@moda-ai/cli 1.55.42 → 1.55.44

package/dist/{profile-commands-se9947c1.js → profile-commands-mh3kfqkn.js}

@@ -2,7 +2,7 @@ import {
   probeApiKey,
   redactApiKey,
   resolveApiKeyCredential
-} from "./cli-77ekrx7d.js";
+} from "./cli-xcpwp0gb.js";
 import {
   authFetch,
   clearAuthSession,
@@ -10,20 +10,29 @@ import {
   loadAuthSession,
   login,
   revokeCliSessionToken
-} from "./cli-pmzh2qjy.js";
+} from "./cli-sejqvvhv.js";
+import {
+  ApiError
+} from "./cli-dmm9jm9m.js";
 import {
   DEFAULT_INGEST_URL,
   EXIT_AUTH_REQUIRED,
   EXIT_DEGRADED,
   EXIT_OK,
   PROD_BASE_URL,
+  apiForbiddenError,
+  apiForbiddenReason,
   clearStoredApiKeyCredentials,
   describeBaseUrlSource,
+  describeModaBaseUrl,
   embeddedTenantIdFromApiKey,
   ensureSecretFilePermissions,
+  errorBodyFields,
   getActiveProfile,
   getModaPaths,
   loadProfileConfig,
+  recordApiRequest,
+  refusedBaseUrlMessage,
   resolveApiKey,
   resolveApiKeyFromActiveProfile,
   resolveApiTenantId,
@@ -35,7 +44,7 @@ import {
   setActiveProfile,
   shellArg,
   upsertProfile
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";
@@ -44,6 +53,30 @@ import"./cli-0v6na3yp.js";
 
