lua-cli 3.16.2 → 3.17.1

package/dist/index.js

@@ -132,13 +132,14 @@ var init_semver = __esm({
 // src/config/constants.ts
 import { join } from "path";
 import { homedir } from "os";
-var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, BASE_URLS, CREDENTIALS_FILE, PREFERRED_AGENT_TYPES, SANDBOX_STORAGE_FILE, POSTHOG_API_KEY, POSTHOG_HOST;
+var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, CREDENTIALS_FILE, PREFERRED_AGENT_TYPES, SANDBOX_STORAGE_FILE, AUTH_STORAGE_FILE, POSTHOG_API_KEY, POSTHOG_HOST;
 var init_constants = __esm({
   "src/config/constants.ts"() {
     "use strict";
     CLI_CONFIG_DIR = join(homedir(), ".lua-cli");
     VERSION_CHECK_FILE = join(CLI_CONFIG_DIR, "version-check.json");
     TELEMETRY_FILE = join(CLI_CONFIG_DIR, "telemetry.json");
+    CLI_CACHE_FILE = join(CLI_CONFIG_DIR, "cache.json");
     BASE_URLS = {
       API: process.env.LUA_API_URL || "https://api.heylua.ai",
       AUTH: process.env.LUA_AUTH_URL || "https://auth.heylua.ai",
@@ -153,6 +154,7 @@ var init_constants = __esm({
       "base"
     ];
     SANDBOX_STORAGE_FILE = join(CLI_CONFIG_DIR, "sandbox.json");
+    AUTH_STORAGE_FILE = join(CLI_CONFIG_DIR, "auth.json");
     POSTHOG_API_KEY = "phc_W7Qsquwlflshmdkm2hWSqRpXuxGbVFo7LEX8H9HrSjC";
     POSTHOG_HOST = "https://us.i.posthog.com";
   }
@@ -1198,7 +1200,14 @@ Feel free to add, remove, or rename sections. Your persona can be a single parag
       // `Data.get('call:<sessionId>')` to drive post-call analytics, follow-ups,
       // or QA workflows. Defaults to false — most calls don't need to keep
       // a transcript copy.
-      persistTranscript: z.boolean().optional()
+      persistTranscript: z.boolean().optional(),
+      // Spoken acknowledgement played when a tool call fails. When a tool
+      // throws, times out, or returns an unsupported result, the adapter calls
+      // `session.say(text)` once per failed call before surfacing the error
+      // to the LLM as a ToolError — fills the 2–3s gap before the LLM's own
+      // recovery response. Persona-specific (keep it short and on-brand);
+      // absent → no spoken fallback (the LLM's recovery is the only signal).
+      onToolFailureSay: z.string().min(1).max(200).optional()
     });
     LuaVoiceConfigSchema = LuaVoiceConfigInnerSchema.superRefine((cfg, ctx) => {
       const isRealtime = cfg.llm.kind === "realtime";
@@ -1526,7 +1535,7 @@ var init_artifact_loader = __esm({
 });
 
 // src/api/backup.api.service.ts
-var BackupApi;
+var BackupApi, backup_api_service_default;
 var init_backup_api_service = __esm({
   "src/api/backup.api.service.ts"() {
     "use strict";
@@ -1645,7 +1654,20 @@ var init_backup_api_service = __esm({
           Authorization: `Bearer ${this.apiKey}`
         });
       }
+      /**
+      * Get the list of backup versions for this agent.
+      *
+      * @param all - If true, lifts the server-side 50-version cap
+      * @returns Promise resolving to the list of version summaries (newest first)
+      */
+      async getBackupVersions(all = false) {
+        const qs = all ? "?all=true" : "";
+        return this.httpGet(`/developer/agents/${this.agentId}/backup/versions${qs}`, {
+          Authorization: `Bearer ${this.apiKey}`
+        });
+      }
     };
+    backup_api_service_default = BackupApi;
   }
 });
 
@@ -1662,7 +1684,7 @@ async function ensureBundlesUploaded(apiKey, agentId, bundles) {
       uploaded: 0
     };
   }
-  const api = new BackupApi(BASE_URLS.API, apiKey, agentId);
+  const api = new backup_api_service_default(BASE_URLS.API, apiKey, agentId);
   const hashes = Array.from(bundles.keys());
   const urlResponse = await api.getBlobUploadUrls(hashes);
   if (!urlResponse.success) {
@@ -5053,11 +5075,11 @@ var init_mcp_server_plugin = __esm({
 // ../shared-source-sync/dist/index.mjs
 import { createHash } from "crypto";
 import { extname } from "path";
-import { readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
 import { join as join4, sep } from "path";
 import { gunzipSync, gzipSync } from "zlib";
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync22, statSync as statSync22, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname3, join as join22, resolve, sep as sep2 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync22, statSync as statSync22, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname4, join as join22, resolve, sep as sep2 } from "path";
 import { mkdirSync as mkdirSync22, readdirSync as readdirSync22, readFileSync as readFileSync32, statSync as statSync3, writeFileSync as writeFileSync22 } from "fs";
 import { dirname as dirname22, join as join32, sep as sep3 } from "path";
 import { gunzipSync as gunzipSync2, gzipSync as gzipSync2 } from "zlib";
@@ -5117,7 +5139,7 @@ function walkWorkspace(rootDir, opts = {}) {
       if (stats.size > maxBytes) continue;
       let content;
       try {
-        content = readFileSync6(abs);
+        content = readFileSync7(abs);
       } catch {
         continue;
       }
@@ -5234,10 +5256,10 @@ function restoreFromBlobs(manifest, blobs, targetDir, opts = {}) {
         continue;
       }
     }
-    mkdirSync5(dirname3(targetPath), {
+    mkdirSync6(dirname4(targetPath), {
       recursive: true
     });
-    writeFileSync5(targetPath, content);
+    writeFileSync6(targetPath, content);
     filesWritten++;
   }
   return {
@@ -5432,12 +5454,12 @@ var init_dist2 = __esm({
         this.options = options;
         this.fetchFn = options.fetch ?? fetch;
       }
-      url(path18) {
+      url(path19) {
         const base = this.options.baseUrl.replace(/\/$/, "");
-        return `${base}/developer/agents/${encodeURIComponent(this.options.agentId)}${path18}`;
+        return `${base}/developer/agents/${encodeURIComponent(this.options.agentId)}${path19}`;
       }
-      async json(method, path18, body) {
-        const endpoint = this.url(path18);
+      async json(method, path19, body) {
+        const endpoint = this.url(path19);
         const res = await this.fetchFn(endpoint, {
           method,
           headers: {
@@ -5456,7 +5478,7 @@ var init_dist2 = __esm({
           } catch {
             text2 = void 0;
           }
-          throw new BackupHttpError(`Backup request failed: ${method} ${path18} \u2192 ${res.status} ${res.statusText}`, res.status, endpoint, text2);
+          throw new BackupHttpError(`Backup request failed: ${method} ${path19} \u2192 ${res.status} ${res.statusText}`, res.status, endpoint, text2);
         }
         const text = await res.text();
         if (!text) return void 0;
@@ -5523,16 +5545,16 @@ var init_dist2 = __esm({
 });
 
 // src/compiler/utils/common.ts
-import path3 from "path";
+import path4 from "path";
 function hashContent(content) {
   return hashContentTruncated(content);
 }
 function isInside(child, parent) {
-  const resolvedChild = path3.resolve(child);
-  const resolvedParent = path3.resolve(parent);
+  const resolvedChild = path4.resolve(child);
+  const resolvedParent = path4.resolve(parent);
   if (resolvedChild === resolvedParent) return true;
-  const rel = path3.relative(resolvedParent, resolvedChild);
-  return !!rel && !rel.startsWith("..") && !path3.isAbsolute(rel);
+  const rel = path4.relative(resolvedParent, resolvedChild);
+  return !!rel && !rel.startsWith("..") && !path4.isAbsolute(rel);
 }
 function classifyProjectFile(name) {
   if (name.endsWith(".ts") || name.endsWith(".tsx") || name.endsWith(".js")) {
@@ -5561,20 +5583,20 @@ var init_common = __esm({
 });
 
 // src/compiler/utils/path-resolver.ts
-import * as fs3 from "fs";
-import * as path4 from "path";
+import * as fs4 from "fs";
+import * as path5 from "path";
 function getTsConfigPathMappings(rootDir) {
-  const resolvedRoot = path4.resolve(rootDir);
+  const resolvedRoot = path5.resolve(rootDir);
   if (mappingsCache.has(resolvedRoot)) {
     return mappingsCache.get(resolvedRoot) ?? null;
   }
-  const tsconfigPath = path4.join(resolvedRoot, "tsconfig.json");
-  if (!fs3.existsSync(tsconfigPath)) {
+  const tsconfigPath = path5.join(resolvedRoot, "tsconfig.json");
+  if (!fs4.existsSync(tsconfigPath)) {
     mappingsCache.set(resolvedRoot, null);
     return null;
   }
   try {
-    const tsconfigContent = fs3.readFileSync(tsconfigPath, "utf-8");
+    const tsconfigContent = fs4.readFileSync(tsconfigPath, "utf-8");
     const tsconfig = JSON.parse(tsconfigContent);
     const compilerOptions = tsconfig.compilerOptions || {};
     if (compilerOptions.paths) {
@@ -5601,7 +5623,7 @@ function resolvePathAlias(specifier, rootDir) {
     if (match) {
       const captured = match[1] || "";
       const targetPath = targets[0].replace("*", captured);
-      return path4.join(mappings.rootDir, mappings.baseUrl, targetPath);
+      return path5.join(mappings.rootDir, mappings.baseUrl, targetPath);
     }
   }
   return null;
@@ -5613,20 +5635,20 @@ function resolveModuleSpecifier(specifier, fromFile, rootDir) {
     return tryExtensions(aliasResolved);
   }
   if (normalized.startsWith("./") || normalized.startsWith("../")) {
-    const basePath = path4.resolve(path4.dirname(fromFile), normalized);
+    const basePath = path5.resolve(path5.dirname(fromFile), normalized);
     return tryExtensions(basePath);
   }
   return void 0;
 }
 function tryExtensions(basePath) {
   for (const ext of MODULE_EXTENSIONS) {
-    const full = ext.startsWith("/") ? path4.join(basePath, ext) : basePath + ext;
-    if (fs3.existsSync(full)) return full;
+    const full = ext.startsWith("/") ? path5.join(basePath, ext) : basePath + ext;
+    if (fs4.existsSync(full)) return full;
   }
   return void 0;
 }
 function registerProjectRootDir(project, rootDir) {
-  projectRootDirs.set(project, path4.resolve(rootDir));
+  projectRootDirs.set(project, path5.resolve(rootDir));
 }
 function getProjectRootDir(project) {
   return projectRootDirs.get(project);
@@ -6226,7 +6248,7 @@ var init_reference_resolver = __esm({
 });
 
 // src/compiler/plugins/skill.plugin.ts
-import fs4 from "fs/promises";
+import fs5 from "fs/promises";
 import { Node as Node11 } from "ts-morph";
 function findEnclosingVariableDeclaration(config) {
   let current = config.getParent();
@@ -6559,7 +6581,7 @@ var init_skill_plugin = __esm({
           description: metadata.description,
           metadata: this.sanitizeForPersistence(metadata.metadata)
         }, null, 2);
-        const originalSource = await fs4.readFile(metadata.sourcePath, "utf-8");
+        const originalSource = await fs5.readFile(metadata.sourcePath, "utf-8");
         return {
           code,
           sourceMap: "",
@@ -6663,6 +6685,31 @@ var init_skill_plugin = __esm({
 
 // src/compiler/plugins/agent.plugin.ts
 import { Node as Node12 } from "ts-morph";
+function shapeModelSettings(raw) {
+  const KNOWN_KEYS = [
+    "temperature",
+    "topP",
+    "topK",
+    "maxOutputTokens",
+    "presencePenalty",
+    "frequencyPenalty",
+    "stopSequences",
+    "seed"
+  ];
+  const result = {};
+  for (const key of KNOWN_KEYS) {
+    const value = raw[key];
+    if (value === void 0) continue;
+    if (key === "stopSequences") {
+      if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+        result[key] = value;
+      }
+    } else if (typeof value === "number" && Number.isFinite(value)) {
+      result[key] = value;
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
 var AgentPlugin, agentPlugin;
 var init_agent_plugin = __esm({
   "src/compiler/plugins/agent.plugin.ts"() {
@@ -6695,7 +6742,8 @@ var init_agent_plugin = __esm({
           "name",
           "description",
           "persona",
-          "model"
+          "model",
+          "modelSettings"
         ]
       };
       supportsClassDefinition = true;
@@ -6752,6 +6800,9 @@ var init_agent_plugin = __esm({
         const governanceHit = findClassMember(classDecl, "governance", "property");
         const governanceObj = governanceHit && Node12.isPropertyDeclaration(governanceHit.node) ? evaluateNodeAsObject(governanceHit.node.getInitializer()) : void 0;
         const governance = governanceObj && typeof governanceObj.mode === "string" ? governanceObj : void 0;
+        const modelSettingsHit = findClassMember(classDecl, "modelSettings", "property");
+        const modelSettingsObj = modelSettingsHit && Node12.isPropertyDeclaration(modelSettingsHit.node) ? evaluateNodeAsObject(modelSettingsHit.node.getInitializer()) : void 0;
+        const modelSettings = modelSettingsObj ? shapeModelSettings(modelSettingsObj) : void 0;
         return {
           kind: this.kind,
           name,
@@ -6766,6 +6817,7 @@ var init_agent_plugin = __esm({
             persona,
             model,
             hasModelResolver,
+            modelSettings,
             batching,
             governance
           }
@@ -6795,6 +6847,7 @@ var init_agent_plugin = __esm({
           "text"
         ]) ?? "";
         const { model, hasModelResolver } = this.extractModelInfo(config);
+        const modelSettings = this.extractModelSettings(config);
         const batching = this.extractBatchingInfo(config);
         const governance = this.extractGovernanceInfo(config);
         const { voiceRefNames, voiceRefSourcePaths } = this.extractVoiceRefs(config);
@@ -6811,6 +6864,7 @@ var init_agent_plugin = __esm({
             persona,
             model,
             hasModelResolver,
+            modelSettings,
             batching,
             governance,
             voiceRefNames,
@@ -6881,6 +6935,17 @@ var init_agent_plugin = __esm({
         return governance;
       }
       /**
+      * Extract `modelSettings` from the config-literal path. Delegates to the
+      * shared `shapeModelSettings` helper so the class-definition extraction
+      * path applies the exact same key whitelist + type narrowing — without
+      * the shared helper, the two paths would drift (see Bugbot #ref1).
+      */
+      extractModelSettings(config) {
+        const raw = extractObjectProperty(config, "modelSettings");
+        if (!raw || typeof raw !== "object") return void 0;
+        return shapeModelSettings(raw);
+      }
+      /**
       * Extract model info from agent config.
       * Returns the static model string (if any) and whether a resolver function exists.
       */
@@ -6962,6 +7027,7 @@ var init_agent_plugin = __esm({
           persona: agentMeta.persona,
           model: agentMeta.model,
           hasModelResolver: agentMeta.hasModelResolver || void 0,
+          modelSettings: agentMeta.modelSettings,
           batching: agentMeta.batching,
           governance: agentMeta.governance,
           voiceRefs
@@ -7023,6 +7089,7 @@ var init_agent_plugin = __esm({
         return rest;
       }
     };
+    __name(shapeModelSettings, "shapeModelSettings");
     agentPlugin = new AgentPlugin();
   }
 });
@@ -7313,10 +7380,10 @@ var init_device_trigger_plugin = __esm({
 });
 
 // src/compiler/utils/primitive-rewrite.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { Node as Node14, Project, ts as ts3 } from "ts-morph";
 function rewritePrimitiveSource(metadata, opts) {
-  const sourceCode = readFileSync8(metadata.sourcePath, "utf-8");
+  const sourceCode = readFileSync9(metadata.sourcePath, "utf-8");
   const localProject = new Project({
     useInMemoryFileSystem: true,
     compilerOptions: {
@@ -7655,7 +7722,7 @@ var init_cross_file_specs = __esm({
 });
 
