@aiaiai-pt/martha-cli 0.65.0 → 0.66.1

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to semver — `0.x` releases may include breaking changes between minor versions.
 
+## [0.66.1] — 2026-11-01
+
+### Fixed
+
+- `martha runner` and `martha chat --local-exec` no longer run a host command when its gate cannot be claimed. A claim that fails with a network error or 5xx is retried twice, then the gate is skipped. Previously any non-409 failure fell through to execution, and the server, which enforces the claim, rejected the result, so the command ran with nowhere to report. This is what happened for runs Temporal no longer had (#1859).
+
+## [0.66.0] — 2026-11-01
+
+### Added
+
+- `martha definitions apply` provisions skills and agent grants (#2339). A `kind: Prompt` file creates the prompt, or a new version only when its content differs from production, promotes it and checks the production content's hash; `description`/`scope` metadata is updated when it differs. An Agent's `functions:` and `workflows:` are granted and read back; grants the file does not declare are reported as drift and never revoked. The dry-run plan lists pending grants and drift.
+- `-f` can be given more than once (`-f agent/ -f agent/skills/`). Directories are still not recursed.
+
 ## [0.65.0] — 2026-10-24
 
 ### Added

package/dist/index.js

@@ -11244,7 +11244,7 @@ init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.65.0";
+var CLI_VERSION = "0.66.1";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {
@@ -13546,6 +13546,7 @@ async function resolveLocalAgent(sessionId, toolCallId, req, state) {
     log_path: result.log_path
   };
 }
+var CLAIM_RETRY = { delaysMs: [1000, 3000] };
 async function claimGate(sessionId, toolCallId, state, transport) {
   if (state.claimed.has(toolCallId))
     return true;
@@ -13553,19 +13554,25 @@ async function claimGate(sessionId, toolCallId, state, transport) {
   const secretHash = createHash2("sha256").update(secret).digest("hex");
   state.secrets.set(toolCallId, secret);
   await state.journal.recordSecret(sessionId, toolCallId, secret);
-  try {
-    await transport.claim(toolCallId, secretHash);
-    state.claimed.add(toolCallId);
-    return true;
-  } catch (e) {
-    if (e instanceof MarthaAPIError && e.status === 409) {
-      process.stderr.write(source_default.yellow(`[local-exec] gate ${toolCallId} is not pending (already resolved or timed out) — skipping execution
+  for (let attempt = 0;; attempt++) {
+    try {
+      await transport.claim(toolCallId, secretHash);
+      state.claimed.add(toolCallId);
+      return true;
+    } catch (e) {
+      if (e instanceof MarthaAPIError && e.status === 409) {
+        process.stderr.write(source_default.yellow(`[local-exec] gate ${toolCallId} is not pending (already resolved or timed out) — skipping execution
 `));
-      return false;
-    }
-    process.stderr.write(source_default.yellow(`[local-exec] failed to claim gate for ${toolCallId}: ${String(e)}
+        return false;
+      }
+      const final = e instanceof MarthaAPIError && e.status >= 400 && e.status < 500;
+      if (final || attempt >= CLAIM_RETRY.delaysMs.length) {
+        process.stderr.write(source_default.yellow(`[local-exec] failed to claim gate for ${toolCallId}: ${String(e)} — skipping execution
 `));
-    return true;
+        return false;
+      }
+      await new Promise((r) => setTimeout(r, CLAIM_RETRY.delaysMs[attempt]));
+    }
   }
 }
 async function postToolResult(toolCallId, result, label, transport, execSecret) {
@@ -16092,21 +16099,24 @@ var VALID_KINDS = new Set([
   "Workflow",
   "Agent",
   "Trigger",
-  "ClientAccess"
+  "ClientAccess",
+  "Prompt"
 ]);
 var KIND_TO_API_PATH = {
   Function: "/api/admin/definitions/functions",
   Workflow: "/api/admin/definitions/workflows",
