@moda-ai/cli 1.55.26 → 1.55.28

package/dist/{cli-sqsjd08w.js → cli-99p2jh28.js}

@@ -1,3 +1,19 @@
+import {
+  CliAccessError,
+  CliAuthError,
+  CliCancellationError,
+  CliInputError,
+  CliInputRequiredError,
+  CliNotFoundError,
+  apiErrorStatus,
+  inputDetailsOf,
+  isApiLikeError,
+  isNetworkLikeError
+} from "./cli-k4tqwah4.js";
+import {
+  redactDeep
+} from "./cli-ns5fcnkz.js";
+
 // src/profiles.ts
 import {
   chmodSync,
@@ -449,6 +465,14 @@ function resolveBaseUrl(options = {}) {
     return PROD_BASE_URL;
   }
 }
+function resolveBaseUrlStrict(options = {}) {
+  try {
+    getActiveProfile(options);
+  } catch {
+    return;
+  }
+  return resolveBaseUrl(options);
+}
 function resolveIngestUrl(options = {}) {
   const environment = activeProfileEnvironment(options);
   const envIngest = optionalString(getEnv(options).MODA_INGEST_URL);
@@ -531,94 +555,6 @@ function writeSecretJsonFile(path, value) {
   } catch {}
 }
 
-// src/errors.ts
-class CliInputError extends Error {
-  usage;
-  reason;
-  details;
-  constructor(message, usage, reason, details) {
-    super(message);
-    this.usage = usage;
-    this.reason = reason;
-    this.details = details;
-    this.name = "CliInputError";
-  }
-}
-var inputDetails = new WeakMap;
-function attachInputDetails(error, details) {
-  inputDetails.set(error, details);
-}
-function inputDetailsOf(error) {
-  if (error instanceof CliInputError && error.details)
-    return error.details;
-  return error !== null && typeof error === "object" ? inputDetails.get(error) : undefined;
-}
-
-class CliAccessError extends Error {
-  guidance;
-  constructor(message, options = {}) {
-    super(message);
-    this.name = "CliAccessError";
-    this.guidance = options.guidance;
-  }
-}
-
-class CliInputRequiredError extends Error {
-  input_request;
-  constructor(message, input_request, usage) {
-    super(message);
-    this.input_request = input_request;
-    this.name = "CliInputRequiredError";
-    if (usage)
-      this.usage = usage;
-  }
-  usage;
-}
-
-class CliAuthError extends Error {
-  auth;
-  constructor(message, auth, usage) {
-    super(message);
-    this.auth = auth;
-    this.name = "CliAuthError";
-    if (usage)
-      this.usage = usage;
-  }
-  usage;
-}
-
-class CliNotFoundError extends Error {
-  entity;
-  id;
-  usage;
-  constructor(entity, id, message, usage) {
-    super(message ?? `No ${entity} found for id "${id}" in this tenant.`);
-    this.entity = entity;
-    this.id = id;
-    this.usage = usage;
-    this.name = "CliNotFoundError";
-  }
-}
-
-class CliCancellationError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CliCancellationError";
-  }
-}
-function isNetworkLikeError(error) {
-  return error instanceof Error && (error.message.startsWith("Network error:") || error.message.startsWith("Request timed out") || error.name === "AbortError" || /(?:ECONNRESET|ECONNREFUSED|ETIMEDOUT|ENOTFOUND|socket hang up)/i.test(error.message));
-}
-function isApiLikeError(error) {
-  return error instanceof Error && (error.name === "ApiError" || ("statusCode" in error) && typeof error.statusCode === "number");
-}
-function apiErrorStatus(error) {
-  if (!isApiLikeError(error))
-    return;
-  const status = error.statusCode;
-  return typeof status === "number" ? status : undefined;
-}
-
 // src/config.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 var pkg = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
@@ -663,11 +599,12 @@ function resolveApiTenantId(options = {}) {
   const apiKey = resolveApiKey(options);
   return (apiKey ? embeddedTenantIdFromApiKey(apiKey) : undefined) || resolveTenantId(options);
 }
-var MODA_API_KEY = process.env.MODA_API_KEY;
-var MODA_INGEST_URL = process.env.MODA_INGEST_URL || DEFAULT_INGEST_URL;
 function resolveModaBaseUrl(options = {}) {
   return resolveBaseUrl(options) || PROD_BASE_URL;
 }
+function resolveModaBaseUrlStrict(options = {}) {
+  return resolveBaseUrlStrict(options);
+}
 function validateConfig() {
   if (!resolveApiKey()) {
     throw new CliAuthError('No Moda API key found. Set MODA_API_KEY=moda_sk_... in the environment, save one with "moda auth login --api-key", or run "moda init" for interactive setup.', {
@@ -677,6 +614,31 @@ function validateConfig() {
   }
 }
 
+// src/api-key-headers.ts
+var PLATFORM_API_KEY_PREFIX = "moda_pk_";
+var TENANT_HEADER = "x-moda-tenant-id";
+function isPlatformApiKey(key) {
+  return Boolean(key?.startsWith(PLATFORM_API_KEY_PREFIX));
+}
+var platformTenantOverride;
+function setPlatformTenantOverride(tenantId) {
+  platformTenantOverride = tenantId;
+}
+var TENANT_PATH = /\/tenants\/([^/?#]+)/;
+function tenantFromUrl(url) {
+  const match = url ? TENANT_PATH.exec(url) : null;
+  return match ? decodeURIComponent(match[1]) : undefined;
+}
+function apiKeyHeaders(key, options = {}, url) {
+  const headers = { "x-api-key": key };
+  if (isPlatformApiKey(key)) {
+    const tenantId = tenantFromUrl(url) || platformTenantOverride || resolveTenantId(options);
+    if (tenantId)
+      headers[TENANT_HEADER] = tenantId;
+  }
+  return headers;
+}
+
 // src/api-request-count.ts
 var apiRequestCount = 0;
 function recordApiRequest() {
@@ -689,765 +651,13 @@ function resetApiRequestCount() {
   apiRequestCount = 0;
 }
 
-// ../../packages/harness-snapshot/src/policy.ts
-var MAX_SCANNED_FILE_BYTES = 512 * 1024;
-var DEFAULT_MAX_INVENTORY_FILES = 12000;
-var DEFAULT_MAX_INVENTORY_TEXT_BYTES = 48 * 1024 * 1024;
-var MAX_SNAPSHOT_BODY_BYTES = 4500000;
-var MAX_RECORDED_SKIPS = 1000;
-var SKIPPED_DIRS = new Set([
