@aiaiai-pt/martha-cli 0.58.1 → 0.61.1

package/CHANGELOG.md

@@ -2,6 +2,72 @@
 
 All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to semver — `0.x` releases may include breaking changes between minor versions.
 
+## [0.61.1] — 2026-09-25
+
+### Fixed — carries 0.60.2's redirect fix onto the 0.61 line
+
+`main` shipped the same-host redirect fix as 0.60.2 while `uio` released 0.61.0
+the same day; the main → uio sync brings that fix into the 0.61 line. No other
+change: `martha triggers list/create` and `definitions apply` of a `kind: Trigger`
+no longer read as "Not authenticated" behind the TLS proxy (see 0.60.2 below).
+
+## [0.61.0] — 2026-09-24
+
+### Added — `martha spend` and `martha budget` (#1107)
+
+- `martha spend [--tenant <id>] [--group-by day|agent|model|surface|billing_owner] [--since] [--until]`
+  reads a tenant's LLM spend from Martha's own ledger (`GET /api/admin/tenants/{t}/spend`).
+- `martha budget list|set|rm` manages per-tenant and per-AI-Agent LLM spend ceilings
+  (`warn`, `require_approval` — the run suspends until an ApprovalCase is approved — or `block`).
+
+Both default to your own tenant; another tenant needs super-admin (the API answers 403).
+
+### Fixed — commands that default to "your tenant" on realms that use Keycloak Organizations
+
+On realms that model tenants as Keycloak Organizations (ubiwhere.io) the access token carries
+an `organizations` claim and no `tenant_id`, so every command that defaults to the caller's
+tenant failed with `No tenant_id claim in access token`. The CLI now resolves the tenant exactly
+as the API does: `tenant_id`, else the first organization.
+
+## [0.60.2] — 2026-09-24
+
+### Fixed — a redirect no longer turns an authenticated request into "Not authenticated"
+
+`martha triggers list`, `triggers create` and `definitions apply` of a
+`kind: Trigger` all failed with `Not authenticated` for a logged-in user. The
+API answers `POST /api/admin/triggers` (no trailing slash) with
+`307 → http://<host>/api/admin/triggers/` — a scheme downgrade behind the TLS
+proxy. `fetch` followed it cross-origin and dropped `Authorization`, so the API
+saw no token. Measured on martha.nomadriver.co, 2026-09-24.
+
+Every request now handles redirects itself (`redirect: "manual"`): same host
+only, always on the original scheme, at most 3 hops; 307/308 keep method and
+body. A redirect to any other host is refused with a clear error and the
+bearer token is never sent there.
+
+## [0.60.0] — 2026-08-20
+
+### Added — `kind: ClientAccess`, so a declared workflow can also be authorized
+
+`definitions apply` could declare a Function, a Workflow, an Agent and a
+Trigger. It could not declare the GRANTS that let a principal call them —
+those existed only as `martha clients grant`. So anything that COMPILES a
+workflow installed the workflow without the authority to run it, and the gap
+only showed at run time as `Unknown function: <name>` on a function that is
+registered and active for the tenant.
+
+```yaml
+kind: ClientAccess
+name: martha-cli-zero        # client_key, name or id — what `martha clients` takes
+grants:
+  - { type: function, name: get_entity_entities_type_code_entity_id_get }
+  - { type: workflow, name: some_workflow }
+```
+
+Additive, like the rest of apply: a document that drops a grant does not revoke
+it. `ClientAccess` documents are applied LAST within a run, so one file can
+carry a workflow and the authority to run it in any order.
