@moda-ai/cli 1.12.6 → 1.13.1

package/dist/cli-session.d.ts

@@ -0,0 +1,26 @@
+import { CliAuthError } from './errors.js';
+import { type AuthSessionOptions, type StoredAuth } from './auth-storage.js';
+/**
+ * Fire-and-forget sliding-expiry renewal, invoked on every authenticated
+ * request: a no-op unless the session is a moda_ct token inside the renewal
+ * window. Never awaited by callers, never throws, never holds the process
+ * open (unref'd socket); on success the stored expires_at is rewritten in
+ * place.
+ */
+export declare function scheduleRenewalIfNearExpiry(session: StoredAuth, authOptions: AuthSessionOptions): void;
+/** The CliAuthError thrown whenever a stored moda_ct session has expired. */
+export declare function cliSessionExpiredError(): CliAuthError;
+/**
+ * Classify a 401 for a moda_ct session. Returns the CliAuthError to throw,
+ * or null when the renew probe says the token is actually alive (the caller
+ * then surfaces the original response unchanged).
+ */
+export declare function classifyModaCtUnauthorized(session: StoredAuth, authOptions: AuthSessionOptions): Promise<CliAuthError | null>;
+/**
+ * Best-effort server-side revocation of a stored moda_ct session token,
+ * called by `moda auth logout` before local deletion. No-op for legacy
+ * auth0-kind sessions; all failures are swallowed (the local deletion is
+ * the contract).
+ */
+export declare function revokeCliSessionToken(options?: AuthSessionOptions): Promise<void>;
+//# sourceMappingURL=cli-session.d.ts.map

