@moda-ai/cli 1.55.28 → 1.55.29

package/dist/cli.js

@@ -91,6 +91,7 @@ import {
   createCliOutput,
   embeddedTenantIdFromApiKey,
   errorToAgentError,
+  getActiveProfile,
   getApiRequestCount,
   getModaDir,
   isPlatformApiKey,
@@ -128,7 +129,7 @@ import {
 } from "./cli-0v6na3yp.js";
 
 // src/cli.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import { z } from "zod";
 
 // src/replays.ts
@@ -387,10 +388,223 @@ function spawnDetachedNode(script, options = {}, spawnImpl = spawn) {
 }
 
 // src/telemetry.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// src/telemetry-spool.ts
+import { createHash, randomUUID } from "node:crypto";
+import {
+  closeSync,
+  constants as fsConstants,
+  fchmodSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  unlinkSync,
+  writeSync
+} from "node:fs";
+import { join } from "node:path";
+var SPOOL_MAX_BYTES = 256 * 1024;
+var FLUSH_MIN_EVENTS = 20;
+var FLUSH_MAX_AGE_MS = 30000;
+var SPOOL_MAX_EVENT_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+var FLUSH_LOCK_STALE_MS = 30000;
+var MAX_BATCH_EVENTS = 50;
+var SPOOL_LOCK_STALE_MS = 2000;
+var SPOOL_LOCK_WAIT_MS = 200;
+var SPOOL_FILE = "usage-spool.jsonl";
+var LOCK_FILE = "flush.lock";
+var SPOOL_LOCK_FILE = "spool.lock";
+var O_NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+function telemetrySpoolDir() {
+  return join(getModaDir(), "telemetry");
+}
+function keyFingerprint(apiKey) {
+  return createHash("sha256").update(`moda-cli-usage-spool\x00${apiKey}`).digest("hex").slice(0, 16);
+}
+function ensureDir(dir) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+}
+function appendLines(path, text) {
+  const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_APPEND | fsConstants.O_CREAT | O_NOFOLLOW, 384);
+  try {
+    try {
+      fchmodSync(fd, 384);
+    } catch {}
+    writeSync(fd, text);
+  } finally {
+    closeSync(fd);
+  }
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function createLockFile(path, staleMs, now) {
+  for (let attempt = 0;attempt < 2; attempt += 1) {
+    try {
+      const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | O_NOFOLLOW, 384);
+      try {
+        writeSync(fd, String(process.pid));
+      } finally {
+        closeSync(fd);
+      }
+      return true;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        return false;
+      try {
+        if (now - statSync(path).mtimeMs < staleMs)
+          return false;
+        unlinkSync(path);
+      } catch {}
+    }
+  }
+  return false;
+}
+function withSpoolLock(dir, fn) {
+  const path = join(dir, SPOOL_LOCK_FILE);
+  const deadline = Date.now() + SPOOL_LOCK_WAIT_MS;
+  while (!createLockFile(path, SPOOL_LOCK_STALE_MS, Date.now())) {
+    if (Date.now() >= deadline)
+      throw new Error("telemetry spool is locked");
+    sleepSync(5);
+  }
+  try {
+    return fn();
+  } finally {
+    try {
+      unlinkSync(path);
+    } catch {}
+  }
+}
+function fileSize(path) {
+  try {
+    return statSync(path).size;
+  } catch {
+    return 0;
+  }
+}
+function parseEntries(text) {
+  const entries = [];
+  for (const line of text.split(`
+`)) {
+    if (!line)
+      continue;
+    try {
+      const entry = JSON.parse(line);
+      if (entry && entry.v === 1 && typeof entry.url === "string" && typeof entry.profile === "string" && typeof entry.key === "string" && typeof entry.t === "number" && entry.event && typeof entry.event === "object") {
+        entries.push(entry);
+      }
+    } catch {}
+  }
+  return entries;
+}
+function sameGroup(a, b) {
+  return a.url === b.url && a.profile === b.profile && a.key === b.key;
+}
