@moda-ai/cli 1.55.59 → 1.55.60

package/dist/{agent-zxzp33vn.js → agent-ds0qdtxz.js}

@@ -1,8 +1,8 @@
 import {
   buildDoctorReport
-} from "./cli-0zz7kg8d.js";
+} from "./cli-bt564t50.js";
 import"./cli-94r5x9bg.js";
-import"./cli-q89d6scp.js";
+import"./cli-hxy54rx3.js";
 import"./cli-mm48br00.js";
 import {
   readHarnessSyncState
@@ -95,7 +95,7 @@ async function buildAgentContext(context) {
   const graph = readHarnessGraphIfPresent(context.cwd);
   const reportState = readHarnessReportState(context.cwd);
   const syncState = readHarnessSyncState(context.cwd);
-  const harness = graph ? await import("./harness-f8e1xhc9.js") : undefined;
+  const harness = graph ? await import("./harness-bxcetthw.js") : undefined;
   const topFindings = doctor.checks.filter((check) => check.status === "fail" || check.status === "warning").slice(0, 12).map(checkToFinding);
   const evidenceRefs = [
     ...doctor.checks.map(checkToEvidenceRef),

package/dist/{cli-0zz7kg8d.js → cli-bt564t50.js}

@@ -4,7 +4,7 @@ import {
 } from "./cli-94r5x9bg.js";
 import {
   inspectPromptManifest
-} from "./cli-q89d6scp.js";
+} from "./cli-hxy54rx3.js";
 import {
   readHarnessSyncState,
   renderDoctorHuman,
@@ -395,7 +395,7 @@ async function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId)
     };
   }
   try {
-    const { scanHarness } = await import("./harness-f8e1xhc9.js");
+    const { scanHarness } = await import("./harness-bxcetthw.js");
     const current = scanHarness({
       rootDir: cwd,
       scannerVersion: "doctor",

package/dist/{cli-q89d6scp.js → cli-hxy54rx3.js}

@@ -5768,7 +5768,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-f8e1xhc9.js");
+    const { analyzeHarnessPrompts } = await import("./harness-bxcetthw.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),
@@ -5796,7 +5796,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const mergedSources = mergePromptSources(manifest.sources, extraSources);
   const manifestUpdate = stableJson(mergedSources) === stableJson(mergePromptSources(manifest.sources, [])) ? undefined : $stringify({ version: 2, prompt_paths: manifest.promptPaths, sources: mergedSources });
   const prompts = await discoverPrompts(extraSources);
-  const { checkPromptAttribution } = await import("./prompt-attribution-b0k1tcrb.js");
+  const { checkPromptAttribution } = await import("./prompt-attribution-6xc7h59r.js");
   const attribution = checkPromptAttribution(process.cwd(), prompts.map((prompt) => prompt.key));
   const brokenAttribution = attribution.references.filter((reference) => reference.status === "missing");
   if (brokenAttribution.length) {
@@ -6102,7 +6102,7 @@ async function migratePromptManifest(options = {}) {
   let addedSources = [];
   let pendingSources = [];
   if (options.discover) {
-    const { analyzeHarnessPrompts } = await import("./harness-f8e1xhc9.js");
+    const { analyzeHarnessPrompts } = await import("./harness-bxcetthw.js");
     const result = await analyzeHarnessPrompts({
       rootDir: root,
       existing: manifest.sources,

