@moda-ai/cli 1.45.3 → 1.49.0

package/README.md

@@ -116,6 +116,7 @@ Feedback:
 
 ```bash
 moda feedback "cluster label looks wrong" --category=bad_cluster_label
+moda feedback "trace belongs to another problem" --category=false_positive_attribution --problem-id=<id>
 ```
 
 Output adapts to where it runs: piped/CI/agent environments get schema-versioned

package/dist/{cli-nnwegmzh.js → cli-6xndg2h4.js}

@@ -13,7 +13,7 @@ import {
   resolvePromptSource,
   safePromptEvidencePath,
   scanHarness
-} from "./cli-3xh2w7hb.js";
+} from "./cli-m3bg9yyh.js";
 import {
   SKILL_SOURCE_HARNESS,
   SKILL_SOURCE_INTEGRATION_BUNDLED,
@@ -26,7 +26,7 @@ import {
 import {
   isAuthSessionValid,
   loadAuthSession
-} from "./cli-dy2aavbe.js";
+} from "./cli-c64d2jrw.js";
 import {
   CliInputError,
   EXIT_ERROR,
@@ -45,7 +45,7 @@ import {
   resolveTenantId,
   secretFilePathFromRef,
   validateConfig
-} from "./cli-bvnw7585.js";
+} from "./cli-bqhs6sk7.js";
 import {
   __commonJS,
   __require,
@@ -6711,7 +6711,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-9qpbj2qj.js");
+    const { analyzeHarnessPrompts } = await import("./harness-4ypeg9dh.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),

package/dist/{cli-bvnw7585.js → cli-bqhs6sk7.js}

@@ -1418,10 +1418,14 @@ function errorToAgentError(error) {
     }
     if (isApiLikeError(error)) {
       const statusCode = "statusCode" in error ? error.statusCode : undefined;
+      const typedCode = "code" in error && typeof error.code === "string" ? error.code : undefined;
+      const suggestions = "suggestions" in error && Array.isArray(error.suggestions) ? error.suggestions.filter((s) => typeof s === "string") : [];
+      const http = typeof statusCode === "number" ? `HTTP ${statusCode}` : undefined;
       return {
         code: "api_error",
         message: error.message,
-        cause: typeof statusCode === "number" ? `HTTP ${statusCode}` : undefined,
+        cause: typedCode ? http ? `${typedCode} (${http})` : typedCode : http,
+        ...suggestions.length > 0 ? { suggested_commands: suggestions } : {},
         blocking: true
       };
     }
@@ -1692,6 +1696,7 @@ function createCommandContext(input, options = {}) {
     positionals: input.positionals,
     flags,
     rawFlags,
+    ...input.bareFlags ? { bareFlags: input.bareFlags } : {},
     startedAt: options.startedAt ?? Date.now(),
     cwd: options.cwd ?? process.cwd(),
     env: options.env ?? process.env,
@@ -1716,4 +1721,4 @@ function createCommandContext(input, options = {}) {
   };
 }
 
-export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, assertValidProfileName, describeBaseUrlSource, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, CliAccessError, CliInputRequiredError, CliAuthError, CliCancellationError, isNetworkLikeError, isApiLikeError, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveApiTenantId, resolveModaBaseUrl, validateConfig, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, explicitOutputMode, resolveOutputMode, createCliOutput, agentEnvelopeFits, stringOption, createCommandContext };
+export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, assertValidProfileName, describeBaseUrlSource, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, CliAccessError, CliInputRequiredError, CliAuthError, CliCancellationError, isNetworkLikeError, isApiLikeError, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveApiTenantId, resolveModaBaseUrl, validateConfig, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, explicitOutputMode, resolveOutputMode, createCliOutput, agentEnvelopeFits, agentMaxOutputBytes, stringOption, createCommandContext };

package/dist/{cli-dy2aavbe.js → cli-c64d2jrw.js}

@@ -7,7 +7,7 @@ import {
   saveProfileConfig,
   secretFilePathFromRef,
   writeSecretJsonFile
-} from "./cli-bvnw7585.js";
+} from "./cli-bqhs6sk7.js";
 import {
   __require
 } from "./cli-0v6na3yp.js";

package/dist/{cli-3xh2w7hb.js → cli-m3bg9yyh.js}

@@ -25,7 +25,7 @@ import {
   resolveTenantId,
   shouldInventoryFile,
   stringOption
-} from "./cli-bvnw7585.js";
+} from "./cli-bqhs6sk7.js";
 import {
   __commonJS,
   __require,
@@ -177909,13 +177909,59 @@ var apiRequestCount = 0;
 class ApiError extends Error {
   statusCode;
   responseBody;
+  code;
+  suggestions;
+  readable;
   constructor(message, statusCode, responseBody) {
-    super(message);
+    const typed = parseTypedErrorBody(responseBody);
+    const platform = platformFailure(responseBody);
+    const readable = typed?.code === "audit_too_large" || platform !== null;
+    super(readable ? `API error (${statusCode}): ${typed?.message ?? platform?.message}` : message);
     this.statusCode = statusCode;
     this.responseBody = responseBody;
     this.name = "ApiError";
+    this.code = typed?.code ?? platform?.code;
+    this.suggestions = typed?.suggestions;
+    this.readable = readable;
   }
 }
+function parseTypedErrorBody(body) {
+  if (!body.trimStart().startsWith("{"))
+    return null;
+  try {
+    const parsed = JSON.parse(body);
+    if (typeof parsed.code !== "string")
+      return null;
+    const suggestions = Array.isArray(parsed.suggestions) ? parsed.suggestions.filter((s) => typeof s === "string") : undefined;
+    return {
+      code: parsed.code,
+      message: typeof parsed.message === "string" ? parsed.message : undefined,
+      suggestions
+    };
+  } catch {
+    return null;
+  }
+}
+var DETERMINISTIC_PLATFORM_FAILURES = [
+  "FUNCTION_INVOCATION_FAILED",
+  "FUNCTION_RESPONSE_PAYLOAD_TOO_LARGE"
+];
+function platformFailure(body) {
+  const code = DETERMINISTIC_PLATFORM_FAILURES.find((c) => body.includes(c));
+  if (!code)
+    return null;
+  const requestId = /\b([a-z]{3}\d::[A-Za-z0-9:-]+)/.exec(body)?.[1];
+  const cause = code === "FUNCTION_RESPONSE_PAYLOAD_TOO_LARGE" ? "the response was larger than the hosting platform allows" : "the server function crashed (typically out of memory or an oversized response)";
+  return {
+    code,
+    message: `The Moda API could not complete this request: ${cause} [${code}` + `${requestId ? `, request ${requestId}` : ""}]. Retrying the same request will fail the same way; ` + "narrow it (a smaller --limit, a single trace, or fewer results) and report it with `moda feedback` if it persists."
+  };
+}
+function isRetryableResponse(status, body) {
+  if (!isRetryable(status))
+    return false;
+  return platformFailure(body) === null;
+}
 
