@aiaiai-pt/martha-cli 0.58.1 → 0.61.0

package/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to semver — `0.x` releases may include breaking changes between minor versions.
 
+## [0.61.0] — 2026-09-24
+
+### Added — `martha spend` and `martha budget` (#1107)
+
+- `martha spend [--tenant <id>] [--group-by day|agent|model|surface|billing_owner] [--since] [--until]`
+  reads a tenant's LLM spend from Martha's own ledger (`GET /api/admin/tenants/{t}/spend`).
+- `martha budget list|set|rm` manages per-tenant and per-AI-Agent LLM spend ceilings
+  (`warn`, `require_approval` — the run suspends until an ApprovalCase is approved — or `block`).
+
+Both default to your own tenant; another tenant needs super-admin (the API answers 403).
+
+### Fixed — commands that default to "your tenant" on realms that use Keycloak Organizations
+
+On realms that model tenants as Keycloak Organizations (ubiwhere.io) the access token carries
+an `organizations` claim and no `tenant_id`, so every command that defaults to the caller's
+tenant failed with `No tenant_id claim in access token`. The CLI now resolves the tenant exactly
+as the API does: `tenant_id`, else the first organization.
+
+## [0.60.0] — 2026-08-20
+
+### Added — `kind: ClientAccess`, so a declared workflow can also be authorized
+
+`definitions apply` could declare a Function, a Workflow, an Agent and a
+Trigger. It could not declare the GRANTS that let a principal call them —
+those existed only as `martha clients grant`. So anything that COMPILES a
+workflow installed the workflow without the authority to run it, and the gap
+only showed at run time as `Unknown function: <name>` on a function that is
+registered and active for the tenant.
+
+```yaml
+kind: ClientAccess
+name: martha-cli-zero        # client_key, name or id — what `martha clients` takes
+grants:
+  - { type: function, name: get_entity_entities_type_code_entity_id_get }
+  - { type: workflow, name: some_workflow }
+```
+
+Additive, like the rest of apply: a document that drops a grant does not revoke
+it. `ClientAccess` documents are applied LAST within a run, so one file can
+carry a workflow and the authority to run it in any order.
+
 ## [0.58.1] — 2026-08-04
 
 ### Fixed — provisioning called an existing agent blind when it wasn't

package/dist/index.js

@@ -5,43 +5,25 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
+        get: () => mod[key],
         enumerable: true
       });
-  if (canCache)
-    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: __exportSetter.bind(all, name)
+      set: (newValue) => all[name] = () => newValue
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -1019,7 +1001,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          }
+          } else {}
         };
       }
       return this;
@@ -10753,6 +10735,18 @@ function belongsToClient(tokens, clientId) {
   const azp = claims?.azp ?? claims?.client_id;
   return azp ? azp === clientId : true;
 }
+function tenantFromClaims(payload) {
+  const tid = payload.tenant_id;
+  if (typeof tid === "string" && tid)
+    return tid;
+  const orgs = payload.organizations;
+  if (orgs && typeof orgs === "object" && !Array.isArray(orgs)) {
+    const first = Object.keys(orgs)[0];
+    if (first)
+      return first;
+  }
+  return null;
+}
 function createContext(opts) {
   const config = loadConfig(opts.configDir);
   const profileName = opts.profileOverride ?? process.env.MARTHA_PROFILE ?? config.current_profile;
@@ -10811,10 +10805,9 @@ function createContext(opts) {
   });
   const getTenantId = async () => {
     const token = await getAccessToken();
