lua-cli 3.16.0 → 3.16.2

package/dist/index.js

@@ -4122,8 +4122,12 @@ var init_tool_plugin = __esm({
       displayName = "Tool";
       defineFunction = "defineTool";
       legacyClassNames = [
-        "LuaTool"
+        "LuaTool",
+        "LuaVoiceTool"
       ];
+      crossFileRewrite = {
+        copyAllFields: true
+      };
       supportsClassDefinition = true;
       /**
       * Extract metadata from a `defineTool({...})` / `new LuaTool({...})`
@@ -4298,6 +4302,9 @@ var init_job_plugin = __esm({
       legacyClassNames = [
         "LuaJob"
       ];
+      crossFileRewrite = {
+        copyAllFields: true
+      };
       supportsClassDefinition = true;
       /**
       * Class-definition extraction. Reads `name`/`description`/`schedule`/
@@ -4479,6 +4486,9 @@ var init_webhook_plugin = __esm({
       legacyClassNames = [
         "LuaWebhook"
       ];
+      crossFileRewrite = {
+        copyAllFields: true
+      };
       supportsClassDefinition = true;
       /**
       * Class-definition shape: read fields off the inheritance chain
@@ -4705,6 +4715,9 @@ var init_preprocessor_plugin = __esm({
         "PreProcessor",
         "LuaPreprocessor"
       ];
+      crossFileRewrite = {
+        copyAllFields: true
+      };
       /**
       * Class-definition extraction. Reads `name`/`description`/`async`/
       * `priority`/`execute` off the inheritance chain (most-derived wins).
@@ -4788,6 +4801,9 @@ var init_postprocessor_plugin = __esm({
         "PostProcessor",
         "LuaPostprocessor"
       ];
+      crossFileRewrite = {
+        copyAllFields: true
+      };
       /**
       * Class-definition extraction. Reads `name`/`description`/`priority`/
       * `execute` off the inheritance chain.
@@ -4863,6 +4879,9 @@ var init_mcp_server_plugin = __esm({
       legacyClassNames = [
         "LuaMCPServer"
       ];
+      crossFileRewrite = {
+        copyAllFields: true
+      };
       supportsClassDefinition = true;
       /**
       * Class-definition extraction. Reads `name`/`description`/`transport`/
@@ -6256,6 +6275,22 @@ var init_skill_plugin = __esm({
       legacyClassNames = [
         "LuaSkill"
       ];
+      // Whitelist drops `tools` for the same reasons agent drops skills/webhooks/jobs:
+      //   1. Bundle size — preserving class references drags tool source files into
+      //      the parent bundle.
+      //   2. Residual super-edge cases — `stripSuperCallsInConstructors` covers
+      //      top-level `super(...)` only; `super.method()` mid-constructor and
+      //      `field = super.x` survive a strip and explode at runtime.
+      // MAINTENANCE: this whitelist also assumes skills are JSON-only artifacts (via
+      // `buildArtifact`). If skills ever migrate to bundled JS, this drop will silently
+      // lose `tools` from skill bundles — re-evaluate.
+      crossFileRewrite = {
+        fields: [
+          "name",
+          "description",
+          "context"
+        ]
+      };
       supportsClassDefinition = true;
       /**
       * Class-definition extraction. Reads `name`/`description`/`context`/
@@ -6647,6 +6682,22 @@ var init_agent_plugin = __esm({
       legacyClassNames = [
         "LuaAgent"
       ];
+      // Whitelist (not copyAllFields). Two reasons, both real:
+      //   1. Bundle size — `skills`/`webhooks`/`jobs`/etc. hold CLASS references;
+      //      preserving them drags every subclass source file into the agent bundle.
+      //   2. Residual super-edge cases — `stripSuperCallsInConstructors` handles
+      //      top-level `super(...)`, but NOT `super.method()` mid-constructor or
+      //      `field = super.x` initializers, both of which still orphan after
+      //      `stripSdkExtendsClauses` runs on dragged-in files.
+      // Agent runtime only needs name/persona/model; references are resolved by `resolveArrayRefs`.
+      crossFileRewrite = {
+        fields: [
+          "name",
+          "description",
+          "persona",
+          "model"
+        ]
+      };
       supportsClassDefinition = true;
       /**
       * Class-definition extraction. Reads the agent's own metadata
@@ -6993,6 +7044,9 @@ var init_device_plugin = __esm({
       legacyClassNames = [
         "LuaDevice"
       ];
+      crossFileRewrite = {
+        copyAllFields: true
+      };
       supportsClassDefinition = true;
       /**
       * Class-definition extraction. Reads `name`/`description`/`group`
@@ -7115,6 +7169,9 @@ var init_device_trigger_plugin = __esm({
       legacyClassNames = [
         "LuaDeviceTrigger"
       ];
+      crossFileRewrite = {
+        copyAllFields: true
+      };
       supportsClassDefinition = true;
       /**
       * Class-definition extraction. Reads `name`/`description`/has-flags
@@ -7255,13 +7312,355 @@ var init_device_trigger_plugin = __esm({
   }
 });
 
+// src/compiler/utils/primitive-rewrite.ts
+import { readFileSync as readFileSync8 } from "fs";
+import { Node as Node14, Project, ts as ts3 } from "ts-morph";
+function rewritePrimitiveSource(metadata, opts) {
+  const sourceCode = readFileSync8(metadata.sourcePath, "utf-8");
+  const localProject = new Project({
+    useInMemoryFileSystem: true,
+    compilerOptions: {
+      allowJs: true,
+      target: 99,
+      module: 99
+    }
+  });
+  const sf = localProject.createSourceFile(`__rewrite_${metadata.kind}_${metadata.name}.ts`, sourceCode);
+  const isPrimitiveCall = /* @__PURE__ */ __name((n) => {
+    if (Node14.isNewExpression(n)) {
+      const callee = n.getExpression();
+      return Node14.isIdentifier(callee) && opts.constructorNames.includes(callee.getText());
+    }
+    if (Node14.isCallExpression(n)) {
+      const callee = n.getExpression();
+      return Node14.isIdentifier(callee) && opts.defineFunctionName !== void 0 && callee.getText() === opts.defineFunctionName;
+    }
+    return false;
+  }, "isPrimitiveCall");
+  const callNode = findCallByExportName(sf, metadata, isPrimitiveCall);
+  if (!callNode) {
+    throw new Error(`Primitive call for export "${metadata.exportName}" (kind=${metadata.kind}) not found in ${metadata.sourcePath}`);
+  }
+  const arg = callNode.getArguments()[0];
+  if (!arg || !Node14.isObjectLiteralExpression(arg)) {
+    throw new Error(`Primitive config arg is not an object literal in ${metadata.sourcePath}`);
+  }
+  const synthesized = opts.buildLiteral(arg, {
+    metadata,
+    compilerVersion: COMPILER_VERSION
+  });
