lua-cli 3.22.0 → 3.23.1

package/dist/index.js

@@ -879,6 +879,31 @@ function isAllowedReviewableExecuteTool(tool) {
 function isReviewableMcpSendTool(tool) {
   return tool.length > REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length && tool.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX);
 }
+function mcpActionTokens(action) {
+  return action.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+}
+function isReviewableMcpDraftTool(tool) {
+  const sep4 = tool.indexOf("_");
+  if (sep4 <= 0 || sep4 >= tool.length - 1) return false;
+  const action = tool.slice(sep4 + 1);
+  const tokens = mcpActionTokens(action);
+  if (!tokens.includes("draft") && !tokens.includes("drafts")) return false;
+  return !MCP_TOOL_READ_VERB_RE.test(action);
+}
+function isMcpDraftCreateTool(tool) {
+  if (!isReviewableMcpDraftTool(tool)) return false;
+  const tokens = mcpActionTokens(tool.slice(tool.indexOf("_") + 1));
+  return tokens[0] === "draft" || tokens.some((t) => MCP_DRAFT_CREATE_VERBS.has(t));
+}
+function mcpSendSiblingForDraftTool(tool, availableToolIds) {
+  const candidates = [
+    ...availableToolIds
+  ].filter((id) => id.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX)).map((id) => ({
+    id,
+    serverName: id.slice(0, -REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length)
+  })).filter(({ serverName }) => tool.startsWith(`${serverName}_`)).sort((a, b) => b.serverName.length - a.serverName.length);
+  return candidates[0]?.id;
+}
 function isReviewableExecuteTool(tool) {
   return isAllowedReviewableExecuteTool(tool) || isReviewableMcpSendTool(tool);
 }
@@ -1115,10 +1140,40 @@ function foldRichPartsIntoMessages(messages, records, makeMessage, sameTurnGroup
   while (next < synthetic.length) combined.push(synthetic[next++].message);
   return mergeRichPartMirrorMessages(combined, sameTurnGroup);
 }
+function isDesktopFileCommandName(value) {
+  return typeof value === "string" && DESKTOP_FILE_COMMAND_SET.has(value);
+}
+function isDesktopFileSessionId(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+function resolveRequireToolApproval(rules) {
+  const raw = rules?.requireToolApproval ?? rules?.requireApproval;
+  if (raw === void 0 || raw === null) return void 0;
+  const list = Array.isArray(raw) ? raw : [
+    raw
+  ];
+  return list.filter((t) => typeof t === "string");
+}
 function buildDefaultPersona(agentName) {
   return DEFAULT_PERSONA_GUIDE.replace(AGENT_NAME_TOKEN, () => agentName || "My Agent");
 }
-var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, REASONING_EFFORT_VALUES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, AGENT_LOG_SOURCES, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema;
+function resolveLuaJobTimeoutSeconds(timeout) {
+  const resolved = timeout ?? LUA_JOB_DEFAULT_TIMEOUT_SECONDS;
+  if (!Number.isInteger(resolved)) {
+    throw new TypeError("LuaJob `timeout` must be an integer number of seconds.");
+  }
+  if (resolved < LUA_JOB_MIN_TIMEOUT_SECONDS || resolved > LUA_JOB_MAX_TIMEOUT_SECONDS) {
+    throw new RangeError(`LuaJob \`timeout\` must be between ${LUA_JOB_MIN_TIMEOUT_SECONDS} and ${LUA_JOB_MAX_TIMEOUT_SECONDS} seconds.`);
+  }
+  return resolved;
+}
+function normalizeLuaJobExecutionTimeoutSeconds(timeout) {
+  if (typeof timeout !== "number" || !Number.isFinite(timeout)) {
+    return LUA_JOB_DEFAULT_TIMEOUT_SECONDS;
+  }
+  return Math.min(Math.max(timeout, LUA_JOB_MIN_TIMEOUT_SECONDS), LUA_JOB_MAX_TIMEOUT_SECONDS);
+}
+var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, AGENT_LOG_SOURCES, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1152,6 +1207,26 @@ var init_dist = __esm({
     REVIEWABLE_MCP_SEND_TOOL_SUFFIX = "_create_messaging_message";
     __name(isReviewableMcpSendTool, "isReviewableMcpSendTool");
     __name2(isReviewableMcpSendTool, "isReviewableMcpSendTool");
