@moda-ai/cli 1.13.7 → 1.13.9

package/dist/auth.d.ts

@@ -2,6 +2,17 @@ import { type ProfileIOOptions } from './profiles.js';
 import { type AuthSessionOptions } from './auth-storage.js';
 export { clearAuthSession, isAuthSessionValid, loadAuthSession, loadToken, saveAuthSession, type AuthSessionOptions, type StoredAuth, type StoredAuthTokenKind, } from './auth-storage.js';
 export { revokeCliSessionToken } from './cli-session.js';
+/** Default wait for browser Auth0/consent during `moda auth login` / init. */
+export declare const DEFAULT_AUTH_TIMEOUT_MS = 600000;
+/**
+ * Resolve the browser-auth wait. Explicit LoginOptions.timeoutMs wins;
+ * otherwise MODA_AUTH_TIMEOUT_MS (clamped); otherwise a 10-minute default that
+ * covers real Auth0 + MFA + slow consent without abandoning mid-login.
+ */
+export declare function resolveAuthTimeoutMs(options?: {
+    timeoutMs?: number;
+    env?: NodeJS.ProcessEnv;
+}): number;
 /** base64url(sha256(verifier)) — the S256 code challenge for a verifier. */
 export declare function computePkceChallenge(codeVerifier: string): string;
 export interface CliLoginContext {
@@ -20,6 +31,11 @@ export declare function getCachedLoginContext(options?: ProfileIOOptions): CliLo
 export interface LoginOptions extends ProfileIOOptions {
     /** Use this exact port for the localhost callback (no fallback ladder). */
     callbackPort?: number;
+    /**
+     * Explicit browser-auth wait in ms. Unlike `MODA_AUTH_TIMEOUT_MS` (clamped
+     * 30s–30m), an explicit value bypasses that clamp (only floored at 1ms) so
+     * programmatic/test callers can set very short or very long waits.
+     */
     timeoutMs?: number;
     openUrl?: (url: string) => Promise<void>;
     /**

package/dist/auth.js

@@ -20,10 +20,33 @@ const CALLBACK_PORT = 8432;
 // callback redirect is port-parameterized, so any of these works as long as
 // the auth URL carries the port that actually got bound.
 const CALLBACK_PORT_LADDER = [CALLBACK_PORT, 8433, 8434, 8435];
-const AUTH_TIMEOUT_MS = 120_000;
+/** Default wait for browser Auth0/consent during `moda auth login` / init. */
+export const DEFAULT_AUTH_TIMEOUT_MS = 600_000;
+/** Floor / ceiling for MODA_AUTH_TIMEOUT_MS (30s .. 30m). */
+const AUTH_TIMEOUT_MIN_MS = 30_000;
+const AUTH_TIMEOUT_MAX_MS = 30 * 60_000;
 const DEFAULT_EXPIRES_IN_SECONDS = 86_400;
 // PKCE code exchange against {base}/api/cli/auth/exchange.
 const EXCHANGE_TIMEOUT_MS = 10_000;
+/**
+ * Resolve the browser-auth wait. Explicit LoginOptions.timeoutMs wins;
+ * otherwise MODA_AUTH_TIMEOUT_MS (clamped); otherwise a 10-minute default that
+ * covers real Auth0 + MFA + slow consent without abandoning mid-login.
+ */
+export function resolveAuthTimeoutMs(options = {}) {
+    if (typeof options.timeoutMs === 'number' && Number.isFinite(options.timeoutMs)) {
+        return Math.max(1, Math.floor(options.timeoutMs));
+    }
+    const env = options.env ?? process.env;
+    const raw = env.MODA_AUTH_TIMEOUT_MS?.trim();
+    if (raw) {
+        const parsed = Number.parseInt(raw, 10);
+        if (Number.isFinite(parsed) && parsed > 0) {
+            return Math.min(AUTH_TIMEOUT_MAX_MS, Math.max(AUTH_TIMEOUT_MIN_MS, parsed));
+        }
+    }
+    return DEFAULT_AUTH_TIMEOUT_MS;
+}
 function escapeHtml(value) {
     return value
         .replace(/&/g, '&')
@@ -209,7 +232,7 @@ export async function login(screen = 'login', options = {}) {
                             // flips. The flag only needs to clear on failure, where a
                             // retry paste is still legitimate.
                             res.writeHead(302, {
-                                Location: `${resolveModaBaseUrl()}/auth/cli/done?status=success`,
+                                Location: `${resolveModaBaseUrl(storageOptions)}/auth/cli/done?status=success`,
                                 Connection: 'close',
                             });
                             res.end(() => {
@@ -220,7 +243,7 @@ export async function login(screen = 'login', options = {}) {
                             exchangeInFlight = false;
                             const error = err instanceof Error ? err : new Error(String(err));
                             res.writeHead(302, {
-                                Location: `${resolveModaBaseUrl()}/auth/cli/done` +
+                                Location: `${resolveModaBaseUrl(storageOptions)}/auth/cli/done` +
                                     `?status=error&reason=${exchangeFailureReason(err)}`,
                                 Connection: 'close',
                             });
@@ -538,7 +561,7 @@ export async function login(screen = 'login', options = {}) {
         }
         timeout = setTimeout(() => {
             fail(new Error('Authentication timed out. Please try again.'));
-        }, options.timeoutMs ?? AUTH_TIMEOUT_MS);
+        }, resolveAuthTimeoutMs({ timeoutMs: options.timeoutMs, env: options.env }));
         server.on('error', (err) => {
             if (settled)
                 return;