+  callNode.replaceWithText(synthesized);
+  sf.forEachDescendant((n) => {
+    if (n === callNode) return;
+    if (isPrimitiveCall(n)) n.replaceWithText("undefined");
+  });
+  rewriteCrossFileCallsInSourceFile(sf, opts.crossFileSpecs, opts.sdkBaseClassNames);
+  stripLuaCliImports(sf);
+  ensureDefaultExport(sf, metadata);
+  return sf.getText();
+}
+function rewriteCrossFileCallsInSourceFile(sf, specs, sdkBaseClassNames) {
+  warnUnsupportedNamespaceImports(sf);
+  const sdkIdentifiers = new Set(sdkBaseClassNames);
+  for (const spec of specs) {
+    if (spec.defineFunction) sdkIdentifiers.add(spec.defineFunction);
+  }
+  const aliasMap = buildSdkAliasMap(sf, sdkIdentifiers);
+  let progressed = true;
+  while (progressed) {
+    progressed = false;
+    const callNode = findFirstCrossFileSdkCall(sf, specs, aliasMap);
+    if (!callNode) break;
+    const spec = callNode.spec;
+    const node = callNode.node;
+    const arg = node.getArguments()[0];
+    const objArg = arg && Node14.isObjectLiteralExpression(arg) ? arg : void 0;
+    node.replaceWithText(buildBareObjectLiteral(spec, objArg));
+    progressed = true;
+  }
+  stripSdkExtendsClauses(sf, sdkBaseClassNames, aliasMap);
+}
+function warnUnsupportedNamespaceImports(sf) {
+  for (const imp of sf.getImportDeclarations()) {
+    const spec = imp.getModuleSpecifierValue();
+    if (spec !== "lua-cli" && spec !== "lua-cli/skill" && spec !== "lua-cli/voice") continue;
+    const ns = imp.getNamespaceImport();
+    if (!ns) continue;
+    const localName = ns.getText();
+    const pos = sf.getLineAndColumnAtPos(imp.getStart());
+    console.warn(formatSarifWarning({
+      ruleId: "lua/unsupported-namespace-import",
+      filePath: sf.getFilePath(),
+      line: pos.line,
+      column: pos.column,
+      message: `namespace import \`import * as ${localName} from '${spec}'\` is not supported by the cross-file rewrite. \`new ${localName}.X({...})\` calls will leak \`${localName}\` into the bundle as an undefined identifier.`,
+      hint: `Use named imports instead: \`import { LuaTool, LuaWebhook, ... } from '${spec}'\`.`
+    }));
+  }
+}
+function stripSdkExtendsClauses(sf, sdkBaseClassNames, aliasMap) {
+  const matchesSdkClass = /* @__PURE__ */ __name((text) => {
+    const canonical = aliasMap.get(text) ?? text;
+    return sdkBaseClassNames.has(canonical);
+  }, "matchesSdkClass");
+  for (const classDecl of sf.getClasses()) {
+    const ext = classDecl.getExtends();
+    if (!ext) continue;
+    const expr = ext.getExpression();
+    if (!Node14.isIdentifier(expr)) continue;
+    if (matchesSdkClass(expr.getText())) {
+      classDecl.removeExtends();
+      stripSuperCallsInConstructors(classDecl);
+    }
+  }
+  sf.forEachDescendant((n) => {
+    if (!Node14.isClassExpression(n)) return;
+    const ext = n.getExtends();
+    if (!ext) return;
+    const expr = ext.getExpression();
+    if (!Node14.isIdentifier(expr)) return;
+    if (matchesSdkClass(expr.getText())) {
+      n.removeExtends();
+      stripSuperCallsInConstructors(n);
+    }
+  });
+}
+function stripSuperCallsInConstructors(classNode) {
+  for (const ctor of classNode.getConstructors()) {
+    const body = ctor.getBody();
+    if (!body || !Node14.isBlock(body)) continue;
+    const toRemove = [];
+    for (const stmt of body.getStatements()) {
+      if (!Node14.isExpressionStatement(stmt)) continue;
+      const expr = stmt.getExpression();
+      if (!Node14.isCallExpression(expr)) continue;
+      if (expr.getExpression().getKind() !== ts3.SyntaxKind.SuperKeyword) continue;
+      toRemove.push(stmt);
+    }
+    for (const stmt of toRemove) stmt.remove();
+  }
+  warnRemainingSuperReferences(classNode);
+}
+function warnRemainingSuperReferences(classNode) {
+  const sf = classNode.getSourceFile();
+  classNode.forEachDescendant((n) => {
+    if (n.getKind() !== ts3.SyntaxKind.SuperKeyword) return;
+    const parent = n.getParent();
+    if (parent && Node14.isCallExpression(parent) && parent.getExpression() === n && Node14.isExpressionStatement(parent.getParent())) {
+      return;
+    }
+    const pos = sf.getLineAndColumnAtPos(n.getStart());
+    console.warn(formatSarifWarning({
+      ruleId: "lua/orphan-super-reference",
+      filePath: sf.getFilePath(),
+      line: pos.line,
+      column: pos.column,
+      message: `\`super\` reference will become orphan after the SDK base class is stripped from the bundle. The compiled artifact will throw \`SyntaxError: 'super' keyword is only allowed in a derived class\` at sandbox eval.`,
+      hint: `Move the override into a class field initializer (the canonical subclass-with-field-override pattern), or stop subclassing the SDK base and use the \`defineX({...})\` / \`new LuaX({...})\` form.`
+    }));
+  });
+}
+function buildSdkAliasMap(sf, sdkIdentifiers) {
+  const map = /* @__PURE__ */ new Map();
+  for (const imp of sf.getImportDeclarations()) {
+    const spec = imp.getModuleSpecifierValue();
+    if (spec !== "lua-cli" && spec !== "lua-cli/skill" && spec !== "lua-cli/voice") continue;
+    for (const named of imp.getNamedImports()) {
+      const exported = named.getName();
+      const alias = named.getAliasNode()?.getText();
+      if (!sdkIdentifiers.has(exported)) continue;
+      const local = alias ?? exported;
+      map.set(local, exported);
+    }
+  }
+  let progressed = true;
+  while (progressed) {
+    progressed = false;
+    for (const vd of sf.getVariableDeclarations()) {
+      const init = vd.getInitializer();
+      if (!init || !Node14.isIdentifier(init)) continue;
+      const name = vd.getName();
+      if (map.has(name)) continue;
+      const initText = init.getText();
+      const canonical = map.get(initText) ?? (sdkIdentifiers.has(initText) ? initText : void 0);
+      if (canonical) {
+        map.set(name, canonical);
+        progressed = true;
+      }
+    }
+  }
+  return map;
+}
+function findFirstCrossFileSdkCall(sf, specs, aliasMap) {
+  let found;
+  sf.forEachDescendant((n) => {
+    if (found) return;
+    if (Node14.isNewExpression(n)) {
+      const callee = n.getExpression();
+      if (!Node14.isIdentifier(callee)) return;
+      const canonical = aliasMap.get(callee.getText()) ?? callee.getText();
+      const spec = specs.find((s) => s.classNames.includes(canonical));
+      if (spec) found = {
+        node: n,
+        spec
+      };
+    } else if (Node14.isCallExpression(n)) {
+      const callee = n.getExpression();
