lua-cli 3.22.0 → 3.23.0

package/dist/index.js

@@ -879,6 +879,27 @@ function isAllowedReviewableExecuteTool(tool) {
 function isReviewableMcpSendTool(tool) {
   return tool.length > REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length && tool.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX);
 }
+function mcpActionTokens(action) {
+  return action.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+}
+function isReviewableMcpDraftTool(tool) {
+  const sep4 = tool.indexOf("_");
+  if (sep4 <= 0 || sep4 >= tool.length - 1) return false;
+  const action = tool.slice(sep4 + 1);
+  const tokens = mcpActionTokens(action);
+  if (!tokens.includes("draft") && !tokens.includes("drafts")) return false;
+  return !MCP_TOOL_READ_VERB_RE.test(action);
+}
+function isMcpDraftCreateTool(tool) {
+  if (!isReviewableMcpDraftTool(tool)) return false;
+  const tokens = mcpActionTokens(tool.slice(tool.indexOf("_") + 1));
+  return tokens[0] === "draft" || tokens.some((t) => MCP_DRAFT_CREATE_VERBS.has(t));
+}
+function mcpSendSiblingForDraftTool(tool, availableToolIds) {
+  const sibling = `${tool.split("_")[0]}${REVIEWABLE_MCP_SEND_TOOL_SUFFIX}`;
+  for (const id of availableToolIds) if (id === sibling) return sibling;
+  return void 0;
+}
 function isReviewableExecuteTool(tool) {
   return isAllowedReviewableExecuteTool(tool) || isReviewableMcpSendTool(tool);
 }
@@ -1118,7 +1139,23 @@ function foldRichPartsIntoMessages(messages, records, makeMessage, sameTurnGroup
 function buildDefaultPersona(agentName) {
   return DEFAULT_PERSONA_GUIDE.replace(AGENT_NAME_TOKEN, () => agentName || "My Agent");
 }
-var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, REASONING_EFFORT_VALUES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, AGENT_LOG_SOURCES, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema;
+function resolveLuaJobTimeoutSeconds(timeout) {
+  const resolved = timeout ?? LUA_JOB_DEFAULT_TIMEOUT_SECONDS;
+  if (!Number.isInteger(resolved)) {
+    throw new TypeError("LuaJob `timeout` must be an integer number of seconds.");
+  }
+  if (resolved < LUA_JOB_MIN_TIMEOUT_SECONDS || resolved > LUA_JOB_MAX_TIMEOUT_SECONDS) {
+    throw new RangeError(`LuaJob \`timeout\` must be between ${LUA_JOB_MIN_TIMEOUT_SECONDS} and ${LUA_JOB_MAX_TIMEOUT_SECONDS} seconds.`);
+  }
+  return resolved;
+}
+function normalizeLuaJobExecutionTimeoutSeconds(timeout) {
+  if (typeof timeout !== "number" || !Number.isFinite(timeout)) {
+    return LUA_JOB_DEFAULT_TIMEOUT_SECONDS;
+  }
+  return Math.min(Math.max(timeout, LUA_JOB_MIN_TIMEOUT_SECONDS), LUA_JOB_MAX_TIMEOUT_SECONDS);
+}
+var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, REASONING_EFFORT_VALUES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, AGENT_LOG_SOURCES, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1152,6 +1189,26 @@ var init_dist = __esm({
     REVIEWABLE_MCP_SEND_TOOL_SUFFIX = "_create_messaging_message";
     __name(isReviewableMcpSendTool, "isReviewableMcpSendTool");
     __name2(isReviewableMcpSendTool, "isReviewableMcpSendTool");
+    MCP_TOOL_READ_VERB_RE = /^(list|get|search|read|fetch|find|query|describe|count|retrieve|lookup|show|view)(_|[A-Z0-9]|$)/;
+    __name(mcpActionTokens, "mcpActionTokens");
+    __name2(mcpActionTokens, "mcpActionTokens");
+    __name(isReviewableMcpDraftTool, "isReviewableMcpDraftTool");
+    __name2(isReviewableMcpDraftTool, "isReviewableMcpDraftTool");
+    MCP_DRAFT_CREATE_VERBS = /* @__PURE__ */ new Set([
+      "create",
+      "compose",
+      "make",
+      "new",
+      "save",
+      "add",
+      "write",
+      "stage",
+      "prepare"
+    ]);
+    __name(isMcpDraftCreateTool, "isMcpDraftCreateTool");
+    __name2(isMcpDraftCreateTool, "isMcpDraftCreateTool");
+    __name(mcpSendSiblingForDraftTool, "mcpSendSiblingForDraftTool");
+    __name2(mcpSendSiblingForDraftTool, "mcpSendSiblingForDraftTool");
     __name(isReviewableExecuteTool, "isReviewableExecuteTool");
     __name2(isReviewableExecuteTool, "isReviewableExecuteTool");
     NON_INTERACTIVE_CHANNELS = [
@@ -1184,11 +1241,11 @@ var init_dist = __esm({
       },
       {
         name: "session_open",
-        description: "Open/attach a browser session (its own cookies/auth). Args: url?, headed?, profile?, confirmActions?."
