@moda-ai/cli 1.55.2 → 1.55.4

package/README.md

@@ -32,6 +32,30 @@ export MODA_API_KEY="moda_sk_..."
 
 Get your API key from [moda.dev/settings](https://moda.dev/settings).
 
+### Read-only keys
+
+Turn on **Read-only** when you create a key in Settings → Ingestion keys. A
+read-only key works with every read command (`overview`, `search`, `context`,
+`problems`, ...) but the API rejects writes (`false-positive`, `signals create`,
+`problem-feedback`, `ask`, ...) with 403, and it cannot ingest data. Use one for
+agents and evaluations that should never change anything.
+
+### Platform admin keys
+
+Platform admins can create `moda_pk_` keys on the admin page (`/admin/api-keys`).
+They are not tied to an organization, so name one on each run:
+
+```bash
+export MODA_API_KEY="moda_pk_..."
+export MODA_TENANT_ID="<organization-id>"
+moda overview
+moda users --tenant-id=<organization-id>   # tenant-scoped commands also take --tenant-id
+```
+
+They are read-only by default and stop working when the owner loses platform
+admin access. Usage is not counted in the organization's CLI analytics. Ordinary
+`moda_sk_` keys cannot choose another organization: the API rejects them with 403.
+
 ## Diagnostics
 
 `moda doctor --online` checks configuration and cloud data flow. Experimental

package/dist/{cli-a2jq9yd5.js → cli-73v8mqh1.js}

@@ -19,8 +19,9 @@ import {
   require_typescript,
   resolvePromptSource,
   safePromptEvidencePath,
-  scanHarness
-} from "./cli-9250ckvg.js";
+  scanHarness,
+  setPlatformTenantOverride
+} from "./cli-9v0c1xe1.js";
 import {
   SKILL_SOURCE_HARNESS,
   SKILL_SOURCE_INTEGRATION_BUNDLED,
@@ -33,7 +34,7 @@ import {
 import {
   isAuthSessionValid,
   loadAuthSession
-} from "./cli-kxwm7y62.js";
+} from "./cli-t5v7mhvj.js";
 import {
   CliInputError,
   EXIT_ERROR,
@@ -52,7 +53,7 @@ import {
   resolveTenantId,
   secretFilePathFromRef,
   validateConfig
-} from "./cli-ac3p2byq.js";
+} from "./cli-zp7a97sp.js";
 import {
   __commonJS,
   __require,
@@ -5606,6 +5607,7 @@ async function runPromptAb(flags, profileOptions, context) {
   if (!tenantId) {
     throw new Error("Missing tenant id. Run `moda init` or pass --tenant-id=<id>.");
   }
+  setPlatformTenantOverride(tenantId);
   const baselineSource = flags.baseline || flags["baseline-file"] || flags["baseline-key"];
   const candidateSource = flags.candidate || flags["candidate-file"] || flags["candidate-key"];
   if (!baselineSource || !candidateSource) {
@@ -6749,7 +6751,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-sd44jsaw.js");
+    const { analyzeHarnessPrompts } = await import("./harness-x6kaz47j.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),
@@ -7079,7 +7081,7 @@ async function migratePromptManifest(options = {}) {
   let addedSources = [];
   let pendingSources = [];
   if (options.discover) {
-    const { analyzeHarnessPrompts } = await import("./harness-sd44jsaw.js");
+    const { analyzeHarnessPrompts } = await import("./harness-x6kaz47j.js");
     const result = await analyzeHarnessPrompts({
       rootDir: root,
       existing: manifest.sources,

package/dist/{cli-sq6g0tk5.js → cli-9kyw5qx0.js}

@@ -1,7 +1,7 @@
 import {
   authFetch,
   getCachedLoginContext
-} from "./cli-kxwm7y62.js";
+} from "./cli-t5v7mhvj.js";
 import {
   CliAccessError,
   CliInputError,
@@ -15,7 +15,7 @@ import {
   resolveTenantIdFromActiveProfile,
   saveCliConfig,
   writeSecretJsonFile
-} from "./cli-ac3p2byq.js";
+} from "./cli-zp7a97sp.js";
 
