@aiaiai-pt/martha-cli 0.68.1 → 0.69.0

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to `@aiaiai-pt/martha-cli`. Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to semver — `0.x` releases may include breaking changes between minor versions.
 
+## [0.69.0] — 2026-11-13
+
+### Added
+
+- `martha definitions apply` preserves the server-supported agent `base_pack_opt_out` flag, allowing narrowly granted specialists such as delegated customer support without restoring broad default tools. This release retains the current published CLI capabilities.
+
+## [0.68.4] — 2026-11-09
+
+### Fixed
+
+- `martha definitions apply` compares a function's `risk_tags` as the server stores them: a legacy spelling (`write`, `delete`, …) matches the canonical tag it maps to, and order no longer matters. It used to report a change on every apply once the server stored the canonical form (MARTHA-602).
+
+## [0.68.3] — 2026-11-09
+
+### Fixed
+
+- `martha functions update` and `martha definitions apply` now check the function's `tool` block (the per-tool call timeout, #1833): an update whose `tool` the server did not persist fails instead of reporting success.
+
+## [0.68.2] — 2026-11-08
+
+### Fixed
+
+- `martha agents doctor` and `martha agents runner-presence` report runner presence as unknown when the presence registry can't be read (the server sends `present: null, available: false`) or the presence call fails. They used to say "no runner connected", which is wrong during an outage: the runner may be attached.
+
 ## [0.68.1] — 2026-11-03
 
 ### Fixed

package/dist/index.js

@@ -11244,7 +11244,7 @@ init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.68.1";
+var CLI_VERSION = "0.69.0";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {
@@ -11633,18 +11633,25 @@ async function diagnoseHostRunner(ctx, name) {
     fix: takeover ? undefined : setupFix
   });
   let attached = false;
+  let presenceUnknown = false;
   let attachedHost;
   try {
     const pres = await ctx.api.get(`${API_PATH}/runner-presence`);
     const p = pres.presence?.[name];
-    attached = !!p?.present;
+    if (p?.present === null || p?.available === false) {
+      presenceUnknown = true;
+    } else {
+      attached = !!p?.present;
+    }
     attachedHost = p?.connections?.[0]?.host;
-  } catch {}
+  } catch {
+    presenceUnknown = true;
+  }
   checks.push({
-    ok: attached,
+    ok: presenceUnknown ? null : attached,
     label: "a runner is attached now",
-    detail: attached ? `host ${attachedHost ?? "?"}` : "no runner connected",
-    fix: attached ? undefined : `on the target machine: martha runner --tools --allow-host-exec (and the server needs CHANNEL_ENABLED=1)`
+    detail: presenceUnknown ? "unknown (presence registry unreachable)" : attached ? `host ${attachedHost ?? "?"}` : "no runner connected",
+    fix: presenceUnknown ? "check Redis connectivity on the Martha server" : attached ? undefined : `on the target machine: martha runner --tools --allow-host-exec (and the server needs CHANNEL_ENABLED=1)`
   });
   const isHostRunner = hasKey || hostTools.length > 0;
   const drivableFromChat = marthaHosted && hasKey && hostTools.length > 0 && grantingClients.length > 0 && takeover;
@@ -12008,6 +12015,8 @@ Attach it as this agent's host executor:
         if (p.present && conns.length) {
           const hosts = conns.map((c) => c.host || c.connection_id?.slice(0, 8) || "?").join(", ");
           console.log(`${source_default.green("● connected")}  ${name}  ${source_default.dim(`(${hosts})`)}`);
+        } else if (p.present === null || p.available === false) {
+          console.log(`${source_default.yellow("? unknown")}  ${name}`);
         } else {
           console.log(`${source_default.dim("○ disconnected")}  ${name}`);
         }
@@ -15902,7 +15911,8 @@ var MUTABLE_FIELDS = {
     "risk_tags",
     "risk_level",
     "verification_safe",
-    "idempotent"
+    "idempotent",
+    "tool"
   ]),
   Workflow: new Set([
     "description",
@@ -16146,6 +16156,7 @@ var AGENT_WRITE_FIELDS = new Set([
   "llm_config",
   "loop_config",
   "runs_as_chat",
+  "base_pack_opt_out",
   "agent_metadata",
   "auth_method",
   "webhook_url",
@@ -16330,6 +16341,30 @@ async function computeOperations(defs, api) {
   }
   return ops;
 }
+var EFFECT_TAG_ALIASES = {
+  write: "mutating",
+  delete: "destructive_write",
+  destructive: "destructive_write",
+  host_exec: "host_execution",
+  readonly: "read_only",
+  read: "read_only",
+  payments: "payment",
+  code_execution: "arbitrary_code",
+  fs: "filesystem"
+};
+function canonicalEffectTag(tag) {
+  if (typeof tag !== "string")
+    return tag;
+  const key = tag.trim().toLowerCase().replace(/[- ]/g, "_");
+  return EFFECT_TAG_ALIASES[key] ?? key;
+}
+function effectTagsMatch(local, remote) {
+  if (!Array.isArray(local) || !Array.isArray(remote))
+    return localSubsetOf(local, remote);
+  const l = new Set(local.map(canonicalEffectTag));
+  const r = new Set(remote.map(canonicalEffectTag));
+  return l.size === r.size && [...l].every((tag) => r.has(tag));
+}
 function diffFields(local, remote) {
   const flatRemote = flattenDefinitionWrapper(remote);
   const changed = [];
@@ -16342,7 +16377,8 @@ function diffFields(local, remote) {
       continue;
     const localVal = local[key];
     const remoteVal = flatRemote[key];
-    if (!localSubsetOf(localVal, remoteVal)) {
+    const same = key === "risk_tags" ? effectTagsMatch(localVal, remoteVal) : localSubsetOf(localVal, remoteVal);
+    if (!same) {
       changed.push(key);
     }
   }
@@ -16614,6 +16650,8 @@ async function applyPrompt(api, op, def) {
       createBody.description = def.body.description;
     if (def.body.scope)
       createBody.scope = def.body.scope;
+    if (def.body.scope_entity_id)
+      createBody.scope_entity_id = def.body.scope_entity_id;
     const res = await api.post(promptPath, createBody);
     const readBack = await api.get(`${promptPath}/${name}`);
     const prodContent = readBack.production?.content;
@@ -16658,7 +16696,8 @@ async function applyPrompt(api, op, def) {
     }
     if (metadataFields.includes("scope")) {
       await api.put(`${promptPath}/${name}/scope`, {
-        scope: def.body.scope
+        scope: def.body.scope,
+        ...def.body.scope_entity_id ? { scope_entity_id: def.body.scope_entity_id } : {}
       });
     }
     if (Object.keys(metaBody).length > 0) {
@@ -28182,11 +28221,13 @@ async function checkHostRunners(ctx) {
         detail: "none configured"
       };
     }
-    const attached = names.filter((n) => presence[n]?.present).length;
+    const attached = names.filter((n) => presence[n]?.present === true).length;
+    const unknown = names.filter((n) => presence[n]?.present === null || presence[n]?.available === false).length;
+    const detail = unknown ? `${names.length} configured, ${attached} attached, ${unknown} unknown (registry unreachable)` : `${names.length} configured, ${attached} attached`;
     return {
       name: "Host runners",
-      status: "pass",
-      detail: `${names.length} configured, ${attached} attached`,
+      status: unknown ? "warn" : "pass",
+      detail,
       remedy: `per-agent checkup: martha agents doctor <name>`
     };
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiaiai-pt/martha-cli",
-  "version": "0.68.1",
+  "version": "0.69.0",
   "description": "Terminal-first client for the Martha AI platform",
   "homepage": "https://docs.martha.nomadriver.co",
   "repository": {

