@moda-ai/cli 1.17.0 → 1.17.2

package/dist/profile-commands.js

@@ -1,7 +1,7 @@
 import { authFetch, clearAuthSession, isAuthSessionValid, loadAuthSession, login, revokeCliSessionToken, } from './auth.js';
 import { EXIT_AUTH_REQUIRED, EXIT_OK } from './output.js';
 import { KEY_LIFECYCLE_ENDPOINT_REQUIREMENTS, createLocalKeyDescriptor, loadLocalKeyDescriptors, upsertLocalKeyDescriptor, writeLocalApiKeySecret, } from './keys.js';
-import { DEFAULT_INGEST_URL, PROD_BASE_URL, ensureSecretFilePermissions, getActiveProfile, getModaPaths, loadProfileConfig, resolveApiKeyFromActiveProfile, resolveSecretReference, secretFilePathFromRef, setActiveProfile, upsertProfile, } from './profiles.js';
+import { DEFAULT_INGEST_URL, PROD_BASE_URL, clearStoredApiKeyCredentials, ensureSecretFilePermissions, getActiveProfile, getModaPaths, loadProfileConfig, resolveApiKeyFromActiveProfile, resolveSecretReference, secretFilePathFromRef, setActiveProfile, upsertProfile, } from './profiles.js';
 import { CliInputError } from './errors.js';
 // Bound the `auth status --online` probe: without a signal, undici's defaults
 // can stall a status check for minutes on a black-holed connection.
@@ -77,9 +77,21 @@ export async function runAuthCommand(context) {
             // auth0-kind sessions have nothing to revoke.
             await revokeCliSessionToken({ profile: context.profile, env: context.env });
             clearAuthSession({ profile: context.profile, env: context.env });
+            // The session token is only the control-plane credential. Data commands
+            // authenticate with the moda_sk_ API key written by `moda init`
+            // (~/.moda/config.json + profile api_key_ref), so logout must clear it
+            // too or the next login keeps acting as the old tenant.
+            const apiKeyCleared = clearStoredApiKeyCredentials({
+                profile: context.profile,
+                env: context.env,
+            });
+            if (context.env.MODA_API_KEY) {
+                console.error('Note: MODA_API_KEY is set in the environment and still takes precedence. Unset it to fully sign out.');
+            }
             context.output.writeData({
                 status: 'logged_out',
                 profile: context.profile ?? process.env.MODA_PROFILE ?? null,
+                api_key_cleared: apiKeyCleared,
             });
             return { exitCode: 0 };
         }

package/dist/profiles.d.ts

@@ -80,6 +80,20 @@ export declare function getActiveProfile(options?: ProfileIOOptions): ModaProfil
 export declare function setActiveProfile(name: string, options?: ProfileIOOptions): ProfileConfig;
 export declare function upsertProfile(profile: ModaProfile, options?: ProfileIOOptions): ProfileConfig;
 export declare function syncLegacyConfigToProfile(legacy: LegacyCliConfig, options?: ProfileIOOptions): ProfileConfig;
+/**
+ * Forget the stored data-plane credentials (`moda_sk_` API key + tenant
+ * binding written by `moda init`): the legacy config's api_key/tenant_id and
+ * the target profile's api_key_ref/tenant_id, deleting `file:` key secrets
+ * under ~/.moda. Called by `moda auth logout` — without this, analytics
+ * commands keep authenticating as the old tenant after a re-login, because
+ * they use the x-api-key plane, not the session token. MODA_API_KEY in the
+ * environment still wins at resolve time.
+ *
+ * The legacy config must be cleared BEFORE reading the profile config:
+ * applyLegacyAwareness re-derives api_key_ref onto the prod profile on every
+ * load while config.json still holds an api_key.
+ */
+export declare function clearStoredApiKeyCredentials(options?: ProfileIOOptions): boolean;
 export declare function secretFilePathFromRef(reference: SecretReference, options?: ProfileIOOptions): string | undefined;
 export declare function resolveSecretReference(reference: SecretReference | undefined, options?: ProfileIOOptions): string | undefined;
 export declare function resolveApiKeyFromActiveProfile(options?: ProfileIOOptions): string | undefined;

