lua-cli 3.23.0 → 3.23.2

package/dist/index.js

@@ -896,9 +896,13 @@ function isMcpDraftCreateTool(tool) {
   return tokens[0] === "draft" || tokens.some((t) => MCP_DRAFT_CREATE_VERBS.has(t));
 }
 function mcpSendSiblingForDraftTool(tool, availableToolIds) {
-  const sibling = `${tool.split("_")[0]}${REVIEWABLE_MCP_SEND_TOOL_SUFFIX}`;
-  for (const id of availableToolIds) if (id === sibling) return sibling;
-  return void 0;
+  const candidates = [
+    ...availableToolIds
+  ].filter((id) => id.endsWith(REVIEWABLE_MCP_SEND_TOOL_SUFFIX)).map((id) => ({
+    id,
+    serverName: id.slice(0, -REVIEWABLE_MCP_SEND_TOOL_SUFFIX.length)
+  })).filter(({ serverName }) => tool.startsWith(`${serverName}_`)).sort((a, b) => b.serverName.length - a.serverName.length);
+  return candidates[0]?.id;
 }
 function isReviewableExecuteTool(tool) {
   return isAllowedReviewableExecuteTool(tool) || isReviewableMcpSendTool(tool);
@@ -1136,6 +1140,20 @@ function foldRichPartsIntoMessages(messages, records, makeMessage, sameTurnGroup
   while (next < synthetic.length) combined.push(synthetic[next++].message);
   return mergeRichPartMirrorMessages(combined, sameTurnGroup);
 }
+function isDesktopFileCommandName(value) {
+  return typeof value === "string" && DESKTOP_FILE_COMMAND_SET.has(value);
+}
+function isDesktopFileSessionId(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+function resolveRequireToolApproval(rules) {
+  const raw = rules?.requireToolApproval ?? rules?.requireApproval;
+  if (raw === void 0 || raw === null) return void 0;
+  const list = Array.isArray(raw) ? raw : [
+    raw
+  ];
+  return list.filter((t) => typeof t === "string");
+}
 function buildDefaultPersona(agentName) {
   return DEFAULT_PERSONA_GUIDE.replace(AGENT_NAME_TOKEN, () => agentName || "My Agent");
 }
@@ -1155,7 +1173,7 @@ function normalizeLuaJobExecutionTimeoutSeconds(timeout) {
   }
   return Math.min(Math.max(timeout, LUA_JOB_MIN_TIMEOUT_SECONDS), LUA_JOB_MAX_TIMEOUT_SECONDS);
 }
-var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, REASONING_EFFORT_VALUES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, AGENT_LOG_SOURCES, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS;
+var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, AGENT_LOG_SOURCES, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1189,7 +1207,7 @@ var init_dist = __esm({
     REVIEWABLE_MCP_SEND_TOOL_SUFFIX = "_create_messaging_message";
     __name(isReviewableMcpSendTool, "isReviewableMcpSendTool");
     __name2(isReviewableMcpSendTool, "isReviewableMcpSendTool");
-    MCP_TOOL_READ_VERB_RE = /^(list|get|search|read|fetch|find|query|describe|count|retrieve|lookup|show|view)(_|[A-Z0-9]|$)/;
+    MCP_TOOL_READ_VERB_RE = /(?:^|_)(list|get|search|read|fetch|find|query|describe|count|retrieve|lookup|show|view)(_|[A-Z0-9]|$)/;
     __name(mcpActionTokens, "mcpActionTokens");
     __name2(mcpActionTokens, "mcpActionTokens");
     __name(isReviewableMcpDraftTool, "isReviewableMcpDraftTool");
@@ -1440,6 +1458,27 @@ var init_dist = __esm({
       }
     ];
     BROWSER_COMMAND_NAMES = BROWSER_COMMANDS.map((c) => c.name);
+    DESKTOP_FILE_COMMANDS = [
+      "files_roots",
+      "files_stat",
+      "files_list",
+      "files_read",
+      "files_search",
+      "files_write",
+      "files_mkdir",
+      "files_move",
+      "files_delete",
+      "files_undo",
+      "files_transfer_prepare",
+      "files_transfer_upload",
+      "files_watch_start",
+      "files_watch_cancel"
+    ];
+    DESKTOP_FILE_COMMAND_SET = new Set(DESKTOP_FILE_COMMANDS);
+    __name(isDesktopFileCommandName, "isDesktopFileCommandName");
+    __name2(isDesktopFileCommandName, "isDesktopFileCommandName");
+    __name(isDesktopFileSessionId, "isDesktopFileSessionId");
+    __name2(isDesktopFileSessionId, "isDesktopFileSessionId");
     REASONING_EFFORT_VALUES = [
       "off",
       "minimal",
@@ -1448,6 +1487,8 @@ var init_dist = __esm({
       "high",
       "max"
     ];
+    __name(resolveRequireToolApproval, "resolveRequireToolApproval");
+    __name2(resolveRequireToolApproval, "resolveRequireToolApproval");
     AGENT_NAME_TOKEN = "[Your Agent Name]";
     DEFAULT_PERSONA_GUIDE = `# ${AGENT_NAME_TOKEN} - Persona
 