-    const payload = decodeJwtPayload(token);
-    const tid = payload.tenant_id;
-    if (typeof tid !== "string" || !tid) {
-      throw new CLIError("No tenant_id claim in access token.", 2 /* Auth */);
+    const tid = tenantFromClaims(decodeJwtPayload(token));
+    if (!tid) {
+      throw new CLIError("No tenant_id or organizations claim in access token.", 2 /* Auth */);
     }
     return tid;
   };
@@ -11149,7 +11142,7 @@ init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.58.1";
+var CLI_VERSION = "0.61.0";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {
@@ -12831,9 +12824,16 @@ class BrowserSession {
 
 // src/lib/host-files.ts
 import { promises as fs6 } from "node:fs";
+import * as os3 from "node:os";
 import * as path5 from "node:path";
 var READ_CAP = 256 * 1024;
 function resolvePath(cwd, p) {
+  if (p === "~") {
+    return os3.homedir();
+  }
+  if (p.startsWith("~/")) {
+    return path5.join(os3.homedir(), p.slice(2));
+  }
   return path5.isAbsolute(p) ? p : path5.resolve(cwd, p);
 }
 async function applyFileAction(cwd, req) {
@@ -14787,8 +14787,8 @@ function registerPrincipalCommands(program2) {
 import { accessSync, constants, mkdirSync, writeFileSync } from "node:fs";
 import { existsSync } from "node:fs";
 import { execFile as execFile2, spawn as spawn3 } from "node:child_process";
-import { homedir } from "node:os";
-import { join as join3 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { join as join4 } from "node:path";
 init_errors();
 var AGENTS_PATH2 = "/api/admin/definitions/agents";
 var SUPPORTED_CHANNELS = ["buzz"];
@@ -14820,35 +14820,35 @@ function buzzAppDataCandidates(platform, env2, home) {
   ];
   const base = () => {
     if (platform === "darwin")
-      return join3(home, "Library", "Application Support");
+      return join4(home, "Library", "Application Support");
     if (platform === "win32")
-      return env2.APPDATA ?? join3(home, "AppData", "Roaming");
-    return env2.XDG_DATA_HOME ?? join3(home, ".local", "share");
+      return env2.APPDATA ?? join4(home, "AppData", "Roaming");
+    return env2.XDG_DATA_HOME ?? join4(home, ".local", "share");
   };
   const root = base();
-  return ids.map(({ build, id }) => ({ build, dir: join3(root, id) }));
+  return ids.map(({ build, id }) => ({ build, dir: join4(root, id) }));
 }
 function chooseAppDataDir(candidates, exists) {
   return candidates.find((c) => exists(c.dir)) ?? null;
 }
 function buzzAppCandidates(platform, env2, home) {
   if (platform === "darwin") {
-    return ["/Applications/Buzz.app", join3(home, "Applications", "Buzz.app")];
+    return ["/Applications/Buzz.app", join4(home, "Applications", "Buzz.app")];
   }
   if (platform === "win32") {
-    const base = env2.LOCALAPPDATA ?? join3(home, "AppData", "Local");
-    return [join3(base, "Programs", "Buzz")];
+    const base = env2.LOCALAPPDATA ?? join4(home, "AppData", "Local");
+    return [join4(base, "Programs", "Buzz")];
   }
   return [
     "/opt/Buzz",
     "/usr/bin/buzz-desktop",
-    join3(home, ".local", "bin", "buzz-desktop")
+    join4(home, ".local", "bin", "buzz-desktop")
   ];
 }
 var BUZZ_RELEASES_URL = "https://github.com/block/buzz/releases/latest";
 function buzzSidecarDirs(platform, env2, home) {
   if (platform === "darwin") {
-    return buzzAppCandidates(platform, env2, home).map((app) => join3(app, "Contents", "MacOS"));
+    return buzzAppCandidates(platform, env2, home).map((app) => join4(app, "Contents", "MacOS"));
   }
   if (platform === "win32") {
     return buzzAppCandidates(platform, env2, home);
@@ -14862,7 +14862,7 @@ function resolveBuzzBinary(bin, opts) {
