@moda-ai/cli 1.55.93 → 1.55.95

package/README.md

@@ -77,6 +77,29 @@ moda harness candidates --path=. --promote=all --out=harness-components.json --y
 
 Every enumerated component includes a source citation and `reachable` or `defined_only` status. Production trace evidence can later promote it to `in_prod`. Dynamic MCP allow-all servers are one group; extraction does not connect to those servers. The repository-bound `createAgentScopeResolver(result, ctx)` callback maps `CallSite.enclosing` to emitted agent IDs, including inherited hooks and shared helpers; ambiguous or unknown scopes return `[]`.
 
+### Component skeleton and diff
+
+```bash
+moda harness skeleton --path=. --out=/tmp/skeleton.json --json
+moda harness skeleton-diff /tmp/before.json /tmp/after.json --json
+moda harness skeleton-diff --from=/tmp/before.json --to=/tmp/after.json --json
+```
+
+`skeleton` produces `harness-skeleton/v1`, a component map of the harness: a `HarnessGraph` (agents, artifacts and relationships in the usual places, so sync and Ask read it unchanged) plus `skeleton.callSites`, counts, commit, content hash, coverage and a control-flow slot. It runs locally without an LLM or network calls and holds locations and owners, never bodies.
+
+- Prompts: a named builder, template or prompt file a model call reaches is one unit, shared by every call that reaches it. Text assembled in the calling function is a `call` unit for that function, with the pieces as `members`. Constants inside a builder are not listed separately.
+- Ids are stable across commits: they hold no line numbers, except the extractor's anonymous `path#L<line>` scopes. Repeated keys get `~2`, `~3` in source order.
+- `liveKey` is the key traces and the traced registry match on, normalised like the backend's trace status: agent class name, model-facing tool name, model id, skill name. Prompts and call sites have none.
+- Map edges live in `skeleton.edges`, a compact table; decode them with `decodeSkeletonEdges(graph.skeleton.edges)` into `{ id: "<type>:<from>-><to>", type, from, to, source, evidence }`. Types: `triggers` (entry point to agent), `invokes_subagent` and `hands_off_to` (agent to agent), `uses_artifact` (agent to prompt, tool or model), `implemented_by` (tool to `code:<path>#<handler>`), `has_control_flow` and `guards` (agent to control-flow item to call site), and `covered_by_eval` (agent or tool to eval suite). `source` is `code` for every extracted edge; consumers merge edges seen in traces as `trace`. `relationships` keeps only the agent-to-agent edges in the usual graph form, so sync and Ask read them unchanged.
+- `skeleton.coverage` says per component type whether detection is `complete` or `partial`, with `skeleton.knownGaps`. Claim completeness only for `complete` types.
+- Entry points: workflows and crons, exported route handlers of route agents (`trigger: "http_route"`) and Durable Object bindings (`trigger: "do_binding"`) of agent classes or of classes that construct one. Each lists the agents it starts in their `entrypointIds` (`triggers` edges); a workflow starts the function agents and sub-agent calls its code reaches.
+- Tools are attributed to agents whose own model calls receive tools. A call that picks its model from a table at runtime has `modelSource: "factory (computed)"` and the table in `modelCandidates`; those candidates are not the call's or the agent's models, and each agent lists such calls in `modelChoices` (call site, location and candidates). A Workers eval suite that drives the deployed Worker covers the agents bound in its default Wrangler config.
+- `covered_by_eval` is a static association (what the suite's own files import, through re-export barrels, and its own model calls), not execution or assertion coverage.
+
+The JSON envelope's `data` is the skeleton; `--out` writes the bare skeleton. Incomplete scans return exit code 3 with warnings. `skeleton-diff` accepts either form, lists added, removed, moved and changed components and edges, ignores line-only shifts, and pairs unique same-name components across file renames as `moved`. Its `identical` flag compares content hashes. `harness extract` output is unchanged.
+
+Library exports (`src/harness-extract/skeleton/index.ts`): `buildHarnessSkeleton(rootDir, options?)`, `skeletonFromExtract(result, ctx)`, `diffHarnessSkeletons(before, after)` and `registerControlFlowDetector(detector)`. A detector receives `{result, ctx, callSites, agents, callSiteIdOf}` and returns control-flow items; items naming unknown call sites or agents are dropped, a throwing detector leaves `controlFlowStatus: "failed"` with a warning, and without a detector the status is `not_run`.
+
 ## Usage
 