package/dist/profiles.js

@@ -1,4 +1,4 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync, } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, normalize, relative } from 'node:path';
 export const PROFILE_CONFIG_VERSION = 1;
@@ -347,6 +347,44 @@ export function syncLegacyConfigToProfile(legacy, options = {}) {
         },
     }, options);
 }
+/**
+ * Forget the stored data-plane credentials (`moda_sk_` API key + tenant
+ * binding written by `moda init`): the legacy config's api_key/tenant_id and
+ * the target profile's api_key_ref/tenant_id, deleting `file:` key secrets
+ * under ~/.moda. Called by `moda auth logout` — without this, analytics
+ * commands keep authenticating as the old tenant after a re-login, because
+ * they use the x-api-key plane, not the session token. MODA_API_KEY in the
+ * environment still wins at resolve time.
+ *
+ * The legacy config must be cleared BEFORE reading the profile config:
+ * applyLegacyAwareness re-derives api_key_ref onto the prod profile on every
+ * load while config.json still holds an api_key.
+ */
+export function clearStoredApiKeyCredentials(options = {}) {
+    let cleared = false;
+    const paths = getModaPaths(options);
+    const legacy = loadLegacyCliConfig(options);
+    if (legacy.api_key || legacy.tenant_id) {
+        writeSecretJsonFile(paths.legacyConfigPath, legacy.ingest_url ? { ingest_url: legacy.ingest_url } : {});
+        cleared = true;
+    }
+    const config = loadProfileConfig(options);
+    const profileName = options.profile ||
+        optionalString(getEnv(options).MODA_PROFILE) ||
+        config.active_profile;
+    const profile = config.profiles[profileName];
+    if (profile && (profile.api_key_ref || profile.tenant_id)) {
+        if (profile.api_key_ref?.startsWith('file:')) {
+            const secretPath = resolveFileSecretPath(profile.api_key_ref, options);
+            if (secretPath)
+                rmSync(secretPath, { force: true });
+        }
+        const { api_key_ref: _key, tenant_id: _tenant, ...rest } = profile;
+        saveProfileConfig({ ...config, profiles: { ...config.profiles, [profileName]: rest } }, options);
+        cleared = true;
+    }
+    return cleared;
+}
 function resolveFileSecretPath(reference, options) {
     if (!reference.startsWith('file:'))
         return undefined;

package/dist/prompts-propose.d.ts

@@ -0,0 +1,10 @@
+import type { CommandContext } from './command-context.js';
+import type { ProfileIOOptions } from './profiles.js';
+/**
+ * `moda prompts propose` — turn a `prompts ab` run's failures into a revised
+ * candidate registered as a new (unlabeled) prompt version. Does NOT promote:
+ * the operator gates the candidate with a fresh `prompts ab` (ideally on the
+ * printed holdout cases the revision never saw) and promotes only if it wins.
+ */
+export declare function runPromptPropose(positionals: string[], flags: Record<string, string>, profileOptions: ProfileIOOptions, context: CommandContext): Promise<void>;
+//# sourceMappingURL=prompts-propose.d.ts.map