package/dist/cli-session.js

@@ -0,0 +1,169 @@
+// src/cli-session.ts — moda_ct CLI session token lifecycle: renewal
+// (sliding expiry), revocation, and 401 classification against the
+// /api/cli/auth/* endpoints.
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { resolveModaBaseUrl } from './config.js';
+import { CliAuthError } from './errors.js';
+import { isModaCtSession, loadAuthSession, persistAuthSession, } from './auth-storage.js';
+// Background sliding-expiry renewal fires when a moda_ct session has less
+// than this long left.
+const RENEW_WINDOW_SECONDS = 7 * 86_400;
+const RENEW_TIMEOUT_MS = 10_000;
+// Synchronous renew probe used to classify a 401, and best-effort revoke on
+// logout: both must never stall a command, so they get a tight budget.
+const RENEW_PROBE_TIMEOUT_MS = 2_000;
+const REVOKE_TIMEOUT_MS = 2_000;
+/**
+ * POST an Authorization-bearer request to a CLI session lifecycle endpoint
+ * (/api/cli/auth/renew or /api/cli/auth/revoke) over raw node http/https.
+ * Not fetch: the background renewal must never delay process exit, and only
+ * a raw socket can be unref'd. Rejects on network failure or timeout.
+ */
+function postCliSessionEndpoint(path, token, timeoutMs, opts = {}) {
+    return new Promise((resolve, reject) => {
+        let url;
+        try {
+            // Resolve the origin from the same profile/env context the session was
+            // loaded with: a `--profile staging` session's renew/revoke must hit the
+            // staging backend that minted it, not the active/default profile's.
+            url = new URL(`${resolveModaBaseUrl(opts.authOptions)}${path}`);
+        }
+        catch (err) {
+            reject(err instanceof Error ? err : new Error(String(err)));
+            return;
+        }
+        const requestFn = url.protocol === 'https:' ? httpsRequest : httpRequest;
+        const req = requestFn(url, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${token}` },
+            timeout: timeoutMs,
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (chunk) => chunks.push(chunk));
+            res.on('end', () => {
+                resolve({
+                    status: res.statusCode ?? 0,
+                    body: Buffer.concat(chunks).toString('utf8'),
+                });
+            });
+            res.on('error', reject);
+        });
+        if (opts.unrefSocket) {
+            req.on('socket', (socket) => {
+                socket.unref();
+            });
+        }
+        req.on('timeout', () => {
+            req.destroy(new Error(`CLI session request timed out after ${timeoutMs}ms`));
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+/**
+ * Parse a renew response body and rewrite the stored session's expiry in
+ * place, preserving the profile scoping the session was loaded with.
+ * Best-effort: an unreadable or incomplete body is simply ignored.
+ */
+function persistRenewedExpiry(session, body, authOptions) {
+    try {
+        const parsed = JSON.parse(body);
+        const expiresAtMs = typeof parsed.expires_at === 'string' ? Date.parse(parsed.expires_at) : NaN;
+        if (!Number.isFinite(expiresAtMs))
+            return;
+        persistAuthSession({ ...session, expires_at: Math.floor(expiresAtMs / 1000) }, authOptions);
+    }
+    catch {
+        // Best-effort persistence only.
+    }
+}
+// Stampede guard: at most one background renewal in flight per process.
+let renewInFlight = false;
+/**
+ * Fire-and-forget sliding-expiry renewal, invoked on every authenticated
+ * request: a no-op unless the session is a moda_ct token inside the renewal
+ * window. Never awaited by callers, never throws, never holds the process
+ * open (unref'd socket); on success the stored expires_at is rewritten in
+ * place.
+ */
+export function scheduleRenewalIfNearExpiry(session, authOptions) {
+    if (!isModaCtSession(session))
+        return;
+    if (session.expires_at - Date.now() / 1000 >= RENEW_WINDOW_SECONDS)
+        return;
+    if (renewInFlight)
+        return;
+    renewInFlight = true;
+    void (async () => {
+        try {
+            const result = await postCliSessionEndpoint('/api/cli/auth/renew', session.access_token, RENEW_TIMEOUT_MS, { unrefSocket: true, authOptions });
+            if (result.status !== 200)
+                return;
+            persistRenewedExpiry(session, result.body, authOptions);
+        }
+        catch {
+            // Silent by design: renewal is opportunistic, the command result must
+            // not depend on it.
+        }
+        finally {
+            renewInFlight = false;
+        }
+    })();
+}
+/** The CliAuthError thrown whenever a stored moda_ct session has expired. */
+export function cliSessionExpiredError() {
+    return new CliAuthError('The stored CLI session token has expired. Run "moda auth login" to sign in again.', { reason: 'token_expired', login_command: ['moda', 'auth', 'login'] });
+}
+/**
+ * Classify a 401 for a moda_ct session. Returns the CliAuthError to throw,
+ * or null when the renew probe says the token is actually alive (the caller
+ * then surfaces the original response unchanged).
+ */
+export async function classifyModaCtUnauthorized(session, authOptions) {
+    const loginCommand = ['moda', 'auth', 'login'];
+    if (Date.now() / 1000 > session.expires_at) {
+        return cliSessionExpiredError();
+    }
+    let probe;
+    try {
+        probe = await postCliSessionEndpoint('/api/cli/auth/renew', session.access_token, RENEW_PROBE_TIMEOUT_MS, { authOptions });
+    }
+    catch {
+        return new CliAuthError('The Moda API rejected the stored CLI session token, and the renewal check could not reach the server. ' +
+            'The token has not expired, so this is likely transient: retry the command instead of logging in again.', { reason: 'renew_failed', login_command: loginCommand });
+    }
+    if (probe.status === 401) {
+        return new CliAuthError('The stored CLI session token has been revoked. Run "moda auth login" to sign in again.', { reason: 'token_revoked', login_command: loginCommand });
+    }
+    if (probe.status === 200) {
+        // The token is demonstrably alive (the probe just slid its expiry) but
+        // the original request still 401'd; persist the fresh expiry and let the
+        // caller see the original response.
+        persistRenewedExpiry(session, probe.body, authOptions);
+        return null;
+    }
+    // Any other renew status (e.g. a 5xx) is indistinguishable from a
+    // transient server problem: same retry guidance as a network failure.
+    return new CliAuthError('The Moda API rejected the stored CLI session token, and the renewal check failed ' +
+        `(HTTP ${probe.status}). The token has not expired, so this is likely transient: ` +
+        'retry the command instead of logging in again.', { reason: 'renew_failed', login_command: loginCommand });
+}
+/**
+ * Best-effort server-side revocation of a stored moda_ct session token,
+ * called by `moda auth logout` before local deletion. No-op for legacy
+ * auth0-kind sessions; all failures are swallowed (the local deletion is
+ * the contract).
+ */
+export async function revokeCliSessionToken(options = {}) {
+    const session = loadAuthSession({ ...options, includeExpired: true });
+    if (!session || !isModaCtSession(session))
+        return;
+    try {
+        await postCliSessionEndpoint('/api/cli/auth/revoke', session.access_token, REVOKE_TIMEOUT_MS, { authOptions: options });
+    }
+    catch {
+        // Best-effort: logout proceeds with local deletion regardless.
+    }
+}
+//# sourceMappingURL=cli-session.js.map

