@moda-ai/cli 1.55.43 → 1.55.44

package/README.md

@@ -416,7 +416,7 @@ Both commands accept two flags to inline a message window per row:
 | Variable | Required | Default | Description |
 |----------|----------|---------|-------------|
 | `MODA_API_KEY` | Yes | -- | Your Moda API key (`moda_sk_...`) |
-| `MODA_BASE_URL` | No | `https://moda.dev` | Base URL for the Data API |
+| `MODA_BASE_URL` | No | `https://moda.dev` | Base URL for the Data API. A loopback URL needs a non-prod profile (`MODA_PROFILE=local`); on a prod profile commands exit 5 before sending anything |
 
 ## Documentation
 

package/dist/{agent-x1gwrrvd.js → agent-5ax7fqhe.js}

@@ -1,8 +1,8 @@
 import {
   buildDoctorReport
-} from "./cli-h62j4jn7.js";
-import"./cli-pmzh2qjy.js";
-import"./cli-k5drmy8r.js";
+} from "./cli-t4xfvrry.js";
+import"./cli-sejqvvhv.js";
+import"./cli-wwbr5caw.js";
 import"./cli-mm48br00.js";
 import {
   readHarnessSyncState
@@ -15,16 +15,16 @@ import {
   readHarnessReport,
   validateHarnessReport
 } from "./cli-cesds766.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
 import {
   resolveApiKey,
   resolveIngestUrl,
   resolveModaBaseUrl,
   resolveTenantId
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";
@@ -95,7 +95,7 @@ async function buildAgentContext(context) {
   const graph = readHarnessGraphIfPresent(context.cwd);
   const reportState = readHarnessReportState(context.cwd);
   const syncState = readHarnessSyncState(context.cwd);
-  const harness = graph ? await import("./harness-1rn1hqzz.js") : undefined;
+  const harness = graph ? await import("./harness-avynbq4f.js") : undefined;
   const topFindings = doctor.checks.filter((check) => check.status === "fail" || check.status === "warning").slice(0, 12).map(checkToFinding);
   const evidenceRefs = [
     ...doctor.checks.map(checkToEvidenceRef),

package/dist/{cli-daqkdnm1.js → cli-4pc0a18x.js}

@@ -1,6 +1,6 @@
 import {
   callControlAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 
 // src/replay-runs.ts
 var DEFAULT_POLL_INTERVAL_MS = 15000;

package/dist/{cli-1z1sx8dg.js → cli-5aa48ry5.js}

@@ -1,10 +1,10 @@
 import {
   fetchApiKeyProbe
-} from "./cli-77ekrx7d.js";
+} from "./cli-xcpwp0gb.js";
 import {
   authFetch,
   getCachedLoginContext
-} from "./cli-pmzh2qjy.js";
+} from "./cli-sejqvvhv.js";
 import {
   embeddedTenantIdFromApiKey,
   getModaDir,
@@ -15,7 +15,7 @@ import {
   resolveTenantIdFromActiveProfile,
   saveCliConfig,
   writeSecretJsonFile
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliAccessError,
   CliInputError,
@@ -118,8 +118,9 @@ function bootstrapLabel(custom) {
 }
 var embeddedTenantId = embeddedTenantIdFromApiKey;
 async function isStoredKeyLive(key, options = {}) {
+  const baseUrl = resolveModaBaseUrl(options);
   try {
-    const response = await fetchApiKeyProbe(resolveModaBaseUrl(options), { "x-api-key": key }, VALIDATE_TIMEOUT_MS);
+    const response = await fetchApiKeyProbe(baseUrl, { "x-api-key": key }, VALIDATE_TIMEOUT_MS);
     if (response.status !== 200)
       return false;
     await response.json();

package/dist/{cli-5fhqfx04.js → cli-8pcq2et6.js}

@@ -1,7 +1,7 @@
 import {
   createCliOutput,
   outputModeFromFlags
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 
 // src/command-context.ts
 function flagEnabled(flags, key) {