package/dist/{cli-9hr66ft2.js → cli-wbd3hzqh.js}

@@ -15325,7 +15325,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-zczyrzra.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-acxh0dbf.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -16965,13 +16965,17 @@ function resolveExternalHarnessAnalystInvocation(options) {
     throw new CliInputError(`${titleFromId(options.adapter)} analyst CLI was not found.`, `Install/sign into ${titleFromId(options.adapter)}, set MODA_HARNESS_ANALYST_COMMAND, or choose another analyst with --analyst=claude|codex|cursor.`);
   }
   if (options.adapter === "claude") {
-    const extraArgs = options.promptTools ? [] : externalAnalystExtraArgs(options.adapter);
+    const extraArgs = options.promptTools ? [] : mode === "write" ? externalAnalystExtraArgs(options.adapter) : readOnlyClaudeExtraArgs(externalAnalystExtraArgs(options.adapter));
     const model = resolveAnalystModel(options.adapter, options.flags);
-    const permission = mode === "write" ? ["--permission-mode", "acceptEdits", "--allowedTools", "Read,Grep,Glob,Edit,Write,Bash"] : ["--allowedTools", `Read,Grep,Glob,Edit(${HARNESS_REPORT_PATH}),Bash(pwd),Bash(ls *),Bash(find *),Bash(rg *),Bash(grep *),Bash(cat *),Bash(git status *),Bash(git ls-files *),Bash(git grep *)`];
+    const permission = mode === "write" ? ["--permission-mode", "acceptEdits", "--allowedTools", "Read,Grep,Glob,Edit,Write,Bash"] : ["--allowedTools", `Read,Grep,Glob,Edit(${HARNESS_REPORT_PATH})`, "--disallowedTools", "Bash"];
     if (isolated) {
       permission[1] = "Read,Grep,Glob,mcp__moda-prompt-source__inspect_sources,mcp__moda-prompt-source__check_mapping";
       permission.push("--mcp-config", isolated.configPath, "--strict-mcp-config");
+    } else if (mode !== "write") {
+      permission.push("--mcp-config", '{"mcpServers":{}}', "--strict-mcp-config");
     }
+    if (mode !== "write")
+      permission.push("--setting-sources", "user");
     return {
       adapter: options.adapter,
       command,
@@ -17110,6 +17114,37 @@ async function runCodingAgent(options) {
 function externalAnalystExtraArgs(adapter) {
   return splitCommandLine(process.env[`MODA_HARNESS_ANALYST_${adapter.toUpperCase()}_ARGS`] ?? "");
 }
+var READ_ONLY_CLAUDE_ARG_FLAGS = new Map([
+  ["--model", true],
+  ["--fallback-model", true],
+  ["--effort", true],
+  ["--max-turns", true],
+  ["--debug-file", true],
+  ["--debug", false],
+  ["--verbose", false],
+  ["--exclude-dynamic-system-prompt-sections", false]
+]);
+function readOnlyClaudeExtraArgs(args) {
+  const kept = [];
+  for (let i = 0;i < args.length; i += 1) {
+    const [flag, inline] = args[i].split(/=(.*)/s, 2);
+    const takesValue = READ_ONLY_CLAUDE_ARG_FLAGS.get(flag);
+    if (takesValue === undefined) {
+      if (inline === undefined && args[i + 1] !== undefined && !args[i + 1].startsWith("-"))
+        i += 1;
+      continue;
+    }
+    if (takesValue && inline === undefined) {
+      if (args[i + 1] === undefined)
+        continue;
+      kept.push(flag, args[i + 1]);
+      i += 1;
+    } else {
+      kept.push(args[i]);
+    }
+  }
+  return kept;
+}
 var DEFAULT_CLAUDE_ANALYST_MODEL = "sonnet";
 function resolveAnalystModel(adapter, flags) {
   const flagValue = flags["analyst-model"] && flags["analyst-model"] !== "true" ? flags["analyst-model"] : undefined;
@@ -19664,4 +19699,4 @@ function hashText(text) {
   return createHash5("sha256").update(text).digest("hex");
 }
 
