@aiaiai-pt/martha-cli 0.61.0 → 0.61.2

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to semver — `0.x` releases may include breaking changes between minor versions.
 
+## [0.61.2] — 2026-10-07
+
+### Fixed — `martha chat` no longer prints `{"v": 1}` before every answer (#1601)
+
+Since 2026-08-06 every chat stream opens with a named `stream_start` frame
+(`event: stream_start` / `data: {"v": 1}`). The chat parser read only `data:`
+lines, so the frame was printed as answer text. It now parses SSE events
+properly and skips named events. The same fall-through printed structured
+frames as raw JSON: `agent_progress` frames are now ignored, and a
+`handover_placeholder` (a human took over) shows its message.
+
+## [0.61.1] — 2026-09-25
+
+### Fixed — carries 0.60.2's redirect fix onto the 0.61 line
+
+`main` shipped the same-host redirect fix as 0.60.2 while `uio` released 0.61.0
+the same day; the main → uio sync brings that fix into the 0.61 line. No other
+change: `martha triggers list/create` and `definitions apply` of a `kind: Trigger`
+no longer read as "Not authenticated" behind the TLS proxy (see 0.60.2 below).
+
 ## [0.61.0] — 2026-09-24
 
 ### Added — `martha spend` and `martha budget` (#1107)
@@ -20,6 +40,22 @@ an `organizations` claim and no `tenant_id`, so every command that defaults to t
 tenant failed with `No tenant_id claim in access token`. The CLI now resolves the tenant exactly
 as the API does: `tenant_id`, else the first organization.
 
+## [0.60.2] — 2026-09-24
+
+### Fixed — a redirect no longer turns an authenticated request into "Not authenticated"
+
+`martha triggers list`, `triggers create` and `definitions apply` of a
+`kind: Trigger` all failed with `Not authenticated` for a logged-in user. The
+API answers `POST /api/admin/triggers` (no trailing slash) with
+`307 → http://<host>/api/admin/triggers/` — a scheme downgrade behind the TLS
+proxy. `fetch` followed it cross-origin and dropped `Authorization`, so the API
+saw no token. Measured on martha.nomadriver.co, 2026-09-24.
+
+Every request now handles redirects itself (`redirect: "manual"`): same host
+only, always on the original scheme, at most 3 hops; 307/308 keep method and
+body. A redirect to any other host is refused with a clear error and the
+bearer token is never sent there.
+
 ## [0.60.0] — 2026-08-20
 
 ### Added — `kind: ClientAccess`, so a declared workflow can also be authorized

package/dist/index.js

@@ -9427,41 +9427,15 @@ async function* parseGenericSSE(body) {
   }
 }
 async function* parseSSEStream(body) {
-  const reader = body.getReader();
-  const decoder = new TextDecoder;
-  let buffer = "";
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done)
-        break;
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split(`
-`);
-      buffer = lines.pop();
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith(":"))
-          continue;
-        if (trimmed.startsWith("data: ")) {
-          const data = trimmed.slice(6);
-          const event = parseDataLine(data);
-          if (event) {
-            yield event;
-            if (event.type === "done" || event.type === "error")
-              return;
-          }
-        }
-      }
-    }
-    if (buffer.trim().startsWith("data: ")) {
-      const data = buffer.trim().slice(6);
-      const event = parseDataLine(data);
-      if (event)
-        yield event;
+  for await (const sse of parseGenericSSE(body)) {
+    if (sse.event && sse.event !== "message")
+      continue;
+    const event = parseDataLine(sse.data);
+    if (event) {
+      yield event;
+      if (event.type === "done" || event.type === "error")
+        return;
     }
-  } finally {
-    reader.releaseLock();
   }
 }
 function parseDataLine(data) {
@@ -9488,6 +9462,12 @@ function parseDataLine(data) {
       if (obj.type === "clear") {
         return { type: "clear", data: "" };
       }
+      if (obj.type === "handover_placeholder") {
+        return { type: "token", data: String(obj.message ?? "") };
+      }
+      if (obj.type === "agent_progress" || obj.type === "widget") {
+        return null;
+      }
       if (obj.type === "done") {
         return {
           type: "done",
@@ -9508,6 +9488,7 @@ function parseDataLine(data) {
 // src/lib/api-client.ts
 var exports_api_client = {};
 __export(exports_api_client, {
+  sameHostRedirect: () => sameHostRedirect,
   MarthaAPIClient: () => MarthaAPIClient
 });
 import fs3 from "node:fs";
@@ -9516,6 +9497,33 @@ function guessMimeType(filename) {
   const ext = nodePath.extname(filename).toLowerCase();
   return MIME_TYPES[ext] ?? "application/octet-stream";
 }
+function isRedirect(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function sameHostRedirect(from, location) {
+  if (!location)
+    return null;
+  const origin = new URL(from);
+  let next;
+  try {
+    next = new URL(location, origin);
+  } catch {
+    return null;
+  }
+  if (next.hostname !== origin.hostname)
+    return null;
+  const port = (u) => u.port || (u.protocol === "https:" ? "443" : "80");
+  if (next.protocol !== origin.protocol) {
+    if (port(next) !== (next.protocol === "https:" ? "443" : "80") || port(origin) !== (origin.protocol === "https:" ? "443" : "80")) {
+      return null;
+    }
+    next.protocol = origin.protocol;
+    next.port = origin.port;
+  } else if (port(next) !== port(origin)) {
+    return null;
+  }
+  return next.toString();
+}
 