-  ".angular",
-  ".cache",
-  ".expo",
-  ".git",
-  ".hg",
-  ".idea",
-  ".svn",
-  ".next",
-  ".nuxt",
-  ".output",
-  ".parcel-cache",
-  ".pytest_cache",
-  ".ruff_cache",
-  ".serverless",
-  ".sst",
-  ".turbo",
-  ".wrangler",
-  ".wrangler-shared",
-  ".moda",
-  ".moda-test",
-  ".moda-test-home",
-  ".moda-cli-workspaces",
-  ".moda-cli-benchmarks",
-  "node_modules",
-  "dist",
-  "build",
-  "coverage",
-  "out",
-  "target",
-  "logs",
-  "tmp",
-  "temp",
-  "__pycache__",
-  ".venv",
-  "venv"
-]);
-var SKIPPED_PATH_PREFIXES = [
-  ".claude/worktrees",
-  ".codex/environments"
-];
-function posixNormalize(path) {
-  const absolute = path.startsWith("/");
-  const parts = path.split("/").filter((part) => part !== "" && part !== ".");
-  const normalized = parts.join("/");
-  return absolute ? `/${normalized}` : normalized;
-}
-function basename(path) {
-  const normalized = posixNormalize(path);
-  const index = normalized.lastIndexOf("/");
-  return index === -1 ? normalized : normalized.slice(index + 1);
-}
-function extname(path) {
-  const name = basename(path);
-  const index = name.lastIndexOf(".");
-  return index <= 0 ? "" : name.slice(index);
-}
-function isSkippedDir(path) {
-  return SKIPPED_DIRS.has(basename(path));
-}
-function isSkippedPathPrefix(path) {
-  const normalized = posixNormalize(path);
-  return SKIPPED_PATH_PREFIXES.some((prefix) => normalized === prefix || normalized.startsWith(`${prefix}/`));
-}
-function isSourceFile(path) {
-  return /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(path);
-}
-function isPackageOrLockfile(path) {
-  return path === "package.json" || path === "pyproject.toml" || path === "bun.lock" || path === "bun.lockb" || path === "pnpm-lock.yaml" || path === "yarn.lock";
-}
-function isPromptLikePath(path) {
-  return /(^|\/)prompts?\//i.test(path) && /\.(prompt\.)?(md|json|ya?ml)$/i.test(path);
-}
-function isSkillLikePath(path) {
-  return /(^|\/)(\.claude\/skills|\.cursor\/rules|skills?)\//i.test(path) && /\.(md|mdc)$/i.test(path);
-}
-function isEvalLikePath(path) {
-  return /(^|\/)(evals?|tests?|__tests__)\//i.test(path) && /\.(ts|tsx|js|mjs|py|json|ya?ml)$/i.test(path);
-}
-function isDeploymentLikePath(path) {
-  return /(^|\/)(wrangler\.toml|vercel\.json|render\.ya?ml|railway\.json|Dockerfile|docker-compose\.ya?ml)$/i.test(path) || /^\.github\/workflows\/[^/]+\.ya?ml$/i.test(path);
-}
-function isDeveloperAgentConfigPath(path) {
-  return path === ".claude/settings.json" || path === ".codex/hooks.json" || path === ".cursor/hooks.json";
-}
-function isReadmeOrAgents(path) {
-  const name = basename(path);
-  return name === "README.md" || name === "AGENTS.md";
-}
-function shouldInventoryFile(path) {
-  const normalized = posixNormalize(path);
-  const name = basename(normalized);
-  const extension = extname(normalized).toLowerCase();
-  if (isSourceFile(normalized))
-    return true;
-  if (isPackageOrLockfile(normalized))
-    return true;
-  if (isPromptLikePath(normalized))
-    return true;
-  if (isSkillLikePath(normalized))
-    return true;
-  if (isEvalLikePath(normalized))
-    return true;
-  if (isDeploymentLikePath(normalized))
-    return true;
-  if (isDeveloperAgentConfigPath(normalized))
-    return true;
-  if (isReadmeOrAgents(normalized))
-    return true;
-  return extension === ".toml" && (name === "pyproject.toml" || name === "wrangler.toml");
-}
-function isTextFile(path) {
-  const extension = extname(path).toLowerCase();
-  return [
-    "",
-    ".cjs",
-    ".js",
-    ".json",
-    ".jsx",
-    ".md",
-    ".mdc",
-    ".mjs",
-    ".py",
-    ".toml",
-    ".ts",
-    ".tsx",
-    ".txt",
-    ".yaml",
-    ".yml"
-  ].includes(extension);
-}
-function isSecretishPath(path) {
-  const name = basename(path).toLowerCase();
-  return name === ".env" || name.startsWith(".env.") || name.includes("secret") || name.includes("private-key") || name.endsWith(".pem");
-}
-
-// ../../packages/harness-snapshot/src/redact.ts
-var REDACTED = "[REDACTED]";
-var MAX_DEPTH = 256;
-var SECRET_KEYS = new Set([
-  "api_key",
-  "apikey",
-  "token",
-  "access_token",
-  "authorization",
-  "secret",
-  "password",
-  "cli_token"
-]);
-var SECRET_PATTERNS = [
-  { pattern: /\bmoda_sk_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
-  { pattern: /\bmoda_pk_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
-  { pattern: /\bmoda_ct_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
-  { pattern: /\bBearer\s+([A-Za-z0-9._~+/-]+=*)\b/gi, prefixLength: 8 },
-  { pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
-  { pattern: /\bsk-ant-api\d{2}-[A-Za-z0-9_-]{20,}\b/g, prefixLength: 12 },
-  { pattern: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\b/g, prefixLength: 8 },
-  { pattern: /\bAKIA[A-Z0-9]{16}\b/g, prefixLength: 8 },
-  { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, prefixLength: 8 },
-  { pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g, prefixLength: 8 },
-  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, prefixLength: 8 }
-];
-function redactDeep(value) {
-  return redactValue(value, 0, new WeakSet);
-}
-function redactValue(value, depth, seen) {
-  if (typeof value === "string")
-    return redactString(value);
-  if (value === null || typeof value !== "object")
-    return value;
-  if (depth >= MAX_DEPTH)
-    return "[MaxDepth]";
-  if (seen.has(value))
-    return "[Circular]";
-  seen.add(value);
-  if (Array.isArray(value)) {
-    try {
-      return value.map((item) => redactValue(item, depth + 1, seen));
-    } finally {