package/dist/{cli-fpd1pfvt.js → cli-8pksf2x7.js}

@@ -4,19 +4,19 @@ import {
   parsePromptFileForAb,
   readPromptLock,
   runPromptSync
-} from "./cli-k5drmy8r.js";
+} from "./cli-wwbr5caw.js";
 import {
   DEFAULT_POLL_INTERVAL_MS,
   DEFAULT_WAIT_TIMEOUT_MS,
   fetchLatestRun
-} from "./cli-daqkdnm1.js";
+} from "./cli-4pc0a18x.js";
 import {
   UUID_RE
-} from "./cli-9a0a3v13.js";
+} from "./cli-tztzrh6b.js";
 import {
   callControlAPI,
   callDataAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   EXIT_ERROR,
   EXIT_OK,
@@ -24,7 +24,7 @@ import {
   setPlatformTenantOverride,
   shellArg,
   validateConfig
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";

package/dist/{cli-s1w5phms.js → cli-d4cdczhe.js}

@@ -44,16 +44,16 @@ import {
 import {
   createCommandContext,
   stringOption
-} from "./cli-5fhqfx04.js";
+} from "./cli-8pcq2et6.js";
 import {
   assertFlags,
   assertPositionals,
   requireTenant
-} from "./cli-9a0a3v13.js";
+} from "./cli-tztzrh6b.js";
 import {
   ApiError,
   callControlAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   embeddedTenantIdFromApiKey,
   getActiveProfile,
@@ -63,7 +63,7 @@ import {
   resolveModaBaseUrl,
   resolveTenantId,
   shellArg
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError,
   CliInputRequiredError
@@ -14048,7 +14048,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-m95qvgbs.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-gd6vyxb0.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);

package/dist/{cli-0xc5htv7.js → cli-dmm9jm9m.js}

@@ -3,7 +3,7 @@ import {
   recordApiRequest,
   resolveApiKey,
   resolveModaBaseUrl
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 
 // src/api-client.ts
 var REQUEST_TIMEOUT_MS = 30000;

