lua-cli 3.39.3 → 3.40.0

package/dist/index.js

@@ -626,11 +626,12 @@ __export(constants_exports, {
   PREFERRED_AGENT_TYPES: () => PREFERRED_AGENT_TYPES,
   SANDBOX_STORAGE_FILE: () => SANDBOX_STORAGE_FILE,
   TELEMETRY_FILE: () => TELEMETRY_FILE,
-  VERSION_CHECK_FILE: () => VERSION_CHECK_FILE
+  VERSION_CHECK_FILE: () => VERSION_CHECK_FILE,
+  WEBHOOK_TRIGGER_BASE_URL: () => WEBHOOK_TRIGGER_BASE_URL
 });
 import { join } from "path";
 import { homedir } from "os";
-var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, CREDENTIALS_FILE, FIREBASE_WEB_API_KEY, PREFERRED_AGENT_TYPES, SANDBOX_STORAGE_FILE, AUTH_STORAGE_FILE, POSTHOG_API_KEY, POSTHOG_HOST;
+var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, WEBHOOK_TRIGGER_BASE_URL, CREDENTIALS_FILE, FIREBASE_WEB_API_KEY, PREFERRED_AGENT_TYPES, SANDBOX_STORAGE_FILE, AUTH_STORAGE_FILE, POSTHOG_API_KEY, POSTHOG_HOST;
 var init_constants = __esm({
   "src/config/constants.ts"() {
     "use strict";
@@ -644,6 +645,7 @@ var init_constants = __esm({
       CHAT: process.env.LUA_API_URL || "https://api.heylua.ai",
       CDN: "https://cdn.heylua.ai"
     };
+    WEBHOOK_TRIGGER_BASE_URL = "https://webhook.heylua.ai";
     CREDENTIALS_FILE = join(CLI_CONFIG_DIR, "credentials");
     FIREBASE_WEB_API_KEY = process.env.LUA_FIREBASE_WEB_API_KEY || "AIzaSyAGI0AxOz6UmtJgwFIA_UNTuYUEgQRRGhw";
     PREFERRED_AGENT_TYPES = [
@@ -909,6 +911,15 @@ function aiGenerateInputFromSimplified(prompt, content) {
     ]
   };
 }
+function isPlatformInvocationCaller(v) {
+  return typeof v === "string" && PLATFORM_INVOCATION_CALLERS.includes(v);
+}
+function supervisionSubjectId(agentId) {
+  return `agent:${agentId}`;
+}
+function isSupervisionOp(op) {
+  return typeof op === "string" && Object.prototype.hasOwnProperty.call(SUPERVISION_OPS, op);
+}
 function isAllowedReviewableExecuteTool(tool) {
   return REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST.includes(tool);
 }
@@ -957,6 +968,9 @@ function isInteractiveTurn(turn) {
 function removeNavigateBlock(input) {
   return input.replace(/::: navigate[\s\S]*?:::/g, "").trim();
 }
+function removeHiddenBlocks(input) {
+  return input.replace(/::: hide\b[\s\S]*?:::/gi, "").replace(/::: hide\b[\s\S]*$/gi, "").trim();
+}
 function transformChatHistoryContentParts(parts) {
   const content = [];
   for (const rawPart of parts ?? []) {
@@ -2502,6 +2516,180 @@ function scheduledTimeKey(scheduledTime) {
 function scheduledWorkflowRunIdForTime(jobId, scheduledTime) {
   return scheduledWorkflowRunId(jobId, scheduledTime);
 }
+function isInt(v) {
+  return typeof v === "number" && Number.isInteger(v);
+}
+function validateScheduleHealth(health, opts) {
+  const base = opts.path ?? "health";
+  const issues = [];
+  if (health === null || typeof health !== "object" || Array.isArray(health)) {
+    return [
+      {
+        code: "health-not-object",
+        path: base,
+        message: `${base} must be an object`
+      }
+    ];
+  }
+  const h = health;
+  for (const key of Object.keys(h)) {
+    if (!KNOWN_KEYS.has(key)) {
+      issues.push({
+        code: "health-unknown-field",
+        path: `${base}.${key}`,
+        message: `${base}.${key} is not a health field (maxSilenceMinutes, alertAfterConsecutiveFailures, notify)`
+      });
+    }
+  }
+  const silence = h.maxSilenceMinutes;
+  const failures = h.alertAfterConsecutiveFailures;
+  if (silence === void 0 && failures === void 0) {
+    issues.push({
+      code: "health-empty",
+      path: base,
+      message: `${base} needs maxSilenceMinutes and/or alertAfterConsecutiveFailures`
+    });
+  }
+  const { min: sMin, max: sMax } = SCHEDULE_HEALTH_LIMITS.maxSilenceMinutes;
+  if (silence !== void 0 && (!isInt(silence) || silence < sMin || silence > sMax)) {
+    issues.push({
+      code: "health-silence-invalid",
+      path: `${base}.maxSilenceMinutes`,
+      message: `${base}.maxSilenceMinutes must be an integer in ${sMin}..${sMax}`
+    });
+  }
+  const fMin = SCHEDULE_HEALTH_LIMITS.alertAfterConsecutiveFailures.min;
+  const fMax = opts.target === "workflow" ? SCHEDULE_HEALTH_LIMITS.parkedKindsMaxFailures : SCHEDULE_HEALTH_LIMITS.alertAfterConsecutiveFailures.max;
+  if (failures !== void 0) {
+    if (!isInt(failures) || failures < fMin) {
+      issues.push({
+        code: "health-failures-invalid",
+        path: `${base}.alertAfterConsecutiveFailures`,
+        message: `${base}.alertAfterConsecutiveFailures must be an integer in ${fMin}..${fMax}`
+      });
+    } else if (failures > fMax) {
+      issues.push({
+        code: opts.target === "workflow" ? "health-failures-unreachable" : "health-failures-invalid",
+        path: `${base}.alertAfterConsecutiveFailures`,
+        message: opts.target === "workflow" ? `${base}.alertAfterConsecutiveFailures must be \u2264 ${fMax}: a workflow schedule is turned off after ${fMax} consecutive failures, so a longer streak can never happen (the turn-off itself always alerts)` : `${base}.alertAfterConsecutiveFailures must be an integer in ${fMin}..${fMax}`
+      });
+    }
+  }
+  if (h.notify !== void 0 && !SCHEDULE_HEALTH_NOTIFY_CHANNELS.includes(h.notify)) {
+    issues.push({
+      code: "health-notify-invalid",
+      path: `${base}.notify`,
+      message: `${base}.notify must be one of ${SCHEDULE_HEALTH_NOTIFY_CHANNELS.join(", ")}`
+    });
+  }
+  const triggers = (opts.triggers ?? []).filter((t) => !!t && typeof t === "object");
+  if (opts.triggers !== void 0 && triggers.length === 0) {
+    issues.push({
+      code: "health-requires-schedule",
+      path: base,
+      message: `${base} needs a schedule to watch`
+    });
+  }
+  if (isInt(silence) && triggers.length > 0) {
+    if (triggers.every((t) => t.type === "once")) {
+      issues.push({
+        code: "health-silence-on-once",
+        path: `${base}.maxSilenceMinutes`,
+        message: `${base}.maxSilenceMinutes needs a recurring schedule; a one-time schedule has no cadence to fall silent against`
+      });
+    } else {
+      const intervals = triggers.filter((t) => t.type === "interval" && isInt(t.seconds)).map((t) => t.seconds);
+      const onlyIntervals = intervals.length === triggers.filter((t) => t.type !== "once").length;
+      if (onlyIntervals && intervals.length > 0) {
+        const fastest = Math.min(...intervals);
+        if (silence * 60 <= fastest) {
+          issues.push({
+            code: "health-silence-shorter-than-interval",
+            path: `${base}.maxSilenceMinutes`,
+            message: `${base}.maxSilenceMinutes (${silence} min) must be longer than the schedule's interval (${fastest}s), or every healthy gap alerts`
+          });
+        }
+      }
+    }
+  }
+  return issues;
+}
+function normalizeScheduleHealth(health) {
+  return {
+    ...health.maxSilenceMinutes !== void 0 ? {
+      maxSilenceMinutes: health.maxSilenceMinutes
+    } : {},
+    ...health.alertAfterConsecutiveFailures !== void 0 ? {
+      alertAfterConsecutiveFailures: health.alertAfterConsecutiveFailures
+    } : {},
+    notify: health.notify ?? SCHEDULE_HEALTH_DEFAULT_NOTIFY
+  };
+}
+function evaluateScheduleHealth(subject, now) {
+  const parked = subject.status === "failed";
+  if (parked) return {
+    watched: true,
+    condition: "auto_disabled"
+  };
+  if (subject.active === false || subject.status !== "active") return {
+    watched: false,
+    condition: null
+  };
+  const threshold = subject.health.alertAfterConsecutiveFailures;
+  if (threshold !== void 0 && subject.consecutiveFailures >= threshold) {
+    return {
+      watched: true,
+      condition: "failures"
+    };
+  }
+  const window = subject.health.maxSilenceMinutes;
+  if (window !== void 0) {
+    const baseline = Math.max(subject.lastSucceededAt ?? 0, subject.state?.watchFrom ?? now);
+    const silentMs = now - baseline;
+    if (silentMs > window * 6e4) {
+      return {
+        watched: true,
+        condition: "silence",
+        silentForMinutes: Math.floor(silentMs / 6e4)
+      };
+    }
+  }
+  return {
+    watched: true,
+    condition: null
+  };
+}
+function scheduleHealthView(health, state3) {
+  if (!health) return void 0;
+  const incident = state3?.incident;
+  return {
+    config: {
+      ...health.maxSilenceMinutes !== void 0 ? {
+        maxSilenceMinutes: health.maxSilenceMinutes
+      } : {},
+      ...health.alertAfterConsecutiveFailures !== void 0 ? {
+        alertAfterConsecutiveFailures: health.alertAfterConsecutiveFailures
+      } : {},
+      ...health.notify ? {
+        notify: health.notify
+      } : {}
+    },
+    state: incident ? "alerting" : state3?.watchFrom !== void 0 ? "ok" : "unwatched",
+    ...incident ? {
+      condition: incident.condition,
+      since: incident.openedAt
+    } : {},
+    ...state3?.lastSucceededAt !== void 0 ? {
+      lastSucceededAt: state3.lastSucceededAt
+    } : {},
+    ...state3?.checkedAt !== void 0 ? {
+      checkedAt: state3.checkedAt
+    } : {}
+  };
+}
+function scheduleHealthSourceId(agentId, jobId) {
+  return `schedule-health:${agentId}:${jobId}`;
+}
 function workflowGoalJudgeKind(judge) {
   return judge && typeof judge === "object" && judge.predicate !== void 0 ? "predicate" : "agent";
 }
@@ -2812,7 +3000,344 @@ function parseOnboardingFlow(value3) {
 function parsePublishedOnboardingResponse(value3) {
   return getPublishedOnboardingResponseSchema.parse(value3);
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema;
+function isForwardableWebRouteRequestHeader(name) {
+  const n2 = name.toLowerCase();
+  return WEB_ROUTE_REQUEST_HEADER_ALLOWLIST.includes(n2) || n2.startsWith("x-lua-");
+}
+function isForwardableWebRouteResponseHeader(name) {
+  const n2 = name.toLowerCase();
+  if (n2 === "set-cookie") return false;
+  return WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST.includes(n2) || n2.startsWith("x-lua-");
+}
+function isWebRouteBody(value3) {
+  if (!value3 || typeof value3 !== "object") return false;
+  const b = value3;
+  if (b.kind === "json") return "value" in b;
+  if (b.kind === "text" || b.kind === "base64") return typeof b.value === "string";
+  return false;
+}
+function isStringRecord(value3) {
+  if (!value3 || typeof value3 !== "object" || Array.isArray(value3)) return false;
+  return Object.values(value3).every((v) => typeof v === "string");
+}
+function isQueryRecord(value3) {
+  if (!value3 || typeof value3 !== "object" || Array.isArray(value3)) return false;
+  return Object.values(value3).every((v) => typeof v === "string" || Array.isArray(v) && v.every((one) => typeof one === "string"));
+}
+function isWebRouteInput(value3) {
+  if (!value3 || typeof value3 !== "object") return false;
+  const v = value3;
+  if (v.v !== WEB_ROUTE_PROTOCOL_VERSION) return false;
+  const r = v.request;
+  if (!r || typeof r !== "object") return false;
+  if (!WEB_ROUTE_METHODS.includes(String(r.method))) return false;
+  if (typeof r.path !== "string" || !r.path.startsWith("/")) return false;
+  if (!isStringRecord(r.params)) return false;
+  if (!isQueryRecord(r.query)) return false;
+  if (!isStringRecord(r.headers)) return false;
+  if (r.body !== void 0) {
+    if (r.method === "GET") return false;
+    if (!isWebRouteBody(r.body)) return false;
+  }
+  const a = v.auth;
+  if (!a || typeof a.userId !== "string" || typeof a.orgId !== "string" || typeof a.agentId !== "string") return false;
+  const app = v.app;
+  if (!app || typeof app.id !== "string" || typeof app.name !== "string" || typeof app.origin !== "string") return false;
+  return true;
+}
+function evidenceDisplayText(text) {
+  const raw = typeof text === "string" ? text : "";
+  if (!raw.trim()) return "";
+  const lines = removeHiddenBlocks(raw).split(/\r?\n/).map((line) => {
+    const t = line.trim();
+    for (const [re, label2] of ATTACHMENT_LINES) {
+      const m = t.match(re);
+      if (m) return label2(m);
+    }
+    return t.replace(/https?:\/\/cdn\.heylua\.ai\/\S+/gi, "[attachment]");
+  }).filter(Boolean);
+  const out = lines.join(" ").replace(/\s+/g, " ").trim();
+  return out || "[Attachment]";
+}
+function evidenceSnippet(text) {
+  const flat = evidenceDisplayText(text);
+  return flat.length <= EVIDENCE_SNIPPET_MAX_CHARS ? flat : `${flat.slice(0, EVIDENCE_SNIPPET_MAX_CHARS - 1)}\u2026`;
+}
+function evidenceWordCount(text) {
+  if (typeof text !== "string") return 0;
+  const t = text.trim();
+  return t ? t.split(/\s+/).length : 0;
+}
+function evidenceKey(label2) {
+  return label2.toLowerCase().replace(/[_\-\s]+/g, " ").trim();
+}
+function evidenceOpaqueKey(text) {
+  let h = 0xcbf29ce484222325n;
+  const prime = 0x100000001b3n;
+  for (const ch of evidenceKey(text)) {
+    h ^= BigInt(ch.codePointAt(0) ?? 0);
+    h = h * prime & 0xffffffffffffffffn;
+  }
+  return `q_${h.toString(16).padStart(16, "0")}`;
+}
+function evidenceToolKey(name) {
+  const i = name.indexOf("__");
+  return (i >= 0 ? name.slice(i + 2) : name).toLowerCase();
+}
+function evidenceToolSlug(name) {
+  const i = name.indexOf("__");
+  return i >= 0 ? name.slice(0, i).toLowerCase() : "";
+}
+function skillSlugBase(skill) {
+  return skill.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+function matchDefinedTool(calledName, defined2) {
+  const key = evidenceToolKey(calledName);
+  const candidates = [];
+  defined2.forEach((d, i) => {
+    if (d.name.toLowerCase() === key) candidates.push(i);
+  });
+  if (candidates.length <= 1) return candidates[0] ?? -1;
+  const slug = evidenceToolSlug(calledName);
+  const bySkill = candidates.find((i) => {
+    const base = skillSlugBase(defined2[i].skill);
+    return base !== "" && (slug === base || slug.startsWith(`${base}_`) || base.startsWith(slug));
+  });
+  return bySkill ?? candidates[0];
+}
+function isMisunderstoodReason(reason) {
+  return typeof reason === "string" && /misunderst/i.test(reason);
+}
+function emptyHistogram(bounds) {
+  return {
+    count: 0,
+    sum: 0,
+    buckets: new Array(bounds.length + 1).fill(0)
+  };
+}
+function addToHistogram(h, bounds, value3) {
+  if (!Number.isFinite(value3) || value3 < 0) return;
+  let i = bounds.findIndex((b) => value3 <= b);
+  if (i < 0) i = bounds.length;
+  h.buckets[i] += 1;
+  h.count += 1;
+  h.sum += value3;
+}
+function mergeHistograms(hs, bounds) {
+  if (hs.length === 0) return null;
+  const out = emptyHistogram(bounds);
+  for (const h of hs) {
+    out.count += h.count;
+    out.sum += h.sum;
+    for (let i = 0; i < out.buckets.length; i++) out.buckets[i] += h.buckets[i] ?? 0;
+  }
+  return out.count > 0 ? out : null;
+}
+function histogramQuantile(h, bounds, q) {
+  if (h.count === 0) return 0;
+  const target = q * h.count;
+  let seen = 0;
+  for (let i = 0; i < h.buckets.length; i++) {
+    const n2 = h.buckets[i];
+    if (n2 > 0 && seen + n2 >= target) {
+      const lo = i === 0 ? 0 : bounds[i - 1];
+      if (i >= bounds.length) return lo;
+      const hi = bounds[i];
+      return lo + (target - seen) / n2 * (hi - lo);
+    }
+    seen += n2;
+  }
+  return bounds[bounds.length - 1];
+}
+function mergeCounted(lists) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const list of [
+    ...lists
+  ].reverse()) {
+    for (const item of list) {
