@aiaiai-pt/martha-cli 0.51.7 → 0.53.1

package/CHANGELOG.md

@@ -2,7 +2,91 @@
 
 All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to semver — `0.x` releases may include breaking changes between minor versions.
 
-## [Unreleased]
+## [0.53.1] — 2026-08-03
+
+### Fixed — `channels install-harness` told a Buzz-less machine to "launch Buzz once"
+
+- The command registers Martha as a runtime *inside* Buzz Desktop, so with no
+  Desktop on the machine there is nothing to register with. It correctly
+  refused and wrote nothing, but the remedy assumed the app was installed and
+  merely unopened. It now probes for the application itself and says which of
+  the two situations it is: **not installed** (with the release link, and a
+  pointer to `martha channels connect buzz`, which needs no Desktop at all) or
+  **installed but never launched** (open it once). Both still name the exact
+  app-data paths so `--app-data` stays actionable.
+
+## [0.53.0] — 2026-08-02
+
+### Added — `martha channels`: connect an agent to a channel from either side (#1140)
+
+- `martha channels install-harness buzz` registers Martha as a **runtime** in
+  Buzz Desktop — a tier-3 custom harness definition written into Desktop's
+  app-data dir (auto-detected per platform, release or dev build; `--print`,
+  `--app-data`, `--force`). The user then picks **Martha** in New agent and sets
+  `MARTHA_CLIENT_ID`/`MARTHA_CLIENT_SECRET` per agent in Edit Agent. Desktop
+  keeps ownership of the keypair, the NIP-OA attestation, spawning and channel
+  attachment; we contribute a definition and the adapter, nothing else. The
+  definition pins `BUZZ_ACP_MULTIPLE_EVENT_HANDLING=queue` — Desktop's `steer`
+  cancels the in-flight turn, which is right for a local LLM and wrong for a
+  remote Martha turn.
+- `martha channels connect buzz` and `martha channels preflight buzz` — the
+  same setup starting from Martha. Preflight checks every precondition (both
+  binaries, that the `martha` on PATH actually has `acp-serve`, API + credential,
+  agent existence/hosting/takeover, its principal, relay reachability, the
+  channel identity, and membership) and names the one command that fixes each
+  gap. It **exits non-zero rather than half-starting**, and reports a check it
+  could not evaluate as WARN rather than claiming the thing is missing.
+  `--emit docker|compose|k8s` prints a deployable unit with secrets referenced
+  instead of inlined; `--dry-run` shows the launch without starting it.
+
+### Fixed — a service-account invocation could run as a logged-in human
+
+- With `MARTHA_CLIENT_ID`/`MARTHA_CLIENT_SECRET` set, the CLI reused whatever
+  token was stored for the profile if it was still valid — including a human
+  token left by an earlier `martha auth login`. A long-running adapter then
+  answered as the developer instead of as its agent, and chat takeover never
+  fired. A stored token is now only reused when it belongs to the same client
+  (`auth_type` + the JWT's `azp`), which is what the documented auth precedence
+  always said. Found by running `martha channels connect` on a real relay.
+- `agents doctor` reported a correctly-bound agent as unbound on any tenant with
+  more than 25 clients: the client scan was capped at 25 and swallowed per-client
+  errors. The scan now walks the whole list (bounded, with concurrency) and says
+  "inconclusive" when it cannot read all of it — an incomplete scan can never
+  justify "no client grants this agent", which was advice to mint a second
+  principal for an agent that already had one.
+- A failed `client_credentials` login now raises an auth-typed error (exit 2)
+  instead of a generic one, so callers can tell "this credential is wrong" apart
+  from "the server is unreachable".
+
+### Added — `martha acp-serve`: ACP stdio bridge (#1117)
+
+- New `acp-serve` command speaks the Agent Client Protocol (newline-delimited
+  JSON-RPC 2.0) over stdio so an ACP harness — Buzz's `buzz-acp`, Zed, or any
+  ACP client — can drive a Martha agent as its runtime. `session/new` opens a
+  Martha chat session, `session/prompt` sends the user message and re-emits
+  Martha's SSE tokens as `session/update` agent_message_chunk notifications,
+  `session/cancel` aborts the in-flight turn (`stopReason: "cancelled"`).
+  Mid-session Martha errors surface as ACP error results without killing the
+  process; unrecoverable startup errors (bad token, unreachable API) exit
+  non-zero with a clear stderr line for the harness's circuit breaker. All
+  logging is JSON lines on stderr — stdout carries only protocol frames.
+- `--post-reply` (opt-in) posts the turn's final answer back to the triggering
+  Buzz channel via the `buzz` CLI — the same reply mechanism Buzz's own
+  agents use — parsing the channel and thread anchor from the prompt's
+  `[Context]` section. The shim itself never holds or signs with Nostr keys.
+- `martha principals bootstrap` — the CLI now exposes the API's own principal
+  noun (`/principals/bootstrap`, #535) with three modes: `human` (what
+  `martha init` wraps), `integration` (headless service account), and `agent`
+  — a service account bound to ONE Martha-hosted agent via chat takeover, so
+  the credential acts as the agent. Agent mode is the one-shot an external
+  ACP driver needs: resolve-or-create the agent, provision the principal
+  (idempotent — same label returns the same secret), bind, and print the
+  `MARTHA_CLIENT_ID/SECRET` + harness env block. The same orchestration ships
+  as a "Provision principal" action in the admin UI agents page. (Agent mode
+  is composed client-side in v1; a follow-up promotes it server-side.)
+- Fixed in review: `--api-url` now flows through `createContext` — mutating
+  `ctx.profile.api_url` after construction (the pattern elsewhere in the CLI)
+  never reaches the already-constructed API client.
 
 ## [0.51.5] — 2026-07-20