package/dist/{cli-t0pb7qbs.js → cli-e24fjyrb.js}

@@ -111,8 +111,14 @@ function createDefaultProfiles(options = {}) {
   };
 }
 function isLoopbackHostname(hostname) {
-  const host = hostname.toLowerCase();
-  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+  if (host === "localhost" || host.endsWith(".localhost"))
+    return true;
+  if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host) || host === "0.0.0.0")
+    return true;
+  if (host === "::1" || host === "::")
+    return true;
+  return /^::ffff:(7f[0-9a-f]{2}:[0-9a-f]{1,4}|127\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.test(host);
 }
 function isLoopbackBaseUrl(url) {
   try {
@@ -287,16 +293,33 @@ function profileBaseUrlOrigin(name, options = {}) {
   return sanitizeProfileBaseUrl(url, environment) === normalizeModaBaseUrl(url) ? "profile" : "default";
 }
 function describeBaseUrlSource(options) {
-  const envBase = optionalString(getEnv(options).MODA_BASE_URL);
-  if (envBase) {
-    const environment = activeProfileEnvironment(options);
-    if (!environmentAllowsLoopback(environment) && isLoopbackBaseUrl(normalizeModaBaseUrl(envBase))) {
-      return `default (env:MODA_BASE_URL loopback ignored for ${environment} profile)`;
-    }
-    return "env:MODA_BASE_URL";
+  const refused = refusedLoopbackBaseUrl(options);
+  if (refused) {
+    return `refused (env:MODA_BASE_URL is loopback and the active profile '${refused.profile}' is ${refused.environment})`;
   }
+  if (optionalString(getEnv(options).MODA_BASE_URL))
+    return "env:MODA_BASE_URL";
   return profileBaseUrlOrigin(options.profile, options);
 }
+function refusedLoopbackBaseUrl(options = {}) {
+  const envBase = optionalString(getEnv(options).MODA_BASE_URL);
+  if (!envBase)
+    return;
+  const url = normalizeModaBaseUrl(envBase);
+  if (!isLoopbackBaseUrl(url))
+    return;
+  let profile;
+  let environment;
+  try {
+    const active = getActiveProfile(options);
+    profile = active.name;
+    environment = active.environment;
+  } catch {
+    profile = optionalString(options.profile) ?? optionalString(getEnv(options).MODA_PROFILE) ?? DEFAULT_PROFILE_NAME;
+    environment = "prod";
+  }
+  return environmentAllowsLoopback(environment) ? undefined : { url, profile, environment };
+}
 function loadProfileConfig(options = {}) {
   const path = getModaPaths(options).profileConfigPath;
   const parsed = safeReadRecord(path);
@@ -471,6 +494,8 @@ function resolveBaseUrlStrict(options = {}) {
   } catch {
     return;
   }
+  if (refusedLoopbackBaseUrl(options))
+    return;
   return resolveBaseUrl(options);
 }
 function resolveIngestUrl(options = {}) {
@@ -600,8 +625,29 @@ function resolveApiTenantId(options = {}) {
   return (apiKey ? embeddedTenantIdFromApiKey(apiKey) : undefined) || resolveTenantId(options);
 }
 function resolveModaBaseUrl(options = {}) {
+  const refused = refusedLoopbackBaseUrl(options);
+  if (refused)
+    throw refusedBaseUrlError(refused);
   return resolveBaseUrl(options) || PROD_BASE_URL;
 }
+function describeModaBaseUrl(options = {}) {
+  const refused = refusedLoopbackBaseUrl(options);
+  return refused ? { url: refused.url, refused } : { url: resolveBaseUrl(options) || PROD_BASE_URL };
+}
+function refusedBaseUrlMessage(refused) {
+  return `MODA_BASE_URL=${refused.url} is a loopback URL, and the active profile '${refused.profile}' is a ${refused.environment} profile. ` + "The CLI does not send a prod profile's credentials to a loopback server, and does not send requests meant for it to production instead.";
+}
+function refusedBaseUrlError(refused) {
+  return new CliInputRequiredError(`${refusedBaseUrlMessage(refused)} Nothing was sent.`, {
+    id: "moda_base_url_refused",
+    question: `Target the local stack at ${refused.url} with the local profile, or production with MODA_BASE_URL unset?`,
+    kind: "select",
+    choices: [
+      { value: "local", label: `Use the local profile for ${refused.url}`, resume_flags: ["--profile=local"] },
+      { value: "production", label: "Use production: unset MODA_BASE_URL and re-run unchanged", resume_flags: [] }
+    ]
+  }, "Re-run with --profile=local (or MODA_PROFILE=local) to use the local stack, or unset MODA_BASE_URL to use production.");
+}
 function resolveModaBaseUrlStrict(options = {}) {
   return resolveBaseUrlStrict(options);
 }
@@ -660,6 +706,64 @@ function shellArg(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
+// src/api-access-errors.ts
+var MESSAGE_PATTERNS = [
+  [/unknown or deleted tenant|does not exist or is not accessible/i, "tenant_not_found"],
+  [/pinned to another tenant|cannot select another/i, "tenant_not_accessible"],
+  [/does not match the tenant in the url/i, "tenant_mismatch"],
+  [/api key is read-only/i, "read_only_key"]
+];
+var REASONS = new Set(MESSAGE_PATTERNS.map(([, reason]) => reason));
+function apiForbiddenReason(code, message) {
+  if (code && REASONS.has(code))
+    return code;
+  if (!message)
+    return;
+  return MESSAGE_PATTERNS.find(([pattern]) => pattern.test(message))?.[1];
+}
+function errorBodyFields(body) {
+  if (typeof body !== "string" || !body.trimStart().startsWith("{"))
+    return {};
+  try {
+    const parsed = JSON.parse(body);
+    return {
+      ...typeof parsed.code === "string" ? { code: parsed.code } : {},
+      ...typeof parsed.message === "string" ? { message: parsed.message } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+function apiForbiddenError(reason, serverMessage) {
+  const server = serverMessage?.trim().replace(/\.$/, "");
+  switch (reason) {
+    case "tenant_not_found":
+      return {
+        code: "not_found",
+        message: server && /does not exist/i.test(server) ? `${server} (HTTP 403).` : "The tenant this request names does not exist or is not accessible to this API key (HTTP 403).",
+        cause: "The tenant id comes from MODA_TENANT_ID (or --tenant-id). No tenant has that id, or it was deleted. " + "Set it to a tenant id from the dashboard URL or from `moda auth whoami` with a browser session, then retry."
+      };
+    case "tenant_not_accessible":
+      return {
+        code: "access_denied",
+        message: `The Moda API refused this request (HTTP 403): ${server ?? "this API key cannot act on the tenant requested"}.`,
+        cause: "This key acts on one tenant only. Unset MODA_TENANT_ID (and drop --tenant-id) so it acts on its own tenant, " + "or use a key for the tenant you want. With MODA_TENANT_ID unset, `moda auth whoami` shows the key's tenant."
+      };
+    case "tenant_mismatch":
+      return {
+        code: "access_denied",
+        message: `The Moda API refused this request (HTTP 403): ${server ?? "the tenant header does not match the tenant in the URL"}.`,
+        cause: "MODA_TENANT_ID names a different tenant than this command. Make them the same tenant, or unset MODA_TENANT_ID."
+      };
+    case "read_only_key":
+      return {
+        code: "access_denied",
+        message: `The Moda API refused this request (HTTP 403): ${server ?? "this API key is read-only"}.`,
+        cause: "This key is read-only: it can run reads but not writes. Run this command with a full-access key."
+      };
+  }
+}
+
 // src/legacy-names.ts
 var LEGACY_NAMES = [
   { legacy: "conversations", use: "moda traces list", canonical: { command: "traces", subcommand: "list" }, silent: true },
@@ -1613,6 +1717,10 @@ function errorToAgentError(error) {
       };
     }
     if (apiErrorStatus(error) === 403) {
+      const body = errorBodyFields(error.responseBody);
+      const reason = apiForbiddenReason(body.code, body.message);
+      if (reason)
+        return { ...apiForbiddenError(reason, body.message), blocking: true };
       return {
         code: "access_denied",
         message: `The Moda API refused this request (HTTP 403): ${serverErrorMessage(error) ?? "the API key does not allow it"}.`,
@@ -2187,4 +2295,4 @@ function extractSuggestedCommands(text) {
   return commands.length > 0 ? commands : undefined;
 }
 