+    MCP_TOOL_READ_VERB_RE = /(?:^|_)(list|get|search|read|fetch|find|query|describe|count|retrieve|lookup|show|view)(_|[A-Z0-9]|$)/;
+    __name(mcpActionTokens, "mcpActionTokens");
+    __name2(mcpActionTokens, "mcpActionTokens");
+    __name(isReviewableMcpDraftTool, "isReviewableMcpDraftTool");
+    __name2(isReviewableMcpDraftTool, "isReviewableMcpDraftTool");
+    MCP_DRAFT_CREATE_VERBS = /* @__PURE__ */ new Set([
+      "create",
+      "compose",
+      "make",
+      "new",
+      "save",
+      "add",
+      "write",
+      "stage",
+      "prepare"
+    ]);
+    __name(isMcpDraftCreateTool, "isMcpDraftCreateTool");
+    __name2(isMcpDraftCreateTool, "isMcpDraftCreateTool");
+    __name(mcpSendSiblingForDraftTool, "mcpSendSiblingForDraftTool");
+    __name2(mcpSendSiblingForDraftTool, "mcpSendSiblingForDraftTool");
     __name(isReviewableExecuteTool, "isReviewableExecuteTool");
     __name2(isReviewableExecuteTool, "isReviewableExecuteTool");
     NON_INTERACTIVE_CHANNELS = [
@@ -1184,11 +1259,11 @@ var init_dist = __esm({
       },
       {
         name: "session_open",
-        description: "Open/attach a browser session (its own cookies/auth). Args: url?, headed?, profile?, confirmActions?."
+        description: "Open/attach a browser session (its own cookies/auth). Args: url?, headed?, profile?, confirmActions?. Only use the browser when the user explicitly asked for it, or said yes when you asked. For reading a page's content use fetchUrl first."
       },
       {
         name: "navigate",
-        description: "Navigate the session to a URL. Args: url, waitUntil?."
+        description: "Navigate the session to a URL. Args: url, waitUntil?. Only use the browser when the user explicitly asked for it, or said yes when you asked. For reading a page's content use fetchUrl first."
       },
       {
         name: "back",
@@ -1383,6 +1458,27 @@ var init_dist = __esm({
       }
     ];
     BROWSER_COMMAND_NAMES = BROWSER_COMMANDS.map((c) => c.name);
+    DESKTOP_FILE_COMMANDS = [
+      "files_roots",
+      "files_stat",
+      "files_list",
+      "files_read",
+      "files_search",
+      "files_write",
+      "files_mkdir",
+      "files_move",
+      "files_delete",
+      "files_undo",
+      "files_transfer_prepare",
+      "files_transfer_upload",
+      "files_watch_start",
+      "files_watch_cancel"
+    ];
+    DESKTOP_FILE_COMMAND_SET = new Set(DESKTOP_FILE_COMMANDS);
+    __name(isDesktopFileCommandName, "isDesktopFileCommandName");
+    __name2(isDesktopFileCommandName, "isDesktopFileCommandName");
+    __name(isDesktopFileSessionId, "isDesktopFileSessionId");
+    __name2(isDesktopFileSessionId, "isDesktopFileSessionId");
     REASONING_EFFORT_VALUES = [
       "off",
       "minimal",
@@ -1391,6 +1487,8 @@ var init_dist = __esm({
       "high",
       "max"
     ];
+    __name(resolveRequireToolApproval, "resolveRequireToolApproval");
+    __name2(resolveRequireToolApproval, "resolveRequireToolApproval");
     AGENT_NAME_TOKEN = "[Your Agent Name]";
     DEFAULT_PERSONA_GUIDE = `# ${AGENT_NAME_TOKEN} - Persona
 
@@ -1701,6 +1799,13 @@ Feel free to add, remove, or rename sections. Your persona can be a single parag
       voiceId: z.string().min(1),
       version: z.string().optional()
     });
+    LUA_JOB_DEFAULT_TIMEOUT_SECONDS = 300;
+    LUA_JOB_MIN_TIMEOUT_SECONDS = 1;
+    LUA_JOB_MAX_TIMEOUT_SECONDS = 600;
+    __name(resolveLuaJobTimeoutSeconds, "resolveLuaJobTimeoutSeconds");
+    __name2(resolveLuaJobTimeoutSeconds, "resolveLuaJobTimeoutSeconds");
+    __name(normalizeLuaJobExecutionTimeoutSeconds, "normalizeLuaJobExecutionTimeoutSeconds");
+    __name2(normalizeLuaJobExecutionTimeoutSeconds, "normalizeLuaJobExecutionTimeoutSeconds");
   }
 });
 
@@ -11034,6 +11139,8 @@ var init_user_instance = __esm({
               "data",
               "userAPI",
               "update",
+              "patch",
+              "unset",