+      if (!Node14.isIdentifier(callee)) return;
+      const canonical = aliasMap.get(callee.getText()) ?? callee.getText();
+      const spec = specs.find((s) => s.defineFunction !== void 0 && s.defineFunction === canonical);
+      if (spec) found = {
+        node: n,
+        spec
+      };
+    }
+  });
+  return found;
+}
+function buildBareObjectLiteral(spec, arg) {
+  if (!arg) return "{}";
+  if (spec.mode === "copyAllFields") {
+    return arg.getText();
+  }
+  const parts = [];
+  for (const f of spec.fields) {
+    const prop = arg.getProperty(f);
+    if (prop && Node14.isPropertyAssignment(prop)) {
+      const init = prop.getInitializer();
+      if (init) parts.push(`${f}: ${init.getText()}`);
+    } else if (prop && Node14.isShorthandPropertyAssignment(prop)) {
+      parts.push(`${f}: ${prop.getName()}`);
+    }
+  }
+  return `{ ${parts.join(", ")} }`;
+}
+function findCallByExportName(sf, metadata, isPrimitiveCall) {
+  if (metadata.isDefaultExport) {
+    for (const stmt of sf.getStatements()) {
+      if (!Node14.isExportAssignment(stmt)) continue;
+      const expr = stmt.getExpression();
+      if (isPrimitiveCall(expr)) return expr;
+      if (Node14.isIdentifier(expr)) {
+        const varDecl2 = sf.getVariableDeclaration(expr.getText());
+        const init2 = varDecl2?.getInitializer();
+        if (init2 && isPrimitiveCall(init2)) return init2;
+      }
+    }
+    return void 0;
+  }
+  const varDecl = sf.getVariableDeclaration(metadata.exportName);
+  const init = varDecl?.getInitializer();
+  if (init && isPrimitiveCall(init)) return init;
+  return void 0;
+}
+function stripLuaCliImports(sf) {
+  for (const imp of sf.getImportDeclarations()) {
+    const spec = imp.getModuleSpecifierValue();
+    if (spec === "lua-cli" || spec === "lua-cli/skill" || spec === "lua-cli/voice") {
+      imp.remove();
+    }
+  }
+}
+function ensureDefaultExport(sf, metadata) {
+  if (metadata.isDefaultExport) return;
+  const existingDefault = sf.getStatements().find(Node14.isExportAssignment);
+  if (!existingDefault) {
+    sf.addStatements(`
+export default ${metadata.exportName};`);
+    return;
+  }
+  const expr = existingDefault.getExpression();
+  const alreadyCorrect = Node14.isIdentifier(expr) && expr.getText() === metadata.exportName;
+  if (!alreadyCorrect) {
+    existingDefault.remove();
+    sf.addStatements(`
+export default ${metadata.exportName};`);
+  }
+}
+function getPropertyText(arg, name) {
+  const prop = arg.getProperty(name);
+  if (prop && Node14.isPropertyAssignment(prop)) {
+    return prop.getInitializer()?.getText();
+  }
+  if (prop && Node14.isShorthandPropertyAssignment(prop)) {
+    return prop.getName();
+  }
+  return void 0;
+}
+function buildLuaPrimitiveMarker(metadata, kind) {
+  return `__lua_primitive__: { version: ${JSON.stringify(COMPILER_VERSION)}, kind: '${kind}', name: ${JSON.stringify(metadata.name)}, description: ${JSON.stringify(metadata.description)}, exportName: ${JSON.stringify(metadata.exportName)} }`;
+}
+var init_primitive_rewrite = __esm({
+  "src/compiler/utils/primitive-rewrite.ts"() {
+    "use strict";
+    init_types();
+    init_reference_resolver();
+    __name(rewritePrimitiveSource, "rewritePrimitiveSource");
+    __name(rewriteCrossFileCallsInSourceFile, "rewriteCrossFileCallsInSourceFile");
+    __name(warnUnsupportedNamespaceImports, "warnUnsupportedNamespaceImports");
+    __name(stripSdkExtendsClauses, "stripSdkExtendsClauses");
+    __name(stripSuperCallsInConstructors, "stripSuperCallsInConstructors");
+    __name(warnRemainingSuperReferences, "warnRemainingSuperReferences");
+    __name(buildSdkAliasMap, "buildSdkAliasMap");
+    __name(findFirstCrossFileSdkCall, "findFirstCrossFileSdkCall");
+    __name(buildBareObjectLiteral, "buildBareObjectLiteral");
+    __name(findCallByExportName, "findCallByExportName");
+    __name(stripLuaCliImports, "stripLuaCliImports");
+    __name(ensureDefaultExport, "ensureDefaultExport");
+    __name(getPropertyText, "getPropertyText");
+    __name(buildLuaPrimitiveMarker, "buildLuaPrimitiveMarker");
+  }
+});
+
+// src/compiler/utils/cross-file-specs.ts
+function buildCrossFileSpecs(plugins = pluginRegistry.getAll()) {
+  const specs = [];
+  for (const plugin of plugins) {
+    if (!plugin.crossFileRewrite) continue;
+    const classNames = [
+      ...plugin.legacyClassNames
+    ];
+    const defineFunction = plugin.defineFunction || void 0;
+    if ("copyAllFields" in plugin.crossFileRewrite && plugin.crossFileRewrite.copyAllFields) {
+      specs.push({
+        classNames,
+        defineFunction,
+        mode: "copyAllFields"
+      });
+    } else if ("fields" in plugin.crossFileRewrite) {
+      specs.push({
+        classNames,
+        defineFunction,
+        mode: "whitelist",
+        fields: plugin.crossFileRewrite.fields
+      });
+    }
+  }
+  return specs;
+}
+function buildSdkBaseClassNames(plugins = pluginRegistry.getAll()) {
+  const names = /* @__PURE__ */ new Set();
+  for (const plugin of plugins) {
+    for (const cls of plugin.legacyClassNames) names.add(cls);
+  }
+  return names;
+}
+var init_cross_file_specs = __esm({
+  "src/compiler/utils/cross-file-specs.ts"() {
+    "use strict";
+    init_registry();
+    __name(buildCrossFileSpecs, "buildCrossFileSpecs");
+    __name(buildSdkBaseClassNames, "buildSdkBaseClassNames");
+  }
+});
+
 // src/compiler/plugins/voice.plugin.ts
 import fs5 from "fs/promises";
-import { Node as Node14 } from "ts-morph";
+import { Node as Node15 } from "ts-morph";
 function astObjectToPlain(obj) {
   const result = {};
   for (const prop of obj.getProperties()) {
-    if (Node14.isSpreadAssignment(prop)) {
+    if (Node15.isSpreadAssignment(prop)) {
       const expr = prop.getExpression();
       const evaluated = astValueToPlain(expr);
       if (evaluated && typeof evaluated === "object" && !Array.isArray(evaluated)) {
@@ -7269,14 +7668,14 @@ function astObjectToPlain(obj) {
       }
       continue;
     }
-    if (Node14.isShorthandPropertyAssignment(prop)) {
+    if (Node15.isShorthandPropertyAssignment(prop)) {
       const key2 = prop.getName();
       if (!key2) continue;
       const v2 = astValueToPlain(prop.getNameNode());
       if (v2 !== void 0) result[key2] = v2;
       continue;
     }
-    if (!Node14.isPropertyAssignment(prop)) continue;
+    if (!Node15.isPropertyAssignment(prop)) continue;
     const key = prop.getName();
