lua-cli 3.39.1 → 3.39.3

package/dist/index.js

@@ -1586,6 +1586,7 @@ function utf8Bytes(value3) {
 }
 function isPlainFieldKey(key) {
   if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
+  if (key === LOG_FIELDS_CLAMPED_KEY) return false;
   return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
 }
 function describeAgentLogFieldsViolation(value3) {
@@ -50379,7 +50380,7 @@ function wantsContent(options, sources) {
   return (sources ?? []).some((source) => LOG_DRAIN_CONTENT_SOURCES.includes(source));
 }
 __name(wantsContent, "wantsContent");
-async function acknowledgeContent(options) {
+async function acknowledgeContent(options, becauseOfFlag = true, nothingHint = "Nothing was created") {
   emitAside("", options.json);
   emitAside(CONTENT_WARNING_TEXT, options.json);
   emitAside("", options.json);
@@ -50387,7 +50388,7 @@ async function acknowledgeContent(options) {
   emitAside("", options.json);
   if (options.yes) return true;
   if (isCiModeEnabled()) {
-    throw CliError.usage("--include-content needs the acknowledgement above; pass --yes to give it non-interactively.", "Nothing was created");
+    throw CliError.usage(becauseOfFlag ? "--include-content needs the acknowledgement above; pass --yes to give it non-interactively." : "Selecting user_message or agent_response needs the acknowledgement above; pass --yes to give it non-interactively. (Content bodies stay OFF unless you also pass --include-content.)", nothingHint);
   }
   const answer = await safePrompt([
     {
@@ -50398,7 +50399,7 @@ async function acknowledgeContent(options) {
     }
   ]);
   if (!answer?.acknowledged) {
-    throw CliError.usage("Content was not enabled: the acknowledgement was declined.", "Nothing was created");
+    throw CliError.usage("Content was not enabled: the acknowledgement was declined.", nothingHint);
   }
   return true;
 }
@@ -50675,8 +50676,9 @@ async function createDrainCore(context, options) {
   const agents = parseAgents(options.agents) ?? (context.agentId ? [
     context.agentId
   ] : "*");
-  const includeContent = wantsContent(options, sources);
-  const includeContentAck = includeContent ? await acknowledgeContent(options) : void 0;
+  const touchesContent = wantsContent(options, sources);
+  const includeContent = options.includeContent === true;
+  const includeContentAck = touchesContent ? await acknowledgeContent(options, includeContent) : void 0;
   const input = {
     name,
     type,
@@ -50789,8 +50791,12 @@ async function updateDrainCore(context, drainId, options) {
     }
     patch.includeContent = false;
   } else if (wantsContent(options, sources)) {
-    patch.includeContent = true;
-    patch.includeContentAck = await acknowledgeContent(options);
+    const includeContent = options.includeContent === true;
+    const ack = await acknowledgeContent(options, includeContent);
+    if (includeContent) {
+      patch.includeContent = true;
+      patch.includeContentAck = ack;
+    }
   }
   if (Object.keys(patch).length === 0) {
     throw CliError.usage("Nothing to update \u2014 no field flags were given.", listHint("Changeable", [
@@ -51705,6 +51711,8 @@ var LOG_EXPORT_DOWNLOAD = {
 };
 var ALREADY_RUNNING = "EXPORT_ALREADY_RUNNING";
 var MISSING_EXPORT_SCOPE_MESSAGE = "Missing scope: logs:read. Create a key with that scope (lua auth key) or ask an org admin.";
+var EXPORT_CONTENT_FORBIDDEN = "EXPORT_CONTENT_FORBIDDEN";
+var MISSING_EXPORT_CONTENT_SCOPE_MESSAGE = "Missing scope: logs:manage. Create a key with that scope (lua auth key) or ask an org admin.";
 var TERMINAL2 = /* @__PURE__ */ new Set([
   "succeeded",
   "failed",
@@ -51721,6 +51729,10 @@ async function logsExportCommand(cmdObj) {
       }
       const sources = parseTypeFlag(options.type);
       const outDir = options.out ? resolveOutDir(String(options.out)) : void 0;
+      const includeContent = options.includeContent === true;
+      if (includeContent) {
+        await acknowledgeContent(options, true, "Nothing was exported");
+      }
       const context = await resolveDrainsContext(options);
       const api = new LogExportApi(BASE_URLS.API, context.apiKey, context.orgId);
       const say = /* @__PURE__ */ __name((line) => {
@@ -51729,7 +51741,8 @@ async function logsExportCommand(cmdObj) {
       const jobId = await startOrAttach(api, {
         from: since,
         to: until ?? (/* @__PURE__ */ new Date()).toISOString(),
-        sources
+        sources,
+        includeContent
       }, say);
       if (options.noWait || options.wait === false) {