-      seen.delete(value);
-    }
-  }
-  const out = {};
-  try {
-    for (const [key, item] of Object.entries(value)) {
-      out[key] = shouldRedactKey(key) ? redactSecretValue(item) : redactValue(item, depth + 1, seen);
-    }
-  } finally {
-    seen.delete(value);
-  }
-  return out;
-}
-function shouldRedactKey(key) {
-  return SECRET_KEYS.has(key.replace(/[-\s]/g, "_").toLowerCase());
-}
-function redactSecretValue(value) {
-  if (typeof value !== "string")
-    return REDACTED;
-  const redacted = redactString(value);
-  if (redacted !== value)
-    return redacted;
-  if (/^(configured|missing|not_configured|none|present|absent)$/i.test(value))
-    return value;
-  return REDACTED;
-}
-function redactStringWithCount(input) {
-  let text = input;
-  let redactionCount = 0;
-  for (const { pattern, prefixLength } of SECRET_PATTERNS) {
-    text = text.replace(pattern, (match) => {
-      redactionCount += 1;
-      if (/^Bearer\s+/i.test(match)) {
-        const token = match.replace(/^Bearer\s+/i, "");
-        return `Bearer ${token.slice(0, prefixLength)}...[REDACTED]`;
-      }
-      return `${match.slice(0, prefixLength)}...[REDACTED]`;
-    });
-  }
-  return { text, redactionCount };
-}
-function redactString(input) {
-  return redactStringWithCount(input).text;
-}
-function redactSnapshotText(text) {
-  const parts = text.split(/(\r\n|\r|\n)/);
-  let redactionCount = 0;
-  for (let index = 0;index < parts.length; index += 2) {
-    const redacted = redactStringWithCount(parts[index] ?? "");
-    parts[index] = redacted.text;
-    redactionCount += redacted.redactionCount;
-  }
-  return { text: parts.join(""), redactionCount };
-}
-
-// ../../packages/harness-snapshot/src/pack.ts
-function utf8ByteLength(value) {
-  let bytes = 0;
-  for (let index = 0;index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code <= 127) {
-      bytes += 1;
-    } else if (code <= 2047) {
-      bytes += 2;
-    } else if (code >= 55296 && code <= 56319) {
-      const next = value.charCodeAt(index + 1);
-      if (next >= 56320 && next <= 57343) {
-        bytes += 4;
-        index += 1;
-      } else {
-        bytes += 3;
-      }
-    } else {
-      bytes += 3;
-    }
-  }
-  return bytes;
-}
-function isValidRelativePath(path) {
-  if (path.length === 0 || path.startsWith("/") || path.includes("\\"))
-    return false;
-  return !path.split("/").some((part) => part === "..");
-}
-function packSnapshot(inputs, opts) {
-  const maxFiles = opts.maxFiles ?? DEFAULT_MAX_INVENTORY_FILES;
-  const maxTextBytes = opts.maxTextBytes ?? DEFAULT_MAX_INVENTORY_TEXT_BYTES;
-  const maxSnapshotBytes = opts.maxSnapshotBytes ?? MAX_SNAPSHOT_BODY_BYTES;
-  const files = [];
-  const skips = [];
-  let inventoryTextBytes = 0;
-  let serializedBytes = 0;
-  let byteCount = 0;
-  let truncated = false;
-  const recordSkip = (path, reason) => {
-    if (skips.length < MAX_RECORDED_SKIPS)
-      skips.push({ path, reason });
-  };
-  const sorted = [...inputs].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
-  for (const input of sorted) {
-    if (!isValidRelativePath(input.path)) {
-      recordSkip(input.path, "invalid relative path");
-      continue;
-    }
-    const path = posixNormalize(input.path);
-    if (input.isSymlink) {
-      recordSkip(path, "symlink skipped for safety");
-      continue;
-    }
-    if (isSecretishPath(path)) {
-      recordSkip(path, "secret-bearing path");
-      continue;
-    }
-    if (!shouldInventoryFile(path)) {
-      recordSkip(path, "not an inventory file");
-      continue;
-    }
-    if (!isTextFile(path)) {
-      recordSkip(path, "non-text file");
-      continue;
-    }
-    if (input.byteSize > MAX_SCANNED_FILE_BYTES) {
-      recordSkip(path, "file too large");
-      truncated = true;
-      continue;
-    }
-    if (files.length >= maxFiles || inventoryTextBytes + input.byteSize > maxTextBytes) {
-      recordSkip(path, "inventory budget");
-      truncated = true;
-      continue;
-    }
-    const text = opts.redact === false ? input.text : redactSnapshotText(input.text).text;
-    const file = { path, text };
-    const serializedCost = utf8ByteLength(JSON.stringify(file)) + 1;
-    if (serializedBytes + serializedCost > maxSnapshotBytes) {
-      recordSkip(path, "snapshot budget");
-      truncated = true;
-      break;
-    }
-    files.push(file);
-    inventoryTextBytes += input.byteSize;
-    serializedBytes += serializedCost;
-    byteCount += utf8ByteLength(text);
-  }
-  return {
-    snapshot: {
-      repo: { name: opts.repoName, root: "." },
-      files,
-      truncated,
-      fileCount: files.length,
-      byteCount,
-      ...opts.gitCommit ? { gitCommit: opts.gitCommit } : {}
-    },
-    skips
-  };
-}
-// src/batch-reads.ts
-import { readFile } from "node:fs/promises";
-var BATCH_MAX_TARGETS = 25;
-var BATCH_CONCURRENCY = 4;
-var ANCHOR_SUFFIX = /^(.+)@(\d+)$/;
-function parseBatchTarget(text, anchors, usage) {
-  const raw = text.trim();
-  if (raw.startsWith("{")) {
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch {
-      throw new CliInputError(`Could not parse the JSON target ${JSON.stringify(raw)}.`, usage, "bad_batch_target");
-    }
-    const record = parsed;
-    const id = record?.id ?? record?.conversation_id ?? record?.trace_id;
-    if (typeof id !== "string" || id.trim() === "") {
-      throw new CliInputError(`JSON target ${JSON.stringify(raw)} has no "id" string.`, usage, "bad_batch_target");
-    }
-    const index = record.msg_index ?? record.message_index;
-    if (index !== undefined && index !== null) {