     if (!key) continue;
     const value = prop.getInitializer();
@@ -7287,16 +7686,16 @@ function astObjectToPlain(obj) {
   return result;
 }
 function astValueToPlain(value) {
-  if (Node14.isStringLiteral(value) || Node14.isNoSubstitutionTemplateLiteral(value)) {
+  if (Node15.isStringLiteral(value) || Node15.isNoSubstitutionTemplateLiteral(value)) {
     return value.getLiteralText();
   }
-  if (Node14.isNumericLiteral(value)) {
+  if (Node15.isNumericLiteral(value)) {
     return Number(value.getLiteralText());
   }
-  if (Node14.isTrueLiteral(value)) return true;
-  if (Node14.isFalseLiteral(value)) return false;
-  if (Node14.isObjectLiteralExpression(value)) return astObjectToPlain(value);
-  if (Node14.isArrayLiteralExpression(value)) {
+  if (Node15.isTrueLiteral(value)) return true;
+  if (Node15.isFalseLiteral(value)) return false;
+  if (Node15.isObjectLiteralExpression(value)) return astObjectToPlain(value);
+  if (Node15.isArrayLiteralExpression(value)) {
     return value.getElements().map((el) => astValueToPlain(el)).filter((x) => x !== void 0);
   }
   return void 0;
@@ -7355,15 +7754,36 @@ function stripKeys(obj, keys) {
 }
 function leftmostIdentifierName(node) {
   let current = node;
-  while (Node14.isPropertyAccessExpression(current)) {
+  while (Node15.isPropertyAccessExpression(current)) {
     current = current.getExpression();
   }
-  return Node14.isIdentifier(current) ? current.getText() : void 0;
+  return Node15.isIdentifier(current) ? current.getText() : void 0;
+}
+function resolveProviderAlias(node, localName) {
+  const sourceFile = node.getSourceFile();
+  for (const imp of sourceFile.getImportDeclarations()) {
+    const moduleSpec = imp.getModuleSpecifierValue();
+    const livekitPlugin = moduleSpec.startsWith("@livekit/agents-plugin-");
+    const isLuaCliVoice = moduleSpec === "lua-cli/voice";
+    const isLivekitAgents = moduleSpec === "@livekit/agents";
+    if (!isLuaCliVoice && !livekitPlugin && !isLivekitAgents) continue;
+    for (const named of imp.getNamedImports()) {
+      const alias = named.getAliasNode()?.getText();
+      const exported = named.getName();
+      const bound = alias ?? exported;
+      if (bound === localName) return exported;
+    }
+    const ns = imp.getNamespaceImport();
+    if (ns && ns.getText() === localName && livekitPlugin) {
+      return moduleSpec.replace("@livekit/agents-plugin-", "");
+    }
+  }
+  return localName;
 }
 function extractRealtimeFromNewExpression(newExpr, classExpr, field) {
   if (classExpr.getName() !== "RealtimeModel") return void 0;
   const realtimeNode = classExpr.getExpression();
-  if (!Node14.isPropertyAccessExpression(realtimeNode) || realtimeNode.getName() !== "realtime") {
+  if (!Node15.isPropertyAccessExpression(realtimeNode) || realtimeNode.getName() !== "realtime") {
     return void 0;
   }
   if (field !== "llm") {
@@ -7374,7 +7794,8 @@ function extractRealtimeFromNewExpression(newExpr, classExpr, field) {
       }
     };
   }
-  const provider = leftmostIdentifierName(realtimeNode.getExpression());
+  const providerLocal = leftmostIdentifierName(realtimeNode.getExpression());
+  const provider = providerLocal ? resolveProviderAlias(realtimeNode, providerLocal) : void 0;
   if (!provider) {
     return {
       error: {
@@ -7393,7 +7814,7 @@ function extractRealtimeFromNewExpression(newExpr, classExpr, field) {
   }
   const optsArg = newExpr.getArguments()[0];
   let options = {};
-  if (optsArg && Node14.isObjectLiteralExpression(optsArg)) {
+  if (optsArg && Node15.isObjectLiteralExpression(optsArg)) {
     options = astObjectToPlain(optsArg);
   }
   return {
@@ -7406,7 +7827,7 @@ function extractRealtimeFromNewExpression(newExpr, classExpr, field) {
 }
 function extractFromNewExpression(newExpr, field) {
   const expr = newExpr.getExpression();
-  if (!Node14.isPropertyAccessExpression(expr)) {
+  if (!Node15.isPropertyAccessExpression(expr)) {
     return {
       error: {
         field,
@@ -7416,7 +7837,7 @@ function extractFromNewExpression(newExpr, field) {
   }
   const realtimeResult = extractRealtimeFromNewExpression(newExpr, expr, field);
   if (realtimeResult) return realtimeResult;
-  const moduleName = expr.getExpression().getText();
+  const moduleName = resolveProviderAlias(expr, expr.getExpression().getText());
   const className = expr.getName();
   if (!PLUGIN_CLASSES.includes(className)) {
     return {
@@ -7436,7 +7857,7 @@ function extractFromNewExpression(newExpr, field) {
   }
   const optsArg = newExpr.getArguments()[0];
   let options = {};
-  if (optsArg && Node14.isObjectLiteralExpression(optsArg)) {
+  if (optsArg && Node15.isObjectLiteralExpression(optsArg)) {
     options = astObjectToPlain(optsArg);
   }
   if (moduleName === "inference") {
@@ -7484,7 +7905,7 @@ function extractFromNewExpression(newExpr, field) {
 }
 function unwrapType(node) {
   let current = node;
-  while (Node14.isAsExpression(current) || Node14.isSatisfiesExpression(current) || Node14.isParenthesizedExpression(current)) {
+  while (Node15.isAsExpression(current) || Node15.isSatisfiesExpression(current) || Node15.isParenthesizedExpression(current)) {
     const inner = current.getExpression?.();
     if (!inner) break;
     current = inner;
@@ -7493,11 +7914,11 @@ function unwrapType(node) {
 }
 function extractModelField(config, field) {
   const prop = config.getProperty(field);
-  if (!prop || !Node14.isPropertyAssignment(prop)) return {};
+  if (!prop || !Node15.isPropertyAssignment(prop)) return {};
   const initializer = prop.getInitializer();
   if (!initializer) return {};
   const value = unwrapType(initializer);
-  if (Node14.isStringLiteral(value) || Node14.isNoSubstitutionTemplateLiteral(value)) {
+  if (Node15.isStringLiteral(value) || Node15.isNoSubstitutionTemplateLiteral(value)) {
     const text = value.getLiteralText();
     if (!text) {
       return {
@@ -7509,7 +7930,7 @@ function extractModelField(config, field) {
     }
     return parseDescriptor(text, field);
   }
-  if (Node14.isObjectLiteralExpression(value)) {
+  if (Node15.isObjectLiteralExpression(value)) {
     if (field !== "tts") {
       return {
         error: {
@@ -7536,7 +7957,7 @@ function extractModelField(config, field) {
       model: out
     };
   }
-  if (Node14.isNewExpression(value)) {
+  if (Node15.isNewExpression(value)) {
     return extractFromNewExpression(value, field);
   }
   return {
