lua-cli 3.25.0 → 3.27.0

package/dist/index.js

@@ -1160,6 +1160,9 @@ function resolveRequireToolApproval(rules) {
 function buildDefaultPersona(agentName) {
   return DEFAULT_PERSONA_GUIDE.replace(AGENT_NAME_TOKEN, () => agentName || "My Agent");
 }
+function buildPersonalSpaceStartingPersona(agentName) {
+  return PERSONAL_SPACE_STARTING_PERSONA.replace(new RegExp(AGENT_NAME_TOKEN.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), () => agentName || "Your assistant");
+}
 function resolveLuaJobTimeoutSeconds(timeout) {
   const resolved = timeout ?? LUA_JOB_DEFAULT_TIMEOUT_SECONDS;
   if (!Number.isInteger(resolved)) {
@@ -1176,7 +1179,7 @@ function normalizeLuaJobExecutionTimeoutSeconds(timeout) {
   }
   return Math.min(Math.max(timeout, LUA_JOB_MIN_TIMEOUT_SECONDS), LUA_JOB_MAX_TIMEOUT_SECONDS);
 }
-var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, AGENT_LOG_SOURCES, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS;
+var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1547,6 +1550,40 @@ Feel free to add, remove, or rename sections. Your persona can be a single parag
 `;
     __name(buildDefaultPersona, "buildDefaultPersona");
     __name2(buildDefaultPersona, "buildDefaultPersona");
+    PERSONAL_SPACE_STARTING_PERSONA = `# ${AGENT_NAME_TOKEN}
+
+You are ${AGENT_NAME_TOKEN}, the assistant for whoever is chatting with you here. Your job is simple: help them get things done, and get better at it every day.
+
+## You're just getting started
+
+This workspace is new. What you already know about the person lives in your memory \u2014 the "Known about this user" notes are verified facts, so use them like you've known them all along; never say you don't know something that's written there. Beyond that, don't pretend. Pay attention instead: how they write, what they ask for, what they're working on. When something matters and you're not sure, ask. One good question beats a wrong guess.
+
+## You have real tools
+
+You can do a lot more than talk. Use your tools when they help, and be straight about what worked and what didn't. The more you learn, the more you can take off their plate without being asked.
+
+## How you sound
+
+Like a sharp, warm human who's on their side. Plain words. Short sentences when short works. React like a person would: if something's great, say so; if something's off, say that too. No corporate filler, no fake enthusiasm.
+
+## What you hold yourself to
+
+- Never make up facts about the person, and never claim you did something you didn't.
+- What you learn about them serves them. Nothing else.
+- If you can't do something, say so and offer what you can do.
+
+## Where you come from
+
+You live on Lua, the platform this workspace runs on. Lua gives people AI agents that do real work for them, and it lives at heylua.ai. It was founded by Lorcan (CEO) and Stefan (CTO).
+
+If someone asks about Lua itself, have fun with it. It's your hometown, so show them around like a proud local: keep the facts straight, keep the delivery playful and a little whimsical. For anything you don't know (pricing, plans, roadmap), point them to heylua.ai instead of guessing.
+
+## Keep this persona alive
+
+This text is who you are for this person. As you learn them, their name, their work, what they care about, update it so tomorrow's you starts smarter than today's. Keep it about who they are and who you are for them.
+`;
+    __name(buildPersonalSpaceStartingPersona, "buildPersonalSpaceStartingPersona");
+    __name2(buildPersonalSpaceStartingPersona, "buildPersonalSpaceStartingPersona");
     AGENT_LOG_SOURCES = [
       "skill",
       "job",
@@ -3298,6 +3335,7 @@ var init_files = __esm({
       "preprocessors",
       "postprocessors",
       "mcpServers",
+      "template",
       "skill"
     ];
     __name(yamlKeySorter, "yamlKeySorter");
@@ -13107,6 +13145,43 @@ var init_ai_api_service = __esm({
   }
 });
 
+// src/api/integrations.api.service.ts
+var IntegrationsApiService;
+var init_integrations_api_service = __esm({
+  "src/api/integrations.api.service.ts"() {
+    "use strict";
+    init_http_client();
+    IntegrationsApiService = class extends HttpClient {
+      static {
+        __name(this, "IntegrationsApiService");
+      }
+      apiKey;
+      agentId;
+      constructor(baseUrl, apiKey, agentId) {
+        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      }
+      async passthrough(integrationType, request2) {
+        return this.httpPost(`/developer/unifiedto/connections/${encodeURIComponent(this.agentId)}/passthrough/${encodeURIComponent(integrationType)}`, request2, {
+          Authorization: `Bearer ${this.apiKey}`
+        });
+      }
+      /**
+      * Sandbox-facing wrapper: returns the raw provider envelope
+      * `{ status, headers, data }` (provider error statuses relayed faithfully in
+      * `status`), and throws only on route-level failures (no connection,
+      * passthrough disabled, rate limited, transport error).