+
 ## [0.58.1] — 2026-08-04
 
 ### Fixed — provisioning called an existing agent blind when it wasn't

package/dist/index.js

@@ -5,43 +5,25 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
+        get: () => mod[key],
         enumerable: true
       });
-  if (canCache)
-    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: __exportSetter.bind(all, name)
+      set: (newValue) => all[name] = () => newValue
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -1019,7 +1001,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          }
+          } else {}
         };
       }
       return this;
@@ -3546,6 +3528,7 @@ var require_stringify = __commonJS((exports) => {
       nullStr: "null",
       simpleKeys: false,
       singleQuote: null,
+      trailingComma: false,
       trueStr: "true",
       verifyAliasOrder: true
     }, doc.schema.toStringOptions, options);
@@ -4054,13 +4037,20 @@ ${indent}${line}` : `
       if (comment)
         reqNewline = true;
       let str = stringify.stringify(item, itemCtx, () => comment = null);
-      if (i < items.length - 1)
+      reqNewline || (reqNewline = lines.length > linesAtValue || str.includes(`
+`));
+      if (i < items.length - 1) {
         str += ",";
+      } else if (ctx.options.trailingComma) {
+        if (ctx.options.lineWidth > 0) {
+          reqNewline || (reqNewline = lines.reduce((sum, line) => sum + line.length + 2, 2) + (str.length + 2) > ctx.options.lineWidth);
+        }
+        if (reqNewline) {
+          str += ",";
+        }
+      }
       if (comment)
         str += stringifyComment.lineComment(str, itemIndent, commentString(comment));
-      if (!reqNewline && (lines.length > linesAtValue || str.includes(`
-`)))
-        reqNewline = true;
       lines.push(str);
       linesAtValue = lines.length;
     }
@@ -6855,17 +6845,22 @@ var require_compose_node = __commonJS((exports) => {
       case "block-map":
       case "block-seq":
       case "flow-collection":
-        node = composeCollection.composeCollection(CN, ctx, token, props, onError);
-        if (anchor)
-          node.anchor = anchor.source.substring(1);
+        try {
+          node = composeCollection.composeCollection(CN, ctx, token, props, onError);
+          if (anchor)
+            node.anchor = anchor.source.substring(1);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          onError(token, "RESOURCE_EXHAUSTION", message);
+        }
         break;
       default: {
         const message = token.type === "error" ? token.message : `Unsupported token (type: ${token.type})`;
         onError(token, "UNEXPECTED_TOKEN", message);
-        node = composeEmptyNode(ctx, token.offset, undefined, null, props, onError);
         isSrcToken = false;
       }
     }
+    node ?? (node = composeEmptyNode(ctx, token.offset, undefined, null, props, onError));
     if (anchor && node.anchor === "")
       onError(anchor, "BAD_ALIAS", "Anchor cannot be an empty string");
     if (atKey && ctx.options.stringKeys && (!identity.isScalar(node) || typeof node.value !== "string" || node.tag && node.tag !== "tag:yaml.org,2002:str")) {
@@ -9526,6 +9521,7 @@ function parseDataLine(data) {
 // src/lib/api-client.ts
 var exports_api_client = {};
 __export(exports_api_client, {
+  sameHostRedirect: () => sameHostRedirect,
   MarthaAPIClient: () => MarthaAPIClient
 });
 import fs3 from "node:fs";
@@ -9534,6 +9530,33 @@ function guessMimeType(filename) {
   const ext = nodePath.extname(filename).toLowerCase();
   return MIME_TYPES[ext] ?? "application/octet-stream";
 }
+function isRedirect(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function sameHostRedirect(from, location) {
+  if (!location)
+    return null;
+  const origin = new URL(from);
+  let next;
+  try {
+    next = new URL(location, origin);
+  } catch {
+    return null;
+  }
+  if (next.hostname !== origin.hostname)
+    return null;
+  const port = (u) => u.port || (u.protocol === "https:" ? "443" : "80");
+  if (next.protocol !== origin.protocol) {
+    if (port(next) !== (next.protocol === "https:" ? "443" : "80") || port(origin) !== (origin.protocol === "https:" ? "443" : "80")) {
+      return null;
+    }
+    next.protocol = origin.protocol;
+    next.port = origin.port;
+  } else if (port(next) !== port(origin)) {
