lua-cli 3.17.0 → 3.17.1

package/dist/index.js

@@ -132,7 +132,7 @@ var init_semver = __esm({
 // src/config/constants.ts
 import { join } from "path";
 import { homedir } from "os";
-var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, CREDENTIALS_FILE, PREFERRED_AGENT_TYPES, SANDBOX_STORAGE_FILE, POSTHOG_API_KEY, POSTHOG_HOST;
+var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, CREDENTIALS_FILE, PREFERRED_AGENT_TYPES, SANDBOX_STORAGE_FILE, AUTH_STORAGE_FILE, POSTHOG_API_KEY, POSTHOG_HOST;
 var init_constants = __esm({
   "src/config/constants.ts"() {
     "use strict";
@@ -154,6 +154,7 @@ var init_constants = __esm({
       "base"
     ];
     SANDBOX_STORAGE_FILE = join(CLI_CONFIG_DIR, "sandbox.json");
+    AUTH_STORAGE_FILE = join(CLI_CONFIG_DIR, "auth.json");
     POSTHOG_API_KEY = "phc_W7Qsquwlflshmdkm2hWSqRpXuxGbVFo7LEX8H9HrSjC";
     POSTHOG_HOST = "https://us.i.posthog.com";
   }
@@ -1199,7 +1200,14 @@ Feel free to add, remove, or rename sections. Your persona can be a single parag
       // `Data.get('call:<sessionId>')` to drive post-call analytics, follow-ups,
       // or QA workflows. Defaults to false — most calls don't need to keep
       // a transcript copy.
-      persistTranscript: z.boolean().optional()
+      persistTranscript: z.boolean().optional(),
+      // Spoken acknowledgement played when a tool call fails. When a tool
+      // throws, times out, or returns an unsupported result, the adapter calls
+      // `session.say(text)` once per failed call before surfacing the error
+      // to the LLM as a ToolError — fills the 2–3s gap before the LLM's own
+      // recovery response. Persona-specific (keep it short and on-brand);
+      // absent → no spoken fallback (the LLM's recovery is the only signal).
+      onToolFailureSay: z.string().min(1).max(200).optional()
     });
     LuaVoiceConfigSchema = LuaVoiceConfigInnerSchema.superRefine((cfg, ctx) => {
       const isRealtime = cfg.llm.kind === "realtime";
@@ -6677,6 +6685,31 @@ var init_skill_plugin = __esm({
 
 // src/compiler/plugins/agent.plugin.ts
 import { Node as Node12 } from "ts-morph";
+function shapeModelSettings(raw) {
+  const KNOWN_KEYS = [
+    "temperature",
+    "topP",
+    "topK",
+    "maxOutputTokens",
+    "presencePenalty",
+    "frequencyPenalty",
+    "stopSequences",
+    "seed"
+  ];
+  const result = {};
+  for (const key of KNOWN_KEYS) {
+    const value = raw[key];
+    if (value === void 0) continue;
+    if (key === "stopSequences") {
+      if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+        result[key] = value;
+      }
+    } else if (typeof value === "number" && Number.isFinite(value)) {
+      result[key] = value;
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
 var AgentPlugin, agentPlugin;
 var init_agent_plugin = __esm({
   "src/compiler/plugins/agent.plugin.ts"() {
@@ -6709,7 +6742,8 @@ var init_agent_plugin = __esm({
           "name",
           "description",
           "persona",
-          "model"
+          "model",
+          "modelSettings"
         ]
       };
       supportsClassDefinition = true;
@@ -6766,6 +6800,9 @@ var init_agent_plugin = __esm({
         const governanceHit = findClassMember(classDecl, "governance", "property");
         const governanceObj = governanceHit && Node12.isPropertyDeclaration(governanceHit.node) ? evaluateNodeAsObject(governanceHit.node.getInitializer()) : void 0;
         const governance = governanceObj && typeof governanceObj.mode === "string" ? governanceObj : void 0;
+        const modelSettingsHit = findClassMember(classDecl, "modelSettings", "property");
+        const modelSettingsObj = modelSettingsHit && Node12.isPropertyDeclaration(modelSettingsHit.node) ? evaluateNodeAsObject(modelSettingsHit.node.getInitializer()) : void 0;
+        const modelSettings = modelSettingsObj ? shapeModelSettings(modelSettingsObj) : void 0;
         return {
           kind: this.kind,
           name,
@@ -6780,6 +6817,7 @@ var init_agent_plugin = __esm({
             persona,
             model,
             hasModelResolver,
+            modelSettings,
             batching,
             governance
           }
@@ -6809,6 +6847,7 @@ var init_agent_plugin = __esm({
           "text"
         ]) ?? "";
         const { model, hasModelResolver } = this.extractModelInfo(config);
+        const modelSettings = this.extractModelSettings(config);
         const batching = this.extractBatchingInfo(config);
         const governance = this.extractGovernanceInfo(config);
         const { voiceRefNames, voiceRefSourcePaths } = this.extractVoiceRefs(config);
@@ -6825,6 +6864,7 @@ var init_agent_plugin = __esm({
             persona,
             model,
             hasModelResolver,
+            modelSettings,
             batching,
             governance,
             voiceRefNames,
@@ -6895,6 +6935,17 @@ var init_agent_plugin = __esm({
         return governance;
       }
       /**
+      * Extract `modelSettings` from the config-literal path. Delegates to the
+      * shared `shapeModelSettings` helper so the class-definition extraction
+      * path applies the exact same key whitelist + type narrowing — without
+      * the shared helper, the two paths would drift (see Bugbot #ref1).