package/skills/martha-cli/SKILL.md

@@ -164,6 +164,10 @@ martha functions export [--format yaml|json] [--output FILE]
 
 Function `auth` field is the most error-prone part — see the [Function authentication patterns](#function-authentication-patterns) section below.
 
+**Call timeout (`tool` block, #1833 I5).** To let one call of a slow function run longer than the default, put `tool: { timeout: 60 }` (seconds, 1-900) at the top level of the `functions create|update -f` body. The server stores it in `definition.tool`. In chat the call's activity then gets `timeout` + 15 s (never under 30 s) instead of a fixed 30 s, and the handler bounds the call by `timeout`, with a 401 credential retry sharing the same deadline. A chat session keeps the bound its tool list had when it started, and calls are capped to fit it, so start a new session after raising `timeout`. Out-of-range values or unknown keys return **422**. A function with a `handler` (platform function) may not declare more than its handler's registry `timeout` (30 s unless the decorator sets another): create/update return **422** naming that bound, and a `timeout` on an unknown handler is a 422 too (MARTHA-626; only the `__system__` seed may exceed it, and older tenant rows above it are clamped at dispatch). `tool: {}` clears it. Platform functions get it from their decorator at seed time. `client_timeout_seconds` (1-86400) is stored but not read yet. `definitions apply` does not round-trip the block yet.
+
+**Effect tags (`risk_tags`) are a closed vocabulary.** Allowed: `read_only`, `network`, `browser`, `untrusted_content`, `external_io`, `external_write`, `mutating`, `tenant_write`, `filesystem`, `host_execution`, `infra`, `destructive_write`, `payment`, `arbitrary_code`. Legacy spellings are mapped on write (`write`→`mutating`, `delete`→`destructive_write`, `host_exec`→`host_execution`, …), so a re-`get` can show a different tag than the file. Any other tag fails `create` / `update` / `definitions apply` with HTTP 422 `unknown_effect_tag`; the body's `suggestion` is the closest valid tag. Fix the file, don't retry. The live list is `martha policy show --json` → `risk_tag_vocabulary`. Full table: `docs/reference/effect-tags.md`.
+
 ### Workflows CRUD + Execution
 
 ```bash