+      const cur = byKey.get(item.key);
+      if (!cur) {
+        byKey.set(item.key, {
+          ...item,
+          examples: item.examples.slice(0, EVIDENCE_EXAMPLES_PER_ITEM)
+        });
+      } else {
+        cur.count += item.count;
+        if (cur.examples.length < EVIDENCE_EXAMPLES_PER_ITEM) {
+          cur.examples.push(...item.examples.slice(0, EVIDENCE_EXAMPLES_PER_ITEM - cur.examples.length));
+        }
+      }
+    }
+  }
+  return [
+    ...byKey.values()
+  ].sort((a, b) => b.count - a.count || a.key.localeCompare(b.key));
+}
+function recentRefs(lists) {
+  return lists.flat().sort((a, b) => b.createdAt - a.createdAt).slice(0, EVIDENCE_EXAMPLES_PER_ITEM);
+}
+function confidenceOf(n2) {
+  return n2 < EVIDENCE_LOW_CONFIDENCE_N ? "low" : "ok";
+}
+function rateOf(count, conversations) {
+  return {
+    count,
+    rate: conversations > 0 ? count / conversations : null,
+    confidence: confidenceOf(count)
+  };
+}
+function evidenceDays(from, to) {
+  const out = [];
+  const end = Date.parse(`${to}T00:00:00Z`);
+  for (let t = Date.parse(`${from}T00:00:00Z`); t <= end; t += 864e5) {
+    out.push(new Date(t).toISOString().slice(0, 10));
+  }
+  return out;
+}
+function summarizeEvidence(input) {
+  const { agentId, from, to } = input;
+  const windowDays = evidenceDays(from, to);
+  const readable = /* @__PURE__ */ __name2((s) => s === "ok" || s === "empty", "readable");
+  const covered = /* @__PURE__ */ __name2((d) => readable(d.sources?.messages) && readable(d.sources?.analyses), "covered");
+  const inWindow = input.days.filter((d) => d.date >= from && d.date <= to && covered(d)).sort((a, b) => a.date.localeCompare(b.date));
+  const trackedSince = [
+    ...input.days,
+    ...input.previous ?? []
+  ].filter(covered).map((d) => d.date).sort()[0] ?? null;
+  const sum = /* @__PURE__ */ __name2((f) => inWindow.reduce((acc, d) => acc + (f(d) || 0), 0), "sum");
+  const conversations = sum((d) => d.conversations);
+  const byReason = Object.fromEntries(BAD_CONVERSATION_REASONS.map((r) => [
+    r,
+    sum((d) => d.bad.byReason[r])
+  ]));
+  const badTotal = sum((d) => d.bad.total);
+  const prevDays = (input.previous ?? []).filter(covered);
+  const comparable = prevDays.length > 0;
+  const prevReasons = mergeCounted(prevDays.map((d) => d.themes.failureReasons));
+  const prevTopics = mergeCounted(prevDays.map((d) => d.themes.topics));
+  const toThemes = /* @__PURE__ */ __name2((lists, prev) => mergeCounted(lists).slice(0, EVIDENCE_SHOWN_ITEMS).map((t) => ({
+    ...t,
+    share: badTotal > 0 ? t.count / badTotal : 0,
+    previousCount: comparable ? prev.find((p) => p.key === t.key)?.count ?? 0 : null,
+    confidence: confidenceOf(t.count)
+  })), "toThemes");
+  const usage = /* @__PURE__ */ new Map();
+  for (const d of inWindow) {
+    for (const t of d.tools) {
+      const cur = usage.get(t.name) ?? {
+        name: t.name,
+        calls: 0,
+        conversations: 0,
+        errors: 0
+      };
+      cur.calls += t.calls;
+      cur.conversations += t.conversations;
+      cur.errors += t.errors;
+      usage.set(t.name, cur);
+    }
+  }
+  const latestDefined = [
+    ...inWindow
+  ].reverse().find((d) => d.definedTools)?.definedTools ?? null;
+  const defined2 = input.definedTools !== void 0 ? input.definedTools : latestDefined;
+  const definedKnown = Array.isArray(defined2);
+  const enoughData = conversations >= EVIDENCE_MIN_CONVERSATIONS;
+  const definedList = defined2 ?? [];
+  const definedRows = definedList.map((dt) => ({
+    name: dt.name,
+    skill: dt.skill,
+    calls: 0,
+    conversations: 0,
+    errors: 0
+  }));
+  const matched = /* @__PURE__ */ new Set();
+  for (const u of usage.values()) {
+    const i = matchDefinedTool(u.name, definedList);
+    if (i < 0) continue;
+    matched.add(u.name);
+    definedRows[i].calls += u.calls;
+    definedRows[i].conversations += u.conversations;
+    definedRows[i].errors += u.errors;
+  }
+  definedRows.sort((a, b) => b.calls - a.calls || a.name.localeCompare(b.name));
+  const other = [
+    ...usage.values()
+  ].filter((u) => !matched.has(u.name)).sort((a, b) => b.calls - a.calls);
+  const rt = mergeHistograms(inWindow.map((d) => d.responseTimeMs).filter((h) => !!h), EVIDENCE_LATENCY_BOUNDS_MS);
+  const wordRows = inWindow.map((d) => d.responseWords).filter((h) => !!h);
+  const rw = mergeHistograms(wordRows, EVIDENCE_WORD_BOUNDS);
+  const short = wordRows.reduce((a, h) => a + h.short, 0);
+  const long = wordRows.reduce((a, h) => a + h.long, 0);
+  return {
+    agentId,
+    window: {
+      from,
+      to,
+      days: windowDays.length
+    },
+    coverage: {
+      daysWithData: inWindow.length,
+      trackedSince,
+      complete: inWindow.length === windowDays.length
+    },
+    conversations,
+    exchanges: sum((d) => d.exchanges),
+    bad: {
+      ...rateOf(badTotal, conversations),
+      byReason,
+      examples: recentRefs(inWindow.map((d) => d.examples.bad))
+    },
+    misunderstood: {
+      ...rateOf(sum((d) => d.misunderstood), conversations),
+      examples: recentRefs(inWindow.map((d) => d.examples.misunderstood))
+    },
+    unmetIntent: {
+      ...rateOf(sum((d) => d.unmetIntent), conversations),
+      questions: mergeCounted(inWindow.map((d) => d.unmetQuestions)).slice(0, EVIDENCE_SHOWN_ITEMS)
+    },
+    loops: {
+      ...rateOf(sum((d) => d.loops), conversations),
+      examples: recentRefs(inWindow.map((d) => d.examples.loops))
+    },
+    themes: {
+      failureReasons: toThemes(inWindow.map((d) => d.themes.failureReasons), prevReasons),
+      topics: toThemes(inWindow.map((d) => d.themes.topics), prevTopics),
+      comparable
+    },
+    tools: {
+      enoughData,
+      definedKnown,
+      definedCount: definedRows.length,
+      usedDefinedCount: definedRows.filter((r) => r.calls > 0).length,
+      calledCount: definedRows.filter((r) => r.calls > 0).length + other.filter((u) => u.calls > 0).length,
+      defined: definedRows,
+      unused: enoughData && definedKnown ? definedRows.filter((r) => r.calls === 0).map(({ name, skill }) => ({
+        name,
+        skill
+      })) : [],
+      other
+    },
+    responseTime: rt ? {
+      count: rt.count,
+      avgMs: Math.round(rt.sum / rt.count),
+      medianMs: Math.round(histogramQuantile(rt, EVIDENCE_LATENCY_BOUNDS_MS, 0.5)),
+      p90Ms: Math.round(histogramQuantile(rt, EVIDENCE_LATENCY_BOUNDS_MS, 0.9))
+    } : null,
+    responseLength: rw ? {
+      count: rw.count,
+      avgWords: Math.round(rw.sum / rw.count),
+      medianWords: Math.round(histogramQuantile(rw, EVIDENCE_WORD_BOUNDS, 0.5)),
+      shortRate: short / rw.count,
+      longRate: long / rw.count
+    } : null
+  };
+}
+function sortVerdictReasons(reasons) {
+  return [
+    ...reasons
+  ].sort((a, b) => REVIEW_VERDICT_REASON_ORDER.indexOf(a.kind) - REVIEW_VERDICT_REASON_ORDER.indexOf(b.kind));
+}
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, PLATFORM_INVOCATION_CALLERS, SUPERVISION_OPS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, SCHEDULE_HEALTH_NOTIFY_CHANNELS, SCHEDULE_HEALTH_DEFAULT_NOTIFY, SCHEDULE_HEALTH_LIMITS, KNOWN_KEYS, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES, ONBOARDING_FLOW_KEY, ONBOARDING_SCHEMA_VERSION, id, copy, onboardingHeadingSchema, onboardingRichTextInlineSchema, onboardingRichTextSchema, onboardingDestinationSchema, onboardingArtworkSchema, onboardingAnswerSchema, onboardingQuestionSchema, onboardingTemplateSectionSchema, onboardingTemplateContentSchema, onboardingUnavailableOutcomeSchema, onboardingFlowSchema, onboardingActorSchema, onboardingEditorSchema, onboardingPublicationSummarySchema, onboardingValidationIssueSchema, onboardingValidationResponseSchema, onboardingAssetSchema, onboardingPublicAssetSchema, getOnboardingConfigResponseSchema, saveOnboardingDraftRequestSchema, validateOnboardingRequestSchema, publishOnboardingRequestSchema, rollbackOnboardingRequestSchema, onboardingTemplateCatalogItemSchema, getPublishedOnboardingResponseSchema, WEB_ROUTE_PROTOCOL_VERSION, WEB_ROUTE_METHODS, WEB_ROUTE_REQUEST_HEADER_ALLOWLIST, WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST, WEB_ROUTE_MAX_REQUEST_BODY_BYTES, WEB_ROUTE_MAX_RESPONSE_BYTES, EVIDENCE_SESSION_IDLE_MS, EVIDENCE_MIN_CONVERSATIONS, EVIDENCE_LOW_CONFIDENCE_N, EVIDENCE_SNIPPET_MAX_CHARS, EVIDENCE_EXAMPLES_PER_ITEM, EVIDENCE_SHOWN_ITEMS, EVIDENCE_LATENCY_BOUNDS_MS, EVIDENCE_WORD_BOUNDS, BAD_CONVERSATION_REASONS, ATTACHMENT_LINES, REVIEW_VERDICT_REASON_ORDER;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -2857,6 +3382,35 @@ var init_dist = __esm({
     __name2(personaToLiteral, "personaToLiteral");
     __name(aiGenerateInputFromSimplified, "aiGenerateInputFromSimplified");
     __name2(aiGenerateInputFromSimplified, "aiGenerateInputFromSimplified");
+    PLATFORM_INVOCATION_CALLERS = [
+      "workflow-step",
+      "supervision-preview"
+    ];
+    __name(isPlatformInvocationCaller, "isPlatformInvocationCaller");
+    __name2(isPlatformInvocationCaller, "isPlatformInvocationCaller");
+    __name(supervisionSubjectId, "supervisionSubjectId");
+    __name2(supervisionSubjectId, "supervisionSubjectId");
+    SUPERVISION_OPS = {
+      "agents.list": "discover",
+      "agents.get": "discover",
+      logs: "observe",
+      "runs.list": "observe",
+      "runs.get": "observe",
+      "data.get": "observe",
+      "data.query": "observe",
+      "versions.list": "observe",
+      "versions.get": "observe",
+      "versions.diff": "observe",
+      "versions.preview": "preview",
+      "versions.promote": "release",
+      "persona.versions": "observe",
+      "persona.activate": "release",
+      "source.list": "observe",
+      "source.get": "observe",
+      "env.keys": "observe"
+    };
+    __name(isSupervisionOp, "isSupervisionOp");
+    __name2(isSupervisionOp, "isSupervisionOp");
     REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST = [
       "sendChannelMessage",
       "sendWhatsappTemplate",
@@ -2912,6 +3466,8 @@ var init_dist = __esm({
     __name2(isInteractiveTurn, "isInteractiveTurn");
     __name(removeNavigateBlock, "removeNavigateBlock");
     __name2(removeNavigateBlock, "removeNavigateBlock");
+    __name(removeHiddenBlocks, "removeHiddenBlocks");
+    __name2(removeHiddenBlocks, "removeHiddenBlocks");
     __name(transformChatHistoryContentParts, "transformChatHistoryContentParts");
     __name2(transformChatHistoryContentParts, "transformChatHistoryContentParts");
     RICH_PARTS_MESSAGE_ID_PREFIX = "rich-parts:";
@@ -3544,6 +4100,7 @@ This text is who you are for this person. As you learn them, their name, their w
       "skill",
       "job",
       "webhook",
+      "web-route",
       "trigger",
       "preprocessor",
       "postprocessor",
@@ -3558,7 +4115,8 @@ This text is who you are for this person. As you learn them, their name, their w
       "model-resolver",
       "workflow-step",
       "workflow-script",
-      "workflow"
+      "workflow",
+      "supervision"
     ];
     AGENT_LOG_ENVIRONMENTS = [
       "production",
@@ -4702,6 +5260,41 @@ This text is who you are for this person. As you learn them, their name, their w
     ];
     WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES = 64 * 1024;
     WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES = 256 * 1024;
+    SCHEDULE_HEALTH_NOTIFY_CHANNELS = [
+      "app",
+      "email",
+      "emailApp"
+    ];
+    SCHEDULE_HEALTH_DEFAULT_NOTIFY = "emailApp";
+    SCHEDULE_HEALTH_LIMITS = {
+      maxSilenceMinutes: {
+        min: 5,
+        max: 43200
+      },
+      alertAfterConsecutiveFailures: {
+        min: 1,
+        max: 50
+      },
+      /** The platform's auto-disable trip (PRO-726 / 07 §7.1.6): a streak can never pass it on these kinds. */
+      parkedKindsMaxFailures: 3
+    };
+    KNOWN_KEYS = /* @__PURE__ */ new Set([
+      "maxSilenceMinutes",
+      "alertAfterConsecutiveFailures",
+      "notify"
+    ]);
+    __name(isInt, "isInt");
+    __name2(isInt, "isInt");
+    __name(validateScheduleHealth, "validateScheduleHealth");
+    __name2(validateScheduleHealth, "validateScheduleHealth");
+    __name(normalizeScheduleHealth, "normalizeScheduleHealth");
+    __name2(normalizeScheduleHealth, "normalizeScheduleHealth");
+    __name(evaluateScheduleHealth, "evaluateScheduleHealth");
+    __name2(evaluateScheduleHealth, "evaluateScheduleHealth");
+    __name(scheduleHealthView, "scheduleHealthView");
+    __name2(scheduleHealthView, "scheduleHealthView");
+    __name(scheduleHealthSourceId, "scheduleHealthSourceId");
+    __name2(scheduleHealthSourceId, "scheduleHealthSourceId");
     WORKFLOW_GOAL_JUDGE_SELF = "$self";
     __name(workflowGoalJudgeKind, "workflowGoalJudgeKind");
     __name2(workflowGoalJudgeKind, "workflowGoalJudgeKind");
@@ -5309,6 +5902,150 @@ listed here; never invent a target.`;
     __name2(parseOnboardingFlow, "parseOnboardingFlow");
     __name(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
     __name2(parsePublishedOnboardingResponse, "parsePublishedOnboardingResponse");
+    WEB_ROUTE_PROTOCOL_VERSION = 1;
+    WEB_ROUTE_METHODS = [
+      "GET",
+      "POST",
+      "PUT",
+      "PATCH",
+      "DELETE"
+    ];
+    WEB_ROUTE_REQUEST_HEADER_ALLOWLIST = [
+      "accept",
+      "accept-language",
+      "content-type",
+      "if-none-match",
+      "idempotency-key"
+    ];
+    WEB_ROUTE_RESPONSE_HEADER_ALLOWLIST = [
+      "content-type",
+      "cache-control",
+      "etag",
+      "location",
+      "content-disposition",
+      "content-language"
+    ];
+    __name(isForwardableWebRouteRequestHeader, "isForwardableWebRouteRequestHeader");
+    __name2(isForwardableWebRouteRequestHeader, "isForwardableWebRouteRequestHeader");
+    __name(isForwardableWebRouteResponseHeader, "isForwardableWebRouteResponseHeader");
+    __name2(isForwardableWebRouteResponseHeader, "isForwardableWebRouteResponseHeader");
+    WEB_ROUTE_MAX_REQUEST_BODY_BYTES = 1 * 1024 * 1024;
+    WEB_ROUTE_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+    __name(isWebRouteBody, "isWebRouteBody");
+    __name2(isWebRouteBody, "isWebRouteBody");
+    __name(isStringRecord, "isStringRecord");
+    __name2(isStringRecord, "isStringRecord");
+    __name(isQueryRecord, "isQueryRecord");
+    __name2(isQueryRecord, "isQueryRecord");
+    __name(isWebRouteInput, "isWebRouteInput");
+    __name2(isWebRouteInput, "isWebRouteInput");
+    EVIDENCE_SESSION_IDLE_MS = 30 * 6e4;
+    EVIDENCE_MIN_CONVERSATIONS = 20;
+    EVIDENCE_LOW_CONFIDENCE_N = 5;
+    EVIDENCE_SNIPPET_MAX_CHARS = 160;
+    EVIDENCE_EXAMPLES_PER_ITEM = 5;
+    EVIDENCE_SHOWN_ITEMS = 5;
+    EVIDENCE_LATENCY_BOUNDS_MS = [
+      500,
+      1e3,
+      2e3,
+      3e3,
+      5e3,
+      8e3,
+      13e3,
+      2e4,
+      3e4,
+      6e4,
+      12e4
+    ];
+    EVIDENCE_WORD_BOUNDS = [
+      4,
+      10,
+      20,
+      40,
+      80,
+      150,
+      300,
+      600
+    ];
+    BAD_CONVERSATION_REASONS = [
+      "thumbs_down",
+      "unfinished",
+      "asked_for_human"
+    ];
+    ATTACHMENT_LINES = [
+      // Audio / video / document lines carry a URL; a reply like "Audio: terrible" is the user's words.