package/dist/doctor.js

@@ -7,7 +7,7 @@ import { isAuthSessionValid, loadAuthSession } from './auth.js';
 import { resolveApiKey, resolveIngestUrl, resolveModaBaseUrl, resolveTenantId } from './config.js';
 import { readHarnessSyncState, scanHarness } from './harness.js';
 import { HARNESS_REPORT_APPROVAL_PATH, HARNESS_REPORT_APPROVAL_SCHEMA_VERSION, HARNESS_REPORT_PATH, hashHarnessReport, readHarnessReport, validateHarnessReport, } from './harness-report.js';
-import { ensureSecretFilePermissions, getActiveProfile, getModaPaths, loadProfileConfig, resolveSecretReference, secretFilePathFromRef, } from './profiles.js';
+import { ensureSecretFilePermissions, getActiveProfile, getModaPaths, isLoopbackBaseUrl, loadProfileConfig, resolveSecretReference, secretFilePathFromRef, } from './profiles.js';
 import { renderDoctorHuman, renderStatusHuman } from './tui.js';
 export async function runDoctorCommand(context) {
     const report = await buildDoctorReport(context, {
@@ -132,6 +132,7 @@ export async function buildDoctorReport(context, options) {
     }
     checks.push(urlCheck('base_url_valid', 'config', 'Base URL is valid', baseUrl));
     checks.push(urlCheck('ingest_url_valid', 'config', 'Ingest URL is valid', ingestUrl));
+    checks.push(localBaseUrlCheck(activeProfile.environment, baseUrl));
     const manifestPath = join(context.cwd, '.moda', 'harness.json');
     const manifestExists = existsSync(manifestPath);
     checks.push({
@@ -287,6 +288,82 @@ function urlCheck(id, group, title, value) {
         nextCommand: valid ? undefined : 'moda profiles create',
     };
 }
+/**
+ * Local stacks mount `/auth/cli` and `/api/*` CLI/control proxies on the
+ * frontend (`:3000` by default). Pointing `base_url` at the backend (`:3001`)
+ * breaks browser login even though some Nest routes still answer there.
+ */
+function localBaseUrlCheck(environment, baseUrl) {
+    // Only the `local` profile targets a loopback worktree stack. `dev` defaults to
+    // remote `https://moda.dev`, so including it here warns valid remote configs.
+    if (environment !== 'local') {
+        return {
+            id: 'local_base_url_frontend',
+            group: 'config',
+            title: 'Local base URL targets the frontend',
+            status: 'skipped',
+            severity: 'info',
+            evidence: [{ label: 'environment', value: environment }],
+        };
+    }
+    let port = null;
+    let loopback = false;
+    try {
+        const parsed = new URL(baseUrl);
+        loopback = isLoopbackBaseUrl(baseUrl);
+        port = parsed.port || (parsed.protocol === 'https:' ? '443' : '80');
+    }
+    catch {
+        return {
+            id: 'local_base_url_frontend',
+            group: 'config',
+            title: 'Local base URL targets the frontend',
+            status: 'fail',
+            severity: 'critical',
+            evidence: [{ label: 'base_url', value: baseUrl }],
+            remediation: 'Set the local profile base URL to the frontend origin (http://localhost:3000).',
+            nextCommand: 'moda profiles create local --environment local --base-url http://localhost:3000',
+        };
+    }
+    const looksLikeBackend = loopback && (port === '3001' || port === '3002');
+    if (looksLikeBackend) {
+        return {
+            id: 'local_base_url_frontend',
+            group: 'config',
+            title: 'Local base URL targets the frontend',
+            status: 'warning',
+            severity: 'warning',
+            evidence: [
+                { label: 'base_url', value: baseUrl },
+                { label: 'port', value: port ?? 'unknown' },
+            ],
+            remediation: 'Local CLI auth and control APIs are served by the frontend. ' +
+                'Use http://localhost:3000 (or your worktree frontend port), not the backend :3001.',
+            nextCommand: 'moda profiles create local --environment local --base-url http://localhost:3000 --use',
+        };
+    }
+    if (!loopback) {
+        return {
+            id: 'local_base_url_frontend',
+            group: 'config',
+            title: 'Local base URL targets the frontend',
+            status: 'warning',
+            severity: 'warning',
+            evidence: [{ label: 'base_url', value: baseUrl }],
+            remediation: 'Local profile should use a loopback frontend URL (http://localhost:3000). ' +
+                'Activate with `moda profiles use local` or set MODA_PROFILE=local.',
+            nextCommand: 'moda profiles use local',
+        };
+    }
+    return {
+        id: 'local_base_url_frontend',
+        group: 'config',
+        title: 'Local base URL targets the frontend',
+        status: 'pass',
+        severity: 'info',
+        evidence: [{ label: 'base_url', value: baseUrl }],
+    };
+}
 function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId) {
     if (!manifestExists) {
         return {

package/dist/harness-artifact-bodies.d.ts

@@ -11,6 +11,13 @@ export interface ArtifactBodyFileItem {
     text?: string;
 }
 export declare function extractToolBodyFromText(text: string, toolName: string): string | undefined;
+export declare function annotatedSourceCandidates(sourcePath: string, annotation: ArtifactBodyAnnotation): string[];
+/**
+ * Resolve an annotated artifact `path=` to a repo-relative sourcePath.
+ * Prefer the nested annotation-relative file when present so later whole-file
+ * hydration and content hashing look in the right place.
+ */
+export declare function resolveAnnotatedSourcePath(sourcePath: string, annotation: ArtifactBodyAnnotation): string;
 export declare function readPromptOrToolBody(type: HarnessArtifactType, sourcePath: string, annotation: ArtifactBodyAnnotation): string | undefined;
 export declare function extractToolBody(file: ArtifactBodyFileItem, tool: {
     name: string;

