@moda-ai/cli 1.55.26 → 1.55.27

package/dist/cli.js

@@ -1,11 +1,31 @@
 #!/usr/bin/env node
 import {
-  MODA_INTELLIGENCE_V1_JSON_SCHEMA
-} from "./cli-bb7133m7.js";
+  BATCH_CONCURRENCY,
+  BATCH_MAX_TARGETS,
+  MODA_INTELLIGENCE_V1_JSON_SCHEMA,
+  asNumber,
+  asRecord,
+  asString,
+  collectBatchTargets,
+  compactProblemDossier,
+  contextTarget,
+  embeddedWindowSize,
+  frustrationsFromEmotions,
+  mapWithConcurrency,
+  parseBatchTarget,
+  trimToolFailureConversations,
+  withFrustrationAnchors,
+  withToolFailureAnchors,
+  withoutDetectionWindows
+} from "./cli-vdkwkkp5.js";
 import {
   createCommandContext,
-  parseBooleanFlagValue
-} from "./cli-cdrvjva5.js";
+  envOptOutSet,
+  envSwitchedOff,
+  optOutFlagSet,
+  parseBooleanFlagValue,
+  withoutFlag
+} from "./cli-v8q7sd7g.js";
 import {
   AuditSchema,
   COMMAND_FLAG_SPECS,
@@ -47,16 +67,14 @@ import {
   unknownSignalsSubcommandError,
   usageLine,
   writeDryRun
-} from "./cli-jgfm7w1r.js";
+} from "./cli-wzds257x.js";
 import {
   ApiError,
   callControlAPI,
   callDataAPI
-} from "./cli-jtyvbd8d.js";
+} from "./cli-pg5qfmqc.js";
 import {
   AGENT_ERROR_CODES,
-  BATCH_CONCURRENCY,
-  BATCH_MAX_TARGETS,
   CliAccessError,
   CliAuthError,
   CliCancellationError,
@@ -76,19 +94,11 @@ import {
   agentMaxOutputBytes,
   apiErrorStatus,
   apiKeyHeaders,
-  asNumber,
-  asRecord,
-  asString,
   attachInputDetails,
   canonicalCommandText,
-  collectBatchTargets,
-  compactProblemDossier,
-  contextTarget,
   createCliOutput,
   embeddedTenantIdFromApiKey,
-  embeddedWindowSize,
   errorToAgentError,
-  frustrationsFromEmotions,
   getApiRequestCount,
   getModaDir,
   inputDetailsOf,
@@ -96,24 +106,20 @@ import {
   isNetworkLikeError,
   isPlatformApiKey,
   loadProfileConfig,
-  mapWithConcurrency,
-  parseBatchTarget,
   resetApiRequestCount,
   resolveApiKey,
   resolveApiTenantId,
   resolveModaBaseUrl,
+  resolveModaBaseUrlStrict,
   resolveOutputMode,
   safeWriteStderr,
   safeWriteStdout,
   setAgentUpdateNotice,
   setPlatformTenantOverride,
-  trimToolFailureConversations,
+  shellArg,
   validateConfig,
-  wasOutputCancelled,
-  withFrustrationAnchors,
-  withToolFailureAnchors,
-  withoutDetectionWindows
-} from "./cli-sqsjd08w.js";
+  wasOutputCancelled
+} from "./cli-r5pp7qny.js";
 import {
   __require
 } from "./cli-0v6na3yp.js";
@@ -302,16 +308,91 @@ async function runReplaysCommand(context) {
 }
 
 // src/telemetry.ts
+import { spawn as spawn2 } from "node:child_process";
+
+// src/detached.ts
 import { spawn } from "node:child_process";
+var INSPECTOR_VALUE_OPTIONS = new Set(["--inspect-port", "--debug-port", "--inspect-publish-uid"]);
+function nodeOptionTokens(nodeOptions) {
+  const tokens = [];
+  let start = -1;
+  let quoted = false;
+  for (let i = 0;i < nodeOptions.length; i += 1) {
+    const ch = nodeOptions[i];
+    if (start === -1) {
+      if (/\s/.test(ch))
+        continue;
+      start = i;
+    }
+    if (quoted && ch === "\\") {
+      i += 1;
+    } else if (ch === '"') {
+      quoted = !quoted;
+    } else if (!quoted && /\s/.test(ch)) {
+      tokens.push(nodeOptions.slice(start, i));
+      start = -1;
+    }
+  }
+  if (start !== -1)
+    tokens.push(nodeOptions.slice(start));
+  return tokens;
+}
+function withoutInspectorOptions(nodeOptions) {
+  const tokens = nodeOptionTokens(nodeOptions);
+  const kept = [];
+  for (let i = 0;i < tokens.length; i += 1) {
+    const name = tokens[i].split("=")[0];
+    if (!name.startsWith("--inspect") && name !== "--debug-port") {