+    return null;
+  }
+  return next.toString();
+}
 
 class MarthaAPIClient {
   baseUrl;
@@ -9551,6 +9574,27 @@ class MarthaAPIClient {
       process.stderr.write(`[DEBUG] ${msg}
 `);
   }
+  async fetchSameHost(url, init) {
+    let target = url;
+    let current = { ...init, redirect: "manual" };
+    let res = await fetch(target, current);
+    for (let hop = 0;isRedirect(res.status); hop++) {
+      const location = res.headers.get("location");
+      const next = sameHostRedirect(target, location);
+      if (!next || hop >= MAX_REDIRECTS) {
+        throw new CLIError(next ? `Too many redirects (${MAX_REDIRECTS}) from ${url}` : `Refused redirect from ${target} to ${location ?? "(no Location)"} — ` + "the credential is only ever sent to the configured API host", 1 /* Error */, "Check the profile's api_url; the server may be missing a trailing-slash route or proxy headers.");
+      }
+      if (res.status !== 307 && res.status !== 308 && current.method !== "GET" && current.method !== "HEAD") {
+        const headers = { ...current.headers };
+        delete headers["Content-Type"];
+        current = { ...current, method: "GET", body: undefined, headers };
+      }
+      this.log(`  → ${res.status} redirect to ${next}`);
+      target = next;
+      res = await fetch(target, current);
+    }
+    return res;
+  }
   async get(path3, opts) {
     return this.request("GET", path3, opts);
   }
@@ -9578,7 +9622,7 @@ class MarthaAPIClient {
     formData.append("file", blob, fileName);
     let res;
     try {
-      res = await fetch(url, {
+      res = await this.fetchSameHost(url, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${token}`,
@@ -9608,7 +9652,7 @@ class MarthaAPIClient {
     const timeout = opts?.timeout ?? this.defaultTimeout;
     let res;
     try {
-      res = await fetch(url, {
+      res = await this.fetchSameHost(url, {
         method: "GET",
         headers: {
           Authorization: `Bearer ${token}`,
@@ -9637,7 +9681,7 @@ class MarthaAPIClient {
     const timeout = opts?.timeout ?? 120000;
     let res;
     try {
-      res = await fetch(url, {
+      res = await this.fetchSameHost(url, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${token}`,
@@ -9666,7 +9710,7 @@ class MarthaAPIClient {
     const token = await this.getAccessToken();
     const url = this.buildUrl(path3, opts?.params);
     const timeout = opts?.timeout ?? 120000;
-    const res = await fetch(url, {
+    const res = await this.fetchSameHost(url, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${token}`,
@@ -9700,7 +9744,7 @@ class MarthaAPIClient {
       if (opts?.body !== undefined)
         this.log(`  body: ${JSON.stringify(opts.body).slice(0, 500)}`);
       try {
-        return await fetch(url, {
+        return await this.fetchSameHost(url, {
           method,
           headers,
           body: opts?.body !== undefined ? JSON.stringify(opts.body) : undefined,
@@ -9748,7 +9792,7 @@ class MarthaAPIClient {
     return url.toString();
   }
 }
-var MIME_TYPES;
+var MIME_TYPES, MAX_REDIRECTS = 3;
 var init_api_client = __esm(() => {
   init_errors();
   MIME_TYPES = {
@@ -10753,6 +10797,18 @@ function belongsToClient(tokens, clientId) {
   const azp = claims?.azp ?? claims?.client_id;
   return azp ? azp === clientId : true;
 }
+function tenantFromClaims(payload) {
+  const tid = payload.tenant_id;
+  if (typeof tid === "string" && tid)
+    return tid;
+  const orgs = payload.organizations;
+  if (orgs && typeof orgs === "object" && !Array.isArray(orgs)) {
+    const first = Object.keys(orgs)[0];
+    if (first)
+      return first;
+  }
+  return null;
+}
 function createContext(opts) {
   const config = loadConfig(opts.configDir);
   const profileName = opts.profileOverride ?? process.env.MARTHA_PROFILE ?? config.current_profile;
@@ -10811,10 +10867,9 @@ function createContext(opts) {
   });
   const getTenantId = async () => {
     const token = await getAccessToken();
-    const payload = decodeJwtPayload(token);
-    const tid = payload.tenant_id;
-    if (typeof tid !== "string" || !tid) {
-      throw new CLIError("No tenant_id claim in access token.", 2 /* Auth */);
+    const tid = tenantFromClaims(decodeJwtPayload(token));
+    if (!tid) {