package/dist/harness-artifact-bodies.js

@@ -26,6 +26,21 @@ function isSecretishPath(path) {
 function isOutsideRoot(rel) {
     return rel === '' || rel === '..' || rel.startsWith('../') || isAbsolute(rel);
 }
+/** Walk from `fromAbs` up to `rootAbs` (inclusive), bounded by `maxDepth`. */
+function walkAncestorDirs(fromAbs, rootAbs, maxDepth = 8) {
+    const dirs = [];
+    let cursor = fromAbs;
+    for (let depth = 0; depth < maxDepth; depth += 1) {
+        dirs.push(cursor);
+        if (normalizePath(cursor) === normalizePath(rootAbs))
+            break;
+        const parent = dirname(cursor);
+        if (parent === cursor)
+            break;
+        cursor = parent;
+    }
+    return dirs;
+}
 function readBoundedRepoText(absPath, rootDir) {
     if (!existsSync(absPath))
         return undefined;
@@ -113,18 +128,31 @@ export function extractToolBodyFromText(text, toolName) {
     }
     return undefined;
 }
-function readAnnotatedSourceText(sourcePath, annotation) {
+export function annotatedSourceCandidates(sourcePath, annotation) {
     const explicitSourcePath = normalizePath(sourcePath) !== normalizePath(annotation.evidence.path);
-    const candidates = explicitSourcePath ? [
-        resolve(annotation.rootDir, sourcePath),
-        resolve(dirname(annotation.sourceAbsPath), sourcePath),
-    ] : [
-        resolve(annotation.rootDir, sourcePath),
-        resolve(dirname(annotation.sourceAbsPath), sourcePath),
-        annotation.sourceAbsPath,
-    ];
+    // Relative `path=` annotations in nested packages usually mean "relative to the
+    // package/harness root that owns the annotated file", not the file's own directory.
+    // Example: harnesses/boardy-ops/src/ops.ts with path=prompts/ops-system.prompt.md
+    // resolves to harnesses/boardy-ops/prompts/ops-system.prompt.md (one level up from
+    // src/), not harnesses/boardy-ops/src/prompts/... Walk parents between the
+    // annotated file and the scan root, then fall back to the scan-root candidate
+    // for flat repos that annotate from the repository root.
+    if (!explicitSourcePath) {
+        return [
+            resolve(annotation.rootDir, sourcePath),
+            resolve(dirname(annotation.sourceAbsPath), sourcePath),
+            annotation.sourceAbsPath,
+        ];
+    }
+    const rootAbs = resolve(annotation.rootDir);
+    const candidates = walkAncestorDirs(dirname(annotation.sourceAbsPath), rootAbs)
+        .map((dir) => resolve(dir, sourcePath));
+    candidates.push(resolve(annotation.rootDir, sourcePath));
+    return candidates;
+}
+function readAnnotatedSourceText(sourcePath, annotation) {
     const seen = new Set();
-    for (const candidate of candidates) {