+      kept.push(tokens[i]);
+      continue;
+    }
+    if (INSPECTOR_VALUE_OPTIONS.has(tokens[i]) && tokens[i + 1] && !tokens[i + 1].startsWith("-"))
+      i += 1;
+  }
+  return kept.join(" ");
+}
+function spawnDetachedNode(script, options = {}, spawnImpl = spawn) {
+  try {
+    const env = { ...process.env, ...options.env };
+    for (const key of options.dropEnv ?? [])
+      delete env[key];
+    if (env.NODE_OPTIONS?.includes("--inspect")) {
+      const kept = withoutInspectorOptions(env.NODE_OPTIONS);
+      if (kept)
+        env.NODE_OPTIONS = kept;
+      else
+        delete env.NODE_OPTIONS;
+    }
+    const child = spawnImpl(process.execPath, ["-e", script], {
+      detached: true,
+      stdio: [options.stdin === undefined ? "ignore" : "pipe", "ignore", "ignore"],
+      windowsHide: true,
+      env
+    });
+    child.on("error", () => {});
+    if (child.pid === undefined)
+      return false;
+    if (options.stdin !== undefined && child.stdin) {
+      child.stdin.on("error", () => {});
+      child.stdin.end(options.stdin);
+    }
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/telemetry.ts
 import { randomUUID } from "node:crypto";
 var INLINE_TELEMETRY_TIMEOUT_MS = 500;
 var DETACHED_TELEMETRY_TIMEOUT_MS = 5000;
 var INVOCATION_ID = randomUUID();
 var TELEMETRY_FLAG = "no-telemetry";
-var TELEMETRY_REQUEST_ENV = "MODA_CLI_TELEMETRY_REQUEST";
 var TELEMETRY_TRANSPORT_ENV = "MODA_CLI_TELEMETRY_TRANSPORT";
 var MAX_TELEMETRY_DURATION_MS = 86400000;
 var MAX_TELEMETRY_API_REQUEST_COUNT = 1e6;
+var MAX_UNKNOWN_FLAG_COUNT = 1000;
 var SEARCH_SURFACE_BY_COMMAND = {
   search: "message",
   conversations: "conversation",
@@ -413,11 +494,10 @@ function serializeAdoption(adoption) {
   return out;
 }
 function stripTelemetryFlag(flags) {
-  const { [TELEMETRY_FLAG]: _drop, ...rest } = flags;
-  return rest;
+  return withoutFlag(flags, TELEMETRY_FLAG);
 }
-function isTelemetryDisabled(flags) {
-  return flags[TELEMETRY_FLAG] === "true" || process.env.MODA_CLI_TELEMETRY === "0" || process.env.DO_NOT_TRACK === "1";
+function isTelemetryDisabled(flags, env = process.env) {
+  return optOutFlagSet(flags, TELEMETRY_FLAG) || envSwitchedOff(env.MODA_CLI_TELEMETRY) || envOptOutSet(env.DO_NOT_TRACK);
 }
 var VALIDATION_REASON_MAX = 128;
 var DEGRADE_REASON_MAX = 64;
@@ -428,88 +508,78 @@ function sanitizeReasonCode(reason, max) {
 function sanitizeValidationReason(reason) {
   return sanitizeReasonCode(reason, VALIDATION_REASON_MAX);
 }
-function sanitizedFlagNames(flags) {
-  return Object.keys(stripTelemetryFlag(flags)).sort();
+var MAX_FLAG_NAMES = 50;
+var FLAG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+var SECRET_PATTERNS = [
+  /moda_sk_/i,
+  /(?:^|[^A-Za-z0-9])sk-[A-Za-z0-9_-]{8,}/,
+  /(?:^|[^A-Za-z0-9])(?:sk|pk|rk)_(?:live|test)_/i,
+  /gh[pousr]_[A-Za-z0-9]{16,}/,
+  /github_pat_/i,
+  /xox[abprs]-/i,
+  /AKIA[0-9A-Z]{16}/,
+  /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/,
+  /-----BEGIN [A-Z ]*PRIVATE KEY/,
+  /[^\s@]+@[^\s@]+\.[A-Za-z]{2,}/,
+  /[A-Za-z0-9+/=]{32,}/
+];
+function looksSecret(value) {
+  return SECRET_PATTERNS.some((pattern) => pattern.test(value));
+}
+function reportedFlagNames(flags, acceptedFlags = new Set) {
+  const names = new Set;
+  let unknownCount = 0;
+  for (const key of Object.keys(stripTelemetryFlag(flags))) {
+    if (acceptedFlags.has(key.replace(/_/g, "-")) && FLAG_NAME_RE.test(key) && !looksSecret(key))
+      names.add(key);
+    else
+      unknownCount += 1;