+      */
+      extractModelSettings(config) {
+        const raw = extractObjectProperty(config, "modelSettings");
+        if (!raw || typeof raw !== "object") return void 0;
+        return shapeModelSettings(raw);
+      }
+      /**
       * Extract model info from agent config.
       * Returns the static model string (if any) and whether a resolver function exists.
       */
@@ -6976,6 +7027,7 @@ var init_agent_plugin = __esm({
           persona: agentMeta.persona,
           model: agentMeta.model,
           hasModelResolver: agentMeta.hasModelResolver || void 0,
+          modelSettings: agentMeta.modelSettings,
           batching: agentMeta.batching,
           governance: agentMeta.governance,
           voiceRefs
@@ -7037,6 +7089,7 @@ var init_agent_plugin = __esm({
         return rest;
       }
     };
+    __name(shapeModelSettings, "shapeModelSettings");
     agentPlugin = new AgentPlugin();
   }
 });
@@ -8100,6 +8153,7 @@ var init_voice_plugin = __esm({
         const tts = extractModelField(config, "tts");
         const krispEnabled = extractBooleanProperty(config, "krispEnabled");
         const persistTranscript = extractBooleanProperty(config, "persistTranscript");
+        const onToolFailureSay = extractStringProperty(config, "onToolFailureSay");
         const volume = extractNumberProperty(config, "volume");
         const interruption = extractObjectProperty(config, "interruption");
         const pronunciationsRaw = extractObjectProperty(config, "pronunciations");
@@ -8136,6 +8190,7 @@ var init_voice_plugin = __esm({
             hasTools: hasArrayProperty(config, "tools"),
             krispEnabled,
             persistTranscript,
+            onToolFailureSay,
             volume,
             pronunciations,
             backgroundAudio,
@@ -8195,6 +8250,7 @@ var init_voice_plugin = __esm({
           if (fields.sttLanguage !== void 0) candidate.sttLanguage = fields.sttLanguage;
           if (fields.krispEnabled !== void 0) candidate.krispEnabled = fields.krispEnabled;
           if (fields.persistTranscript !== void 0) candidate.persistTranscript = fields.persistTranscript;
+          if (fields.onToolFailureSay !== void 0) candidate.onToolFailureSay = fields.onToolFailureSay;
           if (fields.volume !== void 0) candidate.volume = fields.volume;
           if (fields.pronunciations !== void 0) candidate.pronunciations = fields.pronunciations;
           if (fields.backgroundAudio !== void 0) candidate.backgroundAudio = fields.backgroundAudio;
@@ -8349,6 +8405,7 @@ var init_voice_plugin = __esm({
           volume: fields.volume,
           pronunciations: fields.pronunciations,
           persistTranscript: fields.persistTranscript,
+          onToolFailureSay: fields.onToolFailureSay,
           interruption: fields.interruption
         };
         return entry;
@@ -15766,6 +15823,33 @@ var AgentHandler = class {
         success: false
       };
     }
+    const modelSettings = agent?.modelSettings ?? null;
+    writeProgress("\n\u{1F321}\uFE0F  Pushing model settings...");
+    try {
+      const success2 = await this.pushModelSettings({
+        apiKey,
+        agentId
+      }, modelSettings);
+      result.modelSettings = {
+        success: success2
+      };
+      if (success2) {
+        if (modelSettings !== null) {
+          const keys = Object.keys(modelSettings).join(", ");
+          writeSuccess(`  \u2705 Model settings pushed (${keys})`);
+        } else {
+          writeSuccess("  \u2705 Model settings cleared (using provider defaults)");
+        }
+      } else {
+        console.error("  \u274C Failed to push model settings");
+      }
+    } catch (error) {
+      if (AuthenticationError.isAuthenticationError(error)) throw error;
+      console.error(`  \u274C Failed to push model settings: ${error.message}`);
+      result.modelSettings = {
+        success: false
+      };
+    }
     const batching = agent?.batching ?? null;
     writeProgress("\n\u23F1  Pushing batching configuration...");
     try {
@@ -15899,6 +15983,13 @@ var AgentHandler = class {
     });
     return result.success;
   }
+  async pushModelSettings(ctx, modelSettings) {
+    const agentApi = new AgentApi(BASE_URLS.API, ctx.apiKey);
+    const result = await agentApi.updateAgent(ctx.agentId, {
+      modelSettings
+    });
+    return result.success;
+  }
   async pushBatching(ctx, batchingConfig) {
     const agentApi = new AgentApi(BASE_URLS.API, ctx.apiKey);
     const result = await agentApi.updateAgent(ctx.agentId, {
@@ -16932,6 +17023,18 @@ async function safePrompt(questions) {
   }
 }
 __name(safePrompt, "safePrompt");
+async function confirmAction(message) {
+  const answer = await safePrompt([
+    {
+      type: "confirm",
+      name: "confirmed",
+      message,
+      default: false
+    }
+  ]);
+  return answer?.confirmed ?? false;
+}
+__name(confirmAction, "confirmAction");
 
 // src/commands/sync.ts
 init_command_utils();
@@ -18666,6 +18769,7 @@ var VoiceHandler = class extends BaseVersionedHandler {
     if (voice.hasTools !== void 0) body.hasTools = voice.hasTools;
     if (voice.krispEnabled !== void 0) body.krispEnabled = voice.krispEnabled;