 class NetworkError extends Error {
   constructor(message) {
@@ -177970,7 +178016,7 @@ async function callModaAPI(url, options, profileOptions = {}, requestOptions = {
       if (!response.ok) {
         const errorText = await response.text();
         const error = new ApiError(`API error (${response.status}): ${errorText}`, response.status, errorText);
-        if (isRetryable(response.status) && attempt < maxRetries) {
+        if (isRetryableResponse(response.status, errorText) && attempt < maxRetries) {
           continue;
         }
         throw error;
@@ -184813,7 +184859,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-ky4ym5n3.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-dvq7spqh.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);

package/dist/{cli-phgzghwq.js → cli-taf854xx.js}

@@ -1,7 +1,7 @@
 import {
   authFetch,
   getCachedLoginContext
-} from "./cli-dy2aavbe.js";
+} from "./cli-c64d2jrw.js";
 import {
   CliAccessError,
   CliInputError,
@@ -15,7 +15,7 @@ import {
   resolveTenantIdFromActiveProfile,
   saveCliConfig,
   writeSecretJsonFile
-} from "./cli-bvnw7585.js";
+} from "./cli-bqhs6sk7.js";
 
 // src/init/tenant.ts
 import { randomUUID } from "node:crypto";

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   runPromptsCommand,
   runSkillsCommand,
   runStatusCommand
-} from "./cli-nnwegmzh.js";
+} from "./cli-6xndg2h4.js";
 import {
   ApiError,
   HARNESS_REPORT_APPROVAL_PATH,
@@ -37,7 +37,7 @@ import {
   terminalStyles,
   unknownSignalsSubcommandError,
   validateHarnessReport
-} from "./cli-3xh2w7hb.js";
+} from "./cli-m3bg9yyh.js";
 import"./cli-ssfq84k5.js";
 import {
   authFetch,
@@ -46,7 +46,7 @@ import {
   loadAuthSession,
   login,
   revokeCliSessionToken
-} from "./cli-dy2aavbe.js";
+} from "./cli-c64d2jrw.js";
 import {
   AGENT_ERROR_CODES,
   CliAccessError,
@@ -65,6 +65,7 @@ import {
   PROD_BASE_URL,
   VERSION,
   agentEnvelopeFits,
+  agentMaxOutputBytes,
   assertValidProfileName,
   clearStoredApiKeyCredentials,
   createCliOutput,
@@ -96,7 +97,7 @@ import {
   validateConfig,
   wasOutputCancelled,
   writeSecretJsonFile
-} from "./cli-bvnw7585.js";
+} from "./cli-bqhs6sk7.js";
 import {
   __require
 } from "./cli-0v6na3yp.js";
@@ -389,7 +390,9 @@ var AuditSchema = z.object({
   id: z.string().min(1),
   kind: z.enum(["auto", "trace", "conversation"]).default("auto").optional(),
   include_raw: boolFlag(),
-  limit: z.number().min(1).max(1000).default(200).optional()
+  include_bodies: boolFlag(),
+  limit: z.number().min(1).max(1000).default(200).optional(),
+  cursor: z.string().min(1).max(512).optional()
 });
 var TIME_RANGES = ["all", "1h", "3d", "7d", "24h", "30d", "90d"];
 var SEARCH_MODES = ["keyword", "semantic", "hybrid"];
@@ -402,6 +405,8 @@ var SearchSchema = z.object({
   include_tool_io: boolFlag(),
   offset: z.number().min(0).max(1e4).optional()
 });
+
+// ../../packages/database/src/agent-feedback.ts
 var FEEDBACK_CATEGORIES = [
   "bad_cluster_label",
   "mismatched_frustration",
@@ -410,18 +415,98 @@ var FEEDBACK_CATEGORIES = [
   "wrong_tool_failure",
   "incorrect_loop",
   "api_quirk",
+  "false_positive_attribution",
+  "misrouted_fix",
+  "harness_bug",
   "other"
 ];
 var FEEDBACK_SEVERITIES = ["info", "low", "medium", "high"];
-var FeedbackSchema = z.object({
-  note: z.string().min(1).max(4000),
-  category: z.enum(FEEDBACK_CATEGORIES).default("other").optional(),
-  severity: z.enum(FEEDBACK_SEVERITIES).default("low").optional(),
-  conversation_id: z.string().min(1).max(256).optional(),
-  cluster_id: z.string().min(1).max(256).optional(),
-  tool_name: z.string().min(1).max(256).optional(),
-  run_id: z.string().min(1).max(256).optional()
-});
+var DEFAULT_FEEDBACK_CATEGORY = "other";
+var RAW_FEEDBACK_CATEGORY_MAX = 64;
+function isFeedbackCategory(value) {
+  return typeof value === "string" && FEEDBACK_CATEGORIES.includes(value);
+}
+function normalizeFeedbackCategory(value) {
+  if (value === undefined || value === null || value === "")
+    return { category: DEFAULT_FEEDBACK_CATEGORY };
+  if (isFeedbackCategory(value))
+    return { category: value };
+  const raw = String(value).trim().slice(0, RAW_FEEDBACK_CATEGORY_MAX);
+  return raw ? { category: DEFAULT_FEEDBACK_CATEGORY, raw_category: raw } : { category: DEFAULT_FEEDBACK_CATEGORY };
+}
+
+// src/feedback.ts
+var FEEDBACK_FLAGS = ["category", "severity", "note", "cluster-id", "conversation-id", "run-id", "tool-name"];
+var FEEDBACK_USAGE = `Usage: moda feedback "<note>" [--category=${FEEDBACK_CATEGORIES.join("|")}] ` + `[--severity=${FEEDBACK_SEVERITIES.join("|")}] [--conversation-id=ID] [--cluster-id=ID] ` + "[--tool-name=NAME] [--run-id=ID] [--<name>-id=ID]";
+var NOTE_MAX = 4000;
+var REF_VALUE_MAX = 256;
+var REF_FLAG_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*-(?:id|ids|index|token)$/;
+var REF_FLAG_WORDS = new Set(["turn", "tool", "family", "kind"]);
+function isFeedbackRefFlag(flag) {
+  return REF_FLAG_PATTERN.test(flag) || REF_FLAG_WORDS.has(flag);
+}
+function feedbackCategoryHelp(indent = 35, width = 100) {
+  const lines = [];
+  let line = "";
+  FEEDBACK_CATEGORIES.forEach((category, index) => {
+    const piece = index < FEEDBACK_CATEGORIES.length - 1 ? `${category}|` : `${category} (default other)`;
+    if (line && indent + line.length + piece.length > width) {
+      lines.push(line);
+      line = "";
+    }
+    line += piece;
+  });
+  lines.push(line);
+  return lines.join(`
+${" ".repeat(indent)}`);
+}
+function buildFeedbackRequest(positionals, flags, bareFlags) {
+  const isBare = (flag) => bareFlags ? bareFlags.includes(flag) : flags[flag] === "true";
+  const flagNote = flags.note !== undefined && !isBare("note") ? flags.note.trim() : "";
+  const note = [positionals.join(" ").trim(), flagNote].filter(Boolean).join(`
+`);
+  if (note === "")
+    throw new CliInputError("<note> is required", FEEDBACK_USAGE);
+  if (note.length > NOTE_MAX) {
+    throw new CliInputError(`<note> is ${note.length} characters; the limit is ${NOTE_MAX}.`, FEEDBACK_USAGE);
+  }
+  const severity = flags.severity ?? "low";
+  if (!FEEDBACK_SEVERITIES.includes(severity)) {
+    throw new CliInputError(`Invalid --severity '${severity}'. Valid severities: ${FEEDBACK_SEVERITIES.join(", ")}.`, FEEDBACK_USAGE);
+  }
+  const refs = {};
+  for (const [flag, value] of Object.entries(flags)) {
+    if (flag === "category" || flag === "severity" || flag === "note")
+      continue;
+    if (!FEEDBACK_FLAGS.includes(flag) && !isFeedbackRefFlag(flag))
+      continue;
+    const trimmed = value.trim();
+    if (value === "true" || trimmed === "") {
+      throw new CliInputError(`--${flag} needs a value, e.g. --${flag}=<id>.`, FEEDBACK_USAGE);
+    }
+    if (trimmed.length > REF_VALUE_MAX) {
+      throw new CliInputError(`--${flag} is ${trimmed.length} characters; the limit is ${REF_VALUE_MAX}.`, FEEDBACK_USAGE);
+    }
+    refs[flag.replace(/-/g, "_")] = trimmed;
+  }
+  const warnings = [];
+  const { category, raw_category: rawCategory } = normalizeFeedbackCategory(flags.category);
+  if (rawCategory !== undefined) {
+    refs.raw_category = rawCategory;
+    warnings.push(`Unknown category '${rawCategory}': sent as 'other' with refs.raw_category. ` + `Valid categories: ${FEEDBACK_CATEGORIES.join(", ")}.`);
+  }
+  const hint = dedicatedCommandHint(category, rawCategory);
+  if (hint)
+    warnings.push(hint);
+  return { category, severity, note, refs, warnings };
+}
+var MISROUTE_CATEGORIES = new Set(["false_positive_attribution", "misrouted_fix"]);
+var MISROUTE_WORDS = /attribut|misrout|false[\s_-]?positive|wrong[\s_-]?(?:problem|fix)/i;
+function dedicatedCommandHint(category, rawCategory) {
+  if (!MISROUTE_CATEGORIES.has(category) && !(rawCategory && MISROUTE_WORDS.test(rawCategory)))
+    return;
+  return "Feedback is read by the Moda team but does not change the problem. To act on it directly, use " + "`moda problem-feedback <problem_id> --action=flag_attribution --attribution-id=<uuid> --reason=TEXT` (a trace wrongly " + "attributed to a problem), `moda false-positive <kind> <target> --reason=TEXT` (a detection that should not " + "have fired), or `moda fix dismiss <fix_id> --reason=TEXT` (a fix aimed at the wrong problem).";
+}
 