+      [
+        /^\[?audio:\s*https?:\/\/\S+\]?$/i,
+        () => "[Voice message]"
+      ],
+      [
+        /^\[?video:\s*https?:\/\/\S+\]?$/i,
+        () => "[Video]"
+      ],
+      [
+        /^\[?document:\s*https?:\/\/\S+\]?$/i,
+        () => "[Document]"
+      ],
+      // Image lines carry a file name with an extension (spaces allowed): "Image: my photo.jpg".
+      [
+        /^\[?image:\s*(?:https?:\/\/\S+|[^\s][^\n]{0,200}\.[a-z0-9]{2,5})\]?$/i,
+        () => "[Image]"
+      ],
+      // "File: name (url)" — bounded classes, no backtracking between the name and the URL.
+      [
+        /^file:\s*([^()]{1,200}?)\s*\(https?:\/\/[^\s)]+\)$/i,
+        (m) => `[File: ${m[1]}]`
+      ]
+    ];
+    __name(evidenceDisplayText, "evidenceDisplayText");
+    __name2(evidenceDisplayText, "evidenceDisplayText");
+    __name(evidenceSnippet, "evidenceSnippet");
+    __name2(evidenceSnippet, "evidenceSnippet");
+    __name(evidenceWordCount, "evidenceWordCount");
+    __name2(evidenceWordCount, "evidenceWordCount");
+    __name(evidenceKey, "evidenceKey");
+    __name2(evidenceKey, "evidenceKey");
+    __name(evidenceOpaqueKey, "evidenceOpaqueKey");
+    __name2(evidenceOpaqueKey, "evidenceOpaqueKey");
+    __name(evidenceToolKey, "evidenceToolKey");
+    __name2(evidenceToolKey, "evidenceToolKey");
+    __name(evidenceToolSlug, "evidenceToolSlug");
+    __name2(evidenceToolSlug, "evidenceToolSlug");
+    __name(skillSlugBase, "skillSlugBase");
+    __name2(skillSlugBase, "skillSlugBase");
+    __name(matchDefinedTool, "matchDefinedTool");
+    __name2(matchDefinedTool, "matchDefinedTool");
+    __name(isMisunderstoodReason, "isMisunderstoodReason");
+    __name2(isMisunderstoodReason, "isMisunderstoodReason");
+    __name(emptyHistogram, "emptyHistogram");
+    __name2(emptyHistogram, "emptyHistogram");
+    __name(addToHistogram, "addToHistogram");
+    __name2(addToHistogram, "addToHistogram");
+    __name(mergeHistograms, "mergeHistograms");
+    __name2(mergeHistograms, "mergeHistograms");
+    __name(histogramQuantile, "histogramQuantile");
+    __name2(histogramQuantile, "histogramQuantile");
+    __name(mergeCounted, "mergeCounted");
+    __name2(mergeCounted, "mergeCounted");
+    __name(recentRefs, "recentRefs");
+    __name2(recentRefs, "recentRefs");
+    __name(confidenceOf, "confidenceOf");
+    __name2(confidenceOf, "confidenceOf");
+    __name(rateOf, "rateOf");
+    __name2(rateOf, "rateOf");
+    __name(evidenceDays, "evidenceDays");
+    __name2(evidenceDays, "evidenceDays");
+    __name(summarizeEvidence, "summarizeEvidence");
+    __name2(summarizeEvidence, "summarizeEvidence");
+    REVIEW_VERDICT_REASON_ORDER = [
+      "overall_below",
+      "dimension_below",
+      "critical_issues",
+      "issue_count"
+    ];
+    __name(sortVerdictReasons, "sortVerdictReasons");
+    __name2(sortVerdictReasons, "sortVerdictReasons");
   }
 });
 
@@ -5923,7 +6660,31 @@ function effectiveJobTools(jobTools, readOnly) {
   }
   return out;
 }
-var __defProp3, __name3, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_READ_ONLY_DROPPED, WORKFLOW_JOB_DEFAULT_TOOLS;
+function isWorkflowJobPluginId(id2) {
+  return typeof id2 === "string" && WORKFLOW_JOB_PLUGINS.includes(id2);
+}
+function workflowJobPluginDir(id2) {
+  return `${WORKFLOW_JOB_PLUGIN_ROOT}/${id2}`;
+}
+function workflowJobPluginsProblem(plugins) {
+  if (plugins === void 0) return null;
+  if (!Array.isArray(plugins)) return "plugins must be an array of plugin ids";
+  if (plugins.length > WORKFLOW_JOB_PLUGINS_MAX) return `at most ${WORKFLOW_JOB_PLUGINS_MAX} plugins per step`;
+  const unknown = plugins.filter((p) => !isWorkflowJobPluginId(p));
+  if (unknown.length) return `unknown plugin ${unknown.map((u) => JSON.stringify(u)).join(", ")} (allowed: ${WORKFLOW_JOB_PLUGINS.join(", ")})`;
+  if (new Set(plugins).size !== plugins.length) return "plugins must not repeat";
+  return null;
+}
+function workflowJobTargetProblem(target, plugins) {
+  if (target === void 0) return null;
+  if (!target || typeof target !== "object" || Array.isArray(target)) return "target must be { agentId }";
+  const keys = Object.keys(target);
+  const agentId = target.agentId;
+  if (keys.length !== 1 || typeof agentId !== "string" || !agentId.trim() || agentId.length > 256) return "target must be exactly { agentId: <non-empty string> }";
+  if (!Array.isArray(plugins) || plugins.length === 0) return "`target` is legal only beside `plugins`";
+  return null;
+}
+var __defProp3, __name3, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_READ_ONLY_DROPPED, WORKFLOW_JOB_DEFAULT_TOOLS, WORKFLOW_JOB_PLUGINS, WORKFLOW_JOB_PLUGIN_ROOT, WORKFLOW_JOB_PLUGINS_MAX;
 var init_workflow_job_tools = __esm({
   "../shared-types/dist/workflow-job-tools.mjs"() {
     "use strict";
@@ -5958,6 +6719,19 @@ var init_workflow_job_tools = __esm({
     ];
     __name(effectiveJobTools, "effectiveJobTools");
     __name3(effectiveJobTools, "effectiveJobTools");
+    WORKFLOW_JOB_PLUGINS = [
+      "lua-agent-builder"
+    ];
+    WORKFLOW_JOB_PLUGIN_ROOT = "/opt/lua/plugins";
+    WORKFLOW_JOB_PLUGINS_MAX = 4;
+    __name(isWorkflowJobPluginId, "isWorkflowJobPluginId");
+    __name3(isWorkflowJobPluginId, "isWorkflowJobPluginId");
+    __name(workflowJobPluginDir, "workflowJobPluginDir");
+    __name3(workflowJobPluginDir, "workflowJobPluginDir");
+    __name(workflowJobPluginsProblem, "workflowJobPluginsProblem");
+    __name3(workflowJobPluginsProblem, "workflowJobPluginsProblem");
+    __name(workflowJobTargetProblem, "workflowJobTargetProblem");
+    __name3(workflowJobTargetProblem, "workflowJobTargetProblem");
   }
 });
 
@@ -6908,6 +7682,26 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         warn("gh-on-coding-turn", `"${id2}" grants the gh tool on a coding turn \u2014 the pod can open/merge PRs on the workspace repo (purpose:'gh' token, pull_requests:write + contents:write)`, `${path26}.jobTools`, id2);
       }
     }
+    const plugins = node.plugins;
+    const target = node.target;
+    if (target !== void 0) {
+      const problem = workflowJobTargetProblem(target, plugins);
+      if (problem) err("target-invalid", problem, `${path26}.target`, id2);
+    }
+    if (plugins !== void 0) {
+      const problem = workflowJobPluginsProblem(plugins);
+      if (problem) err("plugins-invalid", problem, `${path26}.plugins`, id2);
+      if (node.type !== "agent") err("plugins-invalid", "`plugins` is legal on agent steps only", `${path26}.plugins`, id2);
+      else {
+        if (!isJobTier(node)) err("plugins-invalid", "`plugins` needs tier:'job'", `${path26}.plugins`, id2);
+        const provider = classifyModelProvider(jobClassifiablePin(node.model));
+        if (node.harness === "generic" || provider !== null && provider !== "anthropic") err("plugins-invalid", "`plugins` run on the claude-code harness only (an Anthropic model, no `harness:'generic'`)", `${path26}.plugins`, id2);
+        const w = workspaceOf(node);
+        const ro = w !== void 0 && w !== "inherit" && w.mount === "ro";
+        const declared = Array.isArray(tools) ? tools : void 0;
+        if (!effectiveJobTools(declared, ro).includes("shell")) err("plugins-invalid", "`plugins` need the `shell` job tool (the plugin drives lua-cli) \u2014 keep it in jobTools and mount rw", `${path26}.plugins`, id2);
+      }
+    }
     if (node.type === "agent" && ws && ws !== "inherit" && ws.mount === "ro" && Array.isArray(tools) && effectiveJobTools(tools, true).length === 0) {
       warn("ro-step-has-no-tools", `"${id2}" mounts the workspace read-only and every jobTool it declares (${JSON.stringify(tools)}) is one the ro mount drops [${WORKFLOW_JOB_READ_ONLY_DROPPED.join(", ")}] \u2014 the coding turn would run with no tools at all; keep a read-only tool (read/glob/grep, gh) or mount rw`, `${path26}.jobTools`, id2);
     }
@@ -10376,6 +11170,15 @@ function createWorkflow(cfg) {
     const n2 = cfg.backfillOnEnable.maxOccurrences;
     if (!Number.isInteger(n2) || n2 < 1 || n2 > 200) throw new LuaWorkflowBuildError("invalid-envelope", "backfillOnEnable.maxOccurrences must be an integer in 1..200 (backfill-max-occurrences-out-of-range; the org maxBatchItems twin is checked at publish/R56)");
   }
+  if (cfg.health !== void 0) {
+    const issues = validateScheduleHealth(cfg.health, {
+      target: "workflow",
+      triggers: cfg.schedule && typeof cfg.schedule === "object" ? [
+        cfg.schedule
+      ] : []
+    });
+    if (issues.length > 0) throw new LuaWorkflowBuildError("invalid-envelope", issues.map((i) => `${i.message} (${i.code})`).join("; "));
+  }
   const keys = /* @__PURE__ */ new Set();
   envRefKeys(cfg.schedule, keys);
   envRefKeys(cfg.workspace, keys);
@@ -10400,6 +11203,7 @@ var init2, state2, lit2, eq2, ne2, gt2, gte2, lt2, lte2, inSet2, notIn2, exists2
 var init_workflow = __esm({
   "src/types/workflow.ts"() {
     "use strict";
+    init_workflow_job_tools();
     init_dist();
     init_dist2();
     __name(createStep, "createStep");
@@ -10898,6 +11702,15 @@ var init_workflow = __esm({
             throw new LuaWorkflowBuildError("max-turns-invalid", `"${id2}": ${m} must be an integer ${min}..${max}`);
           }
         }
+        if (opts.plugins !== void 0) {
+          if (tier !== "job") throw new LuaWorkflowBuildError("plugins-invalid", `"${id2}": plugins are only legal on a tier:'job' agent step`);
+          const problem = workflowJobPluginsProblem(opts.plugins);
+          if (problem) throw new LuaWorkflowBuildError("plugins-invalid", `"${id2}": ${problem}`);
+        }
+        if (opts.target !== void 0) {
+          const problem = workflowJobTargetProblem(opts.target, opts.plugins);
+          if (problem) throw new LuaWorkflowBuildError("plugins-invalid", `"${id2}": ${problem}`);
+        }
         assertTimeout({
           id: id2,
           timeoutSeconds: opts.timeoutSeconds,
@@ -10930,7 +11743,9 @@ var init_workflow = __esm({
           harness: opts.harness,
           maxTurns: opts.maxTurns,
           maxMessages: opts.maxMessages,
-          maxInputTokens: opts.maxInputTokens
+          maxInputTokens: opts.maxInputTokens,
+          plugins: opts.plugins,
+          target: opts.target
         });
         return this.push({
           kind: "declare",
@@ -11723,18 +12538,18 @@ var init_http_client = __esm({
       * Use this only when a successful response contains a one-time secret that
       * cannot be recovered after an ambiguous network or server failure.
