@lumoai/cli 1.5.0 → 1.5.1

package/dist/cli/src/commands/task-slack-show.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskSlackShow = taskSlackShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo task slack show <LUM-N> <context-id>`
+ *
+ * Tier-2 retrieval for the cheap inline Slack card. Fetches the stored thread
+ * snapshot (no live Slack call) from
+ * `/api/tasks/:id/slack-contexts/:contextId/snapshot` and prints one line per
+ * message as `author: text`, falling back to `@<userId>` when the display name
+ * is missing.
+ */
+async function taskSlackShow(identifier, contextId) {
+    if (!identifier || !contextId) {
+        console.error('Error: usage: lumo task slack show <LUM-42> <context-id>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/tasks/${encodeURIComponent(identifier)}/slack-contexts/${encodeURIComponent(contextId)}/snapshot`, { headers: { Authorization: `Bearer ${creds.token}` } });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: task ${identifier} or slack context ${contextId} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: slack show failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { snapshot } = (await res.json());
+    const messages = snapshot?.messages ?? [];
+    if (messages.length === 0) {
+        console.log('(no messages in stored snapshot)');
+        return;
+    }
+    for (const m of messages) {
+        const author = (0, sanitize_1.sanitizeField)(m.userName ?? '@' + m.userId);
+        console.log(`${author}: ${(0, sanitize_1.sanitizeField)(m.text)}`);
+    }
+}

package/dist/cli/src/commands/task-update.js

@@ -10,6 +10,7 @@ const api_1 = require("../lib/api");
 const task_create_1 = require("./task-create");
 const tag_resolver_1 = require("../lib/tag-resolver");
 const resolve_1 = require("../lib/resolve");
+const sanitize_1 = require("../lib/sanitize");
 const ALLOWED_STATUSES = ['TODO', 'IN_PROGRESS', 'IN_REVIEW', 'DONE'];
 /**
  * Pure function: given the task's current sprint binding and the resolved
@@ -87,10 +88,10 @@ function buildUpdatePayload(opts) {
  * Appends a Tags line when tags are present.
  */
 function formatUpdatedTaskLine(task) {
-    const escapedTitle = task.title.replace(/"/g, '\\"');
+    const escapedTitle = (0, sanitize_1.sanitizeField)(task.title).replace(/"/g, '\\"');
     const head = `Updated ${task.identifier} "${escapedTitle}"  ${task.url}`;
     if (task.tags && task.tags.length > 0) {
-        return `${head}\nTags: ${task.tags.join(', ')}`;
+        return `${head}\nTags: ${task.tags.map(sanitize_1.sanitizeField).join(', ')}`;
     }
     return head;
 }
@@ -146,8 +147,7 @@ async function taskUpdate(identifier, opts) {
         console.error('Error: not logged in. Run `lumo auth login` first.');
         return 1;
     }
-    const envUrl = process.env.LUMO_API_URL?.trim();
-    const apiUrl = envUrl && envUrl.length > 0 ? envUrl : creds.apiUrl;
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
     // Resolve tag refs into ids
     let tagIds;
     let addTagIds;
@@ -235,7 +235,7 @@ async function taskUpdate(identifier, opts) {
                 // Body wasn't JSON; fall through to status-only message
             }
             if (serverMsg) {
-                console.error(`Error: ${serverMsg}`);
+                console.error(`Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`);
             }
             else {
                 console.error(`Error: task update failed (HTTP ${res.status})`);
@@ -365,7 +365,7 @@ async function taskUpdate(identifier, opts) {
                         errMsg = b.error;
                 }
                 catch { /* ignore */ }
-                console.error(`Error: ${errMsg}`);
+                console.error(`Error: ${(0, sanitize_1.sanitizeField)(errMsg)}`);
                 return 1;
             }
             const oldLabel = oldNumber !== null ? `#${oldNumber}` : action.oldSprintId;
@@ -397,7 +397,7 @@ async function taskUpdate(identifier, opts) {
                         errMsg = b.error;
                 }
                 catch { /* ignore */ }
-                console.error(`Error: ${errMsg}`);
+                console.error(`Error: ${(0, sanitize_1.sanitizeField)(errMsg)}`);
                 return 1;
             }
             // resolvedSprintNumber is set from the resolveSprintId call above