   Agent: "/api/admin/definitions/agents",
   Trigger: "/api/admin/triggers",
-  ClientAccess: "/api/admin/definitions/client-access"
+  ClientAccess: "/api/admin/definitions/client-access",
+  Prompt: "/api/admin/definitions/prompts"
 };
 var KIND_TO_PLURAL = {
   Function: "Functions",
   ClientAccess: "Client access",
   Workflow: "Workflows",
   Agent: "Agents",
-  Trigger: "Triggers"
+  Trigger: "Triggers",
+  Prompt: "Prompts"
 };
 var SERVER_GENERATED_FIELDS = new Set([
   "id",
@@ -16274,17 +16284,36 @@ async function computeOperations(defs, api) {
       });
       continue;
     }
-    const changedFields = diffFields(def.body, remote);
+    const changedFields = def.kind === "Prompt" ? diffPromptFields(def.body, remote) : diffFields(def.body, remote);
     const needsReactivation = remote.is_active === false && def.body.is_active !== false;
     if (needsReactivation && !changedFields.includes("is_active")) {
       changedFields.push("is_active");
     }
+    let pendingGrants;
+    let driftGrants;
+    if (def.kind === "Agent" && remote) {
+      const grants = await computeAgentGrantDiff(api, def);
+      if (grants.pending.functions.length > 0 || grants.pending.workflows.length > 0) {
+        pendingGrants = grants.pending;
+      }
+      if (grants.drift.functions.length > 0 || grants.drift.workflows.length > 0) {
+        driftGrants = grants.drift;
+      }
+    } else if (def.kind === "Agent" && !remote) {
+      const fns = def.body.functions ?? [];
+      const wfs = def.body.workflows ?? [];
+      if (fns.length > 0 || wfs.length > 0) {
+        pendingGrants = { functions: fns, workflows: wfs };
+      }
+    }
     if (changedFields.length === 0) {
       ops.push({
         kind: def.kind,
         name: def.name,
         action: "skip",
-        source: def.source
+        source: def.source,
+        pendingGrants,
+        driftGrants
       });
     } else {
       ops.push({
@@ -16293,7 +16322,9 @@ async function computeOperations(defs, api) {
         action: "update",
         changedFields,
         source: def.source,
-        reactivate: needsReactivation || undefined
+        reactivate: needsReactivation || undefined,
+        pendingGrants,
+        driftGrants
       });
     }
   }
@@ -16307,6 +16338,8 @@ function diffFields(local, remote) {
       continue;
     if (SERVER_GENERATED_FIELDS.has(key))
       continue;
+    if (AGENT_MANAGED_FIELDS.has(key))
+      continue;
     const localVal = local[key];
     const remoteVal = flatRemote[key];
     if (!localSubsetOf(localVal, remoteVal)) {
@@ -16315,6 +16348,32 @@ function diffFields(local, remote) {
   }
   return changed;
 }
+function diffPromptFields(local, remote) {
+  const changed = [];
+  const prod = remote.production;
+  for (const key of Object.keys(local)) {
+    if (key === "name")
+      continue;
+    if (key === "change_summary")
+      continue;
+    if (SERVER_GENERATED_FIELDS.has(key))
+      continue;
+    if (key === "content") {
+      const localContent = local.content;
+      const remoteContent = prod?.content;
+      if (localContent !== remoteContent) {
+        changed.push("content");
+      }
+    } else {
+      const localVal = local[key];
+      const remoteVal = remote[key];
+      if (!localSubsetOf(localVal, remoteVal)) {
+        changed.push(key);
+      }
+    }
+  }
+  return changed;
+}
 function flattenDefinitionWrapper(remote) {
   const result = {};
   for (const [key, val] of Object.entries(remote)) {
@@ -16387,7 +16446,8 @@ function renderPlan(ops) {
     "Workflow",
     "Agent",
     "Trigger",
-    "ClientAccess"
+    "ClientAccess",
+    "Prompt"
   ]) {
     const kindOps = grouped.get(kind);
     if (!kindOps)
@@ -16406,6 +16466,16 @@ function renderPlan(ops) {