       */
-      async httpPostOnce(url, data, headers) {
+      async httpPostOnce(url, data, headers, overrides) {
         return this.retryableRequest(this.baseUrl + url, {
           method: "POST",
           body: data ? JSON.stringify(data) : void 0,
           headers
-        }, 0);
+        }, 0, overrides);
       }
-      async httpPostCoreDrainRetry(url, data, headers) {
-        const first = await this.httpPostOnce(url, data, headers);
+      async httpPostCoreDrainRetry(url, data, headers, overrides) {
+        const first = await this.httpPostOnce(url, data, headers, overrides);
         if (!isCoreDrainApiError(first.error)) return first;
         await new Promise((resolve7) => setTimeout(resolve7, coreDrainApiRetryDelayMs(first.error)));
-        return this.httpPostOnce(url, data, headers);
+        return this.httpPostOnce(url, data, headers, overrides);
       }
       /**
       * Performs an HTTP PUT request
@@ -13312,7 +14127,7 @@ var init_base_handler = __esm({
           if (syncVersions && Array.isArray(versions) && versions.length > 0) {
             const activeVersion = this.getActiveVersion(serverItem);
             const currentVersion = item.version;
-            if (activeVersion && activeVersion !== currentVersion) {
+            if (activeVersion && compareVersions(activeVersion, currentVersion) > 0) {
               const msg = `\u{1F4DD} Updated "${item.name}" ${this.displayName} version: ${currentVersion} \u2192 ${activeVersion}`;
               msgs.push(msg);
               console.log(msg);
@@ -15857,6 +16672,7 @@ var init_job_plugin = __esm({
   "src/compiler/plugins/job.plugin.ts"() {
     "use strict";
     init_base();
+    init_dist();
     init_ast_helpers();
     init_class_hierarchy();
     JobPlugin = class extends BasePlugin {
@@ -15902,6 +16718,8 @@ var init_job_plugin = __esm({
           maxAttempts: extractNestedProperty(retryObj, "maxAttempts"),
           backoffSeconds: extractNestedProperty(retryObj, "backoffSeconds")
         } : void 0;
+        const healthHit = findClassMember(classDecl, "health", "property");
+        const healthConfig = healthHit && Node5.isPropertyDeclaration(healthHit.node) ? evaluateNodeAsObject(healthHit.node.getInitializer()) : void 0;
         return {
           kind: this.kind,
           name,
@@ -15922,7 +16740,9 @@ var init_job_plugin = __esm({
             hasTimeout: timeoutHit !== void 0,
             hasRetry: retryHit !== void 0,
             timeoutValue,
-            retryConfig
+            retryConfig,
+            hasHealth: healthHit !== void 0,
+            healthConfig
           }
         };
       }
@@ -15937,6 +16757,7 @@ var init_job_plugin = __esm({
     schedule: __lua_instance__.schedule,
     timeout: __lua_instance__.timeout,
     retry: __lua_instance__.retry,
+    health: __lua_instance__.health,
     execute: typeof __lua_instance__.execute === 'function' ? __lua_instance__.execute.bind(__lua_instance__) : undefined,
   }`;
       }
@@ -15958,6 +16779,7 @@ var init_job_plugin = __esm({
           maxAttempts: extractNestedProperty(retryObj, "maxAttempts"),
           backoffSeconds: extractNestedProperty(retryObj, "backoffSeconds")
         } : void 0;
+        const healthConfig = extractObjectProperty(config, "health");
         return {
           kind: this.kind,
           ...common,
@@ -15972,7 +16794,9 @@ var init_job_plugin = __esm({
             hasTimeout: config.getProperty("timeout") !== void 0,
             hasRetry: config.getProperty("retry") !== void 0,
             timeoutValue,
-            retryConfig
+            retryConfig,
+            hasHealth: config.getProperty("health") !== void 0,
+            healthConfig
           }
         };
       }
@@ -15999,6 +16823,29 @@ var init_job_plugin = __esm({
             line: metadata.line
           }));
         }
+        if (metadata.metadata.hasHealth) {
+          if (!metadata.metadata.healthConfig) {
+            errors.push(validationError("Job `health` must be an object literal the compiler can read", {
+              line: metadata.line,
+              suggestion: "health: { maxSilenceMinutes: 90, alertAfterConsecutiveFailures: 3, notify: 'emailApp' }"
+            }));
+          } else {
+            const schedule = metadata.metadata.scheduleType ? [
+              {
+                type: metadata.metadata.scheduleType,
+                seconds: metadata.metadata.scheduleSeconds
+              }
+            ] : [];
+            for (const issue of validateScheduleHealth(metadata.metadata.healthConfig, {
+              target: "job",
+              triggers: schedule
+            })) {
+              errors.push(validationError(`Job ${issue.path}: ${issue.message} (${issue.code})`, {
+                line: metadata.line
+              }));
+            }
+          }
+        }
         return {
           valid: errors.length === 0,
           errors,
@@ -16026,7 +16873,10 @@ var init_job_plugin = __esm({
             timezone: jobMeta.scheduleTimezone
           } : void 0,
           timeout: jobMeta.timeoutValue,
-          retry: jobMeta.retryConfig
+          retry: jobMeta.retryConfig,
+          ...jobMeta.healthConfig ? {
+            health: jobMeta.healthConfig
+          } : {}
         };
       }
     };
@@ -18056,7 +18906,7 @@ function shapeReasoningSetting(value3) {
   return Object.keys(result).length > 0 ? result : void 0;
 }
 function shapeModelSettings(raw) {
-  const KNOWN_KEYS = [
+  const KNOWN_KEYS2 = [
     "temperature",
     "topP",
     "topK",
@@ -18068,7 +18918,7 @@ function shapeModelSettings(raw) {
     "reasoning"
   ];
   const result = {};
-  for (const key of KNOWN_KEYS) {
+  for (const key of KNOWN_KEYS2) {
     const value3 = raw[key];
     if (value3 === void 0) continue;
     if (key === "stopSequences") {
@@ -22194,6 +23044,8 @@ function metaOf(node, sources) {
     pick("outputSchema", n2.outputSchema);
     const jobTools = n2.toolScope?.jobTools;
     pick("jobTools", jobTools);
+    pick("plugins", n2.plugins);
+    pick("target", n2.target);
   }
   if (n2.type === "approval") {
     pick("editedPayloadSchema", n2.editedPayloadSchema);
@@ -23076,6 +23928,7 @@ ${firstBundleFrame(vmResult.error.stack)}` : ""}`,
           schedule: config.schedule,
           scheduleInput: config.scheduleInput,
           backfillOnEnable: config.backfillOnEnable,
+          health: config.health,
           outputVisibility: config.outputVisibility,
           goal: config.goal
         };
@@ -27086,6 +27939,48 @@ var init_integrations_api_service = __esm({
 });
 
 // src/api/agents.api.service.ts
+function toInvocationOutput(data, callerThreadId) {
+  const toolNames = /* @__PURE__ */ new Set();
+  for (const step3 of Array.isArray(data.steps) ? data.steps : []) {
+    for (const call of Array.isArray(step3?.toolCalls) ? step3.toolCalls : []) {
+      const name = call?.payload?.toolName;
+      if (name) toolNames.add(name);
+    }
+  }
+  return {
+    text: data.text ?? "",
+    finishReason: data.finishReason,
+    ...data.usage !== void 0 ? {
+      usage: data.usage
+    } : {},
+    ...toolNames.size ? {
+      toolsUsed: [
+        ...toolNames
+      ]
+    } : {},
+    ...callerThreadId !== void 0 ? {
+      threadId: callerThreadId
+    } : {}
+  };
+}
+function runSummary(r) {
+  if (!r || typeof r !== "object") return {};
+  const pick = [
+    "workflowId",
+    "workflowName",
+    "status",
+    "reason",
+    "trigger",
+    "createdAt",
+    "startedAt",
+    "completedAt"
+  ];
+  const out = {
+    runId: r.runId ?? r.id
+  };
+  for (const k of pick) if (r[k] !== void 0) out[k] = r[k];
+  return out;
+}
 var AgentsApiService;
 var init_agents_api_service = __esm({
   "src/api/agents.api.service.ts"() {
@@ -27105,7 +28000,9 @@ var init_agents_api_service = __esm({
         });
         if (body.identifier) query.set("identifier", body.identifier);
         const chatBody = this.toChatGenerateBody(body);
-        return this.httpPostCoreDrainRetry(`/chat/generate/${targetAgentId}?${query.toString()}`, chatBody, {});
+        return this.httpPostCoreDrainRetry(`/chat/generate/${targetAgentId}?${query.toString()}`, chatBody, {}, typeof body.timeoutMs === "number" ? {
+          timeoutMs: body.timeoutMs
+        } : void 0);
       }
       /**
       * Sandbox overload: mirrors the `AI.generate` pattern where the simplified
@@ -27123,7 +28020,128 @@ var init_agents_api_service = __esm({
         if (!result.data) {
           throw new Error("Agent invocation failed: empty response");
         }
-        return typeof promptOrInput === "string" ? result.data.text ?? "" : result.data;
+        if (typeof promptOrInput === "string") return result.data.text ?? "";
+        const data = result.data;
+        if (data?.type === "preprocessor_blocked") {
+          throw Object.assign(new Error(data.text || "Agent invocation blocked by preprocessor"), {
+            name: "AgentInvocationError",
+            code: "PREPROCESSOR_BLOCKED",
+            stage: "preprocess"
+          });
+        }
+        if (data?.governanceBlock) {
+          throw Object.assign(new Error(data.text || "Agent invocation blocked by governance"), {
+            name: "AgentInvocationError",
+            code: "GOVERNANCE_BLOCKED",
+            stage: data.governanceBlock?.stage
+          });
+        }
+        return toInvocationOutput(data, input.threadId);
+      }
+      /**
+      * EM-WS2 — the offline (`lua test` / `lua dev`) twin of the `Agents.*`
+      * supervision members. Read ops go to the developer REST routes with YOUR
+      * developer credential (so they return what you can see, not what a
+      * supervisor grant allows); the platform's projections are mirrored (env KEYS
+      * only, Data only from the target's declared collections, logs without user
+      * ids). Release ops (`versions.promote`, `persona.activate`) and
+      * `versions.preview` are REFUSED offline: a local test must never change what a
+      * live agent serves.
+      */
+      async superviseForSandbox(op, targetAgentId, args2 = {}) {
+        const refuse = /* @__PURE__ */ __name((code, message) => {
+          throw Object.assign(new Error(message), {
+            name: "SupervisionError",
+            code
+          });
+        }, "refuse");
+        if (op === "versions.promote" || op === "persona.activate") {
+          refuse("supervision_release_offline_refused", `${op} is refused offline: a local test never changes a live agent`);
+        }
+        if (op === "versions.preview" || op === "agents.list" || op === "agents.get" || op === "source.get") {
+          refuse("supervision_unavailable_offline", `${op} is not available offline; run it on the platform`);
+        }
+        const id2 = targetAgentId ? encodeURIComponent(targetAgentId) : refuse("supervision_no_target", "A target agent id is required");
+        const get = /* @__PURE__ */ __name(async (url) => {
+          const res = await this.httpGet(url);
+          if (!res.success) refuse("supervision_offline_error", res.error?.message || `GET ${url} failed`);
+          return res.data;
+        }, "get");
+        const q = /* @__PURE__ */ __name((params) => {
+          const sp = new URLSearchParams();
+          for (const [k, v] of Object.entries(params)) if (v !== void 0 && v !== null && v !== "") sp.set(k, String(v));
+          const s = sp.toString();
+          return s ? `?${s}` : "";
+        }, "q");
+        switch (op) {
+          case "logs": {
+            const page = await get(`/developer/agents/${id2}/logs${q({
+              limit: Math.min(Number(args2.limit) || 50, 100),
+              logSource: args2.logSource
+            })}`);
+            const rows3 = Array.isArray(page?.logs) ? page.logs : [];
+            return rows3.map((r) => ({
+              timestamp: r.timestamp,
+              ...r.subType ? {
+                level: r.subType
+              } : {},
+              ...r.metadata?.logSource ? {
+                logSource: r.metadata.logSource
+              } : {},
+              ...r.metadata?.primitiveName ? {
+                primitiveName: r.metadata.primitiveName
+              } : {},
+              ...r.metadata?.toolName ? {
+                toolName: r.metadata.toolName
+              } : {}
+            }));
+          }
+          case "runs.list": {
+            const page = await get(`/workflows/${id2}/runs${q({
+              limit: Math.min(Number(args2.limit) || 20, 50),
+              status: args2.status
+            })}`);
+            return (Array.isArray(page?.items) ? page.items : []).map(runSummary);
+          }
+          case "runs.get":
+            return runSummary(await get(`/workflows/${id2}/runs/${encodeURIComponent(String(args2.runId ?? ""))}`));
+          case "versions.list":
+            return get(`/developer/agents/${id2}/versions${q({
+              limit: args2.limit
+            })}`);
+          case "versions.get":
+            return get(`/developer/agents/${id2}/versions/${encodeURIComponent(String(args2.version))}`);
+          case "versions.diff":
+            return get(`/developer/agents/${id2}/versions/diff${q({
+              from: args2.from,
+              to: args2.to
+            })}`);
+          case "persona.versions":
+            return get(`/developer/agents/${id2}/persona/versions`);
+          case "source.list": {
+            const manifest = await get(`/developer/agents/${id2}/backup/manifest`);
+            const files = Array.isArray(manifest?.files) ? manifest.files : [];
+            return {
+              files: files.map((f) => ({
+                path: f.relativePath,
+                ...typeof f.size === "number" ? {
+                  size: f.size
+                } : {}
+              }))
+            };
+          }
+          case "env.keys": {
+            const env = await get(`/developer/agents/${id2}/env`);
+            return {
+              keys: Object.keys(env?.data ?? {}).sort()
+            };
+          }
+          case "data.get":
+          case "data.query":
+            return refuse("supervision_unavailable_offline", `${op} is not available offline; run it on the platform`);
+          default:
+            return refuse("supervision_unknown_op", `Unknown supervision operation ${String(op)}`);
+        }
       }
       toChatGenerateBody(body) {
         const messages = body.messages ? body.messages : [
@@ -27149,10 +28167,15 @@ var init_agents_api_service = __esm({
           } : {},
           ...body.clientContext !== void 0 ? {
             clientContext: body.clientContext
+          } : {},
+          ...body.model !== void 0 ? {
+            model: body.model
           } : {}
         };
       }
     };
+    __name(toInvocationOutput, "toInvocationOutput");
+    __name(runSummary, "runSummary");
   }
 });
 
@@ -29203,6 +30226,9 @@ var init_mcp_server_handler = __esm({
               name: server.name,
               transport: server.config?.transport || "streamable-http"
             };
+            if (server.description) {
+              result.description = server.description;
+            }
             if (server.config?.url !== void 0) {
               result.url = server.config.url;
             }
@@ -30995,17 +32021,34 @@ var PersonaApi = class extends HttpClient {
     return this.httpGet(`/developer/agents/${this.agentId}/persona/versions${statusParam}`, {});
   }
   /**
-  * Creates a new persona version
+  * Creates a new persona version.
+  *
+  * PRO-2170: the route STAGES by default — creating a version does not change
+  * what the agent serves. `options.publish` is sent only when the caller
+  * passes it, so an omitted flag means "whatever the server's default is" and
+  * an explicit `false` pins the stage-only intent on the wire (what `lua push`
+  * sends, so a server that ever flips its default cannot silently publish a
+  * push again). Activation is `deployVersion`.
+  *
   * @param persona - The persona content (string or channel-aware object)
+  * @param options.publish - `true` = create and serve in one call; `false` = stage only
   * @returns Promise resolving to an ApiResponse with the created version
   */
-  async createVersion(persona) {
+  async createVersion(persona, options = {}) {
     return this.httpPost(`/developer/agents/${this.agentId}/persona/version`, {
-      persona
+      persona,
+      ...options.publish === void 0 ? {} : {
+        publish: options.publish
+      }
     }, {});
   }
   /**
-  * Deploys/activates a persona version to production
+  * Deploys/activates a persona version to production.
+  *
+  * PRO-2170: this is the ONLY path that changes the persona the agent serves.
+  * It re-points the agent, marks the version `published` and demotes the
+  * previously-published one to `staged`.
+  *
   * @param version - The version number to deploy
   * @returns Promise resolving to an ApiResponse with confirmation
   */
@@ -31025,9 +32068,15 @@ var PersonaApi = class extends HttpClient {
     return sorted[0];
   }
   /**
-  * Gets the latest published persona version (excludes drafts)
-  * This is the most recently pushed version, regardless of whether it's currently active.
-  * Use this for sync - code should match the latest push, not a rollback.
+  * Gets the latest published persona version.
+  *
+  * PRO-2170 changed what this means. It used to be "the most recently pushed
+  * version", because a push published every version it created. Now a push
+  * STAGES, so `published` is the version production SERVES, and a local
+  * persona ahead of it is genuine drift (`checkPersonaDrift`) — the same
+  * reading as a pushed-but-not-activated skill. Use `getLatestVersion` (all
+  * statuses) when you want the most recent push instead.
+  *
   * @returns Promise resolving to the latest published PersonaVersion or null if none exist
   */
   async getLatestPublishedVersion() {
@@ -31790,7 +32839,9 @@ var AgentHandler = class {
   }
   async pushPersona(ctx, persona) {
     const personaApi = new PersonaApi(BASE_URLS.API, ctx.apiKey, ctx.agentId);
-    const result = await personaApi.createVersion(persona);
+    const result = await personaApi.createVersion(persona, {
+      publish: false
+    });
     return {
       success: result.success,
       version: result.data?.version
@@ -33252,7 +34303,7 @@ async function syncCommand(options) {
     try {
       writeProgress("\u{1F504} Compiling to get latest local state...");
       await compileCommand({
-        serverSync: true
+        serverSync: !options?.check
       });
       writeProgress("\u{1F504} Checking for drift between server and local code...");
       const { agentId, apiKey } = await initializeCommand({
@@ -33537,6 +34588,7 @@ async function executePushMode(context, drift, primitiveDrift) {
       const result = await agentHandler.pushPersona(context, drift.persona.localPersona);
       if (result.success) {
         writeSuccess(`\u2705 Persona version ${result.version} created on server`);
+        writeInfo(`   Staged, NOT activated \u2014 activate it with \`lua deploy persona --set-version ${result.version}\`.`);
       } else {
         console.error("\u274C Failed to push persona");
         syncFullySucceeded = false;
@@ -33745,6 +34797,7 @@ async function handlePersonaDriftInteractive(context, drift) {
       const result = await agentHandler.pushPersona(context, drift.localPersona);
       if (result.success) {
         writeSuccess(`\u2705 Persona version ${result.version} created on server`);
+        writeInfo(`   Staged, NOT activated \u2014 activate it with \`lua deploy persona --set-version ${result.version}\`.`);
       } else {
         console.error("\u274C Failed to push persona");
       }
@@ -34358,7 +35411,7 @@ var JobHandler = class extends BaseVersionedHandler {
     };
   }
   /**
-  * Override to include schedule, timeout, retry fields in push data.
+  * Override to include schedule, timeout, retry (and, when declared, health) fields in push data.
   */
   buildPushData(primitive, compressedCode, codeS3Hash) {
     const job = primitive;
@@ -34373,7 +35426,11 @@ var JobHandler = class extends BaseVersionedHandler {
       schedule: job.schedule,
       timeout: job.timeout,
       retry: job.retry,
-      metadata: job.metadata
+      metadata: job.metadata,
+      // EM-WS10: only when declared, so an undeclared push stays byte-identical.