 Find things by meaning, then drill in:
@@ -437,3 +460,32 @@ Both commands accept two flags to inline a message window per row:
 ## License
 
 MIT
+
+### Local change impact (experimental)
+
+`moda harness impact --path=<checkout> --from=<old-commit> --to=<new-commit> --json`
+follows changed JavaScript/TypeScript symbols through checker-confirmed references to model
+calls, agents, prompt units, and tool definitions. Alternatively pass `--diff=<zero-context-diff>`
+against `--from`. Control-flow additions use the old enclosing function. Single-line edits use
+changed columns to distinguish changed literals from unchanged siblings.
+
+The command builds a disposable old source snapshot, preserves working-tree edits, returns only
+the reached slice, and makes no API calls or replays. It excludes assets and source files above
+1 MiB; diff inputs have a 16 MiB aggregate source budget. Closure is bounded to 5,000 symbols and
+100,000 references; returned units are bounded to 2,000 units / 2 MiB of literal text. Unchanged
+context reached through a changed symbol is capped at 20 units per call site and 400 in all
+(`contextTruncated`), so it never displaces changed text. Skips, closure budgets and a dropped
+changed-text unit (`unitSliceTruncated`) are reported as warnings and mean the result is incomplete.
+Changed styles, media and fonts are listed in `ignoredFiles`: they carry no prompt or tool text.
+
+Optional `--calls=<json>` accepts `{sourceCommit, candidate, sections, tools}` records.
+`sourceCommit` must equal the resolved old commit, and `candidate` uses the frontend change-tests
+`ChangeCase` fields. Sections/tools supply `text` and `sources: [{path, line, endLine}]` from a
+same-agent source join. Optional `agentIds` rejects mismatched owners. Optional `toolDefinitions`
+(`[{name, definition}]`) joins recorded definitions to unique extracted tool names, owners and
+old source text. Ambiguous definitions remain unlinked. Templates require all static fragments
+in order; changed old literals cannot qualify through unchanged sibling text.
+
+Keep call inputs and redirected output outside the repository: they can contain customer content.
+Python, unresolved dynamic dispatch and new files without old context remain unmodelled. This
+local result does not establish deployment attribution or production precision/recall.

package/dist/{agent-732v69qx.js → agent-wa8tx02f.js}

@@ -1,9 +1,10 @@
 import {
   buildDoctorReport
-} from "./cli-2ctk8gy8.js";
+} from "./cli-abfcqf4p.js";
 import"./cli-qwnkv4jy.js";
-import"./cli-0qgxw8cx.js";
+import"./cli-92zfpz9f.js";
 import"./cli-mm48br00.js";
+import"./cli-764m5azg.js";
 import {
   readHarnessSyncState
 } from "./cli-k0vxtzxb.js";
@@ -15,10 +16,10 @@ import {
   readHarnessReport,
   validateHarnessReport
 } from "./cli-krm4w2v9.js";
-import"./cli-6ga6kmdp.js";
-import"./cli-dxajrq9h.js";
 import"./cli-13zdcv4w.js";
+import"./cli-6ga6kmdp.js";
 import"./cli-e0kbye4s.js";
+import"./cli-dxajrq9h.js";
 import {
   resolveApiKey,
   resolveIngestUrl,
@@ -95,7 +96,7 @@ async function buildAgentContext(context) {
   const graph = readHarnessGraphIfPresent(context.cwd);
   const reportState = readHarnessReportState(context.cwd);
   const syncState = readHarnessSyncState(context.cwd);
-  const harness = graph ? await import("./harness-fjrhp1af.js") : undefined;
+  const harness = graph ? await import("./harness-jka07f99.js") : undefined;
   const topFindings = doctor.checks.filter((check) => check.status === "fail" || check.status === "warning").slice(0, 12).map(checkToFinding);
   const evidenceRefs = [
     ...doctor.checks.map(checkToEvidenceRef),