-      if (!anchors) {
-        throw new CliInputError(`JSON target ${JSON.stringify(raw)} has a msg_index, which this command does not take.`, usage, "bad_batch_target");
-      }
-      if (typeof index !== "number" || !Number.isSafeInteger(index) || index < 0) {
-        throw new CliInputError(`JSON target ${JSON.stringify(raw)} has an invalid msg_index (want an integer >= 0).`, usage, "bad_batch_target");
-      }
-      return { raw, id, msgIndex: index };
-    }
-    return { raw, id };
-  }
-  if (anchors) {
-    const match = ANCHOR_SUFFIX.exec(raw);
-    if (match) {
-      const msgIndex = Number(match[2]);
-      if (!Number.isSafeInteger(msgIndex)) {
-        throw new CliInputError(`Target ${JSON.stringify(raw)} has an @msg_index past ${Number.MAX_SAFE_INTEGER}. ` + 'If the id itself ends in @<digits>, pass it as {"id": "..."}.', usage, "bad_batch_target");
-      }
-      return { raw, id: match[1], msgIndex };
-    }
-  }
-  return { raw, id: raw };
-}
-function parseTargetLines(text, anchors, usage) {
-  return text.split(/\r?\n/).map((line) => line.trim()).filter((line) => line !== "").map((line) => parseBatchTarget(line, anchors, usage));
-}
-async function readStdinText() {
-  if (process.stdin.isTTY) {
-    throw new CliInputError("--ids-from=- reads targets from stdin, but stdin is a terminal. Pipe ids in (one per line) or pass a file path.", undefined, "ids_from_tty");
-  }
-  const chunks = [];
-  for await (const chunk of process.stdin)
-    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
-  return Buffer.concat(chunks).toString("utf8");
-}
-async function readIdsFrom(source, usage) {
-  if (source === "" || source === "true") {
-    throw new CliInputError("--ids-from needs a value: - (stdin) or a file path.", usage, "missing_flag_value");
-  }
-  if (source === "-")
-    return readStdinText();
-  try {
-    return await readFile(source, "utf8");
-  } catch (error) {
-    const code = error.code;
-    throw new CliInputError(`Could not read --ids-from file ${JSON.stringify(source)}${typeof code === "string" ? ` (${code})` : ""}.`, usage, "ids_from_unreadable");
-  }
-}
-async function collectBatchTargets(positionals, idsFrom, options) {
-  const targets = positionals.map((value) => parseBatchTarget(value, options.anchors, options.usage));
-  if (idsFrom !== undefined) {
-    targets.push(...parseTargetLines(await readIdsFrom(idsFrom, options.usage), options.anchors, options.usage));
-  }
-  const seen = new Set;
-  const unique = targets.filter((target) => {
-    const key = `${target.id}\x00${target.msgIndex ?? ""}`;
-    if (seen.has(key))
-      return false;
-    seen.add(key);
-    return true;
-  });
-  if (unique.length === 0) {
-    throw new CliInputError(`No targets: --ids-from gave no ids (one per line).`, options.usage, "missing_positional");
-  }
-  if (unique.length > BATCH_MAX_TARGETS) {
-    throw new CliInputError(`Got ${unique.length} targets; 'moda ${options.command}' reads at most ${BATCH_MAX_TARGETS} per call, so nothing was read. ` + `Split the ids into calls of ${BATCH_MAX_TARGETS} or fewer.`, options.usage, "batch_too_large");
-  }
-  return unique;
-}
-async function mapWithConcurrency(items, limit, fn, options = {}) {
-  const results = new Array(items.length);
-  let next = 0;
-  let failure;
-  const worker = async () => {
-    while (!failure && next < items.length && (options.shouldStart?.(next) ?? true)) {
-      const index = next++;
-      try {
-        results[index] = await fn(items[index], index);
-      } catch (error) {
-        failure ??= { error };
-      }
-    }
-  };
-  await Promise.all(Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, worker));
-  if (failure)
-    throw failure.error;
-  return next < items.length ? results.slice(0, next) : results;
-}
-function idNeedsJsonTarget(id) {
-  return ANCHOR_SUFFIX.test(id);
-}
-function contextTarget(id) {
-  const verbatim = id === id.trim() && !id.startsWith("{") && !idNeedsJsonTarget(id);
-  return verbatim ? id : JSON.stringify({ id });
-}
-
-// src/transforms.ts
-function asRecord(value) {
-  if (value && typeof value === "object" && !Array.isArray(value)) {
+// src/shell-quote.ts
+function shellArg(value) {
+  if (/^[A-Za-z0-9_.,:@%+/=-]+$/.test(value))
     return value;
-  }
-  return null;
-}
-function asString(value) {
-  return typeof value === "string" ? value : null;
-}
-function asNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
-}
-function frustrationAnchorIndex(row) {
-  if (!row)
-    return null;
-  const userQuotes = Array.isArray(row.user_quotes) ? row.user_quotes : [];
-  const firstQuote = asRecord(userQuotes[0]);
-  const resolved = asNumber(firstQuote?.msg_index) ?? asNumber(row.anchor_msg_index);
-  if (resolved !== null)
-    return resolved;
-  const keyTurns = Array.isArray(row.key_turns) ? row.key_turns : [];
-  const firstTurn = keyTurns.find((t) => typeof t === "number");
-  if (firstTurn !== undefined)
-    return firstTurn;
-  return asNumber(firstQuote?.turn);
-}
-function buildFrustrationAnchor(row) {
-  const conversation_id = asString(row.conversation_id) ?? "";
-  const userQuotes = Array.isArray(row.user_quotes) ? row.user_quotes : [];
-  const firstQuote = asRecord(userQuotes[0]);
-  const keyTurnsRaw = Array.isArray(row.key_turns) ? row.key_turns : [];
-  const all_turns = keyTurnsRaw.filter((t) => typeof t === "number");
-  const msg_index = frustrationAnchorIndex(row);
-  let signal = null;
-  let quote_preview = null;
-  if (firstQuote) {
-    signal = asString(firstQuote.signal);
