@moda-ai/cli 1.6.0 → 1.7.0

package/dist/cli.js

@@ -198,6 +198,8 @@ Init flags:
   --no-sdk-integrate               Skip SDK integration (alias: --no-sdk-guide)
   --ci-cd                          Create GitHub Actions Moda validation workflow
   --no-ci-cd                       Skip CI/CD workflow creation
+  --autosync                       Create GitHub Actions workflow to sync prompts + skills to Moda on push to main
+  --no-autosync                    Skip autosync workflow creation
   --offline                        Run final validation offline (skip the online telemetry check)
 
 Examples:
@@ -228,6 +230,7 @@ Examples:
   moda harness scan --json
   moda harness explain --agent=agent_support
   moda init --ci-cd
+  moda init --autosync
   moda overview --days-back=30
   moda clusters --time-range=7d
   moda conversations --search="error" --limit=5
@@ -581,7 +584,7 @@ export const commandRegistry = createCommandRegistry([
     {
         name: 'init',
         description: 'Set up Moda in your project',
-        examples: ['moda init', 'moda init --sdk-integrate', 'moda init --ci-cd'],
+        examples: ['moda init', 'moda init --sdk-integrate', 'moda init --ci-cd', 'moda init --autosync'],
         auth: 'none',
         outputModes: ['human', 'json', 'agent'],
         mutability: 'write',

package/dist/init/index.d.ts

@@ -11,7 +11,7 @@ export interface InitPhaseResult {
     details?: string;
 }
 export interface InitSetupAction {
-    category: 'sdk' | 'harness' | 'hooks' | 'prompts' | 'skills' | 'ci-cd' | 'validation';
+    category: 'sdk' | 'harness' | 'hooks' | 'prompts' | 'skills' | 'ci-cd' | 'autosync' | 'validation';
     title: string;
     status: 'planned' | 'applied' | 'skipped' | 'manual';
     approved: boolean;