@@ -7549,20 +7970,23 @@ function extractModelField(config, field) {
 function hasFunctionProperty(config, propertyName) {
   const prop = config.getProperty(propertyName);
   if (!prop) return false;
-  if (Node14.isMethodDeclaration(prop)) return true;
-  if (!Node14.isPropertyAssignment(prop)) return false;
+  if (Node15.isMethodDeclaration(prop)) return true;
+  if (!Node15.isPropertyAssignment(prop)) return false;
   const value = prop.getInitializer();
   if (!value) return false;
-  if (Node14.isArrowFunction(value) || Node14.isFunctionExpression(value)) return true;
-  if (Node14.isIdentifier(value)) return true;
+  if (Node15.isArrowFunction(value) || Node15.isFunctionExpression(value)) return true;
+  if (Node15.isIdentifier(value)) return true;
   return false;
 }
 function hasArrayProperty(config, propertyName) {
   const prop = config.getProperty(propertyName);
-  if (!prop || !Node14.isPropertyAssignment(prop)) return false;
+  if (!prop || !Node15.isPropertyAssignment(prop)) return false;
   const value = prop.getInitializer();
   if (!value) return false;
-  return Node14.isArrayLiteralExpression(value);
+  if (Node15.isArrayLiteralExpression(value)) return value.getElements().length > 0;
+  if (Node15.isNullLiteral(value)) return false;
+  if (Node15.isIdentifier(value) && value.getText() === "undefined") return false;
+  return true;
 }
 function normalizePronunciations(raw) {
   if (!raw) return {
@@ -7588,6 +8012,8 @@ var init_voice_plugin = __esm({
   "src/compiler/plugins/voice.plugin.ts"() {
     "use strict";
     init_dist();
+    init_primitive_rewrite();
+    init_cross_file_specs();
     init_types();
     init_ast_helpers();
     init_common();
@@ -7618,6 +8044,7 @@ var init_voice_plugin = __esm({
     __name(parseDescriptor, "parseDescriptor");
     __name(stripKeys, "stripKeys");
     __name(leftmostIdentifierName, "leftmostIdentifierName");
+    __name(resolveProviderAlias, "resolveProviderAlias");
     __name(extractRealtimeFromNewExpression, "extractRealtimeFromNewExpression");
     __name(extractFromNewExpression, "extractFromNewExpression");
     __name(unwrapType, "unwrapType");
@@ -7635,6 +8062,14 @@ var init_voice_plugin = __esm({
       legacyClassNames = [
         "LuaVoice"
       ];
+      // Voice's cross-file rewrite uses a narrow whitelist because configs can
+      // have nested provider SDK calls (new deepgram.STT, new elevenlabs.TTS)
+      // that the top-level rewrite (in generateEntryPoint) handles separately.
+      crossFileRewrite = {
+        fields: [
+          "name"
+        ]
+      };
       extractFromConfig(config, exportName, sourcePath, position, pattern) {
         const common = this.extractCommonFields(config, exportName, sourcePath, position);
         if (!common) return null;
@@ -7775,43 +8210,45 @@ var init_voice_plugin = __esm({
         };
       }
       /**
-      * Entry-point emitter for the bundled JS path. Imports the dev's
-      * LuaVoice instance and re-exports its hooks + voice-only tools in
-      * the flat shape the worker sandbox expects (sandbox.ts:extractExports).
+      * Entry-point emitter for hook-bearing voices.
+      *
+      * Architecturally, the bundle must NOT re-evaluate `new LuaVoice({...})` in
+      * the worker sandbox — that call's only purpose is compile-time metadata
+      * extraction (provider/class/options for stt/tts/llm), and re-running it
+      * with stripped SDK imports requires runtime stub injection (a Proxy that
+      * covers only a fraction of the dev's possible introspection patterns).
       *
-      * Tools land as a name-keyed map; sandbox.normalizeTools also accepts
-      * arrays, but pre-normalizing here avoids one walk per session start
-      * and keeps the bundle's wire shape obvious to anyone inspecting it.
+      * Instead, this method does a source-level AST rewrite:
+      *   1. Parse the dev's source file
+      *   2. Find the LuaVoice / defineVoice call site
+      *   3. Splice the hook function-expression texts + tool entries directly
+      *      into a synthesized `{ __lua_primitive__, onEnter, ..., tools }`
+      *      object literal at the same module-scope position
+      *   4. Strip the stripped lua-cli / lua-cli/voice imports
+      *
+      * Closure references (module-level helpers, consts, types) survive
+      * because the splice happens at the same lexical position as the
+      * original call site.
       *
       * Only invoked by the compiler when `buildArtifact` returns undefined
-      * (i.e. when the voice declares hooks or voice-only tools) — see
-      * the conditional in `buildArtifact` below.
+      * (i.e. when the voice declares hooks or voice-only tools).
       */
       generateEntryPoint(metadata) {
-        const importStatement = metadata.isDefaultExport ? `import __voice__ from ${JSON.stringify(metadata.sourcePath)};` : `import { __lua_target__ as __voice__ } from ${JSON.stringify(metadata.sourcePath)};`;
-        return `// AUTO-GENERATED ENTRY POINT \u2014 Voice: ${metadata.name}
-${importStatement}
-
-const __luaTools = {};
-if (__voice__ && Array.isArray(__voice__.tools)) {
-  for (const t of __voice__.tools) {
-    if (t && typeof t === 'object' && typeof t.name === 'string') {
-      __luaTools[t.name] = {
-        name: t.name,
-        description: t.description,
-        execute: t.execute,
-        condition: t.condition,
-        voice: t.voice,
-      };
-    }
-  }
-}
-
-export const onEnter = __voice__ && __voice__.onEnter;
-export const onUserTurnCompleted = __voice__ && __voice__.onUserTurnCompleted;
-export const onExit = __voice__ && __voice__.onExit;
-export const tools = __luaTools;
-`;
+        return rewritePrimitiveSource(metadata, {
+          constructorNames: [
+            "LuaVoice"
+          ],
+          defineFunctionName: this.defineFunction,
+          buildLiteral: /* @__PURE__ */ __name((arg, ctx) => `{
+  ${buildLuaPrimitiveMarker(ctx.metadata, "voice")},
+  onEnter: ${getPropertyText(arg, "onEnter") ?? "undefined"},
+  onUserTurnCompleted: ${getPropertyText(arg, "onUserTurnCompleted") ?? "undefined"},
+  onExit: ${getPropertyText(arg, "onExit") ?? "undefined"},
+  tools: ${getPropertyText(arg, "tools") ?? "[]"}
+}`, "buildLiteral"),
+          crossFileSpecs: buildCrossFileSpecs(),
+          sdkBaseClassNames: buildSdkBaseClassNames()
+        });
       }
       /**
       * Emit a JSON metadata sidecar OR fall through to esbuild bundling.