     if (voice.persistTranscript !== void 0) body.persistTranscript = voice.persistTranscript;
+    if (voice.onToolFailureSay !== void 0) body.onToolFailureSay = voice.onToolFailureSay;
     if (voice.volume !== void 0) body.volume = voice.volume;
     if (voice.pronunciations !== void 0) body.pronunciations = voice.pronunciations;
     if (voice.backgroundAudio !== void 0) body.backgroundAudio = voice.backgroundAudio;
@@ -22139,6 +22243,507 @@ __name(getCommitSha, "getCommitSha");
 
 // src/utils/try-git-commit.ts
 init_analytics();
+
+// src/utils/auto-push-hook.ts
+init_cli();
+
+// src/utils/git-auth-store.ts
+init_constants();
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6 } from "path";
+function readStore() {
+  try {
+    const raw = readFileSync10(AUTH_STORAGE_FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    return {
+      providers: parsed.providers ?? {}
+    };
+  } catch {
+    return {
+      providers: {}
+    };
+  }
+}
+__name(readStore, "readStore");
+function writeStore(store) {
+  mkdirSync7(dirname6(AUTH_STORAGE_FILE), {
+    recursive: true
+  });
+  writeFileSync7(AUTH_STORAGE_FILE, JSON.stringify(store, null, 2), {
+    mode: 384
+  });
+}
+__name(writeStore, "writeStore");
+async function saveAuth(provider, record) {
+  const store = readStore();
+  store.providers[provider] = record;
+  writeStore(store);
+}
+__name(saveAuth, "saveAuth");
+async function getToken2(provider) {
+  return readStore().providers[provider]?.token ?? null;
+}
+__name(getToken2, "getToken");
+async function getStatus(provider) {
+  const record = readStore().providers[provider];
+  if (!record) return {
+    linked: false
+  };
+  return {
+    linked: true,
+    username: record.username,
+    scopes: record.scopes,
+    linkedAt: record.linkedAt
+  };
+}
+__name(getStatus, "getStatus");
+async function clearAuth(provider) {
+  const store = readStore();
+  delete store.providers[provider];
+  writeStore(store);
+}
+__name(clearAuth, "clearAuth");
+
+// src/utils/git-providers/github-provider.ts
+import { createServer } from "http";
+import { randomBytes as randomBytes2 } from "crypto";
+import { request } from "undici";
+import open from "open";
+
+// src/config/git-providers.constants.ts
+var GITHUB_CLIENT_ID = "Ov23lipe1jgBlCsoi9OO";
+var GITHUB_OAUTH_BASE_URL = "https://github.com";
+var GITHUB_API_BASE_URL = "https://api.github.com";
+var GITHUB_OAUTH_SCOPE = "repo";
+var LOOPBACK_PORT_MIN = 49152;
+var LOOPBACK_PORT_MAX = 65535;
+var LOOPBACK_PORT_ATTEMPTS = 3;
+var LOOPBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+var DEVICE_FLOW_DEFAULT_INTERVAL_MS = 5e3;
+var DEVICE_FLOW_SLOW_DOWN_INCREMENT_MS = 5e3;
+var PUSH_TIMEOUT_MS = 2 * 60 * 1e3;
+
+// src/utils/pkce.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+function generateCodeVerifier() {
+  return base64url(randomBytes(64));
+}
+__name(generateCodeVerifier, "generateCodeVerifier");
+function computeCodeChallenge(verifier) {
+  return base64url(createHash2("sha256").update(verifier).digest());
+}
+__name(computeCodeChallenge, "computeCodeChallenge");
+function base64url(buf) {
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+__name(base64url, "base64url");
+
+// src/interfaces/git-providers.ts
+var GitPushError = class extends Error {
+  static {
+    __name(this, "GitPushError");
+  }
+  status;
+  scrubbedStderr;
+  constructor(message, status, scrubbedStderr) {
+    super(message), this.status = status, this.scrubbedStderr = scrubbedStderr;
+    this.name = "GitPushError";
+  }
+};
+
+// src/utils/git-providers/github-provider.ts
+init_cli();
+
+// src/utils/scrub-token.ts
+function scrubToken(s, token) {
+  if (!token) return s;
+  return s.split(token).join("<redacted>");
+}
+__name(scrubToken, "scrubToken");
+
+// src/utils/git-providers/github-provider.ts
+var SUCCESS_HTML = `<!doctype html><meta charset="utf-8"><title>Lua CLI</title>
+<body style="font-family: system-ui; padding: 4rem; text-align: center;">
+  <h1>&#x2713; Connected</h1>
+  <p>You can close this tab and return to the terminal.</p>
+</body>`;
+var GitHubProvider = class {
+  static {
+    __name(this, "GitHubProvider");
+  }
+  name = "github";
+  async login(opts) {
+    const token = opts.device ? await this.deviceFlow() : await this.loopbackFlow();
+    const username = await this.fetchUsername(token);
+    await saveAuth(this.name, {
+      token,
+      username,
+      scopes: [
+        GITHUB_OAUTH_SCOPE
+      ],
+      linkedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return {
+      username
+    };
+  }
+  async logout() {
+    await clearAuth(this.name);
+  }
+  async status() {
+    return getStatus(this.name);
+  }
+  async push(opts) {
+    const parsed = parseGitHubHttpsUrl(opts.remoteUrl);
+    const authedUrl = `https://x-access-token:${opts.token}@github.com/${parsed.owner}/${parsed.repo}`;
+    let result;
+    try {
+      result = await runGit([
+        "push",
+        authedUrl,
+        opts.branch
+      ], {
+        cwd: opts.cwd,
+        timeout: PUSH_TIMEOUT_MS
+      });
+    } catch (err) {
+      const raw = err instanceof Error ? err.message : String(err);
+      const scrubbed2 = scrubToken(raw, opts.token);