+  }
+  const sorted = [...names].sort();
+  return { names: sorted.slice(0, MAX_FLAG_NAMES), unknownCount: unknownCount + Math.max(0, sorted.length - MAX_FLAG_NAMES) };
+}
+function reportedValidationReason(reason, knownFlags = new Set) {
+  let code = reason;
+  const unknownFlag = code ? /^unknown_flag:(.*)$/s.exec(code) : null;
+  if (unknownFlag) {
+    const name = unknownFlag[1].replace(/_/g, "-");
+    code = knownFlags.has(name) && FLAG_NAME_RE.test(name) ? `unknown_flag:${name}` : "unknown_flag";
+  }
+  const cleaned = sanitizeValidationReason(code);
+  if (!cleaned || !looksSecret(cleaned))
+    return cleaned;
+  const head = cleaned.split(":")[0];
+  return head && !looksSecret(head) ? head : undefined;
+}
+function safeCode(value) {
+  return value && !looksSecret(value) ? value : undefined;
 }
 var TELEMETRY_SENDER_SCRIPT = [
   "try {",
-  `  const raw = process.env.${TELEMETRY_REQUEST_ENV};`,
-  `  delete process.env.${TELEMETRY_REQUEST_ENV};`,
-  "  const r = raw ? JSON.parse(raw) : null;",
-  "  if (r && typeof r.url === 'string' && typeof fetch === 'function') {",
-  "    const c = new AbortController();",
-  `    const t = setTimeout(() => c.abort(), ${DETACHED_TELEMETRY_TIMEOUT_MS});`,
-  "    fetch(r.url, { method: 'POST', headers: r.headers, body: r.body, signal: c.signal })",
-  "      .then((res) => (res.body && res.body.cancel ? res.body.cancel() : undefined))",
-  "      .catch(() => {})",
-  "      .finally(() => clearTimeout(t));",
-  "  }",
+  "  let raw = '';",
+  `  const quit = setTimeout(() => process.exit(0), ${DETACHED_TELEMETRY_TIMEOUT_MS + 1000});`,
+  "  const done = () => clearTimeout(quit);",
+  "  process.stdin.setEncoding('utf8');",
+  "  process.stdin.on('error', () => {});",
+  "  process.stdin.on('data', (chunk) => { raw += chunk; });",
+  "  process.stdin.on('end', () => {",
+  "    try {",
+  "      const r = raw ? JSON.parse(raw) : null;",
+  "      raw = '';",
+  "      if (!r || typeof r.url !== 'string' || typeof fetch !== 'function') return done();",
+  "      const c = new AbortController();",
+  `      const t = setTimeout(() => c.abort(), ${DETACHED_TELEMETRY_TIMEOUT_MS});`,
+  "      fetch(r.url, { method: 'POST', headers: r.headers, body: r.body, signal: c.signal })",
+  "        .then((res) => (res.body && res.body.cancel ? res.body.cancel() : undefined))",
+  "        .catch(() => {})",
+  "        .finally(() => { clearTimeout(t); done(); });",
+  "    } catch { done(); }",
+  "  });",
   "} catch {}"
 ].join(`
 `);
-var INSPECTOR_VALUE_OPTIONS = new Set(["--inspect-port", "--debug-port", "--inspect-publish-uid"]);
-function nodeOptionTokens(nodeOptions) {
-  const tokens = [];
-  let start = -1;
-  let quoted = false;
-  for (let i = 0;i < nodeOptions.length; i += 1) {
-    const ch = nodeOptions[i];
-    if (start === -1) {
-      if (/\s/.test(ch))
-        continue;
-      start = i;
-    }
-    if (quoted && ch === "\\") {
-      i += 1;
-    } else if (ch === '"') {
-      quoted = !quoted;
-    } else if (!quoted && /\s/.test(ch)) {
-      tokens.push(nodeOptions.slice(start, i));
-      start = -1;
-    }
-  }
-  if (start !== -1)
-    tokens.push(nodeOptions.slice(start));
-  return tokens;
-}
-function withoutInspectorOptions(nodeOptions) {
-  const tokens = nodeOptionTokens(nodeOptions);
-  const kept = [];
-  for (let i = 0;i < tokens.length; i += 1) {
-    const name = tokens[i].split("=")[0];
-    if (!name.startsWith("--inspect") && name !== "--debug-port") {
-      kept.push(tokens[i]);