-    const quote = asString(firstQuote.quote);
-    if (quote !== null) {
-      let end = 0;
-      let points = 0;
-      for (const ch of quote) {
-        if (points++ === 200)
-          break;
-        end += ch.length;
-      }
-      quote_preview = quote.slice(0, end);
-    }
-  }
-  return {
-    kind: "frustration",
-    conversation_id,
-    msg_index,
-    signal,
-    quote_preview,
-    all_turns,
-    no_anchor: msg_index === null
-  };
-}
-function buildToolFailureAnchor(row, toolName) {
-  const conversation_id = asString(row.conversation_id) ?? "";
-  const msg_index = asNumber(row.msg_index);
-  const tool_use_id = asString(row.tool_use_id);
-  const error_subtype = asString(row.error_subtype);
-  return {
-    kind: "tool_failure",
-    conversation_id,
-    msg_index,
-    tool_name: toolName,
-    tool_use_id,
-    error_subtype,
-    no_anchor: msg_index === null
-  };
-}
-function frustrationsFromEmotions(response) {
-  if (!Array.isArray(response.detections) || Array.isArray(response.frustrations))
-    return response;
-  const summary = asRecord(response.summary) ?? {};
-  const pagination = asRecord(response.pagination) ?? {};
-  const byFamily = asRecord(summary.by_family) ?? {};
-  const totalAnalyzed = asNumber(summary.conversations_analyzed) ?? 0;
-  const byFamilyConversations = asRecord(summary.conversations_by_family);
-  const frustrated = asNumber(byFamilyConversations?.frustration) ?? asNumber(byFamily.frustration) ?? 0;
-  const frustrations = response.detections.map((item) => asRecord(item)).filter((row) => row !== null && (row.family === undefined || row.family === "frustration")).map(({ conversation_context, score, is_detected, ...row }) => ({
-    ...row,
-    is_frustrated: is_detected === true,
-    frustration_score: score,
-    target: row.elicitor === "bot" || row.elicitor === "external" ? row.elicitor : "ambiguous",
-    conversation: conversation_context ?? null
-  }));
-  const atRisk = asNumber(pagination.at_risk) ?? Math.max(0, (asNumber(pagination.total) ?? 0) - frustrated);
-  const signalBreakdown = {};
-  for (const item of Array.isArray(response.signal_breakdown) ? response.signal_breakdown : []) {
-    const row = asRecord(item);
-    if (row?.family === "frustration" && typeof row.signal === "string") {
-      signalBreakdown[row.signal] = asNumber(row.count) ?? 0;
-    }
-  }
-  const { detections: _detections, ...rest } = response;
-  return {
-    ...rest,
-    summary: {
-      total_analyzed: totalAnalyzed,
-      frustrated_count: frustrated,
-      at_risk_count: atRisk,
-      frustration_rate_pct: totalAnalyzed > 0 ? Math.round(frustrated / totalAnalyzed * 1000) / 10 : 0
-    },
-    signal_breakdown: signalBreakdown,
-    frustrations,
-    source: "emotion_detections"
-  };
-}
-function withFrustrationAnchors(response) {
-  if (!Array.isArray(response.frustrations))
-    return response;
-  const frustrations = response.frustrations.map((item) => {
-    const row = asRecord(item);
-    if (!row)
-      return item;
-    const anchor = buildFrustrationAnchor(row);
-    return { ...row, anchor };
-  });
-  return { ...response, frustrations };
-}
-var TOOL_FAILURE_CONTEXT_RADIUS = 2;
-function shellWord(value) {
-  return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function trimFailureWindow(value, radius, fallbackCenter) {
-  const conv = asRecord(value);
-  if (!conv)
-    return value ?? null;
-  const { coverage: _coverage, context, ...convRest } = conv;
-  const ctx = asRecord(context);
-  if (!ctx)
-    return convRest;
-  const center = asNumber(ctx.center_index) ?? fallbackCenter;
-  const messages = (Array.isArray(ctx.messages) ? ctx.messages : []).map((message) => asRecord(message)).filter((message) => {
-    const index = asNumber(message?.index);
-    return message !== null && (center === null || index === null || Math.abs(index - center) <= radius);
-  }).map(({ content_blocks, ...message }) => {
-    const covered = typeof message.content === "string" && message.content.length > 0 || Array.isArray(message.tool_calls) && message.tool_calls.length > 0 || Array.isArray(message.tool_results) && message.tool_results.length > 0;
-    return covered || content_blocks === undefined ? message : { ...message, content_blocks };
-  });
-  const indexes = messages.map((message) => asNumber(message.index)).filter((index) => index !== null);
-  return {
-    ...convRest,
-    context: {
-      ...ctx,
-      ...indexes.length > 0 ? { from_index: Math.min(...indexes), to_index: Math.max(...indexes) } : {},
-      messages
-    }
-  };
-}
-function trimToolFailureConversations(response, opts) {
-  if (!Array.isArray(response.examples))
-    return response;
-  const examples = response.examples.map((item) => {
-    const row = asRecord(item);
-    if (!row)
-      return item;
-    const { conversation, window, ...rest } = row;
-    const conversationId = asString(row.conversation_id);
-    const msgIndex = asNumber(asRecord(row.anchor)?.msg_index) ?? asNumber(row.msg_index);
-    return {
-      ...rest,
-      ...conversationId && msgIndex !== null ? { context_command: `moda traces get ${shellWord(contextTarget(conversationId))} --msg-index=${msgIndex} --window=${TOOL_FAILURE_CONTEXT_RADIUS}` } : {},
-      ...opts.drop ? {} : { conversation: trimFailureWindow(conversation, TOOL_FAILURE_CONTEXT_RADIUS, msgIndex) },
-      ..."window" in row ? { window: trimFailureWindow(window, opts.windowRadius ?? TOOL_FAILURE_CONTEXT_RADIUS, msgIndex) } : {}
-    };
-  });
-  return { ...response, examples };