+function appendSpoolEntry(entry, dir = telemetrySpoolDir()) {
+  ensureDir(dir);
+  const path = join(dir, SPOOL_FILE);
+  const line = `${JSON.stringify(entry)}
+`;
+  return withSpoolLock(dir, () => {
+    if (fileSize(path) + Buffer.byteLength(line) > SPOOL_MAX_BYTES)
+      return false;
+    appendLines(path, line);
+    return true;
+  });
+}
+function readSpool(dir = telemetrySpoolDir()) {
+  try {
+    return parseEntries(readFileSync(join(dir, SPOOL_FILE), "utf8"));
+  } catch {
+    return [];
+  }
+}
+function discardSpool(dir = telemetrySpoolDir()) {
+  try {
+    rmSync(join(dir, SPOOL_FILE), { force: true });
+  } catch {}
+}
+function flushDue(entries, group, now) {
+  let count = 0;
+  for (const entry of entries) {
+    if (!sameGroup(entry, group))
+      continue;
+    count += 1;
+    if (count >= FLUSH_MIN_EVENTS || now - entry.t >= FLUSH_MAX_AGE_MS)
+      return true;
+  }
+  return false;
+}
+function acquireFlushLock(dir = telemetrySpoolDir(), now = Date.now()) {
+  ensureDir(dir);
+  const path = join(dir, LOCK_FILE);
+  return createLockFile(path, FLUSH_LOCK_STALE_MS, now) ? path : undefined;
+}
+function releaseFlushLock(path) {
+  if (!path)
+    return;
+  try {
+    unlinkSync(path);
+  } catch {}
+}
+function claimSpoolGroup(group, dir = telemetrySpoolDir(), now = Date.now(), limit = Number.POSITIVE_INFINITY) {
+  try {
+    return withSpoolLock(dir, () => claimLocked(group, dir, now, limit));
+  } catch {
+    return [];
+  }
+}
+function claimLocked(group, dir, now, limit) {
+  const path = join(dir, SPOOL_FILE);
+  const claim = join(dir, `${SPOOL_FILE}.${process.pid}.${randomUUID()}.claim`);
+  try {
+    renameSync(path, claim);
+  } catch {
+    return [];
+  }
+  let entries = [];
+  try {
+    entries = parseEntries(readFileSync(claim, "utf8"));
+  } catch {} finally {
+    rmSync(claim, { force: true });
+  }
+  const mine = [];
+  const others = [];
+  for (const entry of entries) {
+    const age = now - entry.t;
+    if (age > SPOOL_MAX_EVENT_AGE_MS || age < -FLUSH_LOCK_STALE_MS)
+      continue;
+    (sameGroup(entry, group) && mine.length < limit ? mine : others).push(entry);
+  }
+  if (others.length > 0) {
+    try {
+      const text = others.map((entry) => `${JSON.stringify(entry)}
+`).join("");
+      if (fileSize(path) + Buffer.byteLength(text) <= SPOOL_MAX_BYTES)
+        appendLines(path, text);
+    } catch {}
+  }
+  return mine;
+}
+function batchBodies(entries, now = Date.now()) {
+  const bodies = [];
+  for (let start = 0;start < entries.length; start += MAX_BATCH_EVENTS) {
+    const events = entries.slice(start, start + MAX_BATCH_EVENTS).map((entry) => ({ ...entry.event, age_ms: Math.min(SPOOL_MAX_EVENT_AGE_MS, Math.max(0, Math.round(now - entry.t))) }));
+    bodies.push(JSON.stringify(events));
+  }
+  return bodies;
+}
+
+// src/telemetry.ts
 var INLINE_TELEMETRY_TIMEOUT_MS = 500;
 var DETACHED_TELEMETRY_TIMEOUT_MS = 5000;
-var INVOCATION_ID = randomUUID();
+var DETACHED_TELEMETRY_HARD_STOP_MS = 20000;
+var MAX_FLUSH_BATCHES = Math.floor(DETACHED_TELEMETRY_HARD_STOP_MS / (2 * DETACHED_TELEMETRY_TIMEOUT_MS));
+var INVOCATION_ID = randomUUID2();
 var TELEMETRY_FLAG = "no-telemetry";
 var TELEMETRY_TRANSPORT_ENV = "MODA_CLI_TELEMETRY_TRANSPORT";
 var MAX_TELEMETRY_DURATION_MS = 86400000;
@@ -560,48 +774,103 @@ function safeCode(value) {
 var TELEMETRY_SENDER_SCRIPT = [
   "try {",
   "  let raw = '';",
-  `  const quit = setTimeout(() => process.exit(0), ${DETACHED_TELEMETRY_TIMEOUT_MS + 1000});`,
-  "  const done = () => clearTimeout(quit);",
+  "  let lock;",
+  "  const release = () => { if (typeof lock === 'string') { try { require('node:fs').unlinkSync(lock); } catch {} lock = undefined; } };",
