@moda-ai/cli 1.37.0 → 1.39.0

package/dist/{cli-strngwn3.js → cli-dyeywy9d.js}

@@ -7,7 +7,7 @@ import {
   saveProfileConfig,
   secretFilePathFromRef,
   writeSecretJsonFile
-} from "./cli-q79sq80a.js";
+} from "./cli-rp912ypf.js";
 import {
   __require
 } from "./cli-0v6na3yp.js";
@@ -328,6 +328,71 @@ function getCachedLoginContext(options = {}) {
     return null;
   return cachedLoginContext.context;
 }
+var MISMATCH_MESSAGE = "The sign-in code is for a different workspace than --tenant-id.";
+var CONNECT_CODE_RE = /^mcc_[A-Za-z0-9_-]{43}$/;
+
+class ConnectCodeError extends Error {
+  reason;
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "ConnectCodeError";
+  }
+}
+async function connectWithCode(code, options = {}) {
+  if (!CONNECT_CODE_RE.test(code)) {
+    throw new ConnectCodeError("That is not a Moda sign-in code. Copy the command from the Moda onboarding page again.", "rejected");
+  }
+  let response;
+  try {
+    response = await fetch(`${resolveModaBaseUrl(options)}/api/cli/auth/connect`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ code, label: hostname(), ...options.tenantId ? { tenant_id: options.tenantId } : {} }),
+      redirect: "manual",
+      signal: AbortSignal.timeout(EXCHANGE_TIMEOUT_MS)
+    });
+  } catch {
+    throw new ConnectCodeError("Could not reach Moda to use the sign-in code.", "unreachable");
+  }
+  if (response.status === 400) {
+    const body = await response.json().catch(() => ({}));
+    if (body.error === "tenant_mismatch") {
+      throw new ConnectCodeError(MISMATCH_MESSAGE, "workspace_mismatch");
+    }
+  }
+  if (response.status === 401 || response.status === 400) {
+    throw new ConnectCodeError("The sign-in code was rejected: it expired (10 minutes) or was already used.", "rejected");
+  }
+  if (!response.ok || response.status >= 300 && response.status < 400) {
+    throw new ConnectCodeError(`Moda could not use the sign-in code (HTTP ${response.status}).`, "failed");
+  }
+  const payload = await response.json().catch(() => ({}));
+  const cliToken = typeof payload.cli_token === "string" ? payload.cli_token : undefined;
+  const expiresAtMs = typeof payload.expires_at === "string" ? Date.parse(payload.expires_at) : NaN;
+  const tenantId = typeof payload.tenant_id === "string" ? payload.tenant_id : undefined;
+  if (!cliToken || !Number.isFinite(expiresAtMs) || !tenantId) {
+    throw new ConnectCodeError("Moda returned an incomplete response for the sign-in code.", "failed");
+  }
+  if (options.tenantId && tenantId !== options.tenantId) {
+    throw new ConnectCodeError(MISMATCH_MESSAGE, "workspace_mismatch");
+  }
+  const userEmail = typeof payload.user?.email === "string" ? payload.user.email : undefined;
+  persistAuthSession({
+    access_token: cliToken,
+    expires_at: Math.floor(expiresAtMs / 1000),
+    profile: resolveStorageProfile(options),
+    token_type: "bearer",
+    token_kind: "moda_ct",
+    ...userEmail ? { user_email: userEmail } : {}
+  }, options);
+  const context = {
+    user: { email: userEmail ?? "", name: typeof payload.user?.name === "string" ? payload.user.name : null },
+    tenants: Array.isArray(payload.tenants) ? payload.tenants : []
+  };
+  cachedLoginContext = { profile: resolveStorageProfile(options), context };
+  return { ...context, tenantId };
+}
 var SUCCESS_HTML = `<!DOCTYPE html>
 <html><body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#fafafa">
 <div style="text-align:center">
@@ -761,4 +826,4 @@ function safeResolveUrl(location, base) {
   }
 }
 
-export { isAuthSessionValid, loadToken, loadAuthSession, clearAuthSession, revokeCliSessionToken, getCachedLoginContext, login, authFetch };
+export { isAuthSessionValid, loadToken, loadAuthSession, clearAuthSession, revokeCliSessionToken, getCachedLoginContext, ConnectCodeError, connectWithCode, login, authFetch };

package/dist/{cli-q79sq80a.js → cli-rp912ypf.js}