package/dist/cli/src/commands/task-web-show.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskWebShow = taskWebShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo task web show <LUM-N> <link-id>`
+ *
+ * Tier-2 retrieval for the cheap inline WebLink card. Fetches the page body
+ * (cached, or fetched behind the SSRF guard on first read) from
+ * `/api/tasks/:id/web-links/:linkId/body` and prints it as plain text.
+ */
+async function taskWebShow(identifier, linkId) {
+    if (!identifier || !linkId) {
+        console.error('Error: usage: lumo task web show <LUM-42> <link-id>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/tasks/${encodeURIComponent(identifier)}/web-links/${encodeURIComponent(linkId)}/body`, { headers: { Authorization: `Bearer ${creds.token}` } });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: task ${identifier} or web link ${linkId} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        let serverMsg = null;
+        try {
+            const errBody = (await res.json());
+            if (typeof errBody.error === 'string')
+                serverMsg = errBody.error;
+        }
+        catch {
+            /* not JSON */
+        }
+        console.error(serverMsg
+            ? `Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`
+            : `Error: web show failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { body } = (await res.json());
+    if (!body || body.trim().length === 0) {
+        console.log('(empty body)');
+        return;
+    }
+    console.log((0, sanitize_1.sanitizeField)(body));
+}

package/dist/cli/src/commands/whoami.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.whoami = whoami;
 const config_1 = require("../lib/config");
+const sanitize_1 = require("../lib/sanitize");
 async function whoami() {
     const creds = (0, config_1.readCredentials)();
     if (!creds) {
@@ -9,8 +10,8 @@ async function whoami() {
         console.log('Run `lumo auth login` to log in');
         return 1;
     }
-    console.log(`Logged in as ${creds.email}`);
-    console.log(`  Workspace: ${creds.workspaceName} (${creds.workspaceSlug})`);
-    console.log(`  Key: ${creds.apiKeyName} (${creds.apiKeyPrefix})`);
+    console.log(`Logged in as ${(0, sanitize_1.sanitizeField)(creds.email)}`);
+    console.log(`  Workspace: ${(0, sanitize_1.sanitizeField)(creds.workspaceName)} (${creds.workspaceSlug})`);
+    console.log(`  Key: ${(0, sanitize_1.sanitizeField)(creds.apiKeyName)} (${creds.apiKeyPrefix})`);
     console.log(`  API: ${creds.apiUrl}`);
 }

