@aiaiai-pt/martha-cli 0.61.0 → 0.61.1

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to semver — `0.x` releases may include breaking changes between minor versions.
 
+## [0.61.1] — 2026-09-25
+
+### Fixed — carries 0.60.2's redirect fix onto the 0.61 line
+
+`main` shipped the same-host redirect fix as 0.60.2 while `uio` released 0.61.0
+the same day; the main → uio sync brings that fix into the 0.61 line. No other
+change: `martha triggers list/create` and `definitions apply` of a `kind: Trigger`
+no longer read as "Not authenticated" behind the TLS proxy (see 0.60.2 below).
+
 ## [0.61.0] — 2026-09-24
 
 ### Added — `martha spend` and `martha budget` (#1107)
@@ -20,6 +29,22 @@ an `organizations` claim and no `tenant_id`, so every command that defaults to t
 tenant failed with `No tenant_id claim in access token`. The CLI now resolves the tenant exactly
 as the API does: `tenant_id`, else the first organization.
 
+## [0.60.2] — 2026-09-24
+
+### Fixed — a redirect no longer turns an authenticated request into "Not authenticated"
+
+`martha triggers list`, `triggers create` and `definitions apply` of a
+`kind: Trigger` all failed with `Not authenticated` for a logged-in user. The
+API answers `POST /api/admin/triggers` (no trailing slash) with
+`307 → http://<host>/api/admin/triggers/` — a scheme downgrade behind the TLS
+proxy. `fetch` followed it cross-origin and dropped `Authorization`, so the API
+saw no token. Measured on martha.nomadriver.co, 2026-09-24.
+
+Every request now handles redirects itself (`redirect: "manual"`): same host
+only, always on the original scheme, at most 3 hops; 307/308 keep method and
+body. A redirect to any other host is refused with a clear error and the
+bearer token is never sent there.
+
 ## [0.60.0] — 2026-08-20
 
 ### Added — `kind: ClientAccess`, so a declared workflow can also be authorized

package/dist/index.js

@@ -3528,6 +3528,7 @@ var require_stringify = __commonJS((exports) => {
       nullStr: "null",
       simpleKeys: false,
       singleQuote: null,
+      trailingComma: false,
       trueStr: "true",
       verifyAliasOrder: true
     }, doc.schema.toStringOptions, options);
@@ -4036,13 +4037,20 @@ ${indent}${line}` : `
       if (comment)
         reqNewline = true;
       let str = stringify.stringify(item, itemCtx, () => comment = null);
-      if (i < items.length - 1)
+      reqNewline || (reqNewline = lines.length > linesAtValue || str.includes(`
+`));
+      if (i < items.length - 1) {
         str += ",";
+      } else if (ctx.options.trailingComma) {
+        if (ctx.options.lineWidth > 0) {
+          reqNewline || (reqNewline = lines.reduce((sum, line) => sum + line.length + 2, 2) + (str.length + 2) > ctx.options.lineWidth);
+        }
+        if (reqNewline) {
+          str += ",";
+        }
+      }
       if (comment)
         str += stringifyComment.lineComment(str, itemIndent, commentString(comment));
-      if (!reqNewline && (lines.length > linesAtValue || str.includes(`
-`)))
-        reqNewline = true;
       lines.push(str);
       linesAtValue = lines.length;
     }
@@ -6837,17 +6845,22 @@ var require_compose_node = __commonJS((exports) => {
       case "block-map":
       case "block-seq":
       case "flow-collection":
-        node = composeCollection.composeCollection(CN, ctx, token, props, onError);
-        if (anchor)
-          node.anchor = anchor.source.substring(1);
+        try {
+          node = composeCollection.composeCollection(CN, ctx, token, props, onError);
+          if (anchor)
+            node.anchor = anchor.source.substring(1);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          onError(token, "RESOURCE_EXHAUSTION", message);
+        }
         break;
       default: {
         const message = token.type === "error" ? token.message : `Unsupported token (type: ${token.type})`;
         onError(token, "UNEXPECTED_TOKEN", message);
-        node = composeEmptyNode(ctx, token.offset, undefined, null, props, onError);
         isSrcToken = false;
       }
     }
+    node ?? (node = composeEmptyNode(ctx, token.offset, undefined, null, props, onError));
     if (anchor && node.anchor === "")
       onError(anchor, "BAD_ALIAS", "Anchor cannot be an empty string");
     if (atKey && ctx.options.stringKeys && (!identity.isScalar(node) || typeof node.value !== "string" || node.tag && node.tag !== "tag:yaml.org,2002:str")) {
@@ -9508,6 +9521,7 @@ function parseDataLine(data) {
 // src/lib/api-client.ts
 var exports_api_client = {};
 __export(exports_api_client, {
+  sameHostRedirect: () => sameHostRedirect,
   MarthaAPIClient: () => MarthaAPIClient
 });
 import fs3 from "node:fs";
@@ -9516,6 +9530,33 @@ function guessMimeType(filename) {
   const ext = nodePath.extname(filename).toLowerCase();
   return MIME_TYPES[ext] ?? "application/octet-stream";
 }
+function isRedirect(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function sameHostRedirect(from, location) {
+  if (!location)
+    return null;
+  const origin = new URL(from);
+  let next;
+  try {
+    next = new URL(location, origin);
+  } catch {
+    return null;
+  }
+  if (next.hostname !== origin.hostname)
+    return null;
+  const port = (u) => u.port || (u.protocol === "https:" ? "443" : "80");
+  if (next.protocol !== origin.protocol) {
+    if (port(next) !== (next.protocol === "https:" ? "443" : "80") || port(origin) !== (origin.protocol === "https:" ? "443" : "80")) {
+      return null;
+    }
+    next.protocol = origin.protocol;
+    next.port = origin.port;
+  } else if (port(next) !== port(origin)) {
+    return null;
+  }
+  return next.toString();
+}
 