+      ...job.health ? {
+        health: job.health
+      } : {}
     };
   }
 };
@@ -35028,6 +36085,105 @@ init_workflow_api_service();
 init_artifact_loader();
 init_bundle_upload();
 
+// ../sandbox-runtime/dist/supervision-api.mjs
+var __defProp7 = Object.defineProperty;
+var __name7 = /* @__PURE__ */ __name((target, value3) => __defProp7(target, "name", { value: value3, configurable: true }), "__name");
+function typedError(code, message) {
+  return Object.assign(new Error(message), {
+    name: "SupervisionError",
+    code
+  });
+}
+__name(typedError, "typedError");
+__name7(typedError, "typedError");
+function requireExpectActive(opts, what) {
+  const expectActive = opts?.expectActive;
+  if (expectActive === null) return null;
+  if (typeof expectActive === "number" && Number.isInteger(expectActive) && expectActive > 0) return expectActive;
+  throw typedError("supervision_expect_active_required", `${what} requires { expectActive } \u2014 the version you expect to be active now (null = none)`);
+}
+__name(requireExpectActive, "requireExpectActive");
+__name7(requireExpectActive, "requireExpectActive");
+function buildSupervisionAgentsApi(call) {
+  return {
+    /** Agents of the caller's own organization, with the supervision actions the caller holds on each. */
+    list: /* @__PURE__ */ __name7(() => call("agents.list"), "list"),
+    /** One agent of the caller's organization (not found = other org or no such agent). */
+    get: /* @__PURE__ */ __name7((agentId) => call("agents.get", agentId), "get"),
+    /** Recent execution logs of a supervised agent (metadata + message, no user ids). */
+    logs: /* @__PURE__ */ __name7((agentId, opts = {}) => call("logs", agentId, {
+      ...opts
+    }), "logs"),
+    runs: /* @__PURE__ */ __name7((agentId) => ({
+      list: /* @__PURE__ */ __name7((opts = {}) => call("runs.list", agentId, {
+        ...opts
+      }), "list"),
+      get: /* @__PURE__ */ __name7((runId) => call("runs.get", agentId, {
+        runId
+      }), "get")
+    }), "runs"),
+    /** Read-only, and only the collections the org admin named on the supervision grant. */
+    data: /* @__PURE__ */ __name7((agentId) => ({
+      get: /* @__PURE__ */ __name7((collection, entryId) => call("data.get", agentId, {
+        collection,
+        entryId
+      }), "get"),
+      query: /* @__PURE__ */ __name7((collection, filter, opts = {}) => call("data.query", agentId, {
+        collection,
+        ...filter ? {
+          filter
+        } : {},
+        ...opts
+      }), "query")
+    }), "data"),
+    versions: /* @__PURE__ */ __name7((agentId) => ({
+      list: /* @__PURE__ */ __name7((opts = {}) => call("versions.list", agentId, {
+        ...opts
+      }), "list"),
+      get: /* @__PURE__ */ __name7((version) => call("versions.get", agentId, {
+        version
+      }), "get"),
+      diff: /* @__PURE__ */ __name7((from, to) => call("versions.diff", agentId, {
+        from,
+        to
+      }), "diff"),
+      /** Chat a staged version. No tools run unless `opts.toolScope.skillIds` allowlists them. */
+      preview: /* @__PURE__ */ __name7((version, prompt, opts = {}) => call("versions.preview", agentId, {
+        version,
+        prompt,
+        ...opts.toolScope ? {
+          toolScope: opts.toolScope
+        } : {}
+      }), "preview"),
+      /** Make `version` live. Compare-and-swap: refused unless `expectActive` is the live version. */
+      promote: /* @__PURE__ */ __name7(async (version, opts) => call("versions.promote", agentId, {
+        version,
+        expectActive: requireExpectActive(opts, "versions.promote")
+      }), "promote")
+    }), "versions"),
+    persona: /* @__PURE__ */ __name7((agentId) => ({
+      versions: /* @__PURE__ */ __name7(() => call("persona.versions", agentId), "versions"),
+      /** Serve persona `version`. Compare-and-swap on the served persona version. */
+      activate: /* @__PURE__ */ __name7(async (version, opts) => call("persona.activate", agentId, {
+        version,
+        expectActive: requireExpectActive(opts, "persona.activate")
+      }), "activate")
+    }), "persona"),
+    source: /* @__PURE__ */ __name7((agentId) => ({
+      list: /* @__PURE__ */ __name7(() => call("source.list", agentId), "list"),
+      get: /* @__PURE__ */ __name7((path26) => call("source.get", agentId, {
+        path: path26
+      }), "get")
+    }), "source"),
+    /** Environment variable NAMES only — values are never returned. */
+    env: /* @__PURE__ */ __name7((agentId) => ({
+      keys: /* @__PURE__ */ __name7(() => call("env.keys", agentId), "keys")
+    }), "env")
+  };
+}
+__name(buildSupervisionAgentsApi, "buildSupervisionAgentsApi");
+__name7(buildSupervisionAgentsApi, "buildSupervisionAgentsApi");
+
 // src/utils/sandbox.ts
 init_dist4();
 import vm4 from "vm";
@@ -35148,8 +36304,8 @@ import path19 from "path";
 import { spawn as nodeSpawn } from "child_process";
 import { accessSync, constants as fsConstants, realpathSync, statSync as statSync5 } from "fs";
 import path18 from "path";
-var __defProp7 = Object.defineProperty;
-var __name7 = /* @__PURE__ */ __name((target, value3) => __defProp7(target, "name", { value: value3, configurable: true }), "__name");
+var __defProp8 = Object.defineProperty;
+var __name8 = /* @__PURE__ */ __name((target, value3) => __defProp8(target, "name", { value: value3, configurable: true }), "__name");
 var WORKFLOW_EXEC_BINARIES = Object.freeze([
   "git",
   "gh",
@@ -35173,7 +36329,7 @@ var WorkflowExecError = class extends Error {
     __name(this, "WorkflowExecError");
   }
   static {
-    __name7(this, "WorkflowExecError");
+    __name8(this, "WorkflowExecError");
   }
   code;
   reason;
@@ -35207,7 +36363,7 @@ function isWorkflowExecError(err) {
   return !!e && typeof e === "object" && e.name === "ExecError" && typeof e.code === "string";
 }
 __name(isWorkflowExecError, "isWorkflowExecError");
-__name7(isWorkflowExecError, "isWorkflowExecError");
+__name8(isWorkflowExecError, "isWorkflowExecError");
 function workflowExecRefusal(reason, detail, argv) {
   return new WorkflowExecError("EXEC_REFUSED", `[Lua] exec refused: ${detail} (EXEC_REFUSED/${reason})`, {
     reason,
@@ -35217,7 +36373,7 @@ function workflowExecRefusal(reason, detail, argv) {
   });
 }
 __name(workflowExecRefusal, "workflowExecRefusal");
-__name7(workflowExecRefusal, "workflowExecRefusal");
+__name8(workflowExecRefusal, "workflowExecRefusal");
 var refused = workflowExecRefusal;
 var ALLOWLIST_TEXT = WORKFLOW_EXEC_BINARIES.join(", ");
 function parseCommandTemplate(template3, values) {
@@ -35228,13 +36384,13 @@ function parseCommandTemplate(template3, values) {
   const argv = [];
   let current = null;
   let quote = null;
-  const flush = /* @__PURE__ */ __name7(() => {
+  const flush = /* @__PURE__ */ __name8(() => {
     if (current !== null) {
       argv.push(current);
       current = null;
     }
   }, "flush");
-  const scalar = /* @__PURE__ */ __name7((v, at) => {
+  const scalar = /* @__PURE__ */ __name8((v, at) => {
     if (typeof v === "string") return v;
     if (typeof v === "number" && Number.isFinite(v)) return String(v);
     if (typeof v === "boolean") return String(v);
@@ -35295,7 +36451,7 @@ function parseCommandTemplate(template3, values) {
   return argv;
 }
 __name(parseCommandTemplate, "parseCommandTemplate");
-__name7(parseCommandTemplate, "parseCommandTemplate");
+__name8(parseCommandTemplate, "parseCommandTemplate");
 function validateWorkflowExecArgv(argv) {
   if (!Array.isArray(argv)) throw refused("argv_invalid", 'argv must be an array of strings \u2014 exec(["git", "status"])');
   if (argv.length === 0) throw refused("argv_empty", "the command is empty");
@@ -35317,7 +36473,7 @@ function validateWorkflowExecArgv(argv) {
   ];
 }
 __name(validateWorkflowExecArgv, "validateWorkflowExecArgv");
-__name7(validateWorkflowExecArgv, "validateWorkflowExecArgv");
+__name8(validateWorkflowExecArgv, "validateWorkflowExecArgv");
 function resolveWorkflowExecBinary(name, pathDirs) {
   if (typeof name !== "string" || name.length === 0) throw refused("argv_invalid", "argv[0] must name a binary");
   if (name.includes("/") || name.includes("\\") || name.startsWith(".")) {
@@ -35346,12 +36502,12 @@ function resolveWorkflowExecBinary(name, pathDirs) {
   ]);
 }
 __name(resolveWorkflowExecBinary, "resolveWorkflowExecBinary");
-__name7(resolveWorkflowExecBinary, "resolveWorkflowExecBinary");
+__name8(resolveWorkflowExecBinary, "resolveWorkflowExecBinary");
 function within(root, p) {
   return p === root || p.startsWith(root.endsWith(path18.sep) ? root : root + path18.sep);
 }
 __name(within, "within");
-__name7(within, "within");
+__name8(within, "within");
 function confineWorkflowExecCwd(root, cwd) {
   if (typeof root !== "string" || root.length === 0) throw refused("workspace_unavailable", "the step has no workspace");
   let rootReal;
@@ -35385,7 +36541,7 @@ function confineWorkflowExecCwd(root, cwd) {
   return abs;
 }
 __name(confineWorkflowExecCwd, "confineWorkflowExecCwd");
-__name7(confineWorkflowExecCwd, "confineWorkflowExecCwd");
+__name8(confineWorkflowExecCwd, "confineWorkflowExecCwd");
 var RESERVED_ENV_KEY = /^(LUA_|LD_|DYLD_|GIT_|GH_|GITHUB_)|^(PATH|HOME|NODE_OPTIONS|BASH_ENV|ENV|TZ)$|_PROXY$/i;
 function checkWorkflowExecEnv(env) {
   if (env === void 0) return {};
@@ -35403,7 +36559,7 @@ function checkWorkflowExecEnv(env) {
   return out;
 }
 __name(checkWorkflowExecEnv, "checkWorkflowExecEnv");
-__name7(checkWorkflowExecEnv, "checkWorkflowExecEnv");
+__name8(checkWorkflowExecEnv, "checkWorkflowExecEnv");
 var WORKFLOW_EXEC_GIT_DENIED_SUBCOMMANDS = Object.freeze([
   "push-mirror",
   "daemon",
@@ -35433,7 +36589,7 @@ function gitOptionMatches(arg, opt) {
   return opt.length === 2 && arg.length > 2 && arg.startsWith(opt);
 }
 __name(gitOptionMatches, "gitOptionMatches");
-__name7(gitOptionMatches, "gitOptionMatches");
+__name8(gitOptionMatches, "gitOptionMatches");
 var GIT_PUSH_FORBIDDEN_FLAG = /^(--mirror|--delete|-d|-f|--force|--force-with-lease(=.*)?|--force-if-includes|--prune|--all|--tags)$/;
 function checkWorkflowExecGitArgv(argv, opts = {}) {
   if (argv[0] !== "git") return {};
@@ -35476,9 +36632,9 @@ function checkWorkflowExecGitArgv(argv, opts = {}) {
   };
 }
 __name(checkWorkflowExecGitArgv, "checkWorkflowExecGitArgv");
-__name7(checkWorkflowExecGitArgv, "checkWorkflowExecGitArgv");
+__name8(checkWorkflowExecGitArgv, "checkWorkflowExecGitArgv");
 function formatWorkflowExecArgv(argv, max = WORKFLOW_EXEC_LOG_ARGV_MAX) {
-  const q = /* @__PURE__ */ __name7((a) => {
+  const q = /* @__PURE__ */ __name8((a) => {
     const s = String(a);
     return s.length > 0 && /^[A-Za-z0-9_@%+=:,./-]+$/.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
   }, "q");
@@ -35486,7 +36642,7 @@ function formatWorkflowExecArgv(argv, max = WORKFLOW_EXEC_LOG_ARGV_MAX) {
   return line.length > max ? `${line.slice(0, max)}\u2026` : line;
 }
 __name(formatWorkflowExecArgv, "formatWorkflowExecArgv");
-__name7(formatWorkflowExecArgv, "formatWorkflowExecArgv");
+__name8(formatWorkflowExecArgv, "formatWorkflowExecArgv");
 function spawnWorkflowExec(o) {
   const spawnFn = o.spawnImpl ?? nodeSpawn;
   const max = o.outputMaxBytes ?? WORKFLOW_EXEC_OUTPUT_MAX_BYTES;
@@ -35521,7 +36677,7 @@ function spawnWorkflowExec(o) {
     let settled = false;
     let killTimer;
     let wallTimer;
-    const collect2 = /* @__PURE__ */ __name7((stream) => {
+    const collect2 = /* @__PURE__ */ __name8((stream) => {
       const chunks = [];
       let bytes = 0;
       stream?.on("data", (c) => {
@@ -35544,7 +36700,7 @@ function spawnWorkflowExec(o) {
     }, "collect");
     const stdout = collect2(child.stdout);
     const stderr = collect2(child.stderr);
-    const killTree = /* @__PURE__ */ __name7((sig) => {
+    const killTree = /* @__PURE__ */ __name8((sig) => {
       const pid = child.pid;
       if (!pid) return;
       try {
@@ -35553,7 +36709,7 @@ function spawnWorkflowExec(o) {
       } catch {
       }
     }, "killTree");
-    const end = /* @__PURE__ */ __name7(() => {
+    const end = /* @__PURE__ */ __name8(() => {
       if (settled || timedOut) return;
       timedOut = true;
       killTree("SIGTERM");
@@ -35564,7 +36720,7 @@ function spawnWorkflowExec(o) {
       }, grace);
       killTimer.unref?.();
     }, "end");
-    const cleanup = /* @__PURE__ */ __name7(() => {
+    const cleanup = /* @__PURE__ */ __name8(() => {
       if (wallTimer) clearTimeout(wallTimer);
       if (killTimer) clearTimeout(killTimer);
       o.signal?.removeEventListener("abort", end);
@@ -35598,7 +36754,7 @@ function spawnWorkflowExec(o) {
   });
 }
 __name(spawnWorkflowExec, "spawnWorkflowExec");
-__name7(spawnWorkflowExec, "spawnWorkflowExec");
+__name8(spawnWorkflowExec, "spawnWorkflowExec");
 async function runWorkflowExec(o) {
   const argv = validateWorkflowExecArgv(o.request.argv);
   const file = resolveWorkflowExecBinary(argv[0], o.pathDirs);
@@ -35644,7 +36800,7 @@ async function runWorkflowExec(o) {
   });
 }
 __name(runWorkflowExec, "runWorkflowExec");
-__name7(runWorkflowExec, "runWorkflowExec");
+__name8(runWorkflowExec, "runWorkflowExec");
 function createWorkflowExecQueue() {
   let tail = Promise.resolve();
   return (task) => {
@@ -35654,7 +36810,7 @@ function createWorkflowExecQueue() {
   };
 }
 __name(createWorkflowExecQueue, "createWorkflowExecQueue");
-__name7(createWorkflowExecQueue, "createWorkflowExecQueue");
+__name8(createWorkflowExecQueue, "createWorkflowExecQueue");
 function stderrTail(s) {
   const t = s.trim();
   if (!t) return "";
@@ -35662,9 +36818,9 @@ function stderrTail(s) {
   return `: ${tail.replace(/\s+/g, " ")}`;
 }
 __name(stderrTail, "stderrTail");
-__name7(stderrTail, "stderrTail");
+__name8(stderrTail, "stderrTail");
 function buildWorkflowExecApi(run) {
-  const call = /* @__PURE__ */ __name7(async (req, strict) => {
+  const call = /* @__PURE__ */ __name8(async (req, strict) => {
     const out = await run(req);
     if (out.timedOut) {
       throw new WorkflowExecError("EXEC_TIMEOUT", `[Lua] ${formatWorkflowExecArgv(out.argv)} did not finish within its wall (${out.durationMs} ms) and was killed (EXEC_TIMEOUT)`, out);
@@ -35674,7 +36830,7 @@ function buildWorkflowExecApi(run) {
     }
     return out;
   }, "call");
-  const request2 = /* @__PURE__ */ __name7((argv, opts) => {
+  const request2 = /* @__PURE__ */ __name8((argv, opts) => {
     const o = opts && typeof opts === "object" ? opts : {};
     return {
       argv,
@@ -35683,9 +36839,9 @@ function buildWorkflowExecApi(run) {
       env: o.env
     };
   }, "request");
-  const exec = /* @__PURE__ */ __name7((argv, opts) => call(request2(argv, opts), false), "exec");
+  const exec = /* @__PURE__ */ __name8((argv, opts) => call(request2(argv, opts), false), "exec");
   exec.strict = (argv, opts) => call(request2(argv, opts), true);
-  const $ = /* @__PURE__ */ __name7(async (strings, ...values) => call({
+  const $ = /* @__PURE__ */ __name8(async (strings, ...values) => call({
     argv: parseCommandTemplate(strings, values)
   }, false), "$");
   $.strict = async (strings, ...values) => call({
@@ -35697,16 +36853,16 @@ function buildWorkflowExecApi(run) {
   };
 }
 __name(buildWorkflowExecApi, "buildWorkflowExecApi");
-__name7(buildWorkflowExecApi, "buildWorkflowExecApi");
+__name8(buildWorkflowExecApi, "buildWorkflowExecApi");
 function unavailableWorkflowExecApi(why) {
-  const reject = /* @__PURE__ */ __name7(async () => {
+  const reject = /* @__PURE__ */ __name8(async () => {
     throw new WorkflowExecError("EXEC_UNAVAILABLE", `[Lua] ctx.exec is not available here: ${why} (EXEC_UNAVAILABLE)`);
   }, "reject");
   const exec = Object.assign(() => reject(), {
-    strict: /* @__PURE__ */ __name7(() => reject(), "strict")
+    strict: /* @__PURE__ */ __name8(() => reject(), "strict")
   });
   const $ = Object.assign(() => reject(), {
-    strict: /* @__PURE__ */ __name7(() => reject(), "strict")
+    strict: /* @__PURE__ */ __name8(() => reject(), "strict")
   });
   return {
     exec,
@@ -35714,7 +36870,7 @@ function unavailableWorkflowExecApi(why) {
   };
 }
 __name(unavailableWorkflowExecApi, "unavailableWorkflowExecApi");
-__name7(unavailableWorkflowExecApi, "unavailableWorkflowExecApi");
+__name8(unavailableWorkflowExecApi, "unavailableWorkflowExecApi");
 
 // src/utils/workflow-exec.ts
 var WORKFLOW_LOCAL_EXEC_ENV_KEYS = [
@@ -37507,7 +38663,14 @@ function createSandbox(options) {
         const { getAgentsInstance: getAgentsInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
         const agents = await getAgentsInstance2();
         return agents.invokeForSandbox(targetAgentId, promptOrInput);
-      }, "invoke")
+      }, "invoke"),
+      // EM-WS2 — supervision members, offline twin (reads via your developer
+      // credential; release ops and preview are refused offline).