-      continue;
-    }
-    if (INSPECTOR_VALUE_OPTIONS.has(tokens[i]) && tokens[i + 1] && !tokens[i + 1].startsWith("-"))
-      i += 1;
-  }
-  return kept.join(" ");
-}
-function spawnDetachedTelemetrySender(request, spawnImpl = spawn) {
-  try {
-    const env = { ...process.env, [TELEMETRY_REQUEST_ENV]: JSON.stringify(request) };
-    if (env.NODE_OPTIONS?.includes("--inspect")) {
-      const kept = withoutInspectorOptions(env.NODE_OPTIONS);
-      if (kept)
-        env.NODE_OPTIONS = kept;
-      else
-        delete env.NODE_OPTIONS;
-    }
-    const child = spawnImpl(process.execPath, ["-e", TELEMETRY_SENDER_SCRIPT], {
-      detached: true,
-      stdio: "ignore",
-      windowsHide: true,
-      env
-    });
-    child.on("error", () => {});
-    if (child.pid === undefined)
-      return false;
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
+function spawnDetachedTelemetrySender(request, spawnImpl = spawn2) {
+  return spawnDetachedNode(TELEMETRY_SENDER_SCRIPT, { stdin: JSON.stringify(request), dropEnv: ["MODA_API_KEY"] }, spawnImpl);
 }
 async function sendInline(request) {
   const controller = new AbortController;
@@ -529,16 +599,25 @@ async function sendInline(request) {
   }
 }
 function buildCliUsageRequest(input) {
-  const validationReason = sanitizeValidationReason(input.validationReason);
+  const baseUrl = resolveModaBaseUrlStrict(input.profile ? { profile: input.profile } : {});
+  if (!baseUrl)
+    return;
+  const validationReason = reportedValidationReason(input.validationReason, input.knownFlags);
+  const flagNames = reportedFlagNames(input.flags, input.acceptedFlags);
+  const adoption = serializeAdoption(input.adoption);
+  for (const key of ["subcommand", "degrade_reason", "skill_version"]) {
+    if (typeof adoption[key] === "string" && looksSecret(adoption[key]))
+      delete adoption[key];
+  }
   return {
-    url: `${resolveModaBaseUrl({ profile: input.profile })}/api/v1/data/cli-usage`,
+    url: `${baseUrl}/api/v1/data/cli-usage`,
     headers: {
       ...apiKeyHeaders(input.apiKey),
       "Content-Type": "application/json"
     },
     body: JSON.stringify({
       invocation_id: INVOCATION_ID,
-      command: input.command.slice(0, 64),
+      command: safeCode(input.command.slice(0, 64)) ?? "unknown",
       status: input.status,
       error_type: input.errorType,
       ...validationReason ? { validation_reason: validationReason } : {},
@@ -550,10 +629,11 @@ function buildCliUsageRequest(input) {
       platform: process.platform,
       arch: process.arch,
       flags_json: {
-        names: sanitizedFlagNames(input.flags),
-        ...((alias) => alias ? { legacy_alias: alias } : {})(sanitizeReasonCode(input.legacyAlias?.replace(/ /g, ":"), 64))
+        names: flagNames.names,
+        ...flagNames.unknownCount > 0 ? { unknown_count: Math.min(flagNames.unknownCount, MAX_UNKNOWN_FLAG_COUNT) } : {},
+        ...((alias) => alias ? { legacy_alias: alias } : {})(safeCode(sanitizeReasonCode(input.legacyAlias?.replace(/ /g, ":"), 64)))
       },
-      ...serializeAdoption(input.adoption)
+      ...adoption
     })
   };
 }
@@ -563,6 +643,8 @@ async function sendCliUsageTelemetry(input) {
       return;
     }
     const request = buildCliUsageRequest({ ...input, apiKey: input.apiKey });
+    if (!request)
+      return;
     if (process.env[TELEMETRY_TRANSPORT_ENV] !== "inline" && spawnDetachedTelemetrySender(request)) {
       return;
     }
@@ -579,11 +661,10 @@ var REGISTRY_TIMEOUT_MS = 1500;