-export { startRemoteAnalyze, pollRemoteAnalyzeUntilDone, isRecoverableRemoteRun, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, isToolGroupPlaceholder, repairExternalAnalystReport, deriveRelationshipsFromGraph, deterministicArtifacts, mergeDeterministicArtifacts, analystRefutations, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId, titleFromId, promptNameFromPath };
+export { startRemoteAnalyze, pollRemoteAnalyzeUntilDone, isRecoverableRemoteRun, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, isToolGroupPlaceholder, repairExternalAnalystReport, deriveRelationshipsFromGraph, deterministicArtifacts, mergeDeterministicArtifacts, analystRefutations, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, resolveExternalHarnessAnalystInvocation, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, readOnlyClaudeExtraArgs, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId, titleFromId, promptNameFromPath };

package/dist/cli.js

@@ -2968,25 +2968,25 @@ function leafManifestFields(leaf, commands) {
 import { fileURLToPath } from "url";
 import { realpathSync } from "fs";
 async function runPromptsCommand(...args) {
-  return (await import("./prompts-33ywsv3x.js")).runPromptsCommand(...args);
+  return (await import("./prompts-e8rhawyc.js")).runPromptsCommand(...args);
 }
 async function runSkillsCommand(...args) {
   return (await import("./skills-etzcqhp8.js")).runSkillsCommand(...args);
 }
 async function runHarnessCommand(...args) {
-  return (await import("./harness-f8e1xhc9.js")).runHarnessCommand(...args);
+  return (await import("./harness-bxcetthw.js")).runHarnessCommand(...args);
 }
 async function runSyncCommand(...args) {
-  return (await import("./sync-e02rm8d9.js")).runSyncCommand(...args);
+  return (await import("./sync-m9htrc8t.js")).runSyncCommand(...args);
 }
 async function runRegistryCommand(...args) {
   return (await import("./registry-wv1zzyce.js")).runRegistryCommand(...args);
 }
 async function runDoctorCommand(...args) {
-  return (await import("./doctor-p63wxy0s.js")).runDoctorCommand(...args);
+  return (await import("./doctor-s9t8e808.js")).runDoctorCommand(...args);
 }
 async function runStatusCommand(...args) {
-  return (await import("./doctor-p63wxy0s.js")).runStatusCommand(...args);
+  return (await import("./doctor-s9t8e808.js")).runStatusCommand(...args);
 }
 async function runAuthCommand(...args) {
   return (await import("./profile-commands-yvpe4d8y.js")).runAuthCommand(...args);
@@ -2998,7 +2998,7 @@ async function runProfilesCommand(...args) {
   return (await import("./profile-commands-yvpe4d8y.js")).runProfilesCommand(...args);
 }
 async function runAgentCommand(...args) {
-  return (await import("./agent-zxzp33vn.js")).runAgentCommand(...args);
+  return (await import("./agent-ds0qdtxz.js")).runAgentCommand(...args);
 }
 async function runProductionCommand(...args) {
   return (await import("./production-intelligence-fqvhzq6s.js")).runProductionCommand(...args);
@@ -6762,7 +6762,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result-and-error",
     handler: async (context) => {
-      const { runInit } = await import("./index-92eabh3j.js");
+      const { runInit } = await import("./index-d8hc0er0.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",

package/dist/{doctor-p63wxy0s.js → doctor-s9t8e808.js}

@@ -3,9 +3,9 @@ import {
   promptsDiscoveredCheck,
   runDoctorCommand,
   runStatusCommand
-} from "./cli-0zz7kg8d.js";
+} from "./cli-bt564t50.js";
 import"./cli-94r5x9bg.js";
-import"./cli-q89d6scp.js";
+import"./cli-hxy54rx3.js";
 import"./cli-mm48br00.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";

package/dist/{harness-f8e1xhc9.js → harness-bxcetthw.js}

@@ -25,11 +25,13 @@ import {
   numericEnv,
   numericEnvAllowZero,
   promptNameFromPath,
+  readOnlyClaudeExtraArgs,
   renderAnalystCandidateLines,
   renderAnalystSeedLines,
   renderExternalHarnessAnalystPrompt,
   repairExternalAnalystReport,
   resolveAnalystModel,
+  resolveExternalHarnessAnalystInvocation,
   resolveHarnessAnalyzeConcern,
   runCodingAgent,
   runHarnessCommand,
@@ -43,7 +45,7 @@ import {
   writeHarnessAnalyzeResult,
   writeHarnessArtifacts,
   writeHumanProgress
-} from "./cli-9hr66ft2.js";
+} from "./cli-wbd3hzqh.js";
 import"./cli-97fnztpy.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";
@@ -73,11 +75,13 @@ export {
   runHarnessCommand,
   runCodingAgent,
   resolveHarnessAnalyzeConcern,
+  resolveExternalHarnessAnalystInvocation,
   resolveAnalystModel,
   repairExternalAnalystReport,
   renderExternalHarnessAnalystPrompt,
   renderAnalystSeedLines,
   renderAnalystCandidateLines,
+  readOnlyClaudeExtraArgs,
   promptNameFromPath,
   numericEnvAllowZero,
   numericEnv,