   if (bin.includes("/") || bin.includes("\\"))
     return null;
   for (const dir of buzzSidecarDirs(opts.platform, opts.env, opts.home)) {
-    const candidate = join3(dir, bin);
+    const candidate = join4(dir, bin);
     if (opts.isExecutable(candidate))
       return { path: candidate, source: "desktop" };
   }
@@ -14910,7 +14910,7 @@ function resolveOnPath(bin, env2, platform, isExecutable) {
   const sep = platform === "win32" ? ";" : ":";
   for (const dir of (env2.PATH ?? "").split(sep).filter(Boolean)) {
     for (const ext of exts) {
-      const candidate = join3(dir, bin + ext);
+      const candidate = join4(dir, bin + ext);
       if (isExecutable(candidate))
         return candidate;
     }
@@ -14932,7 +14932,7 @@ function whichBuzz(bin) {
   return resolveBuzzBinary(bin, {
     platform: process.platform,
     env: process.env,
-    home: homedir(),
+    home: homedir2(),
     isExecutable: executableOnDisk
   });
 }
@@ -15248,14 +15248,14 @@ function registerChannelCommands(program2) {
       console.log(json);
       return;
     }
-    const chosen = opts.appData ? { build: "release", dir: String(opts.appData) } : chooseAppDataDir(buzzAppDataCandidates(process.platform, process.env, homedir()), (d) => existsSync(d));
+    const chosen = opts.appData ? { build: "release", dir: String(opts.appData) } : chooseAppDataDir(buzzAppDataCandidates(process.platform, process.env, homedir2()), (d) => existsSync(d));
     if (!chosen) {
-      const candidates = buzzAppDataCandidates(process.platform, process.env, homedir());
-      const appInstalled = buzzAppCandidates(process.platform, process.env, homedir()).some((p) => existsSync(p));
+      const candidates = buzzAppDataCandidates(process.platform, process.env, homedir2());
+      const appInstalled = buzzAppCandidates(process.platform, process.env, homedir2()).some((p) => existsSync(p));
       throw new CLIError(appInstalled ? "Buzz Desktop has no data directory yet." : "Buzz Desktop is not installed.", 3 /* NotFound */, missingAppDataMessage(candidates, appInstalled));
     }
-    const dir = join3(chosen.dir, "custom_harnesses");
-    const file = join3(dir, `${def.id}.json`);
+    const dir = join4(chosen.dir, "custom_harnesses");
+    const file = join4(dir, `${def.id}.json`);
     if (existsSync(file) && !opts.force) {
       throw new CLIError(`${file} already exists.`, 5 /* Conflict */, "Re-run with --force to overwrite it.");
     }
@@ -15326,7 +15326,7 @@ function registerChannelCommands(program2) {
     }
     const acp = whichBuzz(opts.buzzAcpBin);
     const childPath = [
-      ...buzzSidecarDirs(process.platform, process.env, homedir()).filter((d) => existsSync(d)),
+      ...buzzSidecarDirs(process.platform, process.env, homedir2()).filter((d) => existsSync(d)),
       process.env.PATH ?? ""
     ].filter(Boolean).join(process.platform === "win32" ? ";" : ":");
     if (opts.dryRun) {
@@ -15767,6 +15767,7 @@ function registerConfigCommand(program2) {
 }
 
 // src/commands/definitions-apply.ts
+import { createHash as createHash3 } from "node:crypto";
 import fs8 from "node:fs";
 import path8 from "node:path";
 init_dist();
@@ -15988,16 +15989,19 @@ var VALID_KINDS = new Set([
   "Function",
   "Workflow",
   "Agent",
-  "Trigger"
+  "Trigger",
+  "ClientAccess"
 ]);
 var KIND_TO_API_PATH = {
   Function: "/api/admin/definitions/functions",
   Workflow: "/api/admin/definitions/workflows",
   Agent: "/api/admin/definitions/agents",
-  Trigger: "/api/admin/triggers"
+  Trigger: "/api/admin/triggers",
+  ClientAccess: "/api/admin/definitions/client-access"
 };
 var KIND_TO_PLURAL = {
   Function: "Functions",
