@aiaiai-pt/martha-cli 0.65.0 → 0.66.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to semver — `0.x` releases may include breaking changes between minor versions.
 
+## [0.66.0] — 2026-11-01
+
+### Added
+
+- `martha definitions apply` provisions skills and agent grants (#2339). A `kind: Prompt` file creates the prompt, or a new version only when its content differs from production, promotes it and checks the production content's hash; `description`/`scope` metadata is updated when it differs. An Agent's `functions:` and `workflows:` are granted and read back; grants the file does not declare are reported as drift and never revoked. The dry-run plan lists pending grants and drift.
+- `-f` can be given more than once (`-f agent/ -f agent/skills/`). Directories are still not recursed.
+
 ## [0.65.0] — 2026-10-24
 
 ### Added

package/dist/index.js

@@ -11244,7 +11244,7 @@ init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.65.0";
+var CLI_VERSION = "0.66.0";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {
@@ -16092,21 +16092,24 @@ var VALID_KINDS = new Set([
   "Workflow",
   "Agent",
   "Trigger",
-  "ClientAccess"
+  "ClientAccess",
+  "Prompt"
 ]);
 var KIND_TO_API_PATH = {
   Function: "/api/admin/definitions/functions",
   Workflow: "/api/admin/definitions/workflows",
   Agent: "/api/admin/definitions/agents",
   Trigger: "/api/admin/triggers",
-  ClientAccess: "/api/admin/definitions/client-access"
+  ClientAccess: "/api/admin/definitions/client-access",
+  Prompt: "/api/admin/definitions/prompts"
 };
 var KIND_TO_PLURAL = {
   Function: "Functions",
   ClientAccess: "Client access",
   Workflow: "Workflows",
   Agent: "Agents",
-  Trigger: "Triggers"
+  Trigger: "Triggers",
+  Prompt: "Prompts"
 };
 var SERVER_GENERATED_FIELDS = new Set([
   "id",
@@ -16274,17 +16277,36 @@ async function computeOperations(defs, api) {
       });
       continue;
     }
-    const changedFields = diffFields(def.body, remote);
+    const changedFields = def.kind === "Prompt" ? diffPromptFields(def.body, remote) : diffFields(def.body, remote);
     const needsReactivation = remote.is_active === false && def.body.is_active !== false;
     if (needsReactivation && !changedFields.includes("is_active")) {
       changedFields.push("is_active");
     }
+    let pendingGrants;
+    let driftGrants;
+    if (def.kind === "Agent" && remote) {
+      const grants = await computeAgentGrantDiff(api, def);
+      if (grants.pending.functions.length > 0 || grants.pending.workflows.length > 0) {
+        pendingGrants = grants.pending;
+      }
+      if (grants.drift.functions.length > 0 || grants.drift.workflows.length > 0) {
+        driftGrants = grants.drift;
+      }
+    } else if (def.kind === "Agent" && !remote) {
+      const fns = def.body.functions ?? [];
+      const wfs = def.body.workflows ?? [];
+      if (fns.length > 0 || wfs.length > 0) {
+        pendingGrants = { functions: fns, workflows: wfs };
+      }
+    }
     if (changedFields.length === 0) {
       ops.push({
         kind: def.kind,
         name: def.name,
         action: "skip",
-        source: def.source
+        source: def.source,
+        pendingGrants,
+        driftGrants
       });
     } else {
       ops.push({
@@ -16293,7 +16315,9 @@ async function computeOperations(defs, api) {
         action: "update",
         changedFields,
         source: def.source,
-        reactivate: needsReactivation || undefined
+        reactivate: needsReactivation || undefined,
+        pendingGrants,
+        driftGrants
       });
     }
   }
@@ -16307,6 +16331,8 @@ function diffFields(local, remote) {
       continue;
     if (SERVER_GENERATED_FIELDS.has(key))
       continue;
+    if (AGENT_MANAGED_FIELDS.has(key))
+      continue;
     const localVal = local[key];
     const remoteVal = flatRemote[key];
     if (!localSubsetOf(localVal, remoteVal)) {
@@ -16315,6 +16341,32 @@ function diffFields(local, remote) {
   }
   return changed;
 }
+function diffPromptFields(local, remote) {
+  const changed = [];
+  const prod = remote.production;
+  for (const key of Object.keys(local)) {
+    if (key === "name")
+      continue;
+    if (key === "change_summary")
+      continue;
+    if (SERVER_GENERATED_FIELDS.has(key))
+      continue;
+    if (key === "content") {
+      const localContent = local.content;
+      const remoteContent = prod?.content;
+      if (localContent !== remoteContent) {
+        changed.push("content");
+      }
+    } else {
+      const localVal = local[key];
+      const remoteVal = remote[key];
+      if (!localSubsetOf(localVal, remoteVal)) {
+        changed.push(key);
+      }
+    }
+  }
+  return changed;
+}
 function flattenDefinitionWrapper(remote) {
   const result = {};
   for (const [key, val] of Object.entries(remote)) {
@@ -16387,7 +16439,8 @@ function renderPlan(ops) {
     "Workflow",
     "Agent",
     "Trigger",
-    "ClientAccess"
+    "ClientAccess",
+    "Prompt"
   ]) {
     const kindOps = grouped.get(kind);
     if (!kindOps)
@@ -16406,6 +16459,16 @@ function renderPlan(ops) {
         line += source_default.dim("(no changes)");
       }
       console.log(line);
+      const pend = op.pendingGrants;
+      if (pend && pend.functions.length + pend.workflows.length > 0) {
+        const names = [...pend.functions, ...pend.workflows.map((w) => `workflow:${w}`)];
+        console.log(source_default.green(`        + grant ${names.join(", ")}`));
+      }
+      const drift = op.driftGrants;
+      if (drift && drift.functions.length + drift.workflows.length > 0) {
+        const names = [...drift.functions, ...drift.workflows.map((w) => `workflow:${w}`)];
+        console.log(source_default.yellow(`        ! drift (granted, not declared; not revoked): ${names.join(", ")}`));
+      }
     }
     console.log();
   }
@@ -16438,22 +16501,51 @@ async function executeApply(api, ops, defs, warnings) {
   const results = [];
   ops = [...ops].sort((a, b) => (a.kind === "ClientAccess" ? 1 : 0) - (b.kind === "ClientAccess" ? 1 : 0));
   for (const op of ops) {
+    const def = defsByKey.get(`${op.kind}:${op.name}`);
     if (op.action === "skip") {
-      results.push({ name: op.name, kind: op.kind, action: "skipped" });
+      if (op.kind !== "Agent") {
+        results.push({ name: op.name, kind: op.kind, action: "skipped" });
+        continue;
+      }
+      try {
+        const added = await applyAgentGrants(api, def, warnings);
+        results.push({
+          name: op.name,
+          kind: op.kind,
+          action: added > 0 ? "updated" : "skipped"
+        });
+      } catch (err) {
+        results.push({
+          name: op.name,
+          kind: op.kind,
+          action: "failed",
+          error: err instanceof Error ? err.message : String(err),
+          source: def.source
+        });
+      }
       continue;
     }
-    const def = defsByKey.get(`${op.kind}:${op.name}`);
     const apiPath = KIND_TO_API_PATH[op.kind];
+    if (op.kind === "Prompt") {
+      try {
+        const result = await applyPrompt(api, op, def);
+        results.push(result);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        results.push({
+          name: op.name,
+          kind: op.kind,
+          action: "failed",
+          error: msg,
+          source: def.source
+        });
+      }
+      continue;
+    }
     const body = op.kind === "Function" || op.kind === "Workflow" ? normalizeDefinitionWriteBody(op.kind, def.body) : { ...def.body };
     if (op.kind === "Agent") {
       for (const field of AGENT_MANAGED_FIELDS) {
         if (field in body) {
-          const msg = `'${field}' in ${def.name} is managed separately and will be ignored`;
-          if (warnings) {
-            warnings.push(msg);
-          } else {
-            console.error(source_default.yellow(`  Warning: ${msg}.`));
-          }
           delete body[field];
         }
       }
@@ -16486,6 +16578,9 @@ async function executeApply(api, ops, defs, warnings) {
           port_warnings: portWarnings.length > 0 ? portWarnings : undefined
         });
       }
+      if (op.kind === "Agent") {
+        await applyAgentGrants(api, def, warnings);
+      }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       results.push({