         emit2(options, {
@@ -51740,7 +51753,8 @@ async function logsExportCommand(cmdObj) {
         trackEvent("cli_logs_export", {
           waited: false,
           json_output: !!options.json,
-          downloaded: 0
+          downloaded: 0,
+          include_content: includeContent
         });
         return;
       }
@@ -51781,7 +51795,8 @@ async function logsExportCommand(cmdObj) {
         waited: true,
         json_output: !!options.json,
         downloaded: written.length,
-        truncated: !!job.truncated
+        truncated: !!job.truncated,
+        include_content: includeContent
       });
     },
     "logs export",
@@ -51815,6 +51830,11 @@ async function startOrAttach(api, input, say) {
     to: input.to,
     ...input.sources ? {
       sources: input.sources
+    } : {},
+    // Only ever sent as `true` — PRO-2182. `false`/absent both mean "no content", and the
+    // server's own default is `false`, so there is nothing an omitted key would lose.
+    ...input.includeContent ? {
+      includeContent: true
     } : {}
   };
   const started = await callExport(() => api.startExport(body));
@@ -51869,7 +51889,7 @@ async function callExport(call) {
     return await call();
   } catch (error) {
     if (CliError.isCliError(error) && error.statusCode === 403) {
-      throw CliError.forbidden(MISSING_EXPORT_SCOPE_MESSAGE);
+      throw CliError.forbidden(error.serverCode === EXPORT_CONTENT_FORBIDDEN ? MISSING_EXPORT_CONTENT_SCOPE_MESSAGE : MISSING_EXPORT_SCOPE_MESSAGE);
     }
     throw error;
   }
@@ -57641,7 +57661,8 @@ async function resumeCore(ctx, runId, o) {
       };
     } else if (status === 409 && (code === "approval_requires_human" || code === "APPROVAL_REQUIRES_HUMAN")) {
       detail = {
-        message: `step "${o.step}" is an approval \u2014 resolve it with: lua workflows approve ${runId} --approval ${o.step} --decision approve`
+        // BAC-504: approve takes the approval's wfa_… id, never the step id (the 409 envelope carries no approvalId)
+        message: `step "${o.step}" is an approval \u2014 resolve it with the pending approval's wfa_\u2026 id: lua workflows approve ${runId} --approval <wfa_\u2026> --decision approve|deny (lua workflows status ${runId} --steps --json shows it as the suspended step's suspend.approvalId)`
       };
     } else if (status === 409 && (code === "use_signal_route" || code === "USE_SIGNAL_ROUTE")) {
       detail = {
@@ -65789,6 +65810,56 @@ var CALLBACK_HOST = "127.0.0.1";
 var CALLBACK_URL = `http://${CALLBACK_HOST}:${CALLBACK_PORT}/callback`;
 var AGENT_WEBHOOK_URL = `${BASE_URLS.API}/webhook/unifiedto/data`;
 var DEFAULT_VIRTUAL_WEBHOOK_INTERVAL = 1;
+var VIRTUAL_WEBHOOK_INTERVAL_CHOICES = [
+  {
+    name: "1 minute",
+    value: 1
+  },
+  {
+    name: "5 minutes",
+    value: 5
+  },
+  {
+    name: "10 minutes",
+    value: 10
+  },
+  {
+    name: "15 minutes",
+    value: 15
+  },
+  {
+    name: "30 minutes",
+    value: 30
+  },
+  {
+    name: "1 hour",
+    value: 60
+  },
+  {
+    name: "2 hours",
+    value: 120
+  },
+  {
+    name: "4 hours",
+    value: 240
+  },
+  {
+    name: "8 hours",
+    value: 480
+  },
+  {
+    name: "12 hours",
+    value: 720
+  },
+  {
+    name: "24 hours (1 day)",
+    value: 1440
+  },
+  {
+    name: "48 hours (2 days)",
+    value: 2880
+  }
+];
 async function fetchAvailableIntegrations(unifiedToApi, agentId) {
   const result = await unifiedToApi.getAvailableIntegrations(agentId);
   if (!result.success || !result.data) {
@@ -68122,56 +68193,6 @@ Available trigger events for ${selectedConnection.integrationName || selectedCon
     }
   }
   let interval;
-  const intervalOptions = [
-    {
-      name: "1 minute",
-      value: 1
-    },
-    {
-      name: "5 minutes",
-      value: 5
-    },
-    {
-      name: "10 minutes",
-      value: 10
-    },
-    {
-      name: "15 minutes",
-      value: 15
-    },
-    {
-      name: "30 minutes",
-      value: 30
-    },
-    {
-      name: "1 hour",
-      value: 60
-    },
-    {
-      name: "2 hours",
-      value: 120
-    },
-    {
-      name: "4 hours",
-      value: 240
-    },
-    {
-      name: "8 hours",
-      value: 480
-    },
-    {
-      name: "12 hours",
-      value: 720
-    },
-    {
-      name: "24 hours (1 day)",
-      value: 1440
-    },
-    {
-      name: "48 hours (2 days)",
-      value: 2880
-    }
-  ];
   if (selectedEvent.webhookType === "virtual") {
     if (options.interval !== void 0) {
       interval = options.interval;