@@ -8003,6 +8440,8 @@ var init_bundler = __esm({
   "src/compiler/bundler.ts"() {
     "use strict";
     init_types();
+    init_primitive_rewrite();
+    init_cross_file_specs();
     Bundler = class {
       static {
         __name(this, "Bundler");
@@ -8010,24 +8449,43 @@ var init_bundler = __esm({
       options;
       project;
       verbose;
+      // Snapshotted at construction. Plugins registered after this Bundler
+      // is instantiated (test fixtures, "lua-cli as a library" usage) won't appear.
+      // Today the registry is module-load-time only, so this is fine.
+      crossFileSpecs = buildCrossFileSpecs();
+      sdkBaseClassNames = buildSdkBaseClassNames();
       constructor(options, project, verbose) {
         this.options = options;
         this.project = project;
         this.verbose = verbose;
       }
       /**
-      * Strip lua-cli and api-exports import statements from source code using TypeScript AST.
-      * This is more robust than regex and handles all edge cases (multiline, comments, etc.).
+      * Strip lua-cli / lua-cli/skill / lua-cli/voice / api-exports imports from
+      * a source file, then rewrite every SDK class constructor / define-function
+      * call in the file to a bare object literal (`{ name, execute, ... }`).
+      *
+      * After this transform:
+      *   - SDK class identifiers (LuaTool, LuaJob, defineWebhook, ...) no longer
+      *     appear in the source. The call sites that used them are replaced with
+      *     inline object literals carrying the runtime fields. By construction,
+      *     the bundle has zero references to stripped SDK identifiers, so the
+      *     sandbox doesn't need any runtime stub for them.
+      *   - Platform-API identifiers (Data, User, AI, Agents, Jobs, Lua, env, ...)
+      *     remain as free identifiers in the dev's execute / hook bodies. esbuild
+      *     leaves them alone (they're not imported, not local), and at runtime
+      *     they resolve to the sandbox's injected globals.
+      *
+      * Replaces the prior `buildLuaCliStubBlock` runtime-stub approach (BAC-234).
       */
       stripLuaCliImportsAST(code, filename = "temp.ts") {
         try {
           const tempFile = this.project.createSourceFile(`__strip_${filename}`, code, {
             overwrite: true
           });
-          const imports = tempFile.getImportDeclarations();
-          imports.forEach((imp) => {
-            const moduleSpecifier = imp.getModuleSpecifierValue();
-            if (moduleSpecifier === "lua-cli" || moduleSpecifier === "lua-cli/skill" || moduleSpecifier.includes("api-exports")) {
+          rewriteCrossFileCallsInSourceFile(tempFile, this.crossFileSpecs, this.sdkBaseClassNames);
+          tempFile.getImportDeclarations().forEach((imp) => {
+            const spec = imp.getModuleSpecifierValue();
+            if (spec === "lua-cli" || spec === "lua-cli/skill" || spec === "lua-cli/voice" || spec.includes("api-exports")) {
               imp.remove();
             }
           });
@@ -8035,7 +8493,8 @@ var init_bundler = __esm({
           this.project.removeSourceFile(tempFile);
           return result;
         } catch (error) {
-          return code;
+          const msg = error instanceof Error ? error.message : String(error);
+          throw new Error(`[lua-cli] AST rewrite failed for ${filename}: ${msg}. Source: bare SDK identifiers would survive into the bundle and fail at runtime; aborting compile.`);
         }
       }
       /**
@@ -8143,8 +8602,6 @@ export { ${exportName} as __lua_target__ };
       */
       createLuaCliShimPlugin() {
         const stripImports = this.stripLuaCliImportsAST.bind(this);
-        const debug = this.options.debug;
-        const verbose = this.verbose.bind(this);
         return {
           name: "lua-cli-import-stripper",
           setup(build2) {
@@ -8168,14 +8625,12 @@ export { ${exportName} as __lua_target__ };
                 }
                 return null;
               } catch (error) {
-                if (debug) {
-                  verbose(`      Warning: Failed to parse ${args2.path} with ts-morph, using fallback`);
-                }
-                return null;
+                const msg = error instanceof Error ? error.message : String(error);
+                throw new Error(`[lua-cli] AST rewrite failed for ${args2.path}: ${msg}. Aborting compile (silent fallback would corrupt the bundle).`);
               }
             });
             build2.onResolve({
-              filter: /^lua-cli(\/skill)?$/
+              filter: /^lua-cli(\/(skill|voice))?$/
             }, () => ({
               path: "lua-cli-empty",
               namespace: "lua-cli-empty"
@@ -8201,7 +8656,7 @@ export { ${exportName} as __lua_target__ };
 });
 
 // src/compiler/agent-traverser.ts
-import { Project, Node as Node15 } from "ts-morph";
+import { Project as Project2, Node as Node16 } from "ts-morph";
 import path6 from "path";
 import fs7 from "fs";
 var PRIMITIVE_TYPES, AgentTraverser;
@@ -8275,7 +8730,7 @@ var init_agent_traverser = __esm({
       constructor(rootDir, debug = false) {
         this.rootDir = rootDir;
         this.debug = debug;
-        this.project = new Project({
+        this.project = new Project2({
           tsConfigFilePath: path6.join(rootDir, "tsconfig.json"),
           skipAddingFilesFromTsConfig: true
         });
@@ -8424,7 +8879,7 @@ var init_agent_traverser = __esm({
       */
       extractArrayRefs(config, propName) {
         const prop = config.getProperty(propName);
-        if (!prop || !Node15.isPropertyAssignment(prop)) return [];
+        if (!prop || !Node16.isPropertyAssignment(prop)) return [];
         const value = prop.getInitializer();
         if (!value) return [];
         const ctx = {
@@ -8509,7 +8964,7 @@ var init_agent_traverser = __esm({
             for (const assign of file.getExportAssignments()) {
               if (assign.isExportEquals()) continue;
               const expr = assign.getExpression();
-              if (!Node15.isIdentifier(expr)) continue;
+              if (!Node16.isIdentifier(expr)) continue;
               const targetName = expr.getText();
               defaultMatch = detected.find((d) => d.exportName === targetName);
               if (defaultMatch) break;
@@ -8608,7 +9063,7 @@ var init_workspace = __esm({
 // src/compiler/compiler.ts
 import fs9 from "fs/promises";
 import path8 from "path";