               "clear",
               "toJSON",
               "_luaProfile"
@@ -11112,9 +11219,27 @@ var init_user_instance = __esm({
           this.data = response;
           return this.data;
         } catch (error) {
-          throw new Error("Failed to update user data");
+          throw new Error("Failed to update user data", {
+            cause: error
+          });
         }
       }
+      async patch(mutation) {
+        try {
+          const response = await this.userAPI.patch(mutation);
+          this.data = response;
+          return this.data;
+        } catch (error) {
+          throw new Error("Failed to patch user data", {
+            cause: error
+          });
+        }
+      }
+      async unset(...fields) {
+        return this.patch({
+          unset: fields
+        });
+      }
       /**
       * Clears all user data for the current user
       * @returns Promise resolving to true if clearing was successful
@@ -11123,9 +11248,12 @@ var init_user_instance = __esm({
       async clear() {
         try {
           await this.userAPI.clear();
+          this.data = {};
           return true;
         } catch (error) {
-          throw new Error("Failed to clear user data");
+          throw new Error("Failed to clear user data", {
+            cause: error
+          });
         }
       }
       /**
@@ -11138,7 +11266,9 @@ var init_user_instance = __esm({
           await this.userAPI.update(this.data);
           return true;
         } catch (error) {
-          throw new Error("Failed to save user data");
+          throw new Error("Failed to save user data", {
+            cause: error
+          });
         }
       }
       /**
@@ -11152,7 +11282,9 @@ var init_user_instance = __esm({
           await this.userAPI.sendMessage(messages);
           return true;
         } catch (error) {
-          throw new Error("Failed to send message");
+          throw new Error("Failed to send message", {
+            cause: error
+          });
         }
       }
       //get chat history
@@ -11160,7 +11292,9 @@ var init_user_instance = __esm({
         try {
           return await this.userAPI.getChatHistory();
         } catch (error) {
-          throw new Error("Failed to get chat history");
+          throw new Error("Failed to get chat history", {
+            cause: error
+          });
         }
       }
     };
@@ -12576,6 +12710,8 @@ var init_data_entry_instance = __esm({
               "score",
               "customDataAPI",
               "update",
+              "patch",
+              "unset",
               "delete",
               "toJSON"
             ];
@@ -12667,9 +12803,33 @@ var init_data_entry_instance = __esm({
           };
           return this.data;
         } catch (error) {
-          throw new Error("Failed to update custom data entry");
+          throw new Error("Failed to update custom data entry", {
+            cause: error
+          });
+        }
+      }
+      async patch(mutation) {
+        try {
+          await this.customDataAPI.patch(this.collectionName, this.id, mutation);
+          this.data = {
+            ...this.data,
+            ...mutation.set ?? {}
+          };
+          for (const field of mutation.unset ?? []) {
+            delete this.data[field];
+          }
+          return this.data;
+        } catch (error) {
+          throw new Error("Failed to patch custom data entry", {
+            cause: error
+          });
         }
       }
+      async unset(...fields) {
+        return this.patch({
+          unset: fields
+        });
+      }
       /**
       * Deletes the custom data entry
       * @returns Promise resolving to true if deletion was successful
@@ -12680,7 +12840,9 @@ var init_data_entry_instance = __esm({
           await this.customDataAPI.delete(this.collectionName, this.id);
           return true;
         } catch (error) {
