@moda-ai/cli 1.55.6 → 1.55.8

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   runPromptsCommand,
   runSkillsCommand,
   runStatusCommand
-} from "./cli-grn40kvh.js";
+} from "./cli-a0adscdx.js";
 import"./cli-mm48br00.js";
 import {
   ApiError,
@@ -39,7 +39,7 @@ import {
   terminalStyles,
   unknownSignalsSubcommandError,
   validateHarnessReport
-} from "./cli-gxmq4wmn.js";
+} from "./cli-j125g80g.js";
 import"./cli-ssfq84k5.js";
 import {
   authFetch,
@@ -2524,8 +2524,10 @@ agent and prompt handled each LLM call.
   values, or customer data.
 - Do not change runtime behaviour. Part 5 adds trace metadata only. Show the
   diff and get my OK before committing it.
-- Only \`.moda/registry.json\` (plus the files it references) is uploaded.
-  Nothing else in the repo leaves this machine.
+- Parts 0 to 6 upload only \`.moda/registry.json\` (plus the files it
+  references). Part 7 uploads a bundle of the repo, but only after I review
+  its dry run. Secrets, env var values, and git-ignored installs are never
+  included.
 
 ## Part 0: setup
 
@@ -2534,6 +2536,8 @@ agent and prompt handled each LLM call.
    first shipped in 1.45.0). If any is missing or the command fails, run
    \`npm install -g @moda-ai/cli@latest\` and check again. If they're still
    missing, stop and tell me which ones; nothing below works without them.
+   Part 7 also needs \`moda harness register --help\` to work; if it does
+   not, finish Parts 1 to 6 and tell me.
 2. Auth: \`MODA_API_KEY\` must be set, or run \`moda auth login --api-key=<key>\`.
    Ask me for the key if neither is available. Check with \`moda doctor\`.
 3. Run \`moda registry template\` to see a complete example manifest, and
@@ -2692,6 +2696,60 @@ registered, and registered agents never seen. Fix the manifest (or the
 attribution) and push again until there is nothing unexplained left. Attribution
 added in Part 5 only shows up on traces created after it ships.
 
+## Part 7: register the runnable harness
+
+Replay Environments run our real harness in a sandbox with outbound network
+denied, so Moda needs the code itself, not just the manifest. \`moda harness
+register\` collects the git repository into a bundle. It keeps everything a
+build could plausibly need and records the name and reason for everything it
+leaves out: secret files, files that contain credentials, VCS internals,
+installed dependencies a lockfile reproduces, build output, and paths in
+\`.modaignore\`. Env var values are never read; only names are recorded.
+
+1. Preview it. Nothing is uploaded:
+
+       moda harness register --dry-run
+
+2. Review the report with me before going further:
+   - **Excluded**: every path left out and why. If a file a build needs was
+     withheld (for example \`secret_content\` on a fixture with a fake key),
+     tell me; don't move secrets around to get it in.
+   - **Git-ignored but present**: generated clients, local config, or model
+     files the build may need. Ask me before un-ignoring anything.
+   - **Environment variables**: each name with a proposed classification
+     (\`secret\`, \`config\`, \`dependency_endpoint\`, \`model_endpoint\`,
+     \`model_credential\`, \`unknown\`). Read the code for every \`unknown\`
+     and tell me what it is.
+   - **Dependencies and migrations**: the databases, queues, and APIs it
+     found, the adapter Moda proposes for each, and the migrations it would
+     run against a disposable database.
+   - **Gaps** and **Moda will still need from you**.
+3. Declare the entrypoint and the model-routing env vars. The entrypoint is
+   the exact command that starts the harness the way production does (from
+   the Dockerfile, Procfile, start script, or deploy config). The routing vars
+   are the names of the env vars that set the model base URL, the model id,
+   and the API key, so replay can send inference to Moda's approved lane.
+   Pass names, never values:
+
+       moda harness register <name> --dry-run \\
+         --model-base-url-env=OPENAI_BASE_URL --model-env=OPENAI_MODEL \\
+         --model-api-key-env=OPENAI_API_KEY \\
+         --entry -- node dist/server.js
+
+   \`--entry\` goes last: everything after \`--\` is the command. If the code
+   hardcodes the model base URL instead of reading an env var, say so in your
+   report; do not change it.
+4. When I approve the dry run, register for real with the same flags and no
+   \`--dry-run\`. It prints a registration id, a status, and a dashboard link.
+   Then run:
+
+       moda harness registration status <id>
+
+   \`needs_input\` means the dashboard checklist still has items for me:
+   confirming env classifications, approving dependency adapters and
+   migrations, and acknowledging gaps. List the blocking ones in your report.
+   I make those decisions; you don't.
+
 ## Final report
 
