@moda-ai/cli 1.9.0 → 1.9.6

package/dist/auth.js

@@ -312,12 +312,44 @@ export async function authFetch(path, options = {}, authOptions = {}) {
     if (!token) {
         throw new Error('Not authenticated. Run "moda init" to log in.');
     }
-    const url = `${resolveModaBaseUrl()}${path}`;
     const headers = new Headers(options.headers);
     headers.set('Authorization', `Bearer ${token}`);
     if (!headers.has('Content-Type') && options.body) {
         headers.set('Content-Type', 'application/json');
     }
-    return fetch(url, { ...options, headers });
+    const origin = new URL(resolveModaBaseUrl()).origin;
+    let url = `${resolveModaBaseUrl()}${path}`;
+    // Follow redirects manually so EVERY hop is origin-checked, not just the
+    // first. Native `redirect: 'follow'` would silently strip the Authorization
+    // header on a cross-host hop (per the Fetch spec) — the exact failure that
+    // broke moda init (the legacy www → apex 308). Same-host hops keep the header
+    // and are safe to follow; any hop that leaves the Moda origin fails fast with
+    // an actionable error instead of surfacing as a confusing 401.
+    const MAX_REDIRECTS = 5;
+    for (let hop = 0;; hop++) {
+        const response = await fetch(url, { ...options, headers, redirect: 'manual' });
+        if (response.status < 300 || response.status >= 400) {
+            return response;
+        }
+        const location = response.headers.get('location');
+        const target = location ? safeResolveUrl(location, url) : null;
+        if (!target || target.origin !== origin) {
+            throw new Error(`Moda API redirected (${response.status}) to ${location ?? '(unknown)'}. ` +
+                'Cross-host redirects strip Authorization and break moda init. ' +
+                'Use MODA_BASE_URL=https://moda.dev (not www.moda.dev).');
+        }
+        if (hop >= MAX_REDIRECTS) {
+            throw new Error(`Moda API exceeded ${MAX_REDIRECTS} same-host redirects for ${path}.`);
+        }
+        url = target.toString();
+    }
+}
+function safeResolveUrl(location, base) {
+    try {
+        return new URL(location, base);
+    }
+    catch {
+        return null;
+    }
 }
 //# sourceMappingURL=auth.js.map

package/dist/config.d.ts

@@ -27,7 +27,8 @@ export declare function saveCliConfig(update: CliConfig): void;
 export declare function resolveApiKey(options?: ProfileIOOptions): string | undefined;
 /**
  * Resolve the ingest worker base URL used by `moda workspace snapshot`.
- * Env override -> persisted config -> production default.
+ * Env override -> active profile -> legacy config -> production default.
+ * Loopback URLs are rejected unless the active profile is `local`.
  */
 export declare function resolveIngestUrl(options?: ProfileIOOptions): string;
 /**

package/dist/config.js

@@ -1,11 +1,11 @@
 import { readFileSync } from 'node:fs';
-import { DEFAULT_INGEST_URL, PROD_BASE_URL, getLegacyConfigPath, loadLegacyCliConfig, resolveApiKeyFromActiveProfile, resolveBaseUrl, resolveIngestUrlFromActiveProfile, resolveTenantIdFromActiveProfile, syncLegacyConfigToProfile, writeLegacyCliConfig, } from './profiles.js';
+import { DEFAULT_INGEST_URL, PROD_BASE_URL, getLegacyConfigPath, loadLegacyCliConfig, resolveApiKeyFromActiveProfile, resolveBaseUrl, resolveIngestUrl as resolveProfileIngestUrl, resolveTenantIdFromActiveProfile, syncLegacyConfigToProfile, writeLegacyCliConfig, } from './profiles.js';
 const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
 export const VERSION = pkg.version;
-// Canonical host is www.moda.dev. The apex `moda.dev` 308-redirects to it, and
+// Canonical host is moda.dev. The www host 308-redirects to the apex, and
 // cross-host redirects strip the Authorization header (fetch/undici), so using
-// the apex breaks `moda init`'s authenticated calls with a 401. Default to the
-// canonical host directly.
+// www breaks `moda init`'s authenticated calls with a 401. Default to the
+// canonical host directly; resolveBaseUrl() also rewrites legacy www URLs.
 export const MODA_BASE_URL = resolveBaseUrl();
 export function loadCliConfig(options = {}) {
     return loadLegacyCliConfig(options);
@@ -38,14 +38,11 @@ export function resolveApiKey(options = {}) {
 }
 /**
  * Resolve the ingest worker base URL used by `moda workspace snapshot`.
- * Env override -> persisted config -> production default.
+ * Env override -> active profile -> legacy config -> production default.
+ * Loopback URLs are rejected unless the active profile is `local`.
  */
 export function resolveIngestUrl(options = {}) {
-    const env = options.env ?? process.env;
-    return (env.MODA_INGEST_URL ||
-        resolveIngestUrlFromActiveProfile(options) ||
-        loadCliConfig(options).ingest_url ||
-        DEFAULT_INGEST_URL);
+    return resolveProfileIngestUrl(options);
 }
 /**
  * Resolve the active tenant id: env override first, then the persisted

package/dist/profiles.d.ts

@@ -1,5 +1,5 @@
 export declare const PROFILE_CONFIG_VERSION = 1;
-export declare const PROD_BASE_URL = "https://www.moda.dev";
+export declare const PROD_BASE_URL = "https://moda.dev";
 export declare const DEFAULT_INGEST_URL = "https://moda-ingest.modas.workers.dev";
 export declare const DEFAULT_PROFILE_NAME = "prod";
 export type ModaEnvironment = 'local' | 'dev' | 'staging' | 'prod';
@@ -71,6 +71,7 @@ export declare function getLegacyConfigPath(options?: ProfileIOOptions): string;
 export declare function loadLegacyCliConfig(options?: ProfileIOOptions): LegacyCliConfig;
 export declare function writeLegacyCliConfig(update: LegacyCliConfig, options?: ProfileIOOptions): LegacyCliConfig;
 export declare function createDefaultProfiles(options?: ProfileIOOptions): Record<string, ModaProfile>;
+export declare function isLoopbackBaseUrl(url: string): boolean;
 export declare function assertValidProfileName(name: string): void;
 export declare function inspectProfileMigrationState(options?: ProfileIOOptions): ProfileMigrationState;
 export declare function loadProfileConfig(options?: ProfileIOOptions): ProfileConfig;
@@ -82,7 +83,14 @@ export declare function syncLegacyConfigToProfile(legacy: LegacyCliConfig, optio
 export declare function secretFilePathFromRef(reference: SecretReference, options?: ProfileIOOptions): string | undefined;
 export declare function resolveSecretReference(reference: SecretReference | undefined, options?: ProfileIOOptions): string | undefined;
 export declare function resolveApiKeyFromActiveProfile(options?: ProfileIOOptions): string | undefined;
+/**
+ * Vercel serves moda.dev as canonical and 308-redirects www to the apex. Node
+ * fetch strips Authorization on cross-host redirects, which breaks moda init
+ * step 3 when the base URL still points at www.
+ */
+export declare function normalizeModaBaseUrl(url: string): string;
 export declare function resolveBaseUrl(options?: ProfileIOOptions): string;
+export declare function resolveIngestUrl(options?: ProfileIOOptions): string;
 export declare function resolveIngestUrlFromActiveProfile(options?: ProfileIOOptions): string | undefined;
 export declare function resolveTenantIdFromActiveProfile(options?: ProfileIOOptions): string | undefined;
 export declare function ensureSecretFilePermissions(path: string, repair?: boolean): SecretFilePermissionStatus;