-          throw new Error("Failed to delete custom data entry");
+          throw new Error("Failed to delete custom data entry", {
+            cause: error
+          });
         }
       }
       /**
@@ -12694,7 +12856,9 @@ var init_data_entry_instance = __esm({
           await this.customDataAPI.update(this.collectionName, this.id, this.data, searchText);
           return true;
         } catch (error) {
-          throw new Error("Failed to save data entry");
+          throw new Error("Failed to save data entry", {
+            cause: error
+          });
         }
       }
     };
@@ -12805,6 +12969,15 @@ var init_custom_data_api_service = __esm({
         }
         throw new Error(response.error?.message || "Failed to update custom data entry");
       }
+      async patch(collectionName, entryId, mutation) {
+        const response = await this.httpPatch(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, mutation, {
+          Authorization: `Bearer ${this.apiKey}`
+        });
+        if (response.success && response.data) {
+          return response.data;
+        }
+        throw new Error(response.error?.message || "Failed to patch custom data entry");
+      }
       /**
       * Performs semantic search on custom data entries using text similarity
       * @param collectionName - The name of the collection to search within
@@ -13261,8 +13434,10 @@ var init_developer_api_service = __esm({
       * @param email - The email address to look up
       * @returns Promise resolving to an ApiResponse containing the profile, or null if not found
       */
-      async getUserProfileByEmail(email) {
-        return this.httpGet(`/developer/user/profile/email/${encodeURIComponent(email)}`, {
+      async getUserProfileByEmail(email, agentId) {
+        const path18 = `/developer/user/profile/email/${encodeURIComponent(email)}`;
+        const scopedPath = agentId ? `${path18}?agentId=${encodeURIComponent(agentId)}` : path18;
+        return this.httpGet(scopedPath, {
           Authorization: `Bearer ${this.apiKey}`
         });
       }
@@ -13271,9 +13446,11 @@ var init_developer_api_service = __esm({
       * @param phone - The phone number to look up (with or without + prefix)
       * @returns Promise resolving to an ApiResponse containing the profile, or null if not found
       */
-      async getUserProfileByPhone(phone) {
+      async getUserProfileByPhone(phone, agentId) {
         const normalizedPhone = phone.replace(/^\+/, "");
-        return this.httpGet(`/developer/user/profile/phone/${normalizedPhone}`, {
+        const path18 = `/developer/user/profile/phone/${normalizedPhone}`;
+        const scopedPath = agentId ? `${path18}?agentId=${encodeURIComponent(agentId)}` : path18;
+        return this.httpGet(scopedPath, {
           Authorization: `Bearer ${this.apiKey}`
         });
       }
@@ -13813,22 +13990,28 @@ var init_user_data_api_service = __esm({
     init_http_client();
     init_user_instance();
     init_lazy_instances();
-    UserDataApi = class extends HttpClient {
+    UserDataApi = class _UserDataApi extends HttpClient {
       static {
         __name(this, "UserDataApi");
       }
       apiKey;
       agentId;
+      targetUserId;
       /**
       * Creates an instance of UserDataApi
       * @param baseUrl - The base URL for the API
       * @param apiKey - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
+      constructor(baseUrl, apiKey, agentId, targetUserId) {
         super(baseUrl);
         this.apiKey = apiKey;
         this.agentId = agentId;
+        this.targetUserId = targetUserId;
+      }
+      get dataPath() {
+        const base = `/developer/user/data/agent/${this.agentId}`;
+        return this.targetUserId ? `${base}/user/${encodeURIComponent(this.targetUserId)}` : base;
       }
       /**
       * Retrieves user data by userId, email, or phone.