+      */
+      async passthroughForSandbox(integrationType, request2) {
+        const result = await this.passthrough(integrationType, request2);
+        if (!result.success || !result.data) {
+          throw new Error(result.error?.message || `Integration passthrough failed for '${integrationType}'`);
+        }
+        return result.data;
+      }
+    };
+  }
+});
+
 // src/api/agents.api.service.ts
 var AgentsApiService;
 var init_agents_api_service = __esm({
@@ -13853,6 +13928,7 @@ __export(lazy_instances_exports, {
   getDeviceInstance: () => getDeviceInstance,
   getDirectoryInstance: () => getDirectoryInstance,
   getInboxPushInstance: () => getInboxPushInstance,
+  getIntegrationsInstance: () => getIntegrationsInstance,
   getJobInstance: () => getJobInstance,
   getOrderInstance: () => getOrderInstance,
   getProductsInstance: () => getProductsInstance,
@@ -13917,6 +13993,13 @@ async function getAiInstance() {
   }
   return _aiInstance;
 }
+async function getIntegrationsInstance() {
+  if (!_integrationsInstance) {
+    const creds = await getCredentials();
+    _integrationsInstance = new IntegrationsApiService(BASE_URLS.API, creds.apiKey, creds.agentId);
+  }
+  return _integrationsInstance;
+}
 async function getAgentsInstance() {
   if (!_agentsInstance) {
     const creds = await getCredentials();
@@ -13998,7 +14081,7 @@ function clearAllInstances() {
   _channelsSendInstance = null;
   _directoryInstance = null;
 }
-var _userInstance, _dataInstance, _productsInstance, _basketsInstance, _orderInstance, _webhookInstance, _jobInstance, _aiInstance, _agentsInstance, _whatsAppTemplatesInstance, _cdnInstance, _developerInstance, _voiceInstance, _channelsSendInstance, _directoryInstance, _deviceInstance, _inboxPushInstance;
+var _userInstance, _dataInstance, _productsInstance, _basketsInstance, _orderInstance, _webhookInstance, _jobInstance, _aiInstance, _integrationsInstance, _agentsInstance, _whatsAppTemplatesInstance, _cdnInstance, _developerInstance, _voiceInstance, _channelsSendInstance, _directoryInstance, _deviceInstance, _inboxPushInstance;
 var init_lazy_instances = __esm({
   "src/api/lazy-instances.ts"() {
     "use strict";
@@ -14012,6 +14095,7 @@ var init_lazy_instances = __esm({
     init_webhook_api_service();
     init_job_api_service();
     init_ai_api_service();
+    init_integrations_api_service();
     init_agents_api_service();
     init_whatsapp_templates_api_service();
     init_cdn_api_service();
@@ -14028,6 +14112,7 @@ var init_lazy_instances = __esm({
     _webhookInstance = null;
     _jobInstance = null;
     _aiInstance = null;
+    _integrationsInstance = null;
     _agentsInstance = null;
     _whatsAppTemplatesInstance = null;
     _cdnInstance = null;
@@ -14043,6 +14128,7 @@ var init_lazy_instances = __esm({
     __name(getWebhookInstance, "getWebhookInstance");
     __name(getJobInstance, "getJobInstance");
     __name(getAiInstance, "getAiInstance");
+    __name(getIntegrationsInstance, "getIntegrationsInstance");
     __name(getAgentsInstance, "getAgentsInstance");
     __name(getWhatsAppTemplatesInstance, "getWhatsAppTemplatesInstance");
     __name(getCdnInstance, "getCdnInstance");
@@ -21850,6 +21936,16 @@ function createSandbox(options) {
         return agents.invokeForSandbox(targetAgentId, promptOrInput);
       }, "invoke")
     },
+    // Unified.to raw provider passthrough (PRO-209). Proxied via the same
+    // bearer-auth developer route the api-exports `Integrations` namespace
+    // uses, so `lua test` matches production behavior.
+    Integrations: {
+      passthrough: /* @__PURE__ */ __name(async (integrationType, request2) => {
+        const { getIntegrationsInstance: getIntegrationsInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
+        const integrations = await getIntegrationsInstance2();
+        return integrations.passthroughForSandbox(integrationType, request2);
+      }, "passthrough")
+    },
     // Outbound voice dispatch (BAC-212). `lua test` proxies via the same
     // bearer-auth developer endpoint the lua-cli `Voice.call` namespace uses
     // — keeps the surface byte-equivalent to the lua-core production VM
@@ -22652,12 +22748,14 @@ var ALIAS_MAP = {
       "available",
       "info",
       "disconnect",
+      "convert",
       "webhooks",
       "mcp"
     ],
     aliases: lowerKeys({
       add: "connect",
       link: "connect",
+      claim: "convert",
       edit: "update",
       modify: "update",
       ls: "list",
@@ -22792,6 +22890,7 @@ var ALIAS_MAP = {
   "template.action": {
     canonical: [
       "create",
+      "draft",
       "publish",
       "view",
       "versions",
@@ -22803,6 +22902,7 @@ var ALIAS_MAP = {
     ],
     aliases: lowerKeys({
       new: "create",
+      compose: "draft",
       publish_version: "publish",
       submit: "publish",
       show: "view",
@@ -37935,6 +38035,13 @@ var TemplateApiService = class {
       body: JSON.stringify(data)
     });
   }
+  /** T11.3 — draft composer (the clean `/templates/*` route home). */
+  async composeDraft(templateId, data) {
+    return this._fetch(`/templates/${templateId}/versions/draft`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
   async listTemplates() {
     return this._fetch("/marketplace/templates");
   }
@@ -37991,12 +38098,14 @@ var TemplateApiService = class {
 // src/commands/template.ts
 init_command_utils();
 init_analytics();
+init_files();
 function showTemplateUsage() {
   console.log("\nUsage:");
   console.log("  lua marketplace template                       Interactive mode");
   console.log("  lua marketplace template <action> [options]    Non-interactive mode");
   console.log("\nActions:");
   console.log("  create     --name <n> --display-name <n> [--description <text>] [--visibility public|private]");
+  console.log("  draft      --template-id <id> [--source-version <n>] [--force]   Compose/merge the template: section of lua.skill.yaml");
   console.log("  publish    --template-id <id> [--source-version <n>] [--changelog <text>] [--env-contract KEY=desc,...]");
   console.log("  view       --template-id <id> [--version <n>] [--json]");
   console.log("  versions   --template-id <id> [--json]");
@@ -38024,6 +38133,10 @@ async function templateCommand(action, options = {}) {
             name: "Create a template from this agent",
             value: "create"
           },
+          {
+            name: "Draft the template: section from this agent",
+            value: "draft"
+          },
           {
             name: "Publish a new template version",
             value: "publish"
@@ -38073,8 +38186,11 @@ async function templateCommand(action, options = {}) {
     case "create":
       await templateCreateAction(templateApi, config, options);
       break;
+    case "draft":
+      await templateDraftAction(templateApi, options);
+      break;
     case "publish":
-      await templatePublishAction(templateApi, options);
+      await templatePublishAction(templateApi, config, options);
       break;
     case "view":
       await templateViewAction(templateApi, options);
@@ -38320,18 +38436,125 @@ async function templateCreateAction(templateApi, config, options) {
   });
 }
 __name(templateCreateAction, "templateCreateAction");
-async function templatePublishAction(templateApi, options) {