 // src/transforms.ts
 function asRecord(value) {
@@ -7667,6 +7752,7 @@ function parseArgs(argv) {
   const flags = {};
   const positionals = [];
   const shortFlags = [];
+  const bareFlags = [];
   let positional;
   let i = 0;
   let endOfOptions = false;
@@ -7675,7 +7761,7 @@ function parseArgs(argv) {
     if (!endOfOptions && arg === "--" && command !== "") {
       endOfOptions = true;
     } else if (!endOfOptions && arg.startsWith("--")) {
-      i = parseFlag(args, i, flags, command === "");
+      i = parseFlag(args, i, flags, command === "", bareFlags);
     } else if (!endOfOptions && command !== "" && /^-[A-Za-z]/.test(arg)) {
       shortFlags.push(arg);
     } else if (command === "") {
@@ -7688,7 +7774,14 @@ function parseArgs(argv) {
     }
     i++;
   }
-  return { command, positional, positionals, flags, ...shortFlags.length > 0 ? { shortFlags } : {} };
+  return {
+    command,
+    positional,
+    positionals,
+    flags,
+    ...shortFlags.length > 0 ? { shortFlags } : {},
+    ...bareFlags.length > 0 ? { bareFlags } : {}
+  };
 }
 var DRY_RUN_TRUE = new Set(["true", "yes", "1", "on"]);
 var DRY_RUN_FALSE = new Set(["false", "no", "0", "off"]);
@@ -7708,24 +7801,32 @@ var GLOBAL_BOOLEAN_FLAGS = new Set([
   "tui",
   "no-tui"
 ]);
-function parseFlag(args, index, flags, beforeCommand) {
+function parseFlag(args, index, flags, beforeCommand, bareFlags) {
+  const set = (key2, value, bare) => {
+    flags[key2] = value;
+    const at = bareFlags.indexOf(key2);
+    if (at !== -1)
+      bareFlags.splice(at, 1);
+    if (bare)
+      bareFlags.push(key2);
+  };
   const arg = args[index];
   const eqIndex = arg.indexOf("=");
   if (eqIndex !== -1) {
-    flags[arg.slice(2, eqIndex)] = arg.slice(eqIndex + 1);
+    set(arg.slice(2, eqIndex), arg.slice(eqIndex + 1), false);
     return index;
   }
   const key = arg.slice(2);
   const next = args[index + 1];
   if (beforeCommand && GLOBAL_BOOLEAN_FLAGS.has(key)) {
-    flags[key] = "true";
+    set(key, "true", true);
     return index;
   }
   if (next !== undefined && !next.startsWith("--")) {
-    flags[key] = next;
+    set(key, next, false);
     return index + 1;
   }
-  flags[key] = "true";
+  set(key, "true", true);
   return index;
 }
 function initFlagsForContext(flags, outputMode, stdinIsTTY) {
@@ -8016,13 +8117,16 @@ Clusters search flags:
   --mode=fuzzy|semantic|hybrid     Cluster search mode (default hybrid)
 
 Feedback flags:
-  --category=CAT                   bad_cluster_label|mismatched_frustration|missing_data|noisy_data|
-                                   wrong_tool_failure|incorrect_loop|api_quirk|other (default other)
+  --category=CAT                   ${feedbackCategoryHelp()}
+                                   An unknown category is sent as other (with refs.raw_category)
   --severity=info|low|medium|high  How bad it is (default low)
+  --note=TEXT                      The note, if not given as the positional argument
   --conversation-id=ID             Attach the trace ID you were looking at
   --cluster-id=ID                  Attach a cluster node id
   --tool-name=NAME                 Attach a tool name
   --run-id=ID                      Attach a run id
+  --<name>-id=ID                   Any other id (--problem-id, --fix-id, --attribution-id,
+                                   --trace-id, --span-id, --message-index, ...) goes into refs
   (set MODA_CLI_TIPS=0 to hide the feedback tip line)
 