@@ -254,6 +254,33 @@ function normalizeProfileConfig(raw, options = {}) {
     migrations: inspectProfileMigrationState(options)
   }, options);
 }
+function profileBaseUrlOrigin(name, options = {}) {
+  const raw = safeReadRecord(getModaPaths(options).profileConfigPath);
+  const profiles = raw && typeof raw.profiles === "object" && raw.profiles !== null ? raw.profiles : {};
+  let stored;
+  for (const [key, value] of Object.entries(profiles)) {
+    if (!isRecord(value))
+      continue;
+    if ((optionalString(value.name) ?? key) === name)
+      stored = value;
+  }
+  const url = optionalString(stored?.base_url);
+  if (!url)
+    return "default";
+  const environment = normalizeEnvironment(stored?.environment);
+  return sanitizeProfileBaseUrl(url, environment) === normalizeModaBaseUrl(url) ? "profile" : "default";
+}
+function describeBaseUrlSource(options) {
+  const envBase = optionalString(getEnv(options).MODA_BASE_URL);
+  if (envBase) {
+    const environment = activeProfileEnvironment(options);
+    if (!environmentAllowsLoopback(environment) && isLoopbackBaseUrl(normalizeModaBaseUrl(envBase))) {
+      return `default (env:MODA_BASE_URL loopback ignored for ${environment} profile)`;
+    }
+    return "env:MODA_BASE_URL";
+  }
+  return profileBaseUrlOrigin(options.profile, options);
+}
 function loadProfileConfig(options = {}) {
   const path = getModaPaths(options).profileConfigPath;
   const parsed = safeReadRecord(path);
@@ -600,6 +627,10 @@ function resolveTenantId(options = {}) {
   const env = options.env ?? process.env;
   return env.MODA_TENANT_ID || resolveTenantIdFromActiveProfile(options) || loadCliConfig(options).tenant_id || undefined;
 }
+function resolveApiTenantId(options = {}) {
+  const apiKey = resolveApiKey(options);
+  return (apiKey ? embeddedTenantIdFromApiKey(apiKey) : undefined) || resolveTenantId(options);
+}
 var MODA_API_KEY = process.env.MODA_API_KEY;
 var MODA_INGEST_URL = process.env.MODA_INGEST_URL || DEFAULT_INGEST_URL;
 function resolveModaBaseUrl(options = {}) {
@@ -1160,6 +1191,10 @@ function createCliOutput(options) {
       }
       safeWriteStdout(`${JSON.stringify(redactDeep(data), null, 2)}
 `);
+      for (const warning of writeOptions.warnings ?? []) {
+        safeWriteStderr(`Warning: ${warning}
+`);
+      }
     },
     writeEvent(event) {
       if (options.quiet)
@@ -1242,8 +1277,8 @@ function createCliOutput(options) {
 }
 function createAgentEnvelope(options) {
   const safeData = redactDeep(options.data);
-  const bounded = boundForAgent(safeData);
-  const envelope = {
+  const maxBytes = agentMaxOutputBytes();
+  const build = (bounded) => ({
     schema_version: AGENT_SCHEMA_VERSION,
     command: options.command,
     status: options.status,
@@ -1255,14 +1290,31 @@ function createAgentEnvelope(options) {
     recommended_actions: options.recommendedActions ?? [],
     next_commands: normalizeNextCommands(options.nextCommands ?? []),
     artifacts: options.artifacts ?? [],
-    warnings: options.warnings ?? inferWarnings(safeData),
+    warnings: [
+      ...options.warnings ?? inferWarnings(safeData),
+      ...bounded.warning ? [bounded.warning] : []
+    ],
     errors: options.errors ?? [],
     data: bounded.data,
     ...options.meta ? { meta: options.meta } : {},
     ...bounded.truncation ? { truncation: bounded.truncation } : {}
-  };
+  });
+  let envelope = build(boundForAgent(safeData, maxBytes));
+  const envelopeBytes = Buffer.byteLength(JSON.stringify(envelope), "utf8");
+  if (envelopeBytes > maxBytes) {
+    const overhead = envelopeBytes - Buffer.byteLength(JSON.stringify(envelope.data) ?? "", "utf8");
+    envelope = build(boundForAgent(safeData, Math.max(1024, maxBytes - overhead - 1024)));
+  }
   return redactDeep(envelope);
 }
+var AGENT_ENVELOPE_RESERVE_BYTES = 2048;
+function agentEnvelopeFits(command, data, options = {}) {
+  const maxBytes = agentMaxOutputBytes() - AGENT_ENVELOPE_RESERVE_BYTES;
