@moda-ai/cli 1.55.89 → 1.55.91

package/dist/{agent-svqnv0b8.js → agent-scdstghf.js}

@@ -1,8 +1,8 @@
 import {
   buildDoctorReport
-} from "./cli-cqmntvnv.js";
-import"./cli-rrggdmf8.js";
-import"./cli-6hveza1a.js";
+} from "./cli-esna2ebz.js";
+import"./cli-qwnkv4jy.js";
+import"./cli-5knr4dts.js";
 import"./cli-mm48br00.js";
 import {
   readHarnessSyncState
@@ -15,21 +15,21 @@ import {
   readHarnessReport,
   validateHarnessReport
 } from "./cli-y333w08f.js";
-import"./cli-22yvg5kh.js";
-import"./cli-87xy1evx.js";
-import"./cli-5ms8rw8x.js";
+import"./cli-6ga6kmdp.js";
+import"./cli-dxajrq9h.js";
+import"./cli-13zdcv4w.js";
 import"./cli-e0kbye4s.js";
 import {
   resolveApiKey,
   resolveIngestUrl,
   resolveModaBaseUrl,
   resolveTenantId
-} from "./cli-z1t3sf7b.js";
+} from "./cli-1nd4339b.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
-import"./cli-p5grm12t.js";
+import"./cli-0semcakc.js";
 import {
   __require
 } from "./cli-0v6na3yp.js";
@@ -95,7 +95,7 @@ async function buildAgentContext(context) {
   const graph = readHarnessGraphIfPresent(context.cwd);
   const reportState = readHarnessReportState(context.cwd);
   const syncState = readHarnessSyncState(context.cwd);
-  const harness = graph ? await import("./harness-a55w36em.js") : undefined;
+  const harness = graph ? await import("./harness-7j8cvzgc.js") : undefined;
   const topFindings = doctor.checks.filter((check) => check.status === "fail" || check.status === "warning").slice(0, 12).map(checkToFinding);
   const evidenceRefs = [
     ...doctor.checks.map(checkToEvidenceRef),