+        description: "Open/attach a browser session (its own cookies/auth). Args: url?, headed?, profile?, confirmActions?. Only use the browser when the user explicitly asked for it, or said yes when you asked. For reading a page's content use fetchUrl first."
       },
       {
         name: "navigate",
-        description: "Navigate the session to a URL. Args: url, waitUntil?."
+        description: "Navigate the session to a URL. Args: url, waitUntil?. Only use the browser when the user explicitly asked for it, or said yes when you asked. For reading a page's content use fetchUrl first."
       },
       {
         name: "back",
@@ -1701,6 +1758,13 @@ Feel free to add, remove, or rename sections. Your persona can be a single parag
       voiceId: z.string().min(1),
       version: z.string().optional()
     });
+    LUA_JOB_DEFAULT_TIMEOUT_SECONDS = 300;
+    LUA_JOB_MIN_TIMEOUT_SECONDS = 1;
+    LUA_JOB_MAX_TIMEOUT_SECONDS = 600;
+    __name(resolveLuaJobTimeoutSeconds, "resolveLuaJobTimeoutSeconds");
+    __name2(resolveLuaJobTimeoutSeconds, "resolveLuaJobTimeoutSeconds");
+    __name(normalizeLuaJobExecutionTimeoutSeconds, "normalizeLuaJobExecutionTimeoutSeconds");
+    __name2(normalizeLuaJobExecutionTimeoutSeconds, "normalizeLuaJobExecutionTimeoutSeconds");
   }
 });
 
@@ -11034,6 +11098,8 @@ var init_user_instance = __esm({
               "data",
               "userAPI",
               "update",
+              "patch",
+              "unset",
               "clear",
               "toJSON",
               "_luaProfile"
@@ -11112,9 +11178,27 @@ var init_user_instance = __esm({
           this.data = response;
           return this.data;
         } catch (error) {
-          throw new Error("Failed to update user data");
+          throw new Error("Failed to update user data", {
+            cause: error
+          });
+        }
+      }
+      async patch(mutation) {
+        try {
+          const response = await this.userAPI.patch(mutation);
+          this.data = response;
+          return this.data;
+        } catch (error) {
+          throw new Error("Failed to patch user data", {
+            cause: error
+          });
         }
       }
+      async unset(...fields) {
+        return this.patch({
+          unset: fields
+        });
+      }
       /**
       * Clears all user data for the current user
       * @returns Promise resolving to true if clearing was successful
@@ -11123,9 +11207,12 @@ var init_user_instance = __esm({
       async clear() {
         try {
           await this.userAPI.clear();
+          this.data = {};
           return true;
         } catch (error) {
-          throw new Error("Failed to clear user data");
+          throw new Error("Failed to clear user data", {
+            cause: error
+          });
         }
       }
       /**
@@ -11138,7 +11225,9 @@ var init_user_instance = __esm({
           await this.userAPI.update(this.data);
           return true;
         } catch (error) {
-          throw new Error("Failed to save user data");
+          throw new Error("Failed to save user data", {
+            cause: error
+          });
         }
       }
       /**
@@ -11152,7 +11241,9 @@ var init_user_instance = __esm({
           await this.userAPI.sendMessage(messages);
           return true;
         } catch (error) {
-          throw new Error("Failed to send message");
+          throw new Error("Failed to send message", {
+            cause: error
+          });
         }
       }
       //get chat history
@@ -11160,7 +11251,9 @@ var init_user_instance = __esm({
         try {
           return await this.userAPI.getChatHistory();
         } catch (error) {
-          throw new Error("Failed to get chat history");
+          throw new Error("Failed to get chat history", {
+            cause: error
+          });
         }
       }
     };
@@ -12576,6 +12669,8 @@ var init_data_entry_instance = __esm({
               "score",
               "customDataAPI",
               "update",
+              "patch",