@@ -15051,7 +15092,7 @@ export const governance = {
   }
   if (setup.requireApproval && setup.requireApproval.length > 0) {
     const list = setup.requireApproval.map((t) => `'${t}'`).join(", ");
-    ruleLines.push(`    requireApproval: [${list}],`);
+    ruleLines.push(`    requireToolApproval: [${list}],`);
   }
   if (setup.tokenLimit && setup.tokenLimit > 0) {
     ruleLines.push(`    tokenBudget: ${setup.tokenLimit},`);
@@ -19962,6 +20003,15 @@ var DeviceTriggerApi = class extends HttpClient {
 
 // src/primitives/device-trigger.handler.ts
 init_base_handler();
+
+// src/primitives/device-trigger.response.ts
+function parseDeviceTriggerList(data) {
+  const triggers = data?.triggers ?? data?.deviceTriggers;
+  return Array.isArray(triggers) ? triggers : null;
+}
+__name(parseDeviceTriggerList, "parseDeviceTriggerList");
+
+// src/primitives/device-trigger.handler.ts
 var DeviceTriggerHandler = class extends BaseVersionedHandler {
   static {
     __name(this, "DeviceTriggerHandler");
@@ -20001,10 +20051,10 @@ var DeviceTriggerHandler = class extends BaseVersionedHandler {
   }
   async fetchFromServer(api) {
     const response = await api.getDeviceTriggers();
-    if (!response.success || !response.data?.deviceTriggers) {
+    if (!response.success) {
       return null;
     }
-    return response.data.deviceTriggers;
+    return parseDeviceTriggerList(response.data);
   }
   async createOnServer(api, primitive) {
     const response = await api.createDeviceTrigger({
@@ -26211,15 +26261,18 @@ var ChatApi = class extends HttpClient {
     }
   }
   /**
-  * Clears the authenticated user's conversation history for an agent
+  * Clears conversation history for an agent. Without targetIdentifier this is
+  * self-scoped; cross-user clears require org:manage for the agent on the server.
   * @param agentId - The unique identifier of the agent
   * @param threadId - Optional thread ID to clear a specific conversation thread
+  * @param targetIdentifier - Optional target user ID, email, or mobile number
   * @returns Promise resolving to an ApiResponse with confirmation
   * @throws Error if the agent is not found or the clear operation fails
   */
-  async clearHistory(agentId, threadId) {
+  async clearHistory(agentId, threadId, targetIdentifier) {
     const params = new URLSearchParams();
     if (threadId) params.set("threadId", threadId);
+    if (targetIdentifier !== void 0) params.set("targetIdentifier", targetIdentifier);
     const query = params.toString() ? `?${params.toString()}` : "";
     const url = `/chat/history/${agentId}${query}`;
     return this.httpDelete(url, {
@@ -27651,22 +27704,24 @@ init_analytics();
 async function chatClearCommand(options, command) {
   return withErrorHandling(async () => {
     const resolvedOptions = options ?? {};
-    if (resolvedOptions.user) {
-      throw new Error("The --user option was removed: cross-user history clear is no longer supported. This command only clears your own chat history \u2014 re-run it without --user.");
+    const targetIdentifier = resolvedOptions.user?.trim();
+    if (resolvedOptions.user !== void 0 && !targetIdentifier) {
+      throw new Error("--user requires a non-empty user ID, email address, or mobile number.");
     }
     const { agentId, apiKey } = await initializeCommand();
     const threadId = resolvedOptions.thread ?? command?.parent?.opts()?.thread;
     const force = !!resolvedOptions.force;
     const threadContext = threadId ? ` in thread "${threadId}"` : "";