+  ClientAccess: "Client access",
   Workflow: "Workflows",
   Agent: "Agents",
   Trigger: "Triggers"
@@ -16246,10 +16250,18 @@ function localSubsetOf(local, remote) {
   if (typeof local === "object") {
     const lObj = local;
     const rObj = remote;
-    return Object.keys(lObj).every((key) => localSubsetOf(lObj[key], rObj[key]));
+    return Object.keys(lObj).every((key) => {
+      if (key === "value" && typeof lObj.value === "string" && typeof rObj.value_sha256 === "string" && (rObj.value === null || rObj.value === undefined)) {
+        return sha256Prefix(lObj.value) === rObj.value_sha256;
+      }
+      return localSubsetOf(lObj[key], rObj[key]);
+    });
   }
   return false;
 }
+function sha256Prefix(value) {
+  return createHash3("sha256").update(value, "utf8").digest("hex").slice(0, 16);
+}
 var SYMBOLS = {
   create: "+",
   update: "~",
@@ -16272,7 +16284,8 @@ function renderPlan(ops) {
     "Function",
     "Workflow",
     "Agent",
-    "Trigger"
+    "Trigger",
+    "ClientAccess"
   ]) {
     const kindOps = grouped.get(kind);
     if (!kindOps)
@@ -16321,6 +16334,7 @@ async function executeApply(api, ops, defs, warnings) {
     defsByKey.set(`${d.kind}:${d.name}`, d);
   }
   const results = [];
+  ops = [...ops].sort((a, b) => (a.kind === "ClientAccess" ? 1 : 0) - (b.kind === "ClientAccess" ? 1 : 0));
   for (const op of ops) {
     if (op.action === "skip") {
       results.push({ name: op.name, kind: op.kind, action: "skipped" });
@@ -19238,11 +19252,11 @@ ${items.length} task(s) available`));
 }
 
 // src/commands/runner.ts
-import os3 from "node:os";
+import os4 from "node:os";
 init_errors();
 function hostLabel() {
   try {
-    return os3.hostname() || undefined;
+    return os4.hostname() || undefined;
   } catch {
     return;
   }
@@ -21626,6 +21640,129 @@ ${models.length} models`));
   });
 }
 
+// src/commands/spend.ts
+init_errors();
+var GROUPINGS = ["day", "agent", "model", "surface", "billing_owner"];
+function usd(value) {
+  return value == null ? "-" : `$${Number(value).toFixed(4)}`;
+}
+function registerSpendCommand(program2) {
+  program2.command("spend").description("LLM spend for a tenant, from Martha's own ledger").option("--tenant <id>", "Tenant (defaults to your own; others need super-admin)").option("--group-by <dim>", `One of: ${GROUPINGS.join(", ")}`, "day").option("--since <YYYY-MM-DD>", "Inclusive UTC start day").option("--until <YYYY-MM-DD>", "Exclusive UTC end day").action(async (opts) => {
+    const ctx = createContext({
+      profileOverride: program2.opts().profile,
+      verbose: program2.opts().verbose
+    });
+    if (program2.opts().apiUrl) {
+      ctx.profile.api_url = program2.opts().apiUrl;
+    }
+    const isJson = !!program2.opts().json;
+    if (!GROUPINGS.includes(opts.groupBy)) {
+      throw new CLIError(`--group-by must be one of: ${GROUPINGS.join(", ")}`, 4 /* Validation */);
+    }
+    const tenant = opts.tenant ?? await ctx.getTenantId();
+    const params = new URLSearchParams({ group_by: opts.groupBy });
+    if (opts.since)
+      params.set("since", opts.since);
+    if (opts.until)
+      params.set("until", opts.until);
+    const data = await ctx.api.get(`/api/admin/tenants/${encodeURIComponent(tenant)}/spend?${params.toString()}`);
+    if (isJson) {
+      console.log(JSON.stringify(data, null, 2));
+      return;
+    }
+    if (data.rows.length === 0) {
+      console.log(source_default.dim(`No LLM spend recorded for ${data.tenant_id}.`));
+      return;
+    }
+    const cols = [
+      { header: data.group_by.toUpperCase(), accessor: (r) => r.key ?? "-" },