@@ -13847,7 +14030,7 @@ var init_user_data_api_service = __esm({
         }
         let url = `/developer/user/data/agent/${this.agentId}`;
         if (userId) {
-          url += `/user/${userId}`;
+          url += `/user/${encodeURIComponent(userId)}`;
         }
         const response = await this.httpGet(url, {
           Authorization: `Bearer ${this.apiKey}`
@@ -13857,7 +14040,8 @@ var init_user_data_api_service = __esm({
         }
         const profile = response.data?._luaProfile;
         const { _luaProfile, ...data } = response.data || {};
-        return new UserDataInstance(this, data, profile);
+        const scopedApi = userId ? new _UserDataApi(this.baseUrl, this.apiKey, this.agentId, userId) : this;
+        return new UserDataInstance(scopedApi, data, profile);
       }
       /**
       * Resolves email or phone to user profile via DeveloperApi
@@ -13868,11 +14052,11 @@ var init_user_data_api_service = __esm({
         try {
           const developerApi = await getDeveloperInstance();
           if (options.email) {
-            const response = await developerApi.getUserProfileByEmail(options.email);
+            const response = await developerApi.getUserProfileByEmail(options.email, this.agentId);
             return response.success ? response.data ?? null : null;
           }
           if (options.phone) {
-            const response = await developerApi.getUserProfileByPhone(options.phone);
+            const response = await developerApi.getUserProfileByPhone(options.phone, this.agentId);
             return response.success ? response.data ?? null : null;
           }
         } catch (error) {
@@ -13890,7 +14074,7 @@ var init_user_data_api_service = __esm({
       * @throws Error if the update fails or the request is unsuccessful
       */
       async update(data) {
-        const response = await this.httpPut(`/developer/user/data/agent/${this.agentId}`, data, {
+        const response = await this.httpPut(this.dataPath, data, {
           Authorization: `Bearer ${this.apiKey}`
         });
         if (!response.success) {
@@ -13899,13 +14083,23 @@ var init_user_data_api_service = __esm({
         const { _luaProfile, ...cleanData } = response.data || {};
         return cleanData;
       }
+      async patch(mutation) {
+        const response = await this.httpPatch(this.dataPath, mutation, {
+          Authorization: `Bearer ${this.apiKey}`
+        });
+        if (!response.success) {
+          throw new Error(response.error?.message || "Failed to patch user data");
+        }
+        const { _luaProfile, ...cleanData } = response.data || {};
+        return cleanData;
+      }
       /**
       * Clears all user data for the current user and specific agent
       * @returns Promise resolving to an empty object upon successful deletion
       * @throws Error if the clear operation fails or the request is unsuccessful
       */
       async clear() {
-        const response = await this.httpDelete(`/developer/user/data/agent/${this.agentId}`, {
+        const response = await this.httpDelete(this.dataPath, {
           Authorization: `Bearer ${this.apiKey}`
         });
         if (!response.success) {
@@ -14898,7 +15092,7 @@ export const governance = {
   }
   if (setup.requireApproval && setup.requireApproval.length > 0) {
     const list = setup.requireApproval.map((t) => `'${t}'`).join(", ");
-    ruleLines.push(`    requireApproval: [${list}],`);
+    ruleLines.push(`    requireToolApproval: [${list}],`);
   }
   if (setup.tokenLimit && setup.tokenLimit > 0) {
     ruleLines.push(`    tokenBudget: ${setup.tokenLimit},`);
@@ -19809,6 +20003,15 @@ var DeviceTriggerApi = class extends HttpClient {
 
 // src/primitives/device-trigger.handler.ts
 init_base_handler();
+
+// src/primitives/device-trigger.response.ts
+function parseDeviceTriggerList(data) {
+  const triggers = data?.triggers ?? data?.deviceTriggers;
+  return Array.isArray(triggers) ? triggers : null;
+}
+__name(parseDeviceTriggerList, "parseDeviceTriggerList");
+
+// src/primitives/device-trigger.handler.ts
 var DeviceTriggerHandler = class extends BaseVersionedHandler {
   static {
     __name(this, "DeviceTriggerHandler");
@@ -19848,10 +20051,10 @@ var DeviceTriggerHandler = class extends BaseVersionedHandler {
   }
   async fetchFromServer(api) {
     const response = await api.getDeviceTriggers();
-    if (!response.success || !response.data?.deviceTriggers) {
+    if (!response.success) {
       return null;
     }
-    return response.data.deviceTriggers;