+      ...buildSupervisionAgentsApi(async (op, targetAgentId, args2) => {
+        const { getAgentsInstance: getAgentsInstance2 } = await Promise.resolve().then(() => (init_lazy_instances(), lazy_instances_exports));
+        const agents = await getAgentsInstance2();
+        return agents.superviseForSandbox(op, targetAgentId, args2);
+      })
     },
     // Unified.to raw provider passthrough (PRO-209). Proxied via the same
     // bearer-auth developer route the api-exports `Integrations` namespace
@@ -38236,6 +39399,10 @@ var WorkflowHandler = class extends BaseVersionedHandler {
       ...wf.backfillOnEnable ? {
         backfillOnEnable: wf.backfillOnEnable
       } : {},
+      // EM-WS10: only when declared, so an undeclared push stays byte-identical (publish then clears any stale one).
+      ...wf.health ? {
+        health: wf.health
+      } : {},
       ...wf.goal ? {
         goal: wf.goal
       } : {}
@@ -39706,8 +40873,8 @@ import vm5 from "vm";
 import { createHash as createHash7, randomUUID as randomUUID4 } from "crypto";
 
 // ../sandbox-runtime/dist/workflow-script-wrapper.mjs
-var __defProp8 = Object.defineProperty;
-var __name8 = /* @__PURE__ */ __name((target, value3) => __defProp8(target, "name", { value: value3, configurable: true }), "__name");
+var __defProp9 = Object.defineProperty;
+var __name9 = /* @__PURE__ */ __name((target, value3) => __defProp9(target, "name", { value: value3, configurable: true }), "__name");
 var WORKFLOW_SCRIPT_RUNTIME_KEY = "__luaWorkflowScriptRuntime";
 var WORKFLOW_SCRIPT_PROTOCOL_VERSION = 1;
 var WORKFLOW_SCRIPT_DEFAULT_CAPS = {
@@ -40042,18 +41209,18 @@ function computeWorkflowProtocolShipWindow(input) {
   };
 }
 __name(computeWorkflowProtocolShipWindow, "computeWorkflowProtocolShipWindow");
-__name8(computeWorkflowProtocolShipWindow, "computeWorkflowProtocolShipWindow");
+__name9(computeWorkflowProtocolShipWindow, "computeWorkflowProtocolShipWindow");
 var WORKFLOW_SCRIPT_EFFORT_PROTOCOL_VERSION = 2;
 function scriptEffortForwardable(journalProtocolVersion) {
   return typeof journalProtocolVersion === "number" && journalProtocolVersion >= WORKFLOW_SCRIPT_EFFORT_PROTOCOL_VERSION;
 }
 __name(scriptEffortForwardable, "scriptEffortForwardable");
-__name8(scriptEffortForwardable, "scriptEffortForwardable");
+__name9(scriptEffortForwardable, "scriptEffortForwardable");
 function workflowScriptReplaySource(journalProtocolVersion) {
   return WORKFLOW_SCRIPT_PROTOCOL_VERSIONS.includes(journalProtocolVersion) ? WORKFLOW_SCRIPT_REPLAY_SOURCES[journalProtocolVersion] : void 0;
 }
 __name(workflowScriptReplaySource, "workflowScriptReplaySource");
-__name8(workflowScriptReplaySource, "workflowScriptReplaySource");
+__name9(workflowScriptReplaySource, "workflowScriptReplaySource");
 var HOST_BINDINGS = [
   "args",
   "agent",
@@ -40082,7 +41249,7 @@ function transformWorkflowScriptModule(script) {
   return script.replace(/^\s*export\s+const\s+meta\s*=/m, "const meta =");
 }
 __name(transformWorkflowScriptModule, "transformWorkflowScriptModule");
-__name8(transformWorkflowScriptModule, "transformWorkflowScriptModule");
+__name9(transformWorkflowScriptModule, "transformWorkflowScriptModule");
 function buildWorkflowScriptWrapper(script, input) {
   const tick = input ?? {};
   const version = tick.journalProtocolVersion ?? WORKFLOW_SCRIPT_PROTOCOL_VERSION;
@@ -40132,7 +41299,7 @@ ${transformWorkflowScriptModule(script)}
   };
 }
 __name(buildWorkflowScriptWrapper, "buildWorkflowScriptWrapper");
-__name8(buildWorkflowScriptWrapper, "buildWorkflowScriptWrapper");
+__name9(buildWorkflowScriptWrapper, "buildWorkflowScriptWrapper");
 
 // src/utils/workflow-script-replay.ts
 var ReplayRuntimeUnavailableError = class extends Error {
@@ -40568,7 +41735,7 @@ async function runWorkflowLocalFromProject(name, flags) {
       artefactsDir: flags.artefactsDir,
       workspaceDir: flags.workspace ? path23.resolve(flags.workspace) : void 0,
       env: parseEnvFlags(flags.env),
-      prompt: process.stdin.isTTY && !asJson ? promptForLocalDecision : void 0,
+      prompt: process.stdin.isTTY && !asJson && !isCiModeEnabled() ? promptForLocalDecision : void 0,
       log: asJson ? void 0 : (line) => console.log(line)
     });
   } finally {
@@ -41561,6 +42728,7 @@ init_cli();
 init_command_utils();
 init_semver();
 init_auth_error();
+init_cli_error();
 init_constants();
 
 // src/api/agent-version.api.service.ts
@@ -42575,11 +43743,11 @@ function getDeployHint(type) {
   };
 }
 __name(getDeployHint, "getDeployHint");
-function writePersonaServedHint(version) {
-  writeInfo(`\u{1F4A1} Persona v${version} is now served \u2014 the push published it and pointed the agent at it.`);
-  writeInfo("   Roll back with `lua deploy persona` (pick an earlier version) or `lua persona production deploy --persona-version <n>`.");
+function writePersonaStagedHint(version) {
+  writeInfo(`\u{1F4A1} Persona v${version} staged \u2014 NOT activated. What the agent serves is unchanged.`);
+  writeInfo(`   Activate it with \`lua deploy persona --set-version ${version}\` (asks for confirmation first).`);
 }
-__name(writePersonaServedHint, "writePersonaServedHint");
+__name(writePersonaStagedHint, "writePersonaStagedHint");
 async function promptVersionConfirmOrUpdate(currentVersion) {
   console.log(`
 Current version: ${currentVersion || "(none - first push)"}`);
@@ -42862,10 +44030,11 @@ async function pushCommand(type, cmdObj) {
       options.autoDeploy = false;
     }
     if (options.entityName && !type) {
-      console.log("\nUsage:");
-      console.log("  lua push skill --name mySkill --set-version 1.0.5        Push specific skill");
-      console.log("  lua push webhook --name myWebhook --set-version 2.0.0    Push specific webhook");
-      throw new Error("Type must be specified when using the --name option.");
+      throw CliError.usage("Type must be specified when using the --name option.", [
+        "Usage:",
+        "  lua push skill --name mySkill --set-version 1.0.5        Push specific skill",
+        "  lua push webhook --name myWebhook --set-version 2.0.0    Push specific webhook"
+      ].join("\n"));
     }
     if (isStageAll) {
       return await pushAllCommand({
@@ -42878,10 +44047,11 @@ async function pushCommand(type, cmdObj) {
     }
     if (type === "all") {
       if (!options.force) {
-        console.log("\nUsage:");
-        console.log("  lua push all --force                Push all components without prompts");
-        console.log("  lua push all --force --auto-deploy  Push and deploy all to production");
-        throw new Error('The "all" type requires the --force flag');
+        throw CliError.usage('The "all" type requires the --force flag', [
+          "Usage:",
+          "  lua push all --force                Push all components without prompts",
+          "  lua push all --force --auto-deploy  Push and deploy all to production"
+        ].join("\n"));
       }
       return await pushAllCommand({
         ...options,
@@ -43165,7 +44335,7 @@ Model: ${model}`);
       personaDeployWasAttempted = true;
       productionDeployedWithAutoDeploy = await deployPersonaVersionAfterPush(apiKey, agentId, result.persona.version, options.autoDeploy || false);
     } else {
-      writePersonaServedHint(result.persona.version);
+      writePersonaStagedHint(result.persona.version);
     }
   }
   const personaAutoDeployFailed = Boolean(options.autoDeploy && personaDeployEligible && personaDeployWasAttempted && !productionDeployedWithAutoDeploy);
@@ -43479,7 +44649,7 @@ ${icon} Pushing ${items.length} ${handler.displayName}(s)...`);
     };
   }
   if (personaPushResult && !options.autoDeploy) {
-    writePersonaServedHint(personaPushResult.version);
+    writePersonaStagedHint(personaPushResult.version);
   }
   if (toDeploy.length > 0) {
     writeProgress("\n\u{1F680} Deploying all pushed versions to production...");
@@ -43731,6 +44901,14 @@ function formatDeploySuccess(params) {
   return `\u2705 ${label2} "${name}" v${version} deployed successfully`;
 }
 __name(formatDeploySuccess, "formatDeploySuccess");
+function syncDeployedVersionToYaml(handler, name, deployedVersion, recordedVersion) {
+  if (deployedVersion === recordedVersion) {
+    return;
+  }
+  writeInfo(`\u{1F4DD} Updating YAML with deployed version: ${deployedVersion}`);
+  handler.updateVersionInYaml(name, deployedVersion);
+}
+__name(syncDeployedVersionToYaml, "syncDeployedVersionToYaml");
 function deployAllExitCode(failedCount) {
   return failedCount > 0 ? CLI_EXIT.ERROR : void 0;
 }
@@ -43742,6 +44920,12 @@ init_skills_api_service();
 init_webhook_api_service();
 init_job_api_service();
 init_analytics();
+var SCOPED_PROMOTE_NOTICE = "\u2139\uFE0F  For agents under versioning, `lua deploy` creates and promotes a new agent version scoped to this primitive; otherwise it goes live directly. For multi-primitive releases, `lua version promote <version>` remains the recommended flow.";
+var PERSONA_LABEL = "Persona";
+function pointerNotice(label2) {
+  return `\u2139\uFE0F  This updates the served ${label2} pointer now; it does not create an agent version. The next \`lua version promote\` resets it to whatever that version pins.`;
+}
+__name(pointerNotice, "pointerNotice");
 function normalizeVersion(v) {
   return {
     version: v.version,
@@ -43760,6 +44944,7 @@ var VERSIONED_DEPLOY_TYPES = [
     label: "Skill",
     emoji: "\u{1F6E0}\uFE0F",
     idField: "skillId",
+    scoped: false,
     getVersions: /* @__PURE__ */ __name(async (apiKey, agentId, entityId) => {
       const api = new SkillApi(BASE_URLS.API, apiKey, agentId);
       const result = await api.getSkillVersions(entityId);
@@ -43772,6 +44957,7 @@ var VERSIONED_DEPLOY_TYPES = [
     label: "Webhook",
     emoji: "\u{1FA9D}",
     idField: "webhookId",
+    scoped: true,
     getVersions: /* @__PURE__ */ __name(async (apiKey, agentId, entityId) => {
       const api = new WebhookApi(BASE_URLS.API, apiKey, agentId);
       const result = await api.getWebhookVersions(entityId);
@@ -43784,6 +44970,7 @@ var VERSIONED_DEPLOY_TYPES = [
     label: "Trigger",
     emoji: "\u26A1",
     idField: "triggerId",
+    scoped: true,
     getVersions: /* @__PURE__ */ __name(async (apiKey, agentId, entityId) => {
       const api = new TriggerApi(BASE_URLS.API, apiKey, agentId);
       const result = await api.getTriggerVersions(entityId);
@@ -43796,6 +44983,7 @@ var VERSIONED_DEPLOY_TYPES = [
     label: "Job",
     emoji: "\u23F0",
     idField: "jobId",
+    scoped: true,
     getVersions: /* @__PURE__ */ __name(async (apiKey, agentId, entityId) => {
       const api = new JobApi(BASE_URLS.API, apiKey, agentId);
       const result = await api.getJobVersions(entityId);
@@ -43808,6 +44996,7 @@ var VERSIONED_DEPLOY_TYPES = [
     label: "PreProcessor",
     emoji: "\u{1F4E5}",
     idField: "preprocessorId",
+    scoped: true,
     getVersions: /* @__PURE__ */ __name(async (apiKey, agentId, entityId) => {
       const api = new PreProcessorApi(BASE_URLS.API, apiKey, agentId);
       const result = await api.getPreProcessorVersions(entityId);
@@ -43820,6 +45009,7 @@ var VERSIONED_DEPLOY_TYPES = [
     label: "PostProcessor",
     emoji: "\u{1F4E4}",
     idField: "postprocessorId",
+    scoped: true,
     getVersions: /* @__PURE__ */ __name(async (apiKey, agentId, entityId) => {
       const api = new PostProcessorApi(BASE_URLS.API, apiKey, agentId);
       const result = await api.getPostProcessorVersions(entityId);
@@ -43898,13 +45088,14 @@ async function deployCommand(type, cmdObj) {
       selectedType = answer.type;
     }
     const apiKey = await requireAuthOrExit();
-    writeInfo("\u2139\uFE0F  For agents under versioning, `lua deploy` creates and promotes a new agent version scoped to this primitive; otherwise it goes live directly. For multi-primitive releases, `lua version promote <version>` remains the recommended flow.");
     let personaDeployed = false;
     let versionedOutcome = null;
+    let scopedPromoteNotice = false;
     if (selectedType === "persona") {
       personaDeployed = await deployPersonaVersion(apiKey, agentId, options);
     } else {
       const deployConfig = VERSIONED_DEPLOY_TYPES.find((dt) => dt.type === selectedType);
+      scopedPromoteNotice = deployConfig.scoped;
       versionedOutcome = await deployVersionedPrimitive(deployConfig, config, apiKey, agentId, options);
     }
     trackEvent("cli_deploy_completed", {
@@ -43912,7 +45103,7 @@ async function deployCommand(type, cmdObj) {
       force_mode: options.force || false,
       entity_selected_by_name: !!options.name,
       version_selected_by_flag: !!options.version,
-      scoped_promote_notice: true
+      scoped_promote_notice: scopedPromoteNotice
     });
     const deployed = selectedType === "persona" ? personaDeployed : versionedOutcome?.deployed ?? false;
     const hintPrintedAlready = selectedType !== "persona" && !!versionedOutcome?.hintPrinted;
@@ -43921,17 +45112,23 @@ async function deployCommand(type, cmdObj) {
     }
     if (selectedType === "webhook") {
       const webhookNameToken = versionedOutcome?.entityName || options.name?.trim() || "<webhook-name>";
+      const triggerLine = webhookNameToken !== "<webhook-name>" ? {
+        label: "Trigger:",
+        command: `curl -X POST ${WEBHOOK_TRIGGER_BASE_URL}/${agentId}/${encodeURIComponent(webhookNameToken)}`
+      } : {
+        label: "Trigger:",
+        command: "curl -X POST <URL from above>"
+      };
       writeHintBlock({
         headline: "Webhook is live. Trigger it, then inspect logs:",
         lines: [
-          {
-            label: "Find URL:",
-            command: `lua webhooks view --webhook-name ${webhookNameToken}`
-          },
-          {
-            label: "Trigger:",
-            command: "curl -X POST <URL from above>"
-          },
+          ...webhookNameToken === "<webhook-name>" ? [
+            {
+              label: "Find URL:",
+              command: `lua webhooks view --webhook-name ${webhookNameToken}`
+            }
+          ] : [],
+          triggerLine,
           {
             label: "Inspect:",
             command: buildLogsCommand({
@@ -43970,6 +45167,7 @@ async function deployCommand(type, cmdObj) {
 }
 __name(deployCommand, "deployCommand");
 async function deployVersionedPrimitive(deployConfig, config, apiKey, agentId, options) {
+  writeInfo(deployConfig.scoped ? SCOPED_PROMOTE_NOTICE : pointerNotice(deployConfig.label));
   const entities = deployConfig.handler.getFromYaml(config);
   if (entities.length === 0) {
     writeInfo(`\u2139\uFE0F  No ${deployConfig.label}s found in configuration. Nothing to deploy.`);
@@ -44060,10 +45258,7 @@ Available ${deployConfig.label}s:`);
     version: selectedVersion,
     agentVersion: result.agentVersion
   }));
-  if (selectedVersion !== selectedEntity.version) {
-    writeInfo(`\u{1F4DD} Updating YAML with deployed version: ${selectedVersion}`);
-    deployConfig.handler.updateVersionInYaml(selectedEntity.name, selectedVersion);
-  }
+  syncDeployedVersionToYaml(deployConfig.handler, selectedEntity.name, selectedVersion, selectedEntity.version);
   if (deployConfig.type === "job") {
     writeHintBlock({
       headline: "Job is live. Trigger or wait for schedule, then inspect logs:",
@@ -44097,6 +45292,7 @@ Available ${deployConfig.label}s:`);
 __name(deployVersionedPrimitive, "deployVersionedPrimitive");
 async function deployPersonaVersion(apiKey, agentId, options) {
   const personaApi = new PersonaApi(BASE_URLS.API, apiKey, agentId);
+  writeInfo(pointerNotice(PERSONA_LABEL));
   writeProgress("\u{1F504} Fetching persona versions...");
   const result = await personaApi.getVersions("all");
   const versions = result.data?.versions || [];
@@ -44125,7 +45321,9 @@ async function deployPersonaVersion(apiKey, agentId, options) {
         name: "version",
         message: "Select a persona version to deploy:",
         choices: sortedVersions.map((v) => ({
-          name: `v${v.version}${v.isCurrent ? " (CURRENT)" : ""} \u2014 ${new Date(v.createdDate).toLocaleDateString()}`,
+          // PRO-2170: a push stages, so the list now contains versions that are
+          // NOT served. Mark them, or the only clue is the absence of (CURRENT).