 // src/compiler/plugins/voice.plugin.ts
-import fs5 from "fs/promises";
+import fs6 from "fs/promises";
 import { Node as Node15 } from "ts-morph";
 function astObjectToPlain(obj) {
   const result = {};
@@ -8086,6 +8153,7 @@ var init_voice_plugin = __esm({
         const tts = extractModelField(config, "tts");
         const krispEnabled = extractBooleanProperty(config, "krispEnabled");
         const persistTranscript = extractBooleanProperty(config, "persistTranscript");
+        const onToolFailureSay = extractStringProperty(config, "onToolFailureSay");
         const volume = extractNumberProperty(config, "volume");
         const interruption = extractObjectProperty(config, "interruption");
         const pronunciationsRaw = extractObjectProperty(config, "pronunciations");
@@ -8122,6 +8190,7 @@ var init_voice_plugin = __esm({
             hasTools: hasArrayProperty(config, "tools"),
             krispEnabled,
             persistTranscript,
+            onToolFailureSay,
             volume,
             pronunciations,
             backgroundAudio,
@@ -8181,6 +8250,7 @@ var init_voice_plugin = __esm({
           if (fields.sttLanguage !== void 0) candidate.sttLanguage = fields.sttLanguage;
           if (fields.krispEnabled !== void 0) candidate.krispEnabled = fields.krispEnabled;
           if (fields.persistTranscript !== void 0) candidate.persistTranscript = fields.persistTranscript;
+          if (fields.onToolFailureSay !== void 0) candidate.onToolFailureSay = fields.onToolFailureSay;
           if (fields.volume !== void 0) candidate.volume = fields.volume;
           if (fields.pronunciations !== void 0) candidate.pronunciations = fields.pronunciations;
           if (fields.backgroundAudio !== void 0) candidate.backgroundAudio = fields.backgroundAudio;
@@ -8196,8 +8266,8 @@ var init_voice_plugin = __esm({
             }, "isMissingTopLevelRequired");
             for (const issue of parsed.error.issues) {
               if (isMissingTopLevelRequired(issue)) continue;
-              const path18 = issue.path.length > 0 ? issue.path.join(".") : "<root>";
-              errors.push(validationError(`Voice config invalid at \`${path18}\`: ${issue.message}`, {
+              const path19 = issue.path.length > 0 ? issue.path.join(".") : "<root>";
+              errors.push(validationError(`Voice config invalid at \`${path19}\`: ${issue.message}`, {
                 line
               }));
             }
@@ -8278,7 +8348,7 @@ var init_voice_plugin = __esm({
           description: metadata.description,
           metadata: sanitized
         }, null, 2);
-        const originalSource = await fs5.readFile(metadata.sourcePath, "utf-8");
+        const originalSource = await fs6.readFile(metadata.sourcePath, "utf-8");
         return {
           code,
           sourceMap: "",
@@ -8335,6 +8405,7 @@ var init_voice_plugin = __esm({
           volume: fields.volume,
           pronunciations: fields.pronunciations,
           persistTranscript: fields.persistTranscript,
+          onToolFailureSay: fields.onToolFailureSay,
           interruption: fields.interruption
         };
         return entry;
@@ -8431,8 +8502,8 @@ var init_registry = __esm({
 });
 
 // src/compiler/bundler.ts
-import fs6 from "fs/promises";
-import path5 from "path";
+import fs7 from "fs/promises";
+import path6 from "path";
 import crypto4 from "crypto";
 import { build } from "esbuild";
 var Bundler;
@@ -8501,9 +8572,9 @@ var init_bundler = __esm({
       * Bundle a primitive's entry point using esbuild.
       */
       async bundle(metadata, entryPointCode) {
-        const tempDir = path5.join(this.options.outDir, ".temp");
-        const outfile = path5.join(tempDir, `${metadata.kind}-${metadata.name}.bundle.js`);
-        const sourceDir = path5.dirname(metadata.sourcePath);
+        const tempDir = path6.join(this.options.outDir, ".temp");
+        const outfile = path6.join(tempDir, `${metadata.kind}-${metadata.name}.bundle.js`);
+        const sourceDir = path6.dirname(metadata.sourcePath);
         if (this.options.debug) {
           this.verbose(`      Source: ${metadata.sourcePath}`);
           this.verbose(`      Output: ${outfile}`);
@@ -8533,15 +8604,15 @@ var init_bundler = __esm({
           ],
           logLevel: this.options.debug ? "debug" : "silent"
         });
-        const code = await fs6.readFile(outfile, "utf-8");
+        const code = await fs7.readFile(outfile, "utf-8");
         let sourceMap = "";
         try {
-          sourceMap = await fs6.readFile(outfile + ".map", "utf-8");
+          sourceMap = await fs7.readFile(outfile + ".map", "utf-8");
         } catch {
         }
-        const originalSource = await fs6.readFile(metadata.sourcePath, "utf-8");
+        const originalSource = await fs7.readFile(metadata.sourcePath, "utf-8");
         const hash = crypto4.createHash("sha256").update(code).digest("hex").slice(0, 16);
-        const stats = await fs6.stat(outfile);
+        const stats = await fs7.stat(outfile);
         return {
           code,
           sourceMap,
@@ -8558,14 +8629,14 @@ var init_bundler = __esm({
         const bundler = this;
         const sourcePath = metadata.sourcePath;
         const exportName = metadata.exportName;
-        const sourceDir = path5.dirname(sourcePath);
+        const sourceDir = path6.dirname(sourcePath);
         return {
           name: "lua-virtual-source",
           setup(build2) {
             build2.onResolve({
               filter: /.*/
             }, (args2) => {
-              const resolved = args2.path.startsWith(".") ? path5.resolve(args2.resolveDir, args2.path) : args2.path;
+              const resolved = args2.path.startsWith(".") ? path6.resolve(args2.resolveDir, args2.path) : args2.path;
               const normalizedResolved = resolved.replace(/\.(ts|tsx|js|jsx)$/, "");
               const normalizedSource = sourcePath.replace(/\.(ts|tsx|js|jsx)$/, "");
               if (normalizedResolved === normalizedSource) {
@@ -8581,8 +8652,8 @@ var init_bundler = __esm({
               namespace: "lua-virtual-source"
             }, async () => {
               const sourceFile = bundler.project.getSourceFile(sourcePath);
-              let content = sourceFile?.getText() ?? await fs6.readFile(sourcePath, "utf-8");
-              content = bundler.stripLuaCliImportsAST(content, path5.basename(sourcePath));
+              let content = sourceFile?.getText() ?? await fs7.readFile(sourcePath, "utf-8");
+              content = bundler.stripLuaCliImportsAST(content, path6.basename(sourcePath));
               const virtualContent = metadata.isDefaultExport ? content : `${content}
 export { ${exportName} as __lua_target__ };
 `;
@@ -8610,17 +8681,17 @@ export { ${exportName} as __lua_target__ };
               namespace: "file"
             }, async (args2) => {
               if (args2.path.includes("node_modules")) return null;
-              const contents = await fs6.readFile(args2.path, "utf-8");
+              const contents = await fs7.readFile(args2.path, "utf-8");
               if (!contents.includes("lua-cli") && !contents.includes("api-exports")) {
                 return null;
               }
               try {
-                const modifiedContents = stripImports(contents, path5.basename(args2.path));
+                const modifiedContents = stripImports(contents, path6.basename(args2.path));
                 if (modifiedContents !== contents) {
                   return {
                     contents: modifiedContents,
                     loader: args2.path.endsWith(".ts") || args2.path.endsWith(".tsx") ? "ts" : "js",
-                    resolveDir: path5.dirname(args2.path)
+                    resolveDir: path6.dirname(args2.path)
                   };
                 }
                 return null;
@@ -8657,8 +8728,8 @@ export { ${exportName} as __lua_target__ };
 
 // src/compiler/agent-traverser.ts
 import { Project as Project2, Node as Node16 } from "ts-morph";
-import path6 from "path";
-import fs7 from "fs";
+import path7 from "path";
+import fs8 from "fs";
 var PRIMITIVE_TYPES, AgentTraverser;
 var init_agent_traverser = __esm({
   "src/compiler/agent-traverser.ts"() {
@@ -8731,7 +8802,7 @@ var init_agent_traverser = __esm({
         this.rootDir = rootDir;
         this.debug = debug;
         this.project = new Project2({
-          tsConfigFilePath: path6.join(rootDir, "tsconfig.json"),
+          tsConfigFilePath: path7.join(rootDir, "tsconfig.json"),
           skipAddingFilesFromTsConfig: true
         });
         registerProjectRootDir(this.project, this.rootDir);
@@ -8815,15 +8886,15 @@ var init_agent_traverser = __esm({
       */
       detectAgent() {
         const priorityFiles = [
-          path6.join(this.rootDir, "index.ts"),
-          path6.join(this.rootDir, "src", "index.ts"),
-          path6.join(this.rootDir, "agent.ts"),
-          path6.join(this.rootDir, "src", "agent.ts"),
-          path6.join(this.rootDir, "main.ts"),
-          path6.join(this.rootDir, "src", "main.ts")
+          path7.join(this.rootDir, "index.ts"),
+          path7.join(this.rootDir, "src", "index.ts"),
+          path7.join(this.rootDir, "agent.ts"),
+          path7.join(this.rootDir, "src", "agent.ts"),
+          path7.join(this.rootDir, "main.ts"),
+          path7.join(this.rootDir, "src", "main.ts")
         ];
         for (const filePath of priorityFiles) {
-          if (fs7.existsSync(filePath)) {
+          if (fs8.existsSync(filePath)) {
             try {
               const sourceFile = this.project.addSourceFileAtPath(filePath);
               const agent = this.detectAgentInFile(sourceFile);
@@ -8975,7 +9046,7 @@ var init_agent_traverser = __esm({
             console.warn(formatSarifWarning({
               ruleId: "lua/missing-primitive-declaration",
               filePath: sourcePath,
-              message: `agent references ${kind} "${refName}" but ${path6.basename(sourcePath)} does not define a matching primitive`,
+              message: `agent references ${kind} "${refName}" but ${path7.basename(sourcePath)} does not define a matching primitive`,
               hint: `export a named ${plugin.displayName.toLowerCase()} declaration as "${refName}", or adjust the import so it points to the file that does`
             }));
             return null;
@@ -8995,20 +9066,20 @@ var init_agent_traverser = __esm({
 });
 
 // src/compiler/utils/workspace.ts
-import fs8 from "fs";
-import path7 from "path";
+import fs9 from "fs";
+import path8 from "path";
 function findWorkspaceRoot(rootDir) {
-  const resolvedInput = path7.resolve(rootDir);
+  const resolvedInput = path8.resolve(rootDir);
   const cached = workspaceRootCache.get(resolvedInput);
   if (cached !== void 0) return cached;
   let current = resolvedInput;
-  const { root } = path7.parse(current);
+  const { root } = path8.parse(current);
   while (true) {
     if (isWorkspaceRoot(current)) {
       workspaceRootCache.set(resolvedInput, current);
       return current;
     }
-    const parent = path7.dirname(current);
+    const parent = path8.dirname(current);
     if (parent === current || current === root) break;
     current = parent;
   }
@@ -9016,22 +9087,22 @@ function findWorkspaceRoot(rootDir) {
   return resolvedInput;
 }
 function isWorkspaceRoot(dir) {
-  if (fileExists(path7.join(dir, "pnpm-workspace.yaml"))) return true;
-  if (fileExists(path7.join(dir, "lerna.json"))) return true;
-  if (packageJsonHasWorkspaces(path7.join(dir, "package.json"))) return true;
-  if (dirExists(path7.join(dir, ".git"))) return true;
+  if (fileExists(path8.join(dir, "pnpm-workspace.yaml"))) return true;
+  if (fileExists(path8.join(dir, "lerna.json"))) return true;
+  if (packageJsonHasWorkspaces(path8.join(dir, "package.json"))) return true;
+  if (dirExists(path8.join(dir, ".git"))) return true;
   return false;
 }
 function fileExists(p) {
   try {
-    return fs8.statSync(p).isFile();
+    return fs9.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function dirExists(p) {
   try {
-    return fs8.statSync(p).isDirectory();
+    return fs9.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -9039,7 +9110,7 @@ function dirExists(p) {
 function packageJsonHasWorkspaces(pkgPath) {
   if (!fileExists(pkgPath)) return false;
   try {
-    const raw = fs8.readFileSync(pkgPath, "utf-8");
+    const raw = fs9.readFileSync(pkgPath, "utf-8");
     const json = JSON.parse(raw);
     if (!json.workspaces) return false;
     return Array.isArray(json.workspaces) || typeof json.workspaces === "object";
@@ -9061,8 +9132,8 @@ var init_workspace = __esm({
 });
 
 // src/compiler/compiler.ts
-import fs9 from "fs/promises";
-import path8 from "path";
+import fs10 from "fs/promises";
+import path9 from "path";
 import { Project as Project3 } from "ts-morph";
 async function compile(options) {
   const compiler = new Compiler(options);
@@ -9115,7 +9186,7 @@ var init_compiler = __esm({
           ...options
         };
         this.project = new Project3({
-          tsConfigFilePath: path8.join(options.rootDir, "tsconfig.json")
+          tsConfigFilePath: path9.join(options.rootDir, "tsconfig.json")
         });
         registerProjectRootDir(this.project, this.options.rootDir);
         this.bundler = new Bundler({
@@ -9192,10 +9263,10 @@ var init_compiler = __esm({
             return await this.createResult(false, [], errors, warnings, startTime);
           }
           this.verbose("\u{1F4E6} Bundling primitives...");
-          await fs9.mkdir(this.options.outDir, {
+          await fs10.mkdir(this.options.outDir, {
             recursive: true
           });
-          await fs9.mkdir(path8.join(this.options.outDir, ".temp"), {
+          await fs10.mkdir(path9.join(this.options.outDir, ".temp"), {
             recursive: true
           });
           const CONCURRENCY = 4;
@@ -9215,7 +9286,7 @@ var init_compiler = __esm({
           this.verbose("\u{1F4BE} Writing artifacts...");
           await this.writeArtifacts(compiledPrimitives);
           if (!this.options.debug) {
-            await fs9.rm(path8.join(this.options.outDir, ".temp"), {
+            await fs10.rm(path9.join(this.options.outDir, ".temp"), {
               recursive: true,
               force: true
             });
@@ -9258,7 +9329,7 @@ var init_compiler = __esm({
       */
       getWorkspaceRoot() {
         if (this._workspaceRoot === void 0) {
-          this._workspaceRoot = findWorkspaceRoot(path8.resolve(this.options.rootDir));
+          this._workspaceRoot = findWorkspaceRoot(path9.resolve(this.options.rootDir));
         }
         return this._workspaceRoot;
       }
@@ -9272,18 +9343,18 @@ var init_compiler = __esm({
       *  - Files outside the detected workspace root (not our code)
       */
       collectExternalWorkspaceFiles(traverser) {
-        const rootDir = path8.resolve(this.options.rootDir);
+        const rootDir = path9.resolve(this.options.rootDir);
         const workspaceRoot = this.getWorkspaceRoot();
         if (workspaceRoot === rootDir) return [];
         const loaded = traverser.getAllLoadedSourceFilePaths();
         const result = [];
         const seen = /* @__PURE__ */ new Set();
         for (const raw of loaded) {
-          const abs = path8.resolve(raw);
+          const abs = path9.resolve(raw);
           if (seen.has(abs)) continue;
           seen.add(abs);
           if (isInside(abs, rootDir)) continue;
-          if (abs.includes(`${path8.sep}node_modules${path8.sep}`)) continue;
+          if (abs.includes(`${path9.sep}node_modules${path9.sep}`)) continue;
           if (!isInside(abs, workspaceRoot)) continue;
           result.push(abs);
         }
@@ -9416,9 +9487,9 @@ var init_compiler = __esm({
       * @param primitives - All compiled primitives to write
       */
       async writeArtifacts(primitives) {
-        const artifactsDir = path8.join(this.options.outDir, "artifacts");
-        const sourcesDir = path8.join(this.options.outDir, "sources");
-        await fs9.mkdir(sourcesDir, {
+        const artifactsDir = path9.join(this.options.outDir, "artifacts");
+        const sourcesDir = path9.join(this.options.outDir, "sources");
+        await fs10.mkdir(sourcesDir, {
           recursive: true
         });
         const writtenSources = /* @__PURE__ */ new Map();
@@ -9426,7 +9497,7 @@ var init_compiler = __esm({
         this.verbose("   \u{1F4C2} Collecting project files...");
         const projectFiles = await this.storeProjectFiles(sourcesDir, writtenSources);
         const manifest = await this.createManifest(primitives, projectFiles);
-        await fs9.writeFile(path8.join(this.options.outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+        await fs10.writeFile(path9.join(this.options.outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
         this.verbose(`   \u{1F4E6} Total files stored: ${writtenSources.size} (deduplicated)`);
         this.verbose(`   \u{1F4C1} Project files: ${projectFiles.length}`);
         if (this.options.verbose || this.options.debug) {
@@ -9438,25 +9509,25 @@ var init_compiler = __esm({
       */
       async writePrimitiveArtifacts(primitives, artifactsDir, sourcesDir, writtenSources) {
         for (const primitive of primitives) {
-          const primitiveDir = path8.join(artifactsDir, primitive.kind);
-          await fs9.mkdir(primitiveDir, {
+          const primitiveDir = path9.join(artifactsDir, primitive.kind);
+          await fs10.mkdir(primitiveDir, {
             recursive: true
           });
           const baseName = primitive.name;
-          await fs9.writeFile(path8.join(primitiveDir, `${baseName}.js`), primitive.artifact.code);
+          await fs10.writeFile(path9.join(primitiveDir, `${baseName}.js`), primitive.artifact.code);
           if (primitive.artifact.sourceMap) {
-            await fs9.writeFile(path8.join(primitiveDir, `${baseName}.js.map`), primitive.artifact.sourceMap);
+            await fs10.writeFile(path9.join(primitiveDir, `${baseName}.js.map`), primitive.artifact.sourceMap);
           }
           const sourceHash = hashContent(primitive.artifact.originalSource);
           if (!writtenSources.has(sourceHash)) {
             const ext = primitive.sourcePath.endsWith(".tsx") ? ".tsx" : ".ts";
-            await fs9.writeFile(path8.join(sourcesDir, `${sourceHash}${ext}`), primitive.artifact.originalSource);
-            const relativePath = path8.relative(this.options.rootDir, primitive.sourcePath);
+            await fs10.writeFile(path9.join(sourcesDir, `${sourceHash}${ext}`), primitive.artifact.originalSource);
+            const relativePath = path9.relative(this.options.rootDir, primitive.sourcePath);
             writtenSources.set(sourceHash, relativePath);
           }
           const sidecarPlugin = pluginRegistry.get(primitive.kind);
           const sidecarMetadata = sidecarPlugin?.sanitizeForPersistence ? sidecarPlugin.sanitizeForPersistence(primitive.metadata) : primitive.metadata;
-          await fs9.writeFile(path8.join(primitiveDir, `${baseName}.json`), JSON.stringify({
+          await fs10.writeFile(path9.join(primitiveDir, `${baseName}.json`), JSON.stringify({
             kind: primitive.kind,
             name: primitive.name,
             description: primitive.description,
@@ -9478,12 +9549,12 @@ var init_compiler = __esm({
         const allFiles = await this.collectProjectFiles();
         const workspaceRoot = this.getWorkspaceRoot();
         for (const file of allFiles) {
-          const absPath = file.external ? path8.join(workspaceRoot, file.relativePath) : path8.join(this.options.rootDir, file.relativePath);
-          const content = await fs9.readFile(absPath, "utf-8");
+          const absPath = file.external ? path9.join(workspaceRoot, file.relativePath) : path9.join(this.options.rootDir, file.relativePath);
+          const content = await fs10.readFile(absPath, "utf-8");
           const hash = hashContent(content);
           if (!writtenSources.has(hash)) {
-            const ext = path8.extname(file.relativePath) || ".txt";
-            await fs9.writeFile(path8.join(sourcesDir, `${hash}${ext}`), content);
+            const ext = path9.extname(file.relativePath) || ".txt";
+            await fs10.writeFile(path9.join(sourcesDir, `${hash}${ext}`), content);
             writtenSources.set(hash, file.relativePath);
           }
           projectFiles.push({
@@ -9559,12 +9630,12 @@ var init_compiler = __esm({
       async collectProjectFiles() {
         const files = [];
         const scanDir = /* @__PURE__ */ __name(async (dir, relativeBase = "") => {
-          const entries = await fs9.readdir(dir, {
+          const entries = await fs10.readdir(dir, {
             withFileTypes: true
           });
           for (const entry of entries) {
             const relativePath = relativeBase ? `${relativeBase}/${entry.name}` : entry.name;
-            const fullPath = path8.join(dir, entry.name);
+            const fullPath = path9.join(dir, entry.name);
             if (entry.isDirectory()) {
               if (shouldSkipDirectory(entry.name)) continue;
               await scanDir(fullPath, relativePath);
@@ -9581,10 +9652,10 @@ var init_compiler = __esm({
         const workspaceRoot = this.getWorkspaceRoot();
         const externalSeen = /* @__PURE__ */ new Set();
         for (const abs of this.externalWorkspaceFiles) {
-          const rel = path8.relative(workspaceRoot, abs).split(path8.sep).join("/");
+          const rel = path9.relative(workspaceRoot, abs).split(path9.sep).join("/");
           if (!rel || rel.startsWith("..")) continue;
           if (externalSeen.has(rel)) continue;
-          const name = path8.basename(abs);
+          const name = path9.basename(abs);
           if (shouldSkipFile(rel) || shouldSkipFile(name)) continue;
           externalSeen.add(rel);
           files.push({
@@ -9685,13 +9756,13 @@ var init_compiler = __esm({
 });
 