+    return parseDeviceTriggerList(response.data);
   }
   async createOnServer(api, primitive) {
     const response = await api.createDeviceTrigger({
@@ -29634,13 +29837,47 @@ init_cli();
 init_command_utils();
 init_analytics();
 import open from "open";
+
+// src/utils/auth-handoff.ts
+init_constants();
+async function issueAdminHandoff(apiKey) {
+  const response = await fetch(`${BASE_URLS.AUTH}/auth/handoff`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      audience: "admin"
+    })
+  });
+  if (!response.ok) throw new Error("Could not create a secure dashboard sign-in handoff");
+  const body = await response.json();
+  if (typeof body.code !== "string" || !body.code) {
+    throw new Error("Lua Auth returned an invalid dashboard sign-in handoff");
+  }
+  return body.code;
+}
+__name(issueAdminHandoff, "issueAdminHandoff");
+function buildAdminHandoffUrl(code, agentId, orgId) {
+  const url = new URL("/auth-handoff", "https://admin.heylua.ai");
+  url.searchParams.set("code", code);
+  url.searchParams.set("redirect", "/admin/usage");
+  url.searchParams.set("agentId", agentId);
+  url.searchParams.set("orgId", orgId);
+  return url.toString();
+}
+__name(buildAdminHandoffUrl, "buildAdminHandoffUrl");
+
+// src/commands/admin.ts
 async function adminCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Admin Dashboard...");
     const { agentId, orgId, apiKey } = await initializeCommand({
       showProgress: false
     });
-    const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
+    const handoffCode = await issueAdminHandoff(apiKey);
+    const adminUrl = buildAdminHandoffUrl(handoffCode, agentId, orgId);
     await open(adminUrl);
     writeSuccess("Lua Admin Dashboard opened in your browser");
     console.log(`
@@ -29695,10 +29932,10 @@ async function docsCommand() {
 __name(docsCommand, "docsCommand");
 
 // src/commands/channels.ts
-init_cli();
-init_command_utils();
 import inquirer12 from "inquirer";
 import open4 from "open";
+init_cli();
+init_command_utils();
 
 // src/api/channels.api.service.ts
 init_http_client();
@@ -30266,7 +30503,8 @@ async function openAdminDashboard(apiKey, config) {
   if (!orgId) {
     throw new Error("No orgId found in lua.skill.yaml. Please ensure your configuration is valid.");
   }
-  const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
+  const handoffCode = await issueAdminHandoff(apiKey);
+  const adminUrl = buildAdminHandoffUrl(handoffCode, agentId, orgId);
   await open4(adminUrl);
   writeSuccess("\u2705 Lua Admin Dashboard opened in your browser");
   console.log(`
@@ -40625,6 +40863,7 @@ __name(deleteServerInteractive, "deleteServerInteractive");
 init_cli();
 init_constants();
 import http from "http";
+import { randomBytes } from "crypto";
 import { URL as URL2 } from "url";
 import open5 from "open";
 init_command_utils();
@@ -40666,18 +40905,14 @@ var UnifiedToApi = class extends HttpClient {
   async getAuthUrl(integrationType, options) {
     const params = new URLSearchParams();
     params.append("integrationType", integrationType);
+    params.append("agentId", options.agentId);
     params.append("successRedirect", options.successRedirect);
     params.append("failureRedirect", options.failureRedirect);
     if (options.scopes && options.scopes.length > 0) {
       params.append("scopes", options.scopes.join(","));
     }
-    if (options.state) {
-      params.append("state", options.state);
-    }
-    if (options.externalXref) {
-      params.append("externalXref", options.externalXref);
-    }
-    return this.httpGet(`/developer/unifiedto/auth-url?${params.toString()}`, {
+    params.append("state", options.state);
+    return this.httpGet(`/developer/unifiedto/auth-url/v2?${params.toString()}`, {
       Authorization: `Bearer ${this.apiKey}`
     });
   }
@@ -40823,7 +41058,8 @@ var UnifiedToApi = class extends HttpClient {
 // src/commands/integrations.ts
 init_analytics();
 var CALLBACK_PORT = 19837;
-var CALLBACK_URL = `http://localhost:${CALLBACK_PORT}/callback`;
+var CALLBACK_HOST = "127.0.0.1";
+var CALLBACK_URL = `http://${CALLBACK_HOST}:${CALLBACK_PORT}/callback`;
 var AGENT_WEBHOOK_URL = `${BASE_URLS.API}/webhook/unifiedto/data`;
 var DEFAULT_VIRTUAL_WEBHOOK_INTERVAL = 1;
 async function fetchAvailableIntegrations(unifiedToApi, agentId) {
@@ -40842,22 +41078,50 @@ async function fetchAvailableIntegrations(unifiedToApi, agentId) {
   }));
 }
 __name(fetchAvailableIntegrations, "fetchAvailableIntegrations");
-function startCallbackServer(timeoutMs = 3e5) {
+function createOAuthState() {