         line += source_default.dim("(no changes)");
       }
       console.log(line);
+      const pend = op.pendingGrants;
+      if (pend && pend.functions.length + pend.workflows.length > 0) {
+        const names = [...pend.functions, ...pend.workflows.map((w) => `workflow:${w}`)];
+        console.log(source_default.green(`        + grant ${names.join(", ")}`));
+      }
+      const drift = op.driftGrants;
+      if (drift && drift.functions.length + drift.workflows.length > 0) {
+        const names = [...drift.functions, ...drift.workflows.map((w) => `workflow:${w}`)];
+        console.log(source_default.yellow(`        ! drift (granted, not declared; not revoked): ${names.join(", ")}`));
+      }
     }
     console.log();
   }
@@ -16438,22 +16508,51 @@ async function executeApply(api, ops, defs, warnings) {
   const results = [];
   ops = [...ops].sort((a, b) => (a.kind === "ClientAccess" ? 1 : 0) - (b.kind === "ClientAccess" ? 1 : 0));
   for (const op of ops) {
+    const def = defsByKey.get(`${op.kind}:${op.name}`);
     if (op.action === "skip") {
-      results.push({ name: op.name, kind: op.kind, action: "skipped" });
+      if (op.kind !== "Agent") {
+        results.push({ name: op.name, kind: op.kind, action: "skipped" });
+        continue;
+      }
+      try {
+        const added = await applyAgentGrants(api, def, warnings);
+        results.push({
+          name: op.name,
+          kind: op.kind,
+          action: added > 0 ? "updated" : "skipped"
+        });
+      } catch (err) {
+        results.push({
+          name: op.name,
+          kind: op.kind,
+          action: "failed",
+          error: err instanceof Error ? err.message : String(err),
+          source: def.source
+        });
+      }
       continue;
     }
-    const def = defsByKey.get(`${op.kind}:${op.name}`);
     const apiPath = KIND_TO_API_PATH[op.kind];
+    if (op.kind === "Prompt") {
+      try {
+        const result = await applyPrompt(api, op, def);
+        results.push(result);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        results.push({
+          name: op.name,
+          kind: op.kind,
+          action: "failed",
+          error: msg,
+          source: def.source
+        });
+      }
+      continue;
+    }
     const body = op.kind === "Function" || op.kind === "Workflow" ? normalizeDefinitionWriteBody(op.kind, def.body) : { ...def.body };
     if (op.kind === "Agent") {
       for (const field of AGENT_MANAGED_FIELDS) {
         if (field in body) {
-          const msg = `'${field}' in ${def.name} is managed separately and will be ignored`;
-          if (warnings) {
-            warnings.push(msg);
-          } else {
-            console.error(source_default.yellow(`  Warning: ${msg}.`));
-          }
           delete body[field];
         }
       }
@@ -16486,6 +16585,9 @@ async function executeApply(api, ops, defs, warnings) {
           port_warnings: portWarnings.length > 0 ? portWarnings : undefined
         });
       }
+      if (op.kind === "Agent") {
+        await applyAgentGrants(api, def, warnings);
+      }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       results.push({
@@ -16499,6 +16601,175 @@ async function executeApply(api, ops, defs, warnings) {
   }
   return results;
 }
+async function applyPrompt(api, op, def) {
+  const promptPath = KIND_TO_API_PATH.Prompt;
+  const name = encodeURIComponent(def.name);
+  const localContent = def.body.content;
+  if (op.action === "create") {
+    const createBody = {
+      name: def.body.name,
+      content: localContent
+    };
+    if (def.body.description)
+      createBody.description = def.body.description;
+    if (def.body.scope)
+      createBody.scope = def.body.scope;
+    const res = await api.post(promptPath, createBody);