-}
-function withToolFailureAnchors(response) {
-  if (!Array.isArray(response.examples))
-    return response;
-  const toolName = asString(response.tool_name) ?? "";
-  const examples = response.examples.map((item) => {
-    const row = asRecord(item);
-    if (!row)
-      return item;
-    const anchor = buildToolFailureAnchor(row, toolName);
-    return { ...row, anchor };
-  });
-  return { ...response, examples };
-}
-function embeddedWindowSize(conversation) {
-  if (!conversation)
-    return null;
-  const ctx = asRecord(conversation.context);
-  if (!ctx)
-    return null;
-  const center = asNumber(ctx.center_index);
-  const from = asNumber(ctx.from_index);
-  const to = asNumber(ctx.to_index);
-  if (center === null || from === null || to === null)
-    return null;
-  return Math.min(center - from, to - center);
-}
-var DETECTION_CONTEXT_RADIUS = 2;
-function withoutDetectionWindows(response, listKey, windowKey) {
-  const list = response[listKey];
-  if (!Array.isArray(list))
-    return response;
-  const rows = list.map((item) => {
-    const row = asRecord(item);
-    if (!row)
-      return item;
-    const { [windowKey]: _window, ...rest } = row;
-    const conversationId = asString(row.conversation_id);
-    const msgIndex = asNumber(asRecord(row.anchor)?.msg_index) ?? frustrationAnchorIndex(row);
-    return {
-      ...rest,
-      ...conversationId && msgIndex !== null ? { context_command: `moda traces get ${shellWord(contextTarget(conversationId))} --msg-index=${msgIndex} --window=${DETECTION_CONTEXT_RADIUS}` } : {}
-    };
-  });
-  return { ...response, [listKey]: rows };
-}
-var PROBLEM_COMPACT_EVIDENCE = 5;
-var PROBLEM_COMPACT_OMITTED_BLOCKS = [
-  "rubric",
-  "trend",
-  "sub_problems",
-  "affected_conversations",
-  "remainder",
-  "confidence",
-  "change_history",
-  "stories"
-];
-function readCommand(command, purpose) {
-  return { command, purpose, mutability: "read", requires_approval: false };
-}
-function evidenceMsgIndex(row) {
-  return asNumber(row.anchor_msg_index) ?? asNumber(asRecord(asRecord(row.snippet_parsed)?.anchor)?.msg_index);
-}
-function compactProblemDossier(response, problemId) {
-  const id = shellWord(asString(response.problem_id) ?? problemId);
-  const evidence = (Array.isArray(response.evidence) ? response.evidence : []).map((item) => asRecord(item)).filter((row) => row !== null);
-  const topEvidence = evidence.slice(0, PROBLEM_COMPACT_EVIDENCE).map((row) => {
-    const conversationId = asString(row.conversation_id);
-    const msgIndex = evidenceMsgIndex(row);
-    return {
-      attribution_id: row.attribution_id ?? null,
-      conversation_id: conversationId,
-      msg_index: msgIndex,
-      signal_family: row.signal_family ?? null,
-      signal_type: row.signal_type ?? null,
-      confidence: row.confidence ?? null,
-      causal_rationale: row.causal_rationale ?? null,
-      door: row.door ?? null,
-      replay_verified: row.replay_verified ?? null,
-      ...conversationId && msgIndex !== null ? { context_command: `moda traces get ${shellWord(contextTarget(conversationId))} --msg-index=${msgIndex}` } : {}
-    };
-  });
-  const reportsBlock = asRecord(response.investigation_reports);
-  const reports = (Array.isArray(reportsBlock?.items) ? reportsBlock.items : []).map((item) => asRecord(item)).filter((row) => row !== null).map((row) => ({
-    report_id: row.report_id ?? null,
-    conversation_id: row.conversation_id ?? null,
-    mechanism: row.mechanism ?? null,
-    suspected_surface: row.suspected_surface ?? null,
-    severity: row.severity ?? null,
-    problem_found: row.problem_found ?? null
-  }));
-  const verification = asRecord(response.verification);
-  const { samples: _samples, ...verificationCounts } = verification ?? {};
-  const dossier = asRecord(response.dossier);
-  const { representative_story_keys: _storyKeys, ...dossierSummary } = dossier ?? {};
-  const trend = Array.isArray(response.trend) ? response.trend : [];
-  const data = {
-    found: response.found ?? true,
-    problem_id: response.problem_id ?? problemId,
-    requested_problem_id: response.requested_problem_id ?? problemId,
-    alias_resolved: response.alias_resolved ?? false,
-    view: "compact",
-    header: response.header ?? null,
-    dossier: dossier ? dossierSummary : null,
-    verification: verification ? verificationCounts : null,
-    ...response.impact_identity !== undefined ? { impact_identity: response.impact_identity } : {},
-    ...response.hierarchy !== undefined ? { hierarchy: response.hierarchy } : {},
-    ...trend.length > 0 ? { trend_latest: trend[trend.length - 1], trend_points: trend.length } : {},
-    top_evidence: topEvidence,
-    evidence_in_dossier: evidence.length,
-    reports,
-    omitted: {
-      evidence_rows: Math.max(0, evidence.length - topEvidence.length),
-      report_narratives: reports.length,
-      reports_has_more: reportsBlock?.has_more === true,
-      blocks: PROBLEM_COMPACT_OMITTED_BLOCKS.filter((key) => (key in response))
-    },
-    full_command: `moda problems get ${id} --full`
-  };
-  const nextCommands = [
-    readCommand(`moda problems get ${id} --evidence --limit=20`, "Page every evidence row with its anchor (follow next_cursor)."),
-    readCommand(`moda problems get ${id} --reports`, "Page investigation reports with narratives and citations."),
-    readCommand(`moda problems get ${id} --traces`, "Page affected traces with their latest anchor."),
-    readCommand(`moda problems get ${id} --full`, "The complete dossier, every block (large).")