-export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, describeBaseUrlSource, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveApiTenantId, resolveModaBaseUrl, resolveModaBaseUrlStrict, validateConfig, isPlatformApiKey, setPlatformTenantOverride, apiKeyHeaders, recordApiRequest, getApiRequestCount, resetApiRequestCount, shellArg, LEGACY_NAMES, canonicalCommandText, setAgentUpdateNotice, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, explicitOutputMode, outputModeFromFlags, resolveOutputMode, createCliOutput, agentEnvelopeFits, errorToAgentError, agentMaxOutputBytes, continuationCommand };
+export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, describeBaseUrlSource, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveApiTenantId, resolveModaBaseUrl, describeModaBaseUrl, refusedBaseUrlMessage, resolveModaBaseUrlStrict, validateConfig, isPlatformApiKey, setPlatformTenantOverride, apiKeyHeaders, recordApiRequest, getApiRequestCount, resetApiRequestCount, shellArg, apiForbiddenReason, errorBodyFields, apiForbiddenError, LEGACY_NAMES, canonicalCommandText, setAgentUpdateNotice, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, explicitOutputMode, outputModeFromFlags, resolveOutputMode, createCliOutput, agentEnvelopeFits, errorToAgentError, agentMaxOutputBytes, continuationCommand };

package/dist/{cli-5y9tj6cb.js → cli-k2ka2kjb.js}

@@ -3,10 +3,10 @@ import {
 } from "./cli-e0kbye4s.js";
 import {
   callDataAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   shellArg
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";