+  `  const quit = setTimeout(() => { release(); process.exit(0); }, ${DETACHED_TELEMETRY_HARD_STOP_MS});`,
+  "  const done = () => { release(); clearTimeout(quit); };",
+  "  const post = (r, body) => new Promise((resolve) => {",
+  "    try {",
+  "      const u = new URL(r.url);",
+  "      const lib = require(u.protocol === 'https:' ? 'node:https' : 'node:http');",
+  "      const headers = Object.assign({}, r.headers, { 'Content-Length': Buffer.byteLength(body) });",
+  `      const req = lib.request(u, { method: 'POST', headers, agent: false, timeout: ${DETACHED_TELEMETRY_TIMEOUT_MS} }, (res) => {`,
+  "        res.on('error', () => resolve(0));",
+  "        res.on('end', () => resolve(res.statusCode || 0));",
+  "        res.resume();",
+  "      });",
+  "      req.on('timeout', () => req.destroy());",
+  "      req.on('error', () => resolve(0));",
+  "      req.end(body);",
+  "    } catch { resolve(0); }",
+  "  });",
+  "  const run = async (requests) => {",
+  "    for (const r of requests) {",
+  "      if (!r || typeof r.url !== 'string' || typeof r.body !== 'string' || !r.headers || typeof r.headers !== 'object') continue;",
+  "      const status = await post(r, r.body);",
+  "      if (status !== 400 || r.body[0] !== '[') continue;",
+  "      let events = [];",
+  "      try { events = JSON.parse(r.body); } catch {}",
+  "      await Promise.all((Array.isArray(events) ? events : []).map((event) => post(r, JSON.stringify(event))));",
+  "    }",
+  "  };",
   "  process.stdin.setEncoding('utf8');",
   "  process.stdin.on('error', () => {});",
   "  process.stdin.on('data', (chunk) => { raw += chunk; });",
   "  process.stdin.on('end', () => {",
-  "    try {",
-  "      const r = raw ? JSON.parse(raw) : null;",
-  "      raw = '';",
-  "      if (!r || typeof r.url !== 'string' || typeof fetch !== 'function') return done();",
-  "      const c = new AbortController();",
-  `      const t = setTimeout(() => c.abort(), ${DETACHED_TELEMETRY_TIMEOUT_MS});`,
-  "      fetch(r.url, { method: 'POST', headers: r.headers, body: r.body, signal: c.signal })",
-  "        .then((res) => (res.body && res.body.cancel ? res.body.cancel() : undefined))",
-  "        .catch(() => {})",
-  "        .finally(() => { clearTimeout(t); done(); });",
-  "    } catch { done(); }",
+  "    let job = null;",
+  "    try { job = raw ? JSON.parse(raw) : null; } catch {}",
+  "    raw = '';",
+  "    if (job && typeof job.lock === 'string') lock = job.lock;",
+  "    const requests = job && Array.isArray(job.requests) ? job.requests : [];",
+  "    run(requests).catch(() => {}).finally(done);",
   "  });",
   "} catch {}"
 ].join(`
 `);
-function spawnDetachedTelemetrySender(request, spawnImpl = spawn2) {
-  return spawnDetachedNode(TELEMETRY_SENDER_SCRIPT, { stdin: JSON.stringify(request), dropEnv: ["MODA_API_KEY"] }, spawnImpl);
+function spawnDetachedTelemetrySender(job, spawnImpl = spawn2) {
+  return spawnDetachedNode(TELEMETRY_SENDER_SCRIPT, { stdin: JSON.stringify(job), dropEnv: ["MODA_API_KEY"] }, spawnImpl);
+}
+async function sendTelemetryJobInline(job) {
+  try {
+    for (const pending of job.requests)
+      await sendInline(pending);
+  } finally {
+    releaseFlushLock(job.lock);
+  }
 }
 async function sendInline(request) {
+  const status = await postInline(request);
+  if (status !== 400 || !request.body.startsWith("["))
+    return;
+  let events = [];
+  try {
+    events = JSON.parse(request.body);
+  } catch {}
+  if (!Array.isArray(events))
+    return;