 // src/profile-commands.ts
 var ONLINE_PROBE_TIMEOUT_MS = 5000;
+function forbiddenProbeError(probe) {
+  if (probe.status !== 403)
+    return;
+  const fields = errorBodyFields(probe.body);
+  const reason = apiForbiddenReason(fields.code, fields.message);
+  if (!reason || reason === "read_only_key")
+    return;
+  return new ApiError(`API error (403): ${fields.message ?? "forbidden"}`, 403, probe.body ?? "");
+}
+async function probeDataApiReachable(baseUrl) {
+  try {
+    recordApiRequest();
+    const response = await fetch(`${baseUrl}/api/v1/data/whoami`, {
+      method: "GET",
+      signal: AbortSignal.timeout(ONLINE_PROBE_TIMEOUT_MS)
+    });
+    await response.body?.cancel().catch(() => {
+      return;
+    });
+    return { reachable: true, status: response.status, ok: false, error: "no API key to verify" };
+  } catch (error) {
+    return { reachable: false, ok: false, error: error instanceof Error ? error.message : String(error) };
+  }
+}
 function subcommand(context) {
   return context.positionals[0];
 }
@@ -131,6 +164,9 @@ async function loginWithApiKey(context, candidate) {
   const authOptions = { profile: context.profile, env: context.env };
   const probe = await probeApiKey(key, authOptions);
   if (probe.outcome === "rejected") {
+    const forbidden = forbiddenProbeError(probe);
+    if (forbidden)
+      throw forbidden;
     throw new CliInputError(`API key rejected by the Moda API (HTTP ${probe.status}).`, 'The key is revoked, malformed, or belongs to another environment. Mint a new one with "moda provision --tenant-id=<org-id>", or check MODA_BASE_URL points at the right environment.');
   }
   if (probe.outcome === "unreachable") {
@@ -205,6 +241,9 @@ async function runAuthCommand(context) {
             env: context.env
           });
           if (probe.outcome === "rejected") {
+            const forbidden = forbiddenProbeError(probe);
+            if (forbidden)
+              throw forbidden;
             throw new CliInputError(`API key rejected by the Moda API (HTTP ${probe.status}).`, 'The key is revoked or belongs to another environment. Mint a new one with "moda provision --tenant-id=<org-id>", or run "moda auth login".');
           }
           context.output.writeData({
@@ -260,28 +299,67 @@ async function runAuthCommand(context) {
       if (session?.user_email) {
         data.user = { email: session.user_email };
       }
+      const warnings = [];
       if (boolFlag(context, "online")) {
-        let online = { reachable: false };
-        try {
-          const response = await authFetch("/api/cli/context", { signal: AbortSignal.timeout(ONLINE_PROBE_TIMEOUT_MS) }, authOptions);
-          online = { reachable: true, ok: response.ok };
-          if (response.ok) {
-            const body = await response.json();
-            if (Array.isArray(body.tenants)) {
-              online.tenantCount = body.tenants.length;
+        const baseUrl = resolveModaBaseUrl(authOptions);
+        let sessionProbe;
+        let tenantCount;
+        if (session) {
+          sessionProbe = { reachable: false, ok: false };
+          try {
+            const response = await authFetch("/api/cli/context", { signal: AbortSignal.timeout(ONLINE_PROBE_TIMEOUT_MS) }, authOptions);
+            sessionProbe = { reachable: true, status: response.status, ok: response.ok };
+            if (response.ok) {
+              const body = await response.json();
+              if (Array.isArray(body.tenants))
+                tenantCount = body.tenants.length;
             }
-          }
-        } catch {}
-        data.online = online;
+          } catch {}
+        }
+        let dataApi;
         if (credential && data.apiKeyCredential.present) {
           const probe = await probeApiKey(credential.key, authOptions);
           data.apiKeyCredential.verified = probe.outcome === "live";
-          if (probe.outcome === "rejected") {
-            data.authenticated = loggedIn;
+          if (probe.outcome === "live") {
+            const identity = probe.identity;
+            dataApi = {
+              reachable: true,
+              status: 200,
+              ok: true,
+              ...typeof identity?.tenant_id === "string" ? { tenantId: identity.tenant_id } : {},
+              ...identity && "tenant_name" in identity ? { tenantName: typeof identity.tenant_name === "string" ? identity.tenant_name : null } : {},
+              ...typeof identity?.key_kind === "string" ? { keyKind: identity.key_kind } : {},
+              ...typeof identity?.scope === "string" ? { scope: identity.scope } : {}
+            };
+          } else if (probe.outcome === "rejected") {
+            const fields = errorBodyFields(probe.body);
+            dataApi = { reachable: true, status: probe.status, ok: false, error: fields.message ?? `HTTP ${probe.status}` };
+            const reason = apiForbiddenReason(fields.code, fields.message);
+            if (reason && reason !== "read_only_key") {
+              const described = apiForbiddenError(reason, fields.message);
+              warnings.push(`${described.message} ${described.cause}`);
+            } else {
+              data.authenticated = loggedIn;
+            }
+          } else {
+            dataApi = { reachable: probe.status !== undefined, ...probe.status !== undefined ? { status: probe.status } : {}, ok: false, error: probe.reason };
           }
+        } else {
+          dataApi = await probeDataApiReachable(baseUrl);
+        }
+        data.online = {
+          baseUrl,
+          reachable: dataApi.reachable || sessionProbe?.reachable === true,
+          ok: (credential ? dataApi.ok : true) && (sessionProbe ? sessionProbe.ok : true) && Boolean(credential || sessionProbe),
+          ...tenantCount !== undefined ? { tenantCount } : {},
+          ...sessionProbe ? { session: sessionProbe } : {},
+          dataApi
+        };
+        if (sessionProbe?.status === 404 && dataApi.reachable) {
+          warnings.push(`${baseUrl} answers the Data API but has no /api/cli/context, so it looks like the backend. ` + "Data commands work against it; browser login and control-plane commands need the frontend URL (http://localhost:3000 locally).");
         }
       }
-      context.output.writeData(data);
+      context.output.writeData(data, warnings.length > 0 ? { warnings } : undefined);
       return { exitCode: data.authenticated ? EXIT_OK : EXIT_AUTH_REQUIRED };
     }
     case "token": {
@@ -417,7 +495,7 @@ async function runConfigCommand(context) {
   const options = { profile: profile.name, env: context.env };
   const envProfile = context.env.MODA_PROFILE?.trim();
   const apiKey = resolveApiKey(options);
-  const baseUrl = resolveModaBaseUrl(options);
+  const base = describeModaBaseUrl(options);
   context.output.writeData({
     moda_dir: getModaPaths({ env: context.env }).dir,
     active_profile: profile.name,
@@ -427,14 +505,14 @@ async function runConfigCommand(context) {
     resolved: {
       api_key: redactSecret(apiKey),
       api_key_source: context.env.MODA_API_KEY ? "env:MODA_API_KEY" : profile.api_key_ref === "legacy:config.api_key" && apiKey ? "legacy_config" : resolveApiKeyFromActiveProfile(options) ? "profile" : apiKey ? "legacy_config" : "none",
-      base_url: baseUrl,
+      base_url: base.refused ? null : base.url,
       base_url_source: describeBaseUrlSource(options),
       ingest_url: resolveIngestUrl(options),
       tenant_id: resolveApiTenantId(options),
       workspace_id: profile.workspace_id
     },
     migrations: config.migrations
-  });
+  }, base.refused ? { warnings: [`${refusedBaseUrlMessage(base.refused)} Data commands exit 5 until you re-run with --profile=local or unset MODA_BASE_URL.`] } : undefined);
   return { exitCode: 0 };
 }
 export {

