@moda-ai/cli 1.55.43 → 1.55.45

package/dist/{cli-77ekrx7d.js → cli-xcpwp0gb.js}

@@ -5,7 +5,7 @@ import {
   resolveApiKey,
   resolveApiKeyFromActiveProfile,
   resolveModaBaseUrl
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 
 // src/api-key-auth.ts
 var PROBE_TIMEOUT_MS = 1e4;
@@ -37,25 +37,32 @@ async function fetchApiKeyProbe(baseUrl, headers, timeoutMs) {
   return probe("overview");
 }
 async function probeApiKey(key, options = {}) {
+  const baseUrl = resolveModaBaseUrl(options);
   let response;
   try {
-    response = await fetchApiKeyProbe(resolveModaBaseUrl(options), apiKeyHeaders(key, options), PROBE_TIMEOUT_MS);
+    response = await fetchApiKeyProbe(baseUrl, apiKeyHeaders(key, options), PROBE_TIMEOUT_MS);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return { outcome: "unreachable", reason };
   }
   if (response.status === 401 || response.status === 403) {
-    return { outcome: "rejected", status: response.status };
+    const body2 = await response.text().catch(() => {
+      return;
+    });
+    return { outcome: "rejected", status: response.status, ...body2 ? { body: body2 } : {} };
   }
   if (response.status !== 200) {
-    return { outcome: "unreachable", reason: `HTTP ${response.status}` };
+    return { outcome: "unreachable", reason: `HTTP ${response.status}`, status: response.status };
   }
+  let body;
   try {
-    await response.json();
+    body = await response.json();
   } catch {
-    return { outcome: "unreachable", reason: "non-JSON response from the Data API" };
+    return { outcome: "unreachable", reason: "non-JSON response from the Data API", status: response.status };
   }
-  return { outcome: "live" };
+  const record = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
+  const identity = record && typeof record.tenant_id === "string" && typeof record.key_kind === "string" ? record : undefined;
+  return identity ? { outcome: "live", identity } : { outcome: "live" };
 }
 
 export { resolveApiKeyCredential, redactApiKey, fetchApiKeyProbe, probeApiKey };

package/dist/{cli-stfpr2ct.js → cli-xx0pjzkh.js}

@@ -13,22 +13,22 @@ import {
 } from "./cli-hcwdz9sd.js";
 import {
   createCommandContext
-} from "./cli-5fhqfx04.js";
+} from "./cli-8pcq2et6.js";
 import {
   assertFlags,
   assertPositionals,
   writeDryRun
-} from "./cli-9a0a3v13.js";
+} from "./cli-tztzrh6b.js";
 import {
   callControlAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   recordApiRequest,
   resolveApiKey,
   resolveIngestUrl,
   resolveTenantId,
   shellArg
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";