 // src/compiler/utils/file-discovery.ts
-import path9 from "path";
-import fs10 from "fs";
+import path10 from "path";
+import fs11 from "fs";
 function findEntryPoint(projectDir) {
   const baseDir = projectDir || process.cwd();
   for (const relativePath of ENTRY_POINT_PRIORITY) {
-    const fullPath = path9.join(baseDir, relativePath);
-    if (fs10.existsSync(fullPath)) {
+    const fullPath = path10.join(baseDir, relativePath);
+    if (fs11.existsSync(fullPath)) {
       return fullPath;
     }
   }
@@ -9728,8 +9799,8 @@ var init_file_discovery = __esm({
 
 // src/compiler/source-writer.ts
 import { Project as Project4, Node as Node17 } from "ts-morph";
-import fs11 from "fs";
-import path10 from "path";
+import fs12 from "fs";
+import path11 from "path";
 function resolveEntryPath(options) {
   let indexPath;
   try {
@@ -9741,14 +9812,14 @@ function resolveEntryPath(options) {
         indexPath = entryPoint;
       } else {
         const baseDir = options?.projectDir || process.cwd();
-        indexPath = path10.join(baseDir, "src", "index.ts");
+        indexPath = path11.join(baseDir, "src", "index.ts");
       }
     }
   } catch {
     const baseDir = options?.projectDir || process.cwd();
-    indexPath = path10.join(baseDir, "src", "index.ts");
+    indexPath = path11.join(baseDir, "src", "index.ts");
   }
-  if (!fs11.existsSync(indexPath)) {
+  if (!fs12.existsSync(indexPath)) {
     console.warn(`Warning: Entry file not found at ${indexPath}`);
     return null;
   }
@@ -13738,6 +13809,164 @@ __name(promptAuthMethod, "promptAuthMethod");
 
 // src/commands/configure.ts
 init_analytics();
+
+// src/utils/versioning-mode-cache.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+
+// src/api/agent-version.api.service.ts
+init_http_client();
+var AgentVersionApi = class extends HttpClient {
+  static {
+    __name(this, "AgentVersionApi");
+  }
+  apiKey;
+  agentId;
+  constructor(baseUrl, apiKey, agentId) {
+    super(baseUrl);
+    this.apiKey = apiKey;
+    this.agentId = agentId;
+  }
+  get basePath() {
+    return `/developer/agents/${encodeURIComponent(this.agentId)}`;
+  }
+  get authHeader() {
+    return {
+      Authorization: `Bearer ${this.apiKey}`
+    };
+  }
+  // ---------------------------------------------------------------------------
+  // Versioning mode
+  // ---------------------------------------------------------------------------
+  async getVersioningMode() {
+    return this.httpGet(`${this.basePath}/versioning/mode`, this.authHeader);
+  }
+  // ---------------------------------------------------------------------------
+  // Version CRUD
+  // ---------------------------------------------------------------------------
+  async createVersion(body) {
+    return this.httpPost(`${this.basePath}/versions`, body, this.authHeader);
+  }
+  async listVersions(query) {
+    const params = new URLSearchParams();
+    if (query?.all !== void 0) params.append("all", String(query.all));
+    if (query?.limit !== void 0) params.append("limit", String(query.limit));
+    if (query?.status !== void 0) params.append("status", query.status);
+    const qs = params.toString();
+    const url = qs ? `${this.basePath}/versions?${qs}` : `${this.basePath}/versions`;
+    return this.httpGet(url, this.authHeader);
+  }
+  async getVersion(version) {
+    return this.httpGet(`${this.basePath}/versions/${version}`, this.authHeader);
+  }
+  async deleteVersion(version) {
+    return this.httpDelete(`${this.basePath}/versions/${version}`, this.authHeader);
+  }
+  // ---------------------------------------------------------------------------
+  // Diff
+  // ---------------------------------------------------------------------------
+  async diffVersions(from, to) {
+    const url = `${this.basePath}/versions/diff?from=${from}&to=${to}`;
+    return this.httpGet(url, this.authHeader);
+  }
+  // ---------------------------------------------------------------------------
+  // Promote
+  // ---------------------------------------------------------------------------
+  async promoteVersion(version) {
+    return this.httpPost(`${this.basePath}/versions/${version}/promote`, {}, this.authHeader);
+  }
+  // ---------------------------------------------------------------------------
+  // Patch commit hash — called by `lua version create` after a successful git
+  // commit + tag to propagate the SHA to the backend AgentVersion record.
+  // Failure is non-fatal; the version snapshot is valid whether or not this
+  // PATCH lands.
+  // ---------------------------------------------------------------------------
+  async patchCommitHash(version, commitHash) {
+    return this.httpPatch(`${this.basePath}/versions/${version}/commit-hash`, {
+      commitHash
+    }, this.authHeader);
+  }
+};
+
+// src/utils/versioning-mode-cache.ts
+init_constants();
+init_auth_error();
+init_constants();
+var CACHE_TTL_MS = 60 * 60 * 1e3;
+function readCacheFile() {
+  try {
+    const raw = fs3.readFileSync(CLI_CACHE_FILE, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+__name(readCacheFile, "readCacheFile");
+function writeCacheFile(data) {
+  try {
+    fs3.mkdirSync(path3.dirname(CLI_CACHE_FILE), {
+      recursive: true
+    });
+    fs3.writeFileSync(CLI_CACHE_FILE, JSON.stringify(data, null, 2));
+  } catch {
+  }
+}
+__name(writeCacheFile, "writeCacheFile");
+function isFresh(entry) {
+  const age = Date.now() - new Date(entry.cachedAt).getTime();
+  return age >= 0 && age < CACHE_TTL_MS;
+}
+__name(isFresh, "isFresh");
+async function getVersioningModeCached(apiKey, agentId) {
+  const file = readCacheFile();
+  const existing = file.versioningMode?.[agentId];
+  if (existing && isFresh(existing)) {
+    return {
+      enabled: existing.enabled
+    };
+  }
+  try {
+    const api = new AgentVersionApi(BASE_URLS.API, apiKey, agentId);
+    const response = await api.getVersioningMode();
+    if (!response.success || !response.data) {
+      if (existing) return {
+        enabled: existing.enabled
+      };
+      return {
+        enabled: false
+      };
+    }
+    const enabled = response.data.enabled === true;
+    file.versioningMode = file.versioningMode ?? {};
+    file.versioningMode[agentId] = {
+      enabled,
+      cachedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    writeCacheFile(file);
+    return {
+      enabled
+    };
+  } catch (err) {
+    if (err instanceof AuthenticationError) throw err;
+    if (err instanceof Error && /access denied|forbidden|403|401/i.test(err.message)) throw err;
+    if (existing) return {
+      enabled: existing.enabled
+    };
+    return {
+      enabled: false
+    };
+  }
+}
+__name(getVersioningModeCached, "getVersioningModeCached");
+function invalidateVersioningModeCache() {
+  const file = readCacheFile();
+  if (!file.versioningMode) return;
+  delete file.versioningMode;
+  writeCacheFile(file);
+}
+__name(invalidateVersioningModeCache, "invalidateVersioningModeCache");
+
+// src/commands/configure.ts
 async function configureCommand(options = {}) {
   return withErrorHandling(async () => {
     const { apiKey, email, otp } = options;
@@ -13747,11 +13976,13 @@ async function configureCommand(options = {}) {
       authMethod = "api-key";
       nonInteractive = true;
       await handleApiKeyAuthNonInteractive(apiKey);
+      invalidateVersioningModeCache();
     } else if (email) {
       authMethod = "email";
       nonInteractive = true;
       if (otp) {
         await handleEmailOtpVerify(email, otp);
+        invalidateVersioningModeCache();
       } else {
         await handleEmailOtpRequest(email);
       }
@@ -13760,8 +13991,10 @@ async function configureCommand(options = {}) {
       clearPromptLines(2);
       if (authMethod === "api-key") {
         await handleApiKeyAuth();
+        invalidateVersioningModeCache();
       } else if (authMethod === "email") {
         await handleEmailAuth();
+        invalidateVersioningModeCache();
       }
     }
     trackEvent("cli_auth_completed", {
@@ -14433,8 +14666,8 @@ init_compile_constants();
 init_artifact_loader();
 init_backup_api_service();
 init_constants();
-import fs12 from "fs";
-import path11 from "path";
+import fs13 from "fs";
+import path12 from "path";
 var BACKUP_CACHE_FILENAME = "backup-manifest.json";
 function calculateProjectHash(projectFiles) {
   return combineFileHashes(projectFiles);
@@ -14447,11 +14680,11 @@ function getCurrentProjectHash(projectPath = process.cwd()) {
 }
 __name(getCurrentProjectHash, "getCurrentProjectHash");
 function loadSourceByHash(hash, relativePath, projectPath = process.cwd()) {
-  const sourcesDir = path11.join(projectPath, COMPILE_DIRS.DIST_V2, "sources");
-  const ext = path11.extname(relativePath) || ".txt";
-  const sourcePath = path11.join(sourcesDir, `${hash}${ext}`);
-  if (fs12.existsSync(sourcePath)) {
-    return fs12.readFileSync(sourcePath, "utf-8");
+  const sourcesDir = path12.join(projectPath, COMPILE_DIRS.DIST_V2, "sources");
+  const ext = path12.extname(relativePath) || ".txt";
+  const sourcePath = path12.join(sourcesDir, `${hash}${ext}`);
+  if (fs13.existsSync(sourcePath)) {
+    return fs13.readFileSync(sourcePath, "utf-8");
   }
   return null;
 }
@@ -14470,30 +14703,30 @@ function prepareFileRefs(projectPath = process.cwd()) {
 }
 __name(prepareFileRefs, "prepareFileRefs");
 function reconcileManifestWithDisk(projectPath = process.cwd()) {
-  const manifestPath = path11.join(projectPath, COMPILE_DIRS.DIST_V2, "manifest.json");
-  if (!fs12.existsSync(manifestPath)) return;
+  const manifestPath = path12.join(projectPath, COMPILE_DIRS.DIST_V2, "manifest.json");
+  if (!fs13.existsSync(manifestPath)) return;
   const manifest = loadManifest(projectPath);
-  const sourcesDir = path11.join(projectPath, COMPILE_DIRS.DIST_V2, "sources");
-  fs12.mkdirSync(sourcesDir, {
+  const sourcesDir = path12.join(projectPath, COMPILE_DIRS.DIST_V2, "sources");
+  fs13.mkdirSync(sourcesDir, {
     recursive: true
   });
   let changed = false;
   for (const file of manifest.projectFiles) {
     if (file.external) continue;
-    const absPath = path11.join(projectPath, file.relativePath);
-    if (!fs12.existsSync(absPath)) continue;
+    const absPath = path12.join(projectPath, file.relativePath);
+    if (!fs13.existsSync(absPath)) continue;
     let content;
     try {
-      content = fs12.readFileSync(absPath, "utf-8");
+      content = fs13.readFileSync(absPath, "utf-8");
     } catch {
       continue;
     }
     const freshHash = hashContent(content);
     if (freshHash === file.hash) continue;
-    const ext = path11.extname(file.relativePath) || ".txt";
-    const sourceTargetPath = path11.join(sourcesDir, `${freshHash}${ext}`);
+    const ext = path12.extname(file.relativePath) || ".txt";
+    const sourceTargetPath = path12.join(sourcesDir, `${freshHash}${ext}`);
     try {
-      fs12.writeFileSync(sourceTargetPath, content, "utf-8");
+      fs13.writeFileSync(sourceTargetPath, content, "utf-8");
     } catch {
       continue;
     }
@@ -14502,7 +14735,7 @@ function reconcileManifestWithDisk(projectPath = process.cwd()) {
     changed = true;
   }
   if (changed) {
-    fs12.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), "utf-8");
+    fs13.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), "utf-8");
   }
 }
 __name(reconcileManifestWithDisk, "reconcileManifestWithDisk");
@@ -14575,7 +14808,7 @@ function checkRestoreConflicts(manifest, targetDir) {
   const existingFiles = [];
   for (const file of manifest.files) {
     const filePath = resolveBackupFileTarget2(file, targetDir);
-    if (fs12.existsSync(filePath)) {
+    if (fs13.existsSync(filePath)) {
       existingFiles.push(file.relativePath);
     } else {
       newFiles.push(file.relativePath);
@@ -14601,16 +14834,16 @@ function createBackupTracking(projectHash) {
 }
 __name(createBackupTracking, "createBackupTracking");
 function getBackupCachePath(projectPath = process.cwd()) {
-  return path11.join(projectPath, ".lua", BACKUP_CACHE_FILENAME);
+  return path12.join(projectPath, ".lua", BACKUP_CACHE_FILENAME);
 }
 __name(getBackupCachePath, "getBackupCachePath");
 function writeBackupManifestCache(cache, projectPath = process.cwd()) {
   const cachePath = getBackupCachePath(projectPath);
   try {
-    fs12.mkdirSync(path11.dirname(cachePath), {
+    fs13.mkdirSync(path12.dirname(cachePath), {
       recursive: true
     });
-    fs12.writeFileSync(cachePath, JSON.stringify(cache, null, 2), "utf-8");
+    fs13.writeFileSync(cachePath, JSON.stringify(cache, null, 2), "utf-8");
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     console.warn(`Could not write backup manifest cache: ${message}`);
@@ -14619,9 +14852,9 @@ function writeBackupManifestCache(cache, projectPath = process.cwd()) {
 __name(writeBackupManifestCache, "writeBackupManifestCache");
 function readBackupManifestCache(projectPath = process.cwd()) {
   const cachePath = getBackupCachePath(projectPath);
-  if (!fs12.existsSync(cachePath)) return null;
+  if (!fs13.existsSync(cachePath)) return null;
   try {
-    const raw = fs12.readFileSync(cachePath, "utf-8");
+    const raw = fs13.readFileSync(cachePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.lastHash !== "string" || typeof parsed.lastPushedAt !== "string" || !Array.isArray(parsed.files) || !parsed.files.every((f) => f && typeof f.relativePath === "string" && typeof f.hash === "string")) {
       return null;
@@ -14648,18 +14881,18 @@ function detectLocalConflictsForPull(incomingFiles, projectPath = process.cwd())
     f.hash
   ]));
   const conflicts = /* @__PURE__ */ new Set();
-  const projectRoot = path11.resolve(projectPath);
+  const projectRoot = path12.resolve(projectPath);
   for (const incoming of incomingFiles) {
     if (COMPILE_MANAGED_FILES.has(incoming.relativePath)) continue;
     if (incoming.external) continue;
-    const absPath = path11.resolve(projectRoot, incoming.relativePath);
-    if (absPath !== projectRoot && !absPath.startsWith(projectRoot + path11.sep)) {
+    const absPath = path12.resolve(projectRoot, incoming.relativePath);
+    if (absPath !== projectRoot && !absPath.startsWith(projectRoot + path12.sep)) {
       continue;
     }
-    if (!fs12.existsSync(absPath)) continue;
+    if (!fs13.existsSync(absPath)) continue;
     let diskHash;
     try {
-      const bytes = fs12.readFileSync(absPath, "utf-8");
+      const bytes = fs13.readFileSync(absPath, "utf-8");
       diskHash = hashContent(bytes);
     } catch {
       conflicts.add(incoming.relativePath);
@@ -14686,7 +14919,7 @@ function detectLocalConflictsForPull(incomingFiles, projectPath = process.cwd())
 __name(detectLocalConflictsForPull, "detectLocalConflictsForPull");
 async function fetchBackupManifestForPull(apiKey, agentId) {
   try {
-    const backupApi = new BackupApi(BASE_URLS.API, apiKey, agentId);
+    const backupApi = new backup_api_service_default(BASE_URLS.API, apiKey, agentId);
     const response = await backupApi.getBackupManifest();
     return {
       fetched: response.data ?? null
@@ -14717,7 +14950,7 @@ __name(decideBackupFreshness, "decideBackupFreshness");
 async function checkServerBackupNewerThanLocal(apiKey, agentId, projectPath = process.cwd()) {
   const local = readBackupManifestCache(projectPath);
   try {
-    const api = new BackupApi(BASE_URLS.API, apiKey, agentId);
+    const api = new backup_api_service_default(BASE_URLS.API, apiKey, agentId);
     const resp = await api.getBackupMetadata();
     const metadata = resp.success && resp.data ? {
       projectHash: resp.data.projectHash
@@ -14730,7 +14963,7 @@ async function checkServerBackupNewerThanLocal(apiKey, agentId, projectPath = pr
 __name(checkServerBackupNewerThanLocal, "checkServerBackupNewerThanLocal");
 async function checkBackupAvailability(apiKey, agentId) {
   try {
-    const backupApi = new BackupApi(BASE_URLS.API, apiKey, agentId);
+    const backupApi = new backup_api_service_default(BASE_URLS.API, apiKey, agentId);
     const metadata = await backupApi.getBackupMetadata();
     if (metadata.data && metadata.data.fileCount > 0) {
       return {
@@ -14752,7 +14985,7 @@ __name(checkBackupAvailability, "checkBackupAvailability");
 async function restoreFromBackupForSync(apiKey, agentId, expectedPrimitives = [], projectPath, preFetchedManifest) {
   const targetDir = projectPath || process.cwd();
   try {
-    const backupApi = new BackupApi(BASE_URLS.API, apiKey, agentId);
+    const backupApi = new backup_api_service_default(BASE_URLS.API, apiKey, agentId);
     const manifest = preFetchedManifest ?? (await backupApi.getBackupManifest()).data ?? null;
     if (!manifest || !manifest.files?.length) {
       return {
@@ -14838,17 +15071,17 @@ function writeBackupFilesWithByteCompare(manifest, blobs, targetDir) {
     }
     restoredContents.set(makeRestoredContentsKey(file), content);
     const filePath = resolveBackupFileTarget2(file, targetDir);
-    if (fs12.existsSync(filePath)) {
-      const existing = fs12.readFileSync(filePath);
+    if (fs13.existsSync(filePath)) {
+      const existing = fs13.readFileSync(filePath);
       if (existing.equals(content)) {
         filesUnchanged++;
         continue;
       }
     }
-    fs12.mkdirSync(path11.dirname(filePath), {
+    fs13.mkdirSync(path12.dirname(filePath), {
       recursive: true
     });
-    fs12.writeFileSync(filePath, content);
+    fs13.writeFileSync(filePath, content);
     filesWritten++;
   }
   return {
@@ -15590,6 +15823,33 @@ var AgentHandler = class {
         success: false
       };
     }
+    const modelSettings = agent?.modelSettings ?? null;
+    writeProgress("\n\u{1F321}\uFE0F  Pushing model settings...");
+    try {
+      const success2 = await this.pushModelSettings({
+        apiKey,
+        agentId
+      }, modelSettings);
+      result.modelSettings = {
+        success: success2
+      };
+      if (success2) {
+        if (modelSettings !== null) {
+          const keys = Object.keys(modelSettings).join(", ");
+          writeSuccess(`  \u2705 Model settings pushed (${keys})`);
+        } else {
+          writeSuccess("  \u2705 Model settings cleared (using provider defaults)");
+        }
+      } else {
+        console.error("  \u274C Failed to push model settings");
+      }
+    } catch (error) {
+      if (AuthenticationError.isAuthenticationError(error)) throw error;
+      console.error(`  \u274C Failed to push model settings: ${error.message}`);
+      result.modelSettings = {
+        success: false
+      };
+    }
     const batching = agent?.batching ?? null;
     writeProgress("\n\u23F1  Pushing batching configuration...");
     try {
@@ -15723,6 +15983,13 @@ var AgentHandler = class {
     });
     return result.success;
   }
+  async pushModelSettings(ctx, modelSettings) {
+    const agentApi = new AgentApi(BASE_URLS.API, ctx.apiKey);
+    const result = await agentApi.updateAgent(ctx.agentId, {
+      modelSettings
+    });
+    return result.success;
+  }
   async pushBatching(ctx, batchingConfig) {
     const agentApi = new AgentApi(BASE_URLS.API, ctx.apiKey);
     const result = await agentApi.updateAgent(ctx.agentId, {
@@ -16574,7 +16841,7 @@ async function checkAndRestoreBackup(apiKey, agentId, options) {
     if (!confirm) return false;
   }
   try {
-    const backupApi = new BackupApi(BASE_URLS.API, apiKey, agentId);
+    const backupApi = new backup_api_service_default(BASE_URLS.API, apiKey, agentId);
     const urlsResponse = await backupApi.getBlobUrls(manifest.files.map((f) => f.hash));
     if (!urlsResponse.success || !urlsResponse.data) {
       writeError(`Failed to fetch download URLs: ${urlsResponse.error?.message ?? "unknown error"}`);
@@ -16628,6 +16895,7 @@ async function destroyCommand(options) {
     if (options?.force) {
       const deleted2 = deleteApiKey();
       if (deleted2) {
+        invalidateVersioningModeCache();
         writeSuccess("\u2705 API key deleted successfully.");
       } else {
         writeProgress("\u274C Failed to delete API key.");
@@ -16653,6 +16921,7 @@ async function destroyCommand(options) {
     if (confirm) {
       deleted = deleteApiKey();
       if (deleted) {
+        invalidateVersioningModeCache();
         writeSuccess("\u2705 API key deleted successfully.");
       } else {
         writeProgress("\u274C Failed to delete API key.");
@@ -16723,13 +16992,13 @@ __name(apiKeyCommand, "apiKeyCommand");
 init_cli();
 init_files();
 init_auth();
-import path13 from "path";
+import path14 from "path";
 