package/dist/{prompt-attribution-pbns1ya3.js → prompt-attribution-wvvnzw4m.js}

@@ -1,17 +1,18 @@
 import {
   inventoryFiles,
   safePromptEvidencePath
-} from "./cli-vwpbspr5.js";
+} from "./cli-d4cdczhe.js";
 import"./cli-xq45etg1.js";
 import"./cli-97fnztpy.js";
 import"./cli-cesds766.js";
 import {
   require_typescript
 } from "./cli-qpq84eee.js";
-import"./cli-xddtv3yn.js";
-import"./cli-4sy4tytm.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-8pcq2et6.js";
+import"./cli-e0kbye4s.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/prompt-source-mcp.js

@@ -3,7 +3,7 @@ import {
   checkPromptMapping,
   discoverHarnessPromptSources,
   safePromptEvidencePath
-} from "./cli-vwpbspr5.js";
+} from "./cli-d4cdczhe.js";
 import"./cli-xq45etg1.js";
 import"./cli-97fnztpy.js";
 import"./cli-cesds766.js";
@@ -11,10 +11,11 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors
 } from "./cli-qpq84eee.js";
-import"./cli-xddtv3yn.js";
-import"./cli-4sy4tytm.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-8pcq2et6.js";
+import"./cli-e0kbye4s.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/{prompts-ab-f5qrvpkt.js → prompts-ab-y7egdzg4.js}

@@ -23,14 +23,15 @@ import {
   runPromptAb,
   selectProblemCases,
   waitLabel
-} from "./cli-hjm9151g.js";
-import"./cli-he8csgsr.js";
-import"./cli-daqkdnm1.js";
+} from "./cli-8pksf2x7.js";
+import"./cli-wwbr5caw.js";
+import"./cli-4pc0a18x.js";
 import"./cli-mm48br00.js";
-import"./cli-xddtv3yn.js";
-import"./cli-4sy4tytm.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-8pcq2et6.js";
+import"./cli-e0kbye4s.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/{prompts-propose-jg2j41wx.js → prompts-propose-5nw25v9a.js}