+      throw new GitPushError(`git push failed: ${scrubbed2}`, 0, scrubbed2);
+    }
+    if (result.code === 0) return;
+    const scrubbed = scrubToken(result.stderr, opts.token);
+    const status = matchPushStatus(scrubbed);
+    throw new GitPushError(status === 401 ? "GitHub authentication failed (token revoked or insufficient scope)." : status === 403 ? "GitHub rejected the push (403 \u2014 possible SSO enforcement or missing scope)." : "git push failed.", status, scrubbed);
+  }
+  async loopbackFlow() {
+    const verifier = generateCodeVerifier();
+    const challenge = computeCodeChallenge(verifier);
+    const state = randomBytes2(16).toString("hex");
+    const { code, redirectUri } = await this.captureLoopbackCode({
+      state,
+      challenge
+    });
+    return this.exchangeCodeForToken({
+      code,
+      verifier,
+      redirectUri
+    });
+  }
+  async captureLoopbackCode(args2) {
+    let lastErr;
+    for (let i = 0; i < LOOPBACK_PORT_ATTEMPTS; i++) {
+      const port = randomPort();
+      try {
+        return await this.runLoopbackServer(port, args2.state, args2.challenge);
+      } catch (err) {
+        lastErr = err;
+        if (!isPortInUse(err)) throw err;
+      }
+    }
+    throw new Error(`Could not bind a loopback port after ${LOOPBACK_PORT_ATTEMPTS} attempts. Try \`lua git auth github --device\` instead.${lastErr ? ` (${lastErr instanceof Error ? lastErr.message : String(lastErr)})` : ""}`);
+  }
+  runLoopbackServer(port, state, challenge) {
+    return new Promise((resolveOuter, rejectOuter) => {
+      let settled = false;
+      const settle = /* @__PURE__ */ __name((fn) => {
+        if (settled) return;
+        settled = true;
+        fn();
+      }, "settle");
+      const server = createServer((req, res) => {
+        const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+        if (url.pathname !== "/callback") {
+          res.writeHead(404).end();
+          return;
+        }
+        const code = url.searchParams.get("code");
+        const gotState = url.searchParams.get("state");
+        if (!code || gotState !== state) {
+          res.writeHead(400, {
+            "content-type": "text/plain"
+          }).end("State mismatch.");
+          server.close();
+          settle(() => {
+            clearTimeout(timeout);
+            rejectOuter(new Error("OAuth callback state mismatch (possible CSRF). Re-run the command."));
+          });
+          return;
+        }
+        res.writeHead(200, {
+          "content-type": "text/html"
+        }).end(SUCCESS_HTML);
+        server.close();
+        settle(() => {
+          clearTimeout(timeout);
+          resolveOuter({
+            code,
+            redirectUri
+          });
+        });
+      });
+      const timeout = setTimeout(() => {
+        server.close();
+        settle(() => rejectOuter(new Error("OAuth flow timed out (5 min). Re-run `lua git auth github`.")));
+      }, LOOPBACK_TIMEOUT_MS);
+      timeout.unref();
+      server.on("error", (err) => {
+        server.close();
+        settle(() => {
+          clearTimeout(timeout);
+          rejectOuter(err);
+        });
+      });
+      let redirectUri = "";
+      server.listen(port, "127.0.0.1", () => {
+        const actualPort = server.address().port;
+        redirectUri = `http://127.0.0.1:${actualPort}/callback`;
+        const authUrl = new URL(`${GITHUB_OAUTH_BASE_URL}/login/oauth/authorize`);
+        authUrl.searchParams.set("client_id", GITHUB_CLIENT_ID);
+        authUrl.searchParams.set("redirect_uri", redirectUri);
+        authUrl.searchParams.set("scope", GITHUB_OAUTH_SCOPE);
+        authUrl.searchParams.set("code_challenge", challenge);
+        authUrl.searchParams.set("code_challenge_method", "S256");
+        authUrl.searchParams.set("state", state);
+        open(authUrl.toString()).catch(() => {
+          server.close();
+          settle(() => {
+            clearTimeout(timeout);
+            rejectOuter(new Error("Couldn't open a browser \u2014 try `lua git auth github --device` for the device flow."));
+          });
+        });
+      });
+    });
+  }
+  async exchangeCodeForToken(args2) {
+    const res = await request(`${GITHUB_OAUTH_BASE_URL}/login/oauth/access_token`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: GITHUB_CLIENT_ID,
+        code: args2.code,
+        code_verifier: args2.verifier,
+        redirect_uri: args2.redirectUri,
+        grant_type: "authorization_code"
+      })
+    });
+    const body = await res.body.json();
+    if (!body.access_token) {
+      throw new Error(`GitHub rejected the token exchange: ${body.error ?? "unknown error"}`);
+    }
+    return body.access_token;
+  }
+  async fetchUsername(token) {
+    const res = await request(`${GITHUB_API_BASE_URL}/user`, {
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${token}`,
+        "user-agent": "lua-cli"
+      }
+    });
+    const body = await res.body.json();
+    if (!body.login) throw new Error("Could not read GitHub username after auth.");
+    return body.login;
+  }
+  async deviceFlow() {
+    const codeRes = await request(`${GITHUB_OAUTH_BASE_URL}/login/device/code`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: GITHUB_CLIENT_ID,