 Init flags:
@@ -8266,7 +8370,62 @@ function auditCapStatus(data, limit) {
   const rowsCapped = hasMore || !serverSaid && rows >= limit;
   if (!rowsCapped && !spansCapped)
     return null;
-  return { rowsCapped, spansCapped, hasMoreKnown: hasMore, rows, spans };
+  const reason = typeof summary.truncated_reason === "string" ? summary.truncated_reason : null;
+  const cursorValue = summary.next_cursor ?? record.next_cursor;
+  const nextCursor = typeof cursorValue === "string" && cursorValue ? cursorValue : null;
+  return { rowsCapped, spansCapped, hasMoreKnown: hasMore, rows, spans, reason, nextCursor };
+}
+var AUDIT_MIN_PAGE_BYTES = 32 * 1024;
+var AUDIT_AGENT_RESERVE_BYTES = 16 * 1024;
+async function fetchAudit(id, query2, maxBytes) {
+  const pageQuery = new URLSearchParams(query2);
+  if (maxBytes !== undefined)
+    pageQuery.set("max_bytes", maxBytes.toString());
+  const queryString = pageQuery.toString() ? `?${pageQuery.toString()}` : "";
+  return callDataAPI(`/audit/${encodeURIComponent(id)}${queryString}`);
+}
+function auditOutput(command, params, data) {
+  const capped = auditCapStatus(data, params.limit ?? AUDIT_DEFAULT_LIMIT);
+  const auditRecord = asRecord(data);
+  if (!capped || !auditRecord) {
+    return { data: auditRecord ? { ...auditRecord, truncated: false, has_more: false, next_cursor: null } : data, options: {} };
+  }
+  const limit = params.limit ?? AUDIT_DEFAULT_LIMIT;
+  const perTrace = "audit one OTLP trace at a time with `moda audit <trace_id> --kind=trace` (ids in summary.trace_ids)";
+  const warnings = [];
+  const nextCommands = [];
+  const auditFlags = (extra) => [
+    `moda ${command} ${shellArg(params.id)}`,
+    params.kind && params.kind !== "auto" ? `--kind=${params.kind}` : "",
+    params.include_raw === true ? "--include-raw" : "",
+    params.include_bodies === true ? "--include-bodies" : "",
+    ...extra
+  ].filter(Boolean).join(" ");
+  if (capped.nextCursor) {
+    nextCommands.push({
+      command: auditFlags([params.limit ? `--limit=${params.limit}` : "", `--cursor=${capped.nextCursor}`]),
+      purpose: "Read the next page of ingest rows of this trace.",
+      mutability: "read",
+      requires_approval: false
+    });
+  }
+  if (capped.reason === "byte_limit") {
+    warnings.push(`Spans were capped: the response reached the server's size budget after ${capped.rows} ingest row(s), so this trace has more spans than the ${capped.spans} shown. ` + `Continue with the next_cursor page${params.include_bodies === true ? ", or drop --include-bodies to fit more rows per page" : ""}. Orphan/duplicate analysis covers this page only.`);
+  } else if (capped.reason === "span_limit" && capped.nextCursor) {
+    warnings.push(`Spans were capped: the page reached the server's per-page span cap after ${capped.rows} ingest row(s), so this trace has more spans than the ${capped.spans} shown. ` + "Continue with the next_cursor page. Orphan/duplicate analysis covers this page only.");
+  } else if (capped.rowsCapped) {
+    const bigger = Math.min(AUDIT_MAX_LIMIT, limit * 5);
+    warnings.push(`Spans were capped: read ${capped.rows} ingest row(s), the --limit=${limit} maximum, so this trace ${capped.hasMoreKnown ? "has" : "may have"} more spans than the ${capped.spans} shown. ` + (capped.nextCursor ? "Page on with the next_cursor command, or " : "") + (limit < AUDIT_MAX_LIMIT ? `${capped.nextCursor ? "rerun" : "Rerun"} with --limit=${bigger} (max ${AUDIT_MAX_LIMIT}), or ${perTrace}.` : capped.nextCursor ? `${perTrace}.` : `${perTrace[0].toUpperCase()}${perTrace.slice(1)}.`));
+    if (limit < AUDIT_MAX_LIMIT && !params.cursor) {
+      nextCommands.push({ command: auditFlags([`--limit=${bigger}`]), purpose: "Read more ingest rows of this trace.", mutability: "read", requires_approval: false });
+    }
+  } else {
+    warnings.push(`Spans were capped: the server returned ${capped.spans} span(s) and marked the response truncated. ${perTrace[0].toUpperCase()}${perTrace.slice(1)}.`);
+  }
+  return {
+    data: { ...auditRecord, truncated: true, has_more: capped.rowsCapped, next_cursor: capped.nextCursor },
+    options: { warnings, ...nextCommands.length > 0 ? { nextCommands } : {} }
+  };
 }
 var TAIL_SEEN_MAX = 5000;
 var EMOTIONS_TAIL_PAGE_SIZE = 20;
@@ -8755,7 +8914,7 @@ var HAND_PARSED_COMMAND_FLAGS = {
     "tool-use-id"
   ],
   "false-positives": ["all", "kind", "limit"],
-  feedback: ["category", "severity", "cluster-id", "conversation-id", "run-id", "tool-name"],
+  feedback: FEEDBACK_FLAGS,
   "problem-impact": ["mode", "node-id", "problem-id", "run-id", "to", "cursor", "conversation-ids", "days-back"]
 };
 var NO_POSITIONAL_COMMANDS = new Set([
@@ -8786,9 +8945,16 @@ function assertHandParsedFlags(command, flags, positionals) {
   const allowed = HAND_PARSED_COMMAND_FLAGS[command];
   if (!allowed)
     return;
+  const checked = command === "feedback" ? Object.keys(flags).filter((flag2) => !isFeedbackRefFlag(flag2)) : Object.keys(flags);
   const shape = z2.object(Object.fromEntries(allowed.map((flag2) => [flag2.replace(/-/g, "_"), z2.unknown()])));
-  const args = Object.fromEntries(Object.keys(flags).map((flag2) => [flag2.replace(/-/g, "_"), true]));
-  parseCommandFlags(shape.passthrough(), args, command);
+  const args = Object.fromEntries(checked.map((flag2) => [flag2.replace(/-/g, "_"), true]));
+  try {
+    parseCommandFlags(shape.passthrough(), args, command);
+  } catch (error) {
+    if (command !== "feedback" || !(error instanceof CliInputError))
