@moda-ai/cli 1.55.58 → 1.55.60

package/dist/{agent-921q6yvy.js → agent-ds0qdtxz.js}

@@ -1,8 +1,8 @@
 import {
   buildDoctorReport
-} from "./cli-a821bf9p.js";
+} from "./cli-bt564t50.js";
 import"./cli-94r5x9bg.js";
-import"./cli-4zdem6xd.js";
+import"./cli-hxy54rx3.js";
 import"./cli-mm48br00.js";
 import {
   readHarnessSyncState
@@ -95,7 +95,7 @@ async function buildAgentContext(context) {
   const graph = readHarnessGraphIfPresent(context.cwd);
   const reportState = readHarnessReportState(context.cwd);
   const syncState = readHarnessSyncState(context.cwd);
-  const harness = graph ? await import("./harness-2jb52s8r.js") : undefined;
+  const harness = graph ? await import("./harness-bxcetthw.js") : undefined;
   const topFindings = doctor.checks.filter((check) => check.status === "fail" || check.status === "warning").slice(0, 12).map(checkToFinding);
   const evidenceRefs = [
     ...doctor.checks.map(checkToEvidenceRef),

package/dist/{cli-a821bf9p.js → cli-bt564t50.js}

@@ -4,7 +4,7 @@ import {
 } from "./cli-94r5x9bg.js";
 import {
   inspectPromptManifest
-} from "./cli-4zdem6xd.js";
+} from "./cli-hxy54rx3.js";
 import {
   readHarnessSyncState,
   renderDoctorHuman,
@@ -395,7 +395,7 @@ async function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId)
     };
   }
   try {
-    const { scanHarness } = await import("./harness-2jb52s8r.js");
+    const { scanHarness } = await import("./harness-bxcetthw.js");
     const current = scanHarness({
       rootDir: cwd,
       scannerVersion: "doctor",

package/dist/{cli-4zdem6xd.js → cli-hxy54rx3.js}

@@ -5768,7 +5768,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-2jb52s8r.js");
+    const { analyzeHarnessPrompts } = await import("./harness-bxcetthw.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),
@@ -5796,7 +5796,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const mergedSources = mergePromptSources(manifest.sources, extraSources);
   const manifestUpdate = stableJson(mergedSources) === stableJson(mergePromptSources(manifest.sources, [])) ? undefined : $stringify({ version: 2, prompt_paths: manifest.promptPaths, sources: mergedSources });
   const prompts = await discoverPrompts(extraSources);
-  const { checkPromptAttribution } = await import("./prompt-attribution-ndw4jvew.js");
+  const { checkPromptAttribution } = await import("./prompt-attribution-6xc7h59r.js");
   const attribution = checkPromptAttribution(process.cwd(), prompts.map((prompt) => prompt.key));
   const brokenAttribution = attribution.references.filter((reference) => reference.status === "missing");
   if (brokenAttribution.length) {
@@ -6102,7 +6102,7 @@ async function migratePromptManifest(options = {}) {
   let addedSources = [];
   let pendingSources = [];
   if (options.discover) {
-    const { analyzeHarnessPrompts } = await import("./harness-2jb52s8r.js");
+    const { analyzeHarnessPrompts } = await import("./harness-bxcetthw.js");
     const result = await analyzeHarnessPrompts({
       rootDir: root,
       existing: manifest.sources,