+    for (const candidate of annotatedSourceCandidates(sourcePath, annotation)) {
         if (seen.has(candidate))
             continue;
         seen.add(candidate);
@@ -134,6 +162,25 @@ function readAnnotatedSourceText(sourcePath, annotation) {
     }
     return undefined;
 }
+/**
+ * Resolve an annotated artifact `path=` to a repo-relative sourcePath.
+ * Prefer the nested annotation-relative file when present so later whole-file
+ * hydration and content hashing look in the right place.
+ */
+export function resolveAnnotatedSourcePath(sourcePath, annotation) {
+    const seen = new Set();
+    for (const candidate of annotatedSourceCandidates(sourcePath, annotation)) {
+        if (seen.has(candidate))
+            continue;
+        seen.add(candidate);
+        if (readBoundedRepoText(candidate, annotation.rootDir) === undefined)
+            continue;
+        const rel = normalizePath(relative(annotation.rootDir, candidate));
+        if (!isOutsideRoot(rel))
+            return rel;
+    }
+    return sourcePath;
+}
 export function readPromptOrToolBody(type, sourcePath, annotation) {
     if (!requiresArtifactBody(type))
         return undefined;
@@ -154,7 +201,8 @@ export function extractToolBody(file, tool) {
 }
 function hydrateArtifactBody(artifact, rootDir) {
     if (artifact.sourcePath) {
-        const wholeFile = readRepoRelativeText(rootDir, artifact.sourcePath);
+        const wholeFile = readRepoRelativeText(rootDir, artifact.sourcePath)
+            ?? readSourcePathRelativeToEvidence(artifact, rootDir);
         if (wholeFile !== undefined) {
             if (artifact.type === 'prompt' || isDedicatedToolFilePath(artifact.sourcePath)) {
                 return wholeFile;
@@ -174,6 +222,25 @@ function hydrateArtifactBody(artifact, rootDir) {
     }
     return undefined;
 }
+/**
+ * Fallback for nested relative `sourcePath` values that were recorded before the
+ * annotation-relative resolver existed: walk parent dirs beside the evidence file
+ * looking for the package-local prompt/tool path.
+ */
+function readSourcePathRelativeToEvidence(artifact, rootDir) {
+    if (!artifact.sourcePath)
+        return undefined;
+    const evidencePath = firstEvidencePath(artifact);
+    if (!evidencePath)
+        return undefined;
+    const rootAbs = resolve(rootDir);
+    for (const dir of walkAncestorDirs(dirname(resolve(rootDir, evidencePath)), rootAbs)) {
+        const text = readBoundedRepoText(resolve(dir, artifact.sourcePath), rootDir);
+        if (text !== undefined)
+            return text;
+    }
+    return undefined;
+}
 export function hydratePromptAndToolBodies(graph, rootDir) {
     for (const artifact of graph.artifacts) {
         if (!requiresArtifactBody(artifact.type) || artifactHasBody(artifact)) {