+      throw error;
+    throw new CliInputError(/nothing was sent/i.test(error.message) ? error.message : `${error.message} Nothing was sent.`, `${error.usage ?? ""} Id flags (--<name>-id=ID) are attached as refs; put other detail in the note. ${FEEDBACK_USAGE}`.trim());
+  }
 }
 var PROFILE_MANAGING_COMMANDS = new Set(["profiles", "auth", "init", "provision", "status", "config", "keys", "manifest", "agent", "doctor"]);
 async function runProblemsRemainder(flags, context) {
@@ -8947,7 +9113,7 @@ async function readFullTranscript(conversationId, opts = {}) {
       out.push(`Message order may not be chronological: ${tied} of ${total} messages share a timestamp with another message ` + `(ordered by id, not time)${synthetic > 0 ? ` and ${synthetic} carry a synthetic pre-2022 timestamp` : ""}.`);
     }
     if (returned.some(isTruncated)) {
-      out.push(`Message text, tool-call inputs and tool results longer than ${CONTEXT_MESSAGE_TRUNCATE_CHARS} characters are truncated by the context endpoint. ` + "For full raw content (prompts, tool arguments/results) use `moda audit <conversation_id> --include-raw`.");
+      out.push(`Message text, tool-call inputs and tool results longer than ${CONTEXT_MESSAGE_TRUNCATE_CHARS} characters are truncated by the context endpoint. ` + "For full content (prompts, tool arguments/results) use `moda audit <conversation_id> --include-bodies` (or `--include-raw` for the verbatim events).");
     }
     return {
       data: stripLoneSurrogates({
@@ -9258,7 +9424,7 @@ async function runCommand(command, positional, flags, positionals = positional ?
     case "audit":
     case "trace": {
       if (!positional) {
-        throw new CliInputError("<conversation_id|trace_id> is required", "Usage: moda audit <conversation_id|trace_id> [--kind=auto|trace|conversation] [--include-raw] [--limit=N]");
+        throw new CliInputError("<conversation_id|trace_id> is required", "Usage: moda audit <conversation_id|trace_id> [--kind=auto|trace|conversation] [--include-raw] [--include-bodies] [--limit=N] [--cursor=<next_cursor>]");
       }
       const args = flagsToArgs(flags, "id", positional);
       const params = parseCommandFlags(AuditSchema, args, command, { positionalKey: "id" });
@@ -9267,36 +9433,26 @@ async function runCommand(command, positional, flags, positionals = positional ?
         query2.set("kind", params.kind);
       if (params.include_raw === true)
         query2.set("include_raw", "1");
+      if (params.include_bodies === true)
+        query2.set("include_bodies", "1");
       if (params.limit)
         query2.set("limit", params.limit.toString());
-      const queryString = query2.toString() ? `?${query2.toString()}` : "";
-      const data = await callDataAPI(`/audit/${encodeURIComponent(params.id)}${queryString}`);
-      const capped = auditCapStatus(data, params.limit ?? AUDIT_DEFAULT_LIMIT);
-      const auditRecord = asRecord(data);
-      if (!capped || !auditRecord) {
-        context.output.writeData(auditRecord ? { ...auditRecord, truncated: false, has_more: false } : data);
-        break;
-      }
-      const limit = params.limit ?? AUDIT_DEFAULT_LIMIT;
-      const perTrace = "audit one OTLP trace at a time with `moda audit <trace_id> --kind=trace` (ids in summary.trace_ids)";
-      const warnings = [];
-      const nextCommands = [];
-      if (capped.rowsCapped) {
-        const bigger = Math.min(AUDIT_MAX_LIMIT, limit * 5);
-        warnings.push(`Spans were capped: read ${capped.rows} ingest row(s), the --limit=${limit} maximum, so this trace ${capped.hasMoreKnown ? "has" : "may have"} more spans than the ${capped.spans} shown. ` + (limit < AUDIT_MAX_LIMIT ? `Rerun with --limit=${bigger} (max ${AUDIT_MAX_LIMIT}), or ${perTrace}.` : `${perTrace[0].toUpperCase()}${perTrace.slice(1)}.`));
-        if (limit < AUDIT_MAX_LIMIT) {
-          const rerun = [
-            `moda ${command} ${shellArg(params.id)}`,
-            params.kind && params.kind !== "auto" ? `--kind=${params.kind}` : "",
-            params.include_raw === true ? "--include-raw" : "",
-            `--limit=${bigger}`
-          ].filter(Boolean).join(" ");
-          nextCommands.push({ command: rerun, purpose: "Read more ingest rows of this trace.", mutability: "read", requires_approval: false });
-        }
-      } else {
-        warnings.push(`Spans were capped: the server returned ${capped.spans} span(s) and marked the response truncated. ${perTrace[0].toUpperCase()}${perTrace.slice(1)}.`);
+      if (params.cursor)
+        query2.set("cursor", params.cursor);
+      const agentMode = context.output.mode === "agent" || context.output.mode === "agent-stream";
+      let maxBytes = agentMode ? Math.max(AUDIT_MIN_PAGE_BYTES, agentMaxOutputBytes() - AUDIT_AGENT_RESERVE_BYTES) : undefined;
+      let page = auditOutput(command, params, await fetchAudit(params.id, query2, maxBytes));
+      while (maxBytes !== undefined && maxBytes > AUDIT_MIN_PAGE_BYTES && !agentEnvelopeFits(command, page.data, page.options)) {
+        maxBytes = Math.max(AUDIT_MIN_PAGE_BYTES, Math.floor(maxBytes / 2));
+        page = auditOutput(command, params, await fetchAudit(params.id, query2, maxBytes));
+      }
+      if (maxBytes !== undefined && !agentEnvelopeFits(command, page.data, page.options)) {
+        page.options.warnings = [
+          ...page.options.warnings ?? [],
+          "This page is a single ingest row larger than the agent output budget, so some of its spans are cut from this output. " + "Rerun this command with --json (no byte limit) or a higher MODA_AGENT_MAX_OUTPUT_BYTES to see the whole row before following next_cursor."