+async function templateDraftAction(templateApi, options) {
+  const config = readYamlConfig();
+  if (!config) throw new Error("No lua.skill.yaml found in this directory.");
+  const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to draft for?");
+  const sourceAgentVersion = options.sourceVersion ? Number.parseInt(options.sourceVersion, 10) : void 0;
+  if (options.sourceVersion && (!Number.isFinite(sourceAgentVersion) || sourceAgentVersion <= 0)) {
+    throw new Error(`Invalid --source-version "${options.sourceVersion}": must be a positive integer.`);
+  }
+  writeProgress("\u{1F504} Composing template draft...");
+  const result = await templateApi.composeDraft(templateId, {
+    force: options.force === true,
+    sourceAgentVersion
+  });
+  config.template = {
+    connections: result.draft.connections,
+    ...result.draft.personaTemplate ? {
+      personaTemplate: result.draft.personaTemplate
+    } : {},
+    triggerPresets: result.draft.triggerPresets,
+    paramsMeta: result.draft.paramsMeta
+  };
+  writeYamlConfig(config);
+  if (options.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  writeSuccess("\u2705 template: section written to lua.skill.yaml");
+  for (const [section2, diff] of Object.entries(result.diff)) {
+    const annotations = Object.entries(diff.annotations ?? {});
+    console.log(`  ${section2}: +${diff.added.length} added (${diff.added.join(", ") || "\u2014"}), ${diff.kept.length} kept`);
+    for (const [key, note] of annotations) {
+      console.log(`    \u26A0 ${key}: ${note}`);
+    }
+  }
+  writeHintBlock({
+    headline: "Review the drafted sections, then publish:",
+    lines: [
+      {
+        label: "Publish:",
+        command: `lua marketplace template publish --template-id ${templateId}`
+      }
+    ],
+    when: "success"
+  });
+}
+__name(templateDraftAction, "templateDraftAction");
+var TEMPLATE_SECTION_KEYS = [
+  "connections",
+  "personaTemplate",
+  "triggerPresets",
+  "paramsMeta"
+];
+function sectionKeys(section2, value) {
+  if (value === void 0 || value === null) return [];
+  if (section2 === "connections") return (value ?? []).map((entry) => entry.key);
+  if (section2 === "personaTemplate") {
+    const vars = value.vars ?? [];
+    return vars.map((v) => v.name);
+  }
+  return Object.keys(value);
+}
+__name(sectionKeys, "sectionKeys");
+async function confirmTemplateSectionConsequences(templateApi, templateId, local, force) {
+  const versions = await templateApi.getVersions(templateId).catch(() => []);
+  const latest = [
+    ...versions
+  ].sort((a, b) => b.version - a.version)[0];
+  if (!latest) return;
+  const consequences = [];
+  const consequenceCopy = {
+    connections: "installed agents keep their binding; new installs will not be prompted",
+    personaTemplate: "new installs get no persona template; installed personas are untouched",
+    triggerPresets: "new installs fall back to default arming recommendations",
+    paramsMeta: "the deploy form falls back to derived display names and string typing"
+  };
+  for (const section2 of TEMPLATE_SECTION_KEYS) {
+    const serverKeys = sectionKeys(section2, latest[section2]);
+    const localKeys = sectionKeys(section2, local[section2]);
+    const removed = serverKeys.filter((key) => !localKeys.includes(key));
+    if (!removed.length) continue;
+    const clearing = localKeys.length === 0;
+    consequences.push(`  ${section2}: ${clearing ? "CLEARING the section" : `removing ${removed.join(", ")}`} \u2014 ${consequenceCopy[section2]}`);
+  }
+  if (!consequences.length) return;
+  console.log("\n\u26A0 This publish clears or narrows authored template sections:");
+  for (const line of consequences) console.log(line);
+  const isTTY = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (force || isCiModeEnabled() || !isTTY) {
+    writeInfo("Proceeding headless (diff printed above).");
+    return;
+  }
+  const confirmed = await confirmAction("\nProceed with this publish?");
+  if (!confirmed) throw new Error("Publish aborted.");
+}
+__name(confirmTemplateSectionConsequences, "confirmTemplateSectionConsequences");
+async function templatePublishAction(templateApi, config, options) {
   const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to publish a version for?");
   const sourceAgentVersion = options.sourceVersion ? Number.parseInt(options.sourceVersion, 10) : void 0;
   if (options.sourceVersion && (!Number.isFinite(sourceAgentVersion) || sourceAgentVersion <= 0)) {
     throw new Error(`Invalid --source-version "${options.sourceVersion}": must be a positive integer.`);
   }
   const envContract = parseEnvContract(options.envContract);
+  const templateSection = readYamlConfig()?.template ?? config.template;
+  let sectionBody = {};
+  if (templateSection !== void 0) {
+    await confirmTemplateSectionConsequences(templateApi, templateId, templateSection, options.force === true || options.yes === true);
+    sectionBody = {
+      connections: templateSection.connections ?? [],
+      triggerPresets: templateSection.triggerPresets ?? {},
+      personaTemplate: templateSection.personaTemplate ?? null,
+      paramsMeta: templateSection.paramsMeta ?? {}
+    };
+  }
   writeProgress("\u{1F504} Publishing template version...");
   const version = await templateApi.createVersion(templateId, {
     sourceAgentVersion,
     changelog: options.changelog || void 0,
-    envContract
+    envContract,
+    ...sectionBody
   });
   if (options.json) {
     console.log(JSON.stringify(version, null, 2));
@@ -38427,12 +38650,14 @@ async function templateInstallAction(templateApi, config, options) {
     console.error("\n\u274C Use --force to confirm installation");
     throw new Error("This action requires --force to confirm");
   }
+  if (options.skipEnvCheck) {
+    writeInfo("\u26A0\uFE0F  --skip-env-check is deprecated: the env-contract check is server-enforced; use `lua env` to satisfy the contract.");
+  }
   writeProgress("\u{1F504} Installing template...");
   const install = await templateApi.install(templateId, agentId, {
     version,
     envValues,
-    allowCreatorUpdates: options.allowCreatorUpdates,
-    skipEnvCheck: options.skipEnvCheck
+    allowCreatorUpdates: options.allowCreatorUpdates
   });
   if (options.json) {
     console.log(JSON.stringify(install, null, 2));
@@ -38539,6 +38764,9 @@ Apply v${versionObj.version} to ${targets.length} agent(s)?`);
       throw new Error("This action requires --force to confirm (non-interactive mode)");
     }
   }
+  if (options.skipEnvCheck) {
+    writeInfo("\u26A0\uFE0F  --skip-env-check is deprecated: the env-contract check is server-enforced; use `lua env` to satisfy the contract.");
+  }
   writeProgress("\u{1F504} Starting apply run...");
   const { runId } = await templateApi.apply(templateId, {
     version: versionObj.version,
@@ -41220,6 +41448,109 @@ var UnifiedToApi = class extends HttpClient {
       Authorization: `Bearer ${this.apiKey}`
     });
   }
+  // ==================== Personal (user-owned) connections ====================
+  //
+  // The whole tier is agent-free: the acting principal is the API key's owner, resolved server-side
+  // from the same /profile hop a browser session uses. None of these take an agentId — that is the
+  // point, so the signatures don't pretend otherwise.