package/dist/{cli-tp48x76x.js → cli-wbd3hzqh.js}

@@ -15325,7 +15325,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-4q0nkvxb.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-acxh0dbf.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -16012,6 +16012,89 @@ function isToolGroupPlaceholder(name) {
 function isDetectedToolDefinitionReason(reason) {
   return typeof reason === "string" && (reason.startsWith("deterministic detector ") || reason.startsWith("Tool definition detected"));
 }
+var MODEL_SOURCE_FILE2 = /\.(?:[cm]?[jt]sx?|py|json|jsonc|ya?ml|toml)$/i;
+var NON_SOURCE_DIR2 = /(^|\/)(?:docs?|\.moda)\//i;
+function isSearchableModelId(id) {
+  return id.length >= 4 && !/\s/.test(id) && /[\d/.:_-]/.test(id);
+}
+function modelIdsUsedInSource(rootDir, ids) {
+  const pending = new Map;
+  for (const id of new Set(ids.filter(isSearchableModelId))) {
+    const token = `(?<![\\w-])${id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w-]|\\.\\w)`;
+    pending.set(id, { quoted: new RegExp(`(['"\`])[^'"\`\\n]*?${token}[^'"\`\\n]*?\\1`), bare: new RegExp(token) });
+  }
+  const found = new Set;
+  if (pending.size === 0)
+    return found;
+  const rootReal = resolve10(rootDir);
+  const maxFiles = numericEnv("MODA_HARNESS_MAX_FILES", DEFAULT_MAX_INVENTORY_FILES);
+  const maxTextBytes = numericEnv("MODA_HARNESS_MAX_TEXT_BYTES", DEFAULT_MAX_INVENTORY_TEXT_BYTES);
+  let files = 0;
+  let textBytes = 0;
+  let complete = true;
+  const search = (rel2, text) => {
+    const bareValues = /\.(?:ya?ml|toml)$/i.test(rel2);
+    const lines = text.split(`
+`).filter((line) => !/^\s*(?:\/\/|\/\*|\*|#)/.test(line));
+    for (const [id, pattern] of pending) {
+      if (lines.some((line) => pattern.quoted.test(line) || bareValues && pattern.bare.test(line))) {
+        found.add(id);
+        pending.delete(id);
+      }
+    }
+  };
+  const walk = (current) => {
+    if (pending.size === 0)
+      return false;
+    const rel2 = normalizePath2(relative6(rootReal, current)) || ".";
+    let stat;
+    try {
+      stat = lstatSync7(current);
+    } catch {
+      return true;
+    }
+    if (stat.isSymbolicLink())
+      return true;
+    if (stat.isDirectory()) {
+      if (rel2 !== "." && (shouldSkipDirectory(rel2) || NON_SOURCE_DIR2.test(`${rel2}/`)))
+        return true;
+      let entries;
+      try {
+        entries = readdirSync4(current).sort();
+      } catch {
+        return true;
+      }
+      for (const entry of entries) {
+        if (!walk(join9(current, entry)))
+          return false;
+      }
+      return true;
+    }
+    if (!stat.isFile() || stat.size > MAX_SCANNED_FILE_BYTES || isSecretishPath(rel2))
+      return true;
+    if (TEST_PATH2.test(rel2) || !MODEL_SOURCE_FILE2.test(rel2))
+      return true;
+    if (files >= maxFiles) {
+      complete = false;
+      return false;
+    }
+    if (textBytes + stat.size > maxTextBytes) {
+      complete = false;
+      return true;
+    }
+    files += 1;
+    textBytes += stat.size;
+    try {
+      search(rel2, readFileSync12(current, "utf8"));
+    } catch {}
+    return true;
+  };
+  walk(rootReal);
+  if (!complete)
+    for (const id of pending.keys())
+      found.add(id);
+  return found;
+}
 function removeArtifacts(report, ids) {
   const graph = report.graph;
   const keep = (id) => typeof id !== "string" || !ids.has(id);
@@ -16077,16 +16160,20 @@ function repairExternalAnalystReport(report, rootDir, options = {}) {
       evidence: artifact.evidence
     });
   }
-  for (const artifact of normalized.graph.artifacts) {
+  const testOnlyModels = normalized.graph.artifacts.filter((artifact) => {
     if (artifact.type !== "model_config" || unverified.has(artifact.id))
-      continue;
+      return false;
     const paths = artifact.evidence.map((entry) => entry.path).filter((path) => typeof path === "string" && path.length > 0);
-    if (paths.length === 0 || !paths.every((path) => TEST_PATH2.test(path)))
+    return paths.length > 0 && paths.every((path) => TEST_PATH2.test(path));
