@moda-ai/cli 1.37.0 → 1.38.0

package/dist/{cli-ert1sbbt.js → cli-3kcy61fr.js}

@@ -24,7 +24,7 @@ import {
 import {
   isAuthSessionValid,
   loadAuthSession
-} from "./cli-strngwn3.js";
+} from "./cli-kegd748v.js";
 import {
   CliInputError,
   createCommandContext,

package/dist/{cli-qgf2cz2v.js → cli-k38j2fpq.js}

@@ -1,7 +1,7 @@
 import {
   authFetch,
   getCachedLoginContext
-} from "./cli-strngwn3.js";
+} from "./cli-kegd748v.js";
 import {
   CliAccessError,
   CliInputError,

package/dist/{cli-strngwn3.js → cli-kegd748v.js}

@@ -328,6 +328,71 @@ function getCachedLoginContext(options = {}) {
     return null;
   return cachedLoginContext.context;
 }
+var MISMATCH_MESSAGE = "The sign-in code is for a different workspace than --tenant-id.";
+var CONNECT_CODE_RE = /^mcc_[A-Za-z0-9_-]{43}$/;
+
+class ConnectCodeError extends Error {
+  reason;
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "ConnectCodeError";
+  }
+}
+async function connectWithCode(code, options = {}) {
+  if (!CONNECT_CODE_RE.test(code)) {
+    throw new ConnectCodeError("That is not a Moda sign-in code. Copy the command from the Moda onboarding page again.", "rejected");
+  }
+  let response;
+  try {
+    response = await fetch(`${resolveModaBaseUrl(options)}/api/cli/auth/connect`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ code, label: hostname(), ...options.tenantId ? { tenant_id: options.tenantId } : {} }),
+      redirect: "manual",
+      signal: AbortSignal.timeout(EXCHANGE_TIMEOUT_MS)
+    });
+  } catch {
+    throw new ConnectCodeError("Could not reach Moda to use the sign-in code.", "unreachable");
+  }
+  if (response.status === 400) {
+    const body = await response.json().catch(() => ({}));
+    if (body.error === "tenant_mismatch") {
+      throw new ConnectCodeError(MISMATCH_MESSAGE, "workspace_mismatch");
+    }
+  }
+  if (response.status === 401 || response.status === 400) {
+    throw new ConnectCodeError("The sign-in code was rejected: it expired (10 minutes) or was already used.", "rejected");
+  }
+  if (!response.ok || response.status >= 300 && response.status < 400) {
+    throw new ConnectCodeError(`Moda could not use the sign-in code (HTTP ${response.status}).`, "failed");
+  }
+  const payload = await response.json().catch(() => ({}));
+  const cliToken = typeof payload.cli_token === "string" ? payload.cli_token : undefined;
+  const expiresAtMs = typeof payload.expires_at === "string" ? Date.parse(payload.expires_at) : NaN;
+  const tenantId = typeof payload.tenant_id === "string" ? payload.tenant_id : undefined;
+  if (!cliToken || !Number.isFinite(expiresAtMs) || !tenantId) {
+    throw new ConnectCodeError("Moda returned an incomplete response for the sign-in code.", "failed");
+  }
+  if (options.tenantId && tenantId !== options.tenantId) {
+    throw new ConnectCodeError(MISMATCH_MESSAGE, "workspace_mismatch");
+  }
+  const userEmail = typeof payload.user?.email === "string" ? payload.user.email : undefined;
+  persistAuthSession({
+    access_token: cliToken,
+    expires_at: Math.floor(expiresAtMs / 1000),
+    profile: resolveStorageProfile(options),
+    token_type: "bearer",
+    token_kind: "moda_ct",
+    ...userEmail ? { user_email: userEmail } : {}
+  }, options);
+  const context = {
+    user: { email: userEmail ?? "", name: typeof payload.user?.name === "string" ? payload.user.name : null },
+    tenants: Array.isArray(payload.tenants) ? payload.tenants : []
+  };
+  cachedLoginContext = { profile: resolveStorageProfile(options), context };
+  return { ...context, tenantId };
+}
 var SUCCESS_HTML = `<!DOCTYPE html>
 <html><body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#fafafa">
 <div style="text-align:center">
@@ -761,4 +826,4 @@ function safeResolveUrl(location, base) {
   }
 }
 