 var REGISTRY_LATEST_URL = "https://registry.npmjs.org/@moda-ai/cli/latest";
 var SEMVER_RE = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
 function stripUpdateCheckFlag(flags) {
-  const { [UPDATE_CHECK_FLAG]: _drop, ...rest } = flags;
-  return rest;
+  return withoutFlag(flags, UPDATE_CHECK_FLAG);
 }
 function isUpdateCheckDisabled(flags, env = process.env) {
-  return flags[UPDATE_CHECK_FLAG] === "true" || env.MODA_CLI_UPDATE_CHECK === "0" || env.DO_NOT_TRACK === "1" || env.CI !== undefined && env.CI !== "" && env.CI !== "false" && env.CI !== "0";
+  return optOutFlagSet(flags, UPDATE_CHECK_FLAG) || envSwitchedOff(env.MODA_CLI_UPDATE_CHECK) || envOptOutSet(env.DO_NOT_TRACK) || envOptOutSet(env.CI);
 }
 function cachePath(options = {}) {
   return join(getModaDir(options), "update-check.json");
@@ -616,9 +697,39 @@ function isNewerVersion(candidate, current) {
   }
   return false;
 }
-async function startUpdateCheck(options = {}, now = Date.now()) {
+var UPDATE_CHECK_URL_ENV = "MODA_CLI_UPDATE_CHECK_URL";
+var UPDATE_CHECK_CACHE_ENV = "MODA_CLI_UPDATE_CHECK_CACHE";
+var DETACHED_REGISTRY_TIMEOUT_MS = 1e4;
+var UPDATE_CHECK_SCRIPT = [
+  "try {",
+  `  const url = process.env.${UPDATE_CHECK_URL_ENV};`,
+  `  const path = process.env.${UPDATE_CHECK_CACHE_ENV};`,
+  `  const semver = new RegExp(${JSON.stringify(SEMVER_RE.source)});`,
+  "  if (url && path && typeof fetch === 'function') {",
+  "    const c = new AbortController();",
+  `    const t = setTimeout(() => c.abort(), ${DETACHED_REGISTRY_TIMEOUT_MS});`,
+  "    fetch(url, { headers: { Accept: 'application/json' }, signal: c.signal })",
+  "      .then((res) => (res.ok ? res.json() : null))",
+  "      .then((body) => {",
+  "        if (body && typeof body.version === 'string' && semver.test(body.version)) {",
+  "          require('fs').writeFileSync(path, JSON.stringify({ checked_at: Date.now(), latest: body.version }, null, 2) + '\\n', 'utf8');",
+  "        }",
+  "      })",
+  "      .catch(() => {})",
+  "      .finally(() => clearTimeout(t));",
+  "  }",
+  "} catch {}"
+].join(`
+`);
+async function startUpdateCheck(options = {}, now = Date.now(), mode = {}) {
   const cache = readCache(options);
-  if (cache && now - cache.checked_at < CHECK_INTERVAL_MS) {
+  if (cache && cache.checked_at <= now && now - cache.checked_at < CHECK_INTERVAL_MS) {
+    return;
+  }
+  const known = cache && SEMVER_RE.test(cache.latest) ? cache.latest : "";
+  writeCache({ checked_at: now, latest: known }, options);
+  if (mode.detached) {
+    spawnDetachedNode(UPDATE_CHECK_SCRIPT, { env: { [UPDATE_CHECK_URL_ENV]: REGISTRY_LATEST_URL, [UPDATE_CHECK_CACHE_ENV]: cachePath(options) }, dropEnv: ["MODA_API_KEY"] }, mode.spawnImpl);
     return;
   }
   const controller = new AbortController;
@@ -643,16 +754,16 @@ async function startUpdateCheck(options = {}, now = Date.now()) {
 }
 function getAvailableUpdate(options = {}) {
   const cache = readCache(options);
-  return cache && isNewerVersion(cache.latest, VERSION) ? cache.latest : undefined;
+  return cache && SEMVER_RE.test(cache.latest) && isNewerVersion(cache.latest, VERSION) ? cache.latest : undefined;
 }
 function getUpdateNotice(options = {}) {
-  const cache = readCache(options);
-  if (!cache || !isNewerVersion(cache.latest, VERSION)) {
+  const latest = getAvailableUpdate(options);
+  if (!latest) {
     return;
   }
   return [
     "",
-    `Update available: moda-cli ${VERSION} → ${cache.latest}`,
+    `Update available: moda-cli ${VERSION} → ${latest}`,