+          name: `v${v.version}${v.isCurrent ? " (CURRENT)" : ""}${v.status === "staged" ? " (STAGED)" : v.status === "draft" ? " (DRAFT)" : ""} \u2014 ${new Date(v.createdDate).toLocaleDateString()}`,
           value: v.version
         }))
       }
@@ -44159,13 +45357,19 @@ async function deployAllCommand(_options) {
   validateSkillConfig(config);
   const apiKey = await requireAuthOrExit();
   const agentId = config.agent.agentId;
-  writeInfo("\u2139\uFE0F  For agents under versioning, each deploy below creates and promotes an agent version scoped to that primitive. To switch everything atomically in one version instead, use `lua version create` + `lua version promote`.");
+  const hasScopedEntity = VERSIONED_DEPLOY_TYPES.some((dt) => dt.scoped && dt.handler.getFromYaml(config).length > 0);
+  if (hasScopedEntity) {
+    writeInfo("\u2139\uFE0F  For agents under versioning, each deploy below creates and promotes an agent version scoped to that primitive. To switch everything atomically in one version instead, use `lua version create` + `lua version promote`.");
+  }
   let deployedCount = 0;
   let failedCount = 0;
   const failedItems = [];
   console.log("\n\u{1F680} Deploying latest versions of all primitives...\n");
   for (const deployConfig of VERSIONED_DEPLOY_TYPES) {
     const entities = deployConfig.handler.getFromYaml(config);
+    if (!deployConfig.scoped && entities.length > 0) {
+      writeInfo(pointerNotice(deployConfig.label));
+    }
     for (const entity of entities) {
       const entityId = entity[deployConfig.idField];
       if (!entityId) {
@@ -44221,6 +45425,7 @@ async function deployAllCommand(_options) {
     const personaApi = new PersonaApi(BASE_URLS.API, apiKey, agentId);
     const latestPersona = await personaApi.getLatestVersion();
     if (latestPersona) {
+      writeInfo(pointerNotice(PERSONA_LABEL));
       const deployResult = await personaApi.deployVersion(latestPersona.version);
       if (deployResult.success) {
         writeSuccess(`  \u2705 Persona v${latestPersona.version} deployed`);
@@ -45086,6 +46291,7 @@ __name(parseMessageWithAttachments, "parseMessageWithAttachments");
 
 // src/commands/chat.ts
 init_command_utils();
+init_files();
 init_artifact_loader();
 init_types();
 init_analytics();
@@ -45386,12 +46592,13 @@ async function setupChatEnvironment(chatEnv, config) {
   await compileCommand({
     serverSync: "register-only"
   });
+  const postCompileConfig = readYamlConfig() ?? config;
   const manifest = loadManifest();
   const skills = getPrimitivesByKind(manifest, PrimitiveKind.SKILL);
   let sandboxIds = {};
   if (skills.length > 0) {
     writeProgress("\u{1F504} Pushing skills to sandbox...");
-    sandboxIds = await pushSkillsToSandbox(chatEnv.apiKey, chatEnv.agentId, manifest, config, true);
+    sandboxIds = await pushSkillsToSandbox(chatEnv.apiKey, chatEnv.agentId, manifest, postCompileConfig, true);
     if (Object.keys(sandboxIds).length > 0) {
       writeSuccess(`\u2705 Pushed ${Object.keys(sandboxIds).length} skills to sandbox`);
     } else {
@@ -45404,14 +46611,14 @@ async function setupChatEnvironment(chatEnv, config) {
   const postprocessors = getPrimitivesByKind(manifest, PrimitiveKind.POSTPROCESSOR);
   if (preprocessors.length > 0 || postprocessors.length > 0) {
     writeProgress("\u{1F504} Pushing processors to sandbox...");
-    const processorCounts = await pushProcessorsToSandbox(chatEnv.apiKey, chatEnv.agentId, manifest, config, true);
+    const processorCounts = await pushProcessorsToSandbox(chatEnv.apiKey, chatEnv.agentId, manifest, postCompileConfig, true);
     if (processorCounts.preprocessors > 0 || processorCounts.postprocessors > 0) {
       writeSuccess(`\u2705 Pushed ${processorCounts.preprocessors} preprocessor(s) and ${processorCounts.postprocessors} postprocessor(s) to sandbox`);
     }
   }
-  chatEnv.yamlConfig = config;
-  chatEnv.preprocessorOverrides = await getAllSandboxPreProcessorIds(config);
-  chatEnv.postprocessorOverrides = await getAllSandboxPostProcessorIds(config);
+  chatEnv.yamlConfig = postCompileConfig;
+  chatEnv.preprocessorOverrides = await getAllSandboxPreProcessorIds(postCompileConfig);
+  chatEnv.postprocessorOverrides = await getAllSandboxPostProcessorIds(postCompileConfig);
   chatEnv.persona = getAgentPersona() ?? void 0;
 }
 __name(setupChatEnvironment, "setupChatEnvironment");
@@ -46434,6 +47641,12 @@ init_compiler2();
 init_artifact_loader();
 init_analytics();
 init_cli_error();
+function versionStatusMarker(status) {
+  if (status === "draft") return "[DRAFT]";
+  if (status === "staged") return "[STAGED]";
+  return "";
+}
+__name(versionStatusMarker, "versionStatusMarker");
 async function personaCommand(env, action, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
@@ -46472,7 +47685,8 @@ async function personaCommand(env, action, cmdObj) {
       apiKey
     };
     if (selectedEnvironment === "sandbox") {
-      if (action === "view") {
+      const normalizedAction = action ? validateOrSuggest("persona.action", action) : void 0;
+      if (normalizedAction === "view") {
         const currentPersona = flattenPersonaTextAll(getAgentPersona());
         if (currentPersona.trim()) {
           console.log(currentPersona);
@@ -46481,6 +47695,16 @@ async function personaCommand(env, action, cmdObj) {
         }
         return;
       }
+      if (normalizedAction === "versions") {
+        writeProgress("\u{1F504} Loading persona versions...");
+        const versions = await fetchVersionsCore(context);
+        if (!versions) throw new Error("Failed to fetch persona versions");
+        displayVersionsCore(versions);
+        return;
+      }
+      if (normalizedAction) {
+        throw CliError.usage(`Sandbox persona does not support action "${normalizedAction}"`, "Usage: lua persona sandbox view | lua persona sandbox versions");
+      }
       await manageSandboxPersonaInteractive(context);
     } else {
       if (action) {
@@ -46550,7 +47774,8 @@ function displayVersionsCore(versions) {
     const dateStr = date.toLocaleDateString();
     const timeStr = date.toLocaleTimeString();
     const currentMark = v.isCurrent ? " \u2B50 CURRENT" : "";
-    const status = v.status === "draft" ? " [DRAFT]" : "";
+    const marker = versionStatusMarker(v.status);
+    const status = marker ? ` ${marker}` : "";
     console.log(`  Version ${v.version}${status} - ${dateStr} ${timeStr}${currentMark}`);
   });
   console.log("\n" + "=".repeat(60));
@@ -46808,7 +48033,7 @@ async function listPersonaVersionsInteractive(context) {
         const date = new Date(version.createdDate);
         const dateStr = date.toLocaleDateString();
         const timeStr = date.toLocaleTimeString();
-        const status = version.status === "draft" ? "[DRAFT]" : "";
+        const status = versionStatusMarker(version.status);
         const currentMark = version.isCurrent ? " \u2B50 CURRENT" : "";
         return {
           name: `Version ${version.version} ${status} - (${dateStr}) ${timeStr} ${currentMark}`,
@@ -46827,7 +48052,7 @@ async function viewVersionDetailsInteractive(version) {
   console.log(`Persona Version ${version.version}`);
   console.log("=".repeat(60));
   console.log(`Created: ${date.toLocaleString()}`);
-  const versionStatus = version.status === "draft" ? "\u{1F528} DRAFT" : "";
+  const versionStatus = version.status === "draft" ? "\u{1F528} DRAFT" : version.status === "staged" ? "\u{1F4E4} STAGED (not served)" : "\u2B50 PUBLISHED";
   console.log(`Version Status: ${versionStatus}`);
   console.log(`Active Status: ${version.isCurrent ? "\u2B50 CURRENT" : "Available"}`);
   if (version.createdBy) {
@@ -46910,7 +48135,7 @@ async function deployPersonaVersionInteractive(context) {
         const dateStr = date.toLocaleDateString();
         const timeStr = date.toLocaleTimeString();
         const currentMark = v.isCurrent ? " \u2B50 CURRENTLY DEPLOYED" : "";
-        const status = v.status === "draft" ? "[DRAFT]" : "";
+        const status = versionStatusMarker(v.status);
         return {
           name: `Version ${v.version} ${status} - (${dateStr}) ${timeStr} ${currentMark}`,
           value: v.version
@@ -52132,6 +53357,10 @@ function localVersionLine(version, hide) {
   return hide ? null : `   Version: ${version}`;
 }
 __name(localVersionLine, "localVersionLine");
+function priorityLine(priority) {
+  return `   Priority: ${priority ?? 100}`;
+}
+__name(priorityLine, "priorityLine");
 
 // src/commands/skills.ts
 init_skills_api_service();
@@ -52142,7 +53371,8 @@ async function skillsCommand(actionOrEnv, actionArg, cmdObj) {
   return withErrorHandling(async () => {
     const options = {
       skillName: cmdObj?.skillName || null,
-      skillVersion: cmdObj?.skillVersion || null
+      skillVersion: cmdObj?.skillVersion || null,
+      json: cmdObj?.json || false
     };
     const { config, agentId, apiKey } = await initializeCommand();
     const hideVersions = await shouldHidePrimitiveVersions(apiKey, agentId);
@@ -52177,14 +53407,19 @@ async function skillsCommand(actionOrEnv, actionArg, cmdObj) {
             }
             return;
           }
+          if (resolvedAction) {
+            throw CliError.usage(`Sandbox skills do not support action "${resolvedAction}"`, 'Usage: lua skills sandbox view    (only "view" is scriptable in sandbox)');
+          }
           await manageSandboxSkillsInteractive(context3, config);
+        } else if (resolvedAction) {
+          await executeNonInteractive4(context3, config, resolvedAction, options);
         } else {
           await manageProductionSkillsInteractive(context3, config);
         }
         trackEvent("cli_skills_action", {
           environment: selectedEnvironment,
           action: resolvedAction || "interactive",
-          non_interactive: true
+          non_interactive: !!resolvedAction
         });
         return;
       }
@@ -52295,6 +53530,15 @@ async function fetchVersionsCore2(context, skill) {
   };
 }
 __name(fetchVersionsCore2, "fetchVersionsCore");
+function mapSkillVersionsToJson(versions) {
+  return versions.map((version) => ({
+    id: version.id,
+    version: version.version,
+    isCurrent: version.isCurrent,
+    createdDate: version.createdDate
+  }));
+}
+__name(mapSkillVersionsToJson, "mapSkillVersionsToJson");
 function displayVersionsCore2(skill, versions, activeVersionId, hideVersions) {
   if (hideVersions) {
     primitiveVersionHistoryView(skill.name).forEach((line) => console.log(line));
@@ -52323,7 +53567,13 @@ async function deployVersionCore2(context, skill, version) {
     console.error(`\u274C Deploy Error: ${response.error?.message || "Unknown error"}`);
     return false;
   }
-  writeSuccess(`\u2705 Version ${version} of "${skill.name}" deployed successfully`);
+  writeSuccess(formatDeploySuccess({
+    label: "Skill",
+    name: skill.name,
+    version,
+    agentVersion: response.data?.agentVersion
+  }));
+  syncDeployedVersionToYaml(skillHandler, skill.name, version, skill.version);
   writeHintBlock({
     headline: "Skill is live. Generate traffic to see it in action:",
     lines: [
@@ -52408,6 +53658,9 @@ async function promptVersionSelection2(versions, activeVersionId) {
 }
 __name(promptVersionSelection2, "promptVersionSelection");
 async function executeNonInteractive4(context, config, action, options) {
+  if (options.json && action !== "versions") {
+    throw CliError.usage("--json is only supported for the versions action", "Usage: lua skills versions --skill-name <name> --json");
+  }
   const skills = config.skills || [];
   if (action === "view") {
     if (skills.length === 0) {
@@ -52443,6 +53696,10 @@ async function executeNonInteractive4(context, config, action, options) {
     case "versions": {
       const data = await fetchVersionsCore2(context, selectedSkill);
       if (!data) throw new Error("Failed to fetch skill versions");
+      if (options.json) {
+        console.log(JSON.stringify(mapSkillVersionsToJson(data.versions)));
+        break;
+      }
       if (!context.hideVersions && data.versions.length === 0) {
         console.log(`\u2139\uFE0F  No versions found for ${selectedSkill.name}.`);
         console.log("\u{1F4A1} Push a version first using 'lua push skill'.");
@@ -53599,6 +54856,7 @@ async function displayWebhooksCore(context, webhooks) {
         const activeVersion = versions.find((v) => v.webhookId === activeVersionId);
         console.log(`\u{1FA9D} ${webhook.name}`);
         console.log(`   Webhook ID: ${webhook.webhookId}`);
+        console.log(`   URL: ${WEBHOOK_TRIGGER_BASE_URL}/${context.agentId}/${encodeURIComponent(webhook.name)}`);
         if (activeVersion) {
           console.log(deployedVersionLine(activeVersion.version, context.hideVersions));
           console.log(`   Deployed: ${new Date(activeVersion.createdAt).toLocaleString()}`);
@@ -53610,18 +54868,19 @@ async function displayWebhooksCore(context, webhooks) {
         }
         console.log();
       } else {
-        displayWebhookError(webhook, "Unable to fetch version info");
+        displayWebhookError(webhook, "Unable to fetch version info", context.agentId);
       }
     } catch {
-      displayWebhookError(webhook, "Error loading versions");
+      displayWebhookError(webhook, "Error loading versions", context.agentId);
     }
   }
   console.log("=".repeat(60));
 }
 __name(displayWebhooksCore, "displayWebhooksCore");
-function displayWebhookError(webhook, status) {
+function displayWebhookError(webhook, status, agentId) {
   console.log(`\u{1FA9D} ${webhook.name}`);
   console.log(`   Webhook ID: ${webhook.webhookId}`);
+  console.log(`   URL: ${WEBHOOK_TRIGGER_BASE_URL}/${agentId}/${encodeURIComponent(webhook.name)}`);
   console.log(`   Status: ${status}`);
   console.log();
 }
@@ -53666,17 +54925,21 @@ async function deployVersionCore3(context, webhook, version) {
     console.error(`\u274C Deploy Error: ${deployResponse.error?.message || "Unknown error"}`);
     return false;
   }
-  writeSuccess(`\u2705 Version ${version} of "${webhook.name}" deployed successfully`);
+  writeSuccess(formatDeploySuccess({
+    label: "Webhook",
+    name: webhook.name,
+    version,
+    agentVersion: deployResponse.data?.agentVersion
+  }));
+  syncDeployedVersionToYaml(webhookHandler, webhook.name, version, webhook.version);
+  const webhookUrl = `${WEBHOOK_TRIGGER_BASE_URL}/${context.agentId}/${encodeURIComponent(webhook.name)}`;
+  writeInfo(`   URL: ${webhookUrl}`);
   writeHintBlock({
     headline: "Webhook is live. Trigger it, then inspect logs:",
     lines: [
-      {
-        label: "Find URL:",
-        command: `lua webhooks view --webhook-name ${webhook.name}`
-      },
       {
         label: "Trigger:",
-        command: "curl -X POST <URL from above>"