package/dist/cli.js

@@ -26,10 +26,10 @@ import {
   withSummaryCompare,
   withToolFailureAnchors,
   withoutDetectionWindows
-} from "./cli-5y9tj6cb.js";
+} from "./cli-4m0rgkx4.js";
 import {
   createCommandContext
-} from "./cli-5fhqfx04.js";
+} from "./cli-8pcq2et6.js";
 import {
   envOptOutSet,
   envSwitchedOff,
@@ -87,12 +87,12 @@ import {
   unknownSignalsSubcommandError,
   usageLine,
   writeDryRun
-} from "./cli-9a0a3v13.js";
+} from "./cli-tztzrh6b.js";
 import {
   ApiError,
   callControlAPI,
   callDataAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   AGENT_ERROR_CODES,
   EXIT_AUTH_REQUIRED,
@@ -129,7 +129,7 @@ import {
   shellArg,
   validateConfig,
   wasOutputCancelled
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliAccessError,
   CliAuthError,
@@ -3248,46 +3248,46 @@ function leafManifestFields(leaf, commands) {
 import { fileURLToPath } from "url";
 import { realpathSync } from "fs";
 async function runPromptsCommand(...args) {
-  return (await import("./prompts-xe5bgbx8.js")).runPromptsCommand(...args);
+  return (await import("./prompts-snnbyxmz.js")).runPromptsCommand(...args);
 }
 async function runSkillsCommand(...args) {
-  return (await import("./skills-vveagdwe.js")).runSkillsCommand(...args);
+  return (await import("./skills-d4215fa9.js")).runSkillsCommand(...args);
 }
 async function runFixCommand(...args) {
-  return (await import("./fix-7aajsdbf.js")).runFixCommand(...args);
+  return (await import("./fix-nk5xffz8.js")).runFixCommand(...args);
 }
 async function runFixesCommand(...args) {
-  return (await import("./fix-7aajsdbf.js")).runFixesCommand(...args);
+  return (await import("./fix-nk5xffz8.js")).runFixesCommand(...args);
 }
 async function runHarnessCommand(...args) {
-  return (await import("./harness-1rn1hqzz.js")).runHarnessCommand(...args);
+  return (await import("./harness-avynbq4f.js")).runHarnessCommand(...args);
 }
 async function runSyncCommand(...args) {
-  return (await import("./sync-yy3fgnxe.js")).runSyncCommand(...args);
+  return (await import("./sync-17f9yxb1.js")).runSyncCommand(...args);
 }
 async function runRegistryCommand(...args) {
-  return (await import("./registry-j2dsfh6v.js")).runRegistryCommand(...args);
+  return (await import("./registry-8zkxefjs.js")).runRegistryCommand(...args);
 }
 async function runDoctorCommand(...args) {
-  return (await import("./doctor-wrgajgev.js")).runDoctorCommand(...args);
+  return (await import("./doctor-k4tdgvgv.js")).runDoctorCommand(...args);
 }
 async function runStatusCommand(...args) {
-  return (await import("./doctor-wrgajgev.js")).runStatusCommand(...args);
+  return (await import("./doctor-k4tdgvgv.js")).runStatusCommand(...args);
 }
 async function runAuthCommand(...args) {
-  return (await import("./profile-commands-se9947c1.js")).runAuthCommand(...args);
+  return (await import("./profile-commands-mh3kfqkn.js")).runAuthCommand(...args);
 }
 async function runConfigCommand(...args) {
-  return (await import("./profile-commands-se9947c1.js")).runConfigCommand(...args);
+  return (await import("./profile-commands-mh3kfqkn.js")).runConfigCommand(...args);
 }
 async function runProfilesCommand(...args) {
-  return (await import("./profile-commands-se9947c1.js")).runProfilesCommand(...args);
+  return (await import("./profile-commands-mh3kfqkn.js")).runProfilesCommand(...args);
 }
 async function runAgentCommand(...args) {
-  return (await import("./agent-x1gwrrvd.js")).runAgentCommand(...args);
+  return (await import("./agent-5ax7fqhe.js")).runAgentCommand(...args);
 }
 async function runProductionCommand(...args) {
-  return (await import("./production-intelligence-7jvfdz6b.js")).runProductionCommand(...args);
+  return (await import("./production-intelligence-0z6v6tpp.js")).runProductionCommand(...args);
 }
 function parseArgs(argv) {
   const args = argv.slice(2);
@@ -4578,6 +4578,13 @@ async function searchFallbackToTraces(params) {
     params.until ? `--until=${shellArg(params.until)}` : "",
     `--limit=${limit}`
   ].filter(Boolean).join(" ");
+  if (params.mode === "keyword") {
+    return {
+      kind: "notice",
+      warning: "Message-level keyword search returned 0 results. No trace-level search was run: `moda traces --search` ranks by relevance (its results may not contain the exact words), so it cannot answer --mode=keyword. " + (params.originalMessagesRead ? "The original messages in this window were also read for a literal match." : "Zero results here does NOT mean the words never appear; the message index may be incomplete."),
+      nextCommands: [{ command: tracesCommand, purpose: "See relevance-ranked trace-level results (they may not contain the exact words).", mutability: "read", requires_approval: false }]
+    };
+  }
   let traces;
   try {
     traces = asRecord(await callDataAPI(`/conversations?${query2.toString()}`)) ?? {};
@@ -4597,13 +4604,6 @@ async function searchFallbackToTraces(params) {
   const serverHasMore = pagination?.has_more === true;
   const traceMode = asString(traces.search_mode) ?? "keyword";
   const literal = traceMode === "keyword";
-  if (params.mode === "keyword" && !literal) {
-    return {
-      kind: "notice",
-      warning: `Message-level keyword search returned 0 results. Trace-level search is only available ${traceMode}-ranked here (results may not contain the exact words), so none are substituted for --mode=keyword. Zero results here does NOT mean the words never appear; the message index may be incomplete.`,
-      nextCommands: [{ command: tracesCommand, purpose: "See ranked trace-level results instead.", mutability: "read", requires_approval: false }]
-    };
-  }
   const results = rows.map((row) => ({
     match_grain: "trace",
     conversation_id: row.conversation_id,
@@ -5950,7 +5950,11 @@ async function runCommand(command, positional, flags, positionals = positional ?
         warnings.push(`--offset=${params.offset} was not applied: message-level search is not pageable (it returns the top --limit hits). --offset only pages the trace-level fallback. Narrow with --time-range/--user-id or raise --limit instead.`);
       }
       if (results.length === 0 && !params.conversation_id) {
-        const fallback = await searchFallbackToTraces({ ...params, offset: params.offset });
+        const fallback = await searchFallbackToTraces({
+          ...params,
+          offset: params.offset,
+          originalMessagesRead: asRecord(searchRecord.coverage)?.original_messages_search === "used"
+        });
         if (fallback?.kind === "notice") {
           warnings.push(fallback.warning);
           context.output.writeData(data, { warnings, nextCommands: fallback.nextCommands });
@@ -7057,7 +7061,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result-and-error",
     handler: async (context) => {
-      const { runInit } = await import("./index-svfzq5rb.js");
+      const { runInit } = await import("./index-63k2a6gb.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",
@@ -7107,7 +7111,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result-and-error",
     handler: async (context) => {
-      const { runProvision } = await import("./provision-a9kkfvp7.js");
+      const { runProvision } = await import("./provision-t1dpzcjp.js");
       return runProvision(context, {
         resumeCommand: buildResumeCommand("provision", context.rawFlags)
       });