+              "unset",
               "delete",
               "toJSON"
             ];
@@ -12667,9 +12762,33 @@ var init_data_entry_instance = __esm({
           };
           return this.data;
         } catch (error) {
-          throw new Error("Failed to update custom data entry");
+          throw new Error("Failed to update custom data entry", {
+            cause: error
+          });
+        }
+      }
+      async patch(mutation) {
+        try {
+          await this.customDataAPI.patch(this.collectionName, this.id, mutation);
+          this.data = {
+            ...this.data,
+            ...mutation.set ?? {}
+          };
+          for (const field of mutation.unset ?? []) {
+            delete this.data[field];
+          }
+          return this.data;
+        } catch (error) {
+          throw new Error("Failed to patch custom data entry", {
+            cause: error
+          });
         }
       }
+      async unset(...fields) {
+        return this.patch({
+          unset: fields
+        });
+      }
       /**
       * Deletes the custom data entry
       * @returns Promise resolving to true if deletion was successful
@@ -12680,7 +12799,9 @@ var init_data_entry_instance = __esm({
           await this.customDataAPI.delete(this.collectionName, this.id);
           return true;
         } catch (error) {
-          throw new Error("Failed to delete custom data entry");
+          throw new Error("Failed to delete custom data entry", {
+            cause: error
+          });
         }
       }
       /**
@@ -12694,7 +12815,9 @@ var init_data_entry_instance = __esm({
           await this.customDataAPI.update(this.collectionName, this.id, this.data, searchText);
           return true;
         } catch (error) {
-          throw new Error("Failed to save data entry");
+          throw new Error("Failed to save data entry", {
+            cause: error
+          });
         }
       }
     };
@@ -12805,6 +12928,15 @@ var init_custom_data_api_service = __esm({
         }
         throw new Error(response.error?.message || "Failed to update custom data entry");
       }
+      async patch(collectionName, entryId, mutation) {
+        const response = await this.httpPatch(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, mutation, {
+          Authorization: `Bearer ${this.apiKey}`
+        });
+        if (response.success && response.data) {
+          return response.data;
+        }
+        throw new Error(response.error?.message || "Failed to patch custom data entry");
+      }
       /**
       * Performs semantic search on custom data entries using text similarity
       * @param collectionName - The name of the collection to search within
@@ -13261,8 +13393,10 @@ var init_developer_api_service = __esm({
       * @param email - The email address to look up
       * @returns Promise resolving to an ApiResponse containing the profile, or null if not found
       */
-      async getUserProfileByEmail(email) {
-        return this.httpGet(`/developer/user/profile/email/${encodeURIComponent(email)}`, {
+      async getUserProfileByEmail(email, agentId) {
+        const path18 = `/developer/user/profile/email/${encodeURIComponent(email)}`;
+        const scopedPath = agentId ? `${path18}?agentId=${encodeURIComponent(agentId)}` : path18;
+        return this.httpGet(scopedPath, {
           Authorization: `Bearer ${this.apiKey}`
         });
       }
@@ -13271,9 +13405,11 @@ var init_developer_api_service = __esm({
       * @param phone - The phone number to look up (with or without + prefix)
       * @returns Promise resolving to an ApiResponse containing the profile, or null if not found
       */
-      async getUserProfileByPhone(phone) {
+      async getUserProfileByPhone(phone, agentId) {
         const normalizedPhone = phone.replace(/^\+/, "");
-        return this.httpGet(`/developer/user/profile/phone/${normalizedPhone}`, {
+        const path18 = `/developer/user/profile/phone/${normalizedPhone}`;