+      throw new CLIError("No tenant_id or organizations claim in access token.", 2 /* Auth */);
     }
     return tid;
   };
@@ -11149,7 +11204,7 @@ init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.58.1";
+var CLI_VERSION = "0.61.1";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {
@@ -12831,9 +12886,16 @@ class BrowserSession {
 
 // src/lib/host-files.ts
 import { promises as fs6 } from "node:fs";
+import * as os3 from "node:os";
 import * as path5 from "node:path";
 var READ_CAP = 256 * 1024;
 function resolvePath(cwd, p) {
+  if (p === "~") {
+    return os3.homedir();
+  }
+  if (p.startsWith("~/")) {
+    return path5.join(os3.homedir(), p.slice(2));
+  }
   return path5.isAbsolute(p) ? p : path5.resolve(cwd, p);
 }
 async function applyFileAction(cwd, req) {
@@ -14787,8 +14849,8 @@ function registerPrincipalCommands(program2) {
 import { accessSync, constants, mkdirSync, writeFileSync } from "node:fs";
 import { existsSync } from "node:fs";
 import { execFile as execFile2, spawn as spawn3 } from "node:child_process";
-import { homedir } from "node:os";
-import { join as join3 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { join as join4 } from "node:path";
 init_errors();
 var AGENTS_PATH2 = "/api/admin/definitions/agents";
 var SUPPORTED_CHANNELS = ["buzz"];
@@ -14820,35 +14882,35 @@ function buzzAppDataCandidates(platform, env2, home) {
   ];
   const base = () => {
     if (platform === "darwin")
-      return join3(home, "Library", "Application Support");
+      return join4(home, "Library", "Application Support");
     if (platform === "win32")
-      return env2.APPDATA ?? join3(home, "AppData", "Roaming");
-    return env2.XDG_DATA_HOME ?? join3(home, ".local", "share");
+      return env2.APPDATA ?? join4(home, "AppData", "Roaming");
+    return env2.XDG_DATA_HOME ?? join4(home, ".local", "share");
   };
   const root = base();
-  return ids.map(({ build, id }) => ({ build, dir: join3(root, id) }));
+  return ids.map(({ build, id }) => ({ build, dir: join4(root, id) }));
 }
 function chooseAppDataDir(candidates, exists) {
   return candidates.find((c) => exists(c.dir)) ?? null;
 }
 function buzzAppCandidates(platform, env2, home) {
   if (platform === "darwin") {
-    return ["/Applications/Buzz.app", join3(home, "Applications", "Buzz.app")];
+    return ["/Applications/Buzz.app", join4(home, "Applications", "Buzz.app")];
   }
   if (platform === "win32") {
-    const base = env2.LOCALAPPDATA ?? join3(home, "AppData", "Local");
-    return [join3(base, "Programs", "Buzz")];
+    const base = env2.LOCALAPPDATA ?? join4(home, "AppData", "Local");
+    return [join4(base, "Programs", "Buzz")];
   }
   return [
     "/opt/Buzz",
     "/usr/bin/buzz-desktop",
-    join3(home, ".local", "bin", "buzz-desktop")
+    join4(home, ".local", "bin", "buzz-desktop")
   ];
 }
 var BUZZ_RELEASES_URL = "https://github.com/block/buzz/releases/latest";
 function buzzSidecarDirs(platform, env2, home) {
   if (platform === "darwin") {
-    return buzzAppCandidates(platform, env2, home).map((app) => join3(app, "Contents", "MacOS"));
+    return buzzAppCandidates(platform, env2, home).map((app) => join4(app, "Contents", "MacOS"));
   }
   if (platform === "win32") {
     return buzzAppCandidates(platform, env2, home);
@@ -14862,7 +14924,7 @@ function resolveBuzzBinary(bin, opts) {
   if (bin.includes("/") || bin.includes("\\"))
     return null;
   for (const dir of buzzSidecarDirs(opts.platform, opts.env, opts.home)) {
-    const candidate = join3(dir, bin);
+    const candidate = join4(dir, bin);
     if (opts.isExecutable(candidate))
       return { path: candidate, source: "desktop" };
   }
@@ -14910,7 +14972,7 @@ function resolveOnPath(bin, env2, platform, isExecutable) {
   const sep = platform === "win32" ? ";" : ":";
   for (const dir of (env2.PATH ?? "").split(sep).filter(Boolean)) {
     for (const ext of exts) {
-      const candidate = join3(dir, bin + ext);
+      const candidate = join4(dir, bin + ext);
       if (isExecutable(candidate))
         return candidate;
     }
@@ -14932,7 +14994,7 @@ function whichBuzz(bin) {
   return resolveBuzzBinary(bin, {
     platform: process.platform,
     env: process.env,
-    home: homedir(),
+    home: homedir2(),
     isExecutable: executableOnDisk
   });
 }
@@ -15248,14 +15310,14 @@ function registerChannelCommands(program2) {