package/dist/{doctor-wrgajgev.js → doctor-k4tdgvgv.js}

@@ -3,16 +3,16 @@ import {
   promptsDiscoveredCheck,
   runDoctorCommand,
   runStatusCommand
-} from "./cli-h62j4jn7.js";
-import"./cli-pmzh2qjy.js";
-import"./cli-k5drmy8r.js";
+} from "./cli-t4xfvrry.js";
+import"./cli-sejqvvhv.js";
+import"./cli-wwbr5caw.js";
 import"./cli-mm48br00.js";
 import"./cli-xq45etg1.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/{fix-7aajsdbf.js → fix-nk5xffz8.js}

@@ -2,13 +2,13 @@ import {
   DEFAULT_POLL_INTERVAL_MS,
   DEFAULT_WAIT_TIMEOUT_MS,
   fetchLatestRun
-} from "./cli-daqkdnm1.js";
+} from "./cli-4pc0a18x.js";
 import {
   assertFlags
-} from "./cli-9a0a3v13.js";
+} from "./cli-tztzrh6b.js";
 import {
   callControlAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   EXIT_DEGRADED,
   EXIT_ERROR,
@@ -17,7 +17,7 @@ import {
   resolveApiTenantId,
   shellArg,
   validateConfig
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";

package/dist/{harness-1rn1hqzz.js → harness-avynbq4f.js}

@@ -40,18 +40,18 @@ import {
   writeHarnessAnalyzeResult,
   writeHarnessArtifacts,
   writeHumanProgress
-} from "./cli-s1w5phms.js";
+} from "./cli-d4cdczhe.js";
 import"./cli-xq45etg1.js";
 import"./cli-97fnztpy.js";
 import {
   HARNESS_ANALYZE_CONCERNS
 } from "./cli-cesds766.js";
 import"./cli-qpq84eee.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/{harness-github-actions-m95qvgbs.js → harness-github-actions-gd6vyxb0.js}

@@ -1,17 +1,17 @@
 import {
   buildSourceSnapshot
-} from "./cli-s1w5phms.js";
+} from "./cli-d4cdczhe.js";
 import"./cli-xq45etg1.js";
 import"./cli-97fnztpy.js";
 import"./cli-cesds766.js";
 import"./cli-qpq84eee.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
 import {
   recordApiRequest
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/{index-svfzq5rb.js → index-63k2a6gb.js}