+  if (Buffer.byteLength(JSON.stringify(data) ?? "", "utf8") > maxBytes)
+    return false;
+  const envelope = createAgentEnvelope({ command, status: "ok", data, ...options });
+  return !envelope.truncation && Buffer.byteLength(JSON.stringify(envelope), "utf8") <= maxBytes;
+}
 function createAgentErrorEnvelope(command, error, runId) {
   return createAgentEnvelope({
     command,
@@ -1277,7 +1329,7 @@ function createAgentErrorEnvelope(command, error, runId) {
     nextCommands: (error.suggested_commands ?? []).map((commandText) => ({
       command: commandText,
       purpose: "Suggested recovery command.",
-      mutability: commandText.includes(" sync") || commandText.startsWith("moda sync") ? "sync" : "read",
+      mutability: recoveryCommandMutability(commandText),
       requires_approval: commandText.includes(" --yes") || commandText.includes(" sync")
     }))
   });
@@ -1469,8 +1521,15 @@ function normalizeNextCommands(commands) {
     };
   });
 }
+function recoveryCommandMutability(command) {
+  if (command.includes(" sync") || command.startsWith("moda sync"))
+    return "sync";
+  if (/\s--yes(\s|=|$)/.test(command))
+    return "write";
+  return inferMutability(command);
+}
 function inferMutability(command) {
-  if (/\b(sync|approve|init|install|pull|gen|remove|promote)\b/.test(command)) {
+  if (/\b(sync|approve|init|install|pull|gen|remove|promote|delete)\b/.test(command)) {
     if (/\bsync\b/.test(command))
       return "sync";
     return "write";
@@ -1488,25 +1547,108 @@ function inferWarnings(data) {
   }
   return [];
 }
-function boundForAgent(data) {
-  const maxBytes = Number(process.env.MODA_AGENT_MAX_OUTPUT_BYTES ?? 200000);
-  const serialized = JSON.stringify(data);
-  const bytes = Buffer.byteLength(serialized, "utf8");
-  if (bytes <= maxBytes)
+var AGENT_MAX_STRING_CHARS = 2000;
+var PROTECTED_STRING_KEY = /(cursor|token|_id$|^id$|url$|href$|^key$|hash$)/i;
+function agentMaxOutputBytes() {
+  return Number(process.env.MODA_AGENT_MAX_OUTPUT_BYTES ?? 200000);
+}
+function boundForAgent(data, maxBytes = agentMaxOutputBytes()) {
+  const sizeOf = (value) => Buffer.byteLength(JSON.stringify(value) ?? "", "utf8");
+  const serialized = JSON.stringify(data) ?? "";
+  const originalBytes = Buffer.byteLength(serialized, "utf8");
+  if (originalBytes <= maxBytes)
     return { data };
-  const preview = serialized.slice(0, Math.max(0, maxBytes - 256));
+  let shortenedStrings = 0;
+  const shorten = (value, limit, key) => {
+    if (typeof value === "string") {
+      if (value.length <= limit || key !== undefined && PROTECTED_STRING_KEY.test(key))
+        return value;
+      shortenedStrings += 1;
+      return `${value.slice(0, limit)}… [truncated ${value.length - limit} chars]`;
+    }
+    if (Array.isArray(value))
+      return value.map((item) => shorten(item, limit));
+    if (value && typeof value === "object") {
+      return Object.fromEntries(Object.entries(value).map(([entryKey, item]) => [entryKey, shorten(item, limit, entryKey)]));
+    }
+    return value;
+  };
+  let bounded = data;
+  let boundedBytes = originalBytes;
+  for (const limit of [AGENT_MAX_STRING_CHARS, 500, 200]) {
+    shortenedStrings = 0;
+    bounded = shorten(data, limit);
+    boundedBytes = sizeOf(bounded);
+    if (boundedBytes <= maxBytes)
+      break;
+  }
+  const droppedItems = {};
+  const collectArrays = (value, path, out) => {
+    if (Array.isArray(value)) {
+      if (value.length > 1)
+        out.push({ path, array: value, itemBytes: value.map((item) => sizeOf(item) + 1) });
+      value.forEach((item, index) => {
+        if (item && typeof item === "object")
+          collectArrays(item, `${path}[${index}]`, out);
+      });
+    } else if (value && typeof value === "object") {
+      for (const [key, item] of Object.entries(value)) {
+        if (item && typeof item === "object")
+          collectArrays(item, path ? `${path}.${key}` : key, out);