+  /**
+  * Lists the API key owner's personal connections
+  * @returns Promise resolving to an ApiResponse containing personal connections
+  */
+  async getUserConnections() {
+    return this.httpGet("/developer/unifiedto/user-connection", {
+      Authorization: `Bearer ${this.apiKey}`
+    });
+  }
+  /**
+  * Gets a state-bound OAuth URL for a PERSONAL connection
+  * @param integrationType - The integration type
+  * @param options - Redirect pair, scopes and CSRF state
+  * @returns Promise resolving to an ApiResponse containing the authorization URL
+  */
+  async getUserAuthUrl(integrationType, options) {
+    const params = new URLSearchParams();
+    params.append("integrationType", integrationType);
+    params.append("successRedirect", options.successRedirect);
+    params.append("failureRedirect", options.failureRedirect);
+    if (options.scopes && options.scopes.length > 0) {
+      params.append("scopes", options.scopes.join(","));
+    }
+    params.append("state", options.state);
+    return this.httpGet(`/developer/unifiedto/user-connection/auth-url/v2?${params.toString()}`, {
+      Authorization: `Bearer ${this.apiKey}`
+    });
+  }
+  /**
+  * Creates a PERSONAL connection from API-key credentials
+  * @param params - Integration type and credential fields
+  * @returns Promise resolving to an ApiResponse containing the new connection id
+  */
+  async createUserTokenAuthConnection(params) {
+    return this.httpPost("/developer/unifiedto/user-connection/token-auth", params, {
+      Authorization: `Bearer ${this.apiKey}`
+    });
+  }
+  /**
+  * Finalizes a PERSONAL connection: stores it, mounts it on every private agent of the owner's,
+  * and seeds ingest triggers. Takes no displayName/hideSensitive/triggers — the user tier has none.
+  * @param params - The connection id and the OAuth scopes that were consented to
+  * @returns Promise resolving to an ApiResponse containing the agents it mounted on
+  */
+  async finalizeUserConnection(params) {
+    return this.httpPost("/developer/unifiedto/user-connection/finalize", params, {
+      Authorization: `Bearer ${this.apiKey}`
+    });
+  }
+  /**
+  * Converts an agent-owned connection you created into a personal one
+  * @param connectionId - The connection ID
+  * @returns Promise resolving to an ApiResponse containing the agents it mounted on
+  */
+  async convertConnectionToUser(connectionId) {
+    return this.httpPost("/developer/unifiedto/user-connection/convert", {
+      connectionId
+    }, {
+      Authorization: `Bearer ${this.apiKey}`
+    });
+  }
+  /**
+  * Disconnects a personal connection, sweeping every mount
+  * @param connectionId - The connection ID
+  * @param forgetMemories - Also purge what it added to memory (default true server-side)
+  * @returns Promise resolving to an ApiResponse with the number of triggers removed
+  */
+  async deleteUserConnection(connectionId, forgetMemories) {
+    return this.httpDelete(`/developer/unifiedto/user-connection/${connectionId}?forgetMemories=${forgetMemories}`, {
+      Authorization: `Bearer ${this.apiKey}`
+    });
+  }
+  /**
+  * Pauses or resumes a personal connection across every agent it is mounted on
+  * @param connectionId - The connection ID
+  * @param status - 'paused' or 'active'
+  * @returns Promise resolving to an ApiResponse with the resulting status
+  */
+  async setUserConnectionStatus(connectionId, status) {
+    return this.httpPatch(`/developer/unifiedto/user-connection/${connectionId}`, {
+      status
+    }, {
+      Authorization: `Bearer ${this.apiKey}`
+    });
+  }
+  /**
+  * Turns a personal connection's org-memory feed on or off
+  * @param connectionId - The connection ID
+  * @param memoryFeed - Whether new items from this source should be remembered
+  * @returns Promise resolving to an ApiResponse with the resulting state
+  */
+  async setUserConnectionMemoryFeed(connectionId, memoryFeed) {
+    return this.httpPatch(`/developer/unifiedto/user-connection/${connectionId}/memory-feed`, {
+      memoryFeed
+    }, {
+      Authorization: `Bearer ${this.apiKey}`
+    });
+  }
 };
 
 // src/commands/integrations.ts
@@ -41241,7 +41572,9 @@ async function fetchAvailableIntegrations(unifiedToApi, agentId) {
     authSupport: integration.authSupport,
     oauthConfigured: integration.oauthConfigured,
     oauthScopes: integration.oauthScopes,
-    tokenFields: integration.tokenFields
+    tokenFields: integration.tokenFields,
+    orgOnly: integration.orgOnly,
+    native: integration.native
   }));
 }
 __name(fetchAvailableIntegrations, "fetchAvailableIntegrations");
@@ -41410,7 +41743,9 @@ async function executeNonInteractive12(context, action, cmdOptions) {
     authMethod: cmdOptions?.authMethod,
     scopes: cmdOptions?.scopes,
     hideSensitive: cmdOptions?.hideSensitive === "true",
+    hideSensitiveProvided: cmdOptions?.hideSensitive !== void 0,
     accountLabel: cmdOptions?.accountLabel,
+    scope: cmdOptions?.scope,
     // Trigger options
     triggers: cmdOptions?.triggers,
     customWebhook: cmdOptions?.customWebhook === true,
@@ -41430,7 +41765,22 @@ async function executeNonInteractive12(context, action, cmdOptions) {
       await updateConnectionFlow(context, options);
       break;
     case "list":
-      await listConnections(context);
+      if (options.scope === "user") {
+        await listUserConnections(context);
+      } else if (options.scope === "all") {
+        await listConnections(context);
+        await listUserConnections(context);
+      } else {
+        await listConnections(context);
+      }
+      break;
+    case "convert":
+      if (!options.connectionId) {
+        console.error("\u274C --connection-id is required for convert");
+        console.log("\n\u{1F4A1} Run 'lua integrations list' to see connection IDs");
+        throw new Error("--connection-id is required for convert");
+      }
+      await convertConnectionFlow(context, options.connectionId, cmdOptions?.force === true);
       break;
     case "available":
       await listAvailableIntegrations(context);
@@ -41451,7 +41801,11 @@ async function executeNonInteractive12(context, action, cmdOptions) {
         console.log("\n\u{1F4A1} Run 'lua integrations list' to see connection IDs");
         throw new Error("--connection-id is required for disconnect");
       }
-      await disconnectIntegration(context, options.connectionId);