@@ -1,17 +1,17 @@
 import {
   buildDoctorReport
-} from "./cli-h62j4jn7.js";
+} from "./cli-t4xfvrry.js";
 import {
   selectTenantAndCreateKey
-} from "./cli-1z1sx8dg.js";
-import"./cli-77ekrx7d.js";
+} from "./cli-5aa48ry5.js";
+import"./cli-xcpwp0gb.js";
 import {
   ConnectCodeError,
   connectWithCode,
   loadAuthSession,
   loadToken,
   login
-} from "./cli-pmzh2qjy.js";
+} from "./cli-sejqvvhv.js";
 import {
   bundledSkillsDir,
   installIntegrationSkill,
@@ -20,7 +20,7 @@ import {
 import {
   agentsMdProblem,
   runSkillSync
-} from "./cli-stfpr2ct.js";
+} from "./cli-xx0pjzkh.js";
 import"./cli-qm5b1vck.js";
 import {
   detectAgents
@@ -32,7 +32,7 @@ import {
 import {
   initPrompts,
   runPromptSync
-} from "./cli-k5drmy8r.js";
+} from "./cli-wwbr5caw.js";
 import"./cli-mm48br00.js";
 import {
   codingAgentDisplayName,
@@ -46,7 +46,7 @@ import {
   runCodingAgent,
   runHarnessCommand,
   startRemoteAnalyze
-} from "./cli-s1w5phms.js";
+} from "./cli-d4cdczhe.js";
 import {
   canonicalText,
   renderInitBanner,
@@ -62,17 +62,17 @@ import"./cli-cesds766.js";
 import"./cli-qpq84eee.js";
 import {
   createCommandContext
-} from "./cli-5fhqfx04.js";
+} from "./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
 import {
   VERSION,
   recordApiRequest,
   resolveIngestUrl,
   resolveModaBaseUrl,
   shellArg
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliAuthError,
   CliInputError

package/dist/{production-intelligence-7jvfdz6b.js → production-intelligence-0z6v6tpp.js}

@@ -10,7 +10,7 @@ import {
   overviewTrendsQuery,
   renderTrendsHuman,
   trendsSummaryText
-} from "./cli-5y9tj6cb.js";
+} from "./cli-4m0rgkx4.js";
 import {
   renderMarkdownForTerminal,
   shouldColorTerminalOutput,
@@ -21,7 +21,7 @@ import"./cli-e0kbye4s.js";
 import {
   callControlAPI,
   callDataAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   EXIT_DEGRADED,
   EXIT_OK,
@@ -31,7 +31,7 @@ import {
   resolveModaBaseUrl,
   safeWriteStderr,
   shellArg
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliAuthError,
   CliInputError,
@@ -1271,6 +1271,7 @@ function coerceIntelligenceV1(record, context) {
   const nextCommands = Array.isArray(record.next_commands) ? record.next_commands.flatMap(coerceV1NextCommand) : [];
   const warnings = stringArray(record.warnings);
   const meta = asRecord(record.meta);
+  const caveats = asRecord(record.caveats);
   return {
     schema_version: INTELLIGENCE_SCHEMA_VERSION,
     generated_at: asString(record.generated_at) ?? new Date().toISOString(),
@@ -1285,6 +1286,7 @@ function coerceIntelligenceV1(record, context) {
     evidence_refs: evidenceRefs,
     next_commands: nextCommands,
     warnings,
+    ...caveats?.version === "moda.caveats.v1" ? { caveats } : {},
     ...meta ? { meta } : {}
   };
 }