 // src/commands/sync.ts
 init_dist();
 init_cli();
-import fs13 from "fs";
-import path12 from "path";
+import fs14 from "fs";
+import path13 from "path";
 
 // src/utils/prompt-handler.ts
 init_cli();
@@ -16754,6 +17023,18 @@ async function safePrompt(questions) {
   }
 }
 __name(safePrompt, "safePrompt");
+async function confirmAction(message) {
+  const answer = await safePrompt([
+    {
+      type: "confirm",
+      name: "confirmed",
+      message,
+      default: false
+    }
+  ]);
+  return answer?.confirmed ?? false;
+}
+__name(confirmAction, "confirmAction");
 
 // src/commands/sync.ts
 init_command_utils();
@@ -16940,8 +17221,8 @@ init_mcp_server_handler();
 async function syncCommand(options) {
   return withErrorHandling(async () => {
     const preCompileYaml = readYamlConfig();
-    const yamlPath = path12.resolve(process.cwd(), "lua.skill.yaml");
-    const preCompileYamlBytes = fs13.existsSync(yamlPath) ? fs13.readFileSync(yamlPath, "utf-8") : null;
+    const yamlPath = path13.resolve(process.cwd(), "lua.skill.yaml");
+    const preCompileYamlBytes = fs14.existsSync(yamlPath) ? fs14.readFileSync(yamlPath, "utf-8") : null;
     let syncCompletedSuccessfully = false;
     try {
       writeProgress("\u{1F504} Compiling to get latest local state...");
@@ -17002,7 +17283,7 @@ async function syncCommand(options) {
     } finally {
       if (!syncCompletedSuccessfully && preCompileYamlBytes !== null) {
         try {
-          fs13.writeFileSync(yamlPath, preCompileYamlBytes, "utf-8");
+          fs14.writeFileSync(yamlPath, preCompileYamlBytes, "utf-8");
         } catch {
         }
       }
@@ -18488,6 +18769,7 @@ var VoiceHandler = class extends BaseVersionedHandler {
     if (voice.hasTools !== void 0) body.hasTools = voice.hasTools;
     if (voice.krispEnabled !== void 0) body.krispEnabled = voice.krispEnabled;
     if (voice.persistTranscript !== void 0) body.persistTranscript = voice.persistTranscript;
+    if (voice.onToolFailureSay !== void 0) body.onToolFailureSay = voice.onToolFailureSay;
     if (voice.volume !== void 0) body.volume = voice.volume;
     if (voice.pronunciations !== void 0) body.pronunciations = voice.pronunciations;
     if (voice.backgroundAudio !== void 0) body.backgroundAudio = voice.backgroundAudio;
@@ -18559,7 +18841,7 @@ async function compileCommand(options) {
     }
     writeProgress("\u{1F528} Compiling...");
     const rootDir = process.cwd();
-    const outDir = path13.join(rootDir, "dist-v2");
+    const outDir = path14.join(rootDir, "dist-v2");
     const result = await compile({
       rootDir,
       outDir,
@@ -18723,12 +19005,12 @@ init_command_utils();
 
 // src/utils/sandbox.ts
 import vm3 from "vm";
-import path16 from "path";
+import path17 from "path";
 
 // ../shared-sandbox/dist/index.mjs
 import vm from "vm";
 import { createRequire } from "module";
-import path14 from "path";
+import path15 from "path";
 import dns from "dns";
 import net from "net";
 import { promisify } from "util";
@@ -18898,7 +19180,7 @@ var REQUIRE_BLOCKLIST = /* @__PURE__ */ new Set([
 var SANDBOX_FAKE_DIRNAME = "/";
 var SANDBOX_FAKE_FILENAME = "/index.ts";
 function buildSandboxRequire(opts) {
-  const realRequire = createRequire(path14.join(opts.cwd, "package.json"));
+  const realRequire = createRequire(path15.join(opts.cwd, "package.json"));
   const wrapped = /* @__PURE__ */ __name4((id) => {
     if (REQUIRE_BLOCKLIST.has(id)) {
       const evt = {
@@ -19568,14 +19850,14 @@ __name(runBundleInContext, "runBundleInContext");
 __name4(runBundleInContext, "runBundleInContext");
 
 // src/utils/env-loader.utils.ts
-import path15 from "path";
-import fs14 from "fs";
+import path16 from "path";
+import fs15 from "fs";
 function parseEnvFile(filePath) {
-  if (!fs14.existsSync(filePath)) {
+  if (!fs15.existsSync(filePath)) {
     return {};
   }
   try {
-    const content = fs14.readFileSync(filePath, "utf8");
+    const content = fs15.readFileSync(filePath, "utf8");
     if (!content.trim()) return {};
     const envVars = {};
     content.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).forEach((line) => {
@@ -19601,7 +19883,7 @@ async function loadEnvironmentVariables(context) {
 }
 __name(loadEnvironmentVariables, "loadEnvironmentVariables");
 function loadSandboxEnvVariables() {
-  const envFilePath = path15.join(process.cwd(), ".env");
+  const envFilePath = path16.join(process.cwd(), ".env");
   const envMap = parseEnvFile(envFilePath);
   return Object.entries(envMap).map(([key, value]) => ({
     key,
@@ -19696,7 +19978,7 @@ function loadEnvironmentVariables2() {
       envVars[key] = value;
     }
   }
-  const envFilePath = path16.join(process.cwd(), ".env");
+  const envFilePath = path17.join(process.cwd(), ".env");
   const fileEnvVars = parseEnvFile(envFilePath);
   Object.assign(envVars, fileEnvVars);
   return envVars;
@@ -21582,6 +21864,7 @@ init_dist();
 init_files();
 init_cli();
 init_command_utils();
+init_auth();
 init_semver();
 init_auth_error();
 init_constants();
@@ -21648,7 +21931,7 @@ async function runBackupPush(opts) {
       projectHash: manifestProjectHash
     };
   }
-  const backupApi = new BackupApi(BASE_URLS.API, opts.apiKey, opts.agentId);
+  const backupApi = new backup_api_service_default(BASE_URLS.API, opts.apiKey, opts.agentId);
   const allHashes = opts.fresh ? [
     ...new Set(fileRefs.map((f) => f.hash))
   ] : getAllFileHashes(projectPath);
@@ -21709,8 +21992,8 @@ async function runBackupPush(opts) {
 }
 __name(runBackupPush, "runBackupPush");
 async function uploadBlobsFromDisk(uploadUrls, files, projectPath, concurrency = 10) {
-  const fs16 = await import("fs");
-  const path18 = await import("path");
+  const fs17 = await import("fs");
+  const path19 = await import("path");
   const zlib2 = await import("zlib");
   const hashToPath = /* @__PURE__ */ new Map();
   for (const f of files) {
@@ -21724,8 +22007,8 @@ async function uploadBlobsFromDisk(uploadUrls, files, projectPath, concurrency =
       if (!rel) {
         throw new Error(`No file found for hash: ${hash}`);
       }
-      const abs = path18.join(projectPath, rel);
-      const content = fs16.readFileSync(abs);
+      const abs = path19.join(projectPath, rel);
+      const content = fs17.readFileSync(abs);
       const compressed = zlib2.gzipSync(content);
       const response = await fetch(uploadUrls[hash], {
         method: "PUT",
@@ -21816,6 +22099,769 @@ init_analytics();
 init_dist2();
 init_skills_api_service();
 