package/dist/harness.d.ts

@@ -273,6 +273,12 @@ export declare function emitWrittenArtifacts(context: CommandContext, written: s
 export declare function repairExternalAnalystReport(report: HarnessReport, rootDir: string): HarnessReport;
 export declare function sleep(ms: number): Promise<void>;
 export declare function summarizeInvalidAnalystReport(report: unknown): Record<string, unknown>;
+/**
+ * The analyst spellings that select the deterministic local scanner (no LLM,
+ * no remote analyze). Shared by `normalizeAnalystAdapter` and `moda init`'s
+ * `resolveHarnessRemote` so the set cannot drift between the two.
+ */
+export declare function isDeterministicLocalAnalyst(raw: string | undefined): boolean;
 export type CodingAgentAdapter = ExternalHarnessAnalystAdapter;
 export interface CodingAgentRun {
     adapter: CodingAgentAdapter;

package/dist/harness.js

@@ -10,7 +10,7 @@ import { resolveApiKey, resolveTenantId } from './config.js';
 import { CliInputError, CliInputRequiredError } from './errors.js';
 import { isRemoteHarnessAnalyze, runRemoteHarnessAnalyst } from './harness-remote.js';
 import { getActiveProfile } from './profiles.js';
-import { enrichScanCaptureMetadata, extractToolBody, hydratePromptAndToolBodies, readPromptOrToolBody, } from './harness-artifact-bodies.js';
+import { enrichScanCaptureMetadata, annotatedSourceCandidates, extractToolBody, hydratePromptAndToolBodies, readPromptOrToolBody, resolveAnnotatedSourcePath, } from './harness-artifact-bodies.js';
 import { approveHarnessReport, createHarnessReport, graphForReport, hashHarnessReport, hashStableJson as hashHarnessReportStableJson, HARNESS_REPORT_PATH, loadHarnessReportForSync, normalizeHarnessReport, readHarnessReport, resolveHarnessReportPath, validateHarnessReport, writeHarnessReportArtifacts, } from './harness-report.js';
 import { assertHarnessGraphSyncSize } from './harness-sync-limits.js';
 import { renderHarnessAnalystChoice, renderHarnessAnalystLaunch, renderHarnessAnalystPreflight, renderHarnessAnalyzeHumanResult, renderHarnessProgress, } from './tui.js';
@@ -1201,6 +1201,15 @@ function shouldPromptForHarnessAnalyst(context) {
         !context.flags['analyst-command'] &&
         !process.env.MODA_HARNESS_ANALYST_COMMAND;
 }
+/**
+ * The analyst spellings that select the deterministic local scanner (no LLM,
+ * no remote analyze). Shared by `normalizeAnalystAdapter` and `moda init`'s
+ * `resolveHarnessRemote` so the set cannot drift between the two.
+ */
+export function isDeterministicLocalAnalyst(raw) {
+    const value = raw?.trim().toLowerCase();
+    return value === 'local-scan' || value === 'local' || value === 'scripted' || value === 'moda';
+}
 function normalizeAnalystAdapter(raw) {
     const value = (raw && raw !== 'true' ? raw : 'auto').trim().toLowerCase();
     if (value === 'auto')
@@ -1211,7 +1220,7 @@ function normalizeAnalystAdapter(raw) {