package/dist/{harness-github-actions-zczyrzra.js → harness-github-actions-acxh0dbf.js}

@@ -1,6 +1,6 @@
 import {
   buildSourceSnapshot
-} from "./cli-9hr66ft2.js";
+} from "./cli-wbd3hzqh.js";
 import"./cli-97fnztpy.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";

package/dist/{index-92eabh3j.js → index-d8hc0er0.js}

@@ -21,7 +21,7 @@ import {
 } from "./cli-hcwdz9sd.js";
 import {
   buildDoctorReport
-} from "./cli-0zz7kg8d.js";
+} from "./cli-bt564t50.js";
 import {
   ConnectCodeError,
   connectWithCode,
@@ -32,7 +32,7 @@ import {
 import {
   initPrompts,
   runPromptSync
-} from "./cli-q89d6scp.js";
+} from "./cli-hxy54rx3.js";
 import"./cli-mm48br00.js";
 import {
   codingAgentDisplayName,
@@ -46,7 +46,7 @@ import {
   runCodingAgent,
   runHarnessCommand,
   startRemoteAnalyze
-} from "./cli-9hr66ft2.js";
+} from "./cli-wbd3hzqh.js";
 import {
   stripAnsi
 } from "./cli-97fnztpy.js";

package/dist/{prompt-attribution-b0k1tcrb.js → prompt-attribution-6xc7h59r.js}

@@ -1,7 +1,7 @@
 import {
   inventoryFiles,
   safePromptEvidencePath
-} from "./cli-9hr66ft2.js";
+} from "./cli-wbd3hzqh.js";
 import"./cli-97fnztpy.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";

package/dist/prompt-source-mcp.js

@@ -3,7 +3,7 @@ import {
   checkPromptMapping,
   discoverHarnessPromptSources,
   safePromptEvidencePath
-} from "./cli-9hr66ft2.js";
+} from "./cli-wbd3hzqh.js";
 import"./cli-97fnztpy.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";

package/dist/{prompts-33ywsv3x.js → prompts-e8rhawyc.js}

@@ -9,7 +9,7 @@ import {
   runPromptSync,
   runPromptsCommand,
   writePromptSyncProgress
-} from "./cli-q89d6scp.js";
+} from "./cli-hxy54rx3.js";
 import {
   promptSourceHashPayload
 } from "./cli-mm48br00.js";

package/dist/{sync-e02rm8d9.js → sync-m9htrc8t.js}

@@ -6,11 +6,11 @@ import"./cli-rjav0vj1.js";
 import"./cli-hcwdz9sd.js";
 import {
   runPromptsCommand
-} from "./cli-q89d6scp.js";
+} from "./cli-hxy54rx3.js";
 import"./cli-mm48br00.js";
 import {
   runHarnessCommand
-} from "./cli-9hr66ft2.js";
+} from "./cli-wbd3hzqh.js";
 import"./cli-97fnztpy.js";
 import"./cli-k0vxtzxb.js";
 import"./cli-v2h21cgf.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.55.59",
+  "version": "1.55.60",
   "description": "CLI for Moda: production monitoring and evals for AI agents.",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-21T04:29:19.389Z",
-  "cli_version": "1.55.59",
+  "bundled_at": "2026-10-21T04:53:20.126Z",
+  "cli_version": "1.55.60",
   "skills": [
     {
       "id": "integration-cloudflare-think",