+// src/utils/try-git-commit.ts
+init_cli();
+init_files();
+
+// src/utils/git.ts
+import { spawn } from "child_process";
+var DEFAULT_TIMEOUT_MS = 1e4;
+async function runGit(args2, opts = {}) {
+  return new Promise((resolve6, reject) => {
+    const child = spawn("git", args2, {
+      cwd: opts.cwd,
+      shell: false,
+      stdio: [
+        "ignore",
+        "pipe",
+        "pipe"
+      ]
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const timer = setTimeout(() => {
+      settled = true;
+      child.kill("SIGKILL");
+      reject(new Error(`git ${args2.join(" ")} timed out after ${opts.timeout ?? DEFAULT_TIMEOUT_MS}ms`));
+    }, opts.timeout ?? DEFAULT_TIMEOUT_MS);
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stdout?.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(err);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.stderr?.on("error", () => {
+    });
+    child.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(err);
+    });
+    child.on("close", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve6({
+        stdout,
+        stderr,
+        code: code ?? 0
+      });
+    });
+  });
+}
+__name(runGit, "runGit");
+function classifyGitError(err, stderr = "") {
+  if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+    return "no-git";
+  }
+  const s = stderr.toLowerCase();
+  if (s.includes("not a git repository")) return "no-repo";
+  if (s.includes("head detached") || s.includes("does not point to a branch") || s.includes("src refspec head does not match")) return "detached-head";
+  if (s.includes("pre-commit hook") || s.includes("hook failed")) return "hook-failed";
+  if (s.includes("already exists")) return "tag-exists";
+  if (s.includes("nothing to commit")) return "nothing-to-commit";
+  if (s.includes("authentication failed") || s.includes("could not read username")) return "auth";
+  return "unknown";
+}
+__name(classifyGitError, "classifyGitError");
+async function isGitAvailable() {
+  try {
+    const { code } = await runGit([
+      "--version"
+    ]);
+    return code === 0;
+  } catch {
+    return false;
+  }
+}
+__name(isGitAvailable, "isGitAvailable");
+async function isInsideGitRepo(cwd) {
+  try {
+    const { code } = await runGit([
+      "rev-parse",
+      "--is-inside-work-tree"
+    ], {
+      cwd
+    });
+    return code === 0;
+  } catch {
+    return false;
+  }
+}
+__name(isInsideGitRepo, "isInsideGitRepo");
+async function gitUserConfigured(cwd) {
+  const readOne = /* @__PURE__ */ __name(async (key) => {
+    try {
+      const { stdout, code } = await runGit([
+        "config",
+        "--get",
+        key
+      ], {
+        cwd
+      });
+      if (code !== 0) return void 0;
+      const trimmed = stdout.trim();
+      return trimmed.length > 0 ? trimmed : void 0;
+    } catch {
+      return void 0;
+    }
+  }, "readOne");
+  const [name, email] = await Promise.all([
+    readOne("user.name"),
+    readOne("user.email")
+  ]);
+  return {
+    name,
+    email
+  };
+}
+__name(gitUserConfigured, "gitUserConfigured");
+async function getCommitSha(cwd) {
+  try {
+    const { stdout, code } = await runGit([
+      "rev-parse",
+      "HEAD"
+    ], {
+      cwd
+    });
+    if (code !== 0) return null;
+    const sha = stdout.trim();
+    return sha.length > 0 ? sha : null;
+  } catch {
+    return null;
+  }
+}
+__name(getCommitSha, "getCommitSha");
+
+// src/utils/try-git-commit.ts
+init_analytics();
+
+// src/utils/auto-push-hook.ts
+init_cli();
+
+// src/utils/git-auth-store.ts
+init_constants();
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6 } from "path";
+function readStore() {
+  try {
+    const raw = readFileSync10(AUTH_STORAGE_FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    return {
+      providers: parsed.providers ?? {}
+    };
+  } catch {
+    return {
+      providers: {}
+    };
+  }
+}
+__name(readStore, "readStore");
+function writeStore(store) {
+  mkdirSync7(dirname6(AUTH_STORAGE_FILE), {
+    recursive: true
+  });
+  writeFileSync7(AUTH_STORAGE_FILE, JSON.stringify(store, null, 2), {
+    mode: 384
+  });
+}
+__name(writeStore, "writeStore");
+async function saveAuth(provider, record) {
+  const store = readStore();
+  store.providers[provider] = record;
+  writeStore(store);
+}
+__name(saveAuth, "saveAuth");
+async function getToken2(provider) {
+  return readStore().providers[provider]?.token ?? null;
+}
+__name(getToken2, "getToken");
+async function getStatus(provider) {
+  const record = readStore().providers[provider];
+  if (!record) return {
+    linked: false
+  };
+  return {
+    linked: true,
+    username: record.username,
+    scopes: record.scopes,
+    linkedAt: record.linkedAt
+  };
+}
+__name(getStatus, "getStatus");
+async function clearAuth(provider) {
+  const store = readStore();
+  delete store.providers[provider];
+  writeStore(store);
+}
+__name(clearAuth, "clearAuth");
+
+// src/utils/git-providers/github-provider.ts
+import { createServer } from "http";
+import { randomBytes as randomBytes2 } from "crypto";
+import { request } from "undici";
+import open from "open";
+
+// src/config/git-providers.constants.ts
+var GITHUB_CLIENT_ID = "Ov23lipe1jgBlCsoi9OO";
+var GITHUB_OAUTH_BASE_URL = "https://github.com";
+var GITHUB_API_BASE_URL = "https://api.github.com";
+var GITHUB_OAUTH_SCOPE = "repo";
+var LOOPBACK_PORT_MIN = 49152;
+var LOOPBACK_PORT_MAX = 65535;
+var LOOPBACK_PORT_ATTEMPTS = 3;
+var LOOPBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+var DEVICE_FLOW_DEFAULT_INTERVAL_MS = 5e3;
+var DEVICE_FLOW_SLOW_DOWN_INCREMENT_MS = 5e3;
+var PUSH_TIMEOUT_MS = 2 * 60 * 1e3;
+
+// src/utils/pkce.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+function generateCodeVerifier() {
+  return base64url(randomBytes(64));
+}
+__name(generateCodeVerifier, "generateCodeVerifier");
+function computeCodeChallenge(verifier) {
+  return base64url(createHash2("sha256").update(verifier).digest());
+}
+__name(computeCodeChallenge, "computeCodeChallenge");
+function base64url(buf) {
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+__name(base64url, "base64url");
+
+// src/interfaces/git-providers.ts
+var GitPushError = class extends Error {
+  static {
+    __name(this, "GitPushError");
+  }
+  status;
+  scrubbedStderr;
+  constructor(message, status, scrubbedStderr) {
+    super(message), this.status = status, this.scrubbedStderr = scrubbedStderr;
+    this.name = "GitPushError";
+  }
+};
+
+// src/utils/git-providers/github-provider.ts
+init_cli();
+
+// src/utils/scrub-token.ts
+function scrubToken(s, token) {
+  if (!token) return s;
+  return s.split(token).join("<redacted>");
+}
+__name(scrubToken, "scrubToken");
+
+// src/utils/git-providers/github-provider.ts
+var SUCCESS_HTML = `<!doctype html><meta charset="utf-8"><title>Lua CLI</title>
+<body style="font-family: system-ui; padding: 4rem; text-align: center;">
+  <h1>&#x2713; Connected</h1>
+  <p>You can close this tab and return to the terminal.</p>
+</body>`;
+var GitHubProvider = class {
+  static {
+    __name(this, "GitHubProvider");
+  }
+  name = "github";
+  async login(opts) {
+    const token = opts.device ? await this.deviceFlow() : await this.loopbackFlow();
+    const username = await this.fetchUsername(token);
+    await saveAuth(this.name, {
+      token,
+      username,
+      scopes: [
+        GITHUB_OAUTH_SCOPE
+      ],
+      linkedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return {
+      username
+    };
+  }
+  async logout() {
+    await clearAuth(this.name);
+  }
+  async status() {
+    return getStatus(this.name);
+  }
+  async push(opts) {
+    const parsed = parseGitHubHttpsUrl(opts.remoteUrl);
+    const authedUrl = `https://x-access-token:${opts.token}@github.com/${parsed.owner}/${parsed.repo}`;
+    let result;
+    try {
+      result = await runGit([
+        "push",
+        authedUrl,
+        opts.branch
+      ], {
+        cwd: opts.cwd,
+        timeout: PUSH_TIMEOUT_MS
+      });
+    } catch (err) {
+      const raw = err instanceof Error ? err.message : String(err);
+      const scrubbed2 = scrubToken(raw, opts.token);
+      throw new GitPushError(`git push failed: ${scrubbed2}`, 0, scrubbed2);
+    }
+    if (result.code === 0) return;
+    const scrubbed = scrubToken(result.stderr, opts.token);
+    const status = matchPushStatus(scrubbed);
+    throw new GitPushError(status === 401 ? "GitHub authentication failed (token revoked or insufficient scope)." : status === 403 ? "GitHub rejected the push (403 \u2014 possible SSO enforcement or missing scope)." : "git push failed.", status, scrubbed);
+  }
+  async loopbackFlow() {
+    const verifier = generateCodeVerifier();
+    const challenge = computeCodeChallenge(verifier);
+    const state = randomBytes2(16).toString("hex");
+    const { code, redirectUri } = await this.captureLoopbackCode({
+      state,
+      challenge
+    });
+    return this.exchangeCodeForToken({
+      code,
+      verifier,
+      redirectUri
+    });
+  }
+  async captureLoopbackCode(args2) {
+    let lastErr;
+    for (let i = 0; i < LOOPBACK_PORT_ATTEMPTS; i++) {
+      const port = randomPort();
+      try {
+        return await this.runLoopbackServer(port, args2.state, args2.challenge);
+      } catch (err) {
+        lastErr = err;
+        if (!isPortInUse(err)) throw err;
+      }
+    }
+    throw new Error(`Could not bind a loopback port after ${LOOPBACK_PORT_ATTEMPTS} attempts. Try \`lua git auth github --device\` instead.${lastErr ? ` (${lastErr instanceof Error ? lastErr.message : String(lastErr)})` : ""}`);
+  }
+  runLoopbackServer(port, state, challenge) {
+    return new Promise((resolveOuter, rejectOuter) => {
+      let settled = false;
+      const settle = /* @__PURE__ */ __name((fn) => {
+        if (settled) return;
+        settled = true;
+        fn();
+      }, "settle");
+      const server = createServer((req, res) => {
+        const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+        if (url.pathname !== "/callback") {
+          res.writeHead(404).end();
+          return;
+        }
+        const code = url.searchParams.get("code");
+        const gotState = url.searchParams.get("state");
+        if (!code || gotState !== state) {
+          res.writeHead(400, {
+            "content-type": "text/plain"
+          }).end("State mismatch.");
+          server.close();
+          settle(() => {
+            clearTimeout(timeout);
+            rejectOuter(new Error("OAuth callback state mismatch (possible CSRF). Re-run the command."));
+          });
+          return;
+        }
+        res.writeHead(200, {
+          "content-type": "text/html"
+        }).end(SUCCESS_HTML);
+        server.close();
+        settle(() => {
+          clearTimeout(timeout);
+          resolveOuter({
+            code,
+            redirectUri
+          });
+        });
+      });
+      const timeout = setTimeout(() => {
+        server.close();
+        settle(() => rejectOuter(new Error("OAuth flow timed out (5 min). Re-run `lua git auth github`.")));
+      }, LOOPBACK_TIMEOUT_MS);
+      timeout.unref();
+      server.on("error", (err) => {
+        server.close();
+        settle(() => {
+          clearTimeout(timeout);
+          rejectOuter(err);
+        });
+      });
+      let redirectUri = "";
+      server.listen(port, "127.0.0.1", () => {
+        const actualPort = server.address().port;
+        redirectUri = `http://127.0.0.1:${actualPort}/callback`;
+        const authUrl = new URL(`${GITHUB_OAUTH_BASE_URL}/login/oauth/authorize`);
+        authUrl.searchParams.set("client_id", GITHUB_CLIENT_ID);
+        authUrl.searchParams.set("redirect_uri", redirectUri);
+        authUrl.searchParams.set("scope", GITHUB_OAUTH_SCOPE);
+        authUrl.searchParams.set("code_challenge", challenge);
+        authUrl.searchParams.set("code_challenge_method", "S256");
+        authUrl.searchParams.set("state", state);
+        open(authUrl.toString()).catch(() => {
+          server.close();
+          settle(() => {
+            clearTimeout(timeout);
+            rejectOuter(new Error("Couldn't open a browser \u2014 try `lua git auth github --device` for the device flow."));
+          });
+        });
+      });
+    });
+  }
+  async exchangeCodeForToken(args2) {
+    const res = await request(`${GITHUB_OAUTH_BASE_URL}/login/oauth/access_token`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: GITHUB_CLIENT_ID,
+        code: args2.code,
+        code_verifier: args2.verifier,
+        redirect_uri: args2.redirectUri,
+        grant_type: "authorization_code"
+      })
+    });
+    const body = await res.body.json();
+    if (!body.access_token) {
+      throw new Error(`GitHub rejected the token exchange: ${body.error ?? "unknown error"}`);
+    }
+    return body.access_token;
+  }
+  async fetchUsername(token) {
+    const res = await request(`${GITHUB_API_BASE_URL}/user`, {
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${token}`,
+        "user-agent": "lua-cli"
+      }
+    });
+    const body = await res.body.json();
+    if (!body.login) throw new Error("Could not read GitHub username after auth.");
+    return body.login;
+  }
+  async deviceFlow() {
+    const codeRes = await request(`${GITHUB_OAUTH_BASE_URL}/login/device/code`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: GITHUB_CLIENT_ID,
+        scope: GITHUB_OAUTH_SCOPE
+      })
+    });
+    const codeBody = await codeRes.body.json();
+    if (!codeBody.device_code || !codeBody.user_code || !codeBody.verification_uri) {
+      throw new Error(`GitHub rejected device-code request: ${codeBody.error ?? "unknown error"}`);
+    }
+    writeInfo(`Open ${codeBody.verification_uri} and enter the code: ${codeBody.user_code}`);
+    let intervalMs = codeBody.interval != null ? codeBody.interval * 1e3 : DEVICE_FLOW_DEFAULT_INTERVAL_MS;
+    const deadline = Date.now() + (codeBody.expires_in ?? 900) * 1e3;
+    while (Date.now() < deadline) {
+      await sleep(intervalMs);
+      if (Date.now() >= deadline) break;
+      const pollRes = await request(`${GITHUB_OAUTH_BASE_URL}/login/oauth/access_token`, {
+        method: "POST",
+        headers: {
+          accept: "application/json",
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({
+          client_id: GITHUB_CLIENT_ID,
+          device_code: codeBody.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+      });
+      const body = await pollRes.body.json();
+      if (body.access_token) return body.access_token;
+      if (body.error === "authorization_pending") continue;
+      if (body.error === "slow_down") {
+        intervalMs += DEVICE_FLOW_SLOW_DOWN_INCREMENT_MS;
+        continue;
+      }
+      if (body.error === "expired_token") {
+        throw new Error("Device code expired. Re-run `lua git auth github --device`.");
+      }
+      throw new Error(`GitHub device-flow error: ${body.error ?? "unknown"}`);
+    }
+    throw new Error("Device flow timed out. Re-run `lua git auth github --device`.");
+  }
+};
+function randomPort() {
+  const span = LOOPBACK_PORT_MAX - LOOPBACK_PORT_MIN + 1;
+  return LOOPBACK_PORT_MIN + Math.floor(Math.random() * span);
+}
+__name(randomPort, "randomPort");
+function isPortInUse(err) {
+  return !!err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE";
+}
+__name(isPortInUse, "isPortInUse");
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+__name(sleep, "sleep");
+function isGitHubUrl(url) {
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" && u.hostname === "github.com";
+  } catch {
+    return false;
+  }
+}
+__name(isGitHubUrl, "isGitHubUrl");
+function parseGitHubHttpsUrl(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    throw new Error(`Not a parseable URL: ${url}. v1 only supports https GitHub remotes.`);
+  }
+  if (u.protocol !== "https:" || u.hostname !== "github.com") {
+    throw new Error(`Not a GitHub HTTPS remote: ${url}. v1 only supports https://github.com/...`);
+  }
+  const parts = u.pathname.replace(/^\/+/, "").replace(/\.git$/, "").split("/");
+  if (parts.length < 2 || !parts[0] || !parts[1]) {
+    throw new Error(`Unexpected GitHub URL shape: ${url}`);
+  }
+  return {
+    owner: parts[0],
+    repo: parts[1]
+  };
+}
+__name(parseGitHubHttpsUrl, "parseGitHubHttpsUrl");
+function matchPushStatus(stderr) {
+  const s = stderr.toLowerCase();
+  if (s.includes("401") || s.includes("authentication failed")) return 401;
+  if (s.includes("403") || s.includes("permission to") || s.includes("forbidden")) return 403;
+  return 0;
+}
+__name(matchPushStatus, "matchPushStatus");
+
+// src/utils/auto-push-hook.ts
+init_analytics();
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  writeInfo(`\u26A0\uFE0F  ${message}`);
+}
+__name(warnOnce, "warnOnce");
+async function tryGitAutoPush(ctx) {
+  try {
+    if (ctx.config?.git?.autoPush !== true) return;
+    const token = await getToken2("github");
+    if (!token) {
+      warnOnce("missing-github-token", "git.autoPush is enabled but no GitHub auth \u2014 run `lua git auth github`.");
+      return;
+    }
+    const remote = await readRemoteOriginUrl(ctx.cwd);
+    if (!remote) {
+      warnOnce("missing-github-remote", "git.autoPush is enabled but no `remote.origin.url` is set. Skipping push.");
+      return;
+    }
+    if (!isGitHubUrl(remote)) {
+      warnOnce("non-github-remote", `git.autoPush is enabled but origin (${remote}) is not a supported GitHub HTTPS URL. v1 only supports https://github.com/<owner>/<repo> \u2014 skipping push.`);
+      return;
+    }
+    const branch = await readCurrentBranch(ctx.cwd);
+    if (!branch) {
+      warnOnce("detached-head", "Cannot auto-push from a detached HEAD. Skipping push.");
+      return;
+    }
+    const provider = new GitHubProvider();
+    try {
+      await provider.push({
+        token,
+        remoteUrl: remote,
+        branch,
+        cwd: ctx.cwd ?? process.cwd()
+      });
+      writeInfo(`\u2713 Pushed ${ctx.commitSha?.slice(0, 7) ?? ""} to ${remote} (${branch})`);
+      trackEvent("cli_auto_push_succeeded", {
+        action: ctx.action
+      });
+    } catch (err) {
+      const status = err instanceof GitPushError ? err.status : 0;
+      const message = err instanceof GitPushError ? err.scrubbedStderr || err.message : err instanceof Error ? err.message : String(err);
+      if (status === 401) {
+        warnOnce("push-revoked", "GitHub auth was revoked \u2014 run `lua git auth github` to re-link. Commit kept locally.");
+      } else if (status === 403) {
+        warnOnce("push-rejected-403", `GitHub rejected the push: ${message}. Commit kept locally.`);
+      } else {
+        warnOnce("push-failed-other", `Auto-push failed: ${message}. Commit kept locally; run \`git push\` to retry.`);
+      }
+      trackEvent("cli_auto_push_failed", {
+        action: ctx.action,
+        status
+      });
+    }
+  } catch {
+    warnOnce("hook-errored", "Auto-push hook errored unexpectedly. Commit kept locally; run `git push` to retry.");
+    trackEvent("cli_auto_push_failed", {
+      action: ctx.action,
+      status: 0
+    });
+  }
+}
+__name(tryGitAutoPush, "tryGitAutoPush");
+async function readRemoteOriginUrl(cwd) {
+  const res = await runGit([
+    "config",
+    "--get",
+    "remote.origin.url"
+  ], {
+    cwd
+  });
+  if (res.code !== 0) return null;
+  const trimmed = res.stdout.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+__name(readRemoteOriginUrl, "readRemoteOriginUrl");
+async function readCurrentBranch(cwd) {
+  const res = await runGit([
+    "rev-parse",
+    "--abbrev-ref",
+    "HEAD"
+  ], {
+    cwd
+  });
+  if (res.code !== 0) return null;
+  const trimmed = res.stdout.trim();
+  if (!trimmed || trimmed === "HEAD") return null;
+  return trimmed;
+}
+__name(readCurrentBranch, "readCurrentBranch");
+
+// src/utils/try-git-commit.ts
+async function tryGitCommit(opts) {
+  const config = readYamlConfig();
+  if (!config?.git?.enabled) {
+    return {
+      committed: false
+    };
+  }
+  const runOpts = {
+    cwd: opts.cwd
+  };
+  if (!opts.allowEmpty) {
+    try {
+      const addResult = await runGit([
+        "add",
+        "-A"
+      ], runOpts);
+      if (addResult.code !== 0) {
+        const reason = classifyGitError(null, addResult.stderr);
+        reportFailure("add", reason);
+        return {
+          committed: false
+        };
+      }
+    } catch (err) {
+      const reason = classifyGitError(err);
+      reportFailure("add", reason);
+      return {
+        committed: false
+      };
+    }
+  }
+  const commitArgs = [
+    "commit"
+  ];
+  if (opts.allowEmpty) commitArgs.push("--allow-empty");
+  commitArgs.push("-m", opts.message);
+  try {
+    const commitResult = await runGit(commitArgs, runOpts);
+    if (commitResult.code !== 0) {
+      const reason = classifyGitError(null, commitResult.stderr);
+      if (reason !== "nothing-to-commit") {
+        reportFailure("commit", reason);
+      }
+      return {
+        committed: false
+      };
+    }
+  } catch (err) {
+    const reason = classifyGitError(err);
+    if (reason !== "nothing-to-commit") {
+      reportFailure("commit", reason);
+    }
+    return {
+      committed: false
+    };
+  }
+  const sha = await getCommitSha(opts.cwd) ?? void 0;
+  let tagged;
+  if (opts.tag) {
+    try {
+      const tagResult = await runGit([
+        "tag",
+        opts.tag
+      ], runOpts);
+      if (tagResult.code !== 0) {
+        const reason = classifyGitError(null, tagResult.stderr);
+        reportFailure("tag", reason);
+        tagged = false;
+      } else {
+        tagged = true;
+      }
+    } catch (err) {
+      const reason = classifyGitError(err);
+      reportFailure("tag", reason);
+      tagged = false;
+    }
+  }
+  trackEvent("cli_git_sideeffect_succeeded", {
+    action: opts.action,
+    has_sha: Boolean(sha),
+    has_tag: tagged === true
+  });
+  await tryGitAutoPush({
+    config,
+    cwd: opts.cwd,
+    commitSha: sha,
+    action: opts.action
+  });
+  return {
+    committed: true,
+    sha,
+    tagged
+  };
+}
+__name(tryGitCommit, "tryGitCommit");
+function reportFailure(action, reason) {
+  writeInfo(`\u26A0\uFE0F  Git ${action} skipped: ${reason}`);
+  trackEvent("cli_git_sideeffect_failed", {
+    action,
+    reason
+  });
+}
+__name(reportFailure, "reportFailure");
+
+// src/utils/git-messages.ts
+var GIT_MESSAGES = {
+  pushStaged: "lua: push staged code",
+  createVersion: /* @__PURE__ */ __name((version, message) => {
+    const trimmed = message?.trim();
+    return trimmed ? `lua: create version v${version}: ${trimmed}` : `lua: create version v${version}`;
+  }, "createVersion"),
+  promote: /* @__PURE__ */ __name((version) => `lua: promote v${version} to production`, "promote"),
+  delete: /* @__PURE__ */ __name((version) => `lua: delete version v${version}`, "delete"),
+  pullLatest: "lua: pull latest backup",
+  pullVersion: /* @__PURE__ */ __name((version) => `lua: pull version v${version}`, "pullVersion")
+};
+var tagName = /* @__PURE__ */ __name((version) => `lua/v${version}`, "tagName");
+
 // src/commands/push-helpers.ts
 function pickPushAllNextStepVariant(opts) {
   if (opts.pushedSomething && opts.failedCount === 0) return "success";
@@ -22130,6 +23176,34 @@ async function pushCommand(type, cmdObj) {
         allowAll: true
       });
     }
+    const earlyApiKey = loadApiKey();
+    const earlyConfig = readYamlConfig();
+    const earlyAgentId = earlyConfig?.agent?.agentId;
+    const versioning = earlyApiKey && earlyAgentId ? await getVersioningModeCached(earlyApiKey, earlyAgentId) : {
+      enabled: false
+    };
+    const isStageAll = !type && versioning.enabled;
+    const isGranular = Boolean(type && type !== "all" && versioning.enabled);
+    const isAutoDeployNoOp = versioning.enabled && (type === "all" || !type) && Boolean(options.autoDeploy);
+    if (isAutoDeployNoOp) {
+      writeInfo("\u26A0\uFE0F  --auto-deploy is ignored when agent versioning is on. Use `lua version promote <version>` after `lua version create`.");
+      options.autoDeploy = false;
+    }
+    if (options.entityName && !type) {
+      console.log("\nUsage:");
+      console.log("  lua push skill --name mySkill --set-version 1.0.5        Push specific skill");
+      console.log("  lua push webhook --name myWebhook --set-version 2.0.0    Push specific webhook");
+      throw new Error("Type must be specified when using the --name option.");
+    }
+    if (isStageAll) {
+      return await pushAllCommand({
+        ...options,
+        autoDeployNoopWarned: isAutoDeployNoOp
+      });
+    }
+    if (isGranular) {
+      writeInfo("\u26A0\uFE0F  Granular push is deprecated when agent versioning is on. Use `lua push` (no args) to stage all changes, then `lua version create`.");
+    }
     if (type === "all") {
       if (!options.force) {
         console.log("\nUsage:");
@@ -22137,13 +23211,10 @@ async function pushCommand(type, cmdObj) {
         console.log("  lua push all --force --auto-deploy  Push and deploy all to production");
         throw new Error('The "all" type requires the --force flag');
       }
-      return await pushAllCommand(options);
-    }
-    if (options.entityName && !type) {
-      console.log("\nUsage:");
-      console.log("  lua push skill --name mySkill --set-version 1.0.5        Push specific skill");
-      console.log("  lua push webhook --name myWebhook --set-version 2.0.0    Push specific webhook");
-      throw new Error("Type must be specified when using the --name option.");
+      return await pushAllCommand({
+        ...options,
+        autoDeployNoopWarned: isAutoDeployNoOp
+      });
     }
     if (type) {
       selectedType = type;
@@ -22284,13 +23355,17 @@ Until the backup catches up, \`lua init\` for this agent will restore an older s
       bundles_total: versionedPushDeployResult?.bundleStats?.total ?? 0,
       bundles_uploaded: versionedPushDeployResult?.bundleStats?.uploaded ?? 0,
       bundles_existed: versionedPushDeployResult?.bundleStats?.alreadyExisted ?? 0,
-      // Phase 2 `--include-source` telemetry. Tracks adoption of the flag
-      // and whether the per-skill source attach actually lands cleanly —
-      // useful for the eventual "flip default to ON" decision in Slice 5.
+      // `--include-source` telemetry. Tracks adoption of the flag and whether
+      // the per-skill source attach actually lands cleanly — useful for the
+      // eventual "flip default to ON" decision.
       include_source_requested: options.includeSource || false,
       include_source_attempted: trackedIncludeSource?.attempted ?? 0,
       include_source_attached: trackedIncludeSource?.attached ?? 0,
-      include_source_failed: trackedIncludeSource?.failed ?? 0
+      include_source_failed: trackedIncludeSource?.failed ?? 0,
+      // Agent-versioning telemetry. Driven by isStageAll / isGranular.
+      versioning_mode: versioning.enabled ? isGranular ? "granular" : "all" : "flag-off",
+      granular_deprecation_warned: isGranular,
+      auto_deploy_noop_warned: isAutoDeployNoOp
     });
     const productionDeployedActually = versionedPushDeployResult?.productionDeploySucceeded === true || !!agentOutcome && !agentOutcome.cancelled && agentOutcome.productionDeployedWithAutoDeploy;
     const personaAutoDeployRanAndFailed = selectedType === "agent" && options.autoDeploy && !!agentOutcome && !agentOutcome.cancelled && "personaAutoDeployFailed" in agentOutcome && agentOutcome.personaAutoDeployFailed;
@@ -22583,6 +23658,7 @@ async function pushAllCommand(options) {
   }
   const apiKey = await requireAuthOrExit(false);
   const agentId = config.agent.agentId;
+  const pushAllVersioning = await getVersioningModeCached(apiKey, agentId);
   let manifest;
   try {
     manifest = loadManifest();
@@ -22879,15 +23955,26 @@ Until the backup catches up, \`lua init\` for this agent will restore an older s
     bundles_total: bundleStatsAggregate.total,
     bundles_uploaded: bundleStatsAggregate.uploaded,
     bundles_existed: bundleStatsAggregate.existed,
-    // Phase 2 `--include-source` telemetry, parallel to the single-push
+    // `--include-source` telemetry, parallel to the single-push
     // `cli_push_completed` shape. Without these the `lua push all` path —
-    // arguably the highest-volume one for multi-skill agents — would be
-    // invisible to adoption monitoring.
+    // the highest-volume one for multi-skill agents — would be invisible
+    // to adoption monitoring.
     include_source_requested: options.includeSource || false,
     include_source_attempted: includeSourceStats?.attempted ?? 0,
     include_source_attached: includeSourceStats?.attached ?? 0,
-    include_source_failed: includeSourceStats?.failed ?? 0
+    include_source_failed: includeSourceStats?.failed ?? 0,
+    // Agent-versioning telemetry.
+    versioning_mode: pushAllVersioning.enabled ? "stage-all" : "flag-off",
+    granular_deprecation_warned: false,
+    auto_deploy_noop_warned: options.autoDeployNoopWarned || false
   });
+  try {
+    await tryGitCommit({
+      message: GIT_MESSAGES.pushStaged,
+      action: "push-staged"
+    });
+  } catch {
+  }
   const pushedSomething = allResults.length > 0 || mcpPushedCount > 0 || !!personaPushResult || backupSuccess;
   const variant = pickPushAllNextStepVariant({
     pushedSomething,
@@ -22895,7 +23982,11 @@ Until the backup catches up, \`lua init\` for this agent will restore an older s
   });
   if (variant === "success") {
     console.log("");
-    if (options.autoDeploy) {
+    if (pushAllVersioning.enabled) {
+      if (!options.suppressVersionCreateHint) {
+        writeInfo(`Run \`lua version create [-m "<message>"]\` to snapshot the staged state into a named version, then \`lua version promote <version>\` to deploy.`);
+      }
+    } else if (options.autoDeploy) {
       writeHintBlock({
         headline: "All deployed. Generate test traffic first, then inspect:",
         lines: [
@@ -23163,6 +24254,10 @@ async function deployCommand(type, cmdObj) {
       selectedType = answer.type;
     }
     const apiKey = await requireAuthOrExit();
+    const versioning = await getVersioningModeCached(apiKey, agentId);
+    if (versioning.enabled) {
+      writeInfo("\u26A0\uFE0F  `lua deploy` is deprecated when agent versioning is on. Use `lua version promote <version>` for instant, atomic promotion.");
+    }
     let personaDeployed = false;
     let versionedOutcome = null;
     if (selectedType === "persona") {
@@ -23175,7 +24270,8 @@ async function deployCommand(type, cmdObj) {
       primitive_type: selectedType,
       force_mode: options.force || false,
       entity_selected_by_name: !!options.name,
-      version_selected_by_flag: !!options.version
+      version_selected_by_flag: !!options.version,
+      granular_deprecation_warned: versioning.enabled
     });
     const deployed = selectedType === "persona" ? personaDeployed : versionedOutcome?.deployed ?? false;
     const hintPrintedAlready = selectedType !== "persona" && !!versionedOutcome?.hintPrinted;
@@ -23669,11 +24765,11 @@ init_cli();
 