         return 'codex';
     if (value === 'cursor' || value === 'cursor-cli' || value === 'cursor_cli')
         return 'cursor';
-    if (value === 'local-scan' || value === 'local' || value === 'scripted' || value === 'moda')
+    if (isDeterministicLocalAnalyst(value))
         return 'local-scan';
     throw new CliInputError(`Unknown harness analyst '${raw}'.`, 'Use `--analyst=claude|codex|cursor|local-scan`.');
 }
@@ -2439,9 +2448,17 @@ function channelFromAnnotation(annotation) {
 function artifactFromAnnotation(annotation) {
     const values = annotation.values;
     const type = artifactType(first(values.kind) ?? first(values.type));
-    const sourcePath = first(values.path) ?? annotation.evidence.path;
+    const annotatedPath = first(values.path) ?? annotation.evidence.path;
+    // Canonicalize nested relative path= annotations to a repo-relative location
+    // so later whole-file body hydration and hashing find the real prompt/tool file.
+    const sourcePath = resolveAnnotatedSourcePath(annotatedPath, annotation);
     const id = first(values.id) ?? stableId(type, first(values.name) ?? sourcePath);
-    const body = readPromptOrToolBody(type, sourcePath, annotation);
+    // Body reads from the RAW annotated path on purpose: readPromptOrToolBody walks
+    // the annotation's ancestor dirs itself to locate nested-package files, so it
+    // must not be handed the already-canonicalized sourcePath. sourcePath and
+    // contentHash use the canonical path so downstream whole-file hydration and
+    // hashing resolve the same file the body came from.
+    const body = readPromptOrToolBody(type, annotatedPath, annotation);
     return {
         id,
         type,
@@ -3420,14 +3437,13 @@ function upsertDeployment(graph, next) {
     existing.environmentId = existing.environmentId ?? next.environmentId;
 }
 function contentHashForAnnotatedSource(sourcePath, annotation) {
-    const explicitSourcePath = normalizePath(sourcePath) !== normalizePath(annotation.evidence.path);
-    const candidates = explicitSourcePath ? [
-        resolve(annotation.rootDir, sourcePath),
-        resolve(dirname(annotation.sourceAbsPath), sourcePath),
-    ] : [
-        resolve(annotation.rootDir, sourcePath),
-        resolve(dirname(annotation.sourceAbsPath), sourcePath),
-        annotation.sourceAbsPath,
+    // Reuse the annotation-relative candidate resolver; prefer the canonicalized
+    // repo-relative path first so hashing matches hydrated artifact bodies.
+    const bodyAnnotation = annotation;
+    const rootCandidate = resolve(annotation.rootDir, sourcePath);
+    const candidates = [
+        rootCandidate,
+        ...annotatedSourceCandidates(sourcePath, bodyAnnotation).filter((c) => c !== rootCandidate),
     ];
     const seen = new Set();
     for (const candidate of candidates) {