+      { header: "CALLS", accessor: (r) => String(r.calls) },
+      { header: "PROMPT", accessor: (r) => String(r.prompt_tokens) },
+      { header: "COMPLETION", accessor: (r) => String(r.completion_tokens) },
+      { header: "CACHE READ", accessor: (r) => String(r.cache_read_tokens) },
+      { header: "CACHE WRITE", accessor: (r) => String(r.cache_write_tokens) },
+      { header: "COST", accessor: (r) => usd(r.cost_usd) },
+      { header: "UNPRICED", accessor: (r) => String(r.unpriced_calls) }
+    ];
+    const widths = cols.map((col) => Math.max(col.header.length, ...data.rows.map((r) => col.accessor(r).length)));
+    const header = cols.map((col, i) => col.header.padEnd(widths[i])).join("  ");
+    console.log(source_default.bold(header));
+    console.log(source_default.dim("-".repeat(header.length)));
+    for (const row of data.rows) {
+      console.log(cols.map((col, i) => col.accessor(row).padEnd(widths[i])).join("  "));
+    }
+    const t = data.totals;
+    console.log(source_default.dim(`
+${data.tenant_id}: ${t.calls} calls, ${usd(t.cost_usd)}` + (t.unpriced_calls ? `, ${t.unpriced_calls} unpriced (not included in cost)` : "")));
+  });
+}
+
+// src/commands/budget.ts
+init_errors();
+var PERIODS = ["day", "month"];
+var ACTIONS = ["warn", "require_approval", "block"];
+function oneOf(value, allowed, flag) {
+  if (!allowed.includes(value)) {
+    throw new CLIError(`${flag} must be one of: ${allowed.join(", ")}`, 4 /* Validation */);
+  }
+}
+function registerBudgetCommands(program2) {
+  const budget = program2.command("budget").description("LLM spend ceilings for a tenant");
+  const context = () => {
+    const ctx = createContext({
+      profileOverride: program2.opts().profile,
+      verbose: program2.opts().verbose
+    });
+    if (program2.opts().apiUrl)
+      ctx.profile.api_url = program2.opts().apiUrl;
+    return ctx;
+  };
+  const path9 = async (ctx, tenant) => `/api/admin/tenants/${encodeURIComponent(tenant ?? await ctx.getTenantId())}/llm-budgets`;
+  budget.command("list").description("List the tenant's ceilings").option("--tenant <id>", "Tenant (defaults to your own)").action(async (opts) => {
+    const ctx = context();
+    const data = await ctx.api.get(await path9(ctx, opts.tenant));
+    if (program2.opts().json) {
+      console.log(JSON.stringify(data, null, 2));
+      return;
+    }
+    if (data.budgets.length === 0) {
+      console.log(source_default.dim(`No LLM spend ceilings for ${data.tenant_id}.`));
+      return;
+    }
+    for (const b of data.budgets) {
+      const scope = b.agent_id ? `agent ${b.agent_id}` : "tenant";
+      console.log(`${b.id}  ${scope.padEnd(42)} ${b.period.padEnd(6)} $${b.limit_usd}  ${b.action}`);
+    }
+  });
+  budget.command("set").description("Create or replace a ceiling (one per tenant-or-agent + period)").requiredOption("--period <p>", `One of: ${PERIODS.join(", ")}`).requiredOption("--limit <usd>", "Ceiling in USD (cache reads included)").requiredOption("--action <a>", `One of: ${ACTIONS.join(", ")}`).option("--agent <uuid>", "Scope to one AI Agent (default: whole tenant)").option("--note <text>", "Why this ceiling exists").option("--tenant <id>", "Tenant (defaults to your own)").action(async (opts) => {
+    oneOf(opts.period, PERIODS, "--period");
+    oneOf(opts.action, ACTIONS, "--action");
+    if (!/^\d+(\.\d{1,4})?$/.test(opts.limit)) {
+      throw new CLIError("--limit must be a non-negative USD amount", 4 /* Validation */);
+    }
+    const ctx = context();
+    const saved = await ctx.api.put(await path9(ctx, opts.tenant), {
+      period: opts.period,
+      limit_usd: opts.limit,