-import { Project as Project2 } from "ts-morph";
+import { Project as Project3 } from "ts-morph";
 async function compile(options) {
   const compiler = new Compiler(options);
   return compiler.compile();
@@ -8659,7 +9114,7 @@ var init_compiler = __esm({
           runtimeValidation: true,
           ...options
         };
-        this.project = new Project2({
+        this.project = new Project3({
           tsConfigFilePath: path8.join(options.rootDir, "tsconfig.json")
         });
         registerProjectRootDir(this.project, this.options.rootDir);
@@ -9272,7 +9727,7 @@ var init_file_discovery = __esm({
 });
 
 // src/compiler/source-writer.ts
-import { Project as Project3, Node as Node16 } from "ts-morph";
+import { Project as Project4, Node as Node17 } from "ts-morph";
 import fs11 from "fs";
 import path10 from "path";
 function resolveEntryPath(options) {
@@ -9315,20 +9770,20 @@ function updateAgentConfig(updates, options) {
   const indexPath = resolveEntryPath(options);
   if (!indexPath) return false;
   try {
-    const project = new Project3({
+    const project = new Project4({
       skipAddingFilesFromTsConfig: true
     });
     const sourceFile = project.addSourceFileAtPath(indexPath);
     let updated = false;
     sourceFile.forEachDescendant((node) => {
-      if (Node16.isNewExpression(node) && node.getExpression().getText() === "LuaAgent") {
+      if (Node17.isNewExpression(node) && node.getExpression().getText() === "LuaAgent") {
         const args2 = node.getArguments();
-        if (args2.length > 0 && Node16.isObjectLiteralExpression(args2[0])) {
+        if (args2.length > 0 && Node17.isObjectLiteralExpression(args2[0])) {
           const configObj = args2[0];
           const replacedKeys = /* @__PURE__ */ new Set();
           let lastReplacedIndex = -1;
           configObj.getProperties().forEach((prop, index) => {
-            if (Node16.isPropertyAssignment(prop)) {
+            if (Node17.isPropertyAssignment(prop)) {
               const propName = prop.getName();
               if (Object.prototype.hasOwnProperty.call(filteredUpdates, propName)) {
                 const newValue = filteredUpdates[propName];
@@ -9384,21 +9839,21 @@ function removeAgentConfigProperty(propertyName, options) {
   const indexPath = resolveEntryPath(options);
   if (!indexPath) return false;
   try {
-    const project = new Project3({
+    const project = new Project4({
       skipAddingFilesFromTsConfig: true
     });
     const sourceFile = project.addSourceFileAtPath(indexPath);
     let foundConstructor = false;
     let removed = false;
     sourceFile.forEachDescendant((node) => {
-      if (Node16.isNewExpression(node) && node.getExpression().getText() === "LuaAgent") {
+      if (Node17.isNewExpression(node) && node.getExpression().getText() === "LuaAgent") {
         const args2 = node.getArguments();
-        if (args2.length > 0 && Node16.isObjectLiteralExpression(args2[0])) {
+        if (args2.length > 0 && Node17.isObjectLiteralExpression(args2[0])) {
           foundConstructor = true;
           const configObj = args2[0];
           const props = configObj.getProperties();
           for (const prop of props) {
-            if (Node16.isPropertyAssignment(prop) && prop.getName() === propertyName) {
+            if (Node17.isPropertyAssignment(prop) && prop.getName() === propertyName) {
               prop.remove();
               removed = true;
               break;
@@ -18267,7 +18722,7 @@ init_cli();
 init_command_utils();
 
 // src/utils/sandbox.ts
-import vm2 from "vm";
+import vm3 from "vm";
 import path16 from "path";
 
 // ../shared-sandbox/dist/index.mjs
@@ -18278,6 +18733,7 @@ import dns from "dns";
 import net from "net";
 import { promisify } from "util";
 import { Agent as UndiciAgent } from "undici";
+import vm2 from "vm";
 var __defProp4 = Object.defineProperty;
 var __name4 = /* @__PURE__ */ __name((target, value) => __defProp4(target, "name", { value, configurable: true }), "__name");
 function buildSandboxProcess(opts) {
@@ -19088,6 +19544,28 @@ function applyGlobalSelfReference(context) {
 }
 __name(applyGlobalSelfReference, "applyGlobalSelfReference");
 __name4(applyGlobalSelfReference, "applyGlobalSelfReference");
+function resolveExtraAllowedCidrs() {
+  const csv = process.env.LUA_ALLOWED_EGRESS_CIDRS;
+  if (!csv) return [];
+  return csv.split(",").map((s) => s.trim()).filter(Boolean);
+}
+__name(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
+__name4(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
+function wrapBundleAsCjsModule(source) {
+  return "(function(module, exports, require) {\n" + source + "\n})(module, module.exports, require);";
+}
+__name(wrapBundleAsCjsModule, "wrapBundleAsCjsModule");
+__name4(wrapBundleAsCjsModule, "wrapBundleAsCjsModule");
+function runBundleInContext(context, source, options) {
+  const wrapped = wrapBundleAsCjsModule(source);
+  vm2.runInContext(wrapped, context, {
+    filename: options.filename,
+    timeout: options.timeoutMs ?? 1e3,
+    lineOffset: -1
+  });
+}
+__name(runBundleInContext, "runBundleInContext");
+__name4(runBundleInContext, "runBundleInContext");
 
 // src/utils/env-loader.utils.ts
 import path15 from "path";
@@ -19200,12 +19678,12 @@ function resolveEgressMode() {
   return "off";
 }
 __name(resolveEgressMode, "resolveEgressMode");
-function resolveExtraAllowedCidrs() {
+function resolveExtraAllowedCidrs2() {
   const csv = process.env.LUA_ALLOWED_EGRESS_CIDRS;
   if (!csv) return [];
   return csv.split(",").map((s) => s.trim()).filter(Boolean);
 }
-__name(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
+__name(resolveExtraAllowedCidrs2, "resolveExtraAllowedCidrs");
 function defaultSecurityEventLogger(evt) {
   console.warn("[sandbox]", JSON.stringify(evt));
 }
@@ -19353,7 +19831,7 @@ function createSandbox(options) {
     extraGlobals,
     requireMode: resolveRequireMode(),
     egressMode: resolveEgressMode(),
-    egressExtraAllowedCidrs: resolveExtraAllowedCidrs(),
+    egressExtraAllowedCidrs: resolveExtraAllowedCidrs2(),
     onSecurityEvent: defaultSecurityEventLogger
   });
 }
@@ -19361,11 +19839,14 @@ __name(createSandbox, "createSandbox");
 async function executeTool(options) {
   const { toolCode, inputs } = options;
   const sandbox = createSandbox(options);
-  const context = vm2.createContext(sandbox);
+  const context = vm3.createContext(sandbox);
   applyGlobalSelfReference(context);