+  await Promise.all(events.map((event) => postInline({ ...request, body: JSON.stringify(event) })));
+}
+async function postInline(request) {
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), INLINE_TELEMETRY_TIMEOUT_MS);
   if (typeof timeout.unref === "function") {
     timeout.unref();
   }
   try {
-    await fetch(request.url, {
+    const response = await fetch(request.url, {
       method: "POST",
       headers: request.headers,
       body: request.body,
       signal: controller.signal
     });
-  } catch {} finally {
+    return response.status;
+  } catch {
+    return 0;
+  } finally {
     clearTimeout(timeout);
   }
 }
-function buildCliUsageRequest(input) {
+function usageRequest(baseUrl, apiKey, body) {
+  return {
+    url: `${baseUrl}/api/v1/data/cli-usage`,
+    headers: {
+      ...apiKeyHeaders(apiKey),
+      "Content-Type": "application/json"
+    },
+    body
+  };
+}
+function buildCliUsageEvent(input) {
   const baseUrl = resolveModaBaseUrlStrict(input.profile ? { profile: input.profile } : {});
   if (!baseUrl)
     return;
@@ -613,12 +882,8 @@ function buildCliUsageRequest(input) {
       delete adoption[key];
   }
   return {
-    url: `${baseUrl}/api/v1/data/cli-usage`,
-    headers: {
-      ...apiKeyHeaders(input.apiKey),
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
+    baseUrl,
+    event: {
       invocation_id: INVOCATION_ID,
       command: safeCode(input.command.slice(0, 64)) ?? "unknown",
       status: input.status,
@@ -637,27 +902,79 @@ function buildCliUsageRequest(input) {
         ...((alias) => alias ? { legacy_alias: alias } : {})(safeCode(sanitizeReasonCode(input.legacyAlias?.replace(/ /g, ":"), 64)))
       },
       ...adoption
-    })
+    }
+  };
+}
+function telemetryProfileName(profile) {
+  try {
+    return getActiveProfile(profile ? { profile } : {}).name;
+  } catch {
+    return "";
+  }
+}
+function queueCliUsageEvent(request, group, event, now) {
+  const dir = telemetrySpoolDir();
+  const entry = { v: 1, ...group, t: now, event };
+  let unspooled = [];
+  try {
+    if (!appendSpoolEntry(entry, dir))
+      unspooled = [entry];
+  } catch {
+    return { requests: [request] };
+  }
+  const due = unspooled.length > 0 || envOptOutSet(process.env.CI) || flushDue(readSpool(dir), group, now);
+  if (!due)
+    return;
+  const lock = acquireFlushLock(dir, now);
+  if (!lock)
+    return unspooled.length > 0 ? { requests: [request] } : undefined;
+  const limit = MAX_FLUSH_BATCHES * MAX_BATCH_EVENTS - unspooled.length;
+  const entries = [...claimSpoolGroup(group, dir, now, limit), ...unspooled];
+  if (entries.length === 0) {
+    releaseFlushLock(lock);
+    return;
+  }
+  return {
+    requests: batchBodies(entries, now).map((body) => ({ url: request.url, headers: request.headers, body })),
+    lock
   };
 }
+function discardSpoolOnEnvOptOut() {
+  if (!isTelemetryDisabled({}))
+    return false;
+  discardSpool();
+  return true;
+}
 async function sendCliUsageTelemetry(input) {
   try {
+    if (discardSpoolOnEnvOptOut())
+      return;
     if (!input.apiKey || isTelemetryDisabled(input.flags)) {
       return;
     }
-    const request = buildCliUsageRequest({ ...input, apiKey: input.apiKey });
-    if (!request)
+    const built = buildCliUsageEvent(input);
+    if (!built)
       return;
-    if (process.env[TELEMETRY_TRANSPORT_ENV] !== "inline" && spawnDetachedTelemetrySender(request)) {
+    const request = usageRequest(built.baseUrl, input.apiKey, JSON.stringify(built.event));
+    if (process.env[TELEMETRY_TRANSPORT_ENV] === "inline") {
+      await sendInline(request);
       return;
     }
-    await sendInline(request);