+    const readBack = await api.get(`${promptPath}/${name}`);
+    const prodContent = readBack.production?.content;
+    const localHash = createHash3("sha256").update(localContent).digest("hex");
+    const remoteHash = prodContent ? createHash3("sha256").update(prodContent).digest("hex") : "";
+    if (localHash !== remoteHash) {
+      return {
+        name: def.name,
+        kind: "Prompt",
+        action: "failed",
+        error: `Content hash mismatch after create: local=${localHash.slice(0, 12)} remote=${remoteHash.slice(0, 12)}`,
+        source: def.source
+      };
+    }
+    const version = res.version_count ?? res.production?.version ?? 1;
+    return {
+      name: def.name,
+      kind: "Prompt",
+      action: "created",
+      version
+    };
+  }
+  const contentChanged = op.changedFields?.includes("content");
+  const metadataFields = (op.changedFields ?? []).filter((f) => f !== "content");
+  let version;
+  if (contentChanged) {
+    const versionRes = await api.post(`${promptPath}/${name}/versions`, {
+      content: localContent,
+      change_summary: def.body.change_summary ?? "Applied via definitions apply"
+    });
+    const newVersion = versionRes.version;
+    version = newVersion;
+    await api.post(`${promptPath}/${name}/promote`, {
+      version: newVersion,
+      environment: "production"
+    });
+  }
+  if (metadataFields.length > 0) {
+    const metaBody = {};
+    if (metadataFields.includes("description")) {
+      metaBody.description = def.body.description;
+    }
+    if (metadataFields.includes("scope")) {
+      await api.put(`${promptPath}/${name}/scope`, {
+        scope: def.body.scope
+      });
+    }
+    if (Object.keys(metaBody).length > 0) {
+      await api.put(`${promptPath}/${name}`, metaBody);
+    }
+  }
+  if (contentChanged) {
+    const readBack = await api.get(`${promptPath}/${name}`);
+    const prodContent = readBack.production?.content;
+    const localHash = createHash3("sha256").update(localContent).digest("hex");
+    const remoteHash = prodContent ? createHash3("sha256").update(prodContent).digest("hex") : "";
+    if (localHash !== remoteHash) {
+      return {
+        name: def.name,
+        kind: "Prompt",
+        action: "failed",
+        error: `Content hash mismatch after update: local=${localHash.slice(0, 12)} remote=${remoteHash.slice(0, 12)}`,
+        source: def.source
+      };
+    }
+  }
+  return {
+    name: def.name,
+    kind: "Prompt",
+    action: "updated",
+    version
+  };
+}
+async function computeAgentGrantDiff(api, def) {
+  const agentPath = KIND_TO_API_PATH.Agent;
+  const name = encodeURIComponent(def.name);
+  const declaredFunctions = def.body.functions ?? [];
+  const declaredWorkflows = def.body.workflows ?? [];
+  const pendingFns = [];
+  const driftFns = [];
+  const pendingWfs = [];
+  const driftWfs = [];
+  if (declaredFunctions.length > 0) {
+    const remoteFns = await api.get(`${agentPath}/${name}/functions`);
+    const remoteFnNames = new Set((Array.isArray(remoteFns) ? remoteFns : []).map((f) => f.function_name ?? f.name));
+    for (const fn of declaredFunctions) {
+      if (!remoteFnNames.has(fn))
+        pendingFns.push(fn);
+    }
+    const declaredSet = new Set(declaredFunctions);
+    for (const rn of remoteFnNames) {
+      if (!declaredSet.has(rn))
+        driftFns.push(rn);
+    }
+  }
+  if (declaredWorkflows.length > 0) {
+    const remoteWfs = await api.get(`${agentPath}/${name}/workflows`);
+    const remoteWfNames = new Set((Array.isArray(remoteWfs) ? remoteWfs : []).map((w) => w.workflow_name ?? w.name));
+    for (const wf of declaredWorkflows) {
+      if (!remoteWfNames.has(wf))
+        pendingWfs.push(wf);
+    }
+    const declaredSet = new Set(declaredWorkflows);
+    for (const rn of remoteWfNames) {