package/dist/{cli-p5grm12t.js → cli-0semcakc.js}

@@ -210,17 +210,24 @@ function redactSecretValue(value) {
     return value;
   return REDACTED;
 }
+var MASK_SUFFIX = "...[REDACTED]";
+var MASK_SUFFIX_PATTERN = /\.\.\.\[REDACTED\]$/;
+var MASKING_PATTERNS = SECRET_PATTERNS.map(({ pattern, prefixLength }) => ({
+  pattern: new RegExp(`(?:${pattern.source})(?:\\.\\.\\.\\[REDACTED\\])?`, pattern.flags),
+  prefixLength
+}));
 function redactStringWithCount(input) {
   let text = input;
   let redactionCount = 0;
-  for (const { pattern, prefixLength } of SECRET_PATTERNS) {
-    text = text.replace(pattern, (match) => {
+  for (const { pattern, prefixLength } of MASKING_PATTERNS) {
+    text = text.replace(pattern, (rawMatch) => {
       redactionCount += 1;
+      const match = rawMatch.replace(MASK_SUFFIX_PATTERN, "");
       if (/^Bearer\s+/i.test(match)) {
         const token = match.replace(/^Bearer\s+/i, "");
-        return `Bearer ${token.slice(0, prefixLength)}...[REDACTED]`;
+        return `Bearer ${token.slice(0, prefixLength)}${MASK_SUFFIX}`;
       }
-      return `${match.slice(0, prefixLength)}...[REDACTED]`;
+      return `${match.slice(0, prefixLength)}${MASK_SUFFIX}`;
     });
   }
   return { text, redactionCount };
@@ -339,4 +346,176 @@ function packSnapshot(inputs, opts) {
     skips
   };
 }
-export { MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, redactSnapshotText, packSnapshot };
+
+// ../../packages/harness-snapshot/src/artifact-bodies.ts
+var PRIVATE_KEY_BLOCK = /-----BEGIN ([A-Z ]*)PRIVATE KEY-----(?:[\s\S]*?-----END \1PRIVATE KEY-----|(?:(?:\r\n|\r|\n)[ \t]*[A-Za-z0-9+/=]+[ \t]*(?=[\r\n]|$))*)/g;
+function maskPrivateKeyBlock(block) {
+  return block.split(/(\r\n|\r|\n)/).map((part, index) => index === 0 ? "[REDACTED PRIVATE KEY]" : index % 2 === 1 ? part : "").join("");
+}
+var CREDENTIAL_FIELD = /(\b(?:[A-Za-z0-9]+[_-])*(?:api[_-]?key|apikey|secret(?:[_-]?key)?|password|passwd|access[_-]?token|auth[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key)\b["']?\s*[:=]\s*["']?)(?![<${]|process\.env|os\.environ)([^\s"'`,;]{8,})/gi;
+var CALL_OR_INDEX = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*[([]/;
+var DOTTED_REFERENCE = /^[A-Za-z_$][\w$]{0,39}(?:\.[A-Za-z_$][\w$]{0,39})+$/;
+function isCredentialReference(field, value) {
+  if (/["']$/.test(field))
+    return false;
+  return CALL_OR_INDEX.test(value) || DOTTED_REFERENCE.test(value);
+}
+function redactArtifactBody(body) {
+  const masked = body.replace(PRIVATE_KEY_BLOCK, maskPrivateKeyBlock).replace(CREDENTIAL_FIELD, (match, field, value) => isCredentialReference(field, value) ? match : `${field}[REDACTED]`);
+  return redactSnapshotText(masked).text;
+}
+var MAX_STORED_ARTIFACT_BODY_BYTES = 1e6;
+var MAX_ARTIFACT_BODY_UPLOAD_COUNT = 100;
+var MAX_ARTIFACT_BODY_UPLOAD_BYTES = 1800000;
+var MAX_ARTIFACT_BODY_HASH_QUERY = 1000;
+var encoder = new TextEncoder;
+async function webCryptoSha256Hex(text) {
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", encoder.encode(text));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function artifactsOf(graph) {
+  if (!graph || typeof graph !== "object")
+    return [];
+  const artifacts = graph.artifacts;
+  return Array.isArray(artifacts) ? artifacts.filter((artifact) => Boolean(artifact) && typeof artifact === "object") : [];
+}
+async function captureFullArtifactBodies(graph, sha256 = webCryptoSha256Hex) {
+  const captured = new Map;
+  for (const artifact of artifactsOf(graph)) {
+    if (typeof artifact.body !== "string" || artifact.body.length === 0)
+      continue;
+    const body = redactArtifactBody(artifact.body);
+    artifact.body = body;
+    if (encoder.encode(body).length > MAX_STORED_ARTIFACT_BODY_BYTES)
+      continue;
+    captured.set(artifact, { hash: await sha256(body), body, length: body.length });
+  }
+  return captured;
+}
+var BODY_CAPS = [32768, 16384, 8192, 4096, 2048, 1024, 768, 512, 384, 256];
+var PROMPT_ARTIFACT_TYPES = new Set(["prompt", "skill"]);
+var ARTIFACT_BODY_TRUNCATION_MARKER = `
+[Truncated by Moda to fit the harness sync limit: `;
+function fitGraphForSync(graph, maxBytes, fullBodies) {
+  if (!graph || typeof graph !== "object")
+    return 0;
+  const g = graph;
+  const bytes = (value) => encoder.encode(JSON.stringify(value)).length;
+  if (bytes(g) <= maxBytes || !Array.isArray(g.artifacts))
+    return 0;
+  const scan = g.scan && typeof g.scan === "object" ? g.scan : g.scan = {};
+  const previousReasons = scan.truncationReasons;