+  return randomBytes(32).toString("base64url");
+}
+__name(createOAuthState, "createOAuthState");
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (character) => {
+    const escaped = {
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
+      "'": "&#039;"
+    };
+    return escaped[character];
+  });
+}
+__name(escapeHtml, "escapeHtml");
+function startCallbackServer(expectedState, timeoutMs = 3e5) {
   return new Promise((resolve6) => {
     let resolved = false;
     const server = http.createServer((req, res) => {
       if (resolved) return;
       const reqUrl = new URL2(req.url || "/", `http://localhost:${CALLBACK_PORT}`);
       if (reqUrl.pathname === "/callback") {
+        const returnedState = reqUrl.searchParams.get("state");
+        if (returnedState !== expectedState) {
+          res.writeHead(400, {
+            "Content-Type": "text/plain; charset=utf-8",
+            "Cache-Control": "no-store",
+            "X-Content-Type-Options": "nosniff"
+          });
+          res.end("Invalid OAuth state");
+          return;
+        }
         const connectionId = reqUrl.searchParams.get("id");
         const error = reqUrl.searchParams.get("error");
         const logId = reqUrl.searchParams.get("log_id");
         const integrationType = reqUrl.searchParams.get("type");
         resolved = true;
         if (error) {
-          const logIdHtml = logId ? `<p style="color: #888; font-size: 0.85em;">Log ID: <code>${logId}</code></p>` : "";
+          const logIdHtml = logId ? `<p style="color: #888; font-size: 0.85em;">Log ID: <code>${escapeHtml(logId)}</code></p>` : "";
           res.writeHead(200, {
-            "Content-Type": "text/html"
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store"
           });
           res.end(`
             <!DOCTYPE html>
@@ -40866,7 +41130,7 @@ function startCallbackServer(timeoutMs = 3e5) {
             <body style="font-family: system-ui; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e;">
               <div style="text-align: center; color: white; max-width: 500px; padding: 0 20px;">
                 <h1 style="color: #ff6b6b;">Connection Failed</h1>
-                <p style="color: #ccc;">Error: ${error}</p>
+                <p style="color: #ccc;">Authentication failed. Return to the terminal for details.</p>
                 ${logIdHtml}
                 <p style="color: #888;">You can close this window and try again.</p>
               </div>
@@ -40881,7 +41145,8 @@ function startCallbackServer(timeoutMs = 3e5) {
           });
         } else if (connectionId) {
           res.writeHead(200, {
-            "Content-Type": "text/html"
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store"
           });
           res.end(`
             <!DOCTYPE html>
@@ -40915,7 +41180,7 @@ function startCallbackServer(timeoutMs = 3e5) {
         res.end("Not found");
       }
     });
-    server.listen(CALLBACK_PORT, () => {
+    server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
     });
     setTimeout(() => {
       if (!resolved) {
@@ -40978,6 +41243,7 @@ async function executeNonInteractive12(context, action, cmdOptions) {
     authMethod: cmdOptions?.authMethod,
     scopes: cmdOptions?.scopes,
     hideSensitive: cmdOptions?.hideSensitive === "true",
+    accountLabel: cmdOptions?.accountLabel,
     // Trigger options
     triggers: cmdOptions?.triggers,
     customWebhook: cmdOptions?.customWebhook === true,
@@ -41616,22 +41882,13 @@ Available triggers for ${selectedIntegration.name}:`);
     writeInfo(`Note: Could not fetch available triggers (${error.message})`);
   }
   writeProgress("\u{1F504} Preparing authorization...");
-  const state = Buffer.from(JSON.stringify({
-    agentId: context.agentId,
-    integration: selectedIntegration.value,
-    authMethod,
-    timestamp: Date.now()
-  })).toString("base64");
-  const externalXref = JSON.stringify({
-    agentId: context.agentId,
-    userId: context.userId
-  });
+  const state = createOAuthState();
   const authUrlResult = await context.unifiedToApi.getAuthUrl(selectedIntegration.value, {
+    agentId: context.agentId,
     successRedirect: CALLBACK_URL,
     failureRedirect: CALLBACK_URL,
     scopes: authMethod === "oauth" ? selectedScopes : void 0,
-    state,
-    externalXref
+    state
   });
   if (!authUrlResult.success || !authUrlResult.data) {
     writeError(`\u274C Failed to get authorization URL: ${authUrlResult.error?.message || "Unknown error"}`);
@@ -41647,7 +41904,7 @@ Integration: ${selectedIntegration.name}`);