+        ];
       }
-      context.output.writeData({ ...auditRecord, truncated: true, has_more: capped.rowsCapped }, { warnings, ...nextCommands.length > 0 ? { nextCommands } : {} });
+      context.output.writeData(page.data, page.options);
       break;
     }
     case "frustrations": {
@@ -9886,30 +10042,7 @@ async function runCommand(command, positional, flags, positionals = positional ?
       break;
     }
     case "feedback": {
-      const note = positionals.join(" ").trim();
-      if (note === "") {
-        throw new CliInputError("<note> is required", `Usage: moda feedback "<note>" [--category=${FEEDBACK_CATEGORIES.join("|")}] [--severity=${FEEDBACK_SEVERITIES.join("|")}] [--conversation-id=ID] [--cluster-id=ID] [--tool-name=NAME] [--run-id=ID]`);
-      }
-      const params = FeedbackSchema.parse({
-        note,
-        ...flags.category !== undefined ? { category: flags.category } : {},
-        ...flags.severity !== undefined ? { severity: flags.severity } : {},
-        ...flags["conversation-id"] !== undefined ? { conversation_id: flags["conversation-id"] } : {},
-        ...flags["cluster-id"] !== undefined ? { cluster_id: flags["cluster-id"] } : {},
-        ...flags["tool-name"] !== undefined ? { tool_name: flags["tool-name"] } : {},
-        ...flags["run-id"] !== undefined ? { run_id: flags["run-id"] } : {}
-      });
-      const refs = {};
-      if (params.conversation_id)
-        refs.conversation_id = params.conversation_id;
-      if (params.cluster_id)
-        refs.cluster_id = params.cluster_id;
-      if (params.tool_name)
-        refs.tool_name = params.tool_name;
-      if (params.run_id)
-        refs.run_id = params.run_id;
-      const category = params.category ?? "other";
-      const severity = params.severity ?? "low";
+      const { category, severity, note, refs, warnings } = buildFeedbackRequest(positionals, flags, context.bareFlags);
       const data = await callDataAPI("/feedback", {
         method: "POST",
         body: JSON.stringify({
@@ -9918,11 +10051,14 @@ async function runCommand(command, positional, flags, positionals = positional ?
           source: "cli",
           agent: detectCallerAgent(process.env),
           cli_version: VERSION,
-          note: params.note,
+          note,
           ...Object.keys(refs).length > 0 ? { refs } : {}
         })
       }, { retries: 0 });
-      context.output.writeData({ submitted: true, category, severity, ...asRecord(data) ?? {} }, { summary: "Feedback submitted. Thank you for helping us improve!" });
+      context.output.writeData({ submitted: true, category, severity, ...asRecord(data) ?? {} }, {
+        summary: "Feedback submitted. Thank you for helping us improve!",
+        ...warnings.length > 0 ? { warnings } : {}
+      });
       break;
     }
     default:
@@ -10027,7 +10163,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result",
     handler: async (context) => {
-      const { runInit } = await import("./index-bcn5chmf.js");
+      const { runInit } = await import("./index-pdg9t77n.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",
@@ -10068,7 +10204,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result-and-error",
     handler: async (context) => {
-      const { runProvision } = await import("./provision-mqw8s0jb.js");
+      const { runProvision } = await import("./provision-7fhbgk2d.js");
       return runProvision(context, {
         resumeCommand: buildResumeCommand("provision", context.rawFlags)
       });
@@ -10545,7 +10681,9 @@ var commandRegistry = createCommandRegistry([
       "moda audit <conversation_id|trace_id>",
       "moda audit <trace_id> --kind=trace --json",
       "moda audit <conversation_id> --include-raw",
-      "moda audit <conversation_id> --limit=1000   # ingest rows to read (default 200, max 1000); warns when capped"
+      "moda audit <conversation_id> --include-bodies   # keep prompt/response bodies (omitted by default; long strings truncated)",
+      "moda audit <conversation_id> --limit=1000   # ingest rows to read (default 200, max 1000); warns when capped",
+      "moda audit <conversation_id> --cursor=<next_cursor>   # next page of a capped audit"
     ],
     ...dataApiDefaults
   }),
@@ -10769,7 +10907,8 @@ var commandRegistry = createCommandRegistry([
     description: "Flag wrong/missing data or CLI quirks to the Moda team",
     examples: [
       'moda feedback "cluster label looks wrong" --category=bad_cluster_label --cluster-id=<node_id>',
-      'moda feedback "search finds nothing for a trace I can open" --category=missing_data --conversation-id=<id>'
+      'moda feedback "search finds nothing for a trace I can open" --category=missing_data --conversation-id=<id>',
+      'moda feedback "trace is about refunds, not this problem" --category=false_positive_attribution --problem-id=<id> --conversation-id=<id>'
     ],
     ...dataApiDefaults,
     mutability: "write"
@@ -10972,6 +11111,15 @@ function printCliError(error) {
 ${issues.join(`
 `)}
 `);
+  } else if (error instanceof ApiError && error.readable) {
+    safeWriteStderr(`${error.message}
+`);
+    if (error.suggestions?.length) {
+      safeWriteStderr(`Try:
+${error.suggestions.map((s) => `  ${s}`).join(`
+`)}
+`);
+    }
   } else if (error instanceof ApiError) {
     safeWriteStderr(`API error (HTTP ${error.statusCode}): ${error.responseBody || error.message}
 `);

package/dist/{harness-9qpbj2qj.js → harness-4ypeg9dh.js}

@@ -42,8 +42,8 @@ import {
   writeHarnessAnalyzeResult,
   writeHarnessArtifacts,
   writeHumanProgress
-} from "./cli-3xh2w7hb.js";
-import"./cli-bvnw7585.js";
+} from "./cli-m3bg9yyh.js";
+import"./cli-bqhs6sk7.js";
 import"./cli-0v6na3yp.js";
 export {
   writeHumanProgress,

package/dist/{harness-github-actions-ky4ym5n3.js → harness-github-actions-dvq7spqh.js}

@@ -1,7 +1,7 @@
 import {
   buildSourceSnapshot
-} from "./cli-3xh2w7hb.js";
-import"./cli-bvnw7585.js";
+} from "./cli-m3bg9yyh.js";
+import"./cli-bqhs6sk7.js";
 import"./cli-0v6na3yp.js";
 
 // src/harness-github-actions.ts

package/dist/{index-bcn5chmf.js → index-pdg9t77n.js}

@@ -3,7 +3,7 @@ import {
   initPrompts,
   runPromptSync,
   runSkillSync
-} from "./cli-nnwegmzh.js";
+} from "./cli-6xndg2h4.js";
 import {
   codingAgentDisplayName,
   describeCodingAgentEvent,
@@ -22,7 +22,7 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-3xh2w7hb.js";
+} from "./cli-m3bg9yyh.js";
 import {
   bundledSkillsDir,
   installIntegrationSkill,
@@ -34,14 +34,14 @@ import {
 } from "./cli-ssfq84k5.js";
 import {
   selectTenantAndCreateKey
-} from "./cli-phgzghwq.js";
+} from "./cli-taf854xx.js";
 import {
   ConnectCodeError,
   connectWithCode,
   loadAuthSession,
   loadToken,
   login
-} from "./cli-dy2aavbe.js";
+} from "./cli-c64d2jrw.js";
 import {
   CliAuthError,
   CliInputError,
@@ -49,7 +49,7 @@ import {
   createCommandContext,
   resolveIngestUrl,
   resolveModaBaseUrl
-} from "./cli-bvnw7585.js";
+} from "./cli-bqhs6sk7.js";
 import"./cli-0v6na3yp.js";
 
 // src/init/index.ts
@@ -604,6 +604,11 @@ function hasUnexpectedAuditDuplicates(value) {
     return new Set(calls).size !== calls.length;
   });
 }
+function promptHasSystemMessage(prompt) {
+  if (Array.isArray(prompt))
+    return prompt.some((message) => isRecord2(message) && message.role === "system");
+  return isRecord2(prompt) && prompt.reason === "row_payload_cap" && Array.isArray(prompt.roles) && prompt.roles.includes("system");
+}
 function completeAI7Projection(value) {
   if (!isAI7Audit(value))
     return true;
@@ -612,7 +617,7 @@ function completeAI7Projection(value) {
   const spans = value.spans.filter(isRecord2);
   for (const span of spans.filter((span2) => span2.type === "llm")) {
     if (isRecord2(span.attributes) && span.attributes["gen_ai.system_instructions"]) {
-      if (!Array.isArray(span.prompt) || !span.prompt.some((message) => isRecord2(message) && message.role === "system"))
+      if (!promptHasSystemMessage(span.prompt))
         return false;
     }
   }
@@ -632,7 +637,7 @@ function completeAI7Projection(value) {
   return expected.every((id) => typeof id === "string") && actual.every((id) => typeof id === "string") && new Set(actual).size === actual.length && expected.length === actual.length && expected.every((id) => actual.includes(id));
 }
 async function fetchAuditWithApiKey(id, apiKey, baseUrl) {
-  const url = `${baseUrl}/api/v1/data/audit/${encodeURIComponent(id)}?kind=conversation`;
+  const url = `${baseUrl}/api/v1/data/audit/${encodeURIComponent(id)}?kind=conversation&include_bodies=1`;
   const response = await fetch(url, {
     method: "GET",
     headers: { "x-api-key": apiKey },