package/dist/{cli-pmzh2qjy.js → cli-sejqvvhv.js}

@@ -6,7 +6,7 @@ import {
   saveProfileConfig,
   secretFilePathFromRef,
   writeSecretJsonFile
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliAuthError,
   CliInputError
@@ -345,10 +345,11 @@ async function connectWithCode(code, options = {}) {
   if (!CONNECT_CODE_RE.test(code)) {
     throw new ConnectCodeError("That is not a Moda sign-in code. Copy the command from the Moda onboarding page again.", "rejected");
   }
+  const baseUrl = resolveModaBaseUrl(options);
   let response;
   try {
     recordApiRequest();
-    response = await fetch(`${resolveModaBaseUrl(options)}/api/cli/auth/connect`, {
+    response = await fetch(`${baseUrl}/api/cli/auth/connect`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ code, label: hostname(), ...options.tenantId ? { tenant_id: options.tenantId } : {} }),
@@ -452,6 +453,13 @@ async function login(screen = "login", options = {}) {
       reject(new CliInputError(`Moda profile '${targetProfile}' does not exist.`, 'Create it with "moda profiles create <name>" or check "moda profiles list".'));
       return;
     }
+    let baseUrl;
+    try {
+      baseUrl = resolveModaBaseUrl(storageOptions);
+    } catch (err) {
+      reject(err);
+      return;
+    }
     const server = createServer(async (req, res) => {
       if (settled) {
         res.writeHead(410, { Connection: "close" });
@@ -480,7 +488,7 @@ async function login(screen = "login", options = {}) {
             try {
               const cliToken = await exchangeCodeForSession(code);
               res.writeHead(302, {
-                Location: `${resolveModaBaseUrl(storageOptions)}/auth/cli/done?status=success`,
+                Location: `${baseUrl}/auth/cli/done?status=success`,
                 Connection: "close"
               });
               res.end(() => {
@@ -490,7 +498,7 @@ async function login(screen = "login", options = {}) {
               exchangeInFlight = false;
               const error2 = err instanceof Error ? err : new Error(String(err));
               res.writeHead(302, {
-                Location: `${resolveModaBaseUrl(storageOptions)}/auth/cli/done?status=error&reason=${exchangeFailureReason(err)}`,
+                Location: `${baseUrl}/auth/cli/done?status=error&reason=${exchangeFailureReason(err)}`,
                 Connection: "close"
               });
               res.end(() => {
@@ -598,7 +606,7 @@ async function login(screen = "login", options = {}) {
       let response;
       try {
         recordApiRequest();
-        response = await fetch(`${resolveModaBaseUrl(storageOptions)}/api/cli/auth/exchange`, {
+        response = await fetch(`${baseUrl}/api/cli/auth/exchange`, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify({
@@ -762,7 +770,7 @@ async function login(screen = "login", options = {}) {
       if (address && typeof address === "object") {
         localPort = address.port;
       }
-      const authUrl = `${resolveModaBaseUrl(storageOptions)}/auth/cli?port=${localPort}&screen=${screen}&state=${state}&code_challenge=${codeChallenge}&challenge_method=S256`;
+      const authUrl = `${baseUrl}/auth/cli?port=${localPort}&screen=${screen}&state=${state}&code_challenge=${codeChallenge}&challenge_method=S256`;
       attachPromptInput();
       try {
         await (options.openUrl ?? openAuthUrl)(authUrl);