+      if (options.scope === "user") {
+        await disconnectUserConnection(context, options.connectionId);
+      } else {
+        await disconnectIntegration(context, options.connectionId);
+      }
       break;
     case "webhooks":
       await webhooksSubcommand(context, cmdOptions);
@@ -41490,6 +41844,10 @@ async function interactiveIntegrationsManagement(context) {
             name: "\u{1F4CB} List connected integrations",
             value: "list"
           },
+          {
+            name: "\u{1F464} List my personal connections",
+            value: "list-user"
+          },
           {
             name: "\u{1F50D} View available integrations",
             value: "available"
@@ -41525,6 +41883,9 @@ async function interactiveIntegrationsManagement(context) {
       case "list":
         await listConnections(context);
         break;
+      case "list-user":
+        await listUserConnections(context);
+        break;
       case "available":
         await listAvailableIntegrations(context);
         break;
@@ -41687,17 +42048,83 @@ async function showIntegrationInfo(context, integrationType, jsonOutput = false)
   }
 }
 __name(showIntegrationInfo, "showIntegrationInfo");
+function agentOnlyFlagsIn(options) {
+  return [
+    options.triggers && "--triggers",
+    options.customWebhook && "--custom-webhook",
+    options.hookUrl && "--hook-url",
+    options.accountLabel && "--account-label",
+    // NOT `options.hideSensitive !== undefined`: executeNonInteractive coerces that to a boolean for
+    // every run, so its presence has to be tracked separately.
+    options.hideSensitiveProvided && "--hide-sensitive"
+  ].filter((f) => typeof f === "string" && f.length > 0);
+}
+__name(agentOnlyFlagsIn, "agentOnlyFlagsIn");
+function normalizeScopeFlag(raw) {
+  if (!raw) return void 0;
+  const normalized = raw.toLowerCase();
+  if (normalized !== "agent" && normalized !== "user") {
+    console.error(`\u274C Invalid --scope: "${raw}". Use 'agent' or 'user'`);
+    throw new Error("Invalid --scope");
+  }
+  return normalized;
+}
+__name(normalizeScopeFlag, "normalizeScopeFlag");
+async function resolveConnectScope(context, options) {
+  const flagged = normalizeScopeFlag(options.scope);
+  if (flagged) return flagged;
+  const answer = await safePrompt([
+    {
+      type: "list",
+      name: "scope",
+      message: "Who should own this connection?",
+      choices: [
+        {
+          name: `\u{1F916} This agent only \u2014 ${context.agentId} keeps the credential, and loses it when the agent goes`,
+          value: "agent"
+        },
+        {
+          name: "\u{1F464} Me \u2014 every private agent I own can use it, including ones I create later",
+          value: "user"
+        }
+      ]
+    }
+  ]);
+  return answer?.scope;
+}
+__name(resolveConnectScope, "resolveConnectScope");
 async function connectIntegrationFlow(context, options = {}) {
+  const scope = await resolveConnectScope(context, options);
+  if (!scope) return;
+  const userScope = scope === "user";
+  if (userScope) {
+    const unsupported = agentOnlyFlagsIn(options);
+    if (unsupported.length > 0) {
+      console.error(`\u274C ${unsupported.join(", ")} ${unsupported.length > 1 ? "are" : "is"} agent-scoped and cannot be used with --scope user.`);
+      console.log("\u{1F4A1} Connect at agent scope, or drop the flag. Triggers can be added later on an agent connection.");
+      throw new Error("Agent-scoped options cannot be used with --scope user");
+    }
+  }
   writeProgress("\u{1F504} Fetching integrations...");
   let availableIntegrations;
+  let agentConnectedTypes = /* @__PURE__ */ new Set();
   try {
-    availableIntegrations = await fetchAvailableIntegrations(context.unifiedToApi, context.agentId);
+    availableIntegrations = await fetchAvailableIntegrations(context.unifiedToApi, userScope ? void 0 : context.agentId);
+    if (userScope) {
+      const [personal, agentConnections] = await Promise.all([
+        context.unifiedToApi.getUserConnections(),
+        context.unifiedToApi.getConnections(context.agentId)
+      ]);
+      const personalTypes = new Set((personal.data ?? []).map((c) => c.integrationType));
+      agentConnectedTypes = new Set((agentConnections.data ?? []).filter((c) => c.status !== "deleted").map((c) => c.integrationType));
+      availableIntegrations = availableIntegrations.filter((i) => !i.orgOnly && !i.native && !personalTypes.has(i.value));
+    }
   } catch (error) {
     writeError(`\u274C Failed to fetch integrations: ${error.message}`);
     return;
   }
   if (availableIntegrations.length === 0) {
-    writeInfo("All available integrations are already connected (or none are enabled).");
+    writeInfo(userScope ? "You have already connected every integration available as a personal connection." : "All available integrations are already connected (or none are enabled).");
     console.log("\u{1F4A1} Use 'lua integrations update' to change scopes on an existing connection.\n");
     return;
   }
@@ -41706,8 +42133,8 @@ async function connectIntegrationFlow(context, options = {}) {
   if (options.integration) {
     selectedIntegration = availableIntegrations.find((i) => i.value === options.integration);
     if (!selectedIntegration) {
-      console.error(`\u274C Integration "${options.integration}" not found or already connected.`);
-      console.log("\u{1F4A1} If already connected, use 'lua integrations update --integration " + options.integration + "' to change scopes.");
+      console.error(userScope ? `\u274C "${options.integration}" is not available as a personal connection.` : `\u274C Integration "${options.integration}" not found or already connected.`);
+      console.log(userScope ? "\u{1F4A1} You may already have it, or it's org-only / a memory-source connector. Run 'lua integrations list --scope user' to check." : "\u{1F4A1} If already connected, use 'lua integrations update --integration " + options.integration + "' to change scopes.");
       if (availableIntegrations.length > 0) {
         console.log("\nAvailable integrations to connect:");
         availableIntegrations.forEach((i) => console.log(`  - ${i.value} (${i.name})`));
@@ -41767,6 +42194,22 @@ async function connectIntegrationFlow(context, options = {}) {
   console.log(`   Categories: ${selectedIntegration.categories.join(", ")}`);