+  });
+  const usedInSource = testOnlyModels.length > 0 ? modelIdsUsedInSource(rootDir, testOnlyModels.map((artifact) => (artifact.name ?? "").trim())) : new Set;
+  for (const artifact of testOnlyModels) {
+    if (usedInSource.has((artifact.name ?? "").trim()))
       continue;
     unverified.add(artifact.id);
     normalized.graph.unknowns.push({
       id: `unresolved_${artifact.id}`,
-      question: `Model ${artifact.name ?? artifact.id} is cited only from test or fixture files, so it is a test input rather than the harness's model configuration.`,
+      question: `Model ${artifact.name ?? artifact.id} appears only in test or fixture files, so it is a test input rather than the harness's model configuration.`,
       candidateIds: [artifact.id],
       evidence: artifact.evidence
     });
@@ -16878,13 +16965,17 @@ function resolveExternalHarnessAnalystInvocation(options) {
     throw new CliInputError(`${titleFromId(options.adapter)} analyst CLI was not found.`, `Install/sign into ${titleFromId(options.adapter)}, set MODA_HARNESS_ANALYST_COMMAND, or choose another analyst with --analyst=claude|codex|cursor.`);
   }
   if (options.adapter === "claude") {
-    const extraArgs = options.promptTools ? [] : externalAnalystExtraArgs(options.adapter);
+    const extraArgs = options.promptTools ? [] : mode === "write" ? externalAnalystExtraArgs(options.adapter) : readOnlyClaudeExtraArgs(externalAnalystExtraArgs(options.adapter));
     const model = resolveAnalystModel(options.adapter, options.flags);
-    const permission = mode === "write" ? ["--permission-mode", "acceptEdits", "--allowedTools", "Read,Grep,Glob,Edit,Write,Bash"] : ["--allowedTools", `Read,Grep,Glob,Edit(${HARNESS_REPORT_PATH}),Bash(pwd),Bash(ls *),Bash(find *),Bash(rg *),Bash(grep *),Bash(cat *),Bash(git status *),Bash(git ls-files *),Bash(git grep *)`];
+    const permission = mode === "write" ? ["--permission-mode", "acceptEdits", "--allowedTools", "Read,Grep,Glob,Edit,Write,Bash"] : ["--allowedTools", `Read,Grep,Glob,Edit(${HARNESS_REPORT_PATH})`, "--disallowedTools", "Bash"];
     if (isolated) {
       permission[1] = "Read,Grep,Glob,mcp__moda-prompt-source__inspect_sources,mcp__moda-prompt-source__check_mapping";
       permission.push("--mcp-config", isolated.configPath, "--strict-mcp-config");
+    } else if (mode !== "write") {
+      permission.push("--mcp-config", '{"mcpServers":{}}', "--strict-mcp-config");
     }
+    if (mode !== "write")
+      permission.push("--setting-sources", "user");
     return {
       adapter: options.adapter,
       command,
@@ -17023,6 +17114,37 @@ async function runCodingAgent(options) {
 function externalAnalystExtraArgs(adapter) {
   return splitCommandLine(process.env[`MODA_HARNESS_ANALYST_${adapter.toUpperCase()}_ARGS`] ?? "");
 }
+var READ_ONLY_CLAUDE_ARG_FLAGS = new Map([
+  ["--model", true],
+  ["--fallback-model", true],
+  ["--effort", true],
+  ["--max-turns", true],
+  ["--debug-file", true],
+  ["--debug", false],
+  ["--verbose", false],
+  ["--exclude-dynamic-system-prompt-sections", false]
+]);
+function readOnlyClaudeExtraArgs(args) {
+  const kept = [];
+  for (let i = 0;i < args.length; i += 1) {
+    const [flag, inline] = args[i].split(/=(.*)/s, 2);
+    const takesValue = READ_ONLY_CLAUDE_ARG_FLAGS.get(flag);
+    if (takesValue === undefined) {
+      if (inline === undefined && args[i + 1] !== undefined && !args[i + 1].startsWith("-"))
+        i += 1;
+      continue;
+    }
+    if (takesValue && inline === undefined) {
+      if (args[i + 1] === undefined)
+        continue;
+      kept.push(flag, args[i + 1]);
+      i += 1;
+    } else {
+      kept.push(args[i]);
+    }
+  }
+  return kept;
+}
 var DEFAULT_CLAUDE_ANALYST_MODEL = "sonnet";
 function resolveAnalystModel(adapter, flags) {
   const flagValue = flags["analyst-model"] && flags["analyst-model"] !== "true" ? flags["analyst-model"] : undefined;
@@ -19577,4 +19699,4 @@ function hashText(text) {
   return createHash5("sha256").update(text).digest("hex");
 }
 