 // src/init/tenant.ts
 import { randomUUID } from "node:crypto";
@@ -174,7 +174,7 @@ async function selectTenantAndCreateKey(options = {}) {
   }
   log(`  Authenticated as ${ctx.user.email}`);
   if (ctx.tenants.length === 0) {
-    throw new CliAccessError("No organizations found. Create one at https://moda.dev");
+    throw new CliAccessError("This account has no Moda organization yet. Moda is invite-only: finish your access request at https://moda.dev/request-access, or ask a workspace admin to invite you.");
   }
   let selected;
   if (options.tenantId !== undefined) {

package/dist/{cli-9250ckvg.js → cli-9v0c1xe1.js}

@@ -25,7 +25,7 @@ import {
   resolveTenantId,
   shouldInventoryFile,
   stringOption
-} from "./cli-ac3p2byq.js";
+} from "./cli-zp7a97sp.js";
 import {
   __commonJS,
   __require,
@@ -177899,6 +177899,31 @@ import { confirm as confirm2, select } from "@inquirer/prompts";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
+// src/api-key-headers.ts
+var PLATFORM_API_KEY_PREFIX = "moda_pk_";
+var TENANT_HEADER = "x-moda-tenant-id";
+function isPlatformApiKey(key) {
+  return Boolean(key?.startsWith(PLATFORM_API_KEY_PREFIX));
+}
+var platformTenantOverride;
+function setPlatformTenantOverride(tenantId) {
+  platformTenantOverride = tenantId;
+}
+var TENANT_PATH = /\/tenants\/([^/?#]+)/;
+function tenantFromUrl(url) {
+  const match = url ? TENANT_PATH.exec(url) : null;
+  return match ? decodeURIComponent(match[1]) : undefined;
+}
+function apiKeyHeaders(key, options = {}, url) {
+  const headers = { "x-api-key": key };
+  if (isPlatformApiKey(key)) {
+    const tenantId = tenantFromUrl(url) || platformTenantOverride || resolveTenantId(options);
+    if (tenantId)
+      headers[TENANT_HEADER] = tenantId;
+  }
+  return headers;
+}
+
 // src/api-client.ts
 var REQUEST_TIMEOUT_MS = 30000;
 var MAX_RETRIES = 3;
@@ -178006,7 +178031,7 @@ async function callModaAPI(url, options, profileOptions = {}, requestOptions = {
       const response = await fetch(url, {
         ...options,
         headers: {
-          "x-api-key": resolveApiKey(profileOptions) ?? "",
+          ...apiKeyHeaders(resolveApiKey(profileOptions) ?? "", profileOptions, url),
           "Content-Type": "application/json",
           ...options.headers ?? {},
           ...connectionClose ? { Connection: "close" } : {}
@@ -178077,6 +178102,8 @@ function requireTenant(context) {
   if (!tenantId) {
     throw new CliInputError("Could not determine the tenant.", "Use a signed API key (it names its tenant), set MODA_TENANT_ID, or pass --tenant-id=<id>.");
   }
+  if (isPlatformApiKey(key))
+    setPlatformTenantOverride(tenantId);
   return tenantId;
 }
 function assertFlags(command, flags, allowed) {
@@ -184870,7 +184897,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-075xzdvp.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-5syjp1sz.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -188915,4 +188942,4 @@ function hashText(text) {
   return createHash4("sha256").update(text).digest("hex");
 }
 
-export { ApiError, callDataAPI, callControlAPI, getApiRequestCount, resetApiRequestCount, $isSeq, $parseDocument, $stringify, require_typescript, inspectCodeSelectors, inspectPythonSelectors, resolvePromptSource, backfillPromptSource, HARNESS_REPORT_PATH, HARNESS_REPORT_APPROVAL_PATH, HARNESS_ANALYZE_CONCERNS, validateHarnessReport, readHarnessReport, normalizeHarnessReport, hashHarnessReport, hashStableJson, assertFlags, assertPositionals, runUsersCommand, runUserCommand, runProblemReopenCommand, runSignalsManagementCommand, SIGNALS_MANAGEMENT_SUBCOMMANDS, unknownSignalsSubcommandError, shouldColorTerminalOutput, terminalStyles, stripAnsi2 as stripAnsi, renderMarkdownForTerminal, startRemoteAnalyze, pollRemoteAnalyzeUntilDone, isRecoverableRemoteRun, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, renderDoctorHuman, renderStatusHuman, renderInitBanner, renderInitStep, renderInitNote, renderInitSetupPlan, renderInitComplete, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, repairExternalAnalystReport, deriveRelationshipsFromGraph, mergeDeterministicArtifacts, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, readHarnessSyncState, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId2 as stableId, titleFromId2 as titleFromId, promptNameFromPath };
+export { isPlatformApiKey, setPlatformTenantOverride, apiKeyHeaders, ApiError, callDataAPI, callControlAPI, getApiRequestCount, resetApiRequestCount, $isSeq, $parseDocument, $stringify, require_typescript, inspectCodeSelectors, inspectPythonSelectors, resolvePromptSource, backfillPromptSource, HARNESS_REPORT_PATH, HARNESS_REPORT_APPROVAL_PATH, HARNESS_ANALYZE_CONCERNS, validateHarnessReport, readHarnessReport, normalizeHarnessReport, hashHarnessReport, hashStableJson, assertFlags, assertPositionals, runUsersCommand, runUserCommand, runProblemReopenCommand, runSignalsManagementCommand, SIGNALS_MANAGEMENT_SUBCOMMANDS, unknownSignalsSubcommandError, shouldColorTerminalOutput, terminalStyles, stripAnsi2 as stripAnsi, renderMarkdownForTerminal, startRemoteAnalyze, pollRemoteAnalyzeUntilDone, isRecoverableRemoteRun, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, renderDoctorHuman, renderStatusHuman, renderInitBanner, renderInitStep, renderInitNote, renderInitSetupPlan, renderInitComplete, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, repairExternalAnalystReport, deriveRelationshipsFromGraph, mergeDeterministicArtifacts, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, readHarnessSyncState, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId2 as stableId, titleFromId2 as titleFromId, promptNameFromPath };