+        const scopedPath = agentId ? `${path18}?agentId=${encodeURIComponent(agentId)}` : path18;
+        return this.httpGet(scopedPath, {
           Authorization: `Bearer ${this.apiKey}`
         });
       }
@@ -13813,22 +13949,28 @@ var init_user_data_api_service = __esm({
     init_http_client();
     init_user_instance();
     init_lazy_instances();
-    UserDataApi = class extends HttpClient {
+    UserDataApi = class _UserDataApi extends HttpClient {
       static {
         __name(this, "UserDataApi");
       }
       apiKey;
       agentId;
+      targetUserId;
       /**
       * Creates an instance of UserDataApi
       * @param baseUrl - The base URL for the API
       * @param apiKey - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
+      constructor(baseUrl, apiKey, agentId, targetUserId) {
         super(baseUrl);
         this.apiKey = apiKey;
         this.agentId = agentId;
+        this.targetUserId = targetUserId;
+      }
+      get dataPath() {
+        const base = `/developer/user/data/agent/${this.agentId}`;
+        return this.targetUserId ? `${base}/user/${encodeURIComponent(this.targetUserId)}` : base;
       }
       /**
       * Retrieves user data by userId, email, or phone.
@@ -13847,7 +13989,7 @@ var init_user_data_api_service = __esm({
         }
         let url = `/developer/user/data/agent/${this.agentId}`;
         if (userId) {
-          url += `/user/${userId}`;
+          url += `/user/${encodeURIComponent(userId)}`;
         }
         const response = await this.httpGet(url, {
           Authorization: `Bearer ${this.apiKey}`
@@ -13857,7 +13999,8 @@ var init_user_data_api_service = __esm({
         }
         const profile = response.data?._luaProfile;
         const { _luaProfile, ...data } = response.data || {};
-        return new UserDataInstance(this, data, profile);
+        const scopedApi = userId ? new _UserDataApi(this.baseUrl, this.apiKey, this.agentId, userId) : this;
+        return new UserDataInstance(scopedApi, data, profile);
       }
       /**
       * Resolves email or phone to user profile via DeveloperApi
@@ -13868,11 +14011,11 @@ var init_user_data_api_service = __esm({
         try {
           const developerApi = await getDeveloperInstance();
           if (options.email) {
-            const response = await developerApi.getUserProfileByEmail(options.email);
+            const response = await developerApi.getUserProfileByEmail(options.email, this.agentId);
             return response.success ? response.data ?? null : null;
           }
           if (options.phone) {
-            const response = await developerApi.getUserProfileByPhone(options.phone);
+            const response = await developerApi.getUserProfileByPhone(options.phone, this.agentId);
             return response.success ? response.data ?? null : null;
           }
         } catch (error) {
@@ -13890,7 +14033,7 @@ var init_user_data_api_service = __esm({
       * @throws Error if the update fails or the request is unsuccessful
       */
       async update(data) {
-        const response = await this.httpPut(`/developer/user/data/agent/${this.agentId}`, data, {
+        const response = await this.httpPut(this.dataPath, data, {
           Authorization: `Bearer ${this.apiKey}`
         });
         if (!response.success) {
@@ -13899,13 +14042,23 @@ var init_user_data_api_service = __esm({
         const { _luaProfile, ...cleanData } = response.data || {};
         return cleanData;
       }
+      async patch(mutation) {
+        const response = await this.httpPatch(this.dataPath, mutation, {
+          Authorization: `Bearer ${this.apiKey}`
+        });
+        if (!response.success) {
+          throw new Error(response.error?.message || "Failed to patch user data");
+        }
+        const { _luaProfile, ...cleanData } = response.data || {};
+        return cleanData;
+      }
       /**
       * Clears all user data for the current user and specific agent
       * @returns Promise resolving to an empty object upon successful deletion
       * @throws Error if the clear operation fails or the request is unsuccessful
       */
       async clear() {
-        const response = await this.httpDelete(`/developer/user/data/agent/${this.agentId}`, {
+        const response = await this.httpDelete(this.dataPath, {
           Authorization: `Bearer ${this.apiKey}`
         });
         if (!response.success) {
@@ -40625,6 +40778,7 @@ __name(deleteServerInteractive, "deleteServerInteractive");
 init_cli();
 init_constants();
 import http from "http";
+import { randomBytes } from "crypto";
 import { URL as URL2 } from "url";
 import open5 from "open";
 init_command_utils();
@@ -40666,18 +40820,14 @@ var UnifiedToApi = class extends HttpClient {
   async getAuthUrl(integrationType, options) {
     const params = new URLSearchParams();
     params.append("integrationType", integrationType);
+    params.append("agentId", options.agentId);
     params.append("successRedirect", options.successRedirect);
     params.append("failureRedirect", options.failureRedirect);
     if (options.scopes && options.scopes.length > 0) {
       params.append("scopes", options.scopes.join(","));
     }
-    if (options.state) {
-      params.append("state", options.state);
-    }
-    if (options.externalXref) {
-      params.append("externalXref", options.externalXref);
-    }
-    return this.httpGet(`/developer/unifiedto/auth-url?${params.toString()}`, {
+    params.append("state", options.state);
+    return this.httpGet(`/developer/unifiedto/auth-url/v2?${params.toString()}`, {
       Authorization: `Bearer ${this.apiKey}`
     });
   }
@@ -40823,7 +40973,8 @@ var UnifiedToApi = class extends HttpClient {
 // src/commands/integrations.ts
 init_analytics();
 var CALLBACK_PORT = 19837;
-var CALLBACK_URL = `http://localhost:${CALLBACK_PORT}/callback`;
+var CALLBACK_HOST = "127.0.0.1";
+var CALLBACK_URL = `http://${CALLBACK_HOST}:${CALLBACK_PORT}/callback`;
 var AGENT_WEBHOOK_URL = `${BASE_URLS.API}/webhook/unifiedto/data`;
 var DEFAULT_VIRTUAL_WEBHOOK_INTERVAL = 1;
 async function fetchAvailableIntegrations(unifiedToApi, agentId) {
@@ -40842,22 +40993,50 @@ async function fetchAvailableIntegrations(unifiedToApi, agentId) {
   }));
 }
 __name(fetchAvailableIntegrations, "fetchAvailableIntegrations");
-function startCallbackServer(timeoutMs = 3e5) {
+function createOAuthState() {
+  return randomBytes(32).toString("base64url");
+}
+__name(createOAuthState, "createOAuthState");
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (character) => {
+    const escaped = {
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
+      "'": "&#039;"
+    };
+    return escaped[character];
+  });
+}
+__name(escapeHtml, "escapeHtml");
+function startCallbackServer(expectedState, timeoutMs = 3e5) {
   return new Promise((resolve6) => {
     let resolved = false;
     const server = http.createServer((req, res) => {
       if (resolved) return;
       const reqUrl = new URL2(req.url || "/", `http://localhost:${CALLBACK_PORT}`);
       if (reqUrl.pathname === "/callback") {
+        const returnedState = reqUrl.searchParams.get("state");
+        if (returnedState !== expectedState) {
+          res.writeHead(400, {
+            "Content-Type": "text/plain; charset=utf-8",
+            "Cache-Control": "no-store",
+            "X-Content-Type-Options": "nosniff"
+          });
+          res.end("Invalid OAuth state");
+          return;
+        }
         const connectionId = reqUrl.searchParams.get("id");
         const error = reqUrl.searchParams.get("error");
         const logId = reqUrl.searchParams.get("log_id");
         const integrationType = reqUrl.searchParams.get("type");
         resolved = true;
         if (error) {
-          const logIdHtml = logId ? `<p style="color: #888; font-size: 0.85em;">Log ID: <code>${logId}</code></p>` : "";
+          const logIdHtml = logId ? `<p style="color: #888; font-size: 0.85em;">Log ID: <code>${escapeHtml(logId)}</code></p>` : "";
           res.writeHead(200, {
-            "Content-Type": "text/html"