+      action: opts.action,
+      agent_id: opts.agent ?? null,
+      note: opts.note ?? null
+    });
+    if (program2.opts().json)
+      console.log(JSON.stringify(saved, null, 2));
+    else
+      console.log(`${saved.id}  ${saved.period} $${saved.limit_usd} -> ${saved.action}`);
+  });
+  budget.command("rm <budgetId>").description("Delete a ceiling").option("--tenant <id>", "Tenant (defaults to your own)").action(async (budgetId, opts) => {
+    const ctx = context();
+    await ctx.api.del(`${await path9(ctx, opts.tenant)}/${encodeURIComponent(budgetId)}`);
+    if (program2.opts().json)
+      console.log(JSON.stringify({ deleted: budgetId }));
+    else
+      console.log(`deleted ${budgetId}`);
+  });
+}
+
 // src/commands/wiki.ts
 import fs11 from "node:fs";
 init_errors();
@@ -22481,7 +22618,7 @@ async function resolveCredentialFlag(value) {
 
 // src/commands/policy.ts
 init_errors();
-var ACTIONS = ["allow", "require_approval", "block"];
+var ACTIONS2 = ["allow", "require_approval", "block"];
 var KINDS2 = ["risk_tag", "risk_level", "capability"];
 var SCOPES = ["any", "agent", "client"];
 var truncate4 = (s, n) => s.length > n ? s.slice(0, n - 1) + "…" : s;
@@ -22551,8 +22688,8 @@ function registerPolicyCommands(program2) {
       console.log(columns.map((c, i) => c.get(r).padEnd(widths[i])).join("  "));
     }
   });
-  cmd.command("set-default <action>").description(`Set the opt-in default action (${ACTIONS.join("|")})`).action(async (action) => {
-    assertOneOf(action, ACTIONS, "action");
+  cmd.command("set-default <action>").description(`Set the opt-in default action (${ACTIONS2.join("|")})`).action(async (action) => {
+    assertOneOf(action, ACTIONS2, "action");
     const ctx = getCtx();
     const res = await ctx.api.put("/api/admin/policy/settings", { default_action: action });
     if (isJson()) {
@@ -22576,9 +22713,9 @@ function registerPolicyCommands(program2) {
     console.log(`Safe-default bundle ${enabled ? source_default.yellow("enabled") : source_default.dim("disabled")}.`);
   });
   const rule = cmd.command("rule").description("Manage explicit policy rules");
-  rule.command("add").description("Create or update a rule").requiredOption(`--kind <kind>`, `Match kind (${KINDS2.join("|")})`).requiredOption("--value <value>", "Match value (a risk tag, level, or capability ref)").requiredOption(`--action <action>`, `Action (${ACTIONS.join("|")})`).option(`--scope <scope>`, `Principal scope (${SCOPES.join("|")})`, "any").option("--note <text>", "Optional human note").action(async (opts) => {
+  rule.command("add").description("Create or update a rule").requiredOption(`--kind <kind>`, `Match kind (${KINDS2.join("|")})`).requiredOption("--value <value>", "Match value (a risk tag, level, or capability ref)").requiredOption(`--action <action>`, `Action (${ACTIONS2.join("|")})`).option(`--scope <scope>`, `Principal scope (${SCOPES.join("|")})`, "any").option("--note <text>", "Optional human note").action(async (opts) => {
     assertOneOf(opts.kind, KINDS2, "--kind");
-    assertOneOf(opts.action, ACTIONS, "--action");
+    assertOneOf(opts.action, ACTIONS2, "--action");
     assertOneOf(opts.scope, SCOPES, "--scope");
     const ctx = getCtx();
     const res = await ctx.api.post("/api/admin/policy/rules", {
@@ -22609,6 +22746,7 @@ function registerPolicyCommands(program2) {
 import { readFileSync as readFileSync3 } from "node:fs";
 init_errors();
 var BASE = "/api/admin/agent-step/trust-roots";
+var FLEET_BASE = "/api/admin/agent-step/fleet";
 function resolveKeyMaterial(value) {
   if (value.startsWith("@")) {
     const path9 = value.slice(1);