-export { startRemoteAnalyze, pollRemoteAnalyzeUntilDone, isRecoverableRemoteRun, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, isToolGroupPlaceholder, repairExternalAnalystReport, deriveRelationshipsFromGraph, deterministicArtifacts, mergeDeterministicArtifacts, analystRefutations, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId, titleFromId, promptNameFromPath };
+export { startRemoteAnalyze, pollRemoteAnalyzeUntilDone, isRecoverableRemoteRun, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, isToolGroupPlaceholder, repairExternalAnalystReport, deriveRelationshipsFromGraph, deterministicArtifacts, mergeDeterministicArtifacts, analystRefutations, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, resolveExternalHarnessAnalystInvocation, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, readOnlyClaudeExtraArgs, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId, titleFromId, promptNameFromPath };

package/dist/cli.js

@@ -2968,25 +2968,25 @@ function leafManifestFields(leaf, commands) {
 import { fileURLToPath } from "url";
 import { realpathSync } from "fs";
 async function runPromptsCommand(...args) {
-  return (await import("./prompts-2z3cdc52.js")).runPromptsCommand(...args);
+  return (await import("./prompts-e8rhawyc.js")).runPromptsCommand(...args);
 }
 async function runSkillsCommand(...args) {
   return (await import("./skills-etzcqhp8.js")).runSkillsCommand(...args);
 }
 async function runHarnessCommand(...args) {
-  return (await import("./harness-2jb52s8r.js")).runHarnessCommand(...args);
+  return (await import("./harness-bxcetthw.js")).runHarnessCommand(...args);
 }
 async function runSyncCommand(...args) {
-  return (await import("./sync-y4tcnmg6.js")).runSyncCommand(...args);
+  return (await import("./sync-m9htrc8t.js")).runSyncCommand(...args);
 }
 async function runRegistryCommand(...args) {
   return (await import("./registry-wv1zzyce.js")).runRegistryCommand(...args);
 }
 async function runDoctorCommand(...args) {
-  return (await import("./doctor-m6v07zc7.js")).runDoctorCommand(...args);
+  return (await import("./doctor-s9t8e808.js")).runDoctorCommand(...args);
 }
 async function runStatusCommand(...args) {
-  return (await import("./doctor-m6v07zc7.js")).runStatusCommand(...args);
+  return (await import("./doctor-s9t8e808.js")).runStatusCommand(...args);
 }
 async function runAuthCommand(...args) {
   return (await import("./profile-commands-yvpe4d8y.js")).runAuthCommand(...args);
@@ -2998,7 +2998,7 @@ async function runProfilesCommand(...args) {
   return (await import("./profile-commands-yvpe4d8y.js")).runProfilesCommand(...args);
 }
 async function runAgentCommand(...args) {
-  return (await import("./agent-921q6yvy.js")).runAgentCommand(...args);
+  return (await import("./agent-ds0qdtxz.js")).runAgentCommand(...args);
 }
 async function runProductionCommand(...args) {
   return (await import("./production-intelligence-fqvhzq6s.js")).runProductionCommand(...args);
@@ -6762,7 +6762,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result-and-error",
     handler: async (context) => {
-      const { runInit } = await import("./index-2crvn108.js");
+      const { runInit } = await import("./index-d8hc0er0.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",

package/dist/{doctor-m6v07zc7.js → doctor-s9t8e808.js}

@@ -3,9 +3,9 @@ import {
   promptsDiscoveredCheck,
   runDoctorCommand,
   runStatusCommand
-} from "./cli-a821bf9p.js";
+} from "./cli-bt564t50.js";
 import"./cli-94r5x9bg.js";
-import"./cli-4zdem6xd.js";
+import"./cli-hxy54rx3.js";
 import"./cli-mm48br00.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";