package/dist/{profile-commands-se9947c1.js → profile-commands-mh3kfqkn.js}

@@ -2,7 +2,7 @@ import {
   probeApiKey,
   redactApiKey,
   resolveApiKeyCredential
-} from "./cli-77ekrx7d.js";
+} from "./cli-xcpwp0gb.js";
 import {
   authFetch,
   clearAuthSession,
@@ -10,20 +10,29 @@ import {
   loadAuthSession,
   login,
   revokeCliSessionToken
-} from "./cli-pmzh2qjy.js";
+} from "./cli-sejqvvhv.js";
+import {
+  ApiError
+} from "./cli-dmm9jm9m.js";
 import {
   DEFAULT_INGEST_URL,
   EXIT_AUTH_REQUIRED,
   EXIT_DEGRADED,
   EXIT_OK,
   PROD_BASE_URL,
+  apiForbiddenError,
+  apiForbiddenReason,
   clearStoredApiKeyCredentials,
   describeBaseUrlSource,
+  describeModaBaseUrl,
   embeddedTenantIdFromApiKey,
   ensureSecretFilePermissions,
+  errorBodyFields,
   getActiveProfile,
   getModaPaths,
   loadProfileConfig,
+  recordApiRequest,
+  refusedBaseUrlMessage,
   resolveApiKey,
   resolveApiKeyFromActiveProfile,
   resolveApiTenantId,
@@ -35,7 +44,7 @@ import {
   setActiveProfile,
   shellArg,
   upsertProfile
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";
@@ -44,6 +53,30 @@ import"./cli-0v6na3yp.js";
 
