@aiaiai-pt/martha-cli 0.25.0 → 0.26.0

package/dist/index.js

@@ -2158,6 +2158,8 @@ function extractDetail(body) {
       const nested = obj.detail;
       if (typeof nested.message === "string")
         return nested.message;
+      if (typeof nested.code === "string")
+        return nested.code;
       if (nested.code === "mcp_oauth_authorization_required" && typeof nested.authorization_url === "string") {
         return "MCP OAuth authorization required";
       }
@@ -11073,12 +11075,13 @@ ${items.length} ${config.typeNamePlural}`));
 }
 
 // src/commands/chat.ts
+import { createHash as createHash2 } from "node:crypto";
 import { createInterface as createInterface2 } from "node:readline";
 init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.25.0";
+var CLI_VERSION = "0.26.0";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {
@@ -11352,6 +11355,7 @@ function createApprovalTagStripper() {
 
 // src/lib/local-exec.ts
 import { spawn } from "node:child_process";
+import { randomBytes as randomBytes2 } from "node:crypto";
 import { closeSync, openSync, promises as fs5 } from "node:fs";
 import * as path4 from "node:path";
 var DEFAULT_TIMEOUT_MS = 20000;
@@ -11432,6 +11436,9 @@ async function runHostCommand(command, toolCallId, opts) {
 function safeName(s) {
   return s.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 120) || "task";
 }
+function mintExecSecret() {
+  return randomBytes2(32).toString("hex");
+}
 
 class Journal {
   cwd;
@@ -11443,9 +11450,13 @@ class Journal {
   }
   async load() {
     try {
-      return JSON.parse(await fs5.readFile(this.file(), "utf8"));
+      const raw = JSON.parse(await fs5.readFile(this.file(), "utf8"));
+      if (raw["entries"] !== undefined) {
+        return raw;
+      }
+      return { entries: raw, secrets: {} };
     } catch {
-      return {};
+      return { entries: {}, secrets: {} };
     }
   }
   async save(data) {
@@ -11456,11 +11467,11 @@ class Journal {
     return `${sessionId}:${toolCallId}`;
   }
   async lookup(sessionId, toolCallId) {
-    return (await this.load())[Journal.key(sessionId, toolCallId)];
+    return (await this.load()).entries[Journal.key(sessionId, toolCallId)];
   }
   async recordRunning(sessionId, toolCallId, command, now) {
     const data = await this.load();
-    data[Journal.key(sessionId, toolCallId)] = {
+    data.entries[Journal.key(sessionId, toolCallId)] = {
       state: "running",
       command,
       started_at: now
@@ -11470,8 +11481,8 @@ class Journal {
   async recordDone(sessionId, toolCallId, result) {
     const data = await this.load();
     const k = Journal.key(sessionId, toolCallId);
-    const prev = data[k];
-    data[k] = {
+    const prev = data.entries[k];
+    data.entries[k] = {
       state: "done",
       command: prev?.command ?? "",
       started_at: prev?.started_at ?? "",
@@ -11479,6 +11490,14 @@ class Journal {
     };
     await this.save(data);
   }
+  async recordSecret(sessionId, toolCallId, secret) {
+    const data = await this.load();
+    data.secrets[Journal.key(sessionId, toolCallId)] = secret;
+    await this.save(data);
+  }
+  async lookupSecret(sessionId, toolCallId) {
+    return (await this.load()).secrets[Journal.key(sessionId, toolCallId)];
+  }
 }
 function decideFromJournal(entry) {
   if (!entry)
@@ -12104,9 +12123,28 @@ async function resolveLocalAgent(sessionId, toolCallId, req, state) {
     log_path: result.log_path
   };
 }
-async function _postToolResult(ctx, sessionId, toolCallId, result, label) {
+async function claimGate(ctx, sessionId, toolCallId, state) {
+  if (state.claimed.has(toolCallId))
+    return;
+  const secret = state.secrets.get(toolCallId) ?? mintExecSecret();
+  const secretHash = createHash2("sha256").update(secret).digest("hex");
+  state.secrets.set(toolCallId, secret);
+  await state.journal.recordSecret(sessionId, toolCallId, secret);
   try {
-    await ctx.api.post(`/api/chat/${encodeURIComponent(sessionId)}/tool-result`, { tool_call_id: toolCallId, result });
+    await ctx.api.post(`/api/chat/${encodeURIComponent(sessionId)}/tool-claim`, { tool_call_id: toolCallId, secret_hash: secretHash });
+    state.claimed.add(toolCallId);
+  } catch (e) {
+    process.stderr.write(source_default.yellow(`[local-exec] failed to claim gate for ${toolCallId}: ${String(e)}
+`));
+  }
+}
+async function _postToolResult(ctx, sessionId, toolCallId, result, label, execSecret) {
+  try {
+    await ctx.api.post(`/api/chat/${encodeURIComponent(sessionId)}/tool-result`, {
+      tool_call_id: toolCallId,
+      result,
+      ...execSecret !== undefined ? { exec_secret: execSecret } : {}
+    });
   } catch (e) {
     process.stderr.write(source_default.red(`[${label}] failed to POST result: ${String(e)}
 `));
@@ -12118,40 +12156,45 @@ async function handleHostExecFrame(ctx, sessionId, data, state) {
     if (state.handled.has(id))
       continue;
     state.handled.add(id);
+    await claimGate(ctx, sessionId, id, state);
     const result = await resolveHostExec(sessionId, id, req.command, state);
-    await _postToolResult(ctx, sessionId, id, result, "host_exec");
+    await _postToolResult(ctx, sessionId, id, result, "host_exec", state.secrets.get(id));
   }
   for (const req of parseHostScreenshotRequests(data)) {
     const id = req.toolCallId;
     if (state.handled.has(id))
       continue;
     state.handled.add(id);
+    await claimGate(ctx, sessionId, id, state);
     const result = await resolveHostScreenshot(ctx, sessionId, req, state);
-    await _postToolResult(ctx, sessionId, id, result, "host_screenshot");
+    await _postToolResult(ctx, sessionId, id, result, "host_screenshot", state.secrets.get(id));
   }
   for (const req of parseHostBrowserRequests(data)) {
     const id = req.toolCallId;
     if (state.handled.has(id))
       continue;
     state.handled.add(id);
+    await claimGate(ctx, sessionId, id, state);
     const result = await resolveHostBrowser(ctx, sessionId, req, state);
-    await _postToolResult(ctx, sessionId, id, result, "host_browser");
+    await _postToolResult(ctx, sessionId, id, result, "host_browser", state.secrets.get(id));
   }
   for (const req of parseHostFileRequests(data)) {
     const id = req.toolCallId;
     if (state.handled.has(id))
       continue;
     state.handled.add(id);
+    await claimGate(ctx, sessionId, id, state);
     const result = await resolveHostFile(req, state);
-    await _postToolResult(ctx, sessionId, id, result, req.action);
+    await _postToolResult(ctx, sessionId, id, result, req.action, state.secrets.get(id));
   }
   for (const req of parseLocalAgentRequests(data)) {
     const id = req.toolCallId;
     if (state.handled.has(id))
       continue;
     state.handled.add(id);
+    await claimGate(ctx, sessionId, id, state);
     const result = await resolveLocalAgent(sessionId, id, req, state);
-    await _postToolResult(ctx, sessionId, id, result, "local_agent");
+    await _postToolResult(ctx, sessionId, id, result, "local_agent", state.secrets.get(id));
   }
 }
 function parseSlashCommand(input) {
@@ -12209,7 +12252,9 @@ async function sendMessage(ctx, sessionId, message, opts = {}) {
     autoYes: opts.localExec.autoYes,
     localAgent: opts.localExec.agent,
     handled: new Set,
-    journal: new Journal(opts.localExec.cwd)
+    journal: new Journal(opts.localExec.cwd),
+    secrets: new Map,
+    claimed: new Set
   } : null;
   const reqBody = { content: message };
   if (opts.localExec)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiaiai-pt/martha-cli",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Terminal-first client for the Martha AI platform",
   "homepage": "https://docs.martha.nomadriver.co",
   "repository": {