 class MarthaAPIClient {
   baseUrl;
@@ -9533,6 +9574,27 @@ class MarthaAPIClient {
       process.stderr.write(`[DEBUG] ${msg}
 `);
   }
+  async fetchSameHost(url, init) {
+    let target = url;
+    let current = { ...init, redirect: "manual" };
+    let res = await fetch(target, current);
+    for (let hop = 0;isRedirect(res.status); hop++) {
+      const location = res.headers.get("location");
+      const next = sameHostRedirect(target, location);
+      if (!next || hop >= MAX_REDIRECTS) {
+        throw new CLIError(next ? `Too many redirects (${MAX_REDIRECTS}) from ${url}` : `Refused redirect from ${target} to ${location ?? "(no Location)"} — ` + "the credential is only ever sent to the configured API host", 1 /* Error */, "Check the profile's api_url; the server may be missing a trailing-slash route or proxy headers.");
+      }
+      if (res.status !== 307 && res.status !== 308 && current.method !== "GET" && current.method !== "HEAD") {
+        const headers = { ...current.headers };
+        delete headers["Content-Type"];
+        current = { ...current, method: "GET", body: undefined, headers };
+      }
+      this.log(`  → ${res.status} redirect to ${next}`);
+      target = next;
+      res = await fetch(target, current);
+    }
+    return res;
+  }
   async get(path3, opts) {
     return this.request("GET", path3, opts);
   }
@@ -9560,7 +9622,7 @@ class MarthaAPIClient {
     formData.append("file", blob, fileName);
     let res;
     try {
-      res = await fetch(url, {
+      res = await this.fetchSameHost(url, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${token}`,
@@ -9590,7 +9652,7 @@ class MarthaAPIClient {
     const timeout = opts?.timeout ?? this.defaultTimeout;
     let res;
     try {
-      res = await fetch(url, {
+      res = await this.fetchSameHost(url, {
         method: "GET",
         headers: {
           Authorization: `Bearer ${token}`,
@@ -9619,7 +9681,7 @@ class MarthaAPIClient {
     const timeout = opts?.timeout ?? 120000;
     let res;
     try {
-      res = await fetch(url, {
+      res = await this.fetchSameHost(url, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${token}`,
@@ -9648,7 +9710,7 @@ class MarthaAPIClient {
     const token = await this.getAccessToken();
     const url = this.buildUrl(path3, opts?.params);
     const timeout = opts?.timeout ?? 120000;
-    const res = await fetch(url, {
+    const res = await this.fetchSameHost(url, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${token}`,
@@ -9682,7 +9744,7 @@ class MarthaAPIClient {
       if (opts?.body !== undefined)
         this.log(`  body: ${JSON.stringify(opts.body).slice(0, 500)}`);
       try {
-        return await fetch(url, {
+        return await this.fetchSameHost(url, {
           method,
           headers,
           body: opts?.body !== undefined ? JSON.stringify(opts.body) : undefined,
@@ -9730,7 +9792,7 @@ class MarthaAPIClient {
     return url.toString();
   }
 }
-var MIME_TYPES;
+var MIME_TYPES, MAX_REDIRECTS = 3;
 var init_api_client = __esm(() => {
   init_errors();
   MIME_TYPES = {
@@ -11142,7 +11204,7 @@ init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.61.0";
+var CLI_VERSION = "0.61.1";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiaiai-pt/martha-cli",
-  "version": "0.61.0",
+  "version": "0.61.1",
   "description": "Terminal-first client for the Martha AI platform",
   "homepage": "https://docs.martha.nomadriver.co",
   "repository": {