 // src/utils/sandbox-storage.ts
 init_constants();
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
-import { dirname as dirname5 } from "path";
-function readStore() {
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "fs";
+import { dirname as dirname7 } from "path";
+function readStore2() {
   try {
-    const raw = readFileSync9(SANDBOX_STORAGE_FILE, "utf8");
+    const raw = readFileSync11(SANDBOX_STORAGE_FILE, "utf8");
     const parsed = JSON.parse(raw);
     return {
       skills: parsed.skills ?? {},
@@ -23690,28 +24786,28 @@ function readStore() {
     };
   }
 }
-__name(readStore, "readStore");
-function writeStore(store) {
+__name(readStore2, "readStore");
+function writeStore2(store) {
   try {
-    mkdirSync6(dirname5(SANDBOX_STORAGE_FILE), {
+    mkdirSync8(dirname7(SANDBOX_STORAGE_FILE), {
       recursive: true
     });
-    writeFileSync6(SANDBOX_STORAGE_FILE, JSON.stringify(store, null, 2), "utf8");
+    writeFileSync8(SANDBOX_STORAGE_FILE, JSON.stringify(store, null, 2), "utf8");
   } catch {
   }
 }
-__name(writeStore, "writeStore");
+__name(writeStore2, "writeStore");
 async function getSandboxSkillId(skillName) {
-  const store = readStore();
+  const store = readStore2();
   const key = skillName ?? "__default__";
   return store.skills[key] ?? null;
 }
 __name(getSandboxSkillId, "getSandboxSkillId");
 async function setSandboxSkillId(sandboxId, skillName) {
-  const store = readStore();
+  const store = readStore2();
   const key = skillName ?? "__default__";
   store.skills[key] = sandboxId;
-  writeStore(store);
+  writeStore2(store);
 }
 __name(setSandboxSkillId, "setSandboxSkillId");
 async function getAllSandboxSkillIds(yamlConfig) {
@@ -23737,14 +24833,14 @@ async function getAllSandboxSkillIds(yamlConfig) {
 }
 __name(getAllSandboxSkillIds, "getAllSandboxSkillIds");
 async function getSandboxPreProcessorId(preprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   return store.preprocessors[preprocessorName] ?? null;
 }
 __name(getSandboxPreProcessorId, "getSandboxPreProcessorId");
 async function setSandboxPreProcessorId(sandboxId, preprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   store.preprocessors[preprocessorName] = sandboxId;
-  writeStore(store);
+  writeStore2(store);
 }
 __name(setSandboxPreProcessorId, "setSandboxPreProcessorId");
 async function getAllSandboxPreProcessorIds(config) {
@@ -23769,14 +24865,14 @@ async function getAllSandboxPreProcessorIds(config) {
 }
 __name(getAllSandboxPreProcessorIds, "getAllSandboxPreProcessorIds");
 async function getSandboxPostProcessorId(postprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   return store.postprocessors[postprocessorName] ?? null;
 }
 __name(getSandboxPostProcessorId, "getSandboxPostProcessorId");
 async function setSandboxPostProcessorId(sandboxId, postprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   store.postprocessors[postprocessorName] = sandboxId;
-  writeStore(store);
+  writeStore2(store);
 }
 __name(setSandboxPostProcessorId, "setSandboxPostProcessorId");
 async function getAllSandboxPostProcessorIds(config) {
@@ -24200,7 +25296,15 @@ var MIME_TYPES = {
   ".json": "application/json",
   // Email
   ".eml": "message/rfc822",
-  ".msg": "application/vnd.ms-outlook"
+  ".msg": "application/vnd.ms-outlook",
+  // Audio. lua-core picks the path per provider: types in the provider's
+  // native allowlist go straight to the model, the rest are transcribed by
+  // Deepgram via FileConversionService.
+  ".m4a": "audio/mp4",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".ogg": "audio/ogg",
+  ".opus": "audio/opus"
 };
 var IMAGE_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/png",
@@ -25010,8 +26114,8 @@ init_cli();
 init_constants();
 init_command_utils();
 init_developer_api_service();
-import fs15 from "fs";
-import path17 from "path";
+import fs16 from "fs";
+import path18 from "path";
 import inquirer10 from "inquirer";
 init_analytics();
 function resolveEnvironment(env, hasNonInteractiveFlags) {
@@ -25370,10 +26474,10 @@ function variablesToEnvContent(variables) {
 }
 __name(variablesToEnvContent, "variablesToEnvContent");
 function saveSandboxEnvVariables(variables) {
-  const envFilePath = path17.join(process.cwd(), ".env");
+  const envFilePath = path18.join(process.cwd(), ".env");
   try {
     const content = variablesToEnvContent(variables);
-    fs15.writeFileSync(envFilePath, content, "utf8");
+    fs16.writeFileSync(envFilePath, content, "utf8");
     return true;
   } catch (error) {
     console.error("\u274C Error saving .env file:", error);
@@ -27100,7 +28204,7 @@ __name(viewResourceInteractive, "viewResourceInteractive");
 init_cli();
 init_command_utils();
 init_analytics();
-import open from "open";
+import open2 from "open";
 async function adminCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Admin Dashboard...");
@@ -27108,7 +28212,7 @@ async function adminCommand() {
       showProgress: false
     });
     const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
-    await open(adminUrl);
+    await open2(adminUrl);
     writeSuccess("Lua Admin Dashboard opened in your browser");
     console.log(`
   Dashboard URL: https://admin.heylua.ai`);
@@ -27124,7 +28228,7 @@ __name(adminCommand, "adminCommand");
 init_cli();
 init_command_utils();
 init_analytics();
-import open2 from "open";
+import open3 from "open";
 async function evalsCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Evaluations Dashboard...");
@@ -27132,7 +28236,7 @@ async function evalsCommand() {
       showProgress: false
     });
     const evalsUrl = `https://evals.heylua.ai?apiKey=${apiKey}&agentID=${agentId}`;
-    await open2(evalsUrl);
+    await open3(evalsUrl);
     writeSuccess("Lua Evaluations Dashboard opened in your browser");
     console.log(`
   Dashboard URL: https://evals.heylua.ai`);
@@ -27146,12 +28250,12 @@ __name(evalsCommand, "evalsCommand");
 // src/commands/docs.ts
 init_cli();
 init_analytics();
-import open3 from "open";
+import open4 from "open";
 async function docsCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Documentation...");
     const docsUrl = "https://docs.heylua.ai";
-    await open3(docsUrl);
+    await open4(docsUrl);
     writeSuccess("Lua Documentation opened in your browser");
     console.log(`
   Documentation: ${docsUrl}
@@ -27165,7 +28269,7 @@ __name(docsCommand, "docsCommand");
 init_cli();
 init_command_utils();
 import inquirer12 from "inquirer";
-import open4 from "open";
+import open5 from "open";
 