@@ -16499,6 +16594,175 @@ async function executeApply(api, ops, defs, warnings) {
   }
   return results;
 }
+async function applyPrompt(api, op, def) {
+  const promptPath = KIND_TO_API_PATH.Prompt;
+  const name = encodeURIComponent(def.name);
+  const localContent = def.body.content;
+  if (op.action === "create") {
+    const createBody = {
+      name: def.body.name,
+      content: localContent
+    };
+    if (def.body.description)
+      createBody.description = def.body.description;
+    if (def.body.scope)
+      createBody.scope = def.body.scope;
+    const res = await api.post(promptPath, createBody);
+    const readBack = await api.get(`${promptPath}/${name}`);
+    const prodContent = readBack.production?.content;
+    const localHash = createHash3("sha256").update(localContent).digest("hex");
+    const remoteHash = prodContent ? createHash3("sha256").update(prodContent).digest("hex") : "";
+    if (localHash !== remoteHash) {
+      return {
+        name: def.name,
+        kind: "Prompt",
+        action: "failed",
+        error: `Content hash mismatch after create: local=${localHash.slice(0, 12)} remote=${remoteHash.slice(0, 12)}`,
+        source: def.source
+      };
+    }
+    const version = res.version_count ?? res.production?.version ?? 1;
+    return {
+      name: def.name,
+      kind: "Prompt",
+      action: "created",
+      version
+    };
+  }
+  const contentChanged = op.changedFields?.includes("content");
+  const metadataFields = (op.changedFields ?? []).filter((f) => f !== "content");
+  let version;
+  if (contentChanged) {
+    const versionRes = await api.post(`${promptPath}/${name}/versions`, {
+      content: localContent,
+      change_summary: def.body.change_summary ?? "Applied via definitions apply"
+    });
+    const newVersion = versionRes.version;
+    version = newVersion;
+    await api.post(`${promptPath}/${name}/promote`, {
+      version: newVersion,
+      environment: "production"
+    });
+  }
+  if (metadataFields.length > 0) {
+    const metaBody = {};
+    if (metadataFields.includes("description")) {
+      metaBody.description = def.body.description;
+    }
+    if (metadataFields.includes("scope")) {
+      await api.put(`${promptPath}/${name}/scope`, {
+        scope: def.body.scope
+      });
+    }
+    if (Object.keys(metaBody).length > 0) {
+      await api.put(`${promptPath}/${name}`, metaBody);
+    }
+  }
+  if (contentChanged) {
+    const readBack = await api.get(`${promptPath}/${name}`);
+    const prodContent = readBack.production?.content;
+    const localHash = createHash3("sha256").update(localContent).digest("hex");
+    const remoteHash = prodContent ? createHash3("sha256").update(prodContent).digest("hex") : "";
+    if (localHash !== remoteHash) {
+      return {
+        name: def.name,
+        kind: "Prompt",
+        action: "failed",
+        error: `Content hash mismatch after update: local=${localHash.slice(0, 12)} remote=${remoteHash.slice(0, 12)}`,
+        source: def.source
+      };
+    }
+  }
+  return {
+    name: def.name,
+    kind: "Prompt",
+    action: "updated",
+    version
+  };
+}
+async function computeAgentGrantDiff(api, def) {
+  const agentPath = KIND_TO_API_PATH.Agent;
+  const name = encodeURIComponent(def.name);
+  const declaredFunctions = def.body.functions ?? [];
+  const declaredWorkflows = def.body.workflows ?? [];
+  const pendingFns = [];
+  const driftFns = [];
+  const pendingWfs = [];
+  const driftWfs = [];
+  if (declaredFunctions.length > 0) {
+    const remoteFns = await api.get(`${agentPath}/${name}/functions`);
+    const remoteFnNames = new Set((Array.isArray(remoteFns) ? remoteFns : []).map((f) => f.function_name ?? f.name));
+    for (const fn of declaredFunctions) {
+      if (!remoteFnNames.has(fn))
+        pendingFns.push(fn);
+    }
+    const declaredSet = new Set(declaredFunctions);
+    for (const rn of remoteFnNames) {
+      if (!declaredSet.has(rn))
+        driftFns.push(rn);
+    }
+  }
+  if (declaredWorkflows.length > 0) {
+    const remoteWfs = await api.get(`${agentPath}/${name}/workflows`);