     "Run `npm install -g @moda-ai/cli@latest` to update."
   ].join(`
 `);
@@ -2528,46 +2639,46 @@ function leafManifestFields(leaf, commands) {
 import { fileURLToPath } from "url";
 import { realpathSync } from "fs";
 async function runPromptsCommand(...args) {
-  return (await import("./prompts-92aqqb2k.js")).runPromptsCommand(...args);
+  return (await import("./prompts-17wyrst6.js")).runPromptsCommand(...args);
 }
 async function runSkillsCommand(...args) {
-  return (await import("./skills-2mbsj9bt.js")).runSkillsCommand(...args);
+  return (await import("./skills-ccdbqghj.js")).runSkillsCommand(...args);
 }
 async function runFixCommand(...args) {
-  return (await import("./fix-crkwdkt4.js")).runFixCommand(...args);
+  return (await import("./fix-75s9s0d6.js")).runFixCommand(...args);
 }
 async function runFixesCommand(...args) {
-  return (await import("./fix-crkwdkt4.js")).runFixesCommand(...args);
+  return (await import("./fix-75s9s0d6.js")).runFixesCommand(...args);
 }
 async function runHarnessCommand(...args) {
-  return (await import("./harness-x3e7d68b.js")).runHarnessCommand(...args);
+  return (await import("./harness-a7tb9a23.js")).runHarnessCommand(...args);
 }
 async function runSyncCommand(...args) {
-  return (await import("./sync-kghmmmk5.js")).runSyncCommand(...args);
+  return (await import("./sync-hkxce5zh.js")).runSyncCommand(...args);
 }
 async function runRegistryCommand(...args) {
-  return (await import("./registry-ex162j5y.js")).runRegistryCommand(...args);
+  return (await import("./registry-fpzhjznj.js")).runRegistryCommand(...args);
 }
 async function runDoctorCommand(...args) {
-  return (await import("./doctor-w913fj4g.js")).runDoctorCommand(...args);
+  return (await import("./doctor-wmre3mr7.js")).runDoctorCommand(...args);
 }
 async function runStatusCommand(...args) {
-  return (await import("./doctor-w913fj4g.js")).runStatusCommand(...args);
+  return (await import("./doctor-wmre3mr7.js")).runStatusCommand(...args);
 }
 async function runAuthCommand(...args) {
-  return (await import("./profile-commands-ct2t0bfr.js")).runAuthCommand(...args);
+  return (await import("./profile-commands-49yn02yg.js")).runAuthCommand(...args);
 }
 async function runConfigCommand(...args) {
-  return (await import("./profile-commands-ct2t0bfr.js")).runConfigCommand(...args);
+  return (await import("./profile-commands-49yn02yg.js")).runConfigCommand(...args);
 }
 async function runProfilesCommand(...args) {
-  return (await import("./profile-commands-ct2t0bfr.js")).runProfilesCommand(...args);
+  return (await import("./profile-commands-49yn02yg.js")).runProfilesCommand(...args);
 }
 async function runAgentCommand(...args) {
-  return (await import("./agent-nqmha8ck.js")).runAgentCommand(...args);
+  return (await import("./agent-vp9prdma.js")).runAgentCommand(...args);
 }
 async function runProductionCommand(...args) {
-  return (await import("./production-intelligence-7n83c701.js")).runProductionCommand(...args);
+  return (await import("./production-intelligence-7nqddd4f.js")).runProductionCommand(...args);
 }
 function parseArgs(argv) {
   const args = argv.slice(2);
@@ -3326,7 +3437,7 @@ function auditOutput(command, params, data, keep) {
   if (partial && record) {
     const continueWith = auditFlags([
       params.limit ? `--limit=${params.limit}` : "",
-      params.cursor ? `--cursor=${params.cursor}` : "",
+      params.cursor ? `--cursor=${shellArg(params.cursor)}` : "",
       params.page_bytes ? `--page-bytes=${params.page_bytes}` : "",