@@ -7,20 +7,21 @@ import {
   formatVerdict,
   rerunWithYes,
   resolvePromptArmSpec
-} from "./cli-hjm9151g.js";
-import"./cli-he8csgsr.js";
-import"./cli-daqkdnm1.js";
+} from "./cli-8pksf2x7.js";
+import"./cli-wwbr5caw.js";
+import"./cli-4pc0a18x.js";
 import"./cli-mm48br00.js";
-import"./cli-xddtv3yn.js";
-import"./cli-4sy4tytm.js";
+import"./cli-8pcq2et6.js";
+import"./cli-e0kbye4s.js";
+import"./cli-tztzrh6b.js";
 import {
   callControlAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   resolveApiTenantId,
   shellArg,
   validateConfig
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";

package/dist/{prompts-qppk0mhp.js → prompts-snnbyxmz.js}

@@ -11,14 +11,15 @@ import {
   runPromptSync,
   runPromptsCommand,
   writePromptSyncProgress
-} from "./cli-he8csgsr.js";
+} from "./cli-wwbr5caw.js";
 import {
   promptSourceHashPayload
 } from "./cli-mm48br00.js";
-import"./cli-xddtv3yn.js";
-import"./cli-4sy4tytm.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-8pcq2et6.js";
+import"./cli-e0kbye4s.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/{provision-cya5rpxa.js → provision-t1dpzcjp.js}

@@ -1,17 +1,18 @@
 import {
   selectTenantAndCreateKey
-} from "./cli-1z1sx8dg.js";
-import"./cli-77ekrx7d.js";
+} from "./cli-5aa48ry5.js";
+import"./cli-xcpwp0gb.js";
 import {
   loadAuthSession
-} from "./cli-pmzh2qjy.js";
+} from "./cli-sejqvvhv.js";
 import {
   stringOption
-} from "./cli-xddtv3yn.js";
+} from "./cli-8pcq2et6.js";
+import"./cli-e0kbye4s.js";
 import {
   resolveIngestUrl,
   resolveModaBaseUrl
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliAuthError
 } from "./cli-k4tqwah4.js";

package/dist/{registry-8a1940sr.js → registry-8zkxefjs.js}

@@ -1,13 +1,13 @@
 import {
   assertFlags
-} from "./cli-4sy4tytm.js";
+} from "./cli-tztzrh6b.js";
 import {
   callControlAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   explicitOutputMode,
   resolveApiKey
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";

package/dist/{skills-sh93b156.js → skills-d4215fa9.js}

@@ -3,14 +3,15 @@ import {
   pullSkills,
   runSkillSync,
   runSkillsCommand
-} from "./cli-mxfyq5nq.js";
+} from "./cli-xx0pjzkh.js";
 import"./cli-qm5b1vck.js";
 import"./cli-rjav0vj1.js";
 import"./cli-hcwdz9sd.js";
-import"./cli-xddtv3yn.js";
-import"./cli-4sy4tytm.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-8pcq2et6.js";
+import"./cli-e0kbye4s.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-ns5fcnkz.js";
 import"./cli-0v6na3yp.js";

package/dist/{sync-0pp1c8hs.js → sync-17f9yxb1.js}

@@ -1,24 +1,25 @@
 import {
   runSkillsCommand
-} from "./cli-mxfyq5nq.js";
+} from "./cli-xx0pjzkh.js";
 import"./cli-qm5b1vck.js";
 import"./cli-rjav0vj1.js";
 import"./cli-hcwdz9sd.js";
 import {
   runPromptsCommand
-} from "./cli-he8csgsr.js";
+} from "./cli-wwbr5caw.js";
 import"./cli-mm48br00.js";
 import {
   runHarnessCommand
-} from "./cli-vwpbspr5.js";
+} from "./cli-d4cdczhe.js";
 import"./cli-xq45etg1.js";
 import"./cli-97fnztpy.js";
 import"./cli-cesds766.js";
 import"./cli-qpq84eee.js";
-import"./cli-xddtv3yn.js";
-import"./cli-4sy4tytm.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-8pcq2et6.js";
+import"./cli-e0kbye4s.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.55.42",
+  "version": "1.55.44",
   "description": "CLI for Moda: production monitoring and evals for AI agents.",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-18T02:37:16.940Z",
-  "cli_version": "1.55.42",
+  "bundled_at": "2026-10-19T02:47:17.874Z",
+  "cli_version": "1.55.44",
   "skills": [
     {
       "id": "integration-cloudflare-think",