   console.log(`   Auth Support: ${selectedIntegration.authSupport}`);
   console.log(`   OAuth Configured: ${selectedIntegration.oauthConfigured ? "Yes" : "No"}`);
+  console.log(`   Owner: ${userScope ? "you (every private agent you own)" : `this agent (${context.agentId})`}`);
+  if (userScope && agentConnectedTypes.has(selectedIntegration.value)) {
+    writeInfo(`This agent already has its own ${selectedIntegration.name} connection. Connecting as yourself adds a SECOND credential rather than replacing it.`);
+    const proceed = await safePrompt([
+      {
+        type: "confirm",
+        name: "go",
+        message: "Continue?",
+        default: false
+      }
+    ]);
+    if (!proceed?.go) {
+      console.log("\n\u{1F4A1} To re-home the existing one instead: lua integrations convert --connection-id <id>\n");
+      return;
+    }
+  }
   const canUseOAuth = selectedIntegration.oauthConfigured && [
     "oauth",
     "both"
@@ -41892,7 +42335,8 @@ Available scopes for ${selectedIntegration.name}:`);
     console.log("\nYou will enter these on the Unified.to authorization page.\n");
   }
   let hideSensitive = false;
-  if (options.hideSensitive !== void 0) {
+  if (userScope) {
+  } else if (options.hideSensitive !== void 0) {
     hideSensitive = options.hideSensitive;
   } else {
     const sensitiveAnswer = await safePrompt([
@@ -41910,8 +42354,14 @@ Available scopes for ${selectedIntegration.name}:`);
   let selectedTriggers = [];
   let webhookUrl = AGENT_WEBHOOK_URL;
   let isCustomWebhook = false;
+  if (userScope) {
+    writeInfo("Triggers are agent-owned \u2014 skipping. Add them later on an agent connection.");
+  }
   try {
-    const eventsResult = await context.unifiedToApi.getAvailableWebhookEventsByType(selectedIntegration.value);
+    const eventsResult = userScope ? {
+      success: false,
+      data: void 0
+    } : await context.unifiedToApi.getAvailableWebhookEventsByType(selectedIntegration.value);
     if (eventsResult.success && eventsResult.data && eventsResult.data.length > 0) {
       const availableEvents = eventsResult.data;
       if (options.customWebhook || options.hookUrl) {
@@ -42050,7 +42500,12 @@ Available triggers for ${selectedIntegration.name}:`);
   }
   writeProgress("\u{1F504} Preparing authorization...");
   const state = createOAuthState();
-  const authUrlResult = await context.unifiedToApi.getAuthUrl(selectedIntegration.value, {
+  const authUrlResult = userScope ? await context.unifiedToApi.getUserAuthUrl(selectedIntegration.value, {
+    successRedirect: CALLBACK_URL,
+    failureRedirect: CALLBACK_URL,
+    scopes: authMethod === "oauth" ? selectedScopes : void 0,
+    state
+  }) : await context.unifiedToApi.getAuthUrl(selectedIntegration.value, {
     agentId: context.agentId,
     successRedirect: CALLBACK_URL,
     failureRedirect: CALLBACK_URL,
@@ -42083,11 +42538,15 @@ Integration: ${selectedIntegration.name}`);
   const result = await callbackPromise;
   if (result.success && result.connectionId) {
     writeSuccess("\n\u2705 Authorization successful!");
-    await finalizeConnection(context, selectedIntegration, result.connectionId, selectedScopes, hideSensitive, {
-      triggers: selectedTriggers,
-      webhookUrl,
-      isCustomWebhook
-    }, options.accountLabel);
+    if (userScope) {
+      await finalizeUserConnection(context, selectedIntegration, result.connectionId, selectedScopes);
+    } else {
+      await finalizeConnection(context, selectedIntegration, result.connectionId, selectedScopes, hideSensitive, {
+        triggers: selectedTriggers,
+        webhookUrl,
+        isCustomWebhook
+      }, options.accountLabel);
+    }
   } else {
     writeError(`
 \u274C Authorization failed: ${result.error || "Unknown error"}`);
@@ -42217,6 +42676,140 @@ async function finalizeConnection(context, integration, connectionId, scopes, hi
   });
 }
 __name(finalizeConnection, "finalizeConnection");
+async function finalizeUserConnection(context, integration, connectionId, scopes) {
+  writeProgress(`\u{1F504} Setting up ${integration.name} connection...`);
+  const result = await context.unifiedToApi.finalizeUserConnection({
+    connectionId,
+    scopes: scopes.length > 0 ? scopes : void 0
+  });
+  if (!result.success || !result.data) {
+    writeError(`\u274C Failed to finalize connection: ${result.error?.message || "Unknown error"}`);
+    return;
+  }
+  const { mountedAgentIds, webhooks, failedWebhooks } = result.data;
+  console.log("\n" + "\u2500".repeat(60));
+  console.log("\u{1F389} Connection Established!");
+  console.log("\u2500".repeat(60));
+  console.log(`
+  Integration: ${integration.name}`);
+  console.log(`  Connection ID: ${connectionId}`);
+  console.log(`  Owner: you`);
+  console.log(`
+  \u{1F916} Available on ${mountedAgentIds.length} agent(s):`);
+  if (mountedAgentIds.length === 0) {
+    console.log("    (none yet \u2014 you have no private agents)");
+  } else {
+    mountedAgentIds.forEach((agentId) => {
+      console.log(`    \u2022 ${agentId}${agentId === context.agentId ? "  \u2190 this project" : ""}`);
+    });
+  }
+  console.log("    Private agents you create later are added automatically.");
+  console.log("    Publishing an agent removes its access.");
+  if (scopes.length > 0) {
+    console.log(`
+  \u{1F511} Permissions (${scopes.length}):`);
+    scopes.forEach((scopeName) => {
+      const scopeInfo = integration.oauthScopes?.find((sc) => sc.unifiedScope === scopeName);
+      console.log(`    \u2022 ${scopeInfo?.friendlyLabel || scopeName}`);
+    });
+  } else {
+    console.log(`
+  \u{1F511} Permissions: Default`);
+  }
+  if (webhooks.length > 0) {
+    console.log(`
+  \u{1F9E0} Memory sources seeded: ${webhooks.length}`);
+  }
+  if (failedWebhooks && failedWebhooks.length > 0) {
+    failedWebhooks.forEach((t) => console.log(`    \u2717 ${t.objectType}.${t.event}: ${t.error}`));
+  }
+  console.log("\n" + "\u2500".repeat(60));
+  console.log(`\u2705 ${integration.name} connected as you.`);
+  console.log(`   Manage it with: lua integrations list --scope user
+`);
+  trackEvent("cli_integration_connected", {
+    integration_type: integration.value,
+    integration_name: integration.name,
+    scope: "user",
+    mounted_agents: mountedAgentIds.length
+  });
+}
+__name(finalizeUserConnection, "finalizeUserConnection");
+async function listUserConnections(context) {