package/dist/{cli-kxwm7y62.js → cli-t5v7mhvj.js}

@@ -7,7 +7,7 @@ import {
   saveProfileConfig,
   secretFilePathFromRef,
   writeSecretJsonFile
-} from "./cli-ac3p2byq.js";
+} from "./cli-zp7a97sp.js";
 import {
   __require
 } from "./cli-0v6na3yp.js";

package/dist/{cli-ac3p2byq.js → cli-zp7a97sp.js}

@@ -804,6 +804,7 @@ var SECRET_KEYS = new Set([
 ]);
 var SECRET_PATTERNS = [
   { pattern: /\bmoda_sk_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bmoda_pk_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
   { pattern: /\bmoda_ct_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
   { pattern: /\bBearer\s+([A-Za-z0-9._~+/-]+=*)\b/gi, prefixLength: 8 },
   { pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, prefixLength: 8 },

package/dist/cli.js

@@ -8,13 +8,14 @@ import {
   runPromptsCommand,
   runSkillsCommand,
   runStatusCommand
-} from "./cli-a2jq9yd5.js";
+} from "./cli-73v8mqh1.js";
 import"./cli-mm48br00.js";
 import {
   ApiError,
   HARNESS_REPORT_APPROVAL_PATH,
   HARNESS_REPORT_PATH,
   SIGNALS_MANAGEMENT_SUBCOMMANDS,
+  apiKeyHeaders,
   assertFlags,
   assertPositionals,
   callControlAPI,
@@ -23,6 +24,7 @@ import {
   graphForSync,
   hashHarnessReport,
   hashStableJson,
+  isPlatformApiKey,
   readHarnessReport,
   readHarnessSyncState,
   renderMarkdownForTerminal,
@@ -32,13 +34,14 @@ import {
   runSignalsManagementCommand,
   runUserCommand,
   runUsersCommand,
+  setPlatformTenantOverride,
   shouldColorTerminalOutput,
   stripAnsi,
   summarizeHarness,
   terminalStyles,
   unknownSignalsSubcommandError,
   validateHarnessReport
-} from "./cli-9250ckvg.js";
+} from "./cli-9v0c1xe1.js";
 import"./cli-ssfq84k5.js";
 import {
   authFetch,
@@ -47,7 +50,7 @@ import {
   loadAuthSession,
   login,
   revokeCliSessionToken
-} from "./cli-kxwm7y62.js";
+} from "./cli-t5v7mhvj.js";
 import {
   AGENT_ERROR_CODES,
   CliAccessError,
@@ -98,7 +101,7 @@ import {
   validateConfig,
   wasOutputCancelled,
   writeSecretJsonFile
-} from "./cli-ac3p2byq.js";
+} from "./cli-zp7a97sp.js";
 import {
   __require
 } from "./cli-0v6na3yp.js";
@@ -3346,6 +3349,8 @@ function requireTenant(context) {
   if (!tenantId) {
     throw new CliInputError("Could not determine the tenant.", "Use a signed API key (it names its tenant), set MODA_TENANT_ID, or pass --tenant-id=<id>.");
   }
+  if (isPlatformApiKey(key))
+    setPlatformTenantOverride(tenantId);
   return tenantId;
 }
 function intFlag(name, value, min, max) {
@@ -3582,7 +3587,7 @@ async function sendCliUsageTelemetry(input) {
     await fetch(`${resolveModaBaseUrl()}/api/v1/data/cli-usage`, {
       method: "POST",
       headers: {
-        "x-api-key": input.apiKey,
+        ...apiKeyHeaders(input.apiKey),
         "Content-Type": "application/json"
       },
       body: JSON.stringify({
@@ -4815,7 +4820,7 @@ async function probeApiKey(key, options = {}) {
   try {
     response = await fetch(`${resolveModaBaseUrl(options)}/api/v1/data/overview`, {
       method: "GET",
-      headers: { "x-api-key": key },
+      headers: apiKeyHeaders(key, options),
       signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
     });
   } catch (error) {
@@ -6159,7 +6164,7 @@ async function streamAsk(options) {
       response = await fetchImpl(url, {
         method: "POST",
         headers: {
-          "x-api-key": resolveApiKey(profileOptions2) ?? "",
+          ...apiKeyHeaders(resolveApiKey(profileOptions2) ?? "", profileOptions2),
           "Content-Type": "application/json",
           Accept: "text/event-stream"
         },
@@ -10265,7 +10270,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result",
     handler: async (context) => {
-      const { runInit } = await import("./index-hn9t95tr.js");
+      const { runInit } = await import("./index-8vvznb36.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",
@@ -10306,7 +10311,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result-and-error",
     handler: async (context) => {
-      const { runProvision } = await import("./provision-d1dfj6as.js");
+      const { runProvision } = await import("./provision-2z73642d.js");
       return runProvision(context, {
         resumeCommand: buildResumeCommand("provision", context.rawFlags)
       });