package/dist/init/index.js

@@ -13,6 +13,7 @@ import { runSkillSync } from '../skills.js';
 import { SDK_GUIDE_PATH, writeSdkIntegrationGuide } from './sdk-guide.js';
 import { runSdkIntegration } from './sdk-integration.js';
 import { createCommandContext } from '../command-context.js';
+import { VERSION } from '../config.js';
 import { CliInputError } from '../errors.js';
 import { runHarnessCommand } from '../harness.js';
 import { buildDoctorReport } from '../doctor.js';
@@ -136,6 +137,7 @@ export async function runInit(flags, options = {}) {
         installHooks: false,
         integrateSdk: await shouldIntegrateSdk(flags, yes),
         configureCiCd: await shouldConfigureCiCd(flags, yes),
+        configureAutosync: await shouldConfigureAutosync(flags, yes),
     });
     log(renderInitSetupPlan(setupPlan));
     emit('plan', 'Setup plan ready.', 'completed');
@@ -235,6 +237,12 @@ export async function runInit(flags, options = {}) {
         log(renderInitNote(`Wrote ${workflowPath}`));
         markApplied(setupPlan, 'ci-cd');
     }
+    const configureAutosync = setupPlan.find((action) => action.category === 'autosync')?.approved === true;
+    if (configureAutosync) {
+        const workflowPath = writeAutosyncWorkflow();
+        log(renderInitNote(`Wrote ${workflowPath}`));
+        markApplied(setupPlan, 'autosync');
+    }
     log(renderInitNote('Reusing approved Step 4 harness report; no second analyst run needed'));
     markApplied(setupPlan, 'harness');
     markApplied(setupPlan, 'hooks', ingestCodingAgentTraces ? undefined : 'Coding-agent trace capture is temporarily unavailable.');
@@ -337,6 +345,15 @@ function buildSetupPlan(options) {
             command: 'moda doctor --online --json',
             reason: options.configureCiCd ? undefined : 'No CI/CD files are changed until a project-specific plan is approved.',
         },
+        {
+            category: 'autosync',
+            title: 'Autosync prompts and skills to Moda on push to main',
+            status: options.configureAutosync ? 'planned' : 'manual',
+            approved: options.configureAutosync,
+            files: ['.github/workflows/moda-autosync.yml'],
+            command: 'moda prompts sync && moda skills sync',
+            reason: options.configureAutosync ? undefined : 'No autosync workflow is written until it is explicitly approved (--autosync).',
+        },
         {
             category: 'validation',
             title: 'Run Moda doctor online to confirm telemetry is reaching Moda',
@@ -364,6 +381,13 @@ function changedFiles(setupPlan) {
             .filter((action) => action.status === 'applied')
             .flatMap((action) => action.files))].filter((file) => !file.includes('.env'));
 }
+// The CLI version generated workflows pin to. Pinning (rather than `@latest`,
+// which resolves at CI run time) keeps a future compromised `@moda-ai/cli`
+// publish from silently executing in adopters' CI with their MODA_API_KEY /
+// MODA_TENANT_ID present — especially important for autosync, which *writes* to
+// the Moda registry. The pin tracks the CLI that generated the file, so each
+// `moda init` upgrade is an explicit, reviewable bump of the workflow.
+const GENERATED_WORKFLOW_CLI = `@moda-ai/cli@${VERSION}`;
 function writeCiCdWorkflow(cwd = process.cwd()) {
     const relativePath = '.github/workflows/moda-validation.yml';
     const path = join(cwd, relativePath);
@@ -376,6 +400,11 @@ function writeCiCdWorkflow(cwd = process.cwd()) {
         '  push:',
         '    branches: [main]',
         '',
+        '# Least privilege: these jobs only read the checked-out repo and talk to',
+        '# Moda over the API key; they never write back to the repository.',
+        'permissions:',
+        '  contents: read',
+        '',
         'jobs:',
         '  moda-doctor:',
         '    runs-on: ubuntu-latest',
@@ -388,7 +417,51 @@ function writeCiCdWorkflow(cwd = process.cwd()) {
         '        with:',
         '          node-version: 22',
         '      - name: Validate Moda setup',
-        '        run: npx -y @moda-ai/cli@latest moda doctor --online --json',
+        `        run: npx -y ${GENERATED_WORKFLOW_CLI} moda doctor --online --json`,
+        '',
+    ].join('\n')}`);
+    return relativePath;
+}
+// Generates a push-to-main autosync workflow that keeps the Moda registry in
+// sync with the repo: it pushes prompt and skill changes after they merge. It
+// only runs on `main` (never on pull_request) so unmerged versions are never
+// published. Keep its env in step with writeCiCdWorkflow().
+function writeAutosyncWorkflow(cwd = process.cwd()) {
+    const relativePath = '.github/workflows/moda-autosync.yml';
+    const path = join(cwd, relativePath);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${[
+        'name: Moda Autosync',
+        '',
+        'on:',
+        '  push:',
+        '    branches: [main]',
+        '',
+        '# Least privilege: this job only reads the checked-out repo and writes to',
+        '# Moda over the API key; it never writes back to the repository.',
+        'permissions:',
+        '  contents: read',
+        '',
+        '# A single in-flight sync at a time; newer pushes supersede older runs.',
+        'concurrency:',
+        '  group: moda-autosync',
+        '  cancel-in-progress: true',
+        '',
+        'jobs:',
+        '  moda-sync:',
+        '    runs-on: ubuntu-latest',
+        '    env:',
+        '      MODA_API_KEY: ${{ secrets.MODA_API_KEY }}',
+        '      MODA_TENANT_ID: ${{ secrets.MODA_TENANT_ID }}',
+        '    steps:',
+        '      - uses: actions/checkout@v4',
+        '      - uses: actions/setup-node@v4',
+        '        with:',
+        '          node-version: 22',
+        `      - name: Sync prompts to Moda`,
+        `        run: npx -y ${GENERATED_WORKFLOW_CLI} moda prompts sync`,
+        `      - name: Sync skills to Moda`,
+        `        run: npx -y ${GENERATED_WORKFLOW_CLI} moda skills sync`,
         '',
     ].join('\n')}`);
     return relativePath;
@@ -451,6 +524,19 @@ async function shouldConfigureCiCd(flags, yes) {
         default: false,
     });
 }
+async function shouldConfigureAutosync(flags, yes) {
+    const explicit = parseOptionalBoolean(flagValue(flags, 'autosync', 'auto-sync', 'auto_sync'));
+    if (explicit !== undefined)
+        return explicit;
+    if (isTruthyFlag(flagValue(flags, 'no-autosync', 'no_autosync', 'no-auto-sync', 'no_auto_sync')))
+        return false;
+    if (yes)
+        return false;
+    return confirm({
+        message: 'Create a GitHub Actions workflow to autosync prompts and skills to Moda on push to main?',
+        default: false,
+    });
+}
 async function shouldIntegrateSdk(flags, yes) {
     const explicit = parseOptionalBoolean(flagValue(flags, 'sdk-integrate', 'sdk_integrate', 'sdk-guide', 'sdk_guide', 'sdk'));
     if (explicit !== undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {