npm - lua-cli - Versions diffs - 3.17.1 → 3.17.3 - Mend

lua-cli 3.17.1 → 3.17.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/index.js CHANGED Viewed

@@ -22224,6 +22224,23 @@ async function gitUserConfigured(cwd) {
   };
 }
 __name(gitUserConfigured, "gitUserConfigured");
+async function getRemoteOriginUrl(cwd) {
+  try {
+    const { stdout, code } = await runGit([
+      "config",
+      "--get",
+      "remote.origin.url"
+    ], {
+      cwd
+    });
+    if (code !== 0) return null;
+    const trimmed = stdout.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+__name(getRemoteOriginUrl, "getRemoteOriginUrl");
 async function getCommitSha(cwd) {
   try {
     const { stdout, code } = await runGit([
@@ -22305,39 +22322,17 @@ async function clearAuth(provider) {
 __name(clearAuth, "clearAuth");
 // src/utils/git-providers/github-provider.ts
-import { createServer } from "http";
-import { randomBytes as randomBytes2 } from "crypto";
 import { request } from "undici";
-import open from "open";
 // src/config/git-providers.constants.ts
 var GITHUB_CLIENT_ID = "Ov23lipe1jgBlCsoi9OO";
 var GITHUB_OAUTH_BASE_URL = "https://github.com";
 var GITHUB_API_BASE_URL = "https://api.github.com";
 var GITHUB_OAUTH_SCOPE = "repo";
-var LOOPBACK_PORT_MIN = 49152;
-var LOOPBACK_PORT_MAX = 65535;
-var LOOPBACK_PORT_ATTEMPTS = 3;
-var LOOPBACK_TIMEOUT_MS = 5 * 60 * 1e3;
 var DEVICE_FLOW_DEFAULT_INTERVAL_MS = 5e3;
 var DEVICE_FLOW_SLOW_DOWN_INCREMENT_MS = 5e3;
 var PUSH_TIMEOUT_MS = 2 * 60 * 1e3;
-// src/utils/pkce.ts
-import { createHash as createHash2, randomBytes } from "crypto";
-function generateCodeVerifier() {
-  return base64url(randomBytes(64));
-}
-__name(generateCodeVerifier, "generateCodeVerifier");
-function computeCodeChallenge(verifier) {
-  return base64url(createHash2("sha256").update(verifier).digest());
-}
-__name(computeCodeChallenge, "computeCodeChallenge");
-function base64url(buf) {
-  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-__name(base64url, "base64url");
 // src/interfaces/git-providers.ts
 var GitPushError = class extends Error {
   static {
@@ -22362,18 +22357,26 @@ function scrubToken(s, token) {
 __name(scrubToken, "scrubToken");
 // src/utils/git-providers/github-provider.ts
-var SUCCESS_HTML = `<!doctype html><meta charset="utf-8"><title>Lua CLI</title>
-<body style="font-family: system-ui; padding: 4rem; text-align: center;">
-  <h1>&#x2713; Connected</h1>
-  <p>You can close this tab and return to the terminal.</p>
-</body>`;
 var GitHubProvider = class {
   static {
     __name(this, "GitHubProvider");
   }
   name = "github";
-  async login(opts) {
-    const token = opts.device ? await this.deviceFlow() : await this.loopbackFlow();
+  /**
+  * GitHub is authenticated via the OAuth **device flow** only.
+  *
+  * The browser/loopback authorization-code flow is intentionally NOT used:
+  * GitHub requires a `client_secret` to exchange the code (PKCE does not
+  * replace it — the secretless exchange returns `incorrect_client_credentials`),
+  * and a CLI published to npm cannot safely embed a secret. The device flow
+  * needs no secret, which is why it is the only viable flow for a public
+  * client (the same reason GitHub's own `gh` CLI defaults to it).
+  *
+  * `opts.device` is accepted for backwards compatibility but is now a no-op:
+  * the device flow is always used.
+  */
+  async login(_opts) {
+    const token = await this.deviceFlow();
     const username = await this.fetchUsername(token);
     await saveAuth(this.name, {
       token,
@@ -22396,12 +22399,18 @@ var GitHubProvider = class {
   async push(opts) {
     const parsed = parseGitHubHttpsUrl(opts.remoteUrl);
     const authedUrl = `https://x-access-token:${opts.token}@github.com/${parsed.owner}/${parsed.repo}`;
+    const refspecs = opts.tag ? [
+      opts.branch,
+      opts.tag
+    ] : [
+      opts.branch
+    ];
     let result;
     try {
       result = await runGit([
         "push",
         authedUrl,
-        opts.branch
+        ...refspecs
       ], {
         cwd: opts.cwd,
         timeout: PUSH_TIMEOUT_MS
@@ -22416,126 +22425,6 @@ var GitHubProvider = class {
     const status = matchPushStatus(scrubbed);
     throw new GitPushError(status === 401 ? "GitHub authentication failed (token revoked or insufficient scope)." : status === 403 ? "GitHub rejected the push (403 \u2014 possible SSO enforcement or missing scope)." : "git push failed.", status, scrubbed);
   }
-  async loopbackFlow() {
-    const verifier = generateCodeVerifier();
-    const challenge = computeCodeChallenge(verifier);
-    const state = randomBytes2(16).toString("hex");
-    const { code, redirectUri } = await this.captureLoopbackCode({
-      state,
-      challenge
-    });
-    return this.exchangeCodeForToken({
-      code,
-      verifier,
-      redirectUri
-    });
-  }
-  async captureLoopbackCode(args2) {
-    let lastErr;
-    for (let i = 0; i < LOOPBACK_PORT_ATTEMPTS; i++) {
-      const port = randomPort();
-      try {
-        return await this.runLoopbackServer(port, args2.state, args2.challenge);
-      } catch (err) {
-        lastErr = err;
-        if (!isPortInUse(err)) throw err;
-      }
-    }
-    throw new Error(`Could not bind a loopback port after ${LOOPBACK_PORT_ATTEMPTS} attempts. Try \`lua git auth github --device\` instead.${lastErr ? ` (${lastErr instanceof Error ? lastErr.message : String(lastErr)})` : ""}`);
-  }
-  runLoopbackServer(port, state, challenge) {
-    return new Promise((resolveOuter, rejectOuter) => {
-      let settled = false;
-      const settle = /* @__PURE__ */ __name((fn) => {
-        if (settled) return;
-        settled = true;
-        fn();
-      }, "settle");
-      const server = createServer((req, res) => {
-        const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
-        if (url.pathname !== "/callback") {
-          res.writeHead(404).end();
-          return;
-        }
-        const code = url.searchParams.get("code");
-        const gotState = url.searchParams.get("state");
-        if (!code || gotState !== state) {
-          res.writeHead(400, {
-            "content-type": "text/plain"
-          }).end("State mismatch.");
-          server.close();
-          settle(() => {
-            clearTimeout(timeout);
-            rejectOuter(new Error("OAuth callback state mismatch (possible CSRF). Re-run the command."));
-          });
-          return;
-        }
-        res.writeHead(200, {
-          "content-type": "text/html"
-        }).end(SUCCESS_HTML);
-        server.close();
-        settle(() => {
-          clearTimeout(timeout);
-          resolveOuter({
-            code,
-            redirectUri
-          });
-        });
-      });
-      const timeout = setTimeout(() => {
-        server.close();
-        settle(() => rejectOuter(new Error("OAuth flow timed out (5 min). Re-run `lua git auth github`.")));
-      }, LOOPBACK_TIMEOUT_MS);
-      timeout.unref();
-      server.on("error", (err) => {
-        server.close();
-        settle(() => {
-          clearTimeout(timeout);
-          rejectOuter(err);
-        });
-      });
-      let redirectUri = "";
-      server.listen(port, "127.0.0.1", () => {
-        const actualPort = server.address().port;
-        redirectUri = `http://127.0.0.1:${actualPort}/callback`;
-        const authUrl = new URL(`${GITHUB_OAUTH_BASE_URL}/login/oauth/authorize`);
-        authUrl.searchParams.set("client_id", GITHUB_CLIENT_ID);
-        authUrl.searchParams.set("redirect_uri", redirectUri);
-        authUrl.searchParams.set("scope", GITHUB_OAUTH_SCOPE);
-        authUrl.searchParams.set("code_challenge", challenge);
-        authUrl.searchParams.set("code_challenge_method", "S256");
-        authUrl.searchParams.set("state", state);
-        open(authUrl.toString()).catch(() => {
-          server.close();
-          settle(() => {
-            clearTimeout(timeout);
-            rejectOuter(new Error("Couldn't open a browser \u2014 try `lua git auth github --device` for the device flow."));
-          });
-        });
-      });
-    });
-  }
-  async exchangeCodeForToken(args2) {
-    const res = await request(`${GITHUB_OAUTH_BASE_URL}/login/oauth/access_token`, {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({
-        client_id: GITHUB_CLIENT_ID,
-        code: args2.code,
-        code_verifier: args2.verifier,
-        redirect_uri: args2.redirectUri,
-        grant_type: "authorization_code"
-      })
-    });
-    const body = await res.body.json();
-    if (!body.access_token) {
-      throw new Error(`GitHub rejected the token exchange: ${body.error ?? "unknown error"}`);
-    }
-    return body.access_token;
-  }
   async fetchUsername(token) {
     const res = await request(`${GITHUB_API_BASE_URL}/user`, {
       method: "GET",
@@ -22598,15 +22487,6 @@ var GitHubProvider = class {
     throw new Error("Device flow timed out. Re-run `lua git auth github --device`.");
   }
 };
-function randomPort() {
-  const span = LOOPBACK_PORT_MAX - LOOPBACK_PORT_MIN + 1;
-  return LOOPBACK_PORT_MIN + Math.floor(Math.random() * span);
-}
-__name(randomPort, "randomPort");
-function isPortInUse(err) {
-  return !!err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE";
-}
-__name(isPortInUse, "isPortInUse");
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
@@ -22665,7 +22545,7 @@ async function tryGitAutoPush(ctx) {
       warnOnce("missing-github-token", "git.autoPush is enabled but no GitHub auth \u2014 run `lua git auth github`.");
       return;
     }
-    const remote = await readRemoteOriginUrl(ctx.cwd);
+    const remote = await getRemoteOriginUrl(ctx.cwd);
     if (!remote) {
       warnOnce("missing-github-remote", "git.autoPush is enabled but no `remote.origin.url` is set. Skipping push.");
       return;
@@ -22685,9 +22565,11 @@ async function tryGitAutoPush(ctx) {
         token,
         remoteUrl: remote,
         branch,
+        tag: ctx.tag,
         cwd: ctx.cwd ?? process.cwd()
       });
-      writeInfo(`\u2713 Pushed ${ctx.commitSha?.slice(0, 7) ?? ""} to ${remote} (${branch})`);
+      const tagSuffix = ctx.tag ? ` +${ctx.tag}` : "";
+      writeInfo(`\u2713 Pushed ${ctx.commitSha?.slice(0, 7) ?? ""}${tagSuffix} to ${remote} (${branch})`);
       trackEvent("cli_auto_push_succeeded", {
         action: ctx.action
       });
@@ -22715,19 +22597,6 @@ async function tryGitAutoPush(ctx) {
   }
 }
 __name(tryGitAutoPush, "tryGitAutoPush");
-async function readRemoteOriginUrl(cwd) {
-  const res = await runGit([
-    "config",
-    "--get",
-    "remote.origin.url"
-  ], {
-    cwd
-  });
-  if (res.code !== 0) return null;
-  const trimmed = res.stdout.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-__name(readRemoteOriginUrl, "readRemoteOriginUrl");
 async function readCurrentBranch(cwd) {
   const res = await runGit([
     "rev-parse",
@@ -22805,6 +22674,8 @@ async function tryGitCommit(opts) {
   if (opts.tag) {
     try {
       const tagResult = await runGit([
+        "-c",
+        "tag.gpgsign=false",
         "tag",
         opts.tag
       ], runOpts);
@@ -22830,6 +22701,9 @@ async function tryGitCommit(opts) {
     config,
     cwd: opts.cwd,
     commitSha: sha,
+    // Only forward a tag that actually landed — auto-push pushes it as an
+    // explicit refspec, so pushing a non-existent tag would just error.
+    tag: tagged ? opts.tag : void 0,
     action: opts.action
   });
   return {
@@ -28204,7 +28078,7 @@ __name(viewResourceInteractive, "viewResourceInteractive");
 init_cli();
 init_command_utils();
 init_analytics();
-import open2 from "open";
+import open from "open";
 async function adminCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Admin Dashboard...");
@@ -28212,7 +28086,7 @@ async function adminCommand() {
       showProgress: false
     });
     const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
-    await open2(adminUrl);
+    await open(adminUrl);
     writeSuccess("Lua Admin Dashboard opened in your browser");
     console.log(`
   Dashboard URL: https://admin.heylua.ai`);
@@ -28228,7 +28102,7 @@ __name(adminCommand, "adminCommand");
 init_cli();
 init_command_utils();
 init_analytics();
-import open3 from "open";
+import open2 from "open";
 async function evalsCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Evaluations Dashboard...");
@@ -28236,7 +28110,7 @@ async function evalsCommand() {
       showProgress: false
     });
     const evalsUrl = `https://evals.heylua.ai?apiKey=${apiKey}&agentID=${agentId}`;
-    await open3(evalsUrl);
+    await open2(evalsUrl);
     writeSuccess("Lua Evaluations Dashboard opened in your browser");
     console.log(`
   Dashboard URL: https://evals.heylua.ai`);
@@ -28250,12 +28124,12 @@ __name(evalsCommand, "evalsCommand");
 // src/commands/docs.ts
 init_cli();
 init_analytics();
-import open4 from "open";
+import open3 from "open";
 async function docsCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Documentation...");
     const docsUrl = "https://docs.heylua.ai";
-    await open4(docsUrl);
+    await open3(docsUrl);
     writeSuccess("Lua Documentation opened in your browser");
     console.log(`
   Documentation: ${docsUrl}
@@ -28269,7 +28143,7 @@ __name(docsCommand, "docsCommand");
 init_cli();
 init_command_utils();
 import inquirer12 from "inquirer";
-import open5 from "open";
+import open4 from "open";
 // src/api/channels.api.service.ts
 init_http_client();
@@ -28838,7 +28712,7 @@ async function openAdminDashboard(apiKey, config) {
     throw new Error("No orgId found in lua.skill.yaml. Please ensure your configuration is valid.");
   }
   const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
-  await open5(adminUrl);
+  await open4(adminUrl);
   writeSuccess("\u2705 Lua Admin Dashboard opened in your browser");
   console.log(`
   Dashboard URL: https://admin.heylua.ai`);
@@ -30289,6 +30163,40 @@ init_cli();
 init_files();
 init_constants();
 init_command_utils();
+// src/utils/primitive-version-display.ts
+var PRIMITIVE_VERSION_HISTORY_NOTE = "\u2139\uFE0F  Primitive versions are managed by agent versioning. Run `lua version list` to view agent versions.";
+async function shouldHidePrimitiveVersions(apiKey, agentId) {
+  try {
+    const { enabled } = await getVersioningModeCached(apiKey, agentId);
+    return enabled;
+  } catch {
+    return false;
+  }
+}
+__name(shouldHidePrimitiveVersions, "shouldHidePrimitiveVersions");
+var DIVIDER = "=".repeat(60);
+function primitiveVersionHistoryView(label) {
+  return [
+    "\n" + DIVIDER,
+    `\u{1F4DC} Versions for ${label}`,
+    DIVIDER + "\n",
+    PRIMITIVE_VERSION_HISTORY_NOTE,
+    "\n" + DIVIDER
+  ];
+}
+__name(primitiveVersionHistoryView, "primitiveVersionHistoryView");
+function deployedVersionLine(version, hide) {
+  if (version == null) return hide ? "   Not deployed" : "   Deployed Version: Not deployed";
+  return hide ? "   Deployed \u2B50" : `   Deployed Version: ${version} \u2B50`;
+}
+__name(deployedVersionLine, "deployedVersionLine");
+function localVersionLine(version, hide) {
+  return hide ? null : `   Version: ${version}`;
+}
+__name(localVersionLine, "localVersionLine");
+// src/commands/skills.ts
 init_skills_api_service();
 init_skill_handler();
 init_analytics();
@@ -30299,6 +30207,7 @@ async function skillsCommand(actionOrEnv, actionArg, cmdObj) {
       skillVersion: cmdObj?.skillVersion || null
     };
     const { config, agentId, apiKey } = await initializeCommand();
+    const hideVersions = await shouldHidePrimitiveVersions(apiKey, agentId);
     if (actionOrEnv) {
       const normalized = validateOrSuggest("skills.actionOrEnv", actionOrEnv);
       const envSet = /* @__PURE__ */ new Set([
@@ -30310,7 +30219,8 @@ async function skillsCommand(actionOrEnv, actionArg, cmdObj) {
         const context3 = {
           environment: selectedEnvironment,
           agentId,
-          apiKey
+          apiKey,
+          hideVersions
         };
         let resolvedAction = actionArg;
         if (resolvedAction) {
@@ -30323,7 +30233,8 @@ async function skillsCommand(actionOrEnv, actionArg, cmdObj) {
               console.log("\u2139\uFE0F  No skills found in configuration.");
             } else {
               for (const skill of skills) {
-                console.log(`\u{1F4E6} ${skill.name}  v${skill.version}  (${skill.skillId})`);
+                const ver = context3.hideVersions ? "" : `  v${skill.version}`;
+                console.log(`\u{1F4E6} ${skill.name}${ver}  (${skill.skillId})`);
               }
             }
             return;
@@ -30342,7 +30253,8 @@ async function skillsCommand(actionOrEnv, actionArg, cmdObj) {
       const context2 = {
         environment: "production",
         agentId,
-        apiKey
+        apiKey,
+        hideVersions
       };
       await executeNonInteractive4(context2, config, normalized, options);
       trackEvent("cli_skills_action", {
@@ -30374,7 +30286,8 @@ async function skillsCommand(actionOrEnv, actionArg, cmdObj) {
     const context = {
       environment: envAnswer.environment,
       agentId,
-      apiKey
+      apiKey,
+      hideVersions
     };
     if (context.environment === "sandbox") {
       await manageSandboxSkillsInteractive(context, config);
@@ -30403,13 +30316,15 @@ async function displaySkillsCore2(context, skills) {
         console.log(`\u{1F4E6} ${skill.name}`);
         console.log(`   Skill ID: ${skill.skillId}`);
         if (activeVersion) {
-          console.log(`   Deployed Version: ${activeVersion.version} \u2B50`);
+          console.log(deployedVersionLine(activeVersion.version, context.hideVersions));
           const dateStr = activeVersion.createdDate ? new Date(activeVersion.createdDate).toLocaleString() : "Unknown";
           console.log(`   Deployed: ${dateStr}`);
         } else {
-          console.log(`   Deployed Version: Not deployed`);
+          console.log(deployedVersionLine(null, context.hideVersions));
+        }
+        if (!context.hideVersions) {
+          console.log(`   Total Versions: ${versions.length}`);
         }
-        console.log(`   Total Versions: ${versions.length}`);
         console.log();
       } else {
         displaySkillError(skill, "Unable to fetch version info");
@@ -30442,7 +30357,11 @@ async function fetchVersionsCore2(context, skill) {
   };
 }
 __name(fetchVersionsCore2, "fetchVersionsCore");
-function displayVersionsCore2(skill, versions, activeVersionId) {
+function displayVersionsCore2(skill, versions, activeVersionId, hideVersions) {
+  if (hideVersions) {
+    primitiveVersionHistoryView(skill.name).forEach((line) => console.log(line));
+    return;
+  }
   console.log("\n" + "=".repeat(60));
   console.log(`\u{1F4DC} Versions for ${skill.name}`);
   console.log("=".repeat(60) + "\n");
@@ -30595,12 +30514,12 @@ Usage: lua skills ${action} --skill-name <name>`);
     case "versions": {
       const data = await fetchVersionsCore2(context, selectedSkill);
       if (!data) throw new Error("Failed to fetch skill versions");
-      if (data.versions.length === 0) {
+      if (!context.hideVersions && data.versions.length === 0) {
         console.log(`\u2139\uFE0F  No versions found for ${selectedSkill.name}.`);
         console.log("\u{1F4A1} Push a version first using 'lua push skill'.");
         return;
       }
-      displayVersionsCore2(selectedSkill, data.versions, data.activeVersionId);
+      displayVersionsCore2(selectedSkill, data.versions, data.activeVersionId, context.hideVersions);
       break;
     }
     case "deploy": {
@@ -30645,7 +30564,8 @@ async function manageSandboxSkillsInteractive(context, config) {
       console.log("Local skills in lua.skill.yaml:\n");
       skills.forEach((skill, index) => {
         console.log(`${index + 1}. \u{1F4E6} ${skill.name}`);
-        console.log(`   Version: ${skill.version}`);
+        const vline = localVersionLine(skill.version, context.hideVersions);
+        if (vline) console.log(vline);
         console.log(`   Skill ID: ${skill.skillId}`);
         console.log();
       });
@@ -30815,13 +30735,13 @@ async function viewVersionsInteractive(context, config) {
     ]);
     return;
   }
-  if (data.versions.length === 0) {
+  if (!context.hideVersions && data.versions.length === 0) {
     console.log(`
 \u2139\uFE0F  No versions found for ${selectedSkill.name}.
 `);
     console.log("\u{1F4A1} Push a version first using 'lua push skill'.\n");
   } else {
-    displayVersionsCore2(selectedSkill, data.versions, data.activeVersionId);
+    displayVersionsCore2(selectedSkill, data.versions, data.activeVersionId, context.hideVersions);
     console.log();
   }
   await safePrompt([
@@ -31653,10 +31573,12 @@ async function webhooksCommand(action, cmdObj) {
       event: cmdObj?.event || null
     };
     const { config, agentId, apiKey } = await initializeCommand();
+    const hideVersions = await shouldHidePrimitiveVersions(apiKey, agentId);
     const context = {
       environment: "production",
       agentId,
-      apiKey
+      apiKey,
+      hideVersions
     };
     if (action) {
       await executeNonInteractive5(context, config, action, options);
@@ -31686,12 +31608,14 @@ async function displayWebhooksCore(context, webhooks) {
         console.log(`\u{1FA9D} ${webhook.name}`);
         console.log(`   Webhook ID: ${webhook.webhookId}`);
         if (activeVersion) {
-          console.log(`   Deployed Version: ${activeVersion.version} \u2B50`);
+          console.log(deployedVersionLine(activeVersion.version, context.hideVersions));
           console.log(`   Deployed: ${new Date(activeVersion.createdAt).toLocaleString()}`);
         } else {
-          console.log(`   Deployed Version: Not deployed`);
+          console.log(deployedVersionLine(null, context.hideVersions));
+        }
+        if (!context.hideVersions) {
+          console.log(`   Total Versions: ${versions.length}`);
         }
-        console.log(`   Total Versions: ${versions.length}`);
         console.log();
       } else {
         displayWebhookError(webhook, "Unable to fetch version info");
@@ -31724,7 +31648,11 @@ async function fetchVersionsCore3(context, webhook) {
   };
 }
 __name(fetchVersionsCore3, "fetchVersionsCore");
-function displayVersionsCore3(webhook, versions, activeVersionId) {
+function displayVersionsCore3(webhook, versions, activeVersionId, hideVersions) {
+  if (hideVersions) {
+    primitiveVersionHistoryView(webhook.name).forEach((line) => console.log(line));
+    return;
+  }
   console.log("\n" + "=".repeat(60));
   console.log(`\u{1F4DC} Versions for ${webhook.name}`);
   console.log("=".repeat(60) + "\n");
@@ -31998,12 +31926,12 @@ Usage: lua webhooks ${normalizedAction} --webhook-name <name>`);
     case "versions": {
       const data = await fetchVersionsCore3(context, selectedWebhook);
       if (!data) throw new Error("Failed to fetch webhook versions");
-      if (data.versions.length === 0) {
+      if (!context.hideVersions && data.versions.length === 0) {
         console.log(`\u2139\uFE0F  No versions found for ${selectedWebhook.name}.`);
         console.log("\u{1F4A1} Push a version first using 'lua push webhook'.");
         return;
       }
-      displayVersionsCore3(selectedWebhook, data.versions, data.activeVersionId);
+      displayVersionsCore3(selectedWebhook, data.versions, data.activeVersionId, context.hideVersions);
       break;
     }
     case "deploy": {
@@ -32183,13 +32111,13 @@ async function viewVersionsInteractive2(context, config) {
     ]);
     return;
   }
-  if (data.versions.length === 0) {
+  if (!context.hideVersions && data.versions.length === 0) {
     console.log(`
 \u2139\uFE0F  No versions found for ${selectedWebhook.name}.
 `);
     console.log("\u{1F4A1} Push a version first using 'lua push webhook'.\n");
   } else {
-    displayVersionsCore3(selectedWebhook, data.versions, data.activeVersionId);
+    displayVersionsCore3(selectedWebhook, data.versions, data.activeVersionId, context.hideVersions);
     console.log();
   }
   await safePrompt([
@@ -32687,10 +32615,12 @@ async function jobsCommand(action, cmdObj) {
       jobVersion: cmdObj?.jobVersion || null
     };
     const { config, agentId, apiKey } = await initializeCommand();
+    const hideVersions = await shouldHidePrimitiveVersions(apiKey, agentId);
     const context = {
       environment: "production",
       agentId,
-      apiKey
+      apiKey,
+      hideVersions
     };
     if (action) {
       await executeNonInteractive6(context, config, action, options);
@@ -32759,7 +32689,11 @@ async function fetchVersionsCore4(context, job) {
   };
 }
 __name(fetchVersionsCore4, "fetchVersionsCore");
-function displayVersionsCore4(job, versions, activeVersionId) {
+function displayVersionsCore4(job, versions, activeVersionId, hideVersions) {
+  if (hideVersions) {
+    primitiveVersionHistoryView(job.name).forEach((line) => console.log(line));
+    return;
+  }
   console.log("\n" + "=".repeat(60));
   console.log(`\u{1F4DC} Versions for ${job.name}`);
   console.log("=".repeat(60) + "\n");
@@ -33030,12 +32964,12 @@ Usage: lua jobs ${normalizedAction} --job-name <name>`);
     case "versions": {
       const vData = await fetchVersionsCore4(context, selectedJob);
       if (!vData) throw new Error("Failed to fetch job versions");
-      if (vData.versions.length === 0) {
+      if (!context.hideVersions && vData.versions.length === 0) {
         console.log(`\u2139\uFE0F  No versions found for ${selectedJob.name}.`);
         console.log("\u{1F4A1} Push a version first using 'lua push job'.");
         return;
       }
-      displayVersionsCore4(selectedJob, vData.versions, vData.activeVersionId);
+      displayVersionsCore4(selectedJob, vData.versions, vData.activeVersionId, context.hideVersions);
       break;
     }
     case "deploy": {
@@ -33217,13 +33151,13 @@ async function viewJobVersionsInteractive(context, config) {
     ]);
     return;
   }
-  if (viewData.versions.length === 0) {
+  if (!context.hideVersions && viewData.versions.length === 0) {
     console.log(`
 \u2139\uFE0F  No versions found for ${selectedJob.name}.
 `);
     console.log("\u{1F4A1} Push a version first using 'lua push job'.\n");
   } else {
-    displayVersionsCore4(selectedJob, viewData.versions, viewData.activeVersionId);
+    displayVersionsCore4(selectedJob, viewData.versions, viewData.activeVersionId, context.hideVersions);
     console.log();
   }
   await safePrompt([
@@ -33936,9 +33870,11 @@ async function preprocessorsCommand(action, cmdObj) {
       preprocessorVersion: cmdObj?.preprocessorVersion || null
     };
     const { config, agentId, apiKey } = await initializeCommand();
+    const hideVersions = await shouldHidePrimitiveVersions(apiKey, agentId);
     const context = {
       agentId,
-      apiKey
+      apiKey,
+      hideVersions
     };
     if (action) {
       await executeNonInteractive8(context, config, action, options);
@@ -33968,12 +33904,14 @@ async function displayPreProcessorsCore(context, preprocessors) {
         console.log(`\u{1F4E5} ${preprocessor.name}`);
         console.log(`   PreProcessor ID: ${preprocessor.preprocessorId}`);
         if (activeVersion) {
-          console.log(`   Deployed Version: ${activeVersion.version} \u2B50`);
+          console.log(deployedVersionLine(activeVersion.version, context.hideVersions));
           console.log(`   Deployed: ${new Date(activeVersion.createdAt).toLocaleString()}`);
         } else {
-          console.log(`   Deployed Version: Not deployed`);
+          console.log(deployedVersionLine(null, context.hideVersions));
+        }
+        if (!context.hideVersions) {
+          console.log(`   Total Versions: ${versions.length}`);
         }
-        console.log(`   Total Versions: ${versions.length}`);
         console.log();
       } else {
         displayPreProcessorError(preprocessor, "Unable to fetch version info");
@@ -34006,7 +33944,11 @@ async function fetchVersionsCore5(context, preprocessor) {
   };
 }
 __name(fetchVersionsCore5, "fetchVersionsCore");
-function displayVersionsCore5(preprocessor, versions, activeVersionId) {
+function displayVersionsCore5(preprocessor, versions, activeVersionId, hideVersions) {
+  if (hideVersions) {
+    primitiveVersionHistoryView(preprocessor.name).forEach((line) => console.log(line));
+    return;
+  }
   console.log("\n" + "=".repeat(60));
   console.log(`\u{1F4DC} Versions for ${preprocessor.name}`);
   console.log("=".repeat(60) + "\n");
@@ -34180,12 +34122,12 @@ Usage: lua preprocessors ${normalizedAction} --preprocessor-name <name>`);
     case "versions": {
       const data = await fetchVersionsCore5(context, selected);
       if (!data) throw new Error("Failed to fetch preprocessor versions");
-      if (data.versions.length === 0) {
+      if (!context.hideVersions && data.versions.length === 0) {
         console.log(`\u2139\uFE0F  No versions found for ${selected.name}.`);
         console.log("\u{1F4A1} Push a version first using 'lua push preprocessor'.");
         return;
       }
-      displayVersionsCore5(selected, data.versions, data.activeVersionId);
+      displayVersionsCore5(selected, data.versions, data.activeVersionId, context.hideVersions);
       break;
     }
     case "deploy": {
@@ -34343,13 +34285,13 @@ async function viewVersionsInteractive3(context, config) {
     ]);
     return;
   }
-  if (data.versions.length === 0) {
+  if (!context.hideVersions && data.versions.length === 0) {
     console.log(`
 \u2139\uFE0F  No versions found for ${selected.name}.
 `);
     console.log("\u{1F4A1} Push a version first using 'lua push preprocessor'.\n");
   } else {
-    displayVersionsCore5(selected, data.versions, data.activeVersionId);
+    displayVersionsCore5(selected, data.versions, data.activeVersionId, context.hideVersions);
     console.log();
   }
   await safePrompt([
@@ -34515,9 +34457,11 @@ async function postprocessorsCommand(action, cmdObj) {
       postprocessorVersion: cmdObj?.postprocessorVersion || null
     };
     const { config, agentId, apiKey } = await initializeCommand();
+    const hideVersions = await shouldHidePrimitiveVersions(apiKey, agentId);
     const context = {
       agentId,
-      apiKey
+      apiKey,
+      hideVersions
     };
     if (action) {
       await executeNonInteractive9(context, config, action, options);
@@ -34547,12 +34491,14 @@ async function displayPostProcessorsCore(context, postprocessors) {
         console.log(`\u{1F4E4} ${postprocessor.name}`);
         console.log(`   PostProcessor ID: ${postprocessor.postprocessorId}`);
         if (activeVersion) {
-          console.log(`   Deployed Version: ${activeVersion.version} \u2B50`);
+          console.log(deployedVersionLine(activeVersion.version, context.hideVersions));
           console.log(`   Deployed: ${new Date(activeVersion.createdAt).toLocaleString()}`);
         } else {
-          console.log(`   Deployed Version: Not deployed`);
+          console.log(deployedVersionLine(null, context.hideVersions));
+        }
+        if (!context.hideVersions) {
+          console.log(`   Total Versions: ${versions.length}`);
         }
-        console.log(`   Total Versions: ${versions.length}`);
         console.log();
       } else {
         displayPostProcessorError(postprocessor, "Unable to fetch version info");
@@ -34585,7 +34531,11 @@ async function fetchVersionsCore6(context, postprocessor) {
   };
 }
 __name(fetchVersionsCore6, "fetchVersionsCore");
-function displayVersionsCore6(postprocessor, versions, activeVersionId) {
+function displayVersionsCore6(postprocessor, versions, activeVersionId, hideVersions) {
+  if (hideVersions) {
+    primitiveVersionHistoryView(postprocessor.name).forEach((line) => console.log(line));
+    return;
+  }
   console.log("\n" + "=".repeat(60));
   console.log(`\u{1F4DC} Versions for ${postprocessor.name}`);
   console.log("=".repeat(60) + "\n");
@@ -34759,12 +34709,12 @@ Usage: lua postprocessors ${normalizedAction} --postprocessor-name <name>`);
     case "versions": {
       const data = await fetchVersionsCore6(context, selected);
       if (!data) throw new Error("Failed to fetch postprocessor versions");
-      if (data.versions.length === 0) {
+      if (!context.hideVersions && data.versions.length === 0) {
         console.log(`\u2139\uFE0F  No versions found for ${selected.name}.`);
         console.log("\u{1F4A1} Push a version first using 'lua push postprocessor'.");
         return;
       }
-      displayVersionsCore6(selected, data.versions, data.activeVersionId);
+      displayVersionsCore6(selected, data.versions, data.activeVersionId, context.hideVersions);
       break;
     }
     case "deploy": {
@@ -34922,13 +34872,13 @@ async function viewVersionsInteractive4(context, config) {
     ]);
     return;
   }
-  if (data.versions.length === 0) {
+  if (!context.hideVersions && data.versions.length === 0) {
     console.log(`
 \u2139\uFE0F  No versions found for ${selected.name}.
 `);
     console.log("\u{1F4A1} Push a version first using 'lua push postprocessor'.\n");
   } else {
-    displayVersionsCore6(selected, data.versions, data.activeVersionId);
+    displayVersionsCore6(selected, data.versions, data.activeVersionId, context.hideVersions);
     console.log();
   }
   await safePrompt([
@@ -37622,7 +37572,7 @@ init_cli();
 init_constants();
 import http from "http";
 import { URL as URL2 } from "url";
-import open6 from "open";
+import open5 from "open";
 init_command_utils();
 init_developer_api_service();
@@ -38645,7 +38595,7 @@ Integration: ${selectedIntegration.name}`);
 `);
   const callbackPromise = startCallbackServer(3e5);
   try {
-    await open6(authUrl);
+    await open5(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
   } catch (error) {
     writeInfo("\u{1F4A1} Could not open browser automatically. Please open the URL above manually.");
@@ -39076,7 +39026,7 @@ Available scopes for ${selectedIntegration.name}:`);
 `);
   const callbackPromise = startCallbackServer(3e5);
   try {
-    await open6(authUrl);
+    await open5(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
   } catch (error) {
     writeInfo("\u{1F4A1} Could not open browser automatically. Please open the URL above manually.");
@@ -41289,7 +41239,7 @@ __name(pumpRemoteAudioToSpeaker, "pumpRemoteAudioToSpeaker");
 // src/commands/voice-browser.ts
 init_cli();
 import http2 from "http";
-import open7 from "open";
+import open6 from "open";
 var SAFETY_TIMEOUT_MS = 60 * 60 * 1e3;
 async function runBrowserMode(joinUrl) {
   const { wsUrl, token } = parseJoinUrl(joinUrl);
@@ -41321,7 +41271,7 @@ async function runBrowserMode(joinUrl) {
   const localUrl = `http://localhost:${port}/`;
   writeSuccess(`Voice room ready (opening browser)`);
   console.log(`   ${localUrl}`);
-  await open7(localUrl);
+  await open6(localUrl);
   await new Promise((resolve6) => {
     const safety = setTimeout(() => {
       try {
@@ -42374,7 +42324,7 @@ function failConnect(status, banner, errorMessage) {
   throw new Error(errorMessage);
 }
 __name(failConnect, "failConnect");
-async function gitConnectCommand() {
+async function gitConnectCommand(opts = {}) {
   return withErrorHandling(async () => {
     const config = readYamlConfig();
     if (!config) {
@@ -42413,15 +42363,35 @@ async function gitConnectCommand() {
         user_configured: false
       }, '\u2717 Git user.name is not configured.\n   Fix: git config --global user.name "Your Name"', "git user.name is not configured");
     }
+    const passedStatus = {
+      git_available: true,
+      in_repo: true,
+      user_configured: true
+    };
+    if (opts.autoPush) {
+      const token = await getToken2("github");
+      if (!token) {
+        failConnect(passedStatus, "\u2717 --auto-push needs a linked GitHub account.\n   Fix: run `lua git auth github` to link your GitHub account, then re-run `lua git connect --auto-push`.", "no GitHub account linked");
+      }
+      const remote = await getRemoteOriginUrl();
+      if (!remote) {
+        failConnect(passedStatus, "\u2717 --auto-push needs a GitHub remote, but `remote.origin.url` is not set.\n   Fix: git remote add origin https://github.com/<owner>/<repo>.git", "no origin remote configured");
+      }
+      if (!isGitHubUrl(remote)) {
+        failConnect(passedStatus, `\u2717 --auto-push only supports GitHub HTTPS remotes, but origin is ${remote}.
+   Fix: git remote set-url origin https://github.com/<owner>/<repo>.git`, "origin is not a GitHub HTTPS remote");
+      }
+    }
     config.git = {
+      ...config.git,
       enabled: true
     };
+    if (opts.autoPush) config.git.autoPush = true;
     writeYamlConfig(config);
-    writeSuccess("\u2713 Git integration enabled. Future `lua push`, `lua version *`, and `lua pull` runs will auto-commit.");
+    writeSuccess(opts.autoPush ? "\u2713 Git integration enabled with auto-push. Future `lua push`, `lua version *`, and `lua pull` runs will auto-commit and push to GitHub." : "\u2713 Git integration enabled. Future `lua push`, `lua version *`, and `lua pull` runs will auto-commit.");
     trackEvent("cli_git_connect_completed", {
-      git_available: true,
-      in_repo: true,
-      user_configured: true,
+      ...passedStatus,
+      auto_push: Boolean(opts.autoPush),
       succeeded: true
     });
   }, "git connect");
@@ -42535,7 +42505,7 @@ function gitAuthGithubCommand(opts) {
     writeSuccess(`Logged in to GitHub as @${result.username}.`);
     trackEvent("cli_git_auth_succeeded", {
       provider: "github",
-      flow: opts.device ? "device" : "loopback"
+      flow: "device"
     });
   }, "git-auth-github");
 }
@@ -43319,11 +43289,13 @@ Examples:
   $ lua version delete v3 --force Skip confirmation
 `).action((version, opts) => versionDeleteCommand(version, opts));
   const gitGroup = program2.command("git").description("Manage opt-in git auto-commits for this project");
-  gitGroup.command("connect").description("Enable git auto-commits (runs sanity checks, writes git.enabled: true)").action(() => gitConnectCommand());
+  gitGroup.command("connect").description("Enable git auto-commits (runs sanity checks, writes git.enabled: true)").option("--auto-push", "Also enable post-commit auto-push (requires `lua git auth github` + a GitHub HTTPS origin remote)").action((opts) => gitConnectCommand({
+    autoPush: opts.autoPush
+  }));
   gitGroup.command("disconnect").description("Disable git auto-commits (existing commits/tags untouched)").action(() => gitDisconnectCommand());
   gitGroup.command("status").description("Show git integration config + last lua-issued commit/tag").action(() => gitStatusCommand());
   const gitAuthGroup = gitGroup.command("auth").description("Manage git remote provider authentication");
-  gitAuthGroup.command("github").description("Link a GitHub account").option("--device", "Use the device flow (paste a code into github.com/login/device)").option("--force", "Overwrite an existing link without prompting").action((opts) => gitAuthGithubCommand(opts));
+  gitAuthGroup.command("github").description("Link a GitHub account (OAuth device flow)").option("--device", "(deprecated; device flow is always used \u2014 flag kept for compatibility)").option("--force", "Overwrite an existing link without prompting").action((opts) => gitAuthGithubCommand(opts));
   gitAuthGroup.command("status").description("Show the current git auth status").action(() => gitAuthStatusCommand());
   gitAuthGroup.command("disconnect [provider]").description("Disconnect a git provider (default: github)").action((provider) => gitAuthDisconnectCommand(provider));
   program2.command("pull").description("\u{1F4E5}  Pull the agent's source code locally").option("--version <version>", "Pull source linked to a specific agent version (requires versioning)").option("--force", "Skip confirmation prompt").addHelpText("after", `