+    const targetContext = targetIdentifier ? ` for user "${targetIdentifier}"` : "";
     if (!force) {
       console.log(`
-\u26A0\uFE0F  WARNING: This will clear your conversation history${threadContext}!`);
+\u26A0\uFE0F  WARNING: This will clear conversation history${targetContext}${threadContext}!`);
       console.log("\u26A0\uFE0F  This action cannot be undone.\n");
       const confirmAnswer = await safePrompt([
         {
           type: "confirm",
           name: "confirm",
-          message: `Are you sure you want to clear your conversation history${threadContext}?`,
+          message: `Are you sure you want to clear conversation history${targetContext}${threadContext}?`,
           default: false
         }
       ]);
@@ -27676,16 +27731,17 @@ async function chatClearCommand(options, command) {
     }
     writeProgress("\u{1F504} Clearing conversation history...");
     const chatApi = new ChatApi(BASE_URLS.CHAT, apiKey);
-    const response = await chatApi.clearHistory(agentId, threadId);
+    const response = await chatApi.clearHistory(agentId, threadId, targetIdentifier);
     if (!response.success) {
       throw new Error(response.error?.message || "Failed to clear conversation history");
     }
-    writeSuccess(`\u2705 Your conversation history has been cleared${threadContext}`);
-    console.log(`\u{1F4A1} Your chat history has been completely removed${threadContext}.
+    writeSuccess(`\u2705 Conversation history has been cleared${targetContext}${threadContext}`);
+    console.log(`\u{1F4A1} Chat history has been completely removed${targetContext}${threadContext}.
 `);
     trackEvent("cli_chat_cleared", {
       force_mode: force,
-      has_thread_target: !!threadId
+      has_thread_target: !!threadId,
+      has_user_target: !!targetIdentifier
     });
   }, "chat clear");
 }
@@ -29787,13 +29843,47 @@ init_cli();
 init_command_utils();
 init_analytics();
 import open from "open";
+
+// src/utils/auth-handoff.ts
+init_constants();
+async function issueAdminHandoff(apiKey) {
+  const response = await fetch(`${BASE_URLS.AUTH}/auth/handoff`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      audience: "admin"
+    })
+  });
+  if (!response.ok) throw new Error("Could not create a secure dashboard sign-in handoff");
+  const body = await response.json();
+  if (typeof body.code !== "string" || !body.code) {
+    throw new Error("Lua Auth returned an invalid dashboard sign-in handoff");
+  }
+  return body.code;
+}
+__name(issueAdminHandoff, "issueAdminHandoff");
+function buildAdminHandoffUrl(code, agentId, orgId) {
+  const url = new URL("/auth-handoff", "https://admin.heylua.ai");
+  url.searchParams.set("code", code);
+  url.searchParams.set("redirect", "/admin/usage");
+  url.searchParams.set("agentId", agentId);
+  url.searchParams.set("orgId", orgId);
+  return url.toString();
+}
+__name(buildAdminHandoffUrl, "buildAdminHandoffUrl");
+
+// src/commands/admin.ts
 async function adminCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Admin Dashboard...");
     const { agentId, orgId, apiKey } = await initializeCommand({
       showProgress: false
     });
-    const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
+    const handoffCode = await issueAdminHandoff(apiKey);
+    const adminUrl = buildAdminHandoffUrl(handoffCode, agentId, orgId);
     await open(adminUrl);
     writeSuccess("Lua Admin Dashboard opened in your browser");
     console.log(`
@@ -29848,10 +29938,10 @@ async function docsCommand() {
 __name(docsCommand, "docsCommand");
 