@@ -68181,8 +68202,10 @@ Available trigger events for ${selectedConnection.integrationName || selectedCon
           type: "list",
           name: "interval",
           message: "Select polling interval:",
-          choices: intervalOptions,
-          default: 1
+          choices: [
+            ...VIRTUAL_WEBHOOK_INTERVAL_CHOICES
+          ],
+          default: DEFAULT_VIRTUAL_WEBHOOK_INTERVAL
         }
       ]);
       if (!intervalAnswer) return;
@@ -68190,7 +68213,7 @@ Available trigger events for ${selectedConnection.integrationName || selectedCon
     }
   }
   const formatInterval = /* @__PURE__ */ __name((minutes) => {
-    const option = intervalOptions.find((o) => o.value === minutes);
+    const option = VIRTUAL_WEBHOOK_INTERVAL_CHOICES.find((o) => o.value === minutes);
     return option ? option.name : `${minutes} minutes`;
   }, "formatInterval");
   if (!options.connectionId) {
@@ -71696,7 +71719,7 @@ Notes:
   shift the window. --type calls reads voice calls and ignores --since/--until/--environment
   /--follow. --since is INCLUSIVE; the boundary row is de-duplicated by id while following.
 `).action(logsCommand);
-  logsGroup.command("export").description("\u{1F4E6} Export this organization's logs as gzip NDJSON (asynchronous job)").option("--since <when>", "Inclusive lower bound (REQUIRED): an ISO 8601 instant, or 24h | 7d").option("--until <when>", "Inclusive upper bound; same formats (default: now)").option("--type <type>", "Comma-separated log sources, or all (default: all)").option("--out <dir>", "Download the parts into this directory (created if missing)").option("--org <id>", "The organization to export (default: the project, or the key when it reaches one org)").option("--no-wait", "Start the export and print the job id without polling it").option("--json", "Output as JSON").addHelpText("after", `
+  logsGroup.command("export").description("\u{1F4E6} Export this organization's logs as gzip NDJSON (asynchronous job)").option("--since <when>", "Inclusive lower bound (REQUIRED): an ISO 8601 instant, or 24h | 7d").option("--until <when>", "Inclusive upper bound; same formats (default: now)").option("--type <type>", "Comma-separated log sources, or all (default: all)").option("--out <dir>", "Download the parts into this directory (created if missing)").option("--org <id>", "The organization to export (default: the project, or the key when it reaches one org)").option("--no-wait", "Start the export and print the job id without polling it").option("--include-content", "Include user_message / agent_response bodies (requires logs:manage; prints an acknowledgement)").option("-y, --yes", "Give the --include-content acknowledgement non-interactively").option("--json", "Output as JSON").addHelpText("after", `
 Options:
   --since <when>         REQUIRED. Inclusive lower bound: an ISO 8601 instant, or 24h | 7d
   --until <when>         Inclusive upper bound, same formats (default: now)
@@ -71704,19 +71727,26 @@ Options:
   --out <dir>            Download every part into this local directory
   --org <id>             The organization, when the key reaches more than one
   --no-wait              Start it and print the job id; poll later
+  --include-content      Include user_message / agent_response bodies. Requires logs:manage;
+                         prints the same content warning and acknowledgement as
+                         lua drains create --include-content
+  -y, --yes              Give that acknowledgement non-interactively
   --json                 Output as JSON for scripting
 
 Examples:
   $ lua logs export --since 7d --out ./export        A week, downloaded
   $ lua logs export --since 30d --type skill,job     A month, two sources
   $ lua logs export --since 24h --no-wait --json     Start it and return
+  $ lua logs export --since 24h --include-content --yes   Include message bodies (logs:manage)
 
 Notes:
   The window is at most 31 days and the job at most 10 000 000 records; narrow the window
   or the sources rather than raising either. One export runs per organization at a time \u2014
   a second invocation FOLLOWS the running one instead of refusing. Download links expire
-  24 h after the export finishes and the files are removed after 7 days. Message bodies
-  are excluded unless the export was started with the logs:manage scope.
+  24 h after the export finishes and the files are removed after 7 days. Message bodies are
+  EXCLUDED BY DEFAULT and only ever included when --include-content is passed AND the
+  acknowledgement is given AND the credential holds logs:manage \u2014 the scope alone is not