 // src/profile-commands.ts
 var ONLINE_PROBE_TIMEOUT_MS = 5000;
+function forbiddenProbeError(probe) {
+  if (probe.status !== 403)
+    return;
+  const fields = errorBodyFields(probe.body);
+  const reason = apiForbiddenReason(fields.code, fields.message);
+  if (!reason || reason === "read_only_key")
+    return;
+  return new ApiError(`API error (403): ${fields.message ?? "forbidden"}`, 403, probe.body ?? "");
+}
+async function probeDataApiReachable(baseUrl) {
+  try {
+    recordApiRequest();
+    const response = await fetch(`${baseUrl}/api/v1/data/whoami`, {
+      method: "GET",
+      signal: AbortSignal.timeout(ONLINE_PROBE_TIMEOUT_MS)
+    });
+    await response.body?.cancel().catch(() => {
+      return;
+    });
+    return { reachable: true, status: response.status, ok: false, error: "no API key to verify" };
+  } catch (error) {
+    return { reachable: false, ok: false, error: error instanceof Error ? error.message : String(error) };
+  }
+}
 function subcommand(context) {
   return context.positionals[0];
 }
@@ -131,6 +164,9 @@ async function loginWithApiKey(context, candidate) {
   const authOptions = { profile: context.profile, env: context.env };
   const probe = await probeApiKey(key, authOptions);
   if (probe.outcome === "rejected") {
+    const forbidden = forbiddenProbeError(probe);
+    if (forbidden)
+      throw forbidden;
     throw new CliInputError(`API key rejected by the Moda API (HTTP ${probe.status}).`, 'The key is revoked, malformed, or belongs to another environment. Mint a new one with "moda provision --tenant-id=<org-id>", or check MODA_BASE_URL points at the right environment.');
   }
   if (probe.outcome === "unreachable") {
@@ -205,6 +241,9 @@ async function runAuthCommand(context) {
             env: context.env
           });
           if (probe.outcome === "rejected") {
+            const forbidden = forbiddenProbeError(probe);
+            if (forbidden)
+              throw forbidden;
             throw new CliInputError(`API key rejected by the Moda API (HTTP ${probe.status}).`, 'The key is revoked or belongs to another environment. Mint a new one with "moda provision --tenant-id=<org-id>", or run "moda auth login".');
           }
           context.output.writeData({
@@ -260,28 +299,67 @@ async function runAuthCommand(context) {
       if (session?.user_email) {
         data.user = { email: session.user_email };
       }
+      const warnings = [];
       if (boolFlag(context, "online")) {
-        let online = { reachable: false };
-        try {
-          const response = await authFetch("/api/cli/context", { signal: AbortSignal.timeout(ONLINE_PROBE_TIMEOUT_MS) }, authOptions);
-          online = { reachable: true, ok: response.ok };
-          if (response.ok) {
-            const body = await response.json();
-            if (Array.isArray(body.tenants)) {
-              online.tenantCount = body.tenants.length;
+        const baseUrl = resolveModaBaseUrl(authOptions);
+        let sessionProbe;
+        let tenantCount;
+        if (session) {
+          sessionProbe = { reachable: false, ok: false };
+          try {
+            const response = await authFetch("/api/cli/context", { signal: AbortSignal.timeout(ONLINE_PROBE_TIMEOUT_MS) }, authOptions);
+            sessionProbe = { reachable: true, status: response.status, ok: response.ok };
+            if (response.ok) {
+              const body = await response.json();
+              if (Array.isArray(body.tenants))
+                tenantCount = body.tenants.length;
             }
-          }
-        } catch {}
-        data.online = online;
+          } catch {}
+        }
+        let dataApi;
         if (credential && data.apiKeyCredential.present) {
           const probe = await probeApiKey(credential.key, authOptions);
           data.apiKeyCredential.verified = probe.outcome === "live";
-          if (probe.outcome === "rejected") {
-            data.authenticated = loggedIn;
+          if (probe.outcome === "live") {
+            const identity = probe.identity;
+            dataApi = {
+              reachable: true,
+              status: 200,
+              ok: true,
+              ...typeof identity?.tenant_id === "string" ? { tenantId: identity.tenant_id } : {},
+              ...identity && "tenant_name" in identity ? { tenantName: typeof identity.tenant_name === "string" ? identity.tenant_name : null } : {},
+              ...typeof identity?.key_kind === "string" ? { keyKind: identity.key_kind } : {},
+              ...typeof identity?.scope === "string" ? { scope: identity.scope } : {}
+            };
+          } else if (probe.outcome === "rejected") {
+            const fields = errorBodyFields(probe.body);
+            dataApi = { reachable: true, status: probe.status, ok: false, error: fields.message ?? `HTTP ${probe.status}` };
+            const reason = apiForbiddenReason(fields.code, fields.message);
+            if (reason && reason !== "read_only_key") {
+              const described = apiForbiddenError(reason, fields.message);
+              warnings.push(`${described.message} ${described.cause}`);
+            } else {
+              data.authenticated = loggedIn;
+            }
+          } else {
+            dataApi = { reachable: probe.status !== undefined, ...probe.status !== undefined ? { status: probe.status } : {}, ok: false, error: probe.reason };
           }
+        } else {
+          dataApi = await probeDataApiReachable(baseUrl);
+        }
+        data.online = {
+          baseUrl,
+          reachable: dataApi.reachable || sessionProbe?.reachable === true,
+          ok: (credential ? dataApi.ok : true) && (sessionProbe ? sessionProbe.ok : true) && Boolean(credential || sessionProbe),
+          ...tenantCount !== undefined ? { tenantCount } : {},
+          ...sessionProbe ? { session: sessionProbe } : {},
+          dataApi
+        };
+        if (sessionProbe?.status === 404 && dataApi.reachable) {
+          warnings.push(`${baseUrl} answers the Data API but has no /api/cli/context, so it looks like the backend. ` + "Data commands work against it; browser login and control-plane commands need the frontend URL (http://localhost:3000 locally).");
         }
       }
-      context.output.writeData(data);
+      context.output.writeData(data, warnings.length > 0 ? { warnings } : undefined);
       return { exitCode: data.authenticated ? EXIT_OK : EXIT_AUTH_REQUIRED };
     }
     case "token": {
@@ -417,7 +495,7 @@ async function runConfigCommand(context) {
   const options = { profile: profile.name, env: context.env };
   const envProfile = context.env.MODA_PROFILE?.trim();
   const apiKey = resolveApiKey(options);
-  const baseUrl = resolveModaBaseUrl(options);
+  const base = describeModaBaseUrl(options);
   context.output.writeData({
     moda_dir: getModaPaths({ env: context.env }).dir,
     active_profile: profile.name,
@@ -427,14 +505,14 @@ async function runConfigCommand(context) {
     resolved: {
       api_key: redactSecret(apiKey),
       api_key_source: context.env.MODA_API_KEY ? "env:MODA_API_KEY" : profile.api_key_ref === "legacy:config.api_key" && apiKey ? "legacy_config" : resolveApiKeyFromActiveProfile(options) ? "profile" : apiKey ? "legacy_config" : "none",
-      base_url: baseUrl,
+      base_url: base.refused ? null : base.url,
       base_url_source: describeBaseUrlSource(options),
       ingest_url: resolveIngestUrl(options),
       tenant_id: resolveApiTenantId(options),
       workspace_id: profile.workspace_id
     },
     migrations: config.migrations
-  });
+  }, base.refused ? { warnings: [`${refusedBaseUrlMessage(base.refused)} Data commands exit 5 until you re-run with --profile=local or unset MODA_BASE_URL.`] } : undefined);
   return { exitCode: 0 };
 }
 export {