       `--span-offset=${end}`
     ]);
@@ -3365,7 +3476,7 @@ function auditOutput(command, params, data, keep) {
   const nextCommands = [];
   if (capped.nextCursor) {
     nextCommands.push({
-      command: auditFlags([params.limit ? `--limit=${params.limit}` : "", `--cursor=${capped.nextCursor}`]),
+      command: auditFlags([params.limit ? `--limit=${params.limit}` : "", `--cursor=${shellArg(capped.nextCursor)}`]),
       purpose: "Read the next page of ingest rows of this trace.",
       mutability: "read",
       requires_approval: false
@@ -3767,13 +3878,6 @@ function specParseOptions(spec) {
     ...spec.flagAliases ? { flagAliases: spec.flagAliases } : {}
   };
 }
-function shellArg(value) {
-  if (/^[A-Za-z0-9_.,:@%+\/=-]+$/.test(value))
-    return value;
-  if (!/["$`\\!]/.test(value))
-    return `"${value}"`;
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
 function semanticIndexCoverage(coverage) {
   const ratio = asRecord(asRecord(coverage)?.semantic_index)?.coverage_ratio;
   if (typeof ratio !== "number" || !Number.isFinite(ratio) || ratio < 0 || ratio > 1)
@@ -5239,10 +5343,10 @@ async function runCommand(command, positional, flags, positionals = positional ?
       });
       const link = asRecord(data)?.link;
       const summary = describeLinearLink(link);
-      const nextCommands = link ? [] : [`moda problems link ${positional}`];
+      const nextCommands = link ? [] : [`moda problems link ${shellArg(positional)}`];
       if (context.outputMode === "human" && !context.quiet) {
         safeWriteStderr(link ? `${summary}
-` : `${summary} File one with: moda problems link ${positional}
+` : `${summary} File one with: moda problems link ${shellArg(positional)}
 `);
       }
       context.output.writeData(data, { summary, nextCommands });
@@ -5796,7 +5900,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result-and-error",
     handler: async (context) => {
-      const { runInit } = await import("./index-2kf3fnnb.js");
+      const { runInit } = await import("./index-91bpc8g8.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",
@@ -5846,7 +5950,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result-and-error",
     handler: async (context) => {
-      const { runProvision } = await import("./provision-gn8raqpt.js");
+      const { runProvision } = await import("./provision-bc3h68e1.js");
       return runProvision(context, {
         resumeCommand: buildResumeCommand("provision", context.rawFlags)
       });
@@ -6923,6 +7027,46 @@ function printAgentCliError(command, error, mode = "agent") {
   });
   output.writeError(error);
 }
+function flagNamesInLabel(label) {
+  return [...label.matchAll(/--([A-Za-z0-9][A-Za-z0-9-]*)/g)].map((match) => match[1]);
+}
+function specFlagNamesDeep(spec) {
+  if (!spec)
+    return [];
+  return [...specFlagNames(spec), ...Object.values(spec.subcommands ?? {}).flatMap((sub) => specFlagNames(sub))];
+}
+function telemetryAcceptedFlags(definition, route) {
+  const names = new Set([...GLOBAL_FLAG_NAMES, ...GLOBAL_BOOLEAN_FLAGS]);
+  const add = (list) => {
+    for (const name of list)
+      names.add(name);
+  };
+  if (definition) {
+    add(specFlagNamesDeep(flagSpecFor(definition.name)));
+    for (const flag of definition.documentedFlags ?? [])
+      add(flagNamesInLabel(flag.name));
+    for (const sub of definition.subcommands ?? [])
+      for (const flag of sub.flags ?? [])
+        add(flagNamesInLabel(flag.name));
+  }
+  if (route) {