+  enough, the flag is required too.
 `).action((options, command) => logsExportCommand(withGroupOptions(options ?? {}, command)));
   program2.command("skills [actionOrEnv] [action]").description("\u2699\uFE0F  Manage and view skills").option("--skill-name <name>", "Skill name").option("--skill-version <version>", "Version for deploy action (or 'latest')").addHelpText("after", `
 Arguments:
@@ -71840,7 +71870,7 @@ Examples:
   $ lua jobs versions -i myJob                         View job versions
   $ lua jobs history -i myJob                          View execution history
 `).action(jobsCommand);
-  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, retry-step, resolve-step, raise-budget, approve, signal, replay, export, schedules)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/export/goals create/schedules create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create/schedules create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs/schedules create: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start/schedules create: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list/approval-payload --path: page size").option("--cursor <c>", "runs/goals list/approval-payload --path: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status, 6 for a gated run").option("--compose <on|off>", "policy models set: may the composer be shown the model menu").option("--max-class <fast|balanced|strong>", "policy models set: ceiling for class requests and the class map").option("--consent-actions <n>", "policy models set: estimated actions above which a composed run shows the card").option("--allow <codes>", "policy models set: comma-separated approved codes to narrow the set to").option("--class-fast <codes>", "policy models set: ordered overrides of the fast class (comma-separated)").option("--class-balanced <codes>", "policy models set: ordered overrides of the balanced class (comma-separated)").option("--class-strong <codes>", "policy models set: ordered overrides of the strong class (comma-separated)").option("--class-map <pairs>", "policy models set: comma-separated <taskClass>=<modelClass> pairs").option("--pins <class-only|allowed>", "policy models set: may a composed definition pin a concrete code").option("--fallback <same-class|same-provider>", "policy models set: where a failed leg may hop to").option("--enabled <on|off>", "policy autonomy set: may a start inside the envelope skip the consent card").option("--max-duration <seconds>", "policy autonomy set: the envelope\u2019s duration bound, in seconds").option("--max-actions <n>", "policy autonomy set: the envelope\u2019s estimated-actions bound").option("--max-runs-per-hour <n>", "policy autonomy set: autonomous starts per hour, per agent").option("--forms <list>", "policy autonomy set: comma-separated forms the envelope admits (graph,script,static)").option("--clear <keys>", "policy autonomy set: comma-separated members to clear back to the platform default").option("--agent <agentId>", "policy autonomy: not supported \u2014 no route writes a per-agent envelope (see the refusal)").option("--kind <kind>", "clear-gate: the gate kind to clear (e.g. model_policy)").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/retry-step/resolve-step/logs: step id").option("--outcome <skip|complete|fail>", "resolve-step: the decision on the parked step (--action is accepted too)").option("--action <skip|complete|fail>", "resolve-step: alias of --outcome").option("--output <json|@file>", "resolve-step: the output a completed step would have produced (required with --outcome complete)").option("--credits <n>", "raise-budget: the new priced cap of a budget-parked run, in the run's own budget unit \u2014 credits, or actions on a seat plan (above the current one)").option("--max-steps <n>", "raise-budget: the new step cap").option("--max-job-seconds <n>", "raise-budget: the new Job-tier seconds cap").option("--max-duration-seconds <n>", "raise-budget: the new wall-clock cap").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve/approval-payload: approval id").option("--path <array.path>", "approval-payload: page one array of a large payload (--cursor / --limit inside it)").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/retry-step/resolve-step/raise-budget/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph \xB7 export: overwrite files").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip) \xB7 export: target dir").