package/dist/prompts-propose.js

@@ -0,0 +1,76 @@
+import { writeFileSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { callControlAPI } from './api-client.js';
+import { validateConfig } from './config.js';
+// Propose is a single OpenRouter revision behind the backend; give it room.
+const PROPOSE_TIMEOUT_MS = 300_000;
+/**
+ * `moda prompts propose` — turn a `prompts ab` run's failures into a revised
+ * candidate registered as a new (unlabeled) prompt version. Does NOT promote:
+ * the operator gates the candidate with a fresh `prompts ab` (ideally on the
+ * printed holdout cases the revision never saw) and promotes only if it wins.
+ */
+export async function runPromptPropose(positionals, flags, profileOptions, context) {
+    validateConfig();
+    const promptKey = flags['prompt-key'] || positionals[1];
+    const fromRunId = flags['from-run'] || flags['from-run-id'] || flags['run-id'];
+    const replaySetId = flags['set-id'] || flags['replay-set-id'];
+    if (!promptKey || !fromRunId || !replaySetId) {
+        throw new Error('Usage: moda prompts propose --prompt-key=<key> --from-run=<run_id> --set-id=<replay_set_id> [--max-dossiers=8] [--out=path.prompt.md]');
+    }
+    const maxDossiers = parsePositiveInt(flags['max-dossiers'], 8, 16);
+    const result = (await callControlAPI(`/prompts/${encodeURIComponent(promptKey)}/propose`, { method: 'POST', body: JSON.stringify({ fromRunId, replaySetId, maxDossiers }) }, profileOptions, { timeoutMs: PROPOSE_TIMEOUT_MS, retries: 0 }));
+    let outPath;
+    if (result.status === 'proposed' && result.content && flags.out) {
+        outPath = isAbsolute(flags.out) ? flags.out : resolve(process.cwd(), flags.out);
+        writeFileSync(outPath, result.content, 'utf8');
+    }
+    if (context.outputMode === 'human') {
+        printHuman(result, outPath);
+    }
+    context.output.writeData(outPath ? { ...result, outPath } : result);
+}
+function printHuman(result, outPath) {
+    const w = (s) => process.stderr.write(s + '\n');
+    if (result.status !== 'proposed') {
+        w(`No candidate produced (${result.status}): ${result.note}`);
+        return;
+    }
+    w(`Proposed candidate for '${result.promptKey}'`);
+    w(`  new version:  ${result.versionId}  (unlabeled — not promoted)`);
+    w(`  base version: ${result.baseVersionId ?? '(none)'}`);
+    w(`  from run:     built from ${result.dossierCount} failure dossier(s)`);
+    if (result.changelog)
+        w(`  changelog:    ${result.changelog}`);
+    if (result.risks.length)
+        w(`  risks:        ${result.risks.map((r) => `- ${r}`).join('\n                ')}`);
+    if (outPath)
+        w(`  written to:   ${outPath}`);
+    w('');
+    w('Next — gate on holdout cases the revision never saw, then promote if it wins:');
+    if (result.holdoutCaseIds.length) {
+        w(`  holdout cases (${result.holdoutCaseIds.length}): ${result.holdoutCaseIds.join(', ')}`);
+    }
+    else {
+        w('  (too few failures to reserve a holdout — gate on a fresh --auto-generate set)');
+    }
+    if (outPath) {
+        // The candidate lives only in the registry as an unlabeled version; `prompts ab`
+        // resolves --candidate from local file content, so point it at the written --out
+        // file. Using --candidate-key=<key> would resolve to the baseline and compare the
+        // prompt against itself.
+        w(`  moda prompts ab --baseline-key=${result.promptKey} --candidate=${outPath} --auto-generate`);
+    }
+    else {
+        w(`  # re-run with --out=<path.prompt.md> to materialize the candidate, then:`);
+        w(`  moda prompts ab --baseline-key=${result.promptKey} --candidate=<path.prompt.md> --auto-generate`);
+    }
+    w(`  moda prompts promote ${result.promptKey} --label=prod --version=${result.versionId}`);
+}
+function parsePositiveInt(raw, fallback, max) {
+    const n = Number.parseInt(raw ?? '', 10);
+    if (!Number.isFinite(n) || n <= 0)
+        return fallback;
+    return Math.min(n, max);
+}
+//# sourceMappingURL=prompts-propose.js.map

package/dist/prompts.js

@@ -5,6 +5,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { callControlAPI } from './api-client.js';
 import { createCommandContext } from './command-context.js';
 import { runPromptAb } from './prompts-ab.js';
+import { runPromptPropose } from './prompts-propose.js';
 const MODA_DIR = '.moda';
 const MANIFEST_PATH = join(MODA_DIR, 'prompts.yml');
 const LOCK_PATH = join(MODA_DIR, 'prompts.lock.json');
@@ -55,8 +56,11 @@ export async function runPromptsCommand(input, legacyFlags, legacyProfileOptions
         case 'ab':
             await runPromptAb(flags, profileOptions, context);
             break;
+        case 'propose':
+            await runPromptPropose(positionals, flags, profileOptions, context);
+            break;
         default:
-            throw new Error(`Unknown prompts command '${subcommand}'. Use init, status, diff, sync, promote, or ab.`);
+            throw new Error(`Unknown prompts command '${subcommand}'. Use init, status, diff, sync, promote, ab, or propose.`);
     }
 }
 export async function initPrompts(options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.17.0",
+  "version": "1.17.2",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-08T22:14:49.889Z",
-  "cli_version": "1.17.0",
+  "bundled_at": "2026-07-09T02:37:26.434Z",
+  "cli_version": "1.17.2",
   "skills": [
     {
       "id": "integration-node-anthropic",