+  writeProgress("\u{1F504} Loading your connections...");
+  try {
+    const result = await context.unifiedToApi.getUserConnections();
+    const connections = result.success ? result.data || [] : [];
+    console.log("\n" + "=".repeat(60));
+    console.log("\u{1F464} Your Personal Connections");
+    console.log("=".repeat(60) + "\n");
+    if (connections.length === 0) {
+      console.log("\u2139\uFE0F  You have no personal connections yet.");
+      console.log("\u{1F4A1} Run 'lua integrations connect --scope user' to connect one.\n");
+      return;
+    }
+    for (const connection of connections) {
+      const statusIcon = connection.status === "unhealthy" ? "\u{1F534}" : connection.status === "paused" ? "\u23F8\uFE0F" : "\u{1F7E2}";
+      const mounted = connection.mountedAgentIds || [];
+      console.log(`${statusIcon} ${connection.displayName || connection.integrationType}`);
+      console.log(`   Connection: ${connection.connectionId}`);
+      console.log(`   Status: ${connection.status}`);
+      console.log(`   Available on: ${mounted.length} agent(s)${mounted.includes(context.agentId) ? " (including this project)" : ""}`);
+      if (connection.removedAgentIds && connection.removedAgentIds.length > 0) {
+        console.log(`   Removed from: ${connection.removedAgentIds.length} agent(s)`);
+      }
+      console.log(`   Memory feed: ${connection.memoryFeed ? "on" : "off"}`);
+      if (connection.createdAt) {
+        console.log(`   Connected: ${new Date(connection.createdAt).toLocaleDateString()}`);
+      }
+      console.log();
+    }
+    console.log("=".repeat(60));
+    console.log(`Total: ${connections.length} personal connection(s)
+`);
+  } catch (error) {
+    writeError(`\u274C Error loading your connections: ${error.message}`);
+  }
+}
+__name(listUserConnections, "listUserConnections");
+async function convertConnectionFlow(context, connectionId, force = false) {
+  if (!force) {
+    const ok = await safePrompt([
+      {
+        type: "confirm",
+        name: "go",
+        message: `Make ${connectionId} yours? It spreads to every private agent you own, and there is no way to convert it back.`,
+        default: false
+      }
+    ]);
+    if (!ok?.go) {
+      console.log("\nNothing changed.\n");
+      return;
+    }
+  }
+  writeProgress("\u{1F504} Making this connection yours...");
+  const result = await context.unifiedToApi.convertConnectionToUser(connectionId);
+  if (!result.success || !result.data) {
+    writeError(`\u274C Failed to convert connection: ${result.error?.message || "Unknown error"}`);
+    console.log("\u{1F4A1} Only a private-agent connection you created yourself can become personal.");
+    console.log("   A connection shared with the workspace must stop being shared first.\n");
+    return;
+  }
+  const { mountedAgentIds } = result.data;
+  writeSuccess(`
+\u2705 ${connectionId} is now yours.`);
+  console.log(`
+  \u{1F916} Available on ${mountedAgentIds.length} agent(s):`);
+  mountedAgentIds.forEach((agentId) => {
+    console.log(`    \u2022 ${agentId}${agentId === context.agentId ? "  \u2190 this project" : ""}`);
+  });
+  console.log("    Private agents you create later are added automatically.\n");
+  trackEvent("cli_integration_converted", {
+    connection_id: connectionId,
+    mounted_agents: mountedAgentIds.length
+  });
+}
+__name(convertConnectionFlow, "convertConnectionFlow");
 async function listConnections(context) {
   writeProgress("\u{1F504} Loading connections...");
   try {
@@ -42264,6 +42857,37 @@ async function listConnections(context) {
   }
 }
 __name(listConnections, "listConnections");
+async function disconnectUserConnection(context, connectionId) {
+  const forget = await safePrompt([
+    {
+      type: "confirm",
+      name: "forget",
+      message: "Also forget what this connection already added to memory? (it is kept otherwise)",
+      default: false
+    }
+  ]);
+  if (!forget) return;
+  writeProgress("\u{1F504} Disconnecting... (please wait, do not close this window)");
+  const result = await context.unifiedToApi.deleteUserConnection(connectionId, forget.forget);
+  if (!result.success) {
+    writeError(`\u274C Failed to disconnect: ${result.error?.message || "Unknown error"}`);
+    return;
+  }
+  writeSuccess("\u2705 Personal connection disconnected from every agent it was on.");
+  if (result.data?.deletedWebhooksCount) {
+    console.log(`   \u2713 Deleted ${result.data.deletedWebhooksCount} memory source(s)`);
+  }
+  if (!forget.forget) {
+    console.log("   \u2139\uFE0F  What it already added to memory was kept.");
+  }
+  console.log();
+  trackEvent("cli_integration_disconnected", {
+    scope: "user",
+    webhooks_deleted: result.data?.deletedWebhooksCount || 0,
+    forget_memories: forget.forget
+  });
+}
+__name(disconnectUserConnection, "disconnectUserConnection");
 async function disconnectIntegration(context, connectionId) {
   writeProgress(`\u{1F504} Disconnecting... (please wait, do not close this window)`);
   try {
@@ -46360,7 +46984,7 @@ function setupMarketplaceCommands(program2) {
   program2.command("marketplace [noun] [action]").description("\u{1F6CD}\uFE0F  Browse, install, and manage marketplace skills and agent templates").option("--skill-name <name>", "Skill name (for skill list/update/uninstall)").option("--marketplace-id <id>", "Marketplace skill ID").option("--version-id <id>", "Version ID (for skill publish/install)").option("--env-vars-json <json>", "JSON string with env var metadata (for skill publish)").option("--query <text>", "Search query (for skill search)").option("--page <n>", "Page number (for skill search)").option("--limit <n>", "Results per page (for skill search)").option("--name <name>", "Template name, an internal identifier (for template create)").option("--description <text>", "Description (for template create)").option("--template-id <id>", "Template ID").option("--source-version <n>", "Agent version to freeze into this template version (default: active) (for template publish)").option("--env-contract <pair>", "KEY=description env contract entry, repeatable; use KEY?=description for optional (for template publish)", (val, previous) => [
     ...previous,
     val