+        scope: GITHUB_OAUTH_SCOPE
+      })
+    });
+    const codeBody = await codeRes.body.json();
+    if (!codeBody.device_code || !codeBody.user_code || !codeBody.verification_uri) {
+      throw new Error(`GitHub rejected device-code request: ${codeBody.error ?? "unknown error"}`);
+    }
+    writeInfo(`Open ${codeBody.verification_uri} and enter the code: ${codeBody.user_code}`);
+    let intervalMs = codeBody.interval != null ? codeBody.interval * 1e3 : DEVICE_FLOW_DEFAULT_INTERVAL_MS;
+    const deadline = Date.now() + (codeBody.expires_in ?? 900) * 1e3;
+    while (Date.now() < deadline) {
+      await sleep(intervalMs);
+      if (Date.now() >= deadline) break;
+      const pollRes = await request(`${GITHUB_OAUTH_BASE_URL}/login/oauth/access_token`, {
+        method: "POST",
+        headers: {
+          accept: "application/json",
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({
+          client_id: GITHUB_CLIENT_ID,
+          device_code: codeBody.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+      });
+      const body = await pollRes.body.json();
+      if (body.access_token) return body.access_token;
+      if (body.error === "authorization_pending") continue;
+      if (body.error === "slow_down") {
+        intervalMs += DEVICE_FLOW_SLOW_DOWN_INCREMENT_MS;
+        continue;
+      }
+      if (body.error === "expired_token") {
+        throw new Error("Device code expired. Re-run `lua git auth github --device`.");
+      }
+      throw new Error(`GitHub device-flow error: ${body.error ?? "unknown"}`);
+    }
+    throw new Error("Device flow timed out. Re-run `lua git auth github --device`.");
+  }
+};
+function randomPort() {
+  const span = LOOPBACK_PORT_MAX - LOOPBACK_PORT_MIN + 1;
+  return LOOPBACK_PORT_MIN + Math.floor(Math.random() * span);
+}
+__name(randomPort, "randomPort");
+function isPortInUse(err) {
+  return !!err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE";
+}
+__name(isPortInUse, "isPortInUse");
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+__name(sleep, "sleep");
+function isGitHubUrl(url) {
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" && u.hostname === "github.com";
+  } catch {
+    return false;
+  }
+}
+__name(isGitHubUrl, "isGitHubUrl");
+function parseGitHubHttpsUrl(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    throw new Error(`Not a parseable URL: ${url}. v1 only supports https GitHub remotes.`);
+  }
+  if (u.protocol !== "https:" || u.hostname !== "github.com") {
+    throw new Error(`Not a GitHub HTTPS remote: ${url}. v1 only supports https://github.com/...`);
+  }
+  const parts = u.pathname.replace(/^\/+/, "").replace(/\.git$/, "").split("/");
+  if (parts.length < 2 || !parts[0] || !parts[1]) {
+    throw new Error(`Unexpected GitHub URL shape: ${url}`);
+  }
+  return {
+    owner: parts[0],
+    repo: parts[1]
+  };
+}
+__name(parseGitHubHttpsUrl, "parseGitHubHttpsUrl");
+function matchPushStatus(stderr) {
+  const s = stderr.toLowerCase();
+  if (s.includes("401") || s.includes("authentication failed")) return 401;
+  if (s.includes("403") || s.includes("permission to") || s.includes("forbidden")) return 403;
+  return 0;
+}
+__name(matchPushStatus, "matchPushStatus");
+
+// src/utils/auto-push-hook.ts
+init_analytics();
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  writeInfo(`\u26A0\uFE0F  ${message}`);
+}
+__name(warnOnce, "warnOnce");
+async function tryGitAutoPush(ctx) {
+  try {
+    if (ctx.config?.git?.autoPush !== true) return;
+    const token = await getToken2("github");
+    if (!token) {
+      warnOnce("missing-github-token", "git.autoPush is enabled but no GitHub auth \u2014 run `lua git auth github`.");
+      return;
+    }
+    const remote = await readRemoteOriginUrl(ctx.cwd);
+    if (!remote) {
+      warnOnce("missing-github-remote", "git.autoPush is enabled but no `remote.origin.url` is set. Skipping push.");
+      return;
+    }
+    if (!isGitHubUrl(remote)) {
+      warnOnce("non-github-remote", `git.autoPush is enabled but origin (${remote}) is not a supported GitHub HTTPS URL. v1 only supports https://github.com/<owner>/<repo> \u2014 skipping push.`);
+      return;
+    }
+    const branch = await readCurrentBranch(ctx.cwd);
+    if (!branch) {
+      warnOnce("detached-head", "Cannot auto-push from a detached HEAD. Skipping push.");
+      return;
+    }
+    const provider = new GitHubProvider();
+    try {
+      await provider.push({
+        token,
+        remoteUrl: remote,
+        branch,
+        cwd: ctx.cwd ?? process.cwd()
+      });
+      writeInfo(`\u2713 Pushed ${ctx.commitSha?.slice(0, 7) ?? ""} to ${remote} (${branch})`);
+      trackEvent("cli_auto_push_succeeded", {
+        action: ctx.action
+      });
+    } catch (err) {
+      const status = err instanceof GitPushError ? err.status : 0;
+      const message = err instanceof GitPushError ? err.scrubbedStderr || err.message : err instanceof Error ? err.message : String(err);
+      if (status === 401) {
+        warnOnce("push-revoked", "GitHub auth was revoked \u2014 run `lua git auth github` to re-link. Commit kept locally.");
+      } else if (status === 403) {
+        warnOnce("push-rejected-403", `GitHub rejected the push: ${message}. Commit kept locally.`);
+      } else {
+        warnOnce("push-failed-other", `Auto-push failed: ${message}. Commit kept locally; run \`git push\` to retry.`);
+      }
+      trackEvent("cli_auto_push_failed", {
+        action: ctx.action,
+        status
+      });
+    }
+  } catch {
+    warnOnce("hook-errored", "Auto-push hook errored unexpectedly. Commit kept locally; run `git push` to retry.");
+    trackEvent("cli_auto_push_failed", {
+      action: ctx.action,
+      status: 0
+    });
+  }
+}
+__name(tryGitAutoPush, "tryGitAutoPush");
+async function readRemoteOriginUrl(cwd) {
+  const res = await runGit([
+    "config",
+    "--get",
+    "remote.origin.url"
+  ], {
+    cwd
+  });
+  if (res.code !== 0) return null;
+  const trimmed = res.stdout.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+__name(readRemoteOriginUrl, "readRemoteOriginUrl");
+async function readCurrentBranch(cwd) {
+  const res = await runGit([
+    "rev-parse",
+    "--abbrev-ref",
+    "HEAD"
+  ], {
+    cwd
+  });
+  if (res.code !== 0) return null;
+  const trimmed = res.stdout.trim();
+  if (!trimmed || trimmed === "HEAD") return null;
+  return trimmed;
+}
+__name(readCurrentBranch, "readCurrentBranch");
+
+// src/utils/try-git-commit.ts
 async function tryGitCommit(opts) {
   const config = readYamlConfig();
   if (!config?.git?.enabled) {
@@ -22221,6 +22826,12 @@ async function tryGitCommit(opts) {
     has_sha: Boolean(sha),
     has_tag: tagged === true
   });
+  await tryGitAutoPush({
+    config,
+    cwd: opts.cwd,
+    commitSha: sha,
+    action: opts.action
+  });
   return {
     committed: true,
     sha,
@@ -24154,11 +24765,11 @@ init_cli();
 
 // src/utils/sandbox-storage.ts
 init_constants();
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7 } from "fs";
-import { dirname as dirname6 } from "path";
-function readStore() {
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "fs";
+import { dirname as dirname7 } from "path";
+function readStore2() {
   try {
-    const raw = readFileSync10(SANDBOX_STORAGE_FILE, "utf8");
+    const raw = readFileSync11(SANDBOX_STORAGE_FILE, "utf8");
     const parsed = JSON.parse(raw);
     return {
       skills: parsed.skills ?? {},
@@ -24175,28 +24786,28 @@ function readStore() {
     };
   }
 }
-__name(readStore, "readStore");
-function writeStore(store) {
+__name(readStore2, "readStore");
+function writeStore2(store) {
   try {
-    mkdirSync7(dirname6(SANDBOX_STORAGE_FILE), {
+    mkdirSync8(dirname7(SANDBOX_STORAGE_FILE), {
       recursive: true
     });
-    writeFileSync7(SANDBOX_STORAGE_FILE, JSON.stringify(store, null, 2), "utf8");
+    writeFileSync8(SANDBOX_STORAGE_FILE, JSON.stringify(store, null, 2), "utf8");
   } catch {
   }
 }
-__name(writeStore, "writeStore");
+__name(writeStore2, "writeStore");
 async function getSandboxSkillId(skillName) {
-  const store = readStore();
+  const store = readStore2();
   const key = skillName ?? "__default__";
   return store.skills[key] ?? null;
 }
 __name(getSandboxSkillId, "getSandboxSkillId");
 async function setSandboxSkillId(sandboxId, skillName) {
-  const store = readStore();
+  const store = readStore2();
   const key = skillName ?? "__default__";
   store.skills[key] = sandboxId;
-  writeStore(store);
+  writeStore2(store);
 }
 __name(setSandboxSkillId, "setSandboxSkillId");
 async function getAllSandboxSkillIds(yamlConfig) {
@@ -24222,14 +24833,14 @@ async function getAllSandboxSkillIds(yamlConfig) {
 }
 __name(getAllSandboxSkillIds, "getAllSandboxSkillIds");
 async function getSandboxPreProcessorId(preprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   return store.preprocessors[preprocessorName] ?? null;
 }
 __name(getSandboxPreProcessorId, "getSandboxPreProcessorId");
 async function setSandboxPreProcessorId(sandboxId, preprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   store.preprocessors[preprocessorName] = sandboxId;
-  writeStore(store);
+  writeStore2(store);
 }
 __name(setSandboxPreProcessorId, "setSandboxPreProcessorId");
 async function getAllSandboxPreProcessorIds(config) {
@@ -24254,14 +24865,14 @@ async function getAllSandboxPreProcessorIds(config) {
 }
 __name(getAllSandboxPreProcessorIds, "getAllSandboxPreProcessorIds");
 async function getSandboxPostProcessorId(postprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   return store.postprocessors[postprocessorName] ?? null;
 }
 __name(getSandboxPostProcessorId, "getSandboxPostProcessorId");
 async function setSandboxPostProcessorId(sandboxId, postprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   store.postprocessors[postprocessorName] = sandboxId;
-  writeStore(store);
+  writeStore2(store);
 }
 __name(setSandboxPostProcessorId, "setSandboxPostProcessorId");
 async function getAllSandboxPostProcessorIds(config) {
@@ -27593,7 +28204,7 @@ __name(viewResourceInteractive, "viewResourceInteractive");
 init_cli();
 init_command_utils();
 init_analytics();
-import open from "open";
+import open2 from "open";
 async function adminCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Admin Dashboard...");
@@ -27601,7 +28212,7 @@ async function adminCommand() {
       showProgress: false
     });
     const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
-    await open(adminUrl);
+    await open2(adminUrl);
     writeSuccess("Lua Admin Dashboard opened in your browser");
     console.log(`
   Dashboard URL: https://admin.heylua.ai`);
@@ -27617,7 +28228,7 @@ __name(adminCommand, "adminCommand");
 init_cli();
 init_command_utils();
 init_analytics();
-import open2 from "open";
+import open3 from "open";
 async function evalsCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Evaluations Dashboard...");
@@ -27625,7 +28236,7 @@ async function evalsCommand() {
       showProgress: false
     });
     const evalsUrl = `https://evals.heylua.ai?apiKey=${apiKey}&agentID=${agentId}`;
-    await open2(evalsUrl);
+    await open3(evalsUrl);
     writeSuccess("Lua Evaluations Dashboard opened in your browser");
     console.log(`
   Dashboard URL: https://evals.heylua.ai`);
@@ -27639,12 +28250,12 @@ __name(evalsCommand, "evalsCommand");
 // src/commands/docs.ts
 init_cli();
 init_analytics();
-import open3 from "open";
+import open4 from "open";
 async function docsCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Documentation...");
     const docsUrl = "https://docs.heylua.ai";
-    await open3(docsUrl);
+    await open4(docsUrl);
     writeSuccess("Lua Documentation opened in your browser");
     console.log(`
   Documentation: ${docsUrl}
@@ -27658,7 +28269,7 @@ __name(docsCommand, "docsCommand");
 init_cli();
 init_command_utils();
 import inquirer12 from "inquirer";
-import open4 from "open";
+import open5 from "open";
 
 // src/api/channels.api.service.ts
 init_http_client();
@@ -28227,7 +28838,7 @@ async function openAdminDashboard(apiKey, config) {
     throw new Error("No orgId found in lua.skill.yaml. Please ensure your configuration is valid.");
   }
   const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
-  await open4(adminUrl);
+  await open5(adminUrl);
   writeSuccess("\u2705 Lua Admin Dashboard opened in your browser");
   console.log(`
   Dashboard URL: https://admin.heylua.ai`);
@@ -30358,7 +30969,7 @@ init_auth();
 init_auth_api_service();
 init_files();
 init_artifact_loader();
-import { existsSync as existsSync7, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync12 } from "fs";
 import { join as join6 } from "path";
 import { performance } from "perf_hooks";
 import * as os from "os";
@@ -30709,7 +31320,7 @@ function gatherTelemetry() {
   } else {
     try {
       if (existsSync7(TELEMETRY_FILE)) {
-        const raw = readFileSync11(TELEMETRY_FILE, "utf8");
+        const raw = readFileSync12(TELEMETRY_FILE, "utf8");
         const cfg = JSON.parse(raw);
         if (typeof cfg.enabled === "boolean") enabled = cfg.enabled;
       }
@@ -37011,7 +37622,7 @@ init_cli();
 init_constants();
 import http from "http";
 import { URL as URL2 } from "url";
-import open5 from "open";
+import open6 from "open";
 init_command_utils();
 init_developer_api_service();
 
@@ -38034,7 +38645,7 @@ Integration: ${selectedIntegration.name}`);
 `);
   const callbackPromise = startCallbackServer(3e5);
   try {
-    await open5(authUrl);
+    await open6(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
   } catch (error) {
     writeInfo("\u{1F4A1} Could not open browser automatically. Please open the URL above manually.");
@@ -38465,7 +39076,7 @@ Available scopes for ${selectedIntegration.name}:`);
 `);
   const callbackPromise = startCallbackServer(3e5);
   try {
-    await open5(authUrl);
+    await open6(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
   } catch (error) {
     writeInfo("\u{1F4A1} Could not open browser automatically. Please open the URL above manually.");
@@ -39890,7 +40501,7 @@ __name(telemetryCommand, "telemetryCommand");
 init_cli();
 init_command_utils();
 init_analytics();
-import { writeFileSync as writeFileSync8, existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
+import { writeFileSync as writeFileSync9, existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
 import { resolve as resolve4, join as join7 } from "path";
 init_artifact_loader();
 init_types();
@@ -40051,7 +40662,7 @@ async function governanceCommand(action) {
       }
     }
     const content = generateFile(setup);
-    writeFileSync8(filePath, content, "utf-8");
+    writeFileSync9(filePath, content, "utf-8");
     const relativePath = filePath.replace(process.cwd() + "/", "");
     writeSuccess(`Created ${relativePath}`);
     console.log("");
@@ -40678,7 +41289,7 @@ __name(pumpRemoteAudioToSpeaker, "pumpRemoteAudioToSpeaker");
 // src/commands/voice-browser.ts
 init_cli();
 import http2 from "http";
-import open6 from "open";
+import open7 from "open";
 var SAFETY_TIMEOUT_MS = 60 * 60 * 1e3;
 async function runBrowserMode(joinUrl) {
   const { wsUrl, token } = parseJoinUrl(joinUrl);
@@ -40710,7 +41321,7 @@ async function runBrowserMode(joinUrl) {
   const localUrl = `http://localhost:${port}/`;
   writeSuccess(`Voice room ready (opening browser)`);
   console.log(`   ${localUrl}`);
-  await open6(localUrl);
+  await open7(localUrl);
   await new Promise((resolve6) => {
     const safety = setTimeout(() => {
       try {
@@ -41903,6 +42514,77 @@ async function gitStatusCommand() {
 }
 __name(gitStatusCommand, "gitStatusCommand");
 
+// src/commands/git-auth.ts
+init_cli();
+init_analytics();
+function gitAuthGithubCommand(opts) {
+  return withErrorHandling(async () => {
+    const provider = new GitHubProvider();
+    const existing = await provider.status();
+    if (existing.linked && !opts.force) {
+      const ok = await confirmAction(`Already linked to GitHub as @${existing.username}. Re-link?`);
+      if (!ok) {
+        writeInfo("Aborted. Existing link preserved.");
+        return;
+      }
+    }
+    const result = await provider.login({
+      device: opts.device,
+      force: opts.force
+    });
+    writeSuccess(`Logged in to GitHub as @${result.username}.`);
+    trackEvent("cli_git_auth_succeeded", {
+      provider: "github",
+      flow: opts.device ? "device" : "loopback"
+    });
+  }, "git-auth-github");
+}
+__name(gitAuthGithubCommand, "gitAuthGithubCommand");
+function gitAuthStatusCommand() {
+  return withErrorHandling(async () => {
+    const provider = new GitHubProvider();
+    const s = await provider.status();
+    if (!s.linked) {
+      console.log("Not linked. Run `lua git auth github` to link.");
+    } else {
+      console.log(`Linked: github \u2014 @${s.username} (scopes: ${s.scopes.join(", ")}) \u2014 linked ${formatLinkedAt(s.linkedAt)}`);
+    }
+    trackEvent("cli_git_auth_status_completed", {
+      linked: s.linked
+    });
+  }, "git-auth-status");
+}
+__name(gitAuthStatusCommand, "gitAuthStatusCommand");
+function gitAuthDisconnectCommand(provider) {
+  return withErrorHandling(async () => {
+    const name = (provider ?? "github").toLowerCase();
+    if (name !== "github") {
+      writeError(`Unknown provider: ${name}. v1 only supports github.`);
+      return;
+    }
+    const p = new GitHubProvider();
+    const s = await p.status();
+    if (!s.linked) {
+      console.log(`Not linked to ${name}. Nothing to do.`);
+      return;
+    }
+    await p.logout();
+    writeSuccess(`Disconnected from ${name}.`);
+    trackEvent("cli_git_auth_disconnect_completed", {
+      provider: name
+    });
+  }, "git-auth-disconnect");
+}
+__name(gitAuthDisconnectCommand, "gitAuthDisconnectCommand");
+function formatLinkedAt(iso) {
+  try {
+    return new Date(iso).toISOString().replace("T", " ").replace(/\..*$/, " UTC");
+  } catch {
+    return iso;
+  }
+}
+__name(formatLinkedAt, "formatLinkedAt");
+
 // src/commands/pull.ts
 init_cli();
 init_command_utils();
@@ -42597,7 +43279,12 @@ Examples:
   $ lua voice test --runner vitest       Force vitest
 `).action(voiceTestCommand);
   voice.command("list").description("List LuaVoice primitives in the compiled manifest").option("--json", "Output as JSON").action(voiceListCommand);
-  const versionGroup = program2.command("version").description("\u{1F3F7}\uFE0F  Manage agent versions (atomic snapshots of agent state)");
+  const versionGroup = program2.command("version").description("\u{1F3F7}\uFE0F  Manage agent versions \u2014 atomic snapshots (requires agentVersioningEnabled for your org)").addHelpText("after", `
+Note:
+  All \`lua version\` subcommands require the \`agentVersioningEnabled\`
+  feature flag for your org. If a subcommand errors with "Agent versioning
+  is not enabled," contact your admin to enable it.
+`);
   versionGroup.command("create").description("Snapshot current staged state into a new version").option("-m, --message <message>", "Optional description for this version").option("--auto-push", "Push first if local changes are not yet staged").option("--commit-hash <hash>", "Optional git commit hash to associate with this version").addHelpText("after", `
 Examples:
   $ lua version create                         Snapshot current state
@@ -42635,6 +43322,10 @@ Examples:
   gitGroup.command("connect").description("Enable git auto-commits (runs sanity checks, writes git.enabled: true)").action(() => gitConnectCommand());
   gitGroup.command("disconnect").description("Disable git auto-commits (existing commits/tags untouched)").action(() => gitDisconnectCommand());
   gitGroup.command("status").description("Show git integration config + last lua-issued commit/tag").action(() => gitStatusCommand());
+  const gitAuthGroup = gitGroup.command("auth").description("Manage git remote provider authentication");
+  gitAuthGroup.command("github").description("Link a GitHub account").option("--device", "Use the device flow (paste a code into github.com/login/device)").option("--force", "Overwrite an existing link without prompting").action((opts) => gitAuthGithubCommand(opts));
+  gitAuthGroup.command("status").description("Show the current git auth status").action(() => gitAuthStatusCommand());
+  gitAuthGroup.command("disconnect [provider]").description("Disconnect a git provider (default: github)").action((provider) => gitAuthDisconnectCommand(provider));
   program2.command("pull").description("\u{1F4E5}  Pull the agent's source code locally").option("--version <version>", "Pull source linked to a specific agent version (requires versioning)").option("--force", "Skip confirmation prompt").addHelpText("after", `
 Examples:
   $ lua pull                  Restore the latest source backup