 // src/api/channels.api.service.ts
 init_http_client();
@@ -27734,7 +28838,7 @@ async function openAdminDashboard(apiKey, config) {
     throw new Error("No orgId found in lua.skill.yaml. Please ensure your configuration is valid.");
   }
   const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
-  await open4(adminUrl);
+  await open5(adminUrl);
   writeSuccess("\u2705 Lua Admin Dashboard opened in your browser");
   console.log(`
   Dashboard URL: https://admin.heylua.ai`);
@@ -29865,7 +30969,7 @@ init_auth();
 init_auth_api_service();
 init_files();
 init_artifact_loader();
-import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync12 } from "fs";
 import { join as join6 } from "path";
 import { performance } from "perf_hooks";
 import * as os from "os";
@@ -30216,7 +31320,7 @@ function gatherTelemetry() {
   } else {
     try {
       if (existsSync7(TELEMETRY_FILE)) {
-        const raw = readFileSync10(TELEMETRY_FILE, "utf8");
+        const raw = readFileSync12(TELEMETRY_FILE, "utf8");
         const cfg = JSON.parse(raw);
         if (typeof cfg.enabled === "boolean") enabled = cfg.enabled;
       }
@@ -36518,7 +37622,7 @@ init_cli();
 init_constants();
 import http from "http";
 import { URL as URL2 } from "url";
-import open5 from "open";
+import open6 from "open";
 init_command_utils();
 init_developer_api_service();
 
@@ -37541,7 +38645,7 @@ Integration: ${selectedIntegration.name}`);
 `);
   const callbackPromise = startCallbackServer(3e5);
   try {
-    await open5(authUrl);
+    await open6(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
   } catch (error) {
     writeInfo("\u{1F4A1} Could not open browser automatically. Please open the URL above manually.");
@@ -37972,7 +39076,7 @@ Available scopes for ${selectedIntegration.name}:`);
 `);
   const callbackPromise = startCallbackServer(3e5);
   try {
-    await open5(authUrl);
+    await open6(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
   } catch (error) {
     writeInfo("\u{1F4A1} Could not open browser automatically. Please open the URL above manually.");
@@ -39397,7 +40501,7 @@ __name(telemetryCommand, "telemetryCommand");
 init_cli();
 init_command_utils();
 init_analytics();
-import { writeFileSync as writeFileSync7, existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
+import { writeFileSync as writeFileSync9, existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
 import { resolve as resolve4, join as join7 } from "path";
 init_artifact_loader();
 init_types();
@@ -39558,7 +40662,7 @@ async function governanceCommand(action) {
       }
     }
     const content = generateFile(setup);
-    writeFileSync7(filePath, content, "utf-8");
+    writeFileSync9(filePath, content, "utf-8");
     const relativePath = filePath.replace(process.cwd() + "/", "");
     writeSuccess(`Created ${relativePath}`);
     console.log("");
@@ -39822,14 +40926,14 @@ init_analytics();
 init_command_utils();
 init_artifact_loader();
 init_types();
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync9, readdirSync as readdirSync3, statSync as statSync4 } from "fs";
 import { join as join8, relative, resolve as resolve5 } from "path";
 init_voice_api_service();
 init_constants();
 
 // src/commands/voice-terminal.ts
-import { spawn, spawnSync } from "child_process";
+import { spawn as spawn2, spawnSync } from "child_process";
 import { platform as platform3 } from "os";
 import { AudioFrame, AudioSource, AudioStream, LocalAudioTrack, Room, RoomEvent, TrackKind, TrackPublishOptions, TrackSource } from "@livekit/rtc-node";
 
@@ -40092,7 +41196,7 @@ function spawnCapture() {
     String(FRAME_SAMPLES * 2),
     "-"
   ];
-  const proc = spawn("sox", args2, {
+  const proc = spawn2("sox", args2, {
     stdio: [
       "ignore",
       "pipe",
@@ -40123,7 +41227,7 @@ function spawnPlayback() {
     "-",
     "-d"
   ];
-  const proc = spawn("sox", args2, {
+  const proc = spawn2("sox", args2, {
     stdio: [
       "pipe",
       "ignore",
@@ -40185,7 +41289,7 @@ __name(pumpRemoteAudioToSpeaker, "pumpRemoteAudioToSpeaker");
 // src/commands/voice-browser.ts
 init_cli();
 import http2 from "http";
-import open6 from "open";
+import open7 from "open";
 var SAFETY_TIMEOUT_MS = 60 * 60 * 1e3;
 async function runBrowserMode(joinUrl) {
   const { wsUrl, token } = parseJoinUrl(joinUrl);
@@ -40217,7 +41321,7 @@ async function runBrowserMode(joinUrl) {
   const localUrl = `http://localhost:${port}/`;
   writeSuccess(`Voice room ready (opening browser)`);
   console.log(`   ${localUrl}`);
-  await open6(localUrl);
+  await open7(localUrl);
   await new Promise((resolve6) => {
     const safety = setTimeout(() => {
       try {
@@ -40453,7 +41557,7 @@ function buildRunnerArgs(runner, opts) {
 __name(buildRunnerArgs, "buildRunnerArgs");
 async function spawnRunner(runner, args2, cwd) {
   return new Promise((resolveExit) => {
-    const proc = spawn2("npx", [
+    const proc = spawn3("npx", [
       runner,
       ...args2
     ], {
@@ -40846,6 +41950,12 @@ async function sourceRollbackCommand(opts) {
   const config = readYamlConfig();
   const agentId = config?.agent?.agentId;
   if (!agentId) throw new Error("No agentId in lua.skill.yaml. Run `lua init` first.");
+  if (!opts.silent) {
+    const versioning = await getVersioningModeCached(apiKey, agentId);
+    if (versioning.enabled) {
+      writeInfo("\u26A0\uFE0F  `lua source rollback` is deprecated when agent versioning is on. Use `lua version promote <version>` \u2014 instant, no re-upload required.");
+    }
+  }
   const fetchM = opts.fetchManifest ?? defaultFetchManifest;
   const fetchU = opts.fetchUrls ?? defaultFetchUrls;
   const dlBlobs = opts.downloadBlobs ?? downloadBlobsParallel;
@@ -40916,6 +42026,631 @@ function defaultRestore(manifest, blobs, targetDir) {
 }
 __name(defaultRestore, "defaultRestore");
 