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store"
           });
           res.end(`
             <!DOCTYPE html>
@@ -40866,7 +41045,7 @@ function startCallbackServer(timeoutMs = 3e5) {
             <body style="font-family: system-ui; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e;">
               <div style="text-align: center; color: white; max-width: 500px; padding: 0 20px;">
                 <h1 style="color: #ff6b6b;">Connection Failed</h1>
-                <p style="color: #ccc;">Error: ${error}</p>
+                <p style="color: #ccc;">Authentication failed. Return to the terminal for details.</p>
                 ${logIdHtml}
                 <p style="color: #888;">You can close this window and try again.</p>
               </div>
@@ -40881,7 +41060,8 @@ function startCallbackServer(timeoutMs = 3e5) {
           });
         } else if (connectionId) {
           res.writeHead(200, {
-            "Content-Type": "text/html"
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store"
           });
           res.end(`
             <!DOCTYPE html>
@@ -40915,7 +41095,7 @@ function startCallbackServer(timeoutMs = 3e5) {
         res.end("Not found");
       }
     });
-    server.listen(CALLBACK_PORT, () => {
+    server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
     });
     setTimeout(() => {
       if (!resolved) {
@@ -41616,22 +41796,13 @@ Available triggers for ${selectedIntegration.name}:`);
     writeInfo(`Note: Could not fetch available triggers (${error.message})`);
   }
   writeProgress("\u{1F504} Preparing authorization...");
-  const state = Buffer.from(JSON.stringify({
-    agentId: context.agentId,
-    integration: selectedIntegration.value,
-    authMethod,
-    timestamp: Date.now()
-  })).toString("base64");
-  const externalXref = JSON.stringify({
-    agentId: context.agentId,
-    userId: context.userId
-  });
+  const state = createOAuthState();
   const authUrlResult = await context.unifiedToApi.getAuthUrl(selectedIntegration.value, {
+    agentId: context.agentId,
     successRedirect: CALLBACK_URL,
     failureRedirect: CALLBACK_URL,
     scopes: authMethod === "oauth" ? selectedScopes : void 0,
-    state,
-    externalXref
+    state
   });
   if (!authUrlResult.success || !authUrlResult.data) {
     writeError(`\u274C Failed to get authorization URL: ${authUrlResult.error?.message || "Unknown error"}`);
@@ -41647,7 +41818,7 @@ Integration: ${selectedIntegration.name}`);
 \u{1F4CB} Authorization URL (copy if browser doesn't open):
    ${authUrl}
 `);
-  const callbackPromise = startCallbackServer(3e5);
+  const callbackPromise = startCallbackServer(state, 3e5);
   try {
     await open5(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
@@ -42049,22 +42220,13 @@ Available scopes for ${selectedIntegration.name}:`);
     writeError(`\u274C Failed to remove old connection: ${error.message}`);
     return;
   }
-  const state = Buffer.from(JSON.stringify({
-    agentId: context.agentId,
-    integration: selectedIntegration.value,
-    authMethod: "oauth",
-    timestamp: Date.now()
-  })).toString("base64");
-  const externalXref = JSON.stringify({
-    agentId: context.agentId,
-    userId: context.userId
-  });
+  const state = createOAuthState();
   const authUrlResult = await context.unifiedToApi.getAuthUrl(selectedIntegration.value, {
+    agentId: context.agentId,
     successRedirect: CALLBACK_URL,
     failureRedirect: CALLBACK_URL,
     scopes: selectedScopes,
-    state,
-    externalXref
+    state
   });
   if (!authUrlResult.success || !authUrlResult.data) {
     writeError(`\u274C Failed to get authorization URL: ${authUrlResult.error?.message || "Unknown error"}`);
@@ -42078,7 +42240,7 @@ Available scopes for ${selectedIntegration.name}:`);
 \u{1F4CB} Authorization URL (copy if browser doesn't open):
    ${authUrl}
 `);
-  const callbackPromise = startCallbackServer(3e5);
+  const callbackPromise = startCallbackServer(state, 3e5);
   try {
     await open5(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");