+    const group = {
+      url: built.baseUrl,
+      profile: telemetryProfileName(input.profile),
+      key: keyFingerprint(input.apiKey)
+    };
+    const job = queueCliUsageEvent(request, group, built.event, Date.now());
+    if (!job || spawnDetachedTelemetrySender(job))
+      return;
+    await sendTelemetryJobInline(job);
   } catch {}
 }
 
 // src/update-check.ts
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { join as join2 } from "node:path";
 var UPDATE_CHECK_FLAG = "no-update-check";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var REGISTRY_TIMEOUT_MS = 1500;
@@ -670,11 +987,11 @@ function isUpdateCheckDisabled(flags, env = process.env) {
   return optOutFlagSet(flags, UPDATE_CHECK_FLAG) || envSwitchedOff(env.MODA_CLI_UPDATE_CHECK) || envOptOutSet(env.DO_NOT_TRACK) || envOptOutSet(env.CI);
 }
 function cachePath(options = {}) {
-  return join(getModaDir(options), "update-check.json");
+  return join2(getModaDir(options), "update-check.json");
 }
 function readCache(options = {}) {
   try {
-    const parsed = JSON.parse(readFileSync(cachePath(options), "utf8"));
+    const parsed = JSON.parse(readFileSync2(cachePath(options), "utf8"));
     if (parsed && typeof parsed === "object" && typeof parsed.checked_at === "number" && typeof parsed.latest === "string") {
       return parsed;
     }
@@ -683,7 +1000,7 @@ function readCache(options = {}) {
 }
 function writeCache(cache, options = {}) {
   try {
-    mkdirSync(getModaDir(options), { recursive: true });
+    mkdirSync2(getModaDir(options), { recursive: true });
     writeFileSync(cachePath(options), `${JSON.stringify(cache, null, 2)}
 `, "utf8");
   } catch {}
@@ -5445,7 +5762,7 @@ async function runCommand(command, positional, flags, positionals = positional ?
       }
       const data = await callDataAPI(reviewPath, {
         method: "POST",
-        body: JSON.stringify({ ...reviewBody, request_nonce: randomUUID2() }),
+        body: JSON.stringify({ ...reviewBody, request_nonce: randomUUID3() }),
         headers: { "Content-Type": "application/json" }
       });
       context.output.writeData(data);
@@ -5538,7 +5855,7 @@ async function runCommand(command, positional, flags, positionals = positional ?
         });
         break;
       }
-      const sentBody = request.body && request.nonce ? { ...request.body, request_nonce: randomUUID2() } : request.body;
+      const sentBody = request.body && request.nonce ? { ...request.body, request_nonce: randomUUID3() } : request.body;
       const data = await callDataAPI(request.path, {
         method: request.method,
         ...sentBody ? { body: JSON.stringify(sentBody), headers: { "Content-Type": "application/json" } } : {}
@@ -7100,6 +7417,8 @@ async function dispatchParsedCommandInner(typedParsed, startedAt) {
   const switchError = normalizeBooleanFlags(flags);
   const typedFlags = stripUpdateCheckFlag(stripTelemetryFlag(flags));
   const telemetryDisabled = isTelemetryDisabled(flags);
+  if (telemetryDisabled)
+    discardSpoolOnEnvOptOut();
   const updateCheckDisabled = isUpdateCheckDisabled(flags);
   if (command === "--version" || command === "-V" || flags.version === "true") {
     console.log(`moda-cli ${VERSION}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.55.28",
+  "version": "1.55.29",
   "description": "CLI for Moda: production monitoring and evals for AI agents.",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-15T21:39:30.375Z",
-  "cli_version": "1.55.28",
+  "bundled_at": "2026-10-15T21:58:38.008Z",
+  "cli_version": "1.55.29",
   "skills": [
     {
       "id": "integration-cloudflare-think",