package/dist/{harness-2jb52s8r.js → harness-bxcetthw.js}

@@ -25,11 +25,13 @@ import {
   numericEnv,
   numericEnvAllowZero,
   promptNameFromPath,
+  readOnlyClaudeExtraArgs,
   renderAnalystCandidateLines,
   renderAnalystSeedLines,
   renderExternalHarnessAnalystPrompt,
   repairExternalAnalystReport,
   resolveAnalystModel,
+  resolveExternalHarnessAnalystInvocation,
   resolveHarnessAnalyzeConcern,
   runCodingAgent,
   runHarnessCommand,
@@ -43,7 +45,7 @@ import {
   writeHarnessAnalyzeResult,
   writeHarnessArtifacts,
   writeHumanProgress
-} from "./cli-tp48x76x.js";
+} from "./cli-wbd3hzqh.js";
 import"./cli-97fnztpy.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";
@@ -73,11 +75,13 @@ export {
   runHarnessCommand,
   runCodingAgent,
   resolveHarnessAnalyzeConcern,
+  resolveExternalHarnessAnalystInvocation,
   resolveAnalystModel,
   repairExternalAnalystReport,
   renderExternalHarnessAnalystPrompt,
   renderAnalystSeedLines,
   renderAnalystCandidateLines,
+  readOnlyClaudeExtraArgs,
   promptNameFromPath,
   numericEnvAllowZero,
   numericEnv,

package/dist/{harness-github-actions-4q0nkvxb.js → harness-github-actions-acxh0dbf.js}

@@ -1,6 +1,6 @@
 import {
   buildSourceSnapshot
-} from "./cli-tp48x76x.js";
+} from "./cli-wbd3hzqh.js";
 import"./cli-97fnztpy.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";

package/dist/{index-2crvn108.js → index-d8hc0er0.js}

@@ -21,7 +21,7 @@ import {
 } from "./cli-hcwdz9sd.js";
 import {
   buildDoctorReport
-} from "./cli-a821bf9p.js";
+} from "./cli-bt564t50.js";
 import {
   ConnectCodeError,
   connectWithCode,
@@ -32,7 +32,7 @@ import {
 import {
   initPrompts,
   runPromptSync
-} from "./cli-4zdem6xd.js";
+} from "./cli-hxy54rx3.js";
 import"./cli-mm48br00.js";
 import {
   codingAgentDisplayName,
@@ -46,7 +46,7 @@ import {
   runCodingAgent,
   runHarnessCommand,
   startRemoteAnalyze
-} from "./cli-tp48x76x.js";
+} from "./cli-wbd3hzqh.js";
 import {
   stripAnsi
 } from "./cli-97fnztpy.js";

package/dist/{prompt-attribution-ndw4jvew.js → prompt-attribution-6xc7h59r.js}

@@ -1,7 +1,7 @@
 import {
   inventoryFiles,
   safePromptEvidencePath
-} from "./cli-tp48x76x.js";
+} from "./cli-wbd3hzqh.js";
 import"./cli-97fnztpy.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";

package/dist/prompt-source-mcp.js

@@ -3,7 +3,7 @@ import {
   checkPromptMapping,
   discoverHarnessPromptSources,
   safePromptEvidencePath
-} from "./cli-tp48x76x.js";
+} from "./cli-wbd3hzqh.js";
 import"./cli-97fnztpy.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";

package/dist/{prompts-2z3cdc52.js → prompts-e8rhawyc.js}

@@ -9,7 +9,7 @@ import {
   runPromptSync,
   runPromptsCommand,
   writePromptSyncProgress
-} from "./cli-4zdem6xd.js";
+} from "./cli-hxy54rx3.js";
 import {
   promptSourceHashPayload
 } from "./cli-mm48br00.js";

package/dist/{sync-y4tcnmg6.js → sync-m9htrc8t.js}

@@ -6,11 +6,11 @@ import"./cli-rjav0vj1.js";
 import"./cli-hcwdz9sd.js";
 import {
   runPromptsCommand
-} from "./cli-4zdem6xd.js";
+} from "./cli-hxy54rx3.js";
 import"./cli-mm48br00.js";
 import {
   runHarnessCommand
-} from "./cli-tp48x76x.js";
+} from "./cli-wbd3hzqh.js";
 import"./cli-97fnztpy.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.55.58",
+  "version": "1.55.60",
   "description": "CLI for Moda: production monitoring and evals for AI agents.",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-21T04:24:23.494Z",
-  "cli_version": "1.55.58",
+  "bundled_at": "2026-10-21T04:53:20.126Z",
+  "cli_version": "1.55.60",
   "skills": [
     {
       "id": "integration-cloudflare-think",