@aiaiai-pt/martha-cli 0.27.1 → 0.30.0

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https
 
 ## [Unreleased]
 
+## [0.30.0] — 2026-07-03
+
+### Added — #761 runner heartbeat + poll-based cancel
+- `martha runner` now runs each task's goal **asynchronously with a heartbeat loop** (every `min(lease_timeout_s/3, 60)`s). Heartbeats renew the lease, so a task longer than its lease is no longer reclaimed by the lease reaper while still executing on the host (the Slice-0 double-execution hazard).
+- Cancelling a claimed task (`martha tasks cancel <id>` or the admin route) now actually stops it: the heartbeat reply carries `signal: "cancel"`, the runner kills the goal's **entire process tree** (SIGTERM the group, SIGKILL after 5s), and reports the partial output with `status: "cancelled"` — accepted idempotently server-side. Worst-case kill latency is one heartbeat interval (≤60s).
+- Heartbeat failures (network blips, 409s) never affect the running job — only an explicit `signal: "cancel"` kills.
+
+### Changed
+- The runner no longer "backgrounds" goals after 20s (a Slice-0 artifact that reported long tasks as `completed` while they were still running) — it now waits for real completion, kept alive by the heartbeat loop.
+
+<!-- 0.29.0 shipped 2026-07-02 (#751 asks + trigger-tasking) without a CHANGELOG section — see git history. -->
+
+## [0.28.0] — 2026-06-30
+
+### Added — #714 Slice 1 external-agent `event.emit` binding surfaces
+- `martha agents grant-trigger <agent> <trigger>` binds an agent's emitted events to a trigger (so an agent-emitted event may fire it); `martha agents revoke-trigger <agent> <trigger>` removes the binding; `martha agents triggers <agent>` lists the triggers an agent may fire.
+- `martha triggers allow-agent <trigger> <agentId>` accepts an agent as a source for a trigger; `martha triggers disallow-agent <trigger> <agentId>` removes it; `martha triggers agents <trigger>` lists the accepted agent sources.
+- Both directions mutate the same `agent_trigger_access` binding (#714) and reflect each other. All support `--json`. The trigger is resolved by name → id; the agent side keys on the agent's stored (server-normalized) name and the agent id, respectively. Cross-tenant agent/trigger → 404 (IDOR guard).
+
 ## [0.20.0] — 2026-06-21
 
 ### Added — #649 agent→agent delegation surfaces

package/dist/index.js

@@ -5,43 +5,25 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
+        get: () => mod[key],
         enumerable: true
       });
-  if (canCache)
-    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: __exportSetter.bind(all, name)
+      set: (newValue) => all[name] = () => newValue
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -1019,7 +1001,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          }
+          } else {}
         };
       }
       return this;
@@ -11081,7 +11063,7 @@ init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.27.1";
+var CLI_VERSION = "0.30.0";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {
@@ -11439,6 +11421,68 @@ async function runHostCommand(command, toolCallId, opts) {
 function safeName(s) {
   return s.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 120) || "task";
 }
+async function startHostCommand(command, toolCallId, opts) {
+  const dir = runnerDir(opts.cwd);
+  await fs5.mkdir(dir, { recursive: true });
+  const logPath = path4.join(dir, `${safeName(toolCallId)}.log`);
+  await fs5.writeFile(logPath, "");
+  const fd = openSync(logPath, "a");
+  const cap = opts.maxOutputBytes ?? MAX_OUTPUT;
+  const readLog = async () => {
+    try {
+      const buf = await fs5.readFile(logPath);
+      return buf.subarray(-cap).toString("utf8");
+    } catch {
+      return "";
+    }
+  };
+  const child = spawn(command, {
+    shell: true,
+    cwd: opts.cwd,
+    detached: true,
+    stdio: ["ignore", fd, fd]
+  });
+  closeSync(fd);
+  let exited = false;
+  const done = new Promise((resolve, reject) => {
+    let settled = false;
+    child.on("error", (e) => {
+      if (settled)
+        return;
+      settled = true;
+      exited = true;
+      reject(e);
+    });
+    child.on("close", async (code) => {
+      if (settled)
+        return;
+      settled = true;
+      exited = true;
+      resolve({
+        stdout: await readLog(),
+        stderr: "",
+        exit_code: code ?? -1,
+        log_path: logPath
+      });
+    });
+  });
+  const kill = (graceMs = 5000) => {
+    if (exited || !child.pid)
+      return;
+    try {
+      process.kill(-child.pid, "SIGTERM");
+    } catch {}
+    const escalate = setTimeout(() => {
+      if (exited || !child.pid)
+        return;
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {}
+    }, graceMs);
+    escalate.unref?.();
+  };
+  return { pid: child.pid, done, kill };
+}
 function mintExecSecret() {
   return randomBytes2(32).toString("hex");
 }
@@ -13512,7 +13556,7 @@ function registerConfigCommand(program2) {
       config.current_profile = name;
     }
     saveConfig(config);
-    if (!!program2.opts().json) {
+    if (program2.opts().json) {
       console.log(JSON.stringify({
         name,
         profile,
@@ -13556,7 +13600,7 @@ function registerConfigCommand(program2) {
       config.current_profile = remaining[0] ?? "default";
     }
     saveConfig(config);
-    if (!!program2.opts().json) {
+    if (program2.opts().json) {
       console.log(JSON.stringify({ name, deleted: true }));
       return;
     }
@@ -15066,6 +15110,50 @@ var agentsConfig = {
       }
       console.log(`Removed function '${functionName}' from agent '${agent}'`);
     });
+    parentCmd.command("grant-trigger <agent> <trigger>").description("Allow an agent's emitted events to fire a trigger").action(async (agent, trigger) => {
+      const ctx = getCtx();
+      const t = await ctx.api.get(`/api/admin/triggers/${encodeURIComponent(trigger)}`);
+      const result = await ctx.api.post(`${API_PATH}/${encodeURIComponent(agent)}/triggers`, { trigger_id: t.id });
+      if (isJson()) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+      }
+      console.log(`Granted trigger '${trigger}' to agent '${agent}'`);
+    });
+    parentCmd.command("revoke-trigger <agent> <trigger>").description("Revoke an agent's binding to a trigger").action(async (agent, trigger) => {
+      const ctx = getCtx();
+      const t = await ctx.api.get(`/api/admin/triggers/${encodeURIComponent(trigger)}`);
+      await ctx.api.del(`${API_PATH}/${encodeURIComponent(agent)}/triggers/${encodeURIComponent(String(t.id))}`);
+      if (isJson()) {
+        console.log(JSON.stringify({ agent, trigger, removed: true }));
+        return;
+      }
+      console.log(`Revoked trigger '${trigger}' from agent '${agent}'`);
+    });
+    parentCmd.command("triggers <agent>").description("List triggers an agent may fire").action(async (agent) => {
+      const ctx = getCtx();
+      const items = await ctx.api.get(`${API_PATH}/${encodeURIComponent(agent)}/triggers`);
+      if (isJson()) {
+        console.log(JSON.stringify(items, null, 2));
+        return;
+      }
+      if (items.length === 0) {
+        console.log(source_default.dim("No triggers bound to this agent."));
+        return;
+      }
+      const nameW = Math.max(7, ...items.map((b) => String(b.trigger_name ?? "").length));
+      const header = ["TRIGGER", "GRANTED BY", "GRANTED AT"].map((h, i) => h.padEnd([nameW, 16, 20][i])).join("  ");
+      console.log(source_default.bold(header));
+      console.log(source_default.dim("-".repeat(header.length)));
+      for (const b of items) {
+        const date = b.granted_at ? new Date(b.granted_at).toISOString().slice(0, 16).replace("T", " ") : "-";
+        console.log([
+          String(b.trigger_name ?? "").padEnd(nameW),
+          String(b.granted_by ?? "-").padEnd(16),
+          date.padEnd(20)
+        ].join("  "));
+      }
+    });
     parentCmd.command("provision-auth <agent>").description("Provision, switch, or rotate agent auth credentials").requiredOption("--method <method>", "Auth method: service-account or api-key").action(async (agent, opts) => {
       const ctx = getCtx();
       const methodMap = {
@@ -15495,6 +15583,51 @@ var triggersConfig = {
         }
       }
     });
+    parentCmd.command("allow-agent <trigger> <agentId>").description("Accept an agent's emitted events as a source for a trigger").action(async (trigger, agentId) => {
+      const ctx = getCtx();
+      const t = await ctx.api.get(`/api/admin/triggers/${encodeURIComponent(trigger)}`);
+      const result = await ctx.api.post(`/api/admin/triggers/${encodeURIComponent(String(t.id))}/agents`, { agent_id: agentId });
+      if (isJson()) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+      }
+      console.log(`Accepted agent '${agentId}' as a source for '${trigger}'`);
+    });
+    parentCmd.command("disallow-agent <trigger> <agentId>").description("Remove an agent as a source for a trigger").action(async (trigger, agentId) => {
+      const ctx = getCtx();
+      const t = await ctx.api.get(`/api/admin/triggers/${encodeURIComponent(trigger)}`);
+      await ctx.api.del(`/api/admin/triggers/${encodeURIComponent(String(t.id))}/agents/${encodeURIComponent(agentId)}`);
+      if (isJson()) {
+        console.log(JSON.stringify({ trigger, agent_id: agentId, removed: true }));
+        return;
+      }
+      console.log(`Removed agent '${agentId}' as a source for '${trigger}'`);
+    });
+    parentCmd.command("agents <trigger>").description("List the agents accepted as sources for a trigger").action(async (trigger) => {
+      const ctx = getCtx();
+      const t = await ctx.api.get(`/api/admin/triggers/${encodeURIComponent(trigger)}`);
+      const items = await ctx.api.get(`/api/admin/triggers/${encodeURIComponent(String(t.id))}/agents`);
+      if (isJson()) {
+        console.log(JSON.stringify(items, null, 2));
+        return;
+      }
+      if (items.length === 0) {
+        console.log(source_default.dim("No agent sources accepted for this trigger."));
+        return;
+      }
+      const nameW = Math.max(5, ...items.map((b) => String(b.agent_name ?? "").length));
+      const header = ["AGENT", "AGENT ID", "GRANTED AT"].map((h, i) => h.padEnd([nameW, 36, 20][i])).join("  ");
+      console.log(source_default.bold(header));
+      console.log(source_default.dim("-".repeat(header.length)));
+      for (const b of items) {
+        const date = b.granted_at ? new Date(b.granted_at).toISOString().slice(0, 16).replace("T", " ") : "-";
+        console.log([
+          String(b.agent_name ?? "-").padEnd(nameW),
+          String(b.agent_id ?? "-").padEnd(36),
+          date.padEnd(20)
+        ].join("  "));
+      }
+    });
   }
 };
 
@@ -16488,6 +16621,119 @@ function registerApprovalCommands(program2) {
   });
 }
 
+// src/commands/asks.ts
+init_errors();
+var KINDS = ["agent_question", "agent_approval_request"];
+function statusColor(status) {
+  if (status === "approved")
+    return source_default.green(status);
+  if (status === "rejected")
+    return source_default.red(status);
+  if (status === "expired")
+    return source_default.dim(status);
+  return source_default.yellow(status);
+}
+function renderAsk(a) {
+  const lines = [
+    `${source_default.bold(a.case_id ?? "?")}  ${statusColor(a.status ?? "?")}  ${source_default.dim(a.kind ?? "")}`,
+    `  ${a.reason ?? ""}`
+  ];
+  if (a.context_summary)
+    lines.push(`  ${source_default.dim(a.context_summary)}`);
+  if (a.decision) {
+    lines.push(`  ${source_default.bold("decision:")} ${statusColor(a.decision)}`);
+    if (a.comment)
+      lines.push(`  ${source_default.bold("answer:")} ${a.comment}`);
+  }
+  if (a.expires_at)
+    lines.push(`  ${source_default.dim(`expires ${a.expires_at}`)}`);
+  return lines.join(`
+`);
+}
+function registerAskCommands(program2) {
+  const cmd = program2.command("asks").description("Agent asks — questions/approval requests to the human queue (agent credentials)");
+  function getCtx() {
+    const ctx = createContext({
+      profileOverride: program2.opts().profile,
+      verbose: program2.opts().verbose
+    });
+    if (program2.opts().apiUrl)
+      ctx.profile.api_url = program2.opts().apiUrl;
+    return ctx;
+  }
+  function isJson() {
+    return !!program2.opts().json;
+  }
+  cmd.command("create").description("File an ask (the server attributes it to the token's agent)").requiredOption("--reason <text>", "The question / what approval is requested").option("--kind <kind>", `${KINDS.join(" | ")} (default agent_question)`, "agent_question").option("--context <text>", "Context summary for the reviewer").option("--questions <json>", "Structured questions JSON array (ask_user shape: question/header/options/multiSelect)").option("--expires-in <seconds>", "Auto-expire the ask after N seconds").option("--idempotency-key <key>", "Dedup key — retries with the same key do not double-file").action(async (opts) => {
+    if (!KINDS.includes(opts.kind)) {
+      throw new CLIError(`--kind must be one of: ${KINDS.join(", ")}`, 4 /* Validation */);
+    }
+    let questions;
+    if (opts.questions) {
+      try {
+        questions = JSON.parse(opts.questions);
+      } catch {
+        throw new CLIError("--questions must be valid JSON", 4 /* Validation */);
+      }
+    }
+    let expiresIn;
+    if (opts.expiresIn) {
+      expiresIn = parseInt(opts.expiresIn, 10);
+      if (isNaN(expiresIn) || expiresIn < 60) {
+        throw new CLIError("--expires-in must be an integer >= 60 (seconds)", 4 /* Validation */);
+      }
+    }
+    const ctx = getCtx();
+    const ask = await ctx.api.post("/api/agent/asks", {
+      kind: opts.kind,
+      reason: opts.reason,
+      context_summary: opts.context,
+      questions,
+      expires_in_s: expiresIn,
+      idempotency_key: opts.idempotencyKey
+    });
+    if (isJson()) {
+      console.log(JSON.stringify(ask, null, 2));
+      return;
+    }
+    console.log(`Filed ask ${source_default.bold(ask.case_id)} (${ask.status})`);
+    console.log(source_default.dim(`Poll the answer with: martha asks get ${ask.case_id}`));
+  });
+  cmd.command("list").description("List this agent's own asks (newest first)").option("--status <status>", "Filter by status (pending/approved/rejected/expired)").option("--limit <n>", "Max results", "50").action(async (opts) => {
+    const limitN = parseInt(opts.limit, 10);
+    if (isNaN(limitN) || limitN < 1) {
+      throw new CLIError("--limit must be a positive integer", 4 /* Validation */);
+    }
+    const ctx = getCtx();
+    const params = { limit: String(limitN) };
+    if (opts.status)
+      params.status = opts.status;
+    const items = await ctx.api.get("/api/agent/asks", {
+      params
+    });
+    if (isJson()) {
+      console.log(JSON.stringify(items, null, 2));
+      return;
+    }
+    if (items.length === 0) {
+      console.log(source_default.dim("No asks."));
+      return;
+    }
+    console.log(items.map(renderAsk).join(`
+
+`));
+  });
+  cmd.command("get <caseId>").description("Show one own ask — status, and decision+answer once resolved").action(async (caseId) => {
+    const ctx = getCtx();
+    const ask = await ctx.api.get(`/api/agent/asks/${caseId}`);
+    if (isJson()) {
+      console.log(JSON.stringify(ask, null, 2));
+      return;
+    }
+    console.log(renderAsk(ask));
+  });
+}
+
 // src/commands/tasks.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 init_errors();
@@ -16508,7 +16754,7 @@ var sleep4 = (ms, signal) => new Promise((resolve2) => {
   signal?.addEventListener("abort", onAbort, { once: true });
 });
 var fmtDate2 = (v) => typeof v === "string" ? new Date(v).toISOString().slice(0, 16).replace("T", " ") : "-";
-var statusColor = (status) => {
+var statusColor2 = (status) => {
   switch (status) {
     case "open":
       return source_default.yellow(status);