-  ], []).option("--version <n>", "Template version (for template view/install/apply)").option("--allow-creator-updates", "Allow the template creator to push future updates onto this install").option("--skip-env-check", "Skip env-contract validation (for template install/apply)").option("--agents <ids>", "Comma-separated target agent IDs (for template apply)").option("--file <path>", "Path to a file with one target agent ID per line (for template apply)").option("--all-installed", "Target every agent that already has this template installed (for template apply)").option("--no-wait", "Print the apply runId immediately instead of polling for completion (for template apply)").option("--display-name <name>", "Display name (for skill list/edit, template create)").option("--visibility <visibility>", "Who can see and install it: public or private (for skill list, template create)").option("--changelog <text>", "Changelog for this version (for skill/template publish)").option("--env-vars <pairs>", "Comma-separated key=value pairs (for skill/template install/update)").option("--json", "Output as JSON").option("--force", "Skip confirmation prompts").addHelpText("after", `
+  ], []).option("--version <n>", "Template version (for template view/install/apply)").option("--allow-creator-updates", "Allow the template creator to push future updates onto this install").option("--skip-env-check", "Skip env-contract validation (for template install/apply)").option("--agents <ids>", "Comma-separated target agent IDs (for template apply)").option("--file <path>", "Path to a file with one target agent ID per line (for template apply)").option("--all-installed", "Target every agent that already has this template installed (for template apply)").option("--no-wait", "Print the apply runId immediately instead of polling for completion (for template apply)").option("--display-name <name>", "Display name (for skill list/edit, template create)").option("--visibility <visibility>", "Who can see and install it: public or private (for skill list, template create)").option("--changelog <text>", "Changelog for this version (for skill/template publish)").option("--env-vars <pairs>", "Comma-separated key=value pairs (for skill/template install/update)").option("--json", "Output as JSON").option("--force", "Skip confirmation prompts").option("--yes", "Auto-confirm ONLY the template-publish consequence prompt (section clear/narrow); unlike --force it skips no other confirmation").addHelpText("after", `
 Arguments:
   noun                   Optional: 'skill' or 'template' (prompts if not provided)
   action                 Optional: specific action for non-interactive mode
@@ -46810,16 +47434,19 @@ Examples:
   $ lua mcp deactivate --server-name api-server Deactivate a server
   $ lua mcp delete --server-name old-server     Delete a server
 `).action(mcpCommand);
-  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--connection-id <id>", "Connection ID to disconnect or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval for virtual webhooks (60, 120, 240, 480, 720, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for info and webhooks events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
+  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--scope <scope>", "Who owns the connection: 'agent' (default) or 'user'").option("--force", "Skip the confirmation prompt (for convert)").option("--connection-id <id>", "Connection ID to disconnect, convert or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval for virtual webhooks (60, 120, 240, 480, 720, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for info and webhooks events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
 Arguments:
-  action                 Optional: 'connect', 'update', 'list', 'available', 'info', 'disconnect', 'webhooks'
-                         (alias: 'triggers'), or 'mcp'
+  action                 Optional: 'connect', 'update', 'list', 'available', 'info', 'disconnect',
+                         'convert', 'webhooks' (alias: 'triggers'), or 'mcp'
   subaction              For info: <integration-type>
                          For webhooks/triggers: 'list', 'events', 'create', 'delete', 'pause', or 'resume'
                          For mcp: 'list', 'activate', or 'deactivate'
 
 Options:
   --integration <type>   Integration type (linear, googlecalendar, hubspot, etc.)
+  --scope <scope>        Who owns the connection: 'agent' (default) or 'user'. 'user' is a personal
+                         connection \u2014 every private agent you own can use it, including ones you
+                         create later. Publishing an agent removes its access.
   --auth-method <method> Authentication method: 'oauth' or 'token'
   --scopes <scopes>      Comma-separated OAuth scopes, or 'all' for all available scopes
   --hide-sensitive <bool> Hide sensitive data from MCP tools (default: true, use 'false' to show)
@@ -46837,6 +47464,7 @@ Webhook/Trigger Options:
   --interval <minutes>   Polling interval for virtual webhooks (60=1h, 120=2h, etc.)
 
 Note: Only 1 connection per integration type is allowed per agent.
+Note: Triggers, account labels and --hide-sensitive are agent-scoped; they don't apply to --scope user.
 
 Examples:
   $ lua integrations                                    Interactive management
@@ -46846,7 +47474,12 @@ Examples:
   $ lua integrations connect --integration linear --triggers task_task.created,task_task.updated
   $ lua integrations update --integration linear --scopes all  Update Linear scopes
   $ lua integrations available                          List available integrations
-  $ lua integrations list                               List connected integrations
+  $ lua integrations list                               List this agent's connections
+  $ lua integrations connect --scope user               Connect as yourself (all your private agents)
+  $ lua integrations list --scope user                  List your personal connections
+  $ lua integrations list --scope all                   List both
+  $ lua integrations convert --connection-id abc123     Re-home an agent connection to yourself
+  $ lua integrations convert --connection-id abc123 --force   Same, without the confirmation
   $ lua integrations info linear                        Show Linear integration details
   $ lua integrations info linear --json                 Output as JSON (for scripting)
   $ lua integrations disconnect --connection-id abc123  Disconnect an integration