package/dist/cli.js

@@ -12,7 +12,7 @@ import { runSkillsCommand } from './skills.js';
 import { runHarnessCommand } from './harness.js';
 import { runSyncCommand } from './sync.js';
 import { runDoctorCommand, runStatusCommand } from './doctor.js';
-import { CliAuthError, CliCancellationError, CliInputError, CliInputRequiredError, isApiLikeError, isNetworkLikeError } from './errors.js';
+import { CliAccessError, CliAuthError, CliCancellationError, CliInputError, CliInputRequiredError, isApiLikeError, isNetworkLikeError } from './errors.js';
 import { buildSearchAdoptionTelemetry, isTelemetryDisabled, SEARCH_MODES, sendCliUsageTelemetry, stripTelemetryFlag, } from './telemetry.js';
 import { isUpdateCheckDisabled, printUpdateNotice, startUpdateCheck, stripUpdateCheckFlag, } from './update-check.js';
 import { createCommandContext } from './command-context.js';
@@ -111,6 +111,8 @@ Commands:
   manifest                         Describe the CLI machine protocol and commands
   doctor                           Diagnose local Moda setup and data flow
   auth login                       Authenticate with Moda
+  auth status                      Show local auth session state (exit 4 when logged out); --online probes the API
+  auth token                       Print the raw bearer token for $(moda auth token)
   auth logout                      Clear cached Moda auth
   auth whoami                      Show the authenticated Moda user
   profiles list                    List local Moda profiles
@@ -759,7 +761,14 @@ export const commandRegistry = createCommandRegistry([
     {
         name: 'auth',
         description: 'Authenticate and inspect browser auth sessions',
-        examples: ['moda auth login', 'moda auth whoami', 'moda auth logout'],
+        examples: [
+            'moda auth login',
+            'moda auth status',
+            'moda auth status --online',
+            'moda auth token',
+            'moda auth whoami',
+            'moda auth logout',
+        ],
         auth: 'none',
         outputModes: ['human', 'json', 'agent'],
         mutability: 'write',
@@ -1075,10 +1084,12 @@ export function classifyCliError(error) {
     if (error instanceof z.ZodError ||
         error instanceof CliInputError ||
         error instanceof CliInputRequiredError ||
-        error instanceof CliAuthError) {
-        // Auth/input-required are caller-actionable states (missing credentials,
-        // needs a choice), not unknown failures. Bucket them with validation so
-        // the missing-API-key case keeps its pre-hardening telemetry type.
+        error instanceof CliAuthError ||
+        error instanceof CliAccessError) {
+        // Auth/input-required/access are caller-actionable states (missing
+        // credentials, needs a choice, insufficient role), not unknown failures.
+        // Bucket them with validation so the missing-API-key case keeps its
+        // pre-hardening telemetry type.
         return 'validation_error';
     }
     if (error instanceof ApiError || isApiLikeError(error)) {
@@ -1095,6 +1106,11 @@ export function printCliError(error) {
         if (error.usage)
             safeWriteStderr(`${error.usage}\n`);
     }
+    else if (error instanceof CliAccessError) {
+        safeWriteStderr(`Error: ${error.message}\n`);
+        if (error.guidance)
+            safeWriteStderr(`${error.guidance}\n`);
+    }
     else if (error instanceof z.ZodError) {
         const issues = error.errors.map((e) => {
             const field = e.path.length ? e.path.join('.') : 'input';

