@moda-ai/cli 1.55.43 → 1.55.45

package/dist/{prompt-attribution-hc6mcvee.js → prompt-attribution-wvvnzw4m.js}

@@ -1,18 +1,18 @@
 import {
   inventoryFiles,
   safePromptEvidencePath
-} from "./cli-s1w5phms.js";
+} from "./cli-d4cdczhe.js";
 import"./cli-xq45etg1.js";
 import"./cli-97fnztpy.js";
 import"./cli-cesds766.js";
 import {
   require_typescript
 } from "./cli-qpq84eee.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/prompt-source-mcp.js

@@ -3,7 +3,7 @@ import {
   checkPromptMapping,
   discoverHarnessPromptSources,
   safePromptEvidencePath
-} from "./cli-s1w5phms.js";
+} from "./cli-d4cdczhe.js";
 import"./cli-xq45etg1.js";
 import"./cli-97fnztpy.js";
 import"./cli-cesds766.js";
@@ -11,11 +11,11 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors
 } from "./cli-qpq84eee.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/{prompts-ab-ws66335h.js → prompts-ab-y7egdzg4.js}

@@ -23,15 +23,15 @@ import {
   runPromptAb,
   selectProblemCases,
   waitLabel
-} from "./cli-fpd1pfvt.js";
-import"./cli-k5drmy8r.js";
-import"./cli-daqkdnm1.js";
+} from "./cli-8pksf2x7.js";
+import"./cli-wwbr5caw.js";
+import"./cli-4pc0a18x.js";
 import"./cli-mm48br00.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/{prompts-propose-a9m0p9nr.js → prompts-propose-5nw25v9a.js}

@@ -7,21 +7,21 @@ import {
   formatVerdict,
   rerunWithYes,
   resolvePromptArmSpec
-} from "./cli-fpd1pfvt.js";
-import"./cli-k5drmy8r.js";
-import"./cli-daqkdnm1.js";
+} from "./cli-8pksf2x7.js";
+import"./cli-wwbr5caw.js";
+import"./cli-4pc0a18x.js";
 import"./cli-mm48br00.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
+import"./cli-tztzrh6b.js";
 import {
   callControlAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   resolveApiTenantId,
   shellArg,
   validateConfig
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";

package/dist/{prompts-xe5bgbx8.js → prompts-snnbyxmz.js}

@@ -11,15 +11,15 @@ import {
   runPromptSync,
   runPromptsCommand,
   writePromptSyncProgress
-} from "./cli-k5drmy8r.js";
+} from "./cli-wwbr5caw.js";
 import {
   promptSourceHashPayload
 } from "./cli-mm48br00.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-9kfxkxmk.js";
 import"./cli-ns5fcnkz.js";

package/dist/{provision-a9kkfvp7.js → provision-t1dpzcjp.js}

@@ -1,18 +1,18 @@
 import {
   selectTenantAndCreateKey
-} from "./cli-1z1sx8dg.js";
-import"./cli-77ekrx7d.js";
+} from "./cli-5aa48ry5.js";
+import"./cli-xcpwp0gb.js";
 import {
   loadAuthSession
-} from "./cli-pmzh2qjy.js";
+} from "./cli-sejqvvhv.js";
 import {
   stringOption
-} from "./cli-5fhqfx04.js";
+} from "./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
 import {
   resolveIngestUrl,
   resolveModaBaseUrl
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliAuthError
 } from "./cli-k4tqwah4.js";

package/dist/{registry-j2dsfh6v.js → registry-8zkxefjs.js}

@@ -1,13 +1,13 @@
 import {
   assertFlags
-} from "./cli-9a0a3v13.js";
+} from "./cli-tztzrh6b.js";
 import {
   callControlAPI
-} from "./cli-0xc5htv7.js";
+} from "./cli-dmm9jm9m.js";
 import {
   explicitOutputMode,
   resolveApiKey
-} from "./cli-t0pb7qbs.js";
+} from "./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";

package/dist/{skills-vveagdwe.js → skills-d4215fa9.js}

@@ -3,15 +3,15 @@ import {
   pullSkills,
   runSkillSync,
   runSkillsCommand
-} from "./cli-stfpr2ct.js";
+} from "./cli-xx0pjzkh.js";
 import"./cli-qm5b1vck.js";
 import"./cli-rjav0vj1.js";
 import"./cli-hcwdz9sd.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import"./cli-k4tqwah4.js";
 import"./cli-ns5fcnkz.js";
 import"./cli-0v6na3yp.js";