+  const previousTruncated = scan.truncated;
+  const reasons = Array.isArray(scan.truncationReasons) ? scan.truncationReasons : [];
+  scan.truncationReasons = [...new Set([...reasons, "artifact bodies shortened to fit the sync limit"])];
+  scan.truncated = true;
+  let size = bytes(g);
+  let shortened = 0;
+  const artifacts = g.artifacts;
+  const shorten = (eligible) => {
+    for (const cap of BODY_CAPS) {
+      if (size <= maxBytes)
+        return;
+      const withBodies = artifacts.filter((artifact) => eligible(artifact) && typeof artifact.body === "string" && artifact.body.length > cap).sort((a, b) => b.body.length - a.body.length);
+      for (const artifact of withBodies) {
+        const body = artifact.body;
+        const full = fullBodies?.get(artifact);
+        if (full && artifact.bodyHash === undefined) {
+          size += bytes({ bodyHash: full.hash, bodyLength: full.length }) - 1;
+          artifact.bodyHash = full.hash;
+          artifact.bodyLength = full.length;
+        }
+        const where = typeof artifact.sourcePath === "string" ? ` in ${artifact.sourcePath}` : "";
+        const next = `${body.slice(0, cap)}${ARTIFACT_BODY_TRUNCATION_MARKER}${body.length - cap} more characters${where}.]`;
+        size += bytes(next) - bytes(body);
+        artifact.body = next;
+        shortened += 1;
+        if (size <= maxBytes)
+          return;
+      }
+    }
+  };
+  const isPrompt = (artifact) => PROMPT_ARTIFACT_TYPES.has(String(artifact.type));
+  shorten((artifact) => !isPrompt(artifact));
+  shorten(isPrompt);
+  if (shortened === 0) {
+    if (previousReasons === undefined)
+      delete scan.truncationReasons;
+    else
+      scan.truncationReasons = previousReasons;
+    if (previousTruncated === undefined)
+      delete scan.truncated;
+    else
+      scan.truncated = previousTruncated;
+  }
+  return shortened;
+}
+function referencedFullBodies(graph, fullBodies) {
+  const byHash = new Map;
+  for (const artifact of artifactsOf(graph)) {
+    const full = fullBodies.get(artifact);
+    if (full && artifact.bodyHash === full.hash)
+      byHash.set(full.hash, full);
+  }
+  return [...byHash.values()];
+}
+function stripArtifactBodyHashes(graph) {
+  let stripped = 0;
+  for (const artifact of artifactsOf(graph)) {
+    if (artifact.bodyHash === undefined && artifact.bodyLength === undefined)
+      continue;
+    delete artifact.bodyHash;
+    delete artifact.bodyLength;
+    stripped += 1;
+  }
+  return stripped;
+}
+function chunk(items, size) {
+  const out = [];
+  for (let index = 0;index < items.length; index += size)
+    out.push(items.slice(index, index + size));
+  return out;
+}
+async function uploadMissingArtifactBodies(bodies, store) {
+  const byHash = new Map(bodies.map((body) => [body.hash, body]));
+  if (byHash.size === 0)
+    return { referenced: 0, uploaded: 0, batches: 0 };
+  const missing = new Set;
+  for (const hashes of chunk([...byHash.keys()], MAX_ARTIFACT_BODY_HASH_QUERY)) {
+    const answer = await store.missing(hashes);
+    const asked = new Set(hashes);
+    for (const hash of answer)
+      if (asked.has(hash))
+        missing.add(hash);
+  }
+  const batches = [];
+  let current = [];
+  let currentBytes = 0;
+  for (const hash of missing) {
+    const entry = { hash, body: byHash.get(hash).body };
+    const entryBytes = encoder.encode(JSON.stringify(entry)).length + 1;
+    if (current.length > 0 && (current.length >= MAX_ARTIFACT_BODY_UPLOAD_COUNT || currentBytes + entryBytes > MAX_ARTIFACT_BODY_UPLOAD_BYTES)) {
+      batches.push(current);
+      current = [];
+      currentBytes = 0;
+    }
+    current.push(entry);
+    currentBytes += entryBytes;
+  }
+  if (current.length > 0)
+    batches.push(current);
+  for (const batch of batches)
+    await store.upload(batch);
+  return { referenced: byHash.size, uploaded: missing.size, batches: batches.length };
+}
+async function storeShortenedArtifactBodies(graph, fullBodies, store, options = {}) {
+  const bodies = referencedFullBodies(graph, fullBodies);
+  try {
+    return await uploadMissingArtifactBodies(bodies, store);
+  } catch (error) {
+    if (!options.keepHashesOnError)
+      stripArtifactBodyHashes(graph);
+    return { referenced: bodies.length, uploaded: 0, batches: 0, error };
+  }
+}
+export { MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot, redactArtifactBody, MAX_STORED_ARTIFACT_BODY_BYTES, captureFullArtifactBodies, fitGraphForSync, storeShortenedArtifactBodies };