       console.log(json);
       return;
     }
-    const chosen = opts.appData ? { build: "release", dir: String(opts.appData) } : chooseAppDataDir(buzzAppDataCandidates(process.platform, process.env, homedir()), (d) => existsSync(d));
+    const chosen = opts.appData ? { build: "release", dir: String(opts.appData) } : chooseAppDataDir(buzzAppDataCandidates(process.platform, process.env, homedir2()), (d) => existsSync(d));
     if (!chosen) {
-      const candidates = buzzAppDataCandidates(process.platform, process.env, homedir());
-      const appInstalled = buzzAppCandidates(process.platform, process.env, homedir()).some((p) => existsSync(p));
+      const candidates = buzzAppDataCandidates(process.platform, process.env, homedir2());
+      const appInstalled = buzzAppCandidates(process.platform, process.env, homedir2()).some((p) => existsSync(p));
       throw new CLIError(appInstalled ? "Buzz Desktop has no data directory yet." : "Buzz Desktop is not installed.", 3 /* NotFound */, missingAppDataMessage(candidates, appInstalled));
     }
-    const dir = join3(chosen.dir, "custom_harnesses");
-    const file = join3(dir, `${def.id}.json`);
+    const dir = join4(chosen.dir, "custom_harnesses");
+    const file = join4(dir, `${def.id}.json`);
     if (existsSync(file) && !opts.force) {
       throw new CLIError(`${file} already exists.`, 5 /* Conflict */, "Re-run with --force to overwrite it.");
     }
@@ -15326,7 +15388,7 @@ function registerChannelCommands(program2) {
     }
     const acp = whichBuzz(opts.buzzAcpBin);
     const childPath = [
-      ...buzzSidecarDirs(process.platform, process.env, homedir()).filter((d) => existsSync(d)),
+      ...buzzSidecarDirs(process.platform, process.env, homedir2()).filter((d) => existsSync(d)),
       process.env.PATH ?? ""
     ].filter(Boolean).join(process.platform === "win32" ? ";" : ":");
     if (opts.dryRun) {
@@ -15767,6 +15829,7 @@ function registerConfigCommand(program2) {
 }
 
 // src/commands/definitions-apply.ts
+import { createHash as createHash3 } from "node:crypto";
 import fs8 from "node:fs";
 import path8 from "node:path";
 init_dist();
@@ -15988,16 +16051,19 @@ var VALID_KINDS = new Set([
   "Function",
   "Workflow",
   "Agent",
-  "Trigger"
+  "Trigger",
+  "ClientAccess"
 ]);
 var KIND_TO_API_PATH = {
   Function: "/api/admin/definitions/functions",
   Workflow: "/api/admin/definitions/workflows",
   Agent: "/api/admin/definitions/agents",
-  Trigger: "/api/admin/triggers"
+  Trigger: "/api/admin/triggers",
+  ClientAccess: "/api/admin/definitions/client-access"
 };
 var KIND_TO_PLURAL = {
   Function: "Functions",
+  ClientAccess: "Client access",
   Workflow: "Workflows",
   Agent: "Agents",
   Trigger: "Triggers"
@@ -16246,10 +16312,18 @@ function localSubsetOf(local, remote) {
   if (typeof local === "object") {
     const lObj = local;
     const rObj = remote;
-    return Object.keys(lObj).every((key) => localSubsetOf(lObj[key], rObj[key]));
+    return Object.keys(lObj).every((key) => {
+      if (key === "value" && typeof lObj.value === "string" && typeof rObj.value_sha256 === "string" && (rObj.value === null || rObj.value === undefined)) {
+        return sha256Prefix(lObj.value) === rObj.value_sha256;
+      }
+      return localSubsetOf(lObj[key], rObj[key]);
+    });
   }
   return false;
 }
+function sha256Prefix(value) {
+  return createHash3("sha256").update(value, "utf8").digest("hex").slice(0, 16);
+}
 var SYMBOLS = {
   create: "+",
   update: "~",
@@ -16272,7 +16346,8 @@ function renderPlan(ops) {
     "Function",
     "Workflow",
     "Agent",
-    "Trigger"
+    "Trigger",
+    "ClientAccess"
   ]) {
     const kindOps = grouped.get(kind);
     if (!kindOps)
@@ -16321,6 +16396,7 @@ async function executeApply(api, ops, defs, warnings) {
     defsByKey.set(`${d.kind}:${d.name}`, d);
   }
   const results = [];
+  ops = [...ops].sort((a, b) => (a.kind === "ClientAccess" ? 1 : 0) - (b.kind === "ClientAccess" ? 1 : 0));
   for (const op of ops) {
     if (op.action === "skip") {
       results.push({ name: op.name, kind: op.kind, action: "skipped" });
@@ -19238,11 +19314,11 @@ ${items.length} task(s) available`));
 }
 
 // src/commands/runner.ts
-import os3 from "node:os";
+import os4 from "node:os";
 init_errors();