 \u{1F4CB} Authorization URL (copy if browser doesn't open):
    ${authUrl}
 `);
-  const callbackPromise = startCallbackServer(3e5);
+  const callbackPromise = startCallbackServer(state, 3e5);
   try {
     await open5(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
@@ -41663,7 +41920,7 @@ Integration: ${selectedIntegration.name}`);
       triggers: selectedTriggers,
       webhookUrl,
       isCustomWebhook
-    });
+    }, options.accountLabel);
   } else {
     writeError(`
 \u274C Authorization failed: ${result.error || "Unknown error"}`);
@@ -41686,8 +41943,22 @@ async function finalizeConnection(context, integration, connectionId, scopes, hi
   triggers: [],
   webhookUrl: "",
   isCustomWebhook: false
-}) {
+}, requestedAccountLabel) {
   writeProgress(`\u{1F504} Setting up ${integration.name} connection...`);
+  let displayName = requestedAccountLabel?.trim();
+  if (!displayName) {
+    const labelAnswer = await safePrompt([
+      {
+        type: "input",
+        name: "displayName",
+        message: "Account label (used to distinguish this connection):",
+        default: integration.name,
+        validate: /* @__PURE__ */ __name((value) => value.trim().length > 0 || "Account label is required", "validate")
+      }
+    ]);
+    if (!labelAnswer) return;
+    displayName = labelAnswer.displayName.trim();
+  }
   const triggers = webhookConfig.triggers.map((t) => ({
     objectType: t.objectType,
     event: t.event,
@@ -41697,6 +41968,7 @@ async function finalizeConnection(context, integration, connectionId, scopes, hi
   const result = await context.unifiedToApi.finalizeConnection(context.agentId, {
     connectionId,
     integrationType: integration.value,
+    displayName,
     scopes: scopes.length > 0 ? scopes : void 0,
     hideSensitive,
     triggers: triggers.length > 0 ? triggers : void 0
@@ -42049,22 +42321,13 @@ Available scopes for ${selectedIntegration.name}:`);
     writeError(`\u274C Failed to remove old connection: ${error.message}`);
     return;
   }
-  const state = Buffer.from(JSON.stringify({
-    agentId: context.agentId,
-    integration: selectedIntegration.value,
-    authMethod: "oauth",
-    timestamp: Date.now()
-  })).toString("base64");
-  const externalXref = JSON.stringify({
-    agentId: context.agentId,
-    userId: context.userId
-  });
+  const state = createOAuthState();
   const authUrlResult = await context.unifiedToApi.getAuthUrl(selectedIntegration.value, {
+    agentId: context.agentId,
     successRedirect: CALLBACK_URL,
     failureRedirect: CALLBACK_URL,
     scopes: selectedScopes,
-    state,
-    externalXref
+    state
   });
   if (!authUrlResult.success || !authUrlResult.data) {
     writeError(`\u274C Failed to get authorization URL: ${authUrlResult.error?.message || "Unknown error"}`);
@@ -42078,7 +42341,7 @@ Available scopes for ${selectedIntegration.name}:`);
 \u{1F4CB} Authorization URL (copy if browser doesn't open):
    ${authUrl}
 `);
-  const callbackPromise = startCallbackServer(3e5);
+  const callbackPromise = startCallbackServer(state, 3e5);
   try {
     await open5(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
@@ -42114,7 +42377,7 @@ Available scopes for ${selectedIntegration.name}:`);
       triggers: triggersToRestore,
       webhookUrl: AGENT_WEBHOOK_URL,
       isCustomWebhook: hasCustomWebhook
-    });
+    }, options.accountLabel);
     if (triggersToRestore.length > 0) {
       writeSuccess(`Restored ${triggersToRestore.length} trigger(s) from previous connection`);
     }
@@ -46377,7 +46640,7 @@ Examples:
   $ lua mcp deactivate --server-name api-server Deactivate a server
   $ lua mcp delete --server-name old-server     Delete a server
 `).action(mcpCommand);
-  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--connection-id <id>", "Connection ID to disconnect or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval for virtual webhooks (60, 120, 240, 480, 720, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for info and webhooks events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
+  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--connection-id <id>", "Connection ID to disconnect or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval for virtual webhooks (60, 120, 240, 480, 720, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for info and webhooks events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
 Arguments:
   action                 Optional: 'connect', 'update', 'list', 'available', 'info', 'disconnect', 'webhooks'
                          (alias: 'triggers'), or 'mcp'