package/skills/moda-cli/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: moda-cli
-version: 3.0.8
+version: 3.0.10
 description: Investigate a production AI agent with the Moda CLI (`moda`) - find where something happened in real traces (traces search, then traces get), check agent health, rank what to fix (investigate, problems), and dig into tool failures, user frustration, and hallucinations. Also prompt registry sync/promote, replays, custom signals, and false-positive marking. Use when the user mentions Moda, production traces or conversations of their agent, agent failures, or asks what to fix.
 ---
 
@@ -20,8 +20,9 @@ in `references/`; read one only when the task needs it.
   only with an API key, so ready means `apiKeyCredential.verified` is `true`; a
   browser session from `moda auth login` alone is not enough. With no key, or
   a rejected one, ask the user to `export MODA_API_KEY=moda_sk_...` (or run
-  `moda auth login --api-key`). Do not run `moda init` unprompted; it is an
-  interactive wizard that writes to the repo.
+  `moda auth login --api-key`). `online.baseUrl` is where requests go and
+  `online.dataApi.tenantId` the tenant the key acts on. Do not run `moda init`
+  unprompted; it is an interactive wizard that writes to the repo.
 - Not installed: `npx -y -p @moda-ai/cli moda <command>`.
 - If a response carries `meta.update`, the installed CLI is out of date and
   may not match this guide; tell the user how to update
@@ -60,6 +61,8 @@ Details: `references/output-protocol.md`.
 | Where did X happen / traces about Y | `moda traces search "<words>"` (`--mode=keyword` for ids, error codes, exact strings; `--include-tool-io` for tool inputs/outputs) | `moda traces get <conversation_id> --msg-index=<message_index> --window=3` |
 | Search returned nothing | Read `.warnings` (degraded mode, reason). Try a shorter phrase, `--mode=keyword`, a wider `--time-range` | `moda traces --search="<words>"` |
 | Is the agent healthy? | `moda overview --days-back=7` | `moda investigate` |
+| Did my change make it worse? | `moda overview --compare --since=<deploy time, ISO UTC>` (after the deploy against the same span before it; add `--agent-name=<sub-agent>` for one sub-agent) | `moda overview --series --since=<deploy time>` (per hour up to 2 days, else per day), `moda detections list --family=<f> --compare`, `moda problems get <problem_id> --trend` |
+| Is X trending up? | `moda overview --compare --series --days-back=14` | `moda problems get <problem_id> --trend --days-back=30` (incidents per day) |
 | What to fix first? | `moda investigate` or `moda problems list` (free; both rank the same list the dashboard shows, `data.problemsView` names it) | `moda problems get <problem_id>` (`--view=dream` on a dream-grouped tenant), then `--evidence` / `--traces` |
 | Why is tool T failing? | `moda detections tools` | `moda detections tools <T>` (use each row's `anchor`) |
 | How often is tool T called / what is its schema? | `moda tools list` (every tool: calls, failed calls, success rate; `--sort=failure_rate`) | `moda tools get <T>` (registered schema, observed payload fields, usage over time, top failure categories) |