package/dist/cli/src/index.js

@@ -66,6 +66,11 @@ const task_artifact_list_1 = require("./commands/task-artifact-list");
 const task_artifact_show_1 = require("./commands/task-artifact-show");
 const task_artifact_rm_1 = require("./commands/task-artifact-rm");
 const task_artifact_update_1 = require("./commands/task-artifact-update");
+const task_slack_show_1 = require("./commands/task-slack-show");
+const task_web_show_1 = require("./commands/task-web-show");
+const task_figma_context_1 = require("./commands/task-figma-context");
+const task_comment_list_1 = require("./commands/task-comment-list");
+const task_pr_show_1 = require("./commands/task-pr-show");
 const project_list_1 = require("./commands/project-list");
 const milestone_list_1 = require("./commands/milestone-list");
 const milestone_create_1 = require("./commands/milestone-create");
@@ -83,6 +88,8 @@ const sprint_summary_1 = require("./commands/sprint-summary");
 const sprint_add_1 = require("./commands/sprint-add");
 const sprint_remove_1 = require("./commands/sprint-remove");
 const doc_create_1 = require("./commands/doc-create");
+const doc_import_gdoc_1 = require("./commands/doc-import-gdoc");
+const doc_sync_1 = require("./commands/doc-sync");
 const doc_update_1 = require("./commands/doc-update");
 const doc_show_1 = require("./commands/doc-show");
 const doc_list_1 = require("./commands/doc-list");
@@ -96,6 +103,7 @@ const doc_move_1 = require("./commands/doc-move");
 const update_1 = require("./commands/update");
 const setup_1 = require("./commands/setup");
 const update_check_1 = require("./lib/update-check");
+const sanitize_1 = require("./lib/sanitize");
 // Resolve package.json relative to __dirname so this works regardless of how
 // deep the compiled output ends up (flat dist/ or nested dist/cli/src/).
 const pkg = require(path.resolve(__dirname, '../../..', 'package.json'));
@@ -138,7 +146,7 @@ function wrap(fn) {
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            console.error(`Error: ${msg}`);
+            console.error(`Error: ${(0, sanitize_1.sanitizeField)(msg)}`);
             process.exit(1);
         }
     };
@@ -170,6 +178,7 @@ program
     .option('--user', 'Install into ~/.claude (applies across all projects for this user)')
     .option('--project', 'Install into ./.claude (applies to the current project only)')
     .option('--force', 'Overwrite an existing SKILL.md when its contents differ from the bundled version')
+    .option('--agent <token>', 'Coding agent these hooks run under (claude-code, codex, cursor, gemini-cli, github-copilot, windsurf). Baked into every hook command. Defaults to claude-code.')
     .action(wrap(options => (0, setup_1.setup)(options)));
 const session = program
     .command('session')
@@ -243,6 +252,38 @@ taskFigma
     .command('refresh <task>')
     .description('Re-fetch Figma metadata + thumbnail for every link on this task. Per-link failures isolated.')
     .action(wrap((taskId) => (0, task_figma_refresh_1.taskFigmaRefresh)({ identifier: taskId })));
+// Tier-2 retrieval commands (LUM-122). `task context` prints the matching
+// command at the end of each cheap inline card; the agent runs it to pull the
+// full content on demand.
+const taskSlack = task.command('slack').description('Inspect Slack context');
+taskSlack
+    .command('show <identifier> <contextId>')
+    .description('Show the full stored Slack thread snapshot')
+    .action(wrap((id, ctx) => (0, task_slack_show_1.taskSlackShow)(id, ctx)));
+const taskWeb = task.command('web').description('Inspect web link content');
+taskWeb
+    .command('show <identifier> <linkId>')
+    .description('Show the fetched web link body as plain text')
+    .action(wrap((id, link) => (0, task_web_show_1.taskWebShow)(id, link)));
+// taskFigma already exists above → attach the context leaf to it.
+taskFigma
+    .command('context <identifier> <linkId>')
+    .description('Show the cached Figma design context (metadata)')
+    .action(wrap((id, link) => (0, task_figma_context_1.taskFigmaContext)(id, link)));
+// Plural `comments` parent: `task comment <id> <body>` already exists for
+// adding a comment, and commander disallows a duplicate name.
+const taskComments = task
+    .command('comments')
+    .description('Inspect the full task comment thread');
+taskComments
+    .command('list <identifier>')
+    .description('List the full task comment thread')
+    .action(wrap(id => (0, task_comment_list_1.taskCommentList)(id)));
+const taskPr = task.command('pr').description('Inspect linked PRs');
+taskPr
+    .command('show <identifier> <number>')
+    .description('Show the synced PR record (diff/review comments when available)')
+    .action(wrap((id, num) => (0, task_pr_show_1.taskPrShow)(id, num)));
 const taskMemory = task
     .command('memory')
     .description('View and record memories scoped to a task');
@@ -269,6 +310,7 @@ taskMemory
     .option('--applies <text>', 'convention: where the rule applies')
     .option('--workflow <text>', 'procedural: the workflow name')
     .option('--step <text>', 'procedural: a step (repeatable)', collect, [])
+    .option('--agent <agent>', 'Producing agent: claude-code | codex | cursor | gemini-cli | github-copilot | windsurf (default claude-code)')
     .action(wrap((taskArg, opts) => (0, memory_task_add_1.memoryTaskAdd)(taskArg, opts)));
 const taskArtifact = task
     .command('artifact')
@@ -334,6 +376,7 @@ projectMemory
     .option('--applies <text>', 'convention: where it applies')
     .option('--workflow <text>', 'procedural workflow')
     .option('--step <text>', 'procedural step (repeatable)', collect, [])
+    .option('--agent <agent>', 'Producing agent: claude-code | codex | cursor | gemini-cli | github-copilot | windsurf (default claude-code)')
     .action(wrap((p, opts) => (0, memory_project_add_1.memoryProjectAdd)(p, opts)));
 const memoryCmd = program
     .command('memory')
@@ -463,6 +506,16 @@ doc
     .option('--tag <name>', 'Attach tag by name (repeatable)', collect, [])
     .option('--tag-id <cuid>', 'Attach tag by id (repeatable)', collect, [])
     .action(wrap((title, opts) => (0, doc_create_1.docCreate)(title, opts)));
+doc
+    .command('import-gdoc <url>')
+    .description('Import a Google Doc as a Lumo doc (one-way Google → Lumo)')
+    .option('--scope <scope>', 'personal | workspace (default: personal)')
+    .option('--task <LUM-N>', 'Bind the imported doc to this task')
+    .action(wrap((url, opts) => (0, doc_import_gdoc_1.docImportGdoc)(url, opts)));
+doc
+    .command('sync <doc>')
+    .description('Re-sync a Google-imported doc (overwrites the Lumo body)')
+    .action(wrap(ref => (0, doc_sync_1.docSync)(ref)));
 doc
     .command('update <doc>')
     .description('Update an existing document. <doc> accepts a cuid or a case-insensitive title (ambiguous titles fail with candidates). Replacement body comes from --content, --file, or piped stdin (pick one). --tag/--tag-id (bulk replace) cannot be combined with --add-tag/--add-tag-id/--remove-tag/--remove-tag-id.')
@@ -551,110 +604,122 @@ task
 const hook = program
     .command('hook')
     .description('Claude Code hook ingestion (invoked by settings.json, not humans)');
-hook
-    .command('pre-tool-use')
-    .description('Forward a PreToolUse hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('pre-tool-use')));
-hook
-    .command('post-tool-use')
-    .description('Forward a PostToolUse hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('post-tool-use')));