@@ -22722,6 +22860,69 @@ function registerAgentStepCommands(program2) {
     console.log(source_default.green(`Rotated trust root '${tr.name}'`));
     printOne(tr);
   });
+  const fleet = cmd.command("fleet").description("Pause / resume this tenant's agent_step fleet (#1041)");
+  function printFleet(s) {
+    const state = s.effective_paused ? source_default.red(`PAUSED (${s.effective_scope})`) : source_default.green("running");
+    console.log(`agent_step fleet: ${source_default.bold(state)}`);
+    if (s.effective_reason)
+      console.log(`  Reason:     ${s.effective_reason}`);
+    if (s.paused_by)
+      console.log(`  Paused by:  ${s.paused_by}`);
+    if (s.paused_at)
+      console.log(`  Paused at:  ${s.paused_at}`);
+    if (s.paused_workflows.length) {
+      console.log(`  Quarantined workflows: ${s.paused_workflows.join(", ")}`);
+    }
+    if (s.global_paused) {
+      console.log(source_default.yellow(`  NOTE: the PLATFORM-wide break-glass flag is set — every tenant is halted,
+` + "        and resuming this tenant will not restart work until it is cleared."));
+    }
+  }
+  fleet.command("status").description("Show whether agent_step work is currently halted").action(async () => {
+    const ctx = getCtx();
+    const s = await ctx.api.get(FLEET_BASE);
+    if (isJson()) {
+      console.log(JSON.stringify(s, null, 2));
+      return;
+    }
+    printFleet(s);
+  });
+  fleet.command("pause").description("Halt all agent_step runs for this tenant (in-flight steps drain)").requiredOption("-r, --reason <text>", "Why you are stopping the fleet — recorded in the audit log and shown on stopped runs").action(async (opts) => {
+    const ctx = getCtx();
+    const s = await ctx.api.put(FLEET_BASE, {
+      paused: true,
+      reason: opts.reason
+    });
+    if (isJson()) {
+      console.log(JSON.stringify(s, null, 2));
+      return;
+    }
+    console.log(source_default.yellow(`Fleet paused. No new agent_step will start; in-flight steps finish their
+` + "current attempt and then stop instead of retrying."));
+    printFleet(s);
+  });
+  fleet.command("resume").description("Allow agent_step runs for this tenant again").action(async () => {
+    const ctx = getCtx();
+    const s = await ctx.api.put(FLEET_BASE, { paused: false });
+    if (isJson()) {
+      console.log(JSON.stringify(s, null, 2));
+      return;
+    }
+    console.log(source_default.green("Fleet resumed."));
+    printFleet(s);
+  });
+  fleet.command("quarantine [workflows...]").description("Halt only the named workflows (pass none to clear the quarantine list)").action(async (workflows) => {
+    const ctx = getCtx();
+    const s = await ctx.api.put(FLEET_BASE, {
+      paused_workflows: workflows ?? []
+    });
+    if (isJson()) {
+      console.log(JSON.stringify(s, null, 2));
+      return;
+    }
+    console.log(workflows?.length ? source_default.yellow(`Quarantined: ${workflows.join(", ")}`) : source_default.green("Quarantine cleared."));
+    printFleet(s);
+  });
 }
 
 // src/commands/authz.ts
@@ -24142,6 +24343,8 @@ registerNotificationCommands(program2);
 registerMessagingCommands(program2);
 registerClientCommands(program2);
 registerModelsCommand(program2);
+registerSpendCommand(program2);
+registerBudgetCommands(program2);
 registerSessionCommands(program2);
 registerMCPCommands(program2);
 registerPolicyCommands(program2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiaiai-pt/martha-cli",
-  "version": "0.58.1",
+  "version": "0.61.0",
   "description": "Terminal-first client for the Martha AI platform",
   "homepage": "https://docs.martha.nomadriver.co",
   "repository": {