-export { isAuthSessionValid, loadToken, loadAuthSession, clearAuthSession, revokeCliSessionToken, getCachedLoginContext, login, authFetch };
+export { isAuthSessionValid, loadToken, loadAuthSession, clearAuthSession, revokeCliSessionToken, getCachedLoginContext, ConnectCodeError, connectWithCode, login, authFetch };

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   runPromptsCommand,
   runSkillsCommand,
   runStatusCommand
-} from "./cli-ert1sbbt.js";
+} from "./cli-3kcy61fr.js";
 import {
   ApiError,
   HARNESS_REPORT_APPROVAL_PATH,
@@ -38,7 +38,7 @@ import {
   loadAuthSession,
   login,
   revokeCliSessionToken
-} from "./cli-strngwn3.js";
+} from "./cli-kegd748v.js";
 import {
   AGENT_ERROR_CODES,
   CliAccessError,
@@ -5721,6 +5721,8 @@ Init flags:
   --no-sdk-integrate               Skip SDK integration (alias: --no-sdk-guide)
   --verification-id=ID             Tag the SDK integration's test trace with this id
                                    (the onb_ id from the Moda onboarding page)
+  --connect-code=CODE              Sign in with the one-time mcc_ code from the Moda
+                                   onboarding page instead of the browser (10 min, single use)
   --ci-cd                          Create GitHub Actions Moda validation workflow
   --no-ci-cd                       Skip CI/CD workflow creation
   --autosync                       Create GitHub Actions workflow to sync prompts + skills to Moda on push to main
@@ -7084,7 +7086,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result",
     handler: async (context) => {
-      const { runInit } = await import("./index-vmmfya6b.js");
+      const { runInit } = await import("./index-hwfe7gs8.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",
@@ -7125,7 +7127,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result-and-error",
     handler: async (context) => {
-      const { runProvision } = await import("./provision-spwn5t41.js");
+      const { runProvision } = await import("./provision-64c2n9aw.js");
       return runProvision(context, {
         resumeCommand: buildResumeCommand("provision", context.rawFlags)
       });