package/dist/{sync-yy3fgnxe.js → sync-17f9yxb1.js}

@@ -1,25 +1,25 @@
 import {
   runSkillsCommand
-} from "./cli-stfpr2ct.js";
+} from "./cli-xx0pjzkh.js";
 import"./cli-qm5b1vck.js";
 import"./cli-rjav0vj1.js";
 import"./cli-hcwdz9sd.js";
 import {
   runPromptsCommand
-} from "./cli-k5drmy8r.js";
+} from "./cli-wwbr5caw.js";
 import"./cli-mm48br00.js";
 import {
   runHarnessCommand
-} from "./cli-s1w5phms.js";
+} from "./cli-d4cdczhe.js";
 import"./cli-xq45etg1.js";
 import"./cli-97fnztpy.js";
 import"./cli-cesds766.js";
 import"./cli-qpq84eee.js";
-import"./cli-5fhqfx04.js";
+import"./cli-8pcq2et6.js";
 import"./cli-e0kbye4s.js";
-import"./cli-9a0a3v13.js";
-import"./cli-0xc5htv7.js";
-import"./cli-t0pb7qbs.js";
+import"./cli-tztzrh6b.js";
+import"./cli-dmm9jm9m.js";
+import"./cli-e24fjyrb.js";
 import {
   CliInputError
 } from "./cli-k4tqwah4.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.55.43",
+  "version": "1.55.45",
   "description": "CLI for Moda: production monitoring and evals for AI agents.",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-18T02:56:13.211Z",
-  "cli_version": "1.55.43",
+  "bundled_at": "2026-10-20T02:21:32.859Z",
+  "cli_version": "1.55.45",
   "skills": [
     {
       "id": "integration-cloudflare-think",

package/skills/moda-cli/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: moda-cli
-version: 3.0.9
+version: 3.0.10
 description: Investigate a production AI agent with the Moda CLI (`moda`) - find where something happened in real traces (traces search, then traces get), check agent health, rank what to fix (investigate, problems), and dig into tool failures, user frustration, and hallucinations. Also prompt registry sync/promote, replays, custom signals, and false-positive marking. Use when the user mentions Moda, production traces or conversations of their agent, agent failures, or asks what to fix.
 ---
 
@@ -20,8 +20,9 @@ in `references/`; read one only when the task needs it.
   only with an API key, so ready means `apiKeyCredential.verified` is `true`; a
   browser session from `moda auth login` alone is not enough. With no key, or
   a rejected one, ask the user to `export MODA_API_KEY=moda_sk_...` (or run
-  `moda auth login --api-key`). Do not run `moda init` unprompted; it is an
-  interactive wizard that writes to the repo.
+  `moda auth login --api-key`). `online.baseUrl` is where requests go and
+  `online.dataApi.tenantId` the tenant the key acts on. Do not run `moda init`
+  unprompted; it is an interactive wizard that writes to the repo.
 - Not installed: `npx -y -p @moda-ai/cli moda <command>`.
 - If a response carries `meta.update`, the installed CLI is out of date and
   may not match this guide; tell the user how to update

package/skills/moda-cli/references/auth.md

@@ -85,7 +85,7 @@ printf %s "$KEY" | moda auth login --api-key-stdin   # key never touches argv
 moda auth login --api-key=<key>  # inline; WARNS, key is visible in argv + shell history
 moda auth logout                 # revoke the session server-side, then delete it locally
 moda auth status                 # both credentials; exit 0 if either is usable, else 4
-moda auth status --online        # additionally probe GET /api/cli/context
+moda auth status --online        # also probe /api/v1/data/whoami (+ /api/cli/context with a session)
 moda auth whoami                 # identity from the session, or from the API key
 moda auth token                  # print the raw bearer token + newline, nothing else
 curl -H "Authorization: Bearer $(moda auth token)" https://moda.dev/api/cli/context
@@ -156,12 +156,21 @@ two independent credentials and `auth` reports both:
   a rejected key gets `verified: false`, stops counting toward `authenticated`,
   and exits `4`; an unreachable API leaves it counting, so a blip never kills a
   good credential. With `--online` the payload adds
-  `{ "online": { "reachable": <bool>, "ok": <bool>, "tenantCount": <n> } }`:
-  `reachable: true` means any HTTP response arrived (even a 401/500), `ok`
-  reflects HTTP success, and `tenantCount` is present only when the response
-  was ok and carried a tenants array. A network failure or probe timeout
-  (5 s) yields `reachable: false`; the exit code always follows local session
-  validity only, never the probe.
+  `{ "online": { "baseUrl": <url>, "reachable": <bool>, "ok": <bool>,
+  "tenantCount"?: <n>, "session"?: {...}, "dataApi": { "reachable", "status",
+  "ok", "tenantId", "tenantName", "keyKind", "scope", "error"? } } }`.
+  `baseUrl` is where every request goes. `dataApi` probes
+  `GET /api/v1/data/whoami`, which the frontend proxy and the backend both
+  serve, so it confirms a base URL pointed straight at the backend and names
+  the key's tenant; without a key it is an unauthenticated reachability check
+  (a live Data API answers 401). `session` (only with a browser session)
+  probes `GET /api/cli/context`, a frontend-only route: a 404 there with a
+  reachable `dataApi` means the URL is the backend, and a warning says so.
+  `reachable: true` means any HTTP response arrived (even a 401/500); `ok`
+  means every credential present was accepted. A network failure or probe
+  timeout (5 s) yields `reachable: false`. A 403 for an unknown or
+  inaccessible tenant (`MODA_TENANT_ID`) keeps the key counted and adds a
+  warning with the tenant fix.
 - `moda auth token` writes exactly the bare token plus a trailing newline to
   stdout in **every** output mode — including piped/json/agent, because
   command substitution is a pipe — so `$(moda auth token)` composes safely