package/dist/profiles.js

@@ -2,7 +2,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync
 import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, normalize, relative } from 'node:path';
 export const PROFILE_CONFIG_VERSION = 1;
-export const PROD_BASE_URL = 'https://www.moda.dev';
+export const PROD_BASE_URL = 'https://moda.dev';
 export const DEFAULT_INGEST_URL = 'https://moda-ingest.modas.workers.dev';
 export const DEFAULT_PROFILE_NAME = 'prod';
 function getEnv(options = {}) {
@@ -93,6 +93,65 @@ export function createDefaultProfiles(options = {}) {
         prod: profileDefaults('prod', 'prod', now),
     };
 }
+function isLoopbackHostname(hostname) {
+    const host = hostname.toLowerCase();
+    return (host === 'localhost' ||
+        host === '127.0.0.1' ||
+        host === '::1' ||
+        host === '[::1]');
+}
+export function isLoopbackBaseUrl(url) {
+    try {
+        return isLoopbackHostname(new URL(url).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function defaultBaseUrlForEnvironment(environment) {
+    if (environment === 'local')
+        return 'http://localhost:3000';
+    if (environment === 'staging')
+        return 'https://staging.moda.dev';
+    return PROD_BASE_URL;
+}
+function defaultIngestUrlForEnvironment(environment) {
+    if (environment === 'local')
+        return 'http://localhost:8787';
+    return DEFAULT_INGEST_URL;
+}
+function environmentAllowsLoopback(environment) {
+    return environment !== 'prod';
+}
+function sanitizeProfileBaseUrl(url, environment) {
+    const normalized = normalizeModaBaseUrl(url);
+    if (environmentAllowsLoopback(environment) || !isLoopbackBaseUrl(normalized)) {
+        return normalized;
+    }
+    return PROD_BASE_URL;
+}
+function sanitizeProfileIngestUrl(url, environment) {
+    if (!url)
+        return url;
+    if (environmentAllowsLoopback(environment) || !isLoopbackBaseUrl(url)) {
+        return url;
+    }
+    return DEFAULT_INGEST_URL;
+}
+function enforceNonLoopbackBaseUrl(url, environment) {
+    return sanitizeProfileBaseUrl(url, environment);
+}
+function enforceNonLoopbackIngestUrl(url, environment) {
+    return sanitizeProfileIngestUrl(url, environment) ?? defaultIngestUrlForEnvironment(environment);
+}
+function activeProfileEnvironment(options) {
+    try {
+        return getActiveProfile(options).environment;
+    }
+    catch {
+        return 'prod';
+    }
+}
 function normalizeEnvironment(value) {
     if (value === 'local' ||
         value === 'dev' ||
@@ -131,8 +190,8 @@ function normalizeProfile(fallbackName, value, options) {
     const defaults = profileDefaults(name, normalizeEnvironment(value.environment), options.now ?? new Date());
     return {
         ...defaults,
-        base_url: optionalString(value.base_url) ?? defaults.base_url,
-        ingest_url: optionalString(value.ingest_url) ?? defaults.ingest_url,
+        base_url: sanitizeProfileBaseUrl(optionalString(value.base_url) ?? defaults.base_url, normalizeEnvironment(value.environment)),
+        ingest_url: sanitizeProfileIngestUrl(optionalString(value.ingest_url) ?? defaults.ingest_url, normalizeEnvironment(value.environment)),
         tenant_id: optionalString(value.tenant_id),
         workspace_id: optionalString(value.workspace_id),
         api_key_ref: normalizeSecretReference(value.api_key_ref),
@@ -170,9 +229,12 @@ function applyLegacyAwareness(config, options) {
     const migration = inspectProfileMigrationState(options);
     const prod = config.profiles.prod;
     if (prod && (legacy.api_key || legacy.ingest_url || legacy.tenant_id)) {
+        const migratedIngestUrl = legacy.ingest_url && !isLoopbackBaseUrl(legacy.ingest_url)
+            ? legacy.ingest_url
+            : prod.ingest_url;
         config.profiles.prod = {
             ...prod,
-            ingest_url: legacy.ingest_url ?? prod.ingest_url,
+            ingest_url: migratedIngestUrl,
             tenant_id: legacy.tenant_id ?? prod.tenant_id,
             api_key_ref: legacy.api_key ? 'legacy:config.api_key' : prod.api_key_ref,
             auth_token_ref: migration.legacy_auth.has_access_token
@@ -343,17 +405,58 @@ export function resolveApiKeyFromActiveProfile(options = {}) {
         return undefined;
     }
 }
+/**
+ * Vercel serves moda.dev as canonical and 308-redirects www to the apex. Node
+ * fetch strips Authorization on cross-host redirects, which breaks moda init
+ * step 3 when the base URL still points at www.
+ */
+export function normalizeModaBaseUrl(url) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.hostname === 'www.moda.dev') {
+            parsed.hostname = 'moda.dev';
+            return parsed.toString().replace(/\/$/, '');
+        }
+    }
+    catch {
+        // Not a valid URL; return unchanged and let the caller surface the error.
+    }
+    return url.replace(/\/$/, '');
+}
 export function resolveBaseUrl(options = {}) {
+    const environment = activeProfileEnvironment(options);
     const envBase = optionalString(getEnv(options).MODA_BASE_URL);
-    if (envBase)
-        return envBase;
+    if (envBase) {
+        return enforceNonLoopbackBaseUrl(normalizeModaBaseUrl(envBase), environment);
+    }
     try {
-        return getActiveProfile(options).base_url || PROD_BASE_URL;
+        return enforceNonLoopbackBaseUrl(normalizeModaBaseUrl(getActiveProfile(options).base_url || PROD_BASE_URL), environment);
     }
     catch {
         return PROD_BASE_URL;
     }
 }
+export function resolveIngestUrl(options = {}) {
+    const environment = activeProfileEnvironment(options);
+    const envIngest = optionalString(getEnv(options).MODA_INGEST_URL);
+    if (envIngest) {
+        return enforceNonLoopbackIngestUrl(envIngest, environment);
+    }
+    try {
+        const profileIngest = getActiveProfile(options).ingest_url;
+        if (profileIngest) {
+            return enforceNonLoopbackIngestUrl(profileIngest, environment);
+        }
+    }
+    catch {
+        // Fall through to legacy/default below.
+    }
+    const legacyIngest = optionalString(loadLegacyCliConfig(options).ingest_url);
+    if (legacyIngest) {
+        return enforceNonLoopbackIngestUrl(legacyIngest, environment);
+    }
+    return defaultIngestUrlForEnvironment(environment);
+}
 export function resolveIngestUrlFromActiveProfile(options = {}) {
     try {
         return getActiveProfile(options).ingest_url;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.9.0",
+  "version": "1.9.6",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {
@@ -13,8 +13,7 @@
     "!dist/__tests__",
     "hooks/**",
     "skills/**/SKILL.md",
-    "README.md",
-    ".env.example"
+    "README.md"
   ],
   "publishConfig": {
     "access": "public"

package/.env.example

@@ -1,8 +0,0 @@
-# Moda API Key (required)
-# Get this from https://moda.dev/settings
-MODA_API_KEY=moda_sk_...
-
-# Moda Backend URL (optional)
-# Defaults to production: https://moda.dev
-# For local development, override with:
-# MODA_BASE_URL=http://localhost:3001