+      if (!declaredSet.has(rn))
+        driftWfs.push(rn);
+    }
+  }
+  return {
+    pending: { functions: pendingFns, workflows: pendingWfs },
+    drift: { functions: driftFns, workflows: driftWfs }
+  };
+}
+async function applyAgentGrants(api, def, warnings) {
+  const agentPath = KIND_TO_API_PATH.Agent;
+  const name = encodeURIComponent(def.name);
+  const diff = await computeAgentGrantDiff(api, def);
+  for (const fn of diff.pending.functions) {
+    await api.post(`${agentPath}/${name}/functions`, {
+      function_name: fn
+    });
+  }
+  for (const wf of diff.pending.workflows) {
+    await api.post(`${agentPath}/${name}/workflows`, {
+      workflow_name: wf
+    });
+  }
+  const posted = diff.pending.functions.length + diff.pending.workflows.length;
+  if (posted > 0) {
+    const after = await computeAgentGrantDiff(api, def);
+    const missing = [
+      ...after.pending.functions.map((f) => `function '${f}'`),
+      ...after.pending.workflows.map((w) => `workflow '${w}'`)
+    ];
+    if (missing.length > 0) {
+      throw new Error(`grants not on the server after apply for ${def.name}: ${missing.join(", ")}`);
+    }
+  }
+  for (const fn of diff.drift.functions) {
+    const msg = `drift: function '${fn}' granted to ${def.name} remotely but not declared in file`;
+    if (warnings) {
+      warnings.push(msg);
+    } else {
+      console.error(source_default.yellow(`  Warning: ${msg}`));
+    }
+  }
+  for (const wf of diff.drift.workflows) {
+    const msg = `drift: workflow '${wf}' granted to ${def.name} remotely but not declared in file`;
+    if (warnings) {
+      warnings.push(msg);
+    } else {
+      console.error(source_default.yellow(`  Warning: ${msg}`));
+    }
+  }
+  return posted;
+}
 function extractPortWarnings(response) {
   const raw = response.port_warnings;
   if (!Array.isArray(raw) || raw.length === 0)
@@ -16544,7 +16815,7 @@ function registerDefinitionsApply(program) {
   if (!defCmd) {
     defCmd = program.command("definitions").description("Cross-type definition operations");
   }
-  defCmd.command("apply").description("Apply definitions from YAML/JSON files (create or update, never deletes)").requiredOption("-f, --file <path>", "Path to a YAML/JSON file or directory of definitions").option("--dry-run", "Preview changes without applying").option("--yes", "Skip confirmation prompt").addHelpText("after", `
+  defCmd.command("apply").description("Apply definitions from YAML/JSON files (create or update, never deletes)").requiredOption("-f, --file <path>", "Path to a YAML/JSON file or directory of definitions (repeatable; directories are not recursed)", (value, previous = []) => [...previous, value]).option("--dry-run", "Preview changes without applying").option("--yes", "Skip confirmation prompt").addHelpText("after", `
 Examples:
   $ martha definitions apply -f search.yaml            Single file
   $ martha definitions apply -f definitions/            Directory (flat)
@@ -16559,12 +16830,12 @@ Examples:
       ctx.profile.api_url = program.opts().apiUrl;
     }
     const isJson = !!program.opts().json;
-    const defs = loadDefinitions(opts.file);
+    const defs = opts.file.flatMap((f) => loadDefinitions(f));
     if (defs.length === 0) {
       if (isJson) {
         console.log(JSON.stringify({ results: [], message: "No definitions found" }));
       } else {
-        console.log(`No definitions found in ${opts.file}`);
+        console.log(`No definitions found in ${opts.file.join(", ")}`);
       }
       return;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiaiai-pt/martha-cli",
-  "version": "0.65.0",
+  "version": "0.66.1",
   "description": "Terminal-first client for the Martha AI platform",
   "homepage": "https://docs.martha.nomadriver.co",
   "repository": {