package/skills/moda-cli/references/output-protocol.md

@@ -42,7 +42,7 @@ Branch on the exit code; it is stable and cheaper than parsing the payload:
 | `1` | error — bad input, unknown id (`not_found`), access denied, API/network failure | Read `errors[0].code`; retry only `network_error` / 5xx `api_error`. For `not_found`, find a valid id first (the `cause` names the command). |
 | `3` | degraded — Moda Cloud was unavailable and the answer was synthesized from local Data API evidence (`ask`), or some sources failed to load (`investigate`/`failures`, named in `data.failedSources`) | Answer is present but lower-trust or partial; verify before acting, and never read a partial result as "no issues". |
 | `4` | auth required — no API key, or the API rejected it (HTTP 401) | Set `MODA_API_KEY` or run the `login_command` from the `auth` payload (`moda auth login --api-key`), then re-run. |
-| `5` | input required — a choice is needed that the non-interactive run could not answer | Pick a choice from the `input_request` payload and re-invoke the same command with that choice's `resume_flags` appended. |
+| `5` | input required — a choice is needed that the non-interactive run could not answer (for example a tenant, or `--profile=local` for a loopback `MODA_BASE_URL` on a prod profile) | Pick a choice from the `input_request` payload and re-invoke the same command with that choice's `resume_flags` appended. |
 | `130` | cancelled | Treat as interrupted or closed pipe; do not retry blindly. |
 
 Exit codes `4` and `5` are recoverable-by-caller failures: the envelope's

package/skills/moda-cli/references/search-and-traces.md

@@ -37,7 +37,9 @@ These rows have no score or message index. Open one with
 `moda traces spans <conversation_id>` or `moda traces get <conversation_id>` to find the
 matching turn. When more traces exist, `fallback.has_more` is true and
 `next_commands` includes the `moda traces --search ... --offset` command to
-page. With `--mode=keyword`, ranked traces are not substituted. If the fallback
+page. With `--mode=keyword` the trace-level search is not run (it is
+relevance-ranked, so it could not be shown as literal matches); a warning says
+so and `next_commands` offers `moda traces --search` instead. If the fallback
 itself fails, you get a warning, not a silent empty result. Either way, zero
 results does not prove the topic never came up.
 

package/skills/moda-cli/references/troubleshooting.md

@@ -33,6 +33,20 @@ setup wizard; do not run it unprompted.
 The key is invalid, revoked, or for another environment. Get a new key and
 save it with `moda auth login --api-key`.
 
+**`Tenant <id> does not exist or is not accessible to this API key` (exit 1, `not_found`)**
+`MODA_TENANT_ID` (or `--tenant-id`) names a tenant that does not exist or was
+deleted. The key itself is fine. Set the tenant id to one from the dashboard
+URL, or from `moda auth whoami` with a browser session, and retry. A key that
+belongs to one tenant and is pointed at another gets `access_denied` with
+"Unset MODA_TENANT_ID" instead; a read-only key running a write gets
+`access_denied` saying it is read-only.
+
+**`MODA_BASE_URL=... is a loopback URL, and the active profile 'prod' is a prod profile` (exit 5, `input_required`)**
+Nothing was sent. Re-run with `--profile=local` (the choice's `resume_flags`)
+to use the local stack, or unset `MODA_BASE_URL` to use production.
+`moda auth status --online` then shows `online.baseUrl` and, from `/whoami`,
+the tenant the key acts on.
+
 **`not_found` (exit 1)**
 The trace, problem, or cluster id does not exist in this tenant (a trace with
 no generated world state returns a warning, not `not_found`).