-  ];
-  const first = topEvidence.find((row) => typeof row.context_command === "string");
-  if (first?.context_command) {
-    nextCommands.push(readCommand(first.context_command, "Read the trace around the top evidence anchor."));
-  }
-  return { data, nextCommands };
+  if (!/["$`\\!]/.test(value))
+    return `"${value}"`;
+  return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
 // src/legacy-names.ts
@@ -1618,8 +828,8 @@ function canonicalCommandText(text) {
 
 // src/output.ts
 import { randomUUID } from "node:crypto";
-import { lstatSync, mkdirSync as mkdirSync2, readdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { tmpdir } from "node:os";
+import { chmodSync as chmodSync2, lstatSync, mkdirSync as mkdirSync2, readdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { tmpdir, userInfo } from "node:os";
 import { join as join2 } from "node:path";
 var SUGGESTION_KEY = /(_commands?|^hints?|^suggestions?)$/i;
 function canonicalDeep(value, rewriteStrings) {
@@ -1713,7 +923,7 @@ var CUSTOMER_CONTENT_KEYS = new Set([
   "response"
 ]);
 function withProfileOnCommands(value, profile) {
-  const flag = `--profile=${shellWord(profile)}`;
+  const flag = `--profile=${shellArg(profile)}`;
   const visit = (node, key, inCommandList) => {
     const isCommandKey = key !== undefined && (GENERATED_COMMAND_KEY.test(key) || inCommandList && key === "command");
     if (typeof node === "string")
@@ -1722,7 +932,7 @@ function withProfileOnCommands(value, profile) {
       const list = key !== undefined && GENERATED_COMMAND_LIST_KEY.test(key);
       return node.map((item) => typeof item === "string" ? visit(item, isCommandKey ? key : undefined, false) : visit(item, undefined, list));
     }
-    const record = asRecord2(node);
+    const record = asRecord(node);
     if (!record)
       return node;
     return Object.fromEntries(Object.entries(record).map(([entryKey, entry]) => [
@@ -2493,11 +1703,11 @@ function normalizeSummary(summary, command, status, data) {
   return inferSummary(command, status, data);
 }
 function inferSummary(command, status, data) {
-  const record = asRecord2(data);
+  const record = asRecord(data);
   if (status === "error") {
     return { text: `${command} failed.`, confidence: "high" };
   }
-  const summary = asRecord2(record?.summary);
+  const summary = asRecord(record?.summary);
   if (summary) {
     const statusValue = typeof summary.status === "string" ? summary.status : undefined;
     const fail = typeof summary.fail === "number" ? summary.fail : undefined;
@@ -2549,11 +1759,11 @@ function inferMutability(command) {
   return "read";
 }
 function inferWarnings(data) {
-  const record = asRecord2(data);
+  const record = asRecord(data);
   const direct = record?.warnings;
   if (Array.isArray(direct))
     return direct.filter((item) => typeof item === "string");
-  const validation = asRecord2(record?.validation);
+  const validation = asRecord(record?.validation);
   if (Array.isArray(validation?.warnings)) {
     return validation.warnings.filter((item) => typeof item === "string");
   }
@@ -2591,10 +1801,37 @@ function pruneAgentFullOutputs(dir, keep, now = Date.now()) {
     } catch {}
   }
 }
+function currentUserTag() {
+  if (typeof process.getuid === "function")
+    return String(process.getuid());
+  try {
+    return userInfo().username.replace(/[^A-Za-z0-9_.-]+/g, "_") || "user";
+  } catch {
+    return "user";
+  }
+}
+function defaultAgentOutputDir() {
+  return join2(tmpdir(), `moda-agent-output-${currentUserTag()}`);
+}
+function ensurePrivateDir(dir) {
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const stat = lstatSync(dir);
+  if (!stat.isDirectory())
+    throw new Error(`${dir} is not a directory.`);
+  if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+    throw new Error(`${dir} is owned by another user.`);
+  }
+  if (process.platform !== "win32" && (stat.mode & 63) !== 0)
+    chmodSync2(dir, 448);
+}
 function writeAgentFullOutput(command, data) {
   try {
-    const dir = process.env.MODA_AGENT_OUTPUT_DIR || join2(tmpdir(), "moda-agent-output");
-    mkdirSync2(dir, { recursive: true, mode: 448 });
+    const configured = process.env.MODA_AGENT_OUTPUT_DIR;
+    const dir = configured || defaultAgentOutputDir();
+    if (configured)
+      mkdirSync2(dir, { recursive: true, mode: 448 });
+    else
+      ensurePrivateDir(dir);
     const slug = command.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "output";
     const stamp = new Date().toISOString().replace(/[:.]/g, "-");
     const path = join2(dir, `${slug}-${stamp}-${randomUUID().slice(0, 8)}.json`);
@@ -2615,7 +1852,7 @@ function contentBlocksRedundant(message) {
   const hasToolResults = Array.isArray(message.tool_results) && message.tool_results.length > 0;
   const texts = [];
   for (const item of blocks) {
-    const block = asRecord2(item);
+    const block = asRecord(item);
     if (!block)
       return false;
     if (block.type === "text") {
@@ -2647,7 +1884,7 @@ function shedRedundantContentBlocks(value) {
           visit(item);
       return;
     }
-    const record = asRecord2(node);
+    const record = asRecord(node);
     if (!record)
       return;