 Reply with:
@@ -2705,6 +2763,9 @@ Reply with:
 5. The \`moda registry coverage\` result, plus anything unexplained you
    couldn't resolve.
 6. Anything you found but couldn't express in the manifest.
+7. The registration id and status, the entrypoint and model-routing env vars
+   you declared, exclusions or ignored paths a build may need, and the
+   checklist items still open.
 `;
 
 // src/registry.ts
@@ -4185,6 +4246,37 @@ var HARNESS_SUBCOMMAND_HELP = [
     flags: [HARNESS_PATH_FLAG],
     examples: ["moda harness status"]
   },
+  {
+    name: "register",
+    description: "Collect this repo into a Replay Environments bundle, show what is included and excluded, and upload it",
+    usage: "moda harness register [name] [--mode=source|sealed] [--root=<dir>] [--entry -- <cmd...>] [--model-base-url-env=<NAME>] [--image=<ref>@sha256:<digest>] [--dry-run] [--json]",
+    flags: [
+      { name: "[name]", description: "Harness name (default: package.json name or the directory name)." },
+      { name: "--mode=source|sealed", description: "source (default) uploads the source bundle; sealed runs your own image and needs --image." },
+      { name: "--root=<dir>", description: "Harness directory (default: the current directory). The bundle is the whole git repository it lives in." },
+      { name: "--entry -- <cmd...>", description: 'How the harness starts; everything after `--` is the command. `--entry="<cmd>"` also works.' },
+      { name: "--model-base-url-env=<NAME>", description: "Env var that sets the model base URL, so replay can route inference. Also --model-env and --model-api-key-env. Names only." },
+      { name: "--image=<ref>@sha256:<digest>", description: "Sealed mode: the harness image, pinned by digest." },
+      { name: "--dry-run", description: "Collect and print the full report; upload nothing (no API key needed)." }
+    ],
+    examples: [
+      "moda harness register --dry-run",
+      "moda harness register support-agent --model-base-url-env=OPENAI_BASE_URL --entry -- node dist/server.js",
+      "moda harness register --mode=sealed --image=ghcr.io/acme/agent@sha256:<digest>"
+    ]
+  },
+  {
+    name: "registration",
+    description: "List harness registrations, or show one with its checklist (read-only)",
+    usage: "moda harness registration list [--harness=<name>] [--include-retired] [--limit=N] [--offset=N] | moda harness registration status <id>",
+    flags: [
+      { name: "--harness=<name>", description: "Only registrations of this harness." },
+      { name: "--include-retired", description: "Include deleted (retired) registrations." },
+      { name: "--limit=N", description: "Page size (default 50, max 200)." },
+      { name: "--offset=N", description: "Skip this many." }
+    ],
+    examples: ["moda harness registration list", "moda harness registration status hrg_0123abcd"]
+  },
   {
     name: "list",
     description: "List the tenant's synced harnesses (read-only)",
@@ -8019,6 +8111,8 @@ Commands:
   harness sync                     Sync the local harness graph to Moda Cloud
   harness delete <id-or-key>       Permanently delete a synced harness from Moda Cloud
   harness list|show|versions|diff  List synced harnesses, show one, its versions, or a version diff
+  harness register [name]          Bundle this repo for Replay Environments and upload it (--dry-run to review)
+  harness registration list|status List registrations, or show one with what Moda still needs
   harness agents                   List detected runtime agents and families
   harness explain                  Explain the discovered harness graph
   agent context                    Emit local Moda context for coding agents
@@ -8881,7 +8975,7 @@ function parseCommandFlags(schema, args, command, options = {}) {
   ]);
   const unknown = Object.keys(args).filter((key) => !known.has(key));
   if (unknown.includes("dry_run")) {
-    throw new CliInputError(`'moda ${command}' has no dry-run mode, so nothing was sent.`, `Remove --dry-run to run it for real. Commands with a real dry-run: sync, registry push, harness sync/delete, prompts sync/decide, skills sync/policy, signals <write subcommands>, problem-reopen.`, "unsupported_dry_run");
+    throw new CliInputError(`'moda ${command}' has no dry-run mode, so nothing was sent.`, `Remove --dry-run to run it for real. Commands with a real dry-run: sync, registry push, harness sync/delete/register, prompts sync/decide, skills sync/policy, signals <write subcommands>, problem-reopen.`, "unsupported_dry_run");
   }
   if (unknown.length > 0) {
     const flagKeys = schemaKeys.filter((key) => key !== options.positionalKey);
@@ -10422,7 +10516,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result",
     handler: async (context) => {
-      const { runInit } = await import("./index-6wxkhbk5.js");
+      const { runInit } = await import("./index-zdbe66yn.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",
@@ -10651,8 +10745,9 @@ var commandRegistry = createCommandRegistry([
   },
   {
     name: "harness",
-    description: "Analyze, validate, approve, sync, delete, and explain the local multi-agent harness graph",
+    description: "Analyze, validate, approve, sync, delete, and explain the local multi-agent harness graph; register it for Replay Environments",
     examples: [
+      "moda harness register --dry-run",
       "moda harness analyze --experimental --summary",
       "moda harness analyze --experimental --remote",
       "moda harness pull --sync",
@@ -10663,7 +10758,7 @@ var commandRegistry = createCommandRegistry([
     ],
     subcommands: HARNESS_SUBCOMMAND_HELP,
     auth: "api-key",
-    authNote: "sync, list, show, versions, diff, delete, pull, and analyze need the API key; scan, explain, agents, graph, approve, and validate-report are local.",
+    authNote: "sync, list, show, versions, diff, delete, pull, analyze, register, and registration need the API key; scan, explain, agents, graph, approve, validate-report, and register --dry-run are local.",
     outputModes: ["human", "json", "agent"],
     mutability: "write",
     validateConfigBeforeRun: false,