-hook
-    .command('post-tool-use-failure')
-    .description('Forward a PostToolUseFailure hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('post-tool-use-failure')));
-hook
-    .command('user-prompt-submit')
-    .description('Forward a UserPromptSubmit hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('user-prompt-submit')));
-hook
-    .command('stop')
-    .description('Forward a Stop hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('stop')));
-hook
-    .command('stop-failure')
-    .description('Forward a StopFailure hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('stop-failure')));
-hook
-    .command('permission-request')
-    .description('Forward a PermissionRequest hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('permission-request')));
-hook
-    .command('permission-denied')
-    .description('Forward a PermissionDenied hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('permission-denied')));
-hook
-    .command('session-start')
-    .description('Forward a SessionStart hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('session-start')));
-hook
-    .command('session-end')
-    .description('Forward a SessionEnd hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('session-end')));
-hook
-    .command('subagent-start')
-    .description('Forward a SubagentStart hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('subagent-start')));
-hook
-    .command('subagent-stop')
-    .description('Forward a SubagentStop hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('subagent-stop')));
-hook
-    .command('worktree-create')
-    .description('Forward a WorktreeCreate hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('worktree-create')));
-hook
-    .command('worktree-remove')
-    .description('Forward a WorktreeRemove hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('worktree-remove')));
-hook
-    .command('file-changed')
-    .description('Forward a FileChanged hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('file-changed')));
-hook
-    .command('config-change')
-    .description('Forward a ConfigChange hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('config-change')));
-hook
-    .command('task-created')
-    .description('Forward a TaskCreated hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('task-created')));
-hook
-    .command('task-completed')
-    .description('Forward a TaskCompleted hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('task-completed')));
-hook
-    .command('post-tool-batch')
-    .description('Forward a PostToolBatch hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('post-tool-batch')));
-hook
-    .command('user-prompt-expansion')
-    .description('Forward a UserPromptExpansion hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('user-prompt-expansion')));
-hook
-    .command('notification')
-    .description('Forward a Notification hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('notification')));
-hook
-    .command('elicitation')
-    .description('Forward an Elicitation hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('elicitation')));
-hook
-    .command('elicitation-result')
-    .description('Forward an ElicitationResult hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('elicitation-result')));
-hook
-    .command('cwd-changed')
-    .description('Forward a CwdChanged hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('cwd-changed')));
-hook
-    .command('instructions-loaded')
-    .description('Forward an InstructionsLoaded hook event to Lumo (reads JSON from stdin)')
-    .action(wrap(() => (0, hook_1.hookCommand)('instructions-loaded')));
+// Slug → help-text for every `lumo hook <slug>` subcommand. Each one accepts
+// an optional `--agent <token>` flag (baked into settings.json by `lumo setup
+// --agent <token>`); the value rides to the server as the X-Lumo-Agent header
+// so auto-sedimented memories are attributed to the agent that produced them.
+// Keep this list in sync with LUMO_HOOK_EVENTS (cli/src/lib/hooks-template.ts)
+// and the server-side HookEventType slugs.
+const HOOK_SUBCOMMANDS = [
+    [
+        'pre-tool-use',
+        'Forward a PreToolUse hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'post-tool-use',
+        'Forward a PostToolUse hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'post-tool-use-failure',
+        'Forward a PostToolUseFailure hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'user-prompt-submit',
+        'Forward a UserPromptSubmit hook event to Lumo (reads JSON from stdin)',
+    ],
+    ['stop', 'Forward a Stop hook event to Lumo (reads JSON from stdin)'],
+    [
+        'stop-failure',
+        'Forward a StopFailure hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'permission-request',
+        'Forward a PermissionRequest hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'permission-denied',
+        'Forward a PermissionDenied hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'session-start',
+        'Forward a SessionStart hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'session-end',
+        'Forward a SessionEnd hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'subagent-start',
+        'Forward a SubagentStart hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'subagent-stop',
+        'Forward a SubagentStop hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'worktree-create',
+        'Forward a WorktreeCreate hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'worktree-remove',
+        'Forward a WorktreeRemove hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'file-changed',
+        'Forward a FileChanged hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'config-change',
+        'Forward a ConfigChange hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'task-created',
+        'Forward a TaskCreated hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'task-completed',
+        'Forward a TaskCompleted hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'post-tool-batch',
+        'Forward a PostToolBatch hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'user-prompt-expansion',
+        'Forward a UserPromptExpansion hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'notification',
+        'Forward a Notification hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'elicitation',
+        'Forward an Elicitation hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'elicitation-result',
+        'Forward an ElicitationResult hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'cwd-changed',
+        'Forward a CwdChanged hook event to Lumo (reads JSON from stdin)',
+    ],
+    [
+        'instructions-loaded',
+        'Forward an InstructionsLoaded hook event to Lumo (reads JSON from stdin)',
+    ],
+];
+for (const [slug, description] of HOOK_SUBCOMMANDS) {
+    hook
+        .command(slug)
+        .description(description)
+        .option('--agent <token>', 'Coding agent that owns this session (e.g. claude-code, codex). Baked in by `lumo setup --agent`.')
+        .action(wrap((opts) => (0, hook_1.hookCommand)(slug, opts.agent)));
+}
 if (!isUpdateCheckWorker) {
     program.parseAsync(process.argv).catch(err => {
         const msg = err instanceof Error ? err.message : String(err);
-        console.error(`Error: ${msg}`);
+        console.error(`Error: ${(0, sanitize_1.sanitizeField)(msg)}`);
         process.exit(1);
     });
 }