 function hostLabel() {
   try {
-    return os3.hostname() || undefined;
+    return os4.hostname() || undefined;
   } catch {
     return;
   }
@@ -21626,6 +21702,129 @@ ${models.length} models`));
   });
 }
 
+// src/commands/spend.ts
+init_errors();
+var GROUPINGS = ["day", "agent", "model", "surface", "billing_owner"];
+function usd(value) {
+  return value == null ? "-" : `$${Number(value).toFixed(4)}`;
+}
+function registerSpendCommand(program2) {
+  program2.command("spend").description("LLM spend for a tenant, from Martha's own ledger").option("--tenant <id>", "Tenant (defaults to your own; others need super-admin)").option("--group-by <dim>", `One of: ${GROUPINGS.join(", ")}`, "day").option("--since <YYYY-MM-DD>", "Inclusive UTC start day").option("--until <YYYY-MM-DD>", "Exclusive UTC end day").action(async (opts) => {
+    const ctx = createContext({
+      profileOverride: program2.opts().profile,
+      verbose: program2.opts().verbose
+    });
+    if (program2.opts().apiUrl) {
+      ctx.profile.api_url = program2.opts().apiUrl;
+    }
+    const isJson = !!program2.opts().json;
+    if (!GROUPINGS.includes(opts.groupBy)) {
+      throw new CLIError(`--group-by must be one of: ${GROUPINGS.join(", ")}`, 4 /* Validation */);
+    }
+    const tenant = opts.tenant ?? await ctx.getTenantId();
+    const params = new URLSearchParams({ group_by: opts.groupBy });
+    if (opts.since)
+      params.set("since", opts.since);
+    if (opts.until)
+      params.set("until", opts.until);
+    const data = await ctx.api.get(`/api/admin/tenants/${encodeURIComponent(tenant)}/spend?${params.toString()}`);
+    if (isJson) {
+      console.log(JSON.stringify(data, null, 2));
+      return;
+    }
+    if (data.rows.length === 0) {
+      console.log(source_default.dim(`No LLM spend recorded for ${data.tenant_id}.`));
+      return;
+    }
+    const cols = [
+      { header: data.group_by.toUpperCase(), accessor: (r) => r.key ?? "-" },
+      { header: "CALLS", accessor: (r) => String(r.calls) },
+      { header: "PROMPT", accessor: (r) => String(r.prompt_tokens) },
+      { header: "COMPLETION", accessor: (r) => String(r.completion_tokens) },
+      { header: "CACHE READ", accessor: (r) => String(r.cache_read_tokens) },
+      { header: "CACHE WRITE", accessor: (r) => String(r.cache_write_tokens) },
+      { header: "COST", accessor: (r) => usd(r.cost_usd) },
+      { header: "UNPRICED", accessor: (r) => String(r.unpriced_calls) }
+    ];
+    const widths = cols.map((col) => Math.max(col.header.length, ...data.rows.map((r) => col.accessor(r).length)));
+    const header = cols.map((col, i) => col.header.padEnd(widths[i])).join("  ");
+    console.log(source_default.bold(header));
+    console.log(source_default.dim("-".repeat(header.length)));
+    for (const row of data.rows) {
+      console.log(cols.map((col, i) => col.accessor(row).padEnd(widths[i])).join("  "));
+    }
+    const t = data.totals;
+    console.log(source_default.dim(`
+${data.tenant_id}: ${t.calls} calls, ${usd(t.cost_usd)}` + (t.unpriced_calls ? `, ${t.unpriced_calls} unpriced (not included in cost)` : "")));
+  });
+}
+
+// src/commands/budget.ts
+init_errors();
+var PERIODS = ["day", "month"];
+var ACTIONS = ["warn", "require_approval", "block"];
+function oneOf(value, allowed, flag) {
+  if (!allowed.includes(value)) {
+    throw new CLIError(`${flag} must be one of: ${allowed.join(", ")}`, 4 /* Validation */);
+  }
+}
+function registerBudgetCommands(program2) {
+  const budget = program2.command("budget").description("LLM spend ceilings for a tenant");
+  const context = () => {
+    const ctx = createContext({
+      profileOverride: program2.opts().profile,
+      verbose: program2.opts().verbose
+    });
+    if (program2.opts().apiUrl)
+      ctx.profile.api_url = program2.opts().apiUrl;
+    return ctx;
+  };
+  const path9 = async (ctx, tenant) => `/api/admin/tenants/${encodeURIComponent(tenant ?? await ctx.getTenantId())}/llm-budgets`;
+  budget.command("list").description("List the tenant's ceilings").option("--tenant <id>", "Tenant (defaults to your own)").action(async (opts) => {
+    const ctx = context();
+    const data = await ctx.api.get(await path9(ctx, opts.tenant));
+    if (program2.opts().json) {
+      console.log(JSON.stringify(data, null, 2));