+        command: `curl -X POST ${webhookUrl}`
       },
       {
         label: "Inspect:",
@@ -55328,6 +56591,10 @@ async function displayJobsCore(context, jobs, opts = {}) {
       if (jobData.nextRunAt) {
         console.log(`   Next Run: ${new Date(jobData.nextRunAt).toLocaleString()}`);
       }
+      if (jobData.health) {
+        const h = jobData.health;
+        console.log(`   Health: ${h.state === "alerting" ? `ALERT ${(h.condition ?? "").replace("_", "-")}${h.since ? ` since ${new Date(h.since).toLocaleString()}` : ""}` : h.state}`);
+      }
       console.log();
     } catch (error) {
       if (CliError.isCliError(error) && error.statusCode === 404) {
@@ -55396,7 +56663,13 @@ async function deployVersionCore4(context, job, version) {
     console.error(`\u274C Deploy Error: ${deployResponse.error?.message || "Unknown error"}`);
     return false;
   }
-  writeSuccess(`\u2705 Version ${version} of "${job.name}" deployed successfully`);
+  writeSuccess(formatDeploySuccess({
+    label: "Job",
+    name: job.name,
+    version,
+    agentVersion: deployResponse.data?.agentVersion
+  }));
+  syncDeployedVersionToYaml(jobHandler, job.name, version, job.version);
   writeInfo("\u{1F4A1} The new version is now active and will run on schedule.");
   writeHintBlock({
     headline: "Job is live. Trigger it, then inspect:",
@@ -55508,7 +56781,7 @@ async function fetchAndDisplayHistoryCore(context, job) {
     const status = execution.status;
     const statusEmoji = status === "completed" ? "\u2705" : status === "failed" ? "\u274C" : status === "running" ? "\u{1F504}" : "\u23F3";
     console.log(`${index + 1}. ${statusEmoji} ${status.toUpperCase()}`);
-    console.log(`   Execution ID: ${execution.executionId}`);
+    console.log(`   Execution ID: ${execution.id ?? execution.executionId ?? "N/A"}`);
     console.log(`   Started: ${startedAt.toLocaleString()}`);
     if (execution.completedAt) {
       const completedAt = new Date(execution.completedAt);
@@ -56733,7 +58006,7 @@ async function activateCore(ctx, name, on) {
   emitJson(ctx, res);
   if (!ctx.json) {
     writeSuccess(`\u2705 Workflow "${wf.name}" ${on ? "activated" : "deactivated"}`);
-    writeInfo(on ? "\u{1F4A1} Schedules and triggers for this workflow are enabled." : "\u{1F4A1} Schedules and triggers for this workflow are paused.");
+    writeInfo(on ? "\u{1F4A1} The workflow can start scheduled/triggered runs again \u2014 a schedule that is paused or auto-disabled stays that way (see `lua workflows schedules list` / `schedules resume <jobId>`)." : "\u{1F4A1} Scheduled and triggered starts are blocked while inactive \u2014 existing schedule pause/auto-disable state is unchanged.");
   }
   return WORKFLOW_EXIT.OK;
 }
@@ -58325,13 +59598,17 @@ function modelEventDetail(type, data) {
 __name(modelEventDetail, "modelEventDetail");
 async function logsCore(ctx, runId, o) {
   if (o.follow) return watchCore(ctx, runId, o);
+  const since = o.since !== void 0 ? parseSinceFlag(o.since) : void 0;
+  if (since !== void 0 && !Number.isFinite(since)) {
+    throw CliError.usage(`logs: --since is not a duration or ISO timestamp ("${o.since}")`);
+  }
   const res = await ctx.api.getRunEvents(runId, {
     limit: 500
   });
   if (!res.success || !res.data) return apiFailure(ctx, res, "logs");
   emitJson(ctx, res);
   if (ctx.json) return WORKFLOW_EXIT.OK;
-  const events = (res.data.events ?? []).filter((e) => (!o.step || e.stepId === o.step) && WORKFLOW_LOG_EVENT_PATTERN.test(e.type));
+  const events = (res.data.events ?? []).filter((e) => (!o.step || e.stepId === o.step) && WORKFLOW_LOG_EVENT_PATTERN.test(e.type) && (since === void 0 || Date.parse(e.ts) >= since));
   if (events.length === 0) console.log("(no log events yet)");
   for (const e of events) {
     const data = scrubEventData(e.data);
@@ -59124,6 +60401,12 @@ var goalStatusLabel = /* @__PURE__ */ __name((g) => `${g.status}${g.pauseReason
 var goalJobStateLabel = /* @__PURE__ */ __name((g) => g.job ? ` \xB7 ${g.job.status}${g.job.status === "active" && g.job.nextRunAt ? `, next ${when2(g.job.nextRunAt)}` : ""}` : "", "goalJobStateLabel");
 var verdictLabel = /* @__PURE__ */ __name((v) => v ? `${v.done ? "done" : "continue"}${v.summary ? ` \xB7 ${v.summary.slice(0, 60)}` : ""}` : "\u2014", "verdictLabel");
 var scheduleStatus = /* @__PURE__ */ __name((r) => r.autoDisabled ? "auto-disabled" : r.status === "inactive" ? "inactive" : r.status === "completed" || r.status === "missed" ? r.status : r.paused ? "paused" : "active", "scheduleStatus");
+var scheduleHealthLabel = /* @__PURE__ */ __name((r) => {
+  const h = r.health;
+  if (!h) return "\u2014";
+  if (h.state === "alerting") return `ALERT ${(h.condition ?? "").replace("_", "-")}${h.since ? ` since ${when2(h.since)}` : ""}`;
+  return h.state;
+}, "scheduleHealthLabel");
 function goalRaiseHint(goalId, reason) {
   const flag = reason === "budget" ? "--max-credits <n>" : reason === "max_runs" ? "--max-runs <n>" : "--max-runs <n> | --max-credits <n>";
   return `a goal parked at its cap (max_runs / budget) re-arms when the cap is raised: lua workflows goals raise ${goalId} ${flag} \u2014 or edit it: lua workflows goals edit ${goalId} \u2026`;
@@ -59193,6 +60476,7 @@ function printSchedules(items, names) {
     "Last fired",
     "Status",
     "Strikes",
+    "Health",
     "Goal"
   ], items.map((r) => [
     r.jobId,
@@ -59202,6 +60486,7 @@ function printSchedules(items, names) {
     when2(r.lastFiredAt),
     scheduleStatus(r),
     String(r.consecutiveFailures ?? 0),
+    scheduleHealthLabel(r),
     r.goalId ?? "\u2014"
   ])));
   const owned = items.filter((r) => r.goalId).length;
@@ -60852,6 +62137,7 @@ async function displayPreProcessorsCore(context, preprocessors) {
         const activeVersion = versions.find((v) => v.versionId === activeVersionId);
         console.log(`\u{1F4E5} ${preprocessor.name}`);
         console.log(`   PreProcessor ID: ${preprocessor.preprocessorId}`);
+        console.log(priorityLine(response.data.priority));
         if (activeVersion) {
           console.log(deployedVersionLine(activeVersion.version, context.hideVersions));
           console.log(`   Deployed: ${new Date(activeVersion.createdAt).toLocaleString()}`);
@@ -60918,7 +62204,13 @@ async function deployVersionCore5(context, preprocessor, version) {
     console.error(`\u274C Deploy Error: ${deployResponse.error?.message || "Unknown error"}`);
     return false;
   }
-  writeSuccess(`\u2705 Version ${version} of "${preprocessor.name}" deployed successfully`);
+  writeSuccess(formatDeploySuccess({
+    label: "PreProcessor",
+    name: preprocessor.name,
+    version,
+    agentVersion: deployResponse.data?.agentVersion
+  }));
+  syncDeployedVersionToYaml(preprocessorHandler, preprocessor.name, version, preprocessor.version);
   writeHintBlock({
     headline: "Preprocessor is live. Send a test message to trigger it:",
     lines: [
@@ -61429,6 +62721,7 @@ async function displayPostProcessorsCore(context, postprocessors) {
         const activeVersion = versions.find((v) => v.versionId === activeVersionId);
         console.log(`\u{1F4E4} ${postprocessor.name}`);
         console.log(`   PostProcessor ID: ${postprocessor.postprocessorId}`);
+        console.log(priorityLine(response.data.priority));
         if (activeVersion) {
           console.log(deployedVersionLine(activeVersion.version, context.hideVersions));
           console.log(`   Deployed: ${new Date(activeVersion.createdAt).toLocaleString()}`);
@@ -61495,7 +62788,13 @@ async function deployVersionCore6(context, postprocessor, version) {
     console.error(`\u274C Deploy Error: ${deployResponse.error?.message || "Unknown error"}`);
     return false;
   }
-  writeSuccess(`\u2705 Version ${version} of "${postprocessor.name}" deployed successfully`);
+  writeSuccess(formatDeploySuccess({
+    label: "PostProcessor",
+    name: postprocessor.name,
+    version,
+    agentVersion: deployResponse.data?.agentVersion
+  }));
+  syncDeployedVersionToYaml(postprocessorHandler, postprocessor.name, version, postprocessor.version);
   writeHintBlock({
     headline: "Postprocessor is live. Send a test message to trigger it:",
     lines: [
@@ -62524,7 +63823,7 @@ async function templateCreateAction(templateApi, config, options) {
       validate: /* @__PURE__ */ __name((input) => input && input.trim().length > 0 ? true : "Display name cannot be empty.", "validate")
     });
   }
-  if (description === void 0) {
+  if (description === void 0 && !isCiModeEnabled()) {
     questions.push({
       type: "input",
       name: "description",
@@ -62812,7 +64111,7 @@ ${"=".repeat(60)}`);
   console.log(`Visibility: ${template3.visibility === "private" ? "\u{1F512} Private" : "\u{1F310} Public"}`);
   console.log(`Listed: ${template3.listed ? "Yes" : "No"}`);
   console.log(`Installs: ${template3.installCount}`);
-  if (template3.latestVersion != null) console.log(`Latest version: v${template3.latestVersion}`);
+  if (template3.latestVersion) console.log(`Latest version: v${template3.latestVersion}`);
   console.log(`Created: ${new Date(template3.createdAt).toLocaleDateString()}`);
   console.log(`
 ${"=".repeat(60)}
@@ -63428,9 +64727,13 @@ async function listSkillNonInteractive(marketplaceApi, config, apiKey, options)
 }
 __name(listSkillNonInteractive, "listSkillNonInteractive");
 async function publishVersionNonInteractive(marketplaceApi, config, apiKey, options) {
-  const { marketplaceId, versionId, changelog, envVarsJson } = options;
-  if (!marketplaceId || !versionId) {
-    throw CliError.usage("Missing required options", "Usage: lua marketplace skill publish --marketplace-id <id> --version-id <id> [--changelog <text>]");
+  const { marketplaceId, changelog, envVarsJson } = options;
+  let { versionId } = options;
+  if (!marketplaceId || !versionId && !options.version) {
+    throw CliError.usage("Missing required options", "Usage: lua marketplace skill publish --marketplace-id <id> (--version-id <id> | --version <semver>) [--changelog <text>]");
+  }
+  if (!versionId && options.version) {
+    versionId = await resolveVersionIdFromSemver(marketplaceApi, config, apiKey, marketplaceId, options.version);
   }
   let envVars;
   if (envVarsJson) {
@@ -63451,6 +64754,40 @@ async function publishVersionNonInteractive(marketplaceApi, config, apiKey, opti
   writeInfo("\u{1F4A1} You will be notified once the review is complete.");
 }
 __name(publishVersionNonInteractive, "publishVersionNonInteractive");
+async function resolveVersionIdFromSemver(marketplaceApi, config, apiKey, marketplaceId, version) {
+  const marketplaceSkill = await marketplaceApi.getSkillById(marketplaceId);
+  const agentId = config.agent?.agentId;
+  if (!agentId) {
+    throw CliError.usage("Agent ID not found in configuration.");
+  }
+  const skillApi = new SkillApi(BASE_URLS.API, apiKey, agentId);
+  const agentSkillsResponse = await skillApi.getSkills();
+  if (!agentSkillsResponse.success || !agentSkillsResponse.data) {
+    throw CliError.notFound(`Failed to fetch agent skills: ${agentSkillsResponse.message || "Unknown error"}`);
+  }
+  const agentSkills = agentSkillsResponse.data.skills || [];
+  let sourceSkill = agentSkills.find((s) => s.id === marketplaceSkill.sourceSkillId);
+  if (!sourceSkill) {
+    const nameMatches = agentSkills.filter((s) => s.name === marketplaceSkill.name);
+    if (nameMatches.length > 1) {
+      throw CliError.usage(`Multiple agent skills are named "${marketplaceSkill.name}"; cannot determine which one to publish.`, "Pass --version-id explicitly to disambiguate instead of --version.");
+    }
+    sourceSkill = nameMatches[0];
+  }
+  if (!sourceSkill) {
+    throw CliError.notFound(`Could not find the source skill on your agent.`, `The skill "${marketplaceSkill.name}" (ID: ${marketplaceSkill.sourceSkillId}) is missing from agent ${agentId}.`);
+  }
+  const versionsResponse = await skillApi.getSkillVersions(sourceSkill.id);
+  if (!versionsResponse.success || !versionsResponse.data) {
+    throw CliError.notFound(`Failed to fetch skill versions: ${versionsResponse.message || "Unknown error"}`);
+  }
+  const matchingVersion = (versionsResponse.data.versions || []).find((v) => v.version === version);
+  if (!matchingVersion) {
+    throw CliError.notFound(`Version "${version}" not found for skill "${sourceSkill.name}".`, `Run 'lua skills versions --skill-name ${sourceSkill.name} --json' to see available versions.`);
+  }
+  return matchingVersion.id;
+}
+__name(resolveVersionIdFromSemver, "resolveVersionIdFromSemver");
 async function updateMetadataNonInteractive(marketplaceApi, options) {
   const { marketplaceId, displayName } = options;
   if (!marketplaceId) {
@@ -66042,7 +67379,8 @@ async function executeNonInteractive12(context, action, cmdOptions) {
     // Trigger options
     triggers: cmdOptions?.triggers,
     customWebhook: cmdOptions?.customWebhook === true,
-    hookUrl: cmdOptions?.hookUrl
+    hookUrl: cmdOptions?.hookUrl,
+    forget: cmdOptions?.forget === true
   };
   const jsonOutput = cmdOptions?.json === true;
   switch (normalizedAction) {
@@ -66090,7 +67428,7 @@ async function executeNonInteractive12(context, action, cmdOptions) {
         throw CliError.usage("--connection-id is required for disconnect", "Run 'lua integrations list' to see connection IDs");
       }
       if (options.scope === "user") {
-        await disconnectUserConnection(context, options.connectionId);
+        await disconnectUserConnection(context, options.connectionId, options.forget);
       } else {
         await disconnectIntegration(context, options.connectionId);
       }
@@ -66343,9 +67681,27 @@ function normalizeScopeFlag(raw) {
   return normalized;
 }
 __name(normalizeScopeFlag, "normalizeScopeFlag");
+function resolveCiScopeDefault(flagged, ciEnabled) {
+  if (flagged) return flagged;
+  return ciEnabled ? "agent" : void 0;
+}
+__name(resolveCiScopeDefault, "resolveCiScopeDefault");
+function assertAccountLabelForCi(userScope, accountLabel, ciEnabled) {
+  if (userScope || !ciEnabled) return;
+  if (accountLabel?.trim()) return;
+  throw CliError.usage("--account-label is required when --ci is set (finalizeConnection asks for it only after OAuth succeeds, and --ci cannot answer prompts)", joinHint(void 0, "Prompting is not possible under --ci"));
+}
+__name(assertAccountLabelForCi, "assertAccountLabelForCi");
+function resolveDisconnectForget(explicitForget, ciEnabled) {
+  if (explicitForget === true) return true;
+  return ciEnabled ? false : "prompt";
+}
+__name(resolveDisconnectForget, "resolveDisconnectForget");
 async function resolveConnectScope(context, options) {
   const flagged = normalizeScopeFlag(options.scope);
   if (flagged) return flagged;
+  const ciDefault = resolveCiScopeDