@aiaiai-pt/martha-cli 0.51.2 → 0.53.0

package/CHANGELOG.md

@@ -2,7 +2,115 @@
 
 All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to semver — `0.x` releases may include breaking changes between minor versions.
 
-## [Unreleased]
+## [0.53.0] — 2026-08-02
+
+### Added — `martha channels`: connect an agent to a channel from either side (#1140)
+
+- `martha channels install-harness buzz` registers Martha as a **runtime** in
+  Buzz Desktop — a tier-3 custom harness definition written into Desktop's
+  app-data dir (auto-detected per platform, release or dev build; `--print`,
+  `--app-data`, `--force`). The user then picks **Martha** in New agent and sets
+  `MARTHA_CLIENT_ID`/`MARTHA_CLIENT_SECRET` per agent in Edit Agent. Desktop
+  keeps ownership of the keypair, the NIP-OA attestation, spawning and channel
+  attachment; we contribute a definition and the adapter, nothing else. The
+  definition pins `BUZZ_ACP_MULTIPLE_EVENT_HANDLING=queue` — Desktop's `steer`
+  cancels the in-flight turn, which is right for a local LLM and wrong for a
+  remote Martha turn.
+- `martha channels connect buzz` and `martha channels preflight buzz` — the
+  same setup starting from Martha. Preflight checks every precondition (both
+  binaries, that the `martha` on PATH actually has `acp-serve`, API + credential,
+  agent existence/hosting/takeover, its principal, relay reachability, the
+  channel identity, and membership) and names the one command that fixes each
+  gap. It **exits non-zero rather than half-starting**, and reports a check it
+  could not evaluate as WARN rather than claiming the thing is missing.
+  `--emit docker|compose|k8s` prints a deployable unit with secrets referenced
+  instead of inlined; `--dry-run` shows the launch without starting it.
+
+### Fixed — a service-account invocation could run as a logged-in human
+
+- With `MARTHA_CLIENT_ID`/`MARTHA_CLIENT_SECRET` set, the CLI reused whatever
+  token was stored for the profile if it was still valid — including a human
+  token left by an earlier `martha auth login`. A long-running adapter then
+  answered as the developer instead of as its agent, and chat takeover never
+  fired. A stored token is now only reused when it belongs to the same client
+  (`auth_type` + the JWT's `azp`), which is what the documented auth precedence
+  always said. Found by running `martha channels connect` on a real relay.
+- `agents doctor` reported a correctly-bound agent as unbound on any tenant with
+  more than 25 clients: the client scan was capped at 25 and swallowed per-client
+  errors. The scan now walks the whole list (bounded, with concurrency) and says
+  "inconclusive" when it cannot read all of it — an incomplete scan can never
+  justify "no client grants this agent", which was advice to mint a second
+  principal for an agent that already had one.
+- A failed `client_credentials` login now raises an auth-typed error (exit 2)
+  instead of a generic one, so callers can tell "this credential is wrong" apart
+  from "the server is unreachable".
+
+### Added — `martha acp-serve`: ACP stdio bridge (#1117)
+
+- New `acp-serve` command speaks the Agent Client Protocol (newline-delimited
+  JSON-RPC 2.0) over stdio so an ACP harness — Buzz's `buzz-acp`, Zed, or any
+  ACP client — can drive a Martha agent as its runtime. `session/new` opens a
+  Martha chat session, `session/prompt` sends the user message and re-emits
+  Martha's SSE tokens as `session/update` agent_message_chunk notifications,
+  `session/cancel` aborts the in-flight turn (`stopReason: "cancelled"`).
+  Mid-session Martha errors surface as ACP error results without killing the
+  process; unrecoverable startup errors (bad token, unreachable API) exit
+  non-zero with a clear stderr line for the harness's circuit breaker. All
+  logging is JSON lines on stderr — stdout carries only protocol frames.
+- `--post-reply` (opt-in) posts the turn's final answer back to the triggering
+  Buzz channel via the `buzz` CLI — the same reply mechanism Buzz's own
+  agents use — parsing the channel and thread anchor from the prompt's
+  `[Context]` section. The shim itself never holds or signs with Nostr keys.
+- `martha principals bootstrap` — the CLI now exposes the API's own principal
+  noun (`/principals/bootstrap`, #535) with three modes: `human` (what
+  `martha init` wraps), `integration` (headless service account), and `agent`
+  — a service account bound to ONE Martha-hosted agent via chat takeover, so
+  the credential acts as the agent. Agent mode is the one-shot an external
+  ACP driver needs: resolve-or-create the agent, provision the principal
+  (idempotent — same label returns the same secret), bind, and print the
+  `MARTHA_CLIENT_ID/SECRET` + harness env block. The same orchestration ships
+  as a "Provision principal" action in the admin UI agents page. (Agent mode
+  is composed client-side in v1; a follow-up promotes it server-side.)
+- Fixed in review: `--api-url` now flows through `createContext` — mutating
+  `ctx.profile.api_url` after construction (the pattern elsewhere in the CLI)
+  never reaches the already-constructed API client.
+
+## [0.51.5] — 2026-07-20
+
+### Fixed — host tools ran in a doubled working directory
+
+- The runner concatenated its scoped `--cwd` with a per-call `cwd`
+  (`` `${state.cwd}/${req.cwd}` ``), so an ABSOLUTE request path — what an agent
+  sends naturally when its prompt names the repo — became
+  `/Users/me/repo//Users/me/repo` and every `host_exec` failed with ENOENT /
+  MODULE_NOT_FOUND. Now resolved properly (absolute used as-is, relative joined)
+  and still confined inside the scoped workspace.
+
+## [0.51.4] — 2026-07-20
+
+### Added — `MARTHA_BROWSER_HEADFUL` for WAF-protected pages
+
+- `host_browser` launched Chromium headless unconditionally, so any site that
+  fingerprints headless Chrome (Cloudflare & co.) served it 403 — exactly the
+  pages the tool exists to reach. Set `MARTHA_BROWSER_HEADFUL=1` on the runner
+  to launch headful with a real Chrome UA and a 1440x900 viewport. Default is
+  unchanged (headless), so CI and display-less servers are unaffected.
+- Verified against `piscapisca.pt/carros`: 403 headless, 200 headful with live
+  listing data, same machine and same tool.
+
+## [0.51.3] — 2026-07-20
+
+### Fixed — `host_browser` could never find playwright
+
+- `host_browser` resolved `playwright` with a bare specifier, i.e. relative to
+  `martha-cli/dist/` — never the runner's `--cwd`. Its own error message told
+  users to `npm i -D playwright` (naturally read as "in my project"), which was
+  exactly where the CLI would not look, so the tool reported "not installed"
+  forever on fully-provisioned machines. Now resolved from `process.cwd()`
+  first, falling back to the CLI-local install; the failure message names both
+  locations searched.
+- Accept playwright's CJS export shape (`.default`) when loaded by file URL —
+  otherwise resolution succeeded but `chromium` was `undefined`.
 
 ## [0.51.2] — 2026-07-19