@lumerahq/cli 0.19.6 → 0.19.8-dev.0

package/dist/{chunk-WY6UMJNI.js → chunk-BAQROJO7.js}

@@ -246,6 +246,17 @@ var ApiClient = class {
     const result = await this.request("/api/lm_agent_skills?limit=100");
     return result.skills || [];
   }
+  // Resolve a list of refs (slugs or IDs) to skill records. Unlike
+  // listAgentSkills, this returns managed skills as well — the caller has
+  // already named them, so there is no broad enumeration concern.
+  async lookupAgentSkills(refs) {
+    if (!refs || refs.length === 0) return [];
+    const result = await this.request("/api/lm_agent_skills/lookup", {
+      method: "POST",
+      body: JSON.stringify({ refs })
+    });
+    return result.skills || [];
+  }
   // Agent Invoke
   async invokeAgent(agentId, message, sessionId) {
     const body = { message };

package/dist/{chunk-RUJRTLHA.js → chunk-ZDN32JTT.js}

@@ -4,7 +4,7 @@ import {
 import {
   createApiClient,
   isApiErrorStatus
-} from "./chunk-WY6UMJNI.js";
+} from "./chunk-BAQROJO7.js";
 import {
   findProjectRoot,
   getAppName

package/dist/{deps-73XZXRYP.js → deps-DPB3L3EJ.js}

@@ -2,9 +2,9 @@ import {
   deps,
   projectResourceDepsEnabled,
   syncDeps
-} from "./chunk-RUJRTLHA.js";
+} from "./chunk-ZDN32JTT.js";
 import "./chunk-2CR762KB.js";
-import "./chunk-WY6UMJNI.js";
+import "./chunk-BAQROJO7.js";
 import "./chunk-ZH3NVYEQ.js";
 import "./chunk-FJFIWC7G.js";
 import "./chunk-PNKVD2UK.js";

package/dist/{dev-YYMFCXZ5.js → dev-GNZ22LKP.js}

@@ -4,13 +4,13 @@ import {
 import {
   projectResourceDepsEnabled,
   syncDeps
-} from "./chunk-RUJRTLHA.js";
+} from "./chunk-ZDN32JTT.js";
 import {
   loadEnv
 } from "./chunk-2CR762KB.js";
 import {
   createApiClient
-} from "./chunk-WY6UMJNI.js";
+} from "./chunk-BAQROJO7.js";
 import {
   findProjectRoot,
   getApiUrl,

package/dist/index.js

@@ -219,39 +219,39 @@ async function main() {
     switch (command) {
       // Resource commands
       case "plan":
-        await import("./resources-P7WAHOHR.js").then((m) => m.plan(args.slice(1)));
+        await import("./resources-VM42NAMH.js").then((m) => m.plan(args.slice(1)));
         break;
       case "apply":
-        await import("./resources-P7WAHOHR.js").then((m) => m.apply(args.slice(1)));
+        await import("./resources-VM42NAMH.js").then((m) => m.apply(args.slice(1)));
         break;
       case "pull":
-        await import("./resources-P7WAHOHR.js").then((m) => m.pull(args.slice(1)));
+        await import("./resources-VM42NAMH.js").then((m) => m.pull(args.slice(1)));
         break;
       case "destroy":
-        await import("./resources-P7WAHOHR.js").then((m) => m.destroy(args.slice(1)));
+        await import("./resources-VM42NAMH.js").then((m) => m.destroy(args.slice(1)));
         break;
       case "list":
-        await import("./resources-P7WAHOHR.js").then((m) => m.list(args.slice(1)));
+        await import("./resources-VM42NAMH.js").then((m) => m.list(args.slice(1)));
         break;
       case "show":
-        await import("./resources-P7WAHOHR.js").then((m) => m.show(args.slice(1)));
+        await import("./resources-VM42NAMH.js").then((m) => m.show(args.slice(1)));
         break;
       case "diff":
-        await import("./resources-P7WAHOHR.js").then((m) => m.diff(args.slice(1)));
+        await import("./resources-VM42NAMH.js").then((m) => m.diff(args.slice(1)));
         break;
       // Development
       case "dev":
-        await import("./dev-YYMFCXZ5.js").then((m) => m.dev(args.slice(1)));
+        await import("./dev-GNZ22LKP.js").then((m) => m.dev(args.slice(1)));
         break;
       case "run":
-        await import("./run-C23KZI4Z.js").then((m) => m.run(args.slice(1)));
+        await import("./run-QRFSRZXJ.js").then((m) => m.run(args.slice(1)));
         break;
       // Project
       case "init":
-        await import("./init-7YWMMTBF.js").then((m) => m.init(args.slice(1)));
+        await import("./init-RS2ET656.js").then((m) => m.init(args.slice(1)));
         break;
       case "register":
-        await import("./register-KJMSMMD6.js").then((m) => m.register(args.slice(1)));
+        await import("./register-MLYFAODC.js").then((m) => m.register(args.slice(1)));
         break;
       case "templates":
         await import("./templates-LNUOTNLN.js").then((m) => m.templates(subcommand, args.slice(2)));
@@ -268,7 +268,7 @@ async function main() {
         break;
       // Dependencies
       case "deps":
-        await import("./deps-73XZXRYP.js").then((m) => m.deps(args.slice(1)));
+        await import("./deps-DPB3L3EJ.js").then((m) => m.deps(args.slice(1)));
         break;
       // Auth
       case "login":