package/dist/{harness-github-actions-075xzdvp.js → harness-github-actions-5syjp1sz.js}

@@ -1,7 +1,7 @@
 import {
   buildSourceSnapshot
-} from "./cli-9250ckvg.js";
-import"./cli-ac3p2byq.js";
+} from "./cli-9v0c1xe1.js";
+import"./cli-zp7a97sp.js";
 import"./cli-0v6na3yp.js";
 
 // src/harness-github-actions.ts

package/dist/{harness-sd44jsaw.js → harness-x6kaz47j.js}

@@ -42,8 +42,8 @@ import {
   writeHarnessAnalyzeResult,
   writeHarnessArtifacts,
   writeHumanProgress
-} from "./cli-9250ckvg.js";
-import"./cli-ac3p2byq.js";
+} from "./cli-9v0c1xe1.js";
+import"./cli-zp7a97sp.js";
 import"./cli-0v6na3yp.js";
 export {
   writeHumanProgress,

package/dist/{index-hn9t95tr.js → index-8vvznb36.js}

@@ -3,7 +3,7 @@ import {
   initPrompts,
   runPromptSync,
   runSkillSync
-} from "./cli-a2jq9yd5.js";
+} from "./cli-73v8mqh1.js";
 import"./cli-mm48br00.js";
 import {
   codingAgentDisplayName,
@@ -23,7 +23,7 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-9250ckvg.js";
+} from "./cli-9v0c1xe1.js";
 import {
   bundledSkillsDir,
   installIntegrationSkill,
@@ -35,14 +35,14 @@ import {
 } from "./cli-ssfq84k5.js";
 import {
   selectTenantAndCreateKey
-} from "./cli-sq6g0tk5.js";
+} from "./cli-9kyw5qx0.js";
 import {
   ConnectCodeError,
   connectWithCode,
   loadAuthSession,
   loadToken,
   login
-} from "./cli-kxwm7y62.js";
+} from "./cli-t5v7mhvj.js";
 import {
   CliAuthError,
   CliInputError,
@@ -50,7 +50,7 @@ import {
   createCommandContext,
   resolveIngestUrl,
   resolveModaBaseUrl
-} from "./cli-ac3p2byq.js";
+} from "./cli-zp7a97sp.js";
 import"./cli-0v6na3yp.js";
 
 // src/init/index.ts

package/dist/prompt-source-mcp.js

@@ -5,8 +5,8 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors,
   safePromptEvidencePath
-} from "./cli-9250ckvg.js";
-import"./cli-ac3p2byq.js";
+} from "./cli-9v0c1xe1.js";
+import"./cli-zp7a97sp.js";
 import {
   __commonJS,
   __toESM

package/dist/{provision-d1dfj6as.js → provision-2z73642d.js}

@@ -1,15 +1,15 @@
 import {
   selectTenantAndCreateKey
-} from "./cli-sq6g0tk5.js";
+} from "./cli-9kyw5qx0.js";
 import {
   loadAuthSession
-} from "./cli-kxwm7y62.js";
+} from "./cli-t5v7mhvj.js";
 import {
   CliAuthError,
   resolveIngestUrl,
   resolveModaBaseUrl,
   stringOption
-} from "./cli-ac3p2byq.js";
+} from "./cli-zp7a97sp.js";
 import"./cli-0v6na3yp.js";
 
 // src/provision.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.55.2",
+  "version": "1.55.4",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-13T03:17:21.446Z",
-  "cli_version": "1.55.2",
+  "bundled_at": "2026-10-14T00:26:25.137Z",
+  "cli_version": "1.55.4",
   "skills": [
     {
       "id": "integration-cloudflare-think",