   const isBundledArtifact = toolCode.includes("__lua_primitive__");
   if (isBundledArtifact) {
-    vm2.runInContext(toolCode, context);
+    runBundleInContext(context, toolCode, {
+      filename: "tool.bundle.js",
+      timeoutMs: 18e4
+    });
     const moduleExports = context.module.exports;
     const primitive = moduleExports.default?.primitive || moduleExports.primitive;
     if (!primitive || !primitive.execute) {
@@ -19393,7 +19874,7 @@ module.exports = async (input) => {
   }
 };
 `;
-    vm2.runInContext(commonJsWrapper, context);
+    vm3.runInContext(commonJsWrapper, context);
     const executeFunction = context.module.exports;
     return await executeFunction(inputs);
   }
@@ -19402,7 +19883,7 @@ __name(executeTool, "executeTool");
 async function executeWebhook(options) {
   const { webhookCode, query, headers, body } = options;
   const sandbox = createSandbox(options);
-  const context = vm2.createContext(sandbox);
+  const context = vm3.createContext(sandbox);
   applyGlobalSelfReference(context);
   const event = {
     query: query ?? {},
@@ -19412,7 +19893,10 @@ async function executeWebhook(options) {
   };
   const isBundledArtifact = webhookCode.includes("__lua_primitive__");
   if (isBundledArtifact) {
-    vm2.runInContext(webhookCode, context);
+    runBundleInContext(context, webhookCode, {
+      filename: "webhook.bundle.js",
+      timeoutMs: 18e4
+    });
     const moduleExports = context.module.exports;
     const primitive = moduleExports.default?.primitive || moduleExports.primitive;
     if (!primitive || !primitive.execute) {
@@ -19440,7 +19924,7 @@ module.exports = async (event) => {
   }
 };
 `;
-    vm2.runInContext(commonJsWrapper, context);
+    vm3.runInContext(commonJsWrapper, context);
     const executeFunction = context.module.exports;
     return await executeFunction(event);
   }
@@ -19449,7 +19933,7 @@ __name(executeWebhook, "executeWebhook");
 async function executeJob(options) {
   const { jobCode, jobData, apiKey, agentId } = options;
   const sandbox = createSandbox(options);
-  const context = vm2.createContext(sandbox);
+  const context = vm3.createContext(sandbox);
   applyGlobalSelfReference(context);
   let jobInstance = void 0;
   if (jobData) {
@@ -19475,7 +19959,10 @@ async function executeJob(options) {
   }
   const isBundledArtifact = jobCode.includes("__lua_primitive__");
   if (isBundledArtifact) {
-    vm2.runInContext(jobCode, context);
+    runBundleInContext(context, jobCode, {
+      filename: "job.bundle.js",
+      timeoutMs: 18e4
+    });
     const moduleExports = context.module.exports;
     const primitive = moduleExports.default?.primitive || moduleExports.primitive;
     if (!primitive || !primitive.execute) {
@@ -19503,7 +19990,7 @@ module.exports = async (job) => {
   }
 };
 `;
-    vm2.runInContext(commonJsWrapper, context);
+    vm3.runInContext(commonJsWrapper, context);
     const executeFunction = context.module.exports;
     return await executeFunction(jobInstance);
   }
@@ -19515,11 +20002,14 @@ async function executePreProcessor(options) {
   const UserDataApi2 = (await Promise.resolve().then(() => (init_user_data_api_service(), user_data_api_service_exports))).default;
   const userService = new UserDataApi2(BASE_URLS.API, apiKey, agentId);
   const userInstance = await userService.get();
-  const context = vm2.createContext(sandbox);
+  const context = vm3.createContext(sandbox);
   applyGlobalSelfReference(context);
   const isBundledArtifact = processorCode.includes("__lua_primitive__");
   if (isBundledArtifact) {
-    vm2.runInContext(processorCode, context);
+    runBundleInContext(context, processorCode, {
+      filename: "preprocessor.bundle.js",
+      timeoutMs: 18e4
+    });
     const moduleExports = context.module.exports;
     const primitive = moduleExports.default?.primitive || moduleExports.primitive;
     if (!primitive || !primitive.execute) {
@@ -19547,7 +20037,7 @@ module.exports = async (input) => {
   }
 };
 `;
-    vm2.runInContext(commonJsWrapper, context);
+    vm3.runInContext(commonJsWrapper, context);
     const executeFunction = context.module.exports;
     return await executeFunction({
       user: userInstance,
@@ -19563,11 +20053,14 @@ async function executePostProcessor(options) {
   const UserDataApi2 = (await Promise.resolve().then(() => (init_user_data_api_service(), user_data_api_service_exports))).default;
   const userService = new UserDataApi2(BASE_URLS.API, apiKey, agentId);
   const userInstance = await userService.get();
-  const context = vm2.createContext(sandbox);
+  const context = vm3.createContext(sandbox);
   applyGlobalSelfReference(context);
   const isBundledArtifact = processorCode.includes("__lua_primitive__");
   if (isBundledArtifact) {
-    vm2.runInContext(processorCode, context);
+    runBundleInContext(context, processorCode, {
+      filename: "postprocessor.bundle.js",
+      timeoutMs: 18e4
+    });
     const moduleExports = context.module.exports;
     const primitive = moduleExports.default?.primitive || moduleExports.primitive;
     if (!primitive || !primitive.execute) {
@@ -19592,7 +20085,7 @@ module.exports = async (input) => {
   }
 };
 `;
-    vm2.runInContext(commonJsWrapper, context);
+    vm3.runInContext(commonJsWrapper, context);
     const executeFunction = context.module.exports;
     return await executeFunction({
       user: userInstance,
@@ -23176,11 +23669,11 @@ init_cli();
 
 // src/utils/sandbox-storage.ts
 init_constants();
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
 import { dirname as dirname5 } from "path";
 function readStore() {
   try {
-    const raw = readFileSync8(SANDBOX_STORAGE_FILE, "utf8");
+    const raw = readFileSync9(SANDBOX_STORAGE_FILE, "utf8");
     const parsed = JSON.parse(raw);
     return {
       skills: parsed.skills ?? {},
@@ -29372,7 +29865,7 @@ init_auth();
 init_auth_api_service();
 init_files();
 init_artifact_loader();
-import { existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
 import { join as join6 } from "path";
 import { performance } from "perf_hooks";
 import * as os from "os";
@@ -29723,7 +30216,7 @@ function gatherTelemetry() {
   } else {
     try {
       if (existsSync7(TELEMETRY_FILE)) {
-        const raw = readFileSync9(TELEMETRY_FILE, "utf8");
+        const raw = readFileSync10(TELEMETRY_FILE, "utf8");
         const cfg = JSON.parse(raw);
         if (typeof cfg.enabled === "boolean") enabled = cfg.enabled;
       }