package/dist/{cli-h62j4jn7.js → cli-t4xfvrry.js}

@@ -1,10 +1,10 @@
 import {
   isAuthSessionValid,
   loadAuthSession
-} from "./cli-pmzh2qjy.js";
+} from "./cli-sejqvvhv.js";
 import {
   inspectPromptManifest
-} from "./cli-k5drmy8r.js";
+} from "./cli-wwbr5caw.js";
 import {
   readHarnessSyncState,
   renderDoctorHuman,
@@ -12,21 +12,22 @@ import {
 } from "./cli-xq45etg1.js";
 import {
   callDataAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
+  describeModaBaseUrl,
   ensureSecretFilePermissions,
   getActiveProfile,
   getModaPaths,
   isLoopbackBaseUrl,
   loadProfileConfig,
   recordApiRequest,
+  refusedBaseUrlMessage,
   resolveApiKey,
   resolveIngestUrl,
-  resolveModaBaseUrl,
   resolveSecretReference,
   resolveTenantId,
   secretFilePathFromRef
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   __require
 } from "./cli-0v6na3yp.js";
@@ -65,7 +66,7 @@ async function runStatusCommand(context) {
     },
     workspace: {
       tenantId: resolveTenantId() ?? null,
-      baseUrl: resolveModaBaseUrl(),
+      baseUrl: describeModaBaseUrl().url,
       ingestUrl: resolveIngestUrl()
     },
     dataFlow: checkStatus(report.checks, "cloud_data_flow"),
@@ -102,7 +103,8 @@ async function buildDoctorReport(context, options) {
   const profileOptions = { profile: context.profile, env: context.env };
   const apiKey = resolveApiKey(profileOptions);
   const tenantId = resolveTenantId(profileOptions);
-  const baseUrl = resolveModaBaseUrl(profileOptions);
+  const base = describeModaBaseUrl(profileOptions);
+  const baseUrl = base.url;
   const ingestUrl = resolveIngestUrl(profileOptions);
   checks.push({
     id: "active_profile_resolves",
@@ -157,6 +159,8 @@ async function buildDoctorReport(context, options) {
   checks.push(urlCheck("base_url_valid", "config", "Base URL is valid", baseUrl));
   checks.push(urlCheck("ingest_url_valid", "config", "Ingest URL is valid", ingestUrl));
   checks.push(localBaseUrlCheck(activeProfile.environment, baseUrl));
+  if (base.refused)
+    checks.push(refusedBaseUrlCheck(base.refused));
   const manifestPath = join(context.cwd, ".moda", "harness.json");
   const manifestExists = existsSync(manifestPath);
   checks.push({
@@ -183,8 +187,8 @@ async function buildDoctorReport(context, options) {
     "__tests__"
   ]));
   checks.push(validationEventPathCheck(ingestUrl));
-  if (options.offline || !apiKey) {
-    checks.push(...offlineCloudChecks(options.offline));
+  if (options.offline || !apiKey || base.refused) {
+    checks.push(...offlineCloudChecks(options.offline, Boolean(base.refused)));
   } else {
     checks.push(...await cloudDataFlowChecks(ingestUrl, apiKey));
   }
@@ -278,6 +282,21 @@ function secretPermissionCheck(path) {
     remediation: permission.secure ? undefined : "Restrict secret file permissions to the current user."
   };
 }
+function refusedBaseUrlCheck(refused) {
+  return {
+    id: "base_url_not_refused",
+    group: "config",
+    title: "Base URL is usable with the active profile",
+    status: "fail",
+    severity: "critical",
+    evidence: [
+      { label: "MODA_BASE_URL", value: refused.url },
+      { label: "profile", value: `${refused.profile} (${refused.environment})` }
+    ],
+    remediation: `${refusedBaseUrlMessage(refused)} Re-run with --profile=local (or MODA_PROFILE=local) for the local stack, or unset MODA_BASE_URL for production.`,
+    nextCommand: "moda status --profile=local"
+  };
+}
 function urlCheck(id, group, title, value) {
   let valid = false;
   try {
@@ -376,7 +395,7 @@ async function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId)
     };
   }
   try {
-    const { scanHarness } = await import("./harness-1rn1hqzz.js");
+    const { scanHarness } = await import("./harness-avynbq4f.js");
     const current = scanHarness({
       rootDir: cwd,
       scannerVersion: "doctor",
@@ -515,11 +534,11 @@ function validationEventPathCheck(ingestUrl) {
     evidence: [{ label: "path", value: `${ingestUrl.replace(/\/+$/, "")}/v1/otel/validation` }]
   };
 }
-function offlineCloudChecks(isOffline) {
-  const status = isOffline ? "skipped" : "warning";
-  const evidence = [{ label: "mode", value: isOffline ? "offline" : "missing api key" }];
-  const remediation = isOffline ? "Rerun without --offline to check Moda Cloud." : "Configure an API key before checking cloud data flow.";
-  const nextCommand = isOffline ? "moda doctor --online" : "moda init";
+function offlineCloudChecks(isOffline, refused = false) {
+  const status = isOffline || refused ? "skipped" : "warning";
+  const evidence = [{ label: "mode", value: refused ? "base url refused" : isOffline ? "offline" : "missing api key" }];
+  const remediation = refused ? "Fix the refused MODA_BASE_URL (see base_url_not_refused) before checking Moda Cloud." : isOffline ? "Rerun without --offline to check Moda Cloud." : "Configure an API key before checking cloud data flow.";
+  const nextCommand = refused ? "moda doctor --online --profile=local" : isOffline ? "moda doctor --online" : "moda init";
   return [
     {
       id: "cloud_api_reachable",