 class MarthaAPIClient {
   baseUrl;
@@ -9533,6 +9541,27 @@ class MarthaAPIClient {
       process.stderr.write(`[DEBUG] ${msg}
 `);
   }
+  async fetchSameHost(url, init) {
+    let target = url;
+    let current = { ...init, redirect: "manual" };
+    let res = await fetch(target, current);
+    for (let hop = 0;isRedirect(res.status); hop++) {
+      const location = res.headers.get("location");
+      const next = sameHostRedirect(target, location);
+      if (!next || hop >= MAX_REDIRECTS) {
+        throw new CLIError(next ? `Too many redirects (${MAX_REDIRECTS}) from ${url}` : `Refused redirect from ${target} to ${location ?? "(no Location)"} — ` + "the credential is only ever sent to the configured API host", 1 /* Error */, "Check the profile's api_url; the server may be missing a trailing-slash route or proxy headers.");
+      }
+      if (res.status !== 307 && res.status !== 308 && current.method !== "GET" && current.method !== "HEAD") {
+        const headers = { ...current.headers };
+        delete headers["Content-Type"];
+        current = { ...current, method: "GET", body: undefined, headers };
+      }
+      this.log(`  → ${res.status} redirect to ${next}`);
+      target = next;
+      res = await fetch(target, current);
+    }
+    return res;
+  }
   async get(path3, opts) {
     return this.request("GET", path3, opts);
   }
@@ -9560,7 +9589,7 @@ class MarthaAPIClient {
     formData.append("file", blob, fileName);
     let res;
     try {
-      res = await fetch(url, {
+      res = await this.fetchSameHost(url, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${token}`,
@@ -9590,7 +9619,7 @@ class MarthaAPIClient {
     const timeout = opts?.timeout ?? this.defaultTimeout;
     let res;
     try {
-      res = await fetch(url, {
+      res = await this.fetchSameHost(url, {
         method: "GET",
         headers: {
           Authorization: `Bearer ${token}`,
@@ -9619,7 +9648,7 @@ class MarthaAPIClient {
     const timeout = opts?.timeout ?? 120000;
     let res;
     try {
-      res = await fetch(url, {
+      res = await this.fetchSameHost(url, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${token}`,
@@ -9648,7 +9677,7 @@ class MarthaAPIClient {
     const token = await this.getAccessToken();
     const url = this.buildUrl(path3, opts?.params);
     const timeout = opts?.timeout ?? 120000;
-    const res = await fetch(url, {
+    const res = await this.fetchSameHost(url, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${token}`,
@@ -9682,7 +9711,7 @@ class MarthaAPIClient {
       if (opts?.body !== undefined)
         this.log(`  body: ${JSON.stringify(opts.body).slice(0, 500)}`);
       try {
-        return await fetch(url, {
+        return await this.fetchSameHost(url, {
           method,
           headers,
           body: opts?.body !== undefined ? JSON.stringify(opts.body) : undefined,
@@ -9730,7 +9759,7 @@ class MarthaAPIClient {
     return url.toString();
   }
 }
-var MIME_TYPES;
+var MIME_TYPES, MAX_REDIRECTS = 3;
 var init_api_client = __esm(() => {
   init_errors();
   MIME_TYPES = {
@@ -11142,7 +11171,7 @@ init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.61.0";
+var CLI_VERSION = "0.61.2";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiaiai-pt/martha-cli",
-  "version": "0.61.0",
+  "version": "0.61.2",
   "description": "Terminal-first client for the Martha AI platform",
   "homepage": "https://docs.martha.nomadriver.co",
   "repository": {