package/dist/config.d.ts

@@ -17,8 +17,11 @@ export declare function loadCliConfig(options?: ProfileIOOptions): CliConfig;
 /**
  * Merge-and-write the persisted config. Always chmod 0600 since it holds the
  * API key. Best-effort: never throws on chmod failure (some filesystems).
+ * `options.profile` scopes the best-effort profile sync (e.g. `moda init
+ * --profile staging`), so the key is synced to the requested profile rather
+ * than whatever profile happens to be active.
  */
-export declare function saveCliConfig(update: CliConfig): void;
+export declare function saveCliConfig(update: CliConfig, options?: ProfileIOOptions): void;
 /**
  * Resolve the API key: prefer the environment (so CI / explicit exports win),
  * then fall back to the persisted `~/.moda/config.json`. Read lazily so a

package/dist/config.js

@@ -14,11 +14,14 @@ export function loadCliConfig(options = {}) {
 /**
  * Merge-and-write the persisted config. Always chmod 0600 since it holds the
  * API key. Best-effort: never throws on chmod failure (some filesystems).
+ * `options.profile` scopes the best-effort profile sync (e.g. `moda init
+ * --profile staging`), so the key is synced to the requested profile rather
+ * than whatever profile happens to be active.
  */
-export function saveCliConfig(update) {
-    const merged = writeLegacyCliConfig(update);
+export function saveCliConfig(update, options = {}) {
+    const merged = writeLegacyCliConfig(update, options);
     try {
-        syncLegacyConfigToProfile(merged);
+        syncLegacyConfigToProfile(merged, options);
     }
     catch {
         // The legacy config write is the compatibility contract; profile sync is a

package/dist/errors.d.ts

@@ -2,6 +2,19 @@ export declare class CliInputError extends Error {
     readonly usage?: string | undefined;
     constructor(message: string, usage?: string | undefined);
 }
+/**
+ * The authenticated user cannot perform the requested action with their
+ * current access (no organizations, or insufficient role). This is an access
+ * problem, not missing auth — the dispatcher maps it to EXIT_ERROR (1),
+ * never EXIT_AUTH_REQUIRED.
+ */
+export declare class CliAccessError extends Error {
+    /** Optional follow-up line telling the user how to obtain access. */
+    readonly guidance?: string;
+    constructor(message: string, options?: {
+        guidance?: string;
+    });
+}
 export interface AgentInputChoice {
     value: string;
     label: string;

package/dist/errors.js

@@ -6,6 +6,21 @@ export class CliInputError extends Error {
         this.name = 'CliInputError';
     }
 }
+/**
+ * The authenticated user cannot perform the requested action with their
+ * current access (no organizations, or insufficient role). This is an access
+ * problem, not missing auth — the dispatcher maps it to EXIT_ERROR (1),
+ * never EXIT_AUTH_REQUIRED.
+ */
+export class CliAccessError extends Error {
+    /** Optional follow-up line telling the user how to obtain access. */
+    guidance;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = 'CliAccessError';
+        this.guidance = options.guidance;
+    }
+}
 export class CliInputRequiredError extends Error {
     input_request;
     constructor(message, input_request, usage) {

package/dist/exit-funnel.js

@@ -1,4 +1,4 @@
-import { CliAuthError, CliCancellationError, CliInputRequiredError, } from './errors.js';
+import { CliAccessError, CliAuthError, CliCancellationError, CliInputRequiredError, } from './errors.js';
 import { EXIT_AUTH_REQUIRED, EXIT_CANCELLED, EXIT_ERROR, EXIT_INPUT_REQUIRED, EXIT_OK, wasOutputCancelled, } from './output.js';
 const finishedContexts = new WeakSet();
 export async function finishRun(context, outcome) {
@@ -37,6 +37,10 @@ export function exitCodeForError(error) {
         return EXIT_INPUT_REQUIRED;
     if (error instanceof CliCancellationError)
         return EXIT_CANCELLED;
+    // An access problem (missing org / insufficient role) is a hard failure,
+    // never auth-required — it stays EXIT_ERROR (the default), made explicit here.
+    if (error instanceof CliAccessError)
+        return EXIT_ERROR;
     return EXIT_ERROR;
 }
 function exitCodeForOutcome(outcome) {