@@ -16611,7 +16857,7 @@ function registerTaskCommands(program2) {
       const row = columns.map((col, i) => {
         let val = col.accessor(item);
         if (col.header === "STATUS")
-          val = statusColor(val);
+          val = statusColor2(val);
         if (col.header === "PRIORITY")
           val = priorityColor(val);
         return col.header === "STATUS" || col.header === "PRIORITY" ? val.padEnd(widths[i] + (val.length - col.accessor(item).length)) : val.padEnd(widths[i]);
@@ -16660,7 +16906,7 @@ ${items.length} task(s)`));
       return;
     }
     console.log(`Created task ${source_default.cyan(String(result.id ?? ""))}`);
-    console.log(`  Status:   ${statusColor(String(result.status ?? "-"))}`);
+    console.log(`  Status:   ${statusColor2(String(result.status ?? "-"))}`);
     console.log(`  Priority: ${priorityColor(String(result.priority ?? "-"))}`);
     console.log(`  Goal:     ${truncate2(String(result.goal ?? "-"), 60)}`);
   });
@@ -16674,7 +16920,7 @@ ${items.length} task(s)`));
     console.log(source_default.bold("Task Details"));
     console.log(source_default.dim("-".repeat(50)));
     console.log(`${source_default.cyan("ID:")}          ${item.id ?? "-"}`);
-    console.log(`${source_default.cyan("Status:")}      ${statusColor(String(item.status ?? "-"))}`);
+    console.log(`${source_default.cyan("Status:")}      ${statusColor2(String(item.status ?? "-"))}`);
     console.log(`${source_default.cyan("Priority:")}    ${priorityColor(String(item.priority ?? "-"))}`);
     console.log(`${source_default.cyan("Title:")}       ${item.title ?? "-"}`);
     console.log(`${source_default.cyan("Agent:")}       ${item.agent_definition_id ?? "-"}`);
@@ -16785,7 +17031,7 @@ ${items.length} task(s) available`));
       return;
     }
     console.log(`Claimed task ${source_default.cyan(String(result.id ?? "").slice(0, 8))}`);
-    console.log(`  Status:    ${statusColor(String(result.status ?? "-"))}`);
+    console.log(`  Status:    ${statusColor2(String(result.status ?? "-"))}`);
     console.log(`  Executor:  ${result.executor_id ?? "-"}`);
     console.log(`  Lease:     expires ${fmtDate2(result.lease_expires_at)}`);
   });
@@ -16958,7 +17204,7 @@ ${items.length} task(s) available`));
       return;
     }
     console.log(`Completed task ${source_default.cyan(String(result.id ?? "").slice(0, 8))}`);
-    console.log(`  Status: ${statusColor(String(result.status ?? "-"))}`);
+    console.log(`  Status: ${statusColor2(String(result.status ?? "-"))}`);
     console.log(`  Completed at: ${fmtDate2(result.completed_at)}`);
   });
 }
@@ -16968,6 +17214,17 @@ init_errors();
 function sleep5(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
+function sleepUnref(ms) {
+  return new Promise((r) => {
+    const t = setTimeout(r, ms);
+    t.unref?.();
+  });
+}
+var DEFAULT_LEASE_S = 300;
+function heartbeatIntervalMs(leaseTimeoutS) {
+  const lease = typeof leaseTimeoutS === "number" && leaseTimeoutS > 0 ? leaseTimeoutS : DEFAULT_LEASE_S;
+  return Math.min(lease / 3, 60) * 1000;
+}
 async function runOnce(ctx, opts, handled) {
   const tasks = await ctx.api.get("/api/tasks/poll", {
     params: { agent_id: opts.agent, limit: String(opts.pollLimit ?? 5) }
@@ -16985,20 +17242,55 @@ async function runOnce(ctx, opts, handled) {
   handled?.add(task.id);
   const claimed = await ctx.api.post(`/api/tasks/${encodeURIComponent(task.id)}/claim`, {});
   const goal = claimed.goal ?? task.goal ?? "";
+  const intervalMs = heartbeatIntervalMs(claimed.lease_timeout_s ?? DEFAULT_LEASE_S);
   process.stderr.write(source_default.dim(`
-[runner] claimed ${task.id} — running: ${goal}
+[runner] claimed ${task.id} — running: ${goal} (heartbeat every ${Math.round(intervalMs / 1000)}s)
 `));
   let result;
+  let cancelled = false;
   try {
-    result = await runHostCommand(goal, `task-${task.id}`, { cwd: opts.cwd });
+    const handle = await startHostCommand(goal, `task-${task.id}`, {
+      cwd: opts.cwd
+    });
+    const done = handle.done.catch((e) => ({
+      stdout: "",
+      stderr: String(e),
+      exit_code: -1
+    }));
+    for (;; ) {
+      const raced = await Promise.race([
+        done,
+        sleepUnref(intervalMs).then(() => null)
+      ]);
+      if (raced !== null) {
+        result = raced;
+        break;
+      }
+      let reply;
+      try {
+        reply = await ctx.api.post(`/api/tasks/${encodeURIComponent(task.id)}/heartbeat`, {});
+      } catch (e) {
+        process.stderr.write(source_default.yellow(`[runner] heartbeat failed for ${task.id} (job unaffected): ${String(e)}
+`));
+        continue;
+      }
+      if (reply && reply.signal === "cancel") {
+        process.stderr.write(source_default.yellow(`[runner] cancel signal for ${task.id} — killing process tree
+`));
+        handle.kill();
+        result = await done;
+        cancelled = true;
+        break;
+      }
+    }
   } catch (e) {
     result = { stdout: "", stderr: String(e), exit_code: -1 };
   }
   const exit_code = result.exit_code;
   const stdout = result.stdout || result.stderr || "";
-  const status = exit_code === 0 ? "completed" : "failed";
+  const status = cancelled ? "cancelled" : exit_code === 0 ? "completed" : "failed";
   await ctx.api.post(`/api/tasks/${encodeURIComponent(task.id)}/complete`, {
-    outcome: { stdout, exit_code },
+    outcome: cancelled ? { stdout, exit_code, cancelled: true } : { stdout, exit_code },
     status
   });
   process.stderr.write(source_default.dim(`[runner] completed ${task.id} — ${status} (exit ${exit_code})
@@ -19970,7 +20262,7 @@ async function resolveCredentialFlag(value) {
 // src/commands/policy.ts
 init_errors();
 var ACTIONS = ["allow", "require_approval", "block"];
-var KINDS = ["risk_tag", "risk_level", "capability"];
+var KINDS2 = ["risk_tag", "risk_level", "capability"];
 var SCOPES = ["any", "agent", "client"];
 var truncate4 = (s, n) => s.length > n ? s.slice(0, n - 1) + "…" : s;
 function assertOneOf(value, allowed, flag) {
@@ -20066,8 +20358,8 @@ function registerPolicyCommands(program2) {
     console.log(`Safe-default bundle ${enabled ? source_default.yellow("enabled") : source_default.dim("disabled")}.`);
   });
   const rule = cmd.command("rule").description("Manage explicit policy rules");
-  rule.command("add").description("Create or update a rule").requiredOption(`--kind <kind>`, `Match kind (${KINDS.join("|")})`).requiredOption("--value <value>", "Match value (a risk tag, level, or capability ref)").requiredOption(`--action <action>`, `Action (${ACTIONS.join("|")})`).option(`--scope <scope>`, `Principal scope (${SCOPES.join("|")})`, "any").option("--note <text>", "Optional human note").action(async (opts) => {
-    assertOneOf(opts.kind, KINDS, "--kind");
+  rule.command("add").description("Create or update a rule").requiredOption(`--kind <kind>`, `Match kind (${KINDS2.join("|")})`).requiredOption("--value <value>", "Match value (a risk tag, level, or capability ref)").requiredOption(`--action <action>`, `Action (${ACTIONS.join("|")})`).option(`--scope <scope>`, `Principal scope (${SCOPES.join("|")})`, "any").option("--note <text>", "Optional human note").action(async (opts) => {
+    assertOneOf(opts.kind, KINDS2, "--kind");
     assertOneOf(opts.action, ACTIONS, "--action");
     assertOneOf(opts.scope, SCOPES, "--scope");
     const ctx = getCtx();
@@ -21363,6 +21655,7 @@ registerDocumentCommands(program2);
 registerDocumentSyncCommands(program2);
 registerWikiCommands(program2);
 registerApprovalCommands(program2);
+registerAskCommands(program2);
 registerTaskCommands(program2);
 registerRunnerCommand(program2);
 registerTeamCommands(program2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiaiai-pt/martha-cli",
-  "version": "0.27.1",
+  "version": "0.30.0",
   "description": "Terminal-first client for the Martha AI platform",
   "homepage": "https://docs.martha.nomadriver.co",
   "repository": {