package/dist/{cli-5ms8rw8x.js → cli-13zdcv4w.js}

@@ -1,7 +1,7 @@
 import {
   createCliOutput,
   outputModeFromFlags
-} from "./cli-z1t3sf7b.js";
+} from "./cli-1nd4339b.js";
 
 // src/command-context.ts
 function flagEnabled(flags, key) {

package/dist/{cli-z1t3sf7b.js → cli-1nd4339b.js}

@@ -12,7 +12,7 @@ import {
 } from "./cli-k4tqwah4.js";
 import {
   redactDeep
-} from "./cli-p5grm12t.js";
+} from "./cli-0semcakc.js";
 
 // src/profiles.ts
 import {

package/dist/{cli-6hveza1a.js → cli-5knr4dts.js}

@@ -5,13 +5,13 @@ import {
 import {
   assertFlags,
   assertPositionals
-} from "./cli-22yvg5kh.js";
+} from "./cli-6ga6kmdp.js";
 import {
   callControlAPI
-} from "./cli-87xy1evx.js";
+} from "./cli-dxajrq9h.js";
 import {
   createCommandContext
-} from "./cli-5ms8rw8x.js";
+} from "./cli-13zdcv4w.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";
@@ -5543,7 +5543,7 @@ import {
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 var promptSourcesModule;
 async function loadPromptSources() {
-  promptSourcesModule ??= await import("./prompt-sources-87qsxhdt.js");
+  promptSourcesModule ??= await import("./prompt-sources-cyqr5m4h.js");
   return promptSourcesModule;
 }
 var MODA_DIR = ".moda";
@@ -5768,7 +5768,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-a55w36em.js");
+    const { analyzeHarnessPrompts } = await import("./harness-7j8cvzgc.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),
@@ -5796,7 +5796,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const mergedSources = mergePromptSources(manifest.sources, extraSources);
   const manifestUpdate = stableJson(mergedSources) === stableJson(mergePromptSources(manifest.sources, [])) ? undefined : $stringify({ version: 2, prompt_paths: manifest.promptPaths, sources: mergedSources });
   const prompts = await discoverPrompts(extraSources);
-  const { checkPromptAttribution } = await import("./prompt-attribution-fyas5gnw.js");
+  const { checkPromptAttribution } = await import("./prompt-attribution-abzze4g0.js");
   const attribution = checkPromptAttribution(process.cwd(), prompts.map((prompt) => prompt.key));
   const brokenAttribution = attribution.references.filter((reference) => reference.status === "missing");
   if (brokenAttribution.length) {
@@ -6102,7 +6102,7 @@ async function migratePromptManifest(options = {}) {
   let addedSources = [];
   let pendingSources = [];
   if (options.discover) {
-    const { analyzeHarnessPrompts } = await import("./harness-a55w36em.js");
+    const { analyzeHarnessPrompts } = await import("./harness-7j8cvzgc.js");
     const result = await analyzeHarnessPrompts({
       rootDir: root,
       existing: manifest.sources,

package/dist/{cli-n1406hqg.js → cli-62e1vy8f.js}

@@ -1,10 +1,10 @@
 import {
   fetchApiKeyProbe
-} from "./cli-snswkrxd.js";
+} from "./cli-998n4kz9.js";
 import {
   authFetch,
   getCachedLoginContext
-} from "./cli-rrggdmf8.js";
+} from "./cli-qwnkv4jy.js";
 import {
   embeddedTenantIdFromApiKey,
   getModaDir,
@@ -15,7 +15,7 @@ import {
   resolveTenantIdFromActiveProfile,
   saveCliConfig,
   writeSecretJsonFile
-} from "./cli-z1t3sf7b.js";
+} from "./cli-1nd4339b.js";
 import {
   CliAccessError,
   CliInputError,

package/dist/{cli-22yvg5kh.js → cli-6ga6kmdp.js}

@@ -2,7 +2,7 @@ import {
   ApiError,
   callControlAPI,
   callDataAPI
-} from "./cli-87xy1evx.js";
+} from "./cli-dxajrq9h.js";
 import {
   continuationCommand,
   embeddedTenantIdFromApiKey,
@@ -11,7 +11,7 @@ import {
   resolveApiTenantId,
   setPlatformTenantOverride,
   shellArg
-} from "./cli-z1t3sf7b.js";
+} from "./cli-1nd4339b.js";
 import {
   CliAccessError,
   CliInputError