+      return;
+    }
+    if (data.budgets.length === 0) {
+      console.log(source_default.dim(`No LLM spend ceilings for ${data.tenant_id}.`));
+      return;
+    }
+    for (const b of data.budgets) {
+      const scope = b.agent_id ? `agent ${b.agent_id}` : "tenant";
+      console.log(`${b.id}  ${scope.padEnd(42)} ${b.period.padEnd(6)} $${b.limit_usd}  ${b.action}`);
+    }
+  });
+  budget.command("set").description("Create or replace a ceiling (one per tenant-or-agent + period)").requiredOption("--period <p>", `One of: ${PERIODS.join(", ")}`).requiredOption("--limit <usd>", "Ceiling in USD (cache reads included)").requiredOption("--action <a>", `One of: ${ACTIONS.join(", ")}`).option("--agent <uuid>", "Scope to one AI Agent (default: whole tenant)").option("--note <text>", "Why this ceiling exists").option("--tenant <id>", "Tenant (defaults to your own)").action(async (opts) => {
+    oneOf(opts.period, PERIODS, "--period");
+    oneOf(opts.action, ACTIONS, "--action");
+    if (!/^\d+(\.\d{1,4})?$/.test(opts.limit)) {
+      throw new CLIError("--limit must be a non-negative USD amount", 4 /* Validation */);
+    }
+    const ctx = context();
+    const saved = await ctx.api.put(await path9(ctx, opts.tenant), {
+      period: opts.period,
+      limit_usd: opts.limit,
+      action: opts.action,
+      agent_id: opts.agent ?? null,
+      note: opts.note ?? null
+    });
+    if (program2.opts().json)
+      console.log(JSON.stringify(saved, null, 2));
+    else
+      console.log(`${saved.id}  ${saved.period} $${saved.limit_usd} -> ${saved.action}`);
+  });
+  budget.command("rm <budgetId>").description("Delete a ceiling").option("--tenant <id>", "Tenant (defaults to your own)").action(async (budgetId, opts) => {
+    const ctx = context();
+    await ctx.api.del(`${await path9(ctx, opts.tenant)}/${encodeURIComponent(budgetId)}`);
+    if (program2.opts().json)
+      console.log(JSON.stringify({ deleted: budgetId }));
+    else
+      console.log(`deleted ${budgetId}`);
+  });
+}
+
 // src/commands/wiki.ts
 import fs11 from "node:fs";
 init_errors();
@@ -22481,7 +22680,7 @@ async function resolveCredentialFlag(value) {
 
 // src/commands/policy.ts
 init_errors();
-var ACTIONS = ["allow", "require_approval", "block"];
+var ACTIONS2 = ["allow", "require_approval", "block"];
 var KINDS2 = ["risk_tag", "risk_level", "capability"];
 var SCOPES = ["any", "agent", "client"];
 var truncate4 = (s, n) => s.length > n ? s.slice(0, n - 1) + "…" : s;
@@ -22551,8 +22750,8 @@ function registerPolicyCommands(program2) {
       console.log(columns.map((c, i) => c.get(r).padEnd(widths[i])).join("  "));
     }
   });
-  cmd.command("set-default <action>").description(`Set the opt-in default action (${ACTIONS.join("|")})`).action(async (action) => {
-    assertOneOf(action, ACTIONS, "action");
+  cmd.command("set-default <action>").description(`Set the opt-in default action (${ACTIONS2.join("|")})`).action(async (action) => {
+    assertOneOf(action, ACTIONS2, "action");
     const ctx = getCtx();
     const res = await ctx.api.put("/api/admin/policy/settings", { default_action: action });
     if (isJson()) {
@@ -22576,9 +22775,9 @@ function registerPolicyCommands(program2) {
     console.log(`Safe-default bundle ${enabled ? source_default.yellow("enabled") : source_default.dim("disabled")}.`);
   });
   const rule = cmd.command("rule").description("Manage explicit policy rules");
-  rule.command("add").description("Create or update a rule").requiredOption(`--kind <kind>`, `Match kind (${KINDS2.join("|")})`).requiredOption("--value <value>", "Match value (a risk tag, level, or capability ref)").requiredOption(`--action <action>`, `Action (${ACTIONS.join("|")})`).option(`--scope <scope>`, `Principal scope (${SCOPES.join("|")})`, "any").option("--note <text>", "Optional human note").action(async (opts) => {
+  rule.command("add").description("Create or update a rule").requiredOption(`--kind <kind>`, `Match kind (${KINDS2.join("|")})`).requiredOption("--value <value>", "Match value (a risk tag, level, or capability ref)").requiredOption(`--action <action>`, `Action (${ACTIONS2.join("|")})`).option(`--scope <scope>`, `Principal scope (${SCOPES.join("|")})`, "any").option("--note <text>", "Optional human note").action(async (opts) => {