package/dist/init/index.js

@@ -44,8 +44,13 @@ export async function runInit(flags, options = {}) {
     emit('welcome', 'Onboarding this project as a Moda agent harness.', 'completed');
     phases.push({ id: 'welcome', title: 'Welcome', status: 'completed' });
     // Step 2: Authentication
+    // Every auth touchpoint below (cached-token check, browser login, tenant
+    // setup) must share the same --profile context, or `moda init --profile X`
+    // logs in / stores under the default profile while the rest of init reads
+    // from X — the session then looks unauthenticated or uses the wrong key.
+    const profile = stringFlag(flags.profile);
     log(renderInitStep(2, 7, 'Authentication'));
-    let token = loadToken();
+    let token = loadToken({ profile });
     if (!token) {
         if (json || agent) {
             throw new CliAuthError('Browser authentication is required before non-interactive init can continue.', {
@@ -66,7 +71,7 @@ export async function runInit(flags, options = {}) {
         }
         log(renderInitNote(`Opening browser to ${action === 'signup' ? 'sign up' : 'log in'}...`, 'warning'));
         emit('auth', `Opening browser to ${action}.`);
-        token = await login(action);
+        token = await login(action, { profile });
         log(renderInitNote('Authentication successful'));
     }
     else {
@@ -77,11 +82,17 @@ export async function runInit(flags, options = {}) {
     // Step 3: Tenant + API Key
     log(renderInitStep(3, 7, 'Workspace & Profile'));
     emit('workspace', 'Selecting workspace and creating API key.');
+    // --tenant-id flag wins over MODA_TENANT_ID; the source drives the
+    // env-shadow warning so we don't warn when the env var was the selection.
+    const tenantIdFlag = stringFlag(flagValue(flags, 'tenant-id', 'tenant_id'));
+    const tenantIdEnv = process.env.MODA_TENANT_ID;
     const { apiKey, tenantName } = await selectTenantAndCreateKey({
-        tenantId: stringFlag(flagValue(flags, 'tenant-id', 'tenant_id')),
+        tenantId: tenantIdFlag ?? tenantIdEnv,
+        tenantIdSource: tenantIdFlag ? 'flag' : tenantIdEnv ? 'env' : undefined,
         nonInteractive: json || agent,
         silent: !human,
         resumeCommand: ['moda', 'init', ...resumeFlagsForInit(flags)],
+        profile,
     });
     log(renderInitNote(`Active workspace: ${tenantName}`));
     emit('workspace', `Active workspace: ${tenantName}`, 'completed');

package/dist/init/tenant.d.ts

@@ -4,11 +4,25 @@ interface BootstrapResult {
     tenantName: string;
     tenantSlug: string;
 }
-export declare function selectTenantAndCreateKey(options?: {
+export interface SelectTenantAndCreateKeyOptions {
+    /** Tenant id preselected via --tenant-id (flag) or MODA_TENANT_ID (env). */
     tenantId?: string;
+    /** Where the preselected tenant id came from; drives the env-shadow warning. */
+    tenantIdSource?: 'flag' | 'env';
+    /** Non-interactive runs must never open the selection prompt. */
     nonInteractive?: boolean;
+    /** Suppress human prose so it never interleaves with JSON envelopes on stdout. */
     silent?: boolean;
+    /** Resume command echoed into the needs_input event for multi-tenant runs. */
     resumeCommand?: string[];
-}): Promise<BootstrapResult>;
+    /**
+     * Profile context (--profile) threaded from init: scopes the auth-session
+     * reads and request origin behind authFetch, the stored-key candidate
+     * lookup, and the liveness-probe base URL to the given profile.
+     */
+    profile?: string;
+    env?: NodeJS.ProcessEnv;
+}
+export declare function selectTenantAndCreateKey(options?: SelectTenantAndCreateKeyOptions): Promise<BootstrapResult>;
 export {};
 //# sourceMappingURL=tenant.d.ts.map