package/dist/{init-7YWMMTBF.js → init-RS2ET656.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-BHYDYR75.js";
 import {
   createApiClient
-} from "./chunk-WY6UMJNI.js";
+} from "./chunk-BAQROJO7.js";
 import {
   getToken,
   init_auth,

package/dist/{register-KJMSMMD6.js → register-MLYFAODC.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-BHYDYR75.js";
 import {
   createApiClient
-} from "./chunk-WY6UMJNI.js";
+} from "./chunk-BAQROJO7.js";
 import {
   findProjectRoot,
   getAppName,

package/dist/{resources-P7WAHOHR.js → resources-VM42NAMH.js}

@@ -4,13 +4,13 @@ import {
 import {
   projectResourceDepsEnabled,
   syncDeps
-} from "./chunk-RUJRTLHA.js";
+} from "./chunk-ZDN32JTT.js";
 import {
   loadEnv
 } from "./chunk-2CR762KB.js";
 import {
   createApiClient
-} from "./chunk-WY6UMJNI.js";
+} from "./chunk-BAQROJO7.js";
 import {
   findProjectRoot,
   getApiUrl,
@@ -1847,19 +1847,37 @@ async function planAgents(api, localAgents, projectId) {
   const remoteByExternalId = new Map(
     remoteAgents.filter((a) => a.external_id && !a.managed).map((a) => [a.external_id, a])
   );
-  let skillSlugToId = /* @__PURE__ */ new Map();
-  let skillIdToSlug = /* @__PURE__ */ new Map();
-  const hasSkillRefs = localAgents.some((a) => a.agent.skills && a.agent.skills.length > 0) || remoteAgents.some((a) => a.skill_ids && a.skill_ids.length > 0);
-  if (hasSkillRefs) {
+  const skillSlugToId = /* @__PURE__ */ new Map();
+  const skillIdToSlug = /* @__PURE__ */ new Map();
+  const blockedRefs = /* @__PURE__ */ new Set();
+  const planRefs = [
+    .../* @__PURE__ */ new Set([
+      ...localAgents.flatMap((a) => a.agent.skills ?? []),
+      ...remoteAgents.flatMap((a) => a.skill_ids ?? [])
+    ])
+  ];
+  if (planRefs.length > 0) {
     try {
-      const skills = await api.listAgentSkills();
-      skillSlugToId = new Map(skills.map((s) => [s.slug, s.id]));
-      skillIdToSlug = new Map(skills.map((s) => [s.id, s.slug]));
+      const skills = await api.lookupAgentSkills(planRefs);
+      for (const s of skills) {
+        skillIdToSlug.set(s.id, s.slug);
+        if (isAvailableToCustomAgents(s)) {
+          skillSlugToId.set(s.slug, s.id);
+        } else {
+          blockedRefs.add(s.slug);
+          blockedRefs.add(s.id);
+        }
+      }
     } catch {
     }
   }
   for (const { agent, systemPrompt, policyScript } of localAgents) {
     const remote = remoteByExternalId.get(agent.external_id);
+    for (const ref of agent.skills ?? []) {
+      if (blockedRefs.has(ref)) {
+        console.log(pc2.yellow(`    \u26A0 Skill "${ref}" is a Lumera platform skill, only available to Lumera-built agents \u2014 will be skipped on apply`));
+      }
+    }
     if (!remote) {
       changes.push({ type: "create", resource: "agent", id: agent.external_id, name: agent.name });
     } else {
@@ -1871,7 +1889,7 @@ async function planAgents(api, localAgents, projectId) {
       if ((remote.policy_script || "").trim() !== (policyScript || "").trim()) diffs.push("policy_script");
       if ((remote.policy_enabled || false) !== (agent.policy_enabled || false)) diffs.push("policy_enabled");
       if ((remote.policy_description || "") !== (agent.policy_description || "")) diffs.push("policy_description");
-      const localSkillIds = (agent.skills || []).map((s) => skillSlugToId.get(s) || s).sort();
+      const localSkillIds = (agent.skills || []).filter((s) => !blockedRefs.has(s)).map((s) => skillSlugToId.get(s) || s).sort();
       const remoteSkillIds = [...remote.skill_ids || []].sort();