package/dist/init/index.d.ts

@@ -30,8 +30,9 @@ export interface InitRunOptions {
 export declare function runInit(flags: Record<string, unknown>, options?: InitRunOptions): Promise<InitResult>;
 /**
  * Onboarding runs harness discovery SERVER-SIDE by default so the customer
- * needs no local coding agent. Opt out with `--local`, `--no-remote`, or
- * `--remote=false` to use a local coding-agent analyst instead.
+ * needs no local coding agent. Opt out with `--local`, `--no-remote`,
+ * `--remote=false`, or an explicit deterministic local analyst
+ * (`--analyst=local-scan|local|scripted|moda`).
  */
 export declare function resolveHarnessRemote(flags: Record<string, unknown>): boolean;
 //# sourceMappingURL=index.d.ts.map

package/dist/init/index.js

@@ -15,7 +15,7 @@ import { runSdkIntegration } from './sdk-integration.js';
 import { createCommandContext } from '../command-context.js';
 import { VERSION } from '../config.js';
 import { CliAuthError, CliInputError } from '../errors.js';
-import { runHarnessCommand } from '../harness.js';
+import { isDeterministicLocalAnalyst, runHarnessCommand } from '../harness.js';
 import { buildDoctorReport } from '../doctor.js';
 import { renderInitBanner, renderInitComplete, renderInitNote, renderInitSetupPlan, renderInitStep, } from '../tui.js';
 export async function runInit(flags, options = {}) {
@@ -676,8 +676,9 @@ function isTruthyFlag(value) {
 }
 /**
  * Onboarding runs harness discovery SERVER-SIDE by default so the customer
- * needs no local coding agent. Opt out with `--local`, `--no-remote`, or
- * `--remote=false` to use a local coding-agent analyst instead.
+ * needs no local coding agent. Opt out with `--local`, `--no-remote`,
+ * `--remote=false`, or an explicit deterministic local analyst
+ * (`--analyst=local-scan|local|scripted|moda`).
  */
 export function resolveHarnessRemote(flags) {
     if (isTruthyFlag(flagValue(flags, 'local')))
@@ -687,6 +688,13 @@ export function resolveHarnessRemote(flags) {
     const remote = parseOptionalBoolean(flagValue(flags, 'remote'));
     if (remote !== undefined)
         return remote;
+    // Scenarios and users that pin `--analyst=local-scan` mean "run the local
+    // deterministic scanner", not "upload to hosted analyze and poll". Treat that
+    // as an implicit local opt-out so moda-test live/onboarding suites and
+    // developer workflows do not hang waiting on remote analyze.
+    if (isDeterministicLocalAnalyst(stringFlag(flagValue(flags, 'analyst')))) {
+        return false;
+    }
     return true;
 }
 function flagValue(flags, ...keys) {

package/dist/init/tenant.d.ts

@@ -4,6 +4,13 @@ interface BootstrapResult {
     tenantName: string;
     tenantSlug: string;
 }
+/**
+ * Classify a failed /api/cli/context (or bootstrap) response so moda init
+ * distinguishes retryable infra outages (Postgres pool exhaustion → 503
+ * `database_unavailable`) from auth failures. Auth itself can succeed from
+ * a cached moda_ct_ token even when this hydrate call 500s (MODA-742).
+ */
+export declare function formatControlPlaneFetchError(action: string, status: number, body: string): string;
 export interface TenantKeyResult extends BootstrapResult {
     /**
      * True when a previously stored key for the selected tenant passed the