package/dist/{cli-9a0a3v13.js → cli-tztzrh6b.js}

@@ -2,7 +2,7 @@ import {
   ApiError,
   callControlAPI,
   callDataAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   continuationCommand,
   embeddedTenantIdFromApiKey,
@@ -11,7 +11,7 @@ import {
   resolveApiTenantId,
   setPlatformTenantOverride,
   shellArg
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliAccessError,
   CliInputError

package/dist/{cli-k5drmy8r.js → cli-wwbr5caw.js}

@@ -4,14 +4,14 @@ import {
 } from "./cli-mm48br00.js";
 import {
   createCommandContext
-} from "./cli-5fhqfx04.js";
+} from "./cli-8pcq2et6.js";
 import {
   assertFlags,
   assertPositionals
-} from "./cli-9a0a3v13.js";
+} from "./cli-tztzrh6b.js";
 import {
   callControlAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";
@@ -5725,9 +5725,9 @@ async function runPromptsCommand(input, legacyFlags, legacyProfileOptions) {
       await promotePrompt(positionals, flags, profileOptions, context);
       break;
     case "ab":
-      return (await import("./prompts-ab-ws66335h.js")).runPromptAb(flags, profileOptions, context);
+      return (await import("./prompts-ab-y7egdzg4.js")).runPromptAb(flags, profileOptions, context);
     case "propose":
-      await (await import("./prompts-propose-a9m0p9nr.js")).runPromptPropose(positionals, flags, profileOptions, context);
+      await (await import("./prompts-propose-5nw25v9a.js")).runPromptPropose(positionals, flags, profileOptions, context);
       break;
     case "list":
     case "show":
@@ -5830,7 +5830,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-1rn1hqzz.js");
+    const { analyzeHarnessPrompts } = await import("./harness-avynbq4f.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),
@@ -5858,7 +5858,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const mergedSources = mergePromptSources(manifest.sources, extraSources);
   const manifestUpdate = stableJson(mergedSources) === stableJson(mergePromptSources(manifest.sources, [])) ? undefined : $stringify({ version: 2, prompt_paths: manifest.promptPaths, sources: mergedSources });
   const prompts = await discoverPrompts(extraSources);
-  const { checkPromptAttribution } = await import("./prompt-attribution-hc6mcvee.js");
+  const { checkPromptAttribution } = await import("./prompt-attribution-wvvnzw4m.js");
   const attribution = checkPromptAttribution(process.cwd(), prompts.map((prompt) => prompt.key));
   const brokenAttribution = attribution.references.filter((reference) => reference.status === "missing");
   if (brokenAttribution.length) {
@@ -6164,7 +6164,7 @@ async function migratePromptManifest(options = {}) {
   let addedSources = [];
   let pendingSources = [];
   if (options.discover) {
-    const { analyzeHarnessPrompts } = await import("./harness-1rn1hqzz.js");
+    const { analyzeHarnessPrompts } = await import("./harness-avynbq4f.js");
     const result = await analyzeHarnessPrompts({
       rootDir: root,
       existing: manifest.sources,