       if (localSkillIds.join(",") !== remoteSkillIds.join(",")) {
         const addedSlugs = localSkillIds.filter((id) => !remoteSkillIds.includes(id)).map((id) => skillIdToSlug.get(id) || id);
@@ -1895,32 +1913,48 @@ async function planAgents(api, localAgents, projectId) {
   }
   return changes;
 }
+var TAG_AVAILABLE_TO_CUSTOM_AGENTS = "available_to_custom_agents";
+function isAvailableToCustomAgents(skill) {
+  if (!skill.managed) return true;
+  return (skill.tags ?? []).includes(TAG_AVAILABLE_TO_CUSTOM_AGENTS);
+}
 async function applyAgents(api, localAgents, projectId) {
   let errors = 0;
   const remoteAgents = await api.listAgents(projectId ? { project_id: projectId } : void 0);
   const remoteByExternalId = new Map(
     remoteAgents.filter((a) => a.external_id && !a.managed).map((a) => [a.external_id, a])
   );
-  let skillMap = /* @__PURE__ */ new Map();
-  const hasSkillRefs = localAgents.some((a) => a.agent.skills && a.agent.skills.length > 0);
-  if (hasSkillRefs) {
+  const refToId = /* @__PURE__ */ new Map();
+  const blockedRefs = /* @__PURE__ */ new Set();
+  const refs = [...new Set(localAgents.flatMap((a) => a.agent.skills ?? []))];
+  if (refs.length > 0) {
     try {
-      const skills = await api.listAgentSkills();
-      skillMap = new Map(skills.map((s) => [s.slug, s.id]));
+      const skills = await api.lookupAgentSkills(refs);
+      for (const s of skills) {
+        if (isAvailableToCustomAgents(s)) {
+          refToId.set(s.slug, s.id);
+          refToId.set(s.id, s.id);
+        } else {
+          blockedRefs.add(s.slug);
+          blockedRefs.add(s.id);
+        }
+      }
     } catch (e) {
-      console.log(pc2.yellow(`    \u26A0 Could not fetch skills for resolution: ${e}`));
+      console.log(pc2.yellow(`    \u26A0 Could not resolve skills: ${e}`));
     }
   }
   for (const { agent, systemPrompt, policyScript } of localAgents) {
     const remote = remoteByExternalId.get(agent.external_id);
     const skillIds = [];
     if (agent.skills) {
-      for (const slug of agent.skills) {
-        const id = skillMap.get(slug);
+      for (const ref of agent.skills) {
+        const id = refToId.get(ref);
         if (id) {
           skillIds.push(id);
+        } else if (blockedRefs.has(ref)) {
+          console.log(pc2.yellow(`    \u26A0 Skill "${ref}" is a Lumera platform skill, only available to Lumera-built agents \u2014 skipping`));
         } else {
-          console.log(pc2.yellow(`    \u26A0 Skill "${slug}" not found, skipping`));
+          console.log(pc2.yellow(`    \u26A0 Skill "${ref}" not found, skipping (use the slug, e.g. "using-collections")`));
         }
       }
     }
@@ -1955,11 +1989,14 @@ async function pullAgents(api, platformDir, filterName, projectId) {
   const agentsDir = join2(platformDir, "agents");
   mkdirSync(agentsDir, { recursive: true });
   const agents = await api.listAgents(projectId ? { project_id: projectId } : void 0);
-  let skillIdToSlug = /* @__PURE__ */ new Map();
-  try {
-    const skills = await api.listAgentSkills();
-    skillIdToSlug = new Map(skills.map((s) => [s.id, s.slug]));
-  } catch {
+  const skillIdToSlug = /* @__PURE__ */ new Map();
+  const pullRefs = [...new Set(agents.flatMap((a) => a.skill_ids ?? []))];
+  if (pullRefs.length > 0) {
+    try {
+      const skills = await api.lookupAgentSkills(pullRefs);
+      for (const s of skills) skillIdToSlug.set(s.id, s.slug);
+    } catch {
+    }
   }
   for (const agent of agents) {
     if (!agent.external_id || agent.managed) continue;

