
+} from "./cli-3retgh64.js";
 import {
   readHarnessSyncState,
   renderDoctorHuman,
-  renderStatusHuman,
-  scanHarness
-} from "./cli-d577kq6h.js";
+  renderStatusHuman
+} from "./cli-xq45etg1.js";
 import {
   callDataAPI
-} from "./cli-jtyvbd8d.js";
+} from "./cli-e23g9ywa.js";
 import {
   ensureSecretFilePermissions,
   getActiveProfile,
@@ -27,7 +26,10 @@ import {
   resolveSecretReference,
   resolveTenantId,
   secretFilePathFromRef
-} from "./cli-sqsjd08w.js";
+} from "./cli-99p2jh28.js";
+import {
+  __require
+} from "./cli-0v6na3yp.js";
 
 // src/doctor.ts
 import { createHash } from "node:crypto";
@@ -167,7 +169,7 @@ async function buildDoctorReport(context, options) {
     remediation: manifestExists ? undefined : "Run `moda harness scan --summary` to scan the project and write a harness manifest.",
     nextCommand: manifestExists ? undefined : "moda harness scan --summary"
   });
-  checks.push(harnessCurrentCheck(context.cwd, manifestPath, manifestExists, tenantId));
+  checks.push(await harnessCurrentCheck(context.cwd, manifestPath, manifestExists, tenantId));
   checks.push(harnessSyncStateCheck(context.cwd));
   checks.push(promptsDiscoveredCheck(context.cwd));
   checks.push(discoveryCheck("skills_discovered", "harness", "Skills are discovered", context.cwd, [
@@ -361,7 +363,7 @@ function localBaseUrlCheck(environment, baseUrl) {
     evidence: [{ label: "base_url", value: baseUrl }]
   };
 }
-function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId) {
+async function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId) {
   if (!manifestExists) {
     return {
       id: "harness_manifest_current",
@@ -374,6 +376,7 @@ function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId) {
     };
   }
   try {
+    const { scanHarness } = await import("./harness-7azmzytc.js");
     const current = scanHarness({
       rootDir: cwd,
       scannerVersion: "doctor",