 // src/commands/channels.ts
-init_cli();
-init_command_utils();
 import inquirer12 from "inquirer";
 import open4 from "open";
+init_cli();
+init_command_utils();
 
 // src/api/channels.api.service.ts
 init_http_client();
@@ -30419,7 +30509,8 @@ async function openAdminDashboard(apiKey, config) {
   if (!orgId) {
     throw new Error("No orgId found in lua.skill.yaml. Please ensure your configuration is valid.");
   }
-  const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
+  const handoffCode = await issueAdminHandoff(apiKey);
+  const adminUrl = buildAdminHandoffUrl(handoffCode, agentId, orgId);
   await open4(adminUrl);
   writeSuccess("\u2705 Lua Admin Dashboard opened in your browser");
   console.log(`
@@ -41158,6 +41249,7 @@ async function executeNonInteractive12(context, action, cmdOptions) {
     authMethod: cmdOptions?.authMethod,
     scopes: cmdOptions?.scopes,
     hideSensitive: cmdOptions?.hideSensitive === "true",
+    accountLabel: cmdOptions?.accountLabel,
     // Trigger options
     triggers: cmdOptions?.triggers,
     customWebhook: cmdOptions?.customWebhook === true,
@@ -41834,7 +41926,7 @@ Integration: ${selectedIntegration.name}`);
       triggers: selectedTriggers,
       webhookUrl,
       isCustomWebhook
-    });
+    }, options.accountLabel);
   } else {
     writeError(`
 \u274C Authorization failed: ${result.error || "Unknown error"}`);
@@ -41857,8 +41949,22 @@ async function finalizeConnection(context, integration, connectionId, scopes, hi
   triggers: [],
   webhookUrl: "",
   isCustomWebhook: false
-}) {
+}, requestedAccountLabel) {
   writeProgress(`\u{1F504} Setting up ${integration.name} connection...`);
+  let displayName = requestedAccountLabel?.trim();
+  if (!displayName) {
+    const labelAnswer = await safePrompt([
+      {
+        type: "input",
+        name: "displayName",
+        message: "Account label (used to distinguish this connection):",
+        default: integration.name,
+        validate: /* @__PURE__ */ __name((value) => value.trim().length > 0 || "Account label is required", "validate")
+      }
+    ]);
+    if (!labelAnswer) return;
+    displayName = labelAnswer.displayName.trim();
+  }
   const triggers = webhookConfig.triggers.map((t) => ({
     objectType: t.objectType,
     event: t.event,
@@ -41868,6 +41974,7 @@ async function finalizeConnection(context, integration, connectionId, scopes, hi
   const result = await context.unifiedToApi.finalizeConnection(context.agentId, {
     connectionId,
     integrationType: integration.value,
+    displayName,
     scopes: scopes.length > 0 ? scopes : void 0,
     hideSensitive,
     triggers: triggers.length > 0 ? triggers : void 0
@@ -42276,7 +42383,7 @@ Available scopes for ${selectedIntegration.name}:`);
       triggers: triggersToRestore,
       webhookUrl: AGENT_WEBHOOK_URL,
       isCustomWebhook: hasCustomWebhook
-    });
+    }, options.accountLabel);
     if (triggersToRestore.length > 0) {
       writeSuccess(`Restored ${triggersToRestore.length} trigger(s) from previous connection`);
     }
@@ -46279,16 +46386,19 @@ Examples:
   $ lua chat -b "Hello" "What is the weather?" "Tell me a joke" -d 2000 -e sandbox  Batch test
   $ lua chat --agent-version 3 -m "test"         Preview agent version 3 in an isolated thread
 `).action(chatCommand);
-  chatCmd.command("clear").description("Clear your conversation history").option("--user <identifier>", "[removed] cross-user history clear is no longer supported").option("-t, --thread <id>", "Clear a specific thread's history instead of all history").option("--force", "Skip confirmation prompt").addHelpText("after", `
+  chatCmd.command("clear").description("Clear your own or an administered user's conversation history").option("--user <identifier>", "Clear another user by ID, email, or mobile (requires org:manage)").option("-t, --thread <id>", "Clear a specific thread's history instead of all history").option("--force", "Skip confirmation prompt").addHelpText("after", `
 Examples:
   $ lua chat clear                                   Clear your history
   $ lua chat clear --force                           Clear your history without confirmation
+  $ lua chat clear --user user@example.com           Clear another user's history (requires org:manage)
+  $ lua chat clear --user +1234567890 --force        Clear another user's history without confirmation
   $ lua chat clear --thread <threadId>               Clear a specific thread's history
   $ lua chat clear --thread <threadId> --force       Clear a specific thread's history without confirmation
 
 Notes:
-  - This command only clears YOUR OWN conversation history
-  - The --user option was removed: cross-user history clear is no longer supported
+  - Without --user, this command clears only YOUR OWN conversation history
+  - --user requires org:manage for the agent
+  - Org-admin grants do not cascade to private agents; org owners and explicit agent grants follow shared authorization rules
 `).action(chatClearCommand);
   program2.command("env [environment]").description("\u2699\uFE0F  Manage environment variables").option("-k, --key <name>", "Environment variable key").option("-v, --value <value>", "Environment variable value").option("-d, --delete", "Delete the specified key").option("--list", "List all environment variables").addHelpText("after", `
 Arguments:
@@ -46539,7 +46649,7 @@ Examples:
   $ lua mcp deactivate --server-name api-server Deactivate a server
   $ lua mcp delete --server-name old-server     Delete a server
 `).action(mcpCommand);
-  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--connection-id <id>", "Connection ID to disconnect or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval for virtual webhooks (60, 120, 240, 480, 720, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for info and webhooks events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
+  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--connection-id <id>", "Connection ID to disconnect or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval for virtual webhooks (60, 120, 240, 480, 720, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for info and webhooks events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
 Arguments:
   action                 Optional: 'connect', 'update', 'list', 'available', 'info', 'disconnect', 'webhooks'
                          (alias: 'triggers'), or 'mcp'