+// src/commands/version.ts
+init_cli();
+init_command_utils();
+init_analytics();
+init_files();
+init_constants();
+
+// src/utils/parse-version.ts
+function parseVersion2(arg) {
+  if (!arg) throw new Error(`Invalid version "${arg}": must be a positive integer like "3" or "v3".`);
+  const stripped = arg.replace(/^v/i, "");
+  const n = Number.parseInt(stripped, 10);
+  if (!Number.isFinite(n) || n <= 0 || String(n) !== stripped) {
+    throw new Error(`Invalid version "${arg}": must be a positive integer like "3" or "v3".`);
+  }
+  return n;
+}
+__name(parseVersion2, "parseVersion");
+
+// src/commands/version.ts
+async function assertVersioningEnabled(apiKey, agentId) {
+  const { enabled } = await getVersioningModeCached(apiKey, agentId);
+  if (!enabled) {
+    throw new Error("Agent versioning is not enabled for your organization. Contact your admin to enable it, or use `lua push <primitive>` for the legacy flow.");
+  }
+}
+__name(assertVersioningEnabled, "assertVersioningEnabled");
+async function versionCreateCommand(options = {}) {
+  return withErrorHandling(async () => {
+    const { apiKey, agentId } = await initializeCommand();
+    await assertVersioningEnabled(apiKey, agentId);
+    let config = readYamlConfig();
+    let backupVersion = config?.backup?.activeVersion;
+    if (options.autoPush) {
+      await pushAllCommand({
+        force: true,
+        includeSource: true,
+        suppressVersionCreateHint: true
+      });
+      config = readYamlConfig();
+      backupVersion = config?.backup?.activeVersion;
+      if (backupVersion == null) {
+        throw new Error("Backup tracking lost after push. Aborting.");
+      }
+    }
+    if (backupVersion == null) {
+      throw new Error("No backup exists for this agent. Run `lua push` first, or pass `--auto-push` to push and snapshot in one step.");
+    }
+    let message = options.message;
+    const isTTY = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    const isCi = isCiModeEnabled();
+    if (!message && isTTY && !isCi) {
+      const answers = await safePrompt([
+        {
+          type: "input",
+          name: "input",
+          message: "Optional description (blank to skip):"
+        }
+      ]);
+      message = answers?.input?.trim() || void 0;
+    }
+    const api = new AgentVersionApi(BASE_URLS.API, apiKey, agentId);
+    const result = await api.createVersion({
+      message,
+      sourceManifestVersion: backupVersion,
+      commitHash: options.commitHash
+    });
+    if (!result.success || !result.data) {
+      throw new Error(result.error?.message ?? "Failed to create version");
+    }
+    writeInfo(`\u2713 Created v${result.data.version} (staged). Run \`lua version promote v${result.data.version}\` to deploy.`);
+    try {
+      const gitResult = await tryGitCommit({
+        message: GIT_MESSAGES.createVersion(result.data.version, message),
+        action: "version-create",
+        tag: tagName(result.data.version),
+        allowEmpty: true
+      });
+      if (gitResult.committed && gitResult.sha) {
+        await api.patchCommitHash(result.data.version, gitResult.sha);
+      }
+    } catch {
+    }
+    trackEvent("cli_version_create_completed", {
+      auto_push: Boolean(options.autoPush),
+      has_message: Boolean(message),
+      non_interactive: !isTTY || isCi
+    });
+  }, "version create");
+}
+__name(versionCreateCommand, "versionCreateCommand");
+async function versionListCommand(options = {}) {
+  return withErrorHandling(async () => {
+    const { apiKey, agentId } = await initializeCommand();
+    await assertVersioningEnabled(apiKey, agentId);
+    const query = {};
+    if (options.all) query.all = true;
+    if (options.limit != null) query.limit = options.limit;
+    if (options.status) query.status = options.status;
+    const api = new AgentVersionApi(BASE_URLS.API, apiKey, agentId);
+    const response = await api.listVersions(query);
+    if (!response.success || !response.data) {
+      throw new Error(response.error?.message ?? "Failed to list versions");
+    }
+    const versions = response.data;
+    if (options.json) {
+      console.log(JSON.stringify(versions, null, 2));
+    } else if (versions.length === 0) {
+      writeInfo("(no versions yet \u2014 run `lua version create` to make one)");
+    } else {
+      console.log("VERSION    STATUS       CREATED              BY         MESSAGE");
+      for (const v of versions) {
+        const star = v.status === "active" ? "*" : " ";
+        const date = new Date(v.createdAt).toISOString().slice(0, 16).replace("T", " ");
+        const status = v.status.padEnd(11);
+        const by = (v.createdBy || "").slice(0, 10).padEnd(10);
+        const msg = (v.message || "").slice(0, 60);
+        console.log(`v${v.version}${star}    ${status} ${date}  ${by}${msg}`);
+      }
+    }
+    trackEvent("cli_version_list_completed", {
+      count: versions.length,
+      status_filter: options.status ?? "all"
+    });
+  }, "version list");
+}
+__name(versionListCommand, "versionListCommand");
+async function versionShowCommand(versionArg, options = {}) {
+  return withErrorHandling(async () => {
+    const { apiKey, agentId } = await initializeCommand();
+    await assertVersioningEnabled(apiKey, agentId);
+    const version = parseVersion2(versionArg);
+    const api = new AgentVersionApi(BASE_URLS.API, apiKey, agentId);
+    const response = await api.getVersion(version);
+    if (!response.success || !response.data) {
+      throw new Error(response.error?.message ?? `Version v${version} not found`);
+    }
+    const v = response.data;
+    if (options.json) {
+      console.log(JSON.stringify(v, null, 2));
+    } else {
+      console.log(`Version v${v.version} (${v.status})`);
+      console.log(`  Created: ${v.createdAt} by ${v.createdBy}`);
+      if (v.message) console.log(`  Message: ${v.message}`);
+      if (v.commitHash) console.log(`  Commit:  ${v.commitHash}`);
+      console.log(`  Model:   ${v.snapshot.model}`);
+      console.log(`  Snapshot:`);
+      console.log(`    Skills:         ${v.snapshot.skills.length}`);
+      console.log(`    Webhooks:       ${v.snapshot.webhooks.length}`);
+      console.log(`    Jobs:           ${v.snapshot.jobs.length}`);
+      console.log(`    Preprocessors:  ${v.snapshot.preprocessors.length}`);
+      console.log(`    Postprocessors: ${v.snapshot.postprocessors.length}`);
+      console.log(`    MCP servers:    ${v.snapshot.mcpServers.length}`);
+      console.log(`    Persona:        ${v.snapshot.persona.versionId || "(none)"}`);
+    }
+    trackEvent("cli_version_show_completed", {
+      version,
+      json: Boolean(options.json)
+    });
+  }, "version show");
+}
+__name(versionShowCommand, "versionShowCommand");
+async function versionDiffCommand(fromArg, toArg, options = {}) {
+  return withErrorHandling(async () => {
+    const { apiKey, agentId } = await initializeCommand();
+    await assertVersioningEnabled(apiKey, agentId);
+    const from = parseVersion2(fromArg);
+    const to = parseVersion2(toArg);
+    const api = new AgentVersionApi(BASE_URLS.API, apiKey, agentId);
+    const response = await api.diffVersions(from, to);
+    if (!response.success || !response.data) {
+      throw new Error(response.error?.message ?? "Failed to diff versions");
+    }
+    const diff = response.data;
+    if (options.json) {
+      console.log(JSON.stringify(diff, null, 2));
+    } else {
+      console.log(`Diff v${from} \u2192 v${to}`);
+      const sections = [
+        {
+          name: "Skills",
+          entry: diff.skills,
+          key: "skillId"
+        },
+        {
+          name: "Webhooks",
+          entry: diff.webhooks,
+          key: "webhookId"
+        },
+        {
+          name: "Jobs",
+          entry: diff.jobs,
+          key: "jobId"
+        },
+        {
+          name: "Preprocessors",
+          entry: diff.preprocessors,
+          key: "id"
+        },
+        {
+          name: "Postprocessors",
+          entry: diff.postprocessors,
+          key: "id"
+        }
+      ];
+      for (const { name, entry, key } of sections) {
+        const total = entry.added.length + entry.removed.length + entry.changed.length;
+        if (total === 0) {
+          console.log(`${name}: (no changes)`);
+          continue;
+        }
+        console.log(`${name}:`);
+        for (const a of entry.added) {
+          console.log(`  + ${a[key]}@${a.version} (added)`);
+        }
+        for (const r of entry.removed) {
+          console.log(`  - ${r[key]}@${r.version} (removed)`);
+        }
+        for (const c of entry.changed) {
+          console.log(`  ~ ${c[key]} ${c.from.version} \u2192 ${c.to.version}`);
+        }
+      }
+      const mcp = diff.mcpServers;
+      if (mcp.added.length || mcp.removed.length || mcp.changed.length) {
+        console.log("MCP servers:");
+        mcp.added.forEach((m) => console.log(`  + ${m.id} (added)`));
+        mcp.removed.forEach((m) => console.log(`  - ${m.id} (removed)`));
+        mcp.changed.forEach((m) => console.log(`  ~ ${m.id} (config changed)`));
+      } else {
+        console.log("MCP servers: (no changes)");
+      }
+      console.log(`Persona: ${diff.persona ? `${diff.persona.from} \u2192 ${diff.persona.to}` : "(unchanged)"}`);
+      console.log(`Model: ${diff.model ? `${diff.model.from} \u2192 ${diff.model.to}` : "(unchanged)"}`);
+    }
+    trackEvent("cli_version_diff_completed", {
+      from_to_distance: Math.abs(to - from)
+    });
+  }, "version diff");
+}
+__name(versionDiffCommand, "versionDiffCommand");
+async function versionPromoteCommand(versionArg) {
+  return withErrorHandling(async () => {
+    const { apiKey, agentId } = await initializeCommand();
+    await assertVersioningEnabled(apiKey, agentId);
+    const version = parseVersion2(versionArg);
+    const api = new AgentVersionApi(BASE_URLS.API, apiKey, agentId);
+    const response = await api.promoteVersion(version);
+    if (!response.success) {
+      const errCode = response.error?.code;
+      if (errCode === "VERSION_ALREADY_ACTIVE") {
+        writeInfo(`v${version} is already active. No change.`);
+        return;
+      }
+      throw new Error(response.error?.message ?? `Failed to promote v${version}`);
+    }
+    if (!response.data) {
+      throw new Error(`Promote returned no data`);
+    }
+    const { promoted, previousActive } = response.data;
+    const rollback = previousActive != null && previousActive > promoted;
+    if (previousActive == null) {
+      writeInfo(`\u2713 Promoted v${promoted}. (No previous active version.)`);
+    } else {
+      writeInfo(`\u2713 Promoted v${promoted}. Previous active: v${previousActive}.`);
+    }
+    try {
+      await tryGitCommit({
+        message: GIT_MESSAGES.promote(promoted),
+        action: "version-promote",
+        allowEmpty: true
+      });
+    } catch {
+    }
+    trackEvent("cli_version_promote_completed", {
+      from_version: previousActive,
+      to_version: promoted,
+      rollback
+    });
+  }, "version promote");
+}
+__name(versionPromoteCommand, "versionPromoteCommand");
+async function versionDeleteCommand(versionArg, options = {}) {
+  return withErrorHandling(async () => {
+    const { apiKey, agentId } = await initializeCommand();
+    await assertVersioningEnabled(apiKey, agentId);
+    if (versionArg === "current" || versionArg === "active") {
+      throw new Error(`Cannot delete the active version directly. Use \`lua version promote <other>\` to roll back first, then delete.`);
+    }
+    const version = parseVersion2(versionArg);
+    const isTTY = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    const isCi = isCiModeEnabled();
+    if (!options.force && isTTY && !isCi) {
+      const answer = await safePrompt([
+        {
+          type: "confirm",
+          name: "confirm",
+          message: `Delete v${version}?`,
+          default: false
+        }
+      ]);
+      if (!answer?.confirm) {
+        writeInfo("Aborted.");
+        return;
+      }
+    }
+    const api = new AgentVersionApi(BASE_URLS.API, apiKey, agentId);
+    const response = await api.deleteVersion(version);
+    if (!response.success) {
+      const errCode = response.error?.code;
+      if (errCode === "CANNOT_DELETE_ACTIVE_VERSION") {
+        throw new Error(`Cannot delete v${version}: it is the active version. Promote a different version first.`);
+      }
+      if (errCode === "CANNOT_DELETE_LAST_VERSION") {
+        throw new Error(`Cannot delete v${version}: it is the only remaining version.`);
+      }
+      throw new Error(response.error?.message ?? `Failed to delete v${version}`);
+    }
+    writeInfo(`\u2713 Deleted v${version}.`);
+    try {
+      await tryGitCommit({
+        message: GIT_MESSAGES.delete(version),
+        action: "version-delete",
+        allowEmpty: true
+      });
+    } catch {
+    }
+    trackEvent("cli_version_delete_completed", {
+      version,
+      force: Boolean(options.force)
+    });
+  }, "version delete");
+}
+__name(versionDeleteCommand, "versionDeleteCommand");
+
+// src/commands/git.ts
+init_cli();
+init_files();
+init_analytics();
+var NO_YAML_MESSAGE = "No lua.skill.yaml found. Please run this command from a skill directory.";
+function failConnect(status, banner, errorMessage) {
+  if (banner) writeError(banner);
+  trackEvent("cli_git_connect_completed", {
+    ...status,
+    succeeded: false
+  });
+  throw new Error(errorMessage);
+}
+__name(failConnect, "failConnect");
+async function gitConnectCommand() {
+  return withErrorHandling(async () => {
+    const config = readYamlConfig();
+    if (!config) {
+      failConnect({
+        git_available: false,
+        in_repo: false,
+        user_configured: false
+      }, null, NO_YAML_MESSAGE);
+    }
+    if (!await isGitAvailable()) {
+      failConnect({
+        git_available: false,
+        in_repo: false,
+        user_configured: false
+      }, "\u2717 Git binary not found on PATH.\n   Fix: install git from https://git-scm.com/downloads, then re-run `lua git connect`.", "git is not installed");
+    }
+    if (!await isInsideGitRepo()) {
+      failConnect({
+        git_available: true,
+        in_repo: false,
+        user_configured: false
+      }, "\u2717 This directory is not inside a git repository.\n   Fix: run `git init` in your project root, then re-run `lua git connect`.", "not inside a git repository");
+    }
+    const identity = await gitUserConfigured();
+    if (!identity.email) {
+      failConnect({
+        git_available: true,
+        in_repo: true,
+        user_configured: false
+      }, '\u2717 Git user.email is not configured.\n   Fix: git config --global user.email "you@example.com"', "git user.email is not configured");
+    }
+    if (!identity.name) {
+      failConnect({
+        git_available: true,
+        in_repo: true,
+        user_configured: false
+      }, '\u2717 Git user.name is not configured.\n   Fix: git config --global user.name "Your Name"', "git user.name is not configured");
+    }
+    config.git = {
+      enabled: true
+    };
+    writeYamlConfig(config);
+    writeSuccess("\u2713 Git integration enabled. Future `lua push`, `lua version *`, and `lua pull` runs will auto-commit.");
+    trackEvent("cli_git_connect_completed", {
+      git_available: true,
+      in_repo: true,
+      user_configured: true,
+      succeeded: true
+    });
+  }, "git connect");
+}
+__name(gitConnectCommand, "gitConnectCommand");
+async function gitDisconnectCommand() {
+  return withErrorHandling(async () => {
+    const config = readYamlConfig();
+    if (!config) {
+      throw new Error(NO_YAML_MESSAGE);
+    }
+    config.git = {
+      enabled: false
+    };
+    writeYamlConfig(config);
+    writeSuccess("\u2713 Git integration disabled. Existing commits and tags are untouched.");
+    trackEvent("cli_git_disconnect_completed", {});
+  }, "git disconnect");
+}
+__name(gitDisconnectCommand, "gitDisconnectCommand");
+async function gitStatusCommand() {
+  return withErrorHandling(async () => {
+    const config = readYamlConfig();
+    const enabled = Boolean(config?.git?.enabled);
+    if (!enabled) {
+      writeInfo("Git integration: disabled (run `lua git connect` to enable)");
+      trackEvent("cli_git_status_completed", {
+        enabled: false
+      });
+      return;
+    }
+    const settled = await Promise.allSettled([
+      runGit([
+        "--version"
+      ]),
+      gitUserConfigured(),
+      runGit([
+        "log",
+        "--grep",
+        "^lua: ",
+        "-n",
+        "1",
+        "--format=%h  %s"
+      ]),
+      // tryGitCommit creates lightweight tags (`git tag <name>`), which have
+      // no taggerdate field. creatordate works for both flavors and returns
+      // the committerdate of the referenced commit — chronological order
+      // matches our pattern of tagging immediately after the commit.
+      runGit([
+        "for-each-ref",
+        "--sort=-creatordate",
+        "refs/tags/lua/",
+        "--count=1",
+        "--format=%(refname:short)"
+      ])
+    ]);
+    const versionResult = settled[0].status === "fulfilled" ? settled[0].value : {
+      stdout: "",
+      stderr: "",
+      code: 1
+    };
+    const identity = settled[1].status === "fulfilled" ? settled[1].value : {
+      name: void 0,
+      email: void 0
+    };
+    const lastCommitResult = settled[2].status === "fulfilled" ? settled[2].value : {
+      stdout: "",
+      stderr: "",
+      code: 1
+    };
+    const lastTagResult = settled[3].status === "fulfilled" ? settled[3].value : {
+      stdout: "",
+      stderr: "",
+      code: 1
+    };
+    const versionLine = versionResult.code === 0 ? `${versionResult.stdout.trim()} (\u2713)` : "(not detected)";
+    const identityLine = identity.name && identity.email ? `${identity.name} <${identity.email}> (\u2713)` : "(not configured)";
+    const lastCommit = lastCommitResult.code === 0 && lastCommitResult.stdout.trim() ? lastCommitResult.stdout.trim() : "(none yet)";
+    const lastTag = lastTagResult.code === 0 && lastTagResult.stdout.trim() ? lastTagResult.stdout.trim() : "(none yet)";
+    writeInfo(`Git integration:    enabled`);
+    writeInfo(`Project repo:       ${process.cwd()}`);
+    writeInfo(`Git binary:         ${versionLine}`);
+    writeInfo(`User identity:      ${identityLine}`);
+    writeInfo(`Last lua commit:    ${lastCommit}`);
+    writeInfo(`Last lua tag:       ${lastTag}`);
+    trackEvent("cli_git_status_completed", {
+      enabled: true
+    });
+  }, "git status");
+}
+__name(gitStatusCommand, "gitStatusCommand");
+
+// src/commands/git-auth.ts
+init_cli();
+init_analytics();
+function gitAuthGithubCommand(opts) {
+  return withErrorHandling(async () => {
+    const provider = new GitHubProvider();
+    const existing = await provider.status();
+    if (existing.linked && !opts.force) {
+      const ok = await confirmAction(`Already linked to GitHub as @${existing.username}. Re-link?`);
+      if (!ok) {
+        writeInfo("Aborted. Existing link preserved.");
+        return;
+      }
+    }
+    const result = await provider.login({
+      device: opts.device,
+      force: opts.force
+    });
+    writeSuccess(`Logged in to GitHub as @${result.username}.`);
+    trackEvent("cli_git_auth_succeeded", {
+      provider: "github",
+      flow: opts.device ? "device" : "loopback"
+    });
+  }, "git-auth-github");
+}
+__name(gitAuthGithubCommand, "gitAuthGithubCommand");
+function gitAuthStatusCommand() {
+  return withErrorHandling(async () => {
+    const provider = new GitHubProvider();
+    const s = await provider.status();
+    if (!s.linked) {
+      console.log("Not linked. Run `lua git auth github` to link.");
+    } else {
+      console.log(`Linked: github \u2014 @${s.username} (scopes: ${s.scopes.join(", ")}) \u2014 linked ${formatLinkedAt(s.linkedAt)}`);
+    }
+    trackEvent("cli_git_auth_status_completed", {
+      linked: s.linked
+    });
+  }, "git-auth-status");
+}
+__name(gitAuthStatusCommand, "gitAuthStatusCommand");
+function gitAuthDisconnectCommand(provider) {
+  return withErrorHandling(async () => {
+    const name = (provider ?? "github").toLowerCase();
+    if (name !== "github") {
+      writeError(`Unknown provider: ${name}. v1 only supports github.`);
+      return;
+    }
+    const p = new GitHubProvider();
+    const s = await p.status();
+    if (!s.linked) {
+      console.log(`Not linked to ${name}. Nothing to do.`);
+      return;
+    }
+    await p.logout();
+    writeSuccess(`Disconnected from ${name}.`);
+    trackEvent("cli_git_auth_disconnect_completed", {
+      provider: name
+    });
+  }, "git-auth-disconnect");
+}
+__name(gitAuthDisconnectCommand, "gitAuthDisconnectCommand");
+function formatLinkedAt(iso) {
+  try {
+    return new Date(iso).toISOString().replace("T", " ").replace(/\..*$/, " UTC");
+  } catch {
+    return iso;
+  }
+}
+__name(formatLinkedAt, "formatLinkedAt");
+
+// src/commands/pull.ts
+init_cli();
+init_command_utils();
+init_analytics();
+init_backup_api_service();
+init_constants();
+async function pullCommand(options = {}) {
+  return withErrorHandling(async () => {
+    const { apiKey, agentId } = await initializeCommand();
+    const force = Boolean(options.force);
+    if (options.version) {
+      await assertVersioningEnabled(apiKey, agentId);
+      const version = parseVersion2(options.version);
+      const api = new AgentVersionApi(BASE_URLS.API, apiKey, agentId);
+      const response = await api.getVersion(version);
+      if (!response.success || !response.data) {
+        throw new Error(response.error?.message ?? `Version v${version} not found`);
+      }
+      const sourceManifestVersion = response.data.sourceManifestVersion;
+      if (sourceManifestVersion == null) {
+        throw new Error(`Version v${version} has no source backup linked. Cannot pull source for this version.`);
+      }
+      writeInfo(`Pulling source for agent version v${version} (backup v${sourceManifestVersion})\u2026`);
+      await sourceRollbackCommand({
+        version: sourceManifestVersion,
+        force,
+        silent: true
+      });
+      try {
+        await tryGitCommit({
+          message: GIT_MESSAGES.pullVersion(version),
+          action: "pull-version"
+        });
+      } catch {
+      }
+      trackEvent("cli_pull_completed", {
+        has_version_arg: true
+      });
+      return;
+    }
+    const backupApi = new BackupApi(BASE_URLS.API, apiKey, agentId);
+    const backupResp = await backupApi.getBackupVersions();
+    if (!backupResp.success || !backupResp.data?.versions?.length) {
+      throw new Error("No backup versions available to pull.");
+    }
+    const latest = backupResp.data.versions[0].version;
+    writeInfo(`Pulling latest source backup (v${latest})\u2026`);
+    await sourceRollbackCommand({
+      version: latest,
+      force,
+      silent: true
+    });
+    try {
+      await tryGitCommit({
+        message: GIT_MESSAGES.pullLatest,
+        action: "pull-latest"
+      });
+    } catch {
+    }
+    trackEvent("cli_pull_completed", {
+      has_version_arg: false
+    });
+  }, "pull");
+}
+__name(pullCommand, "pullCommand");
+
 // src/cli/command-definitions.ts
 init_cli();
 function setupAuthCommands(program2) {
@@ -41544,6 +43279,59 @@ Examples:
   $ lua voice test --runner vitest       Force vitest
 `).action(voiceTestCommand);
   voice.command("list").description("List LuaVoice primitives in the compiled manifest").option("--json", "Output as JSON").action(voiceListCommand);
+  const versionGroup = program2.command("version").description("\u{1F3F7}\uFE0F  Manage agent versions \u2014 atomic snapshots (requires agentVersioningEnabled for your org)").addHelpText("after", `
+Note:
+  All \`lua version\` subcommands require the \`agentVersioningEnabled\`
+  feature flag for your org. If a subcommand errors with "Agent versioning
+  is not enabled," contact your admin to enable it.
+`);
+  versionGroup.command("create").description("Snapshot current staged state into a new version").option("-m, --message <message>", "Optional description for this version").option("--auto-push", "Push first if local changes are not yet staged").option("--commit-hash <hash>", "Optional git commit hash to associate with this version").addHelpText("after", `
+Examples:
+  $ lua version create                         Snapshot current state
+  $ lua version create -m "Add FAQ skill"      Include a description
+  $ lua version create --auto-push             Push then snapshot in one step
+`).action((opts) => versionCreateCommand(opts));
+  versionGroup.command("list").description("List versions of the current agent").option("--all", "Show all versions (no server-side cap)").option("--limit <n>", "Cap output to this many entries", (v) => parseInt(v, 10)).option("--status <status>", "Filter by status: active | staged | all", "all").option("--json", "Output as JSON").addHelpText("after", `
+Examples:
+  $ lua version list                     List all versions (default)
+  $ lua version list --status active     Show only active versions
+  $ lua version list --limit 10          Show the 10 most recent
+  $ lua version list --json              Machine-readable output
+`).action((opts) => versionListCommand(opts));
+  versionGroup.command("show <version>").description("Show full snapshot of a specific version").option("--json", "Output as JSON").addHelpText("after", `
+Examples:
+  $ lua version show 3          Show version 3 details
+  $ lua version show v3 --json  JSON output
+`).action((version, opts) => versionShowCommand(version, opts));
+  versionGroup.command("diff <from> <to>").description("Compare two versions side-by-side").option("--json", "Output diff as JSON").addHelpText("after", `
+Examples:
+  $ lua version diff 2 3          Compare v2 \u2192 v3
+  $ lua version diff v2 v3 --json Machine-readable diff
+`).action((from, to, opts) => versionDiffCommand(from, to, opts));
+  versionGroup.command("promote <version>").description("Promote a version to active (atomic, instant)").addHelpText("after", `
+Examples:
+  $ lua version promote 3     Promote v3 to the active version
+  $ lua version promote v3    Same (v-prefix accepted)
+`).action((version) => versionPromoteCommand(version));
+  versionGroup.command("delete <version>").description("Soft-delete a version").option("--force", "Skip confirmation prompt").addHelpText("after", `
+Examples:
+  $ lua version delete 3          Delete v3 (confirms first)
+  $ lua version delete v3 --force Skip confirmation
+`).action((version, opts) => versionDeleteCommand(version, opts));
+  const gitGroup = program2.command("git").description("Manage opt-in git auto-commits for this project");
+  gitGroup.command("connect").description("Enable git auto-commits (runs sanity checks, writes git.enabled: true)").action(() => gitConnectCommand());
+  gitGroup.command("disconnect").description("Disable git auto-commits (existing commits/tags untouched)").action(() => gitDisconnectCommand());
+  gitGroup.command("status").description("Show git integration config + last lua-issued commit/tag").action(() => gitStatusCommand());
+  const gitAuthGroup = gitGroup.command("auth").description("Manage git remote provider authentication");
+  gitAuthGroup.command("github").description("Link a GitHub account").option("--device", "Use the device flow (paste a code into github.com/login/device)").option("--force", "Overwrite an existing link without prompting").action((opts) => gitAuthGithubCommand(opts));
+  gitAuthGroup.command("status").description("Show the current git auth status").action(() => gitAuthStatusCommand());
+  gitAuthGroup.command("disconnect [provider]").description("Disconnect a git provider (default: github)").action((provider) => gitAuthDisconnectCommand(provider));
+  program2.command("pull").description("\u{1F4E5}  Pull the agent's source code locally").option("--version <version>", "Pull source linked to a specific agent version (requires versioning)").option("--force", "Skip confirmation prompt").addHelpText("after", `
+Examples:
+  $ lua pull                  Restore the latest source backup
+  $ lua pull --version 3      Restore the source snapshot from agent version 3
+  $ lua pull --version v3 --force  Skip the confirmation prompt
+`).action((opts) => pullCommand(opts));
   const sourceCmd = program2.command("source").description("\u{1F5C2}\uFE0F  Manage workspace source versions");
   sourceCmd.command("list").description("List source versions for the current agent").option("--all", "Show all versions instead of the most recent 50", false).option("--limit <n>", "Number of versions to show", "50").addHelpText("after", `
 Examples: