lua-cli 3.17.0 → 3.17.2

package/dist/index.js

@@ -132,7 +132,7 @@ var init_semver = __esm({
 // src/config/constants.ts
 import { join } from "path";
 import { homedir } from "os";
-var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, CREDENTIALS_FILE, PREFERRED_AGENT_TYPES, SANDBOX_STORAGE_FILE, POSTHOG_API_KEY, POSTHOG_HOST;
+var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, CREDENTIALS_FILE, PREFERRED_AGENT_TYPES, SANDBOX_STORAGE_FILE, AUTH_STORAGE_FILE, POSTHOG_API_KEY, POSTHOG_HOST;
 var init_constants = __esm({
   "src/config/constants.ts"() {
     "use strict";
@@ -154,6 +154,7 @@ var init_constants = __esm({
       "base"
     ];
     SANDBOX_STORAGE_FILE = join(CLI_CONFIG_DIR, "sandbox.json");
+    AUTH_STORAGE_FILE = join(CLI_CONFIG_DIR, "auth.json");
     POSTHOG_API_KEY = "phc_W7Qsquwlflshmdkm2hWSqRpXuxGbVFo7LEX8H9HrSjC";
     POSTHOG_HOST = "https://us.i.posthog.com";
   }
@@ -1199,7 +1200,14 @@ Feel free to add, remove, or rename sections. Your persona can be a single parag
       // `Data.get('call:<sessionId>')` to drive post-call analytics, follow-ups,
       // or QA workflows. Defaults to false — most calls don't need to keep
       // a transcript copy.
-      persistTranscript: z.boolean().optional()
+      persistTranscript: z.boolean().optional(),
+      // Spoken acknowledgement played when a tool call fails. When a tool
+      // throws, times out, or returns an unsupported result, the adapter calls
+      // `session.say(text)` once per failed call before surfacing the error
+      // to the LLM as a ToolError — fills the 2–3s gap before the LLM's own
+      // recovery response. Persona-specific (keep it short and on-brand);
+      // absent → no spoken fallback (the LLM's recovery is the only signal).
+      onToolFailureSay: z.string().min(1).max(200).optional()
     });
     LuaVoiceConfigSchema = LuaVoiceConfigInnerSchema.superRefine((cfg, ctx) => {
       const isRealtime = cfg.llm.kind === "realtime";
@@ -6677,6 +6685,31 @@ var init_skill_plugin = __esm({
 
 // src/compiler/plugins/agent.plugin.ts
 import { Node as Node12 } from "ts-morph";
+function shapeModelSettings(raw) {
+  const KNOWN_KEYS = [
+    "temperature",
+    "topP",
+    "topK",
+    "maxOutputTokens",
+    "presencePenalty",
+    "frequencyPenalty",
+    "stopSequences",
+    "seed"
+  ];
+  const result = {};
+  for (const key of KNOWN_KEYS) {
+    const value = raw[key];
+    if (value === void 0) continue;
+    if (key === "stopSequences") {
+      if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+        result[key] = value;
+      }
+    } else if (typeof value === "number" && Number.isFinite(value)) {
+      result[key] = value;
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
 var AgentPlugin, agentPlugin;
 var init_agent_plugin = __esm({
   "src/compiler/plugins/agent.plugin.ts"() {
@@ -6709,7 +6742,8 @@ var init_agent_plugin = __esm({
           "name",
           "description",
           "persona",
-          "model"
+          "model",
+          "modelSettings"
         ]
       };
       supportsClassDefinition = true;
@@ -6766,6 +6800,9 @@ var init_agent_plugin = __esm({
         const governanceHit = findClassMember(classDecl, "governance", "property");
         const governanceObj = governanceHit && Node12.isPropertyDeclaration(governanceHit.node) ? evaluateNodeAsObject(governanceHit.node.getInitializer()) : void 0;
         const governance = governanceObj && typeof governanceObj.mode === "string" ? governanceObj : void 0;
+        const modelSettingsHit = findClassMember(classDecl, "modelSettings", "property");
+        const modelSettingsObj = modelSettingsHit && Node12.isPropertyDeclaration(modelSettingsHit.node) ? evaluateNodeAsObject(modelSettingsHit.node.getInitializer()) : void 0;
+        const modelSettings = modelSettingsObj ? shapeModelSettings(modelSettingsObj) : void 0;
         return {
           kind: this.kind,
           name,
@@ -6780,6 +6817,7 @@ var init_agent_plugin = __esm({
             persona,
             model,
             hasModelResolver,
+            modelSettings,
             batching,
             governance
           }
@@ -6809,6 +6847,7 @@ var init_agent_plugin = __esm({
           "text"
         ]) ?? "";
         const { model, hasModelResolver } = this.extractModelInfo(config);
+        const modelSettings = this.extractModelSettings(config);
         const batching = this.extractBatchingInfo(config);
         const governance = this.extractGovernanceInfo(config);
         const { voiceRefNames, voiceRefSourcePaths } = this.extractVoiceRefs(config);
@@ -6825,6 +6864,7 @@ var init_agent_plugin = __esm({
             persona,
             model,
             hasModelResolver,
+            modelSettings,
             batching,
             governance,
             voiceRefNames,
@@ -6895,6 +6935,17 @@ var init_agent_plugin = __esm({
         return governance;
       }
       /**
+      * Extract `modelSettings` from the config-literal path. Delegates to the
+      * shared `shapeModelSettings` helper so the class-definition extraction
+      * path applies the exact same key whitelist + type narrowing — without
+      * the shared helper, the two paths would drift (see Bugbot #ref1).
+      */
+      extractModelSettings(config) {
+        const raw = extractObjectProperty(config, "modelSettings");
+        if (!raw || typeof raw !== "object") return void 0;
+        return shapeModelSettings(raw);
+      }
+      /**
       * Extract model info from agent config.
       * Returns the static model string (if any) and whether a resolver function exists.
       */
@@ -6976,6 +7027,7 @@ var init_agent_plugin = __esm({
           persona: agentMeta.persona,
           model: agentMeta.model,
           hasModelResolver: agentMeta.hasModelResolver || void 0,
+          modelSettings: agentMeta.modelSettings,
           batching: agentMeta.batching,
           governance: agentMeta.governance,
           voiceRefs
@@ -7037,6 +7089,7 @@ var init_agent_plugin = __esm({
         return rest;
       }
     };
+    __name(shapeModelSettings, "shapeModelSettings");
     agentPlugin = new AgentPlugin();
   }
 });
@@ -8100,6 +8153,7 @@ var init_voice_plugin = __esm({
         const tts = extractModelField(config, "tts");
         const krispEnabled = extractBooleanProperty(config, "krispEnabled");
         const persistTranscript = extractBooleanProperty(config, "persistTranscript");
+        const onToolFailureSay = extractStringProperty(config, "onToolFailureSay");
         const volume = extractNumberProperty(config, "volume");
         const interruption = extractObjectProperty(config, "interruption");
         const pronunciationsRaw = extractObjectProperty(config, "pronunciations");
@@ -8136,6 +8190,7 @@ var init_voice_plugin = __esm({
             hasTools: hasArrayProperty(config, "tools"),
             krispEnabled,
             persistTranscript,
+            onToolFailureSay,
             volume,
             pronunciations,
             backgroundAudio,
@@ -8195,6 +8250,7 @@ var init_voice_plugin = __esm({
           if (fields.sttLanguage !== void 0) candidate.sttLanguage = fields.sttLanguage;
           if (fields.krispEnabled !== void 0) candidate.krispEnabled = fields.krispEnabled;
           if (fields.persistTranscript !== void 0) candidate.persistTranscript = fields.persistTranscript;
+          if (fields.onToolFailureSay !== void 0) candidate.onToolFailureSay = fields.onToolFailureSay;
           if (fields.volume !== void 0) candidate.volume = fields.volume;
           if (fields.pronunciations !== void 0) candidate.pronunciations = fields.pronunciations;
           if (fields.backgroundAudio !== void 0) candidate.backgroundAudio = fields.backgroundAudio;
@@ -8349,6 +8405,7 @@ var init_voice_plugin = __esm({
           volume: fields.volume,
           pronunciations: fields.pronunciations,
           persistTranscript: fields.persistTranscript,
+          onToolFailureSay: fields.onToolFailureSay,
           interruption: fields.interruption
         };
         return entry;
@@ -15766,6 +15823,33 @@ var AgentHandler = class {
         success: false
       };
     }
+    const modelSettings = agent?.modelSettings ?? null;
+    writeProgress("\n\u{1F321}\uFE0F  Pushing model settings...");
+    try {
+      const success2 = await this.pushModelSettings({
+        apiKey,
+        agentId
+      }, modelSettings);
+      result.modelSettings = {
+        success: success2
+      };
+      if (success2) {
+        if (modelSettings !== null) {
+          const keys = Object.keys(modelSettings).join(", ");
+          writeSuccess(`  \u2705 Model settings pushed (${keys})`);
+        } else {
+          writeSuccess("  \u2705 Model settings cleared (using provider defaults)");
+        }
+      } else {
+        console.error("  \u274C Failed to push model settings");
+      }
+    } catch (error) {
+      if (AuthenticationError.isAuthenticationError(error)) throw error;
+      console.error(`  \u274C Failed to push model settings: ${error.message}`);
+      result.modelSettings = {
+        success: false
+      };
+    }
     const batching = agent?.batching ?? null;
     writeProgress("\n\u23F1  Pushing batching configuration...");
     try {
@@ -15899,6 +15983,13 @@ var AgentHandler = class {
     });
     return result.success;
   }
+  async pushModelSettings(ctx, modelSettings) {
+    const agentApi = new AgentApi(BASE_URLS.API, ctx.apiKey);
+    const result = await agentApi.updateAgent(ctx.agentId, {
+      modelSettings
+    });
+    return result.success;
+  }
   async pushBatching(ctx, batchingConfig) {
     const agentApi = new AgentApi(BASE_URLS.API, ctx.apiKey);
     const result = await agentApi.updateAgent(ctx.agentId, {
@@ -16932,6 +17023,18 @@ async function safePrompt(questions) {
   }
 }
 __name(safePrompt, "safePrompt");
+async function confirmAction(message) {
+  const answer = await safePrompt([
+    {
+      type: "confirm",
+      name: "confirmed",
+      message,
+      default: false
+    }
+  ]);
+  return answer?.confirmed ?? false;
+}
+__name(confirmAction, "confirmAction");
 
 // src/commands/sync.ts
 init_command_utils();
@@ -18666,6 +18769,7 @@ var VoiceHandler = class extends BaseVersionedHandler {
     if (voice.hasTools !== void 0) body.hasTools = voice.hasTools;
     if (voice.krispEnabled !== void 0) body.krispEnabled = voice.krispEnabled;
     if (voice.persistTranscript !== void 0) body.persistTranscript = voice.persistTranscript;
+    if (voice.onToolFailureSay !== void 0) body.onToolFailureSay = voice.onToolFailureSay;
     if (voice.volume !== void 0) body.volume = voice.volume;
     if (voice.pronunciations !== void 0) body.pronunciations = voice.pronunciations;
     if (voice.backgroundAudio !== void 0) body.backgroundAudio = voice.backgroundAudio;
@@ -22120,6 +22224,23 @@ async function gitUserConfigured(cwd) {
   };
 }
 __name(gitUserConfigured, "gitUserConfigured");
+async function getRemoteOriginUrl(cwd) {
+  try {
+    const { stdout, code } = await runGit([
+      "config",
+      "--get",
+      "remote.origin.url"
+    ], {
+      cwd
+    });
+    if (code !== 0) return null;
+    const trimmed = stdout.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+__name(getRemoteOriginUrl, "getRemoteOriginUrl");
 async function getCommitSha(cwd) {
   try {
     const { stdout, code } = await runGit([
@@ -22139,6 +22260,351 @@ __name(getCommitSha, "getCommitSha");
 
 // src/utils/try-git-commit.ts
 init_analytics();
+
+// src/utils/auto-push-hook.ts
+init_cli();
+
+// src/utils/git-auth-store.ts
+init_constants();
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6 } from "path";
+function readStore() {
+  try {
+    const raw = readFileSync10(AUTH_STORAGE_FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    return {
+      providers: parsed.providers ?? {}
+    };
+  } catch {
+    return {
+      providers: {}
+    };
+  }
+}
+__name(readStore, "readStore");
+function writeStore(store) {
+  mkdirSync7(dirname6(AUTH_STORAGE_FILE), {
+    recursive: true
+  });
+  writeFileSync7(AUTH_STORAGE_FILE, JSON.stringify(store, null, 2), {
+    mode: 384
+  });
+}
+__name(writeStore, "writeStore");
+async function saveAuth(provider, record) {
+  const store = readStore();
+  store.providers[provider] = record;
+  writeStore(store);
+}
+__name(saveAuth, "saveAuth");
+async function getToken2(provider) {
+  return readStore().providers[provider]?.token ?? null;
+}
+__name(getToken2, "getToken");
+async function getStatus(provider) {
+  const record = readStore().providers[provider];
+  if (!record) return {
+    linked: false
+  };
+  return {
+    linked: true,
+    username: record.username,
+    scopes: record.scopes,
+    linkedAt: record.linkedAt
+  };
+}
+__name(getStatus, "getStatus");
+async function clearAuth(provider) {
+  const store = readStore();
+  delete store.providers[provider];
+  writeStore(store);
+}
+__name(clearAuth, "clearAuth");
+
+// src/utils/git-providers/github-provider.ts
+import { request } from "undici";
+
+// src/config/git-providers.constants.ts
+var GITHUB_CLIENT_ID = "Ov23lipe1jgBlCsoi9OO";
+var GITHUB_OAUTH_BASE_URL = "https://github.com";
+var GITHUB_API_BASE_URL = "https://api.github.com";
+var GITHUB_OAUTH_SCOPE = "repo";
+var DEVICE_FLOW_DEFAULT_INTERVAL_MS = 5e3;
+var DEVICE_FLOW_SLOW_DOWN_INCREMENT_MS = 5e3;
+var PUSH_TIMEOUT_MS = 2 * 60 * 1e3;
+
+// src/interfaces/git-providers.ts
+var GitPushError = class extends Error {
+  static {
+    __name(this, "GitPushError");
+  }
+  status;
+  scrubbedStderr;
+  constructor(message, status, scrubbedStderr) {
+    super(message), this.status = status, this.scrubbedStderr = scrubbedStderr;
+    this.name = "GitPushError";
+  }
+};
+
+// src/utils/git-providers/github-provider.ts
+init_cli();
+
+// src/utils/scrub-token.ts
+function scrubToken(s, token) {
+  if (!token) return s;
+  return s.split(token).join("<redacted>");
+}
+__name(scrubToken, "scrubToken");
+
+// src/utils/git-providers/github-provider.ts
+var GitHubProvider = class {
+  static {
+    __name(this, "GitHubProvider");
+  }
+  name = "github";
+  /**
+  * GitHub is authenticated via the OAuth **device flow** only.
+  *
+  * The browser/loopback authorization-code flow is intentionally NOT used:
+  * GitHub requires a `client_secret` to exchange the code (PKCE does not
+  * replace it — the secretless exchange returns `incorrect_client_credentials`),
+  * and a CLI published to npm cannot safely embed a secret. The device flow
+  * needs no secret, which is why it is the only viable flow for a public
+  * client (the same reason GitHub's own `gh` CLI defaults to it).
+  *
+  * `opts.device` is accepted for backwards compatibility but is now a no-op:
+  * the device flow is always used.
+  */
+  async login(_opts) {
+    const token = await this.deviceFlow();
+    const username = await this.fetchUsername(token);
+    await saveAuth(this.name, {
+      token,
+      username,
+      scopes: [
+        GITHUB_OAUTH_SCOPE
+      ],
+      linkedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return {
+      username
+    };
+  }
+  async logout() {
+    await clearAuth(this.name);
+  }
+  async status() {
+    return getStatus(this.name);
+  }
+  async push(opts) {
+    const parsed = parseGitHubHttpsUrl(opts.remoteUrl);
+    const authedUrl = `https://x-access-token:${opts.token}@github.com/${parsed.owner}/${parsed.repo}`;
+    let result;
+    try {
+      result = await runGit([
+        "push",
+        authedUrl,
+        opts.branch
+      ], {
+        cwd: opts.cwd,
+        timeout: PUSH_TIMEOUT_MS
+      });
+    } catch (err) {
+      const raw = err instanceof Error ? err.message : String(err);
+      const scrubbed2 = scrubToken(raw, opts.token);
+      throw new GitPushError(`git push failed: ${scrubbed2}`, 0, scrubbed2);
+    }
+    if (result.code === 0) return;
+    const scrubbed = scrubToken(result.stderr, opts.token);
+    const status = matchPushStatus(scrubbed);
+    throw new GitPushError(status === 401 ? "GitHub authentication failed (token revoked or insufficient scope)." : status === 403 ? "GitHub rejected the push (403 \u2014 possible SSO enforcement or missing scope)." : "git push failed.", status, scrubbed);
+  }
+  async fetchUsername(token) {
+    const res = await request(`${GITHUB_API_BASE_URL}/user`, {
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${token}`,
+        "user-agent": "lua-cli"
+      }
+    });
+    const body = await res.body.json();
+    if (!body.login) throw new Error("Could not read GitHub username after auth.");
+    return body.login;
+  }
+  async deviceFlow() {
+    const codeRes = await request(`${GITHUB_OAUTH_BASE_URL}/login/device/code`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: GITHUB_CLIENT_ID,
+        scope: GITHUB_OAUTH_SCOPE
+      })
+    });
+    const codeBody = await codeRes.body.json();
+    if (!codeBody.device_code || !codeBody.user_code || !codeBody.verification_uri) {
+      throw new Error(`GitHub rejected device-code request: ${codeBody.error ?? "unknown error"}`);
+    }
+    writeInfo(`Open ${codeBody.verification_uri} and enter the code: ${codeBody.user_code}`);
+    let intervalMs = codeBody.interval != null ? codeBody.interval * 1e3 : DEVICE_FLOW_DEFAULT_INTERVAL_MS;
+    const deadline = Date.now() + (codeBody.expires_in ?? 900) * 1e3;
+    while (Date.now() < deadline) {
+      await sleep(intervalMs);
+      if (Date.now() >= deadline) break;
+      const pollRes = await request(`${GITHUB_OAUTH_BASE_URL}/login/oauth/access_token`, {
+        method: "POST",
+        headers: {
+          accept: "application/json",
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({
+          client_id: GITHUB_CLIENT_ID,
+          device_code: codeBody.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+      });
+      const body = await pollRes.body.json();
+      if (body.access_token) return body.access_token;
+      if (body.error === "authorization_pending") continue;
+      if (body.error === "slow_down") {
+        intervalMs += DEVICE_FLOW_SLOW_DOWN_INCREMENT_MS;
+        continue;
+      }
+      if (body.error === "expired_token") {
+        throw new Error("Device code expired. Re-run `lua git auth github --device`.");
+      }
+      throw new Error(`GitHub device-flow error: ${body.error ?? "unknown"}`);
+    }
+    throw new Error("Device flow timed out. Re-run `lua git auth github --device`.");
+  }
+};
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+__name(sleep, "sleep");
+function isGitHubUrl(url) {
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" && u.hostname === "github.com";
+  } catch {
+    return false;
+  }
+}
+__name(isGitHubUrl, "isGitHubUrl");
+function parseGitHubHttpsUrl(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    throw new Error(`Not a parseable URL: ${url}. v1 only supports https GitHub remotes.`);
+  }
+  if (u.protocol !== "https:" || u.hostname !== "github.com") {
+    throw new Error(`Not a GitHub HTTPS remote: ${url}. v1 only supports https://github.com/...`);
+  }
+  const parts = u.pathname.replace(/^\/+/, "").replace(/\.git$/, "").split("/");
+  if (parts.length < 2 || !parts[0] || !parts[1]) {
+    throw new Error(`Unexpected GitHub URL shape: ${url}`);
+  }
+  return {
+    owner: parts[0],
+    repo: parts[1]
+  };
+}
+__name(parseGitHubHttpsUrl, "parseGitHubHttpsUrl");
+function matchPushStatus(stderr) {
+  const s = stderr.toLowerCase();
+  if (s.includes("401") || s.includes("authentication failed")) return 401;
+  if (s.includes("403") || s.includes("permission to") || s.includes("forbidden")) return 403;
+  return 0;
+}
+__name(matchPushStatus, "matchPushStatus");
+
+// src/utils/auto-push-hook.ts
+init_analytics();
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  writeInfo(`\u26A0\uFE0F  ${message}`);
+}
+__name(warnOnce, "warnOnce");
+async function tryGitAutoPush(ctx) {
+  try {
+    if (ctx.config?.git?.autoPush !== true) return;
+    const token = await getToken2("github");
+    if (!token) {
+      warnOnce("missing-github-token", "git.autoPush is enabled but no GitHub auth \u2014 run `lua git auth github`.");
+      return;
+    }
+    const remote = await getRemoteOriginUrl(ctx.cwd);
+    if (!remote) {
+      warnOnce("missing-github-remote", "git.autoPush is enabled but no `remote.origin.url` is set. Skipping push.");
+      return;
+    }
+    if (!isGitHubUrl(remote)) {
+      warnOnce("non-github-remote", `git.autoPush is enabled but origin (${remote}) is not a supported GitHub HTTPS URL. v1 only supports https://github.com/<owner>/<repo> \u2014 skipping push.`);
+      return;
+    }
+    const branch = await readCurrentBranch(ctx.cwd);
+    if (!branch) {
+      warnOnce("detached-head", "Cannot auto-push from a detached HEAD. Skipping push.");
+      return;
+    }
+    const provider = new GitHubProvider();
+    try {
+      await provider.push({
+        token,
+        remoteUrl: remote,
+        branch,
+        cwd: ctx.cwd ?? process.cwd()
+      });
+      writeInfo(`\u2713 Pushed ${ctx.commitSha?.slice(0, 7) ?? ""} to ${remote} (${branch})`);
+      trackEvent("cli_auto_push_succeeded", {
+        action: ctx.action
+      });
+    } catch (err) {
+      const status = err instanceof GitPushError ? err.status : 0;
+      const message = err instanceof GitPushError ? err.scrubbedStderr || err.message : err instanceof Error ? err.message : String(err);
+      if (status === 401) {
+        warnOnce("push-revoked", "GitHub auth was revoked \u2014 run `lua git auth github` to re-link. Commit kept locally.");
+      } else if (status === 403) {
+        warnOnce("push-rejected-403", `GitHub rejected the push: ${message}. Commit kept locally.`);
+      } else {
+        warnOnce("push-failed-other", `Auto-push failed: ${message}. Commit kept locally; run \`git push\` to retry.`);
+      }
+      trackEvent("cli_auto_push_failed", {
+        action: ctx.action,
+        status
+      });
+    }
+  } catch {
+    warnOnce("hook-errored", "Auto-push hook errored unexpectedly. Commit kept locally; run `git push` to retry.");
+    trackEvent("cli_auto_push_failed", {
+      action: ctx.action,
+      status: 0
+    });
+  }
+}
+__name(tryGitAutoPush, "tryGitAutoPush");
+async function readCurrentBranch(cwd) {
+  const res = await runGit([
+    "rev-parse",
+    "--abbrev-ref",
+    "HEAD"
+  ], {
+    cwd
+  });
+  if (res.code !== 0) return null;
+  const trimmed = res.stdout.trim();
+  if (!trimmed || trimmed === "HEAD") return null;
+  return trimmed;
+}
+__name(readCurrentBranch, "readCurrentBranch");
+
+// src/utils/try-git-commit.ts
 async function tryGitCommit(opts) {
   const config = readYamlConfig();
   if (!config?.git?.enabled) {
@@ -22221,6 +22687,12 @@ async function tryGitCommit(opts) {
     has_sha: Boolean(sha),
     has_tag: tagged === true
   });
+  await tryGitAutoPush({
+    config,
+    cwd: opts.cwd,
+    commitSha: sha,
+    action: opts.action
+  });
   return {
     committed: true,
     sha,
@@ -24154,11 +24626,11 @@ init_cli();
 
 // src/utils/sandbox-storage.ts
 init_constants();
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7 } from "fs";
-import { dirname as dirname6 } from "path";
-function readStore() {
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "fs";
+import { dirname as dirname7 } from "path";
+function readStore2() {
   try {
-    const raw = readFileSync10(SANDBOX_STORAGE_FILE, "utf8");
+    const raw = readFileSync11(SANDBOX_STORAGE_FILE, "utf8");
     const parsed = JSON.parse(raw);
     return {
       skills: parsed.skills ?? {},
@@ -24175,28 +24647,28 @@ function readStore() {
     };
   }
 }
-__name(readStore, "readStore");
-function writeStore(store) {
+__name(readStore2, "readStore");
+function writeStore2(store) {
   try {
-    mkdirSync7(dirname6(SANDBOX_STORAGE_FILE), {
+    mkdirSync8(dirname7(SANDBOX_STORAGE_FILE), {
       recursive: true
     });
-    writeFileSync7(SANDBOX_STORAGE_FILE, JSON.stringify(store, null, 2), "utf8");
+    writeFileSync8(SANDBOX_STORAGE_FILE, JSON.stringify(store, null, 2), "utf8");
   } catch {
   }
 }
-__name(writeStore, "writeStore");
+__name(writeStore2, "writeStore");
 async function getSandboxSkillId(skillName) {
-  const store = readStore();
+  const store = readStore2();
   const key = skillName ?? "__default__";
   return store.skills[key] ?? null;
 }
 __name(getSandboxSkillId, "getSandboxSkillId");
 async function setSandboxSkillId(sandboxId, skillName) {
-  const store = readStore();
+  const store = readStore2();
   const key = skillName ?? "__default__";
   store.skills[key] = sandboxId;
-  writeStore(store);
+  writeStore2(store);
 }
 __name(setSandboxSkillId, "setSandboxSkillId");
 async function getAllSandboxSkillIds(yamlConfig) {
@@ -24222,14 +24694,14 @@ async function getAllSandboxSkillIds(yamlConfig) {
 }
 __name(getAllSandboxSkillIds, "getAllSandboxSkillIds");
 async function getSandboxPreProcessorId(preprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   return store.preprocessors[preprocessorName] ?? null;
 }
 __name(getSandboxPreProcessorId, "getSandboxPreProcessorId");
 async function setSandboxPreProcessorId(sandboxId, preprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   store.preprocessors[preprocessorName] = sandboxId;
-  writeStore(store);
+  writeStore2(store);
 }
 __name(setSandboxPreProcessorId, "setSandboxPreProcessorId");
 async function getAllSandboxPreProcessorIds(config) {
@@ -24254,14 +24726,14 @@ async function getAllSandboxPreProcessorIds(config) {
 }
 __name(getAllSandboxPreProcessorIds, "getAllSandboxPreProcessorIds");
 async function getSandboxPostProcessorId(postprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   return store.postprocessors[postprocessorName] ?? null;
 }
 __name(getSandboxPostProcessorId, "getSandboxPostProcessorId");
 async function setSandboxPostProcessorId(sandboxId, postprocessorName) {
-  const store = readStore();
+  const store = readStore2();
   store.postprocessors[postprocessorName] = sandboxId;
-  writeStore(store);
+  writeStore2(store);
 }
 __name(setSandboxPostProcessorId, "setSandboxPostProcessorId");
 async function getAllSandboxPostProcessorIds(config) {
@@ -30358,7 +30830,7 @@ init_auth();
 init_auth_api_service();
 init_files();
 init_artifact_loader();
-import { existsSync as existsSync7, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync12 } from "fs";
 import { join as join6 } from "path";
 import { performance } from "perf_hooks";
 import * as os from "os";
@@ -30709,7 +31181,7 @@ function gatherTelemetry() {
   } else {
     try {
       if (existsSync7(TELEMETRY_FILE)) {
-        const raw = readFileSync11(TELEMETRY_FILE, "utf8");
+        const raw = readFileSync12(TELEMETRY_FILE, "utf8");
         const cfg = JSON.parse(raw);
         if (typeof cfg.enabled === "boolean") enabled = cfg.enabled;
       }
@@ -39890,7 +40362,7 @@ __name(telemetryCommand, "telemetryCommand");
 init_cli();
 init_command_utils();
 init_analytics();
-import { writeFileSync as writeFileSync8, existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
+import { writeFileSync as writeFileSync9, existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
 import { resolve as resolve4, join as join7 } from "path";
 init_artifact_loader();
 init_types();
@@ -40051,7 +40523,7 @@ async function governanceCommand(action) {
       }
     }
     const content = generateFile(setup);
-    writeFileSync8(filePath, content, "utf-8");
+    writeFileSync9(filePath, content, "utf-8");
     const relativePath = filePath.replace(process.cwd() + "/", "");
     writeSuccess(`Created ${relativePath}`);
     console.log("");
@@ -41763,7 +42235,7 @@ function failConnect(status, banner, errorMessage) {
   throw new Error(errorMessage);
 }
 __name(failConnect, "failConnect");
-async function gitConnectCommand() {
+async function gitConnectCommand(opts = {}) {
   return withErrorHandling(async () => {
     const config = readYamlConfig();
     if (!config) {
@@ -41802,15 +42274,35 @@ async function gitConnectCommand() {
         user_configured: false
       }, '\u2717 Git user.name is not configured.\n   Fix: git config --global user.name "Your Name"', "git user.name is not configured");
     }
+    const passedStatus = {
+      git_available: true,
+      in_repo: true,
+      user_configured: true
+    };
+    if (opts.autoPush) {
+      const token = await getToken2("github");
+      if (!token) {
+        failConnect(passedStatus, "\u2717 --auto-push needs a linked GitHub account.\n   Fix: run `lua git auth github` to link your GitHub account, then re-run `lua git connect --auto-push`.", "no GitHub account linked");
+      }
+      const remote = await getRemoteOriginUrl();
+      if (!remote) {
+        failConnect(passedStatus, "\u2717 --auto-push needs a GitHub remote, but `remote.origin.url` is not set.\n   Fix: git remote add origin https://github.com/<owner>/<repo>.git", "no origin remote configured");
+      }
+      if (!isGitHubUrl(remote)) {
+        failConnect(passedStatus, `\u2717 --auto-push only supports GitHub HTTPS remotes, but origin is ${remote}.
+   Fix: git remote set-url origin https://github.com/<owner>/<repo>.git`, "origin is not a GitHub HTTPS remote");
+      }
+    }
     config.git = {
+      ...config.git,
       enabled: true
     };
+    if (opts.autoPush) config.git.autoPush = true;
     writeYamlConfig(config);
-    writeSuccess("\u2713 Git integration enabled. Future `lua push`, `lua version *`, and `lua pull` runs will auto-commit.");
+    writeSuccess(opts.autoPush ? "\u2713 Git integration enabled with auto-push. Future `lua push`, `lua version *`, and `lua pull` runs will auto-commit and push to GitHub." : "\u2713 Git integration enabled. Future `lua push`, `lua version *`, and `lua pull` runs will auto-commit.");
     trackEvent("cli_git_connect_completed", {
-      git_available: true,
-      in_repo: true,
-      user_configured: true,
+      ...passedStatus,
+      auto_push: Boolean(opts.autoPush),
       succeeded: true
     });
   }, "git connect");
@@ -41903,6 +42395,77 @@ async function gitStatusCommand() {
 }
 __name(gitStatusCommand, "gitStatusCommand");
 
+// src/commands/git-auth.ts
+init_cli();
+init_analytics();
+function gitAuthGithubCommand(opts) {
+  return withErrorHandling(async () => {
+    const provider = new GitHubProvider();
+    const existing = await provider.status();
+    if (existing.linked && !opts.force) {
+      const ok = await confirmAction(`Already linked to GitHub as @${existing.username}. Re-link?`);
+      if (!ok) {
+        writeInfo("Aborted. Existing link preserved.");
+        return;
+      }
+    }
+    const result = await provider.login({
+      device: opts.device,
+      force: opts.force
+    });
+    writeSuccess(`Logged in to GitHub as @${result.username}.`);
+    trackEvent("cli_git_auth_succeeded", {
+      provider: "github",
+      flow: "device"
+    });
+  }, "git-auth-github");
+}
+__name(gitAuthGithubCommand, "gitAuthGithubCommand");
+function gitAuthStatusCommand() {
+  return withErrorHandling(async () => {
+    const provider = new GitHubProvider();
+    const s = await provider.status();
+    if (!s.linked) {
+      console.log("Not linked. Run `lua git auth github` to link.");
+    } else {
+      console.log(`Linked: github \u2014 @${s.username} (scopes: ${s.scopes.join(", ")}) \u2014 linked ${formatLinkedAt(s.linkedAt)}`);
+    }
+    trackEvent("cli_git_auth_status_completed", {
+      linked: s.linked
+    });
+  }, "git-auth-status");
+}
+__name(gitAuthStatusCommand, "gitAuthStatusCommand");
+function gitAuthDisconnectCommand(provider) {
+  return withErrorHandling(async () => {
+    const name = (provider ?? "github").toLowerCase();
+    if (name !== "github") {
+      writeError(`Unknown provider: ${name}. v1 only supports github.`);
+      return;
+    }
+    const p = new GitHubProvider();
+    const s = await p.status();
+    if (!s.linked) {
+      console.log(`Not linked to ${name}. Nothing to do.`);
+      return;
+    }
+    await p.logout();
+    writeSuccess(`Disconnected from ${name}.`);
+    trackEvent("cli_git_auth_disconnect_completed", {
+      provider: name
+    });
+  }, "git-auth-disconnect");
+}
+__name(gitAuthDisconnectCommand, "gitAuthDisconnectCommand");
+function formatLinkedAt(iso) {
+  try {
+    return new Date(iso).toISOString().replace("T", " ").replace(/\..*$/, " UTC");
+  } catch {
+    return iso;
+  }
+}
+__name(formatLinkedAt, "formatLinkedAt");
+
 // src/commands/pull.ts
 init_cli();
 init_command_utils();
@@ -42597,7 +43160,12 @@ Examples:
   $ lua voice test --runner vitest       Force vitest
 `).action(voiceTestCommand);
   voice.command("list").description("List LuaVoice primitives in the compiled manifest").option("--json", "Output as JSON").action(voiceListCommand);
-  const versionGroup = program2.command("version").description("\u{1F3F7}\uFE0F  Manage agent versions (atomic snapshots of agent state)");
+  const versionGroup = program2.command("version").description("\u{1F3F7}\uFE0F  Manage agent versions \u2014 atomic snapshots (requires agentVersioningEnabled for your org)").addHelpText("after", `
+Note:
+  All \`lua version\` subcommands require the \`agentVersioningEnabled\`
+  feature flag for your org. If a subcommand errors with "Agent versioning
+  is not enabled," contact your admin to enable it.
+`);
   versionGroup.command("create").description("Snapshot current staged state into a new version").option("-m, --message <message>", "Optional description for this version").option("--auto-push", "Push first if local changes are not yet staged").option("--commit-hash <hash>", "Optional git commit hash to associate with this version").addHelpText("after", `
 Examples:
   $ lua version create                         Snapshot current state
@@ -42632,9 +43200,15 @@ Examples:
   $ lua version delete v3 --force Skip confirmation
 `).action((version, opts) => versionDeleteCommand(version, opts));
   const gitGroup = program2.command("git").description("Manage opt-in git auto-commits for this project");
-  gitGroup.command("connect").description("Enable git auto-commits (runs sanity checks, writes git.enabled: true)").action(() => gitConnectCommand());
+  gitGroup.command("connect").description("Enable git auto-commits (runs sanity checks, writes git.enabled: true)").option("--auto-push", "Also enable post-commit auto-push (requires `lua git auth github` + a GitHub HTTPS origin remote)").action((opts) => gitConnectCommand({
+    autoPush: opts.autoPush
+  }));
   gitGroup.command("disconnect").description("Disable git auto-commits (existing commits/tags untouched)").action(() => gitDisconnectCommand());
   gitGroup.command("status").description("Show git integration config + last lua-issued commit/tag").action(() => gitStatusCommand());
+  const gitAuthGroup = gitGroup.command("auth").description("Manage git remote provider authentication");
+  gitAuthGroup.command("github").description("Link a GitHub account (OAuth device flow)").option("--device", "(deprecated; device flow is always used \u2014 flag kept for compatibility)").option("--force", "Overwrite an existing link without prompting").action((opts) => gitAuthGithubCommand(opts));
+  gitAuthGroup.command("status").description("Show the current git auth status").action(() => gitAuthStatusCommand());
+  gitAuthGroup.command("disconnect [provider]").description("Disconnect a git provider (default: github)").action((provider) => gitAuthDisconnectCommand(provider));
   program2.command("pull").description("\u{1F4E5}  Pull the agent's source code locally").option("--version <version>", "Pull source linked to a specific agent version (requires versioning)").option("--force", "Skip confirmation prompt").addHelpText("after", `
 Examples:
   $ lua pull                  Restore the latest source backup