@moda-ai/cli 1.55.11 → 1.55.13

package/dist/{agent-n0ch2j90.js → agent-rd9deae9.js}

@@ -1,8 +1,8 @@
 import {
   buildDoctorReport
-} from "./cli-11fevr8y.js";
-import"./cli-t4jjhn3g.js";
-import"./cli-fq7kk77e.js";
+} from "./cli-34zdvcpg.js";
+import"./cli-ssqb8bfw.js";
+import"./cli-90hb4ng0.js";
 import"./cli-mm48br00.js";
 import {
   HARNESS_REPORT_APPROVAL_PATH,
@@ -14,19 +14,19 @@ import {
   readHarnessSyncState,
   summarizeHarness,
   validateHarnessReport
-} from "./cli-m857n028.js";
+} from "./cli-m0fa54ny.js";
 import"./cli-97fnztpy.js";
-import"./cli-k5qqj2bp.js";
-import"./cli-g7ferymy.js";
-import"./cli-tmqd1f0m.js";
-import"./cli-m16taf4z.js";
+import"./cli-4x9w6ey7.js";
+import"./cli-k7vwt56h.js";
+import"./cli-ryd7nzke.js";
+import"./cli-09rr5smg.js";
 import {
   CliInputError,
   resolveApiKey,
   resolveIngestUrl,
   resolveModaBaseUrl,
   resolveTenantId
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 import"./cli-0v6na3yp.js";
 
 // src/agent.ts

package/dist/{cli-m16taf4z.js → cli-09rr5smg.js}

@@ -1,6 +1,6 @@
 import {
   resolveTenantId
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 
 // src/api-key-headers.ts
 var PLATFORM_API_KEY_PREFIX = "moda_pk_";

package/dist/{cli-11fevr8y.js → cli-34zdvcpg.js}

@@ -1,19 +1,19 @@
 import {
   isAuthSessionValid,
   loadAuthSession
-} from "./cli-t4jjhn3g.js";
+} from "./cli-ssqb8bfw.js";
 import {
   inspectPromptManifest
-} from "./cli-fq7kk77e.js";
+} from "./cli-90hb4ng0.js";
 import {
   readHarnessSyncState,
   renderDoctorHuman,
   renderStatusHuman,
   scanHarness
-} from "./cli-m857n028.js";
+} from "./cli-m0fa54ny.js";
 import {
   callDataAPI
-} from "./cli-tmqd1f0m.js";
+} from "./cli-ryd7nzke.js";
 import {
   ensureSecretFilePermissions,
   getActiveProfile,
@@ -27,7 +27,7 @@ import {
   resolveSecretReference,
   resolveTenantId,
   secretFilePathFromRef
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 
 // src/doctor.ts
 import { createHash } from "node:crypto";

package/dist/{cli-k5qqj2bp.js → cli-4x9w6ey7.js}

@@ -1,7 +1,7 @@
 import {
   createCliOutput,
   outputModeFromFlags
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 
 // src/command-context.ts
 function flagEnabled(flags, key) {

package/dist/{cli-fq7kk77e.js → cli-90hb4ng0.js}

@@ -12,28 +12,28 @@ import {
   require_typescript,
   resolvePromptSource,
   safePromptEvidencePath
-} from "./cli-m857n028.js";
+} from "./cli-m0fa54ny.js";
 import {
   createCommandContext
-} from "./cli-k5qqj2bp.js";
+} from "./cli-4x9w6ey7.js";
 import {
   assertFlags,
   assertPositionals
-} from "./cli-g7ferymy.js";
+} from "./cli-k7vwt56h.js";
 import {
   callControlAPI,
   callDataAPI
-} from "./cli-tmqd1f0m.js";
+} from "./cli-ryd7nzke.js";
 import {
   setPlatformTenantOverride
-} from "./cli-m16taf4z.js";
+} from "./cli-09rr5smg.js";
 import {
   CliInputError,
   EXIT_ERROR,
   EXIT_OK,
   resolveApiTenantId,
   validateConfig
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 import {
   __commonJS,
   __require,
@@ -6731,7 +6731,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-jbqpbp6n.js");
+    const { analyzeHarnessPrompts } = await import("./harness-9psndqtm.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),
@@ -7061,7 +7061,7 @@ async function migratePromptManifest(options = {}) {
   let addedSources = [];
   let pendingSources = [];
   if (options.discover) {
-    const { analyzeHarnessPrompts } = await import("./harness-jbqpbp6n.js");
+    const { analyzeHarnessPrompts } = await import("./harness-9psndqtm.js");
     const result = await analyzeHarnessPrompts({
       rootDir: root,
       existing: manifest.sources,

package/dist/{cli-n9gexgma.js → cli-bfmn3bsk.js}

@@ -1,7 +1,7 @@
 import {
   authFetch,
   getCachedLoginContext
-} from "./cli-t4jjhn3g.js";
+} from "./cli-ssqb8bfw.js";
 import {
   CliAccessError,
   CliInputError,
@@ -16,7 +16,7 @@ import {
   resolveTenantIdFromActiveProfile,
   saveCliConfig,
   writeSecretJsonFile
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 
 // src/init/tenant.ts
 import { randomUUID } from "node:crypto";

package/dist/{cli-g7ferymy.js → cli-k7vwt56h.js}

@@ -2,18 +2,18 @@ import {
   ApiError,
   callControlAPI,
   callDataAPI
-} from "./cli-tmqd1f0m.js";
+} from "./cli-ryd7nzke.js";
 import {
   isPlatformApiKey,
   setPlatformTenantOverride
-} from "./cli-m16taf4z.js";
+} from "./cli-09rr5smg.js";
 import {
   CliAccessError,
   CliInputError,
   embeddedTenantIdFromApiKey,
   resolveApiKey,
   resolveApiTenantId
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 
 // src/parity-commands.ts
 import { readFileSync } from "node:fs";

package/dist/{cli-429zt7g4.js → cli-kwz900s4.js}

@@ -576,6 +576,19 @@ class CliAuthError extends Error {
   usage;
 }
 
+class CliNotFoundError extends Error {
+  entity;
+  id;
+  usage;
+  constructor(entity, id, message, usage) {
+    super(message ?? `No ${entity} found for id "${id}" in this tenant.`);
+    this.entity = entity;
+    this.id = id;
+    this.usage = usage;
+    this.name = "CliNotFoundError";
+  }
+}
+
 class CliCancellationError extends Error {
   constructor(message) {
     super(message);
@@ -588,6 +601,12 @@ function isNetworkLikeError(error) {
 function isApiLikeError(error) {
   return error instanceof Error && (error.name === "ApiError" || ("statusCode" in error) && typeof error.statusCode === "number");
 }
+function apiErrorStatus(error) {
+  if (!isApiLikeError(error))
+    return;
+  const status = error.statusCode;
+  return typeof status === "number" ? status : undefined;
+}
 
 // src/config.ts
 import { readFileSync as readFileSync2 } from "node:fs";
@@ -640,9 +659,9 @@ function resolveModaBaseUrl(options = {}) {
 }
 function validateConfig() {
   if (!resolveApiKey()) {
-    throw new CliAuthError('No Moda API key found. Set MODA_API_KEY or run "moda init".', {
+    throw new CliAuthError('No Moda API key found. Set MODA_API_KEY=moda_sk_... in the environment, save one with "moda auth login --api-key", or run "moda init" for interactive setup.', {
       reason: "no_stored_credentials",
-      login_command: ["moda", "init"]
+      login_command: ["moda", "auth", "login", "--api-key"]
     }, "Get your API key from https://moda.dev/settings");
   }
 }
@@ -1004,9 +1023,16 @@ import { randomUUID } from "node:crypto";
 import { lstatSync, mkdirSync as mkdirSync2, readdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join2 } from "node:path";
+var agentUpdateNotice;
+function setAgentUpdateNotice(notice) {
+  agentUpdateNotice = notice;
+}
+function resolveAgentUpdateNotice() {
+  return typeof agentUpdateNotice === "function" ? agentUpdateNotice() : agentUpdateNotice;
+}
 var AGENT_SCHEMA_VERSION = "moda.agent.v1";
 var AGENT_EVENT_SCHEMA_VERSION = "moda.agent_event.v1";
-var FEEDBACK_TIP = 'Help us improve! If a result in this response looks wrong or is missing data, flag it: moda feedback "<describe what looked wrong>" [--category=...] [--conversation-id=... | --cluster-id=... | --tool-name=...]. Only submit genuine observations.';
+var FEEDBACK_TIP = 'If a result looks wrong or is missing data: moda feedback "<what looked wrong>"';
 var EXIT_OK = 0;
 var EXIT_ERROR = 1;
 var EXIT_DEGRADED = 3;
@@ -1024,7 +1050,8 @@ var AGENT_ERROR_CODES = [
   "access_denied",
   "unknown_error",
   "cloud_unavailable",
-  "output_error"
+  "output_error",
+  "not_found"
 ];
 var FALLBACK_RUN_ID = randomUUID();
 var fallbackSeq = 0;
@@ -1139,8 +1166,10 @@ function createCliOutput(options) {
     startedAt: Date.now(),
     lastEventAt: Date.now()
   };
-  const emitEvent = (event) => {
-    if (options.quiet || options.mode !== "agent-stream")
+  const emitEvent = (event, { bypassQuiet = false } = {}) => {
+    if (options.mode !== "agent-stream")
+      return;
+    if (options.quiet && !bypassQuiet)
       return;
     if (state.terminal)
       return;
@@ -1156,16 +1185,19 @@ function createCliOutput(options) {
     safeWriteStdout(`${JSON.stringify(createAgentEvent(options.command, event, state))}
 `);
   };
-  const ensureStarted = () => {
-    if (options.mode !== "agent-stream" || state.started || options.quiet)
+  const ensureStarted = ({ bypassQuiet = false } = {}) => {
+    if (options.mode !== "agent-stream" || state.started)
+      return;
+    if (options.quiet && !bypassQuiet)
       return;
-    startHeartbeat(options.command, state);
+    if (!options.quiet)
+      startHeartbeat(options.command, state);
     emitEvent({
       event: "started",
       phase: options.command,
       message: `Starting ${options.command}.`,
       elapsed_ms: 0
-    });
+    }, { bypassQuiet });
   };
   const writeEnvelope = (data, writeOptions = {}) => {
     return createAgentEnvelope({
@@ -1175,7 +1207,8 @@ function createCliOutput(options) {
       meta: {
         ...writeOptions.meta ?? {},
         run_id: state.runId,
-        ...options.command === "feedback" ? {} : { tip: FEEDBACK_TIP }
+        ...options.command === "feedback" ? {} : { tip: FEEDBACK_TIP },
+        ...((update) => update ? { update } : {})(resolveAgentUpdateNotice())
       },
       summary: writeOptions.summary,
       findings: writeOptions.findings,
@@ -1235,12 +1268,12 @@ function createCliOutput(options) {
       emitEvent(event);
     },
     writeError(error) {
-      if (options.quiet || state.terminal)
+      if (state.terminal)
         return;
       const agentError = errorToAgentError(error);
       const envelope = createAgentErrorEnvelope(options.command || "unknown", agentError, state.runId, errorWarnings(error));
       if (options.mode === "agent-stream") {
-        ensureStarted();
+        ensureStarted({ bypassQuiet: true });
         if (error instanceof CliInputRequiredError) {
           emitEvent({
             event: "needs_input",
@@ -1249,18 +1282,18 @@ function createCliOutput(options) {
             error: agentError,
             input_request: error.input_request,
             result: envelope
-          });
+          }, { bypassQuiet: true });
           return;
         }
-        if (error instanceof CliAuthError) {
+        if (error instanceof CliAuthError || agentError.code === "auth_required") {
           emitEvent({
             event: "auth_required",
             status: "error",
-            message: error.message,
+            message: agentError.message,
             error: agentError,
-            auth: error.auth,
+            auth: error instanceof CliAuthError ? error.auth : agentError.auth,
             result: envelope
-          });
+          }, { bypassQuiet: true });
           return;
         }
         if (error instanceof CliCancellationError) {
@@ -1270,7 +1303,7 @@ function createCliOutput(options) {
             message: error.message,
             error: agentError,
             result: envelope
-          });
+          }, { bypassQuiet: true });
           return;
         }
         emitEvent({
@@ -1279,7 +1312,7 @@ function createCliOutput(options) {
           message: agentError.message,
           error: agentError,
           result: envelope
-        });
+        }, { bypassQuiet: true });
         return;
       }
       if (options.mode === "agent" || options.mode === "json") {
@@ -1549,6 +1582,20 @@ function formatValidationMessage(error) {
   });
   return `Validation error — ${[...new Set(parts)].join("; ")}`;
 }
+var API_KEY_RECOVERY = "Set MODA_API_KEY=moda_sk_... in the environment, or save one with `moda auth login --api-key` (reads MODA_API_KEY or --api-key-stdin). Keys: https://moda.dev/settings";
+function serverErrorMessage(error) {
+  const body = error.responseBody;
+  if (typeof body !== "string" || !body.trimStart().startsWith("{"))
+    return;
+  try {
+    const message = JSON.parse(body).message;
+    if (typeof message === "string" && message.trim())
+      return message.trim().replace(/\.$/, "");
+    if (Array.isArray(message))
+      return message.filter((m) => typeof m === "string").join("; ") || undefined;
+  } catch {}
+  return;
+}
 function errorToAgentError(error) {
   if (error instanceof CliInputRequiredError) {
     return {
@@ -1580,6 +1627,15 @@ function errorToAgentError(error) {
       blocking: true
     };
   }
+  if (error instanceof CliNotFoundError) {
+    return {
+      code: "not_found",
+      message: error.message,
+      cause: error.usage,
+      suggested_commands: error.usage ? extractSuggestedCommands(error.usage) : undefined,
+      blocking: true
+    };
+  }
   if (error instanceof CliAccessError) {
     return {
       code: "access_denied",
@@ -1598,6 +1654,24 @@ function errorToAgentError(error) {
         blocking: true
       };
     }
+    if (apiErrorStatus(error) === 401) {
+      return {
+        code: "auth_required",
+        message: "The Moda API rejected the API key (HTTP 401): it is invalid, revoked, or for another environment.",
+        cause: API_KEY_RECOVERY,
+        suggested_commands: ["moda auth login --api-key", "moda auth status --online"],
+        auth: { reason: "api_key_rejected", login_command: ["moda", "auth", "login", "--api-key"] },
+        blocking: true
+      };
+    }
+    if (apiErrorStatus(error) === 403) {
+      return {
+        code: "access_denied",
+        message: `The Moda API refused this request (HTTP 403): ${serverErrorMessage(error) ?? "the API key does not allow it"}.`,
+        cause: "Read-only keys cannot run writes, and organization keys cannot select another tenant. Use a key with the needed access.",
+        blocking: true
+      };
+    }
     if (isApiLikeError(error)) {
       const statusCode = "statusCode" in error ? error.statusCode : undefined;
       const typedCode = "code" in error && typeof error.code === "string" ? error.code : undefined;
@@ -1871,4 +1945,4 @@ function extractSuggestedCommands(text) {
   return commands.length > 0 ? commands : undefined;
 }
 
-export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, describeBaseUrlSource, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, CliAccessError, CliInputRequiredError, CliAuthError, CliCancellationError, isNetworkLikeError, isApiLikeError, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveApiTenantId, resolveModaBaseUrl, validateConfig, recordApiRequest, getApiRequestCount, resetApiRequestCount, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, explicitOutputMode, outputModeFromFlags, resolveOutputMode, createCliOutput, agentEnvelopeFits, agentMaxOutputBytes };
+export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, describeBaseUrlSource, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, CliAccessError, CliInputRequiredError, CliAuthError, CliNotFoundError, CliCancellationError, isNetworkLikeError, isApiLikeError, apiErrorStatus, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveApiTenantId, resolveModaBaseUrl, validateConfig, recordApiRequest, getApiRequestCount, resetApiRequestCount, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot, setAgentUpdateNotice, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, explicitOutputMode, outputModeFromFlags, resolveOutputMode, createCliOutput, agentEnvelopeFits, agentMaxOutputBytes };

package/dist/{cli-m857n028.js → cli-m0fa54ny.js}

@@ -4,16 +4,16 @@ import {
 import {
   createCommandContext,
   stringOption
-} from "./cli-k5qqj2bp.js";
+} from "./cli-4x9w6ey7.js";
 import {
   assertFlags,
   assertPositionals,
   requireTenant
-} from "./cli-g7ferymy.js";
+} from "./cli-k7vwt56h.js";
 import {
   ApiError,
   callControlAPI
-} from "./cli-tmqd1f0m.js";
+} from "./cli-ryd7nzke.js";
 import {
   CliInputError,
   CliInputRequiredError,
@@ -39,7 +39,7 @@ import {
   resolveModaBaseUrl,
   resolveTenantId,
   shouldInventoryFile
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 import {
   __commonJS,
   __require,
@@ -193996,7 +193996,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-mtksqp3c.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-nph5t2s7.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);

package/dist/{cli-tmqd1f0m.js → cli-ryd7nzke.js}

@@ -1,11 +1,11 @@
 import {
   apiKeyHeaders
-} from "./cli-m16taf4z.js";
+} from "./cli-09rr5smg.js";
 import {
   recordApiRequest,
   resolveApiKey,
   resolveModaBaseUrl
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 
 // src/api-client.ts
 var REQUEST_TIMEOUT_MS = 30000;

package/dist/{cli-t4jjhn3g.js → cli-ssqb8bfw.js}

@@ -8,7 +8,7 @@ import {
   saveProfileConfig,
   secretFilePathFromRef,
   writeSecretJsonFile
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 import {
   __require
 } from "./cli-0v6na3yp.js";

package/dist/{cli-fwec3m42.js → cli-y8gbbe9k.js}

@@ -1,20 +1,20 @@
 import {
   createCommandContext
-} from "./cli-k5qqj2bp.js";
+} from "./cli-4x9w6ey7.js";
 import {
   assertFlags,
   assertPositionals
-} from "./cli-g7ferymy.js";
+} from "./cli-k7vwt56h.js";
 import {
   callControlAPI
-} from "./cli-tmqd1f0m.js";
+} from "./cli-ryd7nzke.js";
 import {
   CliInputError,
   recordApiRequest,
   resolveApiKey,
   resolveIngestUrl,
   resolveTenantId
-} from "./cli-429zt7g4.js";
+} from "./cli-kwz900s4.js";
 import {
   SKILL_SOURCE_HARNESS,
   SKILL_SOURCE_INTEGRATION_BUNDLED,