package/dist/{harness-github-actions-s10y3kpz.js → harness-github-actions-t4m8q3wn.js}

@@ -1,6 +1,6 @@
 import {
   buildSourceSnapshot
-} from "./cli-gxmq4wmn.js";
+} from "./cli-j125g80g.js";
 import {
   recordApiRequest
 } from "./cli-mx9r1689.js";

package/dist/{harness-7eabmv0v.js → harness-kpskdj9x.js}

@@ -42,7 +42,7 @@ import {
   writeHarnessAnalyzeResult,
   writeHarnessArtifacts,
   writeHumanProgress
-} from "./cli-gxmq4wmn.js";
+} from "./cli-j125g80g.js";
 import"./cli-mx9r1689.js";
 import"./cli-0v6na3yp.js";
 export {

package/dist/{index-6wxkhbk5.js → index-zdbe66yn.js}

@@ -3,7 +3,7 @@ import {
   initPrompts,
   runPromptSync,
   runSkillSync
-} from "./cli-grn40kvh.js";
+} from "./cli-a0adscdx.js";
 import"./cli-mm48br00.js";
 import {
   codingAgentDisplayName,
@@ -23,7 +23,7 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-gxmq4wmn.js";
+} from "./cli-j125g80g.js";
 import {
   bundledSkillsDir,
   installIntegrationSkill,

package/dist/prompt-source-mcp.js

@@ -5,7 +5,7 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors,
   safePromptEvidencePath
-} from "./cli-gxmq4wmn.js";
+} from "./cli-j125g80g.js";
 import"./cli-mx9r1689.js";
 import {
   __commonJS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.55.6",
+  "version": "1.55.8",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {
@@ -66,6 +66,7 @@
   "devDependencies": {
     "@moda/database": "*",
     "@moda/eslint-config": "*",
+    "@moda/harness-bundle": "*",
     "@moda/harness-snapshot": "*",
     "@moda/integration-skills": "*",
     "@types/node": "^22.10.5",

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-14T10:49:23.091Z",
-  "cli_version": "1.55.6",
+  "bundled_at": "2026-10-14T16:47:16.312Z",
+  "cli_version": "1.55.8",
   "skills": [
     {
       "id": "integration-cloudflare-think",