package/dist/prompt-source-mcp.js

@@ -5,8 +5,8 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors,
   safePromptEvidencePath
-} from "./cli-3xh2w7hb.js";
-import"./cli-bvnw7585.js";
+} from "./cli-m3bg9yyh.js";
+import"./cli-bqhs6sk7.js";
 import {
   __commonJS,
   __toESM

package/dist/{provision-mqw8s0jb.js → provision-7fhbgk2d.js}

@@ -1,15 +1,15 @@
 import {
   selectTenantAndCreateKey
-} from "./cli-phgzghwq.js";
+} from "./cli-taf854xx.js";
 import {
   loadAuthSession
-} from "./cli-dy2aavbe.js";
+} from "./cli-c64d2jrw.js";
 import {
   CliAuthError,
   resolveIngestUrl,
   resolveModaBaseUrl,
   stringOption
-} from "./cli-bvnw7585.js";
+} from "./cli-bqhs6sk7.js";
 import"./cli-0v6na3yp.js";
 
 // src/provision.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.45.3",
+  "version": "1.49.0",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {
@@ -56,6 +56,7 @@
     "@modelcontextprotocol/sdk": "^1.30.0"
   },
   "devDependencies": {
+    "@moda/database": "*",
     "@moda/eslint-config": "*",
     "@moda/harness-snapshot": "*",
     "@moda/integration-skills": "*",

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-10T04:37:09.232Z",
-  "cli_version": "1.45.3",
+  "bundled_at": "2026-10-10T08:40:09.772Z",
+  "cli_version": "1.49.0",
   "skills": [
     {
       "id": "integration-cloudflare-think",

package/skills/moda-cli/SKILL.md

@@ -652,13 +652,23 @@ tool calls, prompt/response bodies, and `gen_ai.*` attributes — use `moda audi
 moda audit <conversation_id|trace_id>         # auto-detects OTLP trace_id vs trace ID (conversation_id)
 moda audit <trace_id> --kind=trace            # force OTLP trace_id lookup
 moda audit <conversation_id> --include-raw    # attach verbatim raw_event bodies
+moda audit <conversation_id> --include-bodies # keep prompt/response/attribute bodies
 moda audit <conversation_id> --limit=1000     # ingest rows to read (default 200, max 1000)
+moda audit <conversation_id> --cursor=<next_cursor>  # next page of a capped audit
 ```
 
 `truncated` / `has_more` at the top level say whether the audit is complete.
-A full `--limit` page of ingest rows (or a server span cap) sets both, and a
-warning plus `next_commands` give the rerun; for very large traces audit one
-OTLP trace at a time (`summary.trace_ids`, `--kind=trace`).
+A full `--limit` page of ingest rows, the server's ~3 MB response budget
+(`summary.truncated_reason: "byte_limit"`) or a span cap sets both, and a
+warning plus `next_commands` give the follow-up — usually the `--cursor=` page
+from `next_cursor`; for very large traces audit one OTLP trace at a time
+(`summary.trace_ids`, `--kind=trace`). Prompt/response bodies are omitted by
+default (`{"omitted": true, "original_bytes": N}`); `--include-bodies` keeps
+them, cutting strings over 8 KB to `{"truncated": true, "original_bytes": N,
+"preview": …}`. Ingest rows whose stored payload is too large carry
+`payload_capped: true`: their spans keep ids, hierarchy, timing and types but
+no bodies. A trace too large to audit at all fails fast with an
+`audit_too_large` error whose `suggested_commands` list per-trace audits.
 
 Returns the raw, NON-deduped span set from the Layer-0 store (`events_raw`), so
 nothing is collapsed. Use it to verify capture completeness: the `summary` gives
@@ -1186,15 +1196,30 @@ moda feedback "search finds nothing for a trace I can open" \
   --category=missing_data --conversation-id=<id>
 moda feedback "a cancelled call is counted as a tool failure" \
   --category=wrong_tool_failure --tool-name=<tool>
+moda feedback "trace is a refund request, not this problem" \
+  --category=false_positive_attribution --problem-id=<id> --conversation-id=<id>
 ```
 
-- `<note>` is required (max 4000 chars). Say what looked wrong and why.
+- `<note>` is required (max 4000 chars), as the argument or `--note=TEXT`.
+  Say what looked wrong and why.
 - `--category`: `bad_cluster_label | mismatched_frustration | missing_data |
-  noisy_data | wrong_tool_failure | incorrect_loop | api_quirk | other`
-  (default `other`).
+  noisy_data | wrong_tool_failure | incorrect_loop | api_quirk |
+  false_positive_attribution | misrouted_fix | harness_bug | other`
+  (default `other`). Use `false_positive_attribution` when a trace is
+  attributed to the wrong problem, `misrouted_fix` when a fix targets the
+  wrong problem or file, and `harness_bug` for a bug in the agent harness
+  Moda analysed. An unknown category is still sent, as `other` with
+  `refs.raw_category`, and a warning lists the valid ones.
 - `--severity`: `info | low | medium | high` (default `low`).
 - Attach ids when you have them: `--conversation-id`, `--cluster-id`,
-  `--tool-name`, `--run-id`; they let the team reproduce what you saw.
+  `--tool-name`, `--run-id`, or any other `--<name>-id` (`--problem-id`,
+  `--fix-id`, `--attribution-id`, `--trace-id`, `--span-id`,
+  `--message-index`); they go into `refs` and let the team reproduce what
+  you saw.
+- Feedback does not change the problem itself. To act on a misroute directly,
+  use `moda problem-feedback <problem_id> --action=flag_attribution
+  --attribution-id=<uuid> --reason=TEXT`, `moda false-positive <kind> <target>
+  --reason=TEXT`, or `moda fix dismiss <fix_id> --reason=TEXT`.
 - Never include secrets or full transcripts in the note.
 
 ## Validation — how to know it worked