package/dist/init/tenant.js

@@ -8,6 +8,37 @@ import { authFetch, getCachedLoginContext } from '../auth.js';
 import { loadCliConfig, resolveIngestUrl, resolveModaBaseUrl, saveCliConfig, } from '../config.js';
 import { getModaDir, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, writeSecretJsonFile, } from '../profiles.js';
 import { CliAccessError, CliInputError, CliInputRequiredError } from '../errors.js';
+/**
+ * Classify a failed /api/cli/context (or bootstrap) response so moda init
+ * distinguishes retryable infra outages (Postgres pool exhaustion → 503
+ * `database_unavailable`) from auth failures. Auth itself can succeed from
+ * a cached moda_ct_ token even when this hydrate call 500s (MODA-742).
+ */
+export function formatControlPlaneFetchError(action, status, body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        // Non-JSON body — fall through to generic formatting.
+    }
+    const isDbUnavailable = status === 503 &&
+        (parsed?.error === 'database_unavailable' ||
+            parsed?.retryable === true ||
+            /database_unavailable|too many database connections|rds_reserved|connection pool/i.test(body));
+    if (isDbUnavailable) {
+        return (`Failed to ${action} (${status}): Moda control-plane database is temporarily unavailable ` +
+            `(connection pool exhausted). This is not an authentication failure — your session token ` +
+            `is fine. Retry in a few seconds.` +
+            (parsed?.message ? ` (${parsed.message})` : ''));
+    }
+    if (status >= 500 &&
+        /too many database connections|rds_reserved|remaining connection slots/i.test(body)) {
+        return (`Failed to ${action} (${status}): Moda control-plane database ran out of connections. ` +
+            `This is a retryable infra outage, not an auth failure. Retry in a few seconds. Body: ${body}`);
+    }
+    return `Failed to ${action} (${status}): ${body}`;
+}
 // Mirrors the backend's checkAdminAccess: only the viewer role is denied.
 const ADMIN_ACCESS_MESSAGE = 'You need admin or owner access to create API keys.';
 const ADMIN_ACCESS_GUIDANCE = 'Ask your organization owner to upgrade your role.';
@@ -250,7 +281,7 @@ export async function selectTenantAndCreateKey(options = {}) {
         const contextRes = await authFetch('/api/cli/context', {}, authOptions);
         if (!contextRes.ok) {
             const body = await contextRes.text();
-            throw new Error(`Failed to fetch context (${contextRes.status}): ${body}`);
+            throw new Error(formatControlPlaneFetchError('fetch context', contextRes.status, body));
         }
         ctx = (await contextRes.json());
     }
@@ -360,14 +391,15 @@ export async function selectTenantAndCreateKey(options = {}) {
                     'This organization has reached its CLI API key limit.', {
                     // Command-agnostic: this path is shared by `moda init` and
                     // `moda provision`.
-                    guidance: 'Revoke old CLI keys in the dashboard (Settings -> API Keys), then retry.',
+                    guidance: 'Revoke unused "CLI - ..." keys in the dashboard (Settings → API Keys), ' +
+                        'or reuse the existing key already saved in ~/.moda/config.json from a previous moda init / moda provision --save, then retry.',
                 });
             }
             throw new Error(`Failed to create API key (409): ${body}`);
         }
         if (!bootstrapRes.ok) {
             const body = await bootstrapRes.text();
-            throw new Error(`Failed to create API key (${bootstrapRes.status}): ${body}`);
+            throw new Error(formatControlPlaneFetchError('create API key', bootstrapRes.status, body));
         }
         result = (await bootstrapRes.json());
         clearBootstrapIdempotencyKey(selected.id, authOptions);

package/dist/manifest.js

@@ -27,6 +27,7 @@ export function buildManifest(commands) {
             'MODA_TENANT_ID',
             'MODA_PROFILE',
             'MODA_BASE_URL',
+            'MODA_AUTH_TIMEOUT_MS',
             'MODA_HEARTBEAT_MS',
             'MODA_AGENT_MAX_OUTPUT_BYTES',
             'MODA_CLI_TELEMETRY',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.13.7",
+  "version": "1.13.9",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-08T02:33:51.881Z",
-  "cli_version": "1.13.7",
+  "bundled_at": "2026-07-08T05:27:07.614Z",
+  "cli_version": "1.13.9",
   "skills": [
     {
       "id": "integration-node-anthropic",