package/dist/cli/src/lib/agent.js

@@ -5,7 +5,7 @@
  * mirrored here. Keep in sync with prisma `enum TaskArtifactAgent`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VALID_AGENT_TOKENS = exports.AGENT_LABELS = void 0;
+exports.VALID_AGENT_TOKENS = exports.ENUM_TO_TOKEN = exports.AGENT_LABELS = void 0;
 exports.normalizeAgent = normalizeAgent;
 /** enum value → display label (matches lib/i18n en.json taskArtifact.agent.*) */
 exports.AGENT_LABELS = {
@@ -16,6 +16,15 @@ exports.AGENT_LABELS = {
     GITHUB_COPILOT: 'GitHub Copilot',
     WINDSURF: 'Windsurf',
 };
+/** enum value → canonical CLI token (inverse of the non-alias TOKEN_TO_ENUM rows) */
+exports.ENUM_TO_TOKEN = {
+    CLAUDE_CODE: 'claude-code',
+    CODEX: 'codex',
+    CURSOR: 'cursor',
+    GEMINI_CLI: 'gemini-cli',
+    GITHUB_COPILOT: 'github-copilot',
+    WINDSURF: 'windsurf',
+};
 /** accepted CLI token (normalized) → enum value */
 const TOKEN_TO_ENUM = {
     'claude-code': 'CLAUDE_CODE',