+    add(route.allowedFlags ?? []);
+    add(Object.keys(route.flagAliases ?? {}));
+    add(specFlagNamesDeep(leafFlagSpec(route.leaf)));
+  }
+  return names;
+}
+var knownFlagNames;
+function telemetryKnownFlags() {
+  if (!knownFlagNames) {
+    knownFlagNames = new Set(RAW_BOOLEAN_FLAGS);
+    for (const definition of commandRegistry.all()) {
+      for (const name of telemetryAcceptedFlags(definition, undefined))
+        knownFlagNames.add(name);
+    }
+  }
+  return knownFlagNames;
+}
 function existingFlagProfile(flags) {
   const name = flags.profile;
   if (!name || name === "true")
@@ -7095,6 +7239,8 @@ async function dispatchParsedCommandInner(typedParsed, startedAt) {
     if (!handlerTelemetry)
       return;
     const telemetryProfile = existingFlagProfile(typedFlags);
+    if (typedFlags.profile !== undefined && telemetryProfile === undefined)
+      return;
     const adoption = buildSearchAdoptionTelemetry({
       command: handlerTelemetry,
       positional: parsed.positional,
@@ -7122,12 +7268,14 @@ async function dispatchParsedCommandInner(typedParsed, startedAt) {
       durationMs: Date.now() - startedAt,
       apiRequestCount: input.apiRequestCount,
       adoption,
-      ...identity2?.legacyAlias ? { legacyAlias: identity2.legacyAlias } : {}
+      ...identity2?.legacyAlias ? { legacyAlias: identity2.legacyAlias } : {},
+      acceptedFlags: telemetryAcceptedFlags(definition2, route),
+      knownFlags: telemetryKnownFlags()
     });
   };
   const failEarly = (error, commandDefinition, identity2) => {
     const mode = outputModeFor();
-    const telemetryOptOut = telemetryDisabled || flags["no-telemetry"] !== undefined && flags["no-telemetry"] !== "false";
+    const telemetryOptOut = telemetryDisabled || optOutFlagSet(flags, "no-telemetry", false);
     const reports = commandDefinition ? commandDefinition.telemetry === "result-and-error" : identity2 !== undefined;
     if (reports && !telemetryOptOut) {
       reportUsage({
@@ -7179,7 +7327,7 @@ async function dispatchParsedCommandInner(typedParsed, startedAt) {
     const known = Object.keys(loadProfileConfig({ env: process.env }).profiles);
     if (!known.includes(requestedProfile)) {
       const source = commandFlags.profile ? `--profile=${requestedProfile}` : `MODA_PROFILE=${requestedProfile}`;
-      return failEarly(new CliInputError(`Moda profile '${requestedProfile}' does not exist (from ${source}), so nothing was run.`, `Known profiles: ${known.join(", ")}. Create it with 'moda profiles create ${requestedProfile}' or fix the name.`, "unknown_profile"), definition, identity);
+      return failEarly(new CliInputError(`Moda profile '${requestedProfile}' does not exist (from ${source}), so nothing was run.`, `Known profiles: ${known.join(", ")}. Create it with 'moda profiles create ${shellArg(requestedProfile)}' or fix the name.`, "unknown_profile"), definition, identity);
     }
     if (commandFlags.profile)
       process.env.MODA_PROFILE = commandFlags.profile;
@@ -7188,7 +7336,7 @@ async function dispatchParsedCommandInner(typedParsed, startedAt) {
     commandFlags.agent = "true";
   }
   if (!updateCheckDisabled) {
-    startUpdateCheck();
+    startUpdateCheck({}, Date.now(), { detached: outputModeFor() !== "human" });
     setAgentUpdateNotice(() => {
       const latest = getAvailableUpdate();
       return latest ? `moda-cli ${VERSION} is out of date (latest ${latest}); commands and flags may differ from the docs. Update: npm install -g @moda-ai/cli@latest` : undefined;