+    const remoteWfNames = new Set((Array.isArray(remoteWfs) ? remoteWfs : []).map((w) => w.workflow_name ?? w.name));
+    for (const wf of declaredWorkflows) {
+      if (!remoteWfNames.has(wf))
+        pendingWfs.push(wf);
+    }
+    const declaredSet = new Set(declaredWorkflows);
+    for (const rn of remoteWfNames) {
+      if (!declaredSet.has(rn))
+        driftWfs.push(rn);
+    }
+  }
+  return {
+    pending: { functions: pendingFns, workflows: pendingWfs },
+    drift: { functions: driftFns, workflows: driftWfs }
+  };
+}
+async function applyAgentGrants(api, def, warnings) {
+  const agentPath = KIND_TO_API_PATH.Agent;
+  const name = encodeURIComponent(def.name);
+  const diff = await computeAgentGrantDiff(api, def);
+  for (const fn of diff.pending.functions) {
+    await api.post(`${agentPath}/${name}/functions`, {
+      function_name: fn
+    });
+  }
+  for (const wf of diff.pending.workflows) {
+    await api.post(`${agentPath}/${name}/workflows`, {
+      workflow_name: wf
+    });
+  }
+  const posted = diff.pending.functions.length + diff.pending.workflows.length;
+  if (posted > 0) {
+    const after = await computeAgentGrantDiff(api, def);
+    const missing = [
+      ...after.pending.functions.map((f) => `function '${f}'`),
+      ...after.pending.workflows.map((w) => `workflow '${w}'`)
+    ];
+    if (missing.length > 0) {
+      throw new Error(`grants not on the server after apply for ${def.name}: ${missing.join(", ")}`);
+    }
+  }
+  for (const fn of diff.drift.functions) {
+    const msg = `drift: function '${fn}' granted to ${def.name} remotely but not declared in file`;
+    if (warnings) {
+      warnings.push(msg);
+    } else {
+      console.error(source_default.yellow(`  Warning: ${msg}`));
+    }
+  }
+  for (const wf of diff.drift.workflows) {
+    const msg = `drift: workflow '${wf}' granted to ${def.name} remotely but not declared in file`;
+    if (warnings) {
+      warnings.push(msg);
+    } else {
+      console.error(source_default.yellow(`  Warning: ${msg}`));
+    }
+  }
+  return posted;
+}
 function extractPortWarnings(response) {
   const raw = response.port_warnings;
   if (!Array.isArray(raw) || raw.length === 0)
@@ -16544,7 +16808,7 @@ function registerDefinitionsApply(program) {
   if (!defCmd) {
     defCmd = program.command("definitions").description("Cross-type definition operations");
   }
-  defCmd.command("apply").description("Apply definitions from YAML/JSON files (create or update, never deletes)").requiredOption("-f, --file <path>", "Path to a YAML/JSON file or directory of definitions").option("--dry-run", "Preview changes without applying").option("--yes", "Skip confirmation prompt").addHelpText("after", `
+  defCmd.command("apply").description("Apply definitions from YAML/JSON files (create or update, never deletes)").requiredOption("-f, --file <path>", "Path to a YAML/JSON file or directory of definitions (repeatable; directories are not recursed)", (value, previous = []) => [...previous, value]).option("--dry-run", "Preview changes without applying").option("--yes", "Skip confirmation prompt").addHelpText("after", `
 Examples:
   $ martha definitions apply -f search.yaml            Single file
   $ martha definitions apply -f definitions/            Directory (flat)
@@ -16559,12 +16823,12 @@ Examples:
       ctx.profile.api_url = program.opts().apiUrl;
     }
     const isJson = !!program.opts().json;
-    const defs = loadDefinitions(opts.file);
+    const defs = opts.file.flatMap((f) => loadDefinitions(f));
     if (defs.length === 0) {
       if (isJson) {
         console.log(JSON.stringify({ results: [], message: "No definitions found" }));
       } else {
-        console.log(`No definitions found in ${opts.file}`);
+        console.log(`No definitions found in ${opts.file.join(", ")}`);
       }
       return;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiaiai-pt/martha-cli",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "description": "Terminal-first client for the Martha AI platform",
   "homepage": "https://docs.martha.nomadriver.co",
   "repository": {