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create/schedules create: cadence entry (repeatable, \u2264 5); goals: none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit/schedules create: IANA timezone for bare cron cadences").option("--notify <emailApp|email|app|off>", "schedules create: where each fire notifies").option("--backfill-on-enable <n|none>", "schedules create/patch/resume: replay \u2264 n missed fires on re-enable (patch: none clears it)").option("--backfill-now", "schedules resume (or patch --paused false): one-shot backfill on THIS re-enable").option("--paused <true|false>", "schedules patch: pause (true) or re-enable (false) the schedule").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit/schedules create: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
+  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, retry-step, resolve-step, raise-budget, approve, signal, replay, export, schedules)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/export/goals create/schedules create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create/schedules create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs/schedules create: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start/schedules create: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list/approval-payload --path: page size").option("--cursor <c>", "runs/goals list/approval-payload --path: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status, 6 for a gated run").option("--compose <on|off>", "policy models set: may the composer be shown the model menu").option("--max-class <fast|balanced|strong>", "policy models set: ceiling for class requests and the class map").option("--consent-actions <n>", "policy models set: estimated actions above which a composed run shows the card").option("--allow <codes>", "policy models set: comma-separated approved codes to narrow the set to").option("--class-fast <codes>", "policy models set: ordered overrides of the fast class (comma-separated)").option("--class-balanced <codes>", "policy models set: ordered overrides of the balanced class (comma-separated)").option("--class-strong <codes>", "policy models set: ordered overrides of the strong class (comma-separated)").option("--class-map <pairs>", "policy models set: comma-separated <taskClass>=<modelClass> pairs").option("--pins <class-only|allowed>", "policy models set: may a composed definition pin a concrete code").option("--fallback <same-class|same-provider>", "policy models set: where a failed leg may hop to").option("--enabled <on|off>", "policy autonomy set: may a start inside the envelope skip the consent card").option("--max-duration <seconds>", "policy autonomy set: the envelope\u2019s duration bound, in seconds").option("--max-actions <n>", "policy autonomy set: the envelope\u2019s estimated-actions bound").option("--max-runs-per-hour <n>", "policy autonomy set: autonomous starts per hour, per agent").option("--forms <list>", "policy autonomy set: comma-separated forms the envelope admits (graph,script,static)").option("--clear <keys>", "policy autonomy set: comma-separated members to clear back to the platform default").option("--agent <agentId>", "policy autonomy: not supported \u2014 no route writes a per-agent envelope (see the refusal)").option("--kind <kind>", "clear-gate: the gate kind to clear (e.g. model_policy)").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/retry-step/resolve-step/logs: step id").option("--outcome <skip|complete|fail>", "resolve-step: the decision on the parked step (--action is accepted too)").option("--action <skip|complete|fail>", "resolve-step: alias of --outcome").option("--output <json|@file>", "resolve-step: the output a completed step would have produced (required with --outcome complete)").option("--credits <n>", "raise-budget: the new priced cap of a budget-parked run, in the run's own budget unit \u2014 credits, or actions on a seat plan (above the current one)").option("--max-steps <n>", "raise-budget: the new step cap").option("--max-job-seconds <n>", "raise-budget: the new Job-tier seconds cap").option("--max-duration-seconds <n>", "raise-budget: the new wall-clock cap").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve/approval-payload: the wfa_\u2026 approval id (lua workflows status <runId> --steps --json \u2192 suspend.approvalId), not the step id").option("--path <array.path>", "approval-payload: page one array of a large payload (--cursor / --limit inside it)").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/retry-step/resolve-step/raise-budget/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph \xB7 export: overwrite files").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip) \xB7 export: target dir").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create/schedules create: cadence entry (repeatable, \u2264 5); goals: none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit/schedules create: IANA timezone for bare cron cadences").option("--notify <emailApp|email|app|off>", "schedules create: where each fire notifies").option("--backfill-on-enable <n|none>", "schedules create/patch/resume: replay \u2264 n missed fires on re-enable (patch: none clears it)").option("--backfill-now", "schedules resume (or patch --paused false): one-shot backfill on THIS re-enable").option("--paused <true|false>", "schedules patch: pause (true) or re-enable (false) the schedule").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit/schedules create: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
 Arguments:
   action    list \xB7 view \xB7 versions \xB7 deploy \xB7 activate \xB7 deactivate \xB7 start \xB7 run \xB7 runs \xB7 status \xB7
             watch \xB7 cancel \xB7 resume \xB7 retry-step \xB7 resolve-step \xB7 raise-budget \xB7 approve \xB7 approval-payload \xB7
@@ -71880,7 +71910,7 @@ Examples:
   $ lua workflows resolve-step <runId> --step sendEmails --outcome complete --output '{"sent":0}'
   $ lua workflows raise-budget <runId> --credits 20
   $ lua workflows approval-payload <runId> --approval wfa_1234
-  $ lua workflows approve <runId> --approval reviewDrafts --decision approve
+  $ lua workflows approve <runId> --approval wfa_1234 --decision approve
   $ lua workflows signal <runId> review --payload '{"ok":true}'
   $ lua workflows replay <runId> --local
   $ lua workflows deploy outreach -v latest
@@ -71975,7 +72005,7 @@ Examples:
   $ lua mcp deactivate --server-name api-server Deactivate a server
   $ lua mcp delete --server-name old-server     Delete a server
 `).action(mcpCommand);
-  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--scope <scope>", "Who owns the connection: 'agent' (default) or 'user'").option("--force", "Skip the confirmation prompt (for convert)").option("--connection-id <id>", "Exact connection ID to update, disconnect, convert or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval for virtual webhooks (60, 120, 240, 480, 720, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for info and webhooks events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
+  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--scope <scope>", "Who owns the connection: 'agent' (default) or 'user'").option("--force", "Skip the confirmation prompt (for convert)").option("--connection-id <id>", "Exact connection ID to update, disconnect, convert or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval in minutes for virtual webhooks, 1-2880 (default 1; e.g. 1, 5, 15, 60, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for info and webhooks events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
 Arguments:
   action                 Optional: 'connect', 'update', 'list', 'available', 'info', 'disconnect',
                          'convert', 'webhooks' (alias: 'triggers'), or 'mcp'
@@ -72002,7 +72032,7 @@ Webhook/Trigger Options:
   --webhook-id <id>      Trigger ID to delete
   --object <type>        Object type (task_task, calendar_event, messaging_message, etc.)
   --event <type>         Event type: created, updated, or deleted
-  --interval <minutes>   Polling interval for virtual webhooks (60=1h, 120=2h, etc.)
+  --interval <minutes>   Polling interval in minutes for virtual webhooks, 1-2880 (default 1; e.g. 1, 5, 15, 60, 1440, 2880)
 
 Note: Multiple accounts of one integration are supported; use --connection-id when updating one.
 Note: Triggers, account labels and --hide-sensitive are agent-scoped; they don't apply to --scope user.
@@ -72031,6 +72061,7 @@ Webhook/Trigger Examples ('triggers' is an alias for 'webhooks'):
   $ lua integrations triggers list                      Same, via the 'triggers' alias
   $ lua integrations webhooks events --integration linear  List available events
   $ lua integrations webhooks create                    Create trigger (interactive)
+  $ lua integrations webhooks create --connection abc123 --object task_task --event created --interval 5
   $ lua integrations webhooks delete --webhook-id wh_xyz789
   $ lua integrations webhooks pause --webhook-id wh_xyz789
   $ lua integrations webhooks pause --connection-id abc123   Pause all triggers for a connection