package/skills/moda-cli/references/auth.md

@@ -85,7 +85,7 @@ printf %s "$KEY" | moda auth login --api-key-stdin   # key never touches argv
 moda auth login --api-key=<key>  # inline; WARNS, key is visible in argv + shell history
 moda auth logout                 # revoke the session server-side, then delete it locally
 moda auth status                 # both credentials; exit 0 if either is usable, else 4
-moda auth status --online        # additionally probe GET /api/cli/context
+moda auth status --online        # also probe /api/v1/data/whoami (+ /api/cli/context with a session)
 moda auth whoami                 # identity from the session, or from the API key
 moda auth token                  # print the raw bearer token + newline, nothing else
 curl -H "Authorization: Bearer $(moda auth token)" https://moda.dev/api/cli/context
@@ -156,12 +156,21 @@ two independent credentials and `auth` reports both:
   a rejected key gets `verified: false`, stops counting toward `authenticated`,
   and exits `4`; an unreachable API leaves it counting, so a blip never kills a
   good credential. With `--online` the payload adds
-  `{ "online": { "reachable": <bool>, "ok": <bool>, "tenantCount": <n> } }`:
-  `reachable: true` means any HTTP response arrived (even a 401/500), `ok`
-  reflects HTTP success, and `tenantCount` is present only when the response
-  was ok and carried a tenants array. A network failure or probe timeout
-  (5 s) yields `reachable: false`; the exit code always follows local session
-  validity only, never the probe.
+  `{ "online": { "baseUrl": <url>, "reachable": <bool>, "ok": <bool>,
+  "tenantCount"?: <n>, "session"?: {...}, "dataApi": { "reachable", "status",
+  "ok", "tenantId", "tenantName", "keyKind", "scope", "error"? } } }`.
+  `baseUrl` is where every request goes. `dataApi` probes
+  `GET /api/v1/data/whoami`, which the frontend proxy and the backend both
+  serve, so it confirms a base URL pointed straight at the backend and names
+  the key's tenant; without a key it is an unauthenticated reachability check
+  (a live Data API answers 401). `session` (only with a browser session)
+  probes `GET /api/cli/context`, a frontend-only route: a 404 there with a
+  reachable `dataApi` means the URL is the backend, and a warning says so.
+  `reachable: true` means any HTTP response arrived (even a 401/500); `ok`
+  means every credential present was accepted. A network failure or probe
+  timeout (5 s) yields `reachable: false`. A 403 for an unknown or
+  inaccessible tenant (`MODA_TENANT_ID`) keeps the key counted and adds a
+  warning with the tenant fix.
 - `moda auth token` writes exactly the bare token plus a trailing newline to
   stdout in **every** output mode — including piped/json/agent, because
   command substitution is a pipe — so `$(moda auth token)` composes safely