+      }
+    }
+  };
+  for (let round = 0;round < 25 && boundedBytes > maxBytes; round++) {
+    const arrays = [];
+    collectArrays(bounded, "", arrays);
+    const largest = arrays.map((entry) => ({ ...entry, total: entry.itemBytes.reduce((sum, bytes) => sum + bytes, 0) })).sort((left, right) => right.total - left.total)[0];
+    if (!largest)
+      break;
+    let overshoot = boundedBytes - maxBytes;
+    let drop = 0;
+    for (let index = largest.array.length - 1;index >= 1 && overshoot > 0; index--) {
+      overshoot -= largest.itemBytes[index];
+      drop += 1;
+    }
+    if (drop === 0)
+      break;
+    largest.array.splice(largest.array.length - drop, drop);
+    const key = largest.path || "(root)";
+    droppedItems[key] = (droppedItems[key] ?? 0) + drop;
+    boundedBytes = sizeOf(bounded);
+  }
+  const dropped = Object.entries(droppedItems);
+  const parts = [
+    shortenedStrings > 0 ? `shortened ${shortenedStrings} long text field(s)` : "",
+    ...dropped.map(([path, count]) => `dropped the last ${count} item(s) of data.${path}`)
+  ].filter(Boolean);
+  const howToGetMore = "For complete results narrow the query (a smaller --limit, with --offset or --cursor paging where the command supports it), " + "rerun with --json (no byte limit), or raise MODA_AGENT_MAX_OUTPUT_BYTES.";
+  if (boundedBytes > maxBytes) {
+    const stub = { truncated: true, original_bytes: originalBytes, max_bytes: maxBytes, preview: serialized.slice(0, Math.max(0, maxBytes - 256)) };
+    for (let stubBytes = sizeOf(stub);stubBytes > maxBytes && stub.preview.length > 0; stubBytes = sizeOf(stub)) {
+      stub.preview = stub.preview.slice(0, Math.max(0, stub.preview.length - (stubBytes - maxBytes) - 16));
+    }
+    return {
+      data: stub,
+      warning: `Output was ${originalBytes} bytes, over the ${maxBytes}-byte agent limit, and could not be reduced while keeping its structure; data is a string preview. ${howToGetMore}`,
+      truncation: {
+        data: { original_bytes: originalBytes, max_bytes: maxBytes, reason: "agent_output_byte_limit", structure_preserved: false, complete: false }
+      }
+    };
+  }
   return {
-    data: {
-      truncated: true,
-      original_bytes: bytes,
-      max_bytes: maxBytes,
-      preview
-    },
+    data: bounded,
+    warning: `Output was ${originalBytes} bytes, over the ${maxBytes}-byte agent limit: ${parts.join("; ")}. ${howToGetMore}`,
     truncation: {
       data: {
-        original_bytes: bytes,
+        original_bytes: originalBytes,
+        bounded_bytes: boundedBytes,
         max_bytes: maxBytes,
-        reason: "agent_output_byte_limit"
+        reason: "agent_output_byte_limit",
+        shortened_strings: shortenedStrings,
+        dropped_items: droppedItems,
+        structure_preserved: true,
+        complete: false
       }
     }
   };
@@ -1566,4 +1708,4 @@ function createCommandContext(input, options = {}) {
   };
 }
 
-export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, assertValidProfileName, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, CliAccessError, CliInputRequiredError, CliAuthError, CliCancellationError, isNetworkLikeError, isApiLikeError, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveModaBaseUrl, validateConfig, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, resolveOutputMode, createCliOutput, stringOption, createCommandContext };
+export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, assertValidProfileName, describeBaseUrlSource, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, CliAccessError, CliInputRequiredError, CliAuthError, CliCancellationError, isNetworkLikeError, isApiLikeError, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveApiTenantId, resolveModaBaseUrl, validateConfig, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, resolveOutputMode, createCliOutput, agentEnvelopeFits, stringOption, createCommandContext };