     assertOneOf(opts.kind, KINDS2, "--kind");
-    assertOneOf(opts.action, ACTIONS, "--action");
+    assertOneOf(opts.action, ACTIONS2, "--action");
     assertOneOf(opts.scope, SCOPES, "--scope");
     const ctx = getCtx();
     const res = await ctx.api.post("/api/admin/policy/rules", {
@@ -22609,6 +22808,7 @@ function registerPolicyCommands(program2) {
 import { readFileSync as readFileSync3 } from "node:fs";
 init_errors();
 var BASE = "/api/admin/agent-step/trust-roots";
+var FLEET_BASE = "/api/admin/agent-step/fleet";
 function resolveKeyMaterial(value) {
   if (value.startsWith("@")) {
     const path9 = value.slice(1);
@@ -22722,6 +22922,69 @@ function registerAgentStepCommands(program2) {
     console.log(source_default.green(`Rotated trust root '${tr.name}'`));
     printOne(tr);
   });
+  const fleet = cmd.command("fleet").description("Pause / resume this tenant's agent_step fleet (#1041)");
+  function printFleet(s) {
+    const state = s.effective_paused ? source_default.red(`PAUSED (${s.effective_scope})`) : source_default.green("running");
+    console.log(`agent_step fleet: ${source_default.bold(state)}`);
+    if (s.effective_reason)
+      console.log(`  Reason:     ${s.effective_reason}`);
+    if (s.paused_by)
+      console.log(`  Paused by:  ${s.paused_by}`);
+    if (s.paused_at)
+      console.log(`  Paused at:  ${s.paused_at}`);
+    if (s.paused_workflows.length) {
+      console.log(`  Quarantined workflows: ${s.paused_workflows.join(", ")}`);
+    }
+    if (s.global_paused) {
+      console.log(source_default.yellow(`  NOTE: the PLATFORM-wide break-glass flag is set — every tenant is halted,
+` + "        and resuming this tenant will not restart work until it is cleared."));
+    }
+  }
+  fleet.command("status").description("Show whether agent_step work is currently halted").action(async () => {
+    const ctx = getCtx();
+    const s = await ctx.api.get(FLEET_BASE);
+    if (isJson()) {
+      console.log(JSON.stringify(s, null, 2));
+      return;
+    }
+    printFleet(s);
+  });
+  fleet.command("pause").description("Halt all agent_step runs for this tenant (in-flight steps drain)").requiredOption("-r, --reason <text>", "Why you are stopping the fleet — recorded in the audit log and shown on stopped runs").action(async (opts) => {
+    const ctx = getCtx();
+    const s = await ctx.api.put(FLEET_BASE, {
+      paused: true,
+      reason: opts.reason
+    });
+    if (isJson()) {
+      console.log(JSON.stringify(s, null, 2));
+      return;
+    }
+    console.log(source_default.yellow(`Fleet paused. No new agent_step will start; in-flight steps finish their
+` + "current attempt and then stop instead of retrying."));
+    printFleet(s);
+  });
+  fleet.command("resume").description("Allow agent_step runs for this tenant again").action(async () => {
+    const ctx = getCtx();
+    const s = await ctx.api.put(FLEET_BASE, { paused: false });
+    if (isJson()) {
+      console.log(JSON.stringify(s, null, 2));
+      return;
+    }
+    console.log(source_default.green("Fleet resumed."));
+    printFleet(s);
+  });
+  fleet.command("quarantine [workflows...]").description("Halt only the named workflows (pass none to clear the quarantine list)").action(async (workflows) => {
+    const ctx = getCtx();
+    const s = await ctx.api.put(FLEET_BASE, {
+      paused_workflows: workflows ?? []
+    });
+    if (isJson()) {
+      console.log(JSON.stringify(s, null, 2));
+      return;
+    }
+    console.log(workflows?.length ? source_default.yellow(`Quarantined: ${workflows.join(", ")}`) : source_default.green("Quarantine cleared."));
+    printFleet(s);
+  });
 }
 
 // src/commands/authz.ts
@@ -24142,6 +24405,8 @@ registerNotificationCommands(program2);
 registerMessagingCommands(program2);
 registerClientCommands(program2);
 registerModelsCommand(program2);
+registerSpendCommand(program2);
+registerBudgetCommands(program2);
 registerSessionCommands(program2);
 registerMCPCommands(program2);
 registerPolicyCommands(program2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiaiai-pt/martha-cli",
-  "version": "0.58.1",
+  "version": "0.61.1",
   "description": "Terminal-first client for the Martha AI platform",
   "homepage": "https://docs.martha.nomadriver.co",
   "repository": {