package/skills/moda-cli/references/commands.md

@@ -15,7 +15,7 @@ Loaded on demand from the moda-cli skill. This table can lag the CLI: `moda <com
 | `moda auth status` | Both credentials; exit `0` if either is usable, `4` if neither (expected, not an error) |
 | `moda auth token` | Print the raw bearer token for `$(moda auth token)` composition |
 | `moda traces search "<query>"` | **Message-grain semantic/keyword/hybrid search (incl. tool calls); primary content-discovery path** |
-| `moda overview` | Dashboard KPIs, top clusters, recent activity |
+| `moda overview` | Dashboard KPIs, top clusters, recent activity. `--compare` adds `trends`: overview KPIs, per-unit rates, Problems and each detector family against the previous window of equal length; `--series` adds `[bucket, value]` arrays; `--since=<ISO> [--until=<ISO>]` sets the window (before/after a deploy); `--agent-name=<sub-agent>`; `--unit=conversation\|segment\|turn` |
 | `moda ask "<question>"` | Natural-language production/harness answer with evidence (exit `3` = degraded local fallback) |
 | `moda investigate` | Rank production issues (tool failures, frustrations, top Problems) with evidence + next commands |
 | `moda clusters` | Browse topic cluster hierarchy; `--search="q"` finds clusters by meaning, `--node-id=ID` resolves a deep link |
@@ -25,7 +25,7 @@ Loaded on demand from the moda-cli skill. This table can lag the CLI: `moda <com
 | `moda detections list --family=frustration` | User frustration detections with evidence (the frustration family of `emotions`, legacy field names) |
 | `moda detections list --family=emotion` | Multi-family emotion detections: frustration, disapproval, sadness, confusion, anxiety, trust, positive (`--family=F`, `--user-id`, `--conversation-id`, limit 1–20) |
 | `moda detections list --family=hallucination` | Grounding detections: contradicted/verified outputs, rule breakdown (`--kind=contradicted\|verified`, `--conversation-id=ID`) |
-| `moda detections tools` | Tool failure overview |
+| `moda detections tools` | Tool failure overview (`--compare` adds `summary.compare`) |
 | `moda detections tools <tool_name>` | Per-tool failure breakdown + examples |
 | `moda tools list` | Tool catalog: every tool called in the window with calls, failed calls, success rate, traces, effect direction, last seen (`--sort=calls\|failure_rate\|failures\|traces\|last_seen`, `--search`, `--direction`, `--limit` 1-200, `--offset`) |
 | `moda tools get <tool_name>` | One tool: call stats, registered description and schema, observed payload fields, usage over time, top failure categories with the newest failure (`--days-back`, `--full`) |
@@ -35,6 +35,8 @@ Loaded on demand from the moda-cli skill. This table can lag the CLI: `moda <com
 | `moda review <kind> <target>` | Write: kinds `problem\|problem-detection\|quote\|tool\|laziness\|hallucination\|custom-signal`; `--reason` optional; problem-detection needs `--conversation-id` + `--attribution-id`; quote needs `--family`, `--turn`, `--quote`; tool needs `--tool` plus `--tool-use-id` or `--msg-index`; custom-signal needs `--conversation-id`; `--verdict=clear` removes a mark (not for problem) |
 | `moda reviews list [conversation_id]` | Current false-positive marks: all (`--kind=quote\|tool\|laziness\|hallucination\|custom-signal`, `--all` to include removed, `--limit`) or one trace with its problem detection reviews. Problem dismissals are read with `moda problems get <problem_id> --feedback`, detection reviews with `moda reviews list <conversation_id> --kind=problem-detection` |
 | `moda detections list --family=laziness` | Laziness detections per trace (`--days-back`, `--limit` 1-50, `--conversation-id`, `--family`) |
+| `moda detections list --family=<f> --compare` | Adds `summary.compare`: the family's dashboard KPI tiles and per-trace rate for the list's `--days-back` window against the previous window of equal length (whole family; not with `--conversation-id`/`--user-id`) |
+| `moda problems get <problem_id> --trend` | Incidents and users per day (`[date, value]`) and incidents/signals against the previous window of equal length (`--days-back`, default 30; no comparison above 45) |
 | `moda detections list --family=<f> --group-by=trace` | The dashboard's per-trace list for emotion, frustration and hallucination: totals count traces. Dashboard filters imply it: emotion/frustration `--search --status --elicitor --trajectory --signal --sort --order`; hallucination `--search --status --rule --source --sort --order`; laziness (always per trace) `--search --status --sort --order`. See detections.md 5a |
 | `moda problems linear <problem_id>` | The Problem's linked Linear issue (key, state, URL) or `link: null`; needs Linear connected (Integrations → Linear) |
 | `moda problems link <problem_id>` | Write: file the Problem as a Linear issue (`--team-id`, `--title`, `--priority=0-4`), or link an existing one with `--issue=ENG-123\|URL` (exclusive with the others). Idempotent per Problem |

package/skills/moda-cli/references/dashboard-parity.md

@@ -14,6 +14,9 @@ Writes listed here accept `--dry-run`: it validates the call, prints the exact r
 | Traces list: Processed, Use case confidence, Indexed columns | `moda traces` rows: `processing_status`, `error_message`, `membership_score`, `indexed_at`; `moda traces get <id>`: `trace_state` |
 | Signals tabs: per-trace list, filters, sort | `moda detections list --family=<f> --group-by=trace` plus `--trajectory --elicitor --signal --status --search --sort --order` (emotion), `--rule --source` (hallucination) |
 | Settings: which detectors run | `moda overview` → `detectors` (read-only; switching one is dashboard-only) |
+| Home / Analytics / Signals KPI cards: change against the previous period, sparklines, agent selector | `moda overview --compare [--series] [--since=<ISO> --until=<ISO>] [--agent-name=<sub-agent>] [--unit=turn]` |
+| Detector tab KPI tiles with deltas | `moda detections list --family=<f> --compare` (`summary.compare`) |
+| Problem history per day | `moda problems get <problem_id> --trend [--days-back=N]` |
 | Users page / user profile | `moda users [--window --cohort --sort --order --health-status]`, `moda user <id>` (`--cohort` takes `builtin:<key>`, a saved cohort id, or a bare built-in key) |
 | Cohort selector on Problems, Traces, Signals tabs, custom signals, Topics | `--cohort=builtin:<key>\|<saved id>` on `problems list`, `traces list`, `detections list` (emotion, frustration and hallucination read the per-trace list; laziness; custom_signal `--signal-id`), `detections tools`, `clusters` (`--time-range=all\|3d\|7d\|30d`, also with `--search`). Output says which cohort scoped it (summary line and `cohort` in the data). `traces search` has no cohort scope |
 | Cohort builder: list, fields, preview, compare, save, edit | `moda cohorts list [--include-archived]`, `get <ref>`, `fields`, `preview --file=<definition.json>`, `compare <a> <b> [--days=7\|30\|90]`, `create --name --file [--dry-run]`, `update <cohort_id> [--name --file --note] [--dry-run]` (archiving is dashboard-only) |

package/skills/moda-cli/references/detections.md

@@ -126,6 +126,26 @@ An empty detection list is not proof a trace is clean:
   pending or errored traces: a pending trace may already have some detections,
   but its detections may be incomplete.
 
+### 5c. Is a family getting worse? (`--compare`)
+
+```bash
+moda detections list --family=frustration --compare --days-back=7
+moda detections list --family=laziness:stub_body --compare
+moda detections tools --compare --days-back=14
+```
+
+`--compare` adds `summary.compare`, one more read (GET `/v1/data/trends`)
+with the dashboard's KPI tiles for the family: `kpis` (for example emotion
+analyzed traces, negative rate, negative detections, affected users and traces
+per family) and `rate` (share of traces with a detection, the Signals rate
+card; left out for `frustration` and a sub-family, since the card counts the
+whole detector, and `notes` says so). Each figure is `{current, previous, delta, delta_pct, spike?}` for the
+list's `--days-back` window against the window of equal length just before it.
+It covers the whole family, so it rejects `--conversation-id` and `--user-id`;
+other list filters do not narrow it. For a before/after-deploy window, or a
+series per hour or day, use `moda overview --compare --since=<deploy time>`
+and `--series` (see production-intelligence.md).
+
 ### 6. Tool failure investigation
 
 ```bash

package/skills/moda-cli/references/output-protocol.md

@@ -42,7 +42,7 @@ Branch on the exit code; it is stable and cheaper than parsing the payload:
 | `1` | error — bad input, unknown id (`not_found`), access denied, API/network failure | Read `errors[0].code`; retry only `network_error` / 5xx `api_error`. For `not_found`, find a valid id first (the `cause` names the command). |
 | `3` | degraded — Moda Cloud was unavailable and the answer was synthesized from local Data API evidence (`ask`), or some sources failed to load (`investigate`/`failures`, named in `data.failedSources`) | Answer is present but lower-trust or partial; verify before acting, and never read a partial result as "no issues". |
 | `4` | auth required — no API key, or the API rejected it (HTTP 401) | Set `MODA_API_KEY` or run the `login_command` from the `auth` payload (`moda auth login --api-key`), then re-run. |
-| `5` | input required — a choice is needed that the non-interactive run could not answer | Pick a choice from the `input_request` payload and re-invoke the same command with that choice's `resume_flags` appended. |
+| `5` | input required — a choice is needed that the non-interactive run could not answer (for example a tenant, or `--profile=local` for a loopback `MODA_BASE_URL` on a prod profile) | Pick a choice from the `input_request` payload and re-invoke the same command with that choice's `resume_flags` appended. |
 | `130` | cancelled | Treat as interrupted or closed pipe; do not retry blindly. |
 
 Exit codes `4` and `5` are recoverable-by-caller failures: the envelope's