package/dist/{run-C23KZI4Z.js → run-QRFSRZXJ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2CR762KB.js";
 import {
   createApiClient
-} from "./chunk-WY6UMJNI.js";
+} from "./chunk-BAQROJO7.js";
 import {
   findProjectRoot,
   getApiUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumerahq/cli",
-  "version": "0.19.6",
+  "version": "0.19.8-dev.0",
   "description": "CLI for building and deploying Lumera apps",
   "type": "module",
   "engines": {

package/templates/default/AGENTS.md

@@ -128,7 +128,27 @@ Follow the user's lead. If they tell you exactly what to build, build it. The wo
 ### Rules
 7. **Code is source of truth** — Edit files in `platform/`, then deploy with `lumera apply`. Don't edit in the Lumera UI.
 8. **Keep docs current** — After each slice, update `architecture.md` with what was built (data models, relationships, hook logic, design decisions). Also update the project description at the top of this file (`AGENTS.md`) so it reflects what the project actually does now — not the original template description.
-9. **Commit and push** — After each slice or significant change: `git add -A && git commit -m "descriptive message" && git push`. The sandbox is ephemeral — uncommitted work is lost if recycled.
+9. **Commit and push** — After each slice or significant change, stage your changes, create a meaningful commit with both a title and description, then push. The sandbox is ephemeral — uncommitted work is lost if recycled.
+   - Use a conventional subject (`feat:`, `fix:`, `chore:`, `docs:`, `test:`) that explains the user-visible change, not just the filenames.
+   - Include a body that describes why the change was needed, what you changed, and the main areas covered.
+   - Avoid generic messages like `update files`, `changes`, `WIP`, or filename-only summaries.
+   - Prefer a HEREDOC so multi-line messages are reliable:
+     ```bash
+     git add -A
+     git commit -m "$(cat <<'EOF'
+     feat: add invoice approval dashboard
+
+     Adds the first invoice review slice with a collection schema, seeded
+     example data, and a dashboard for approving or rejecting invoices.
+
+     Covers:
+     - invoice collection fields and statuses
+     - approval actions in the UI
+     - project documentation updates
+     EOF
+     )"
+     git push
+     ```
 10. **Deploy marker** — When your changes need `lumera apply`, include at the end of your response: `<!-- DEPLOY: short commit message -->`. Skip for frontend-only changes.
 
 ## File Artifacts