     if ("content_blocks" in record && contentBlocksRedundant(record)) {
@@ -2669,17 +1906,17 @@ function continuationCommand(invocation, overrides) {
   const dashAt = invocation.positionals.findIndex((value) => value.startsWith("-"));
   const leading = dashAt === -1 ? invocation.positionals : invocation.positionals.slice(0, dashAt);
   const trailing = dashAt === -1 ? [] : invocation.positionals.slice(dashAt);
-  const parts = ["moda", invocation.command, ...leading.map((value) => shellWord(value))];
+  const parts = ["moda", invocation.command, ...leading.map((value) => shellArg(value))];
   for (const [key, value] of Object.entries(invocation.flags)) {
     const flag = normalize2(key);
     if (overridden.has(flag) || CONTINUATION_SECRET_FLAGS.has(flag))
       continue;
-    parts.push(bare.has(flag) && value === "true" ? `--${flag}` : `--${flag}=${shellWord(String(value))}`);
+    parts.push(bare.has(flag) && value === "true" ? `--${flag}` : `--${flag}=${shellArg(String(value))}`);
   }
   for (const [key, value] of Object.entries(overrides))
-    parts.push(`--${normalize2(key)}=${shellWord(String(value))}`);
+    parts.push(`--${normalize2(key)}=${shellArg(String(value))}`);
   if (trailing.length > 0)
-    parts.push("--", ...trailing.map((value) => shellWord(value)));
+    parts.push("--", ...trailing.map((value) => shellArg(value)));
   return canonicalCommandText(parts.join(" "));
 }
 var PAGED_LIST_BY_COMMAND = {
@@ -2700,7 +1937,7 @@ function rewritePagination(list, isTopLevel, invocation) {
   const { parent, array, originalLength } = list;
   if (!parent)
     return;
-  const nested = asRecord2(parent.pagination);
+  const nested = asRecord(parent.pagination);
   const inline = !nested && !isTopLevel && (("has_more" in parent) || ("next_cursor" in parent)) ? parent : undefined;
   const pagination = nested ?? inline;
   if (!pagination)
@@ -2840,7 +2077,7 @@ function boundForAgent(data, maxBytes = agentMaxOutputBytes(), options = {}) {
       fullOutputPath
     };
   }
-  const root = asRecord2(bounded);
+  const root = asRecord(bounded);
   const notes = [];
   const nextCommands = [];
   for (const list of droppedLists.values()) {
@@ -2878,7 +2115,7 @@ function boundForAgent(data, maxBytes = agentMaxOutputBytes(), options = {}) {
     ...nextCommands.length > 0 ? { nextCommands } : {}
   };
 }
-function asRecord2(value) {
+function asRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
 }
 function extractSuggestedCommands(text) {
@@ -2886,29 +2123,4 @@ function extractSuggestedCommands(text) {
   return commands.length > 0 ? commands : undefined;
 }
 
-// src/api-key-headers.ts
-var PLATFORM_API_KEY_PREFIX = "moda_pk_";
-var TENANT_HEADER = "x-moda-tenant-id";
-function isPlatformApiKey(key) {
-  return Boolean(key?.startsWith(PLATFORM_API_KEY_PREFIX));
-}
-var platformTenantOverride;
-function setPlatformTenantOverride(tenantId) {
-  platformTenantOverride = tenantId;
-}
-var TENANT_PATH = /\/tenants\/([^/?#]+)/;
-function tenantFromUrl(url) {
-  const match = url ? TENANT_PATH.exec(url) : null;
-  return match ? decodeURIComponent(match[1]) : undefined;
-}
-function apiKeyHeaders(key, options = {}, url) {
-  const headers = { "x-api-key": key };
-  if (isPlatformApiKey(key)) {
-    const tenantId = tenantFromUrl(url) || platformTenantOverride || resolveTenantId(options);
-    if (tenantId)
-      headers[TENANT_HEADER] = tenantId;
-  }
-  return headers;
-}
-
-export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, describeBaseUrlSource, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, attachInputDetails, inputDetailsOf, CliAccessError, CliInputRequiredError, CliAuthError, CliNotFoundError, CliCancellationError, isNetworkLikeError, isApiLikeError, apiErrorStatus, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveApiTenantId, resolveModaBaseUrl, validateConfig, isPlatformApiKey, setPlatformTenantOverride, apiKeyHeaders, recordApiRequest, getApiRequestCount, resetApiRequestCount, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot, BATCH_MAX_TARGETS, BATCH_CONCURRENCY, parseBatchTarget, collectBatchTargets, mapWithConcurrency, contextTarget, asRecord, asString, asNumber, frustrationAnchorIndex, frustrationsFromEmotions, withFrustrationAnchors, shellWord, trimToolFailureConversations, withToolFailureAnchors, embeddedWindowSize, withoutDetectionWindows, compactProblemDossier, LEGACY_NAMES, canonicalCommandText, setAgentUpdateNotice, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, explicitOutputMode, outputModeFromFlags, resolveOutputMode, createCliOutput, agentEnvelopeFits, errorToAgentError, agentMaxOutputBytes, continuationCommand };
+export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, describeBaseUrlSource, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveApiTenantId, resolveModaBaseUrl, resolveModaBaseUrlStrict, validateConfig, isPlatformApiKey, setPlatformTenantOverride, apiKeyHeaders, recordApiRequest, getApiRequestCount, resetApiRequestCount, shellArg, LEGACY_NAMES, canonicalCommandText, setAgentUpdateNotice, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, explicitOutputMode, outputModeFromFlags, resolveOutputMode, createCliOutput, agentEnvelopeFits, errorToAgentError, agentMaxOutputBytes, continuationCommand };