package/dist/{index-vmmfya6b.js → index-hwfe7gs8.js}

@@ -3,7 +3,7 @@ import {
   initPrompts,
   runPromptSync,
   runSkillSync
-} from "./cli-ert1sbbt.js";
+} from "./cli-3kcy61fr.js";
 import {
   codingAgentDisplayName,
   describeCodingAgentEvent,
@@ -34,11 +34,14 @@ import {
 } from "./cli-ssfq84k5.js";
 import {
   selectTenantAndCreateKey
-} from "./cli-qgf2cz2v.js";
+} from "./cli-k38j2fpq.js";
 import {
+  ConnectCodeError,
+  connectWithCode,
+  loadAuthSession,
   loadToken,
   login
-} from "./cli-strngwn3.js";
+} from "./cli-kegd748v.js";
 import {
   CliAuthError,
   CliInputError,
@@ -1643,6 +1646,32 @@ async function runInit(flags, options = {}) {
   const profile = stringFlag(flags.profile);
   log(renderInitStep(1, 5, "Sign in", "No environment variable files are written. File changes are listed before completion."));
   let token = loadToken({ profile });
+  const connectCode = stringFlag(flagValue(flags, "connect-code", "connect_code"));
+  let codeTenantId;
+  if (connectCode) {
+    const previousEmail = token ? loadAuthSession({ profile })?.user_email : undefined;
+    try {
+      const connected = await connectWithCode(connectCode, {
+        profile,
+        tenantId: stringFlag(flagValue(flags, "tenant-id", "tenant_id"))
+      });
+      token = loadToken({ profile });
+      codeTenantId = connected.tenantId;
+      const email = connected.user.email || "your Moda account";
+      const replaced = previousEmail && previousEmail !== connected.user.email ? ` (replacing the CLI session for ${previousEmail})` : "";
+      log(renderInitNote(`Signed in as ${email} with the one-time code${replaced}`));
+      emit("auth", `Signed in as ${email} with the one-time code${replaced}.`);
+    } catch (error) {
+      if (!(error instanceof ConnectCodeError))
+        throw error;
+      if (error.reason === "workspace_mismatch") {
+        throw new CliInputError(error.message, "Copy the command again from the Moda onboarding page, or drop --tenant-id.");
+      }
+      const next = token ? `Continuing with your existing CLI session${previousEmail ? ` (${previousEmail})` : ""}.` : "Signing in through the browser instead.";
+      warn(renderInitNote(`${error.message} ${next}`, "warning"));
+      emit("auth", `${error.message} ${next}`, "warning");
+    }
+  }
   if (!token) {
     if (json || agent || noPrompts) {
       throw new CliAuthError("Browser authentication is required before non-interactive init can continue.", {
@@ -1652,7 +1681,8 @@ async function runInit(flags, options = {}) {
       }, "Run `moda auth login`, then re-run `moda init`.");
     }
     let action = "login";
-    if (!yes) {
+    const fromDashboard = Boolean(connectCode || stringFlag(flagValue(flags, "tenant-id", "tenant_id")) || stringFlag(flagValue(flags, "verification-id", "verification_id")));
+    if (!yes && !fromDashboard) {
       action = await select({
         message: "Get started",
         choices: [
@@ -1673,14 +1703,17 @@ async function runInit(flags, options = {}) {
   log(renderInitStep(2, 5, "Workspace"));
   emit("workspace", "Selecting workspace and creating API key.");
   const tenantIdFlag = stringFlag(flagValue(flags, "tenant-id", "tenant_id"));
+  if (codeTenantId && tenantIdFlag && tenantIdFlag !== codeTenantId) {
+    throw new CliInputError("The sign-in code is for a different workspace than --tenant-id.", "Copy the command again from the Moda onboarding page, or drop --tenant-id.");
+  }
   const verificationId = stringFlag(flagValue(flags, "verification-id", "verification_id"));
   if (verificationId !== undefined && !isAcceptedVerificationId(verificationId)) {
     throw new CliInputError(`Invalid --verification-id ${JSON.stringify(verificationId).slice(0, 80)}`, "Pass the onb_ id shown in the Moda onboarding page, or omit the flag.");
   }
   const tenantIdEnv = stringFlag(process.env.MODA_TENANT_ID);
   const { apiKey, tenantId: selectedTenantId, tenantName } = await selectTenantAndCreateKey({
-    tenantId: tenantIdFlag ?? tenantIdEnv,
-    tenantIdSource: tenantIdFlag ? "flag" : tenantIdEnv ? "env" : undefined,
+    tenantId: tenantIdFlag ?? codeTenantId ?? tenantIdEnv,
+    tenantIdSource: tenantIdFlag || codeTenantId ? "flag" : tenantIdEnv ? "env" : undefined,
     nonInteractive: json || agent || noPrompts,
     silent: !human,
     resumeCommand: ["moda", "init", ...resumeFlagsForInit(flags)],

package/dist/{provision-spwn5t41.js → provision-64c2n9aw.js}

@@ -1,9 +1,9 @@
 import {
   selectTenantAndCreateKey
-} from "./cli-qgf2cz2v.js";
+} from "./cli-k38j2fpq.js";
 import {
   loadAuthSession
-} from "./cli-strngwn3.js";
+} from "./cli-kegd748v.js";
 import {
   CliAuthError,
   resolveIngestUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.37.0",
+  "version": "1.38.0",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-09-27T21:11:50.220Z",
-  "cli_version": "1.37.0",
+  "bundled_at": "2026-09-28T05:22:37.701Z",
+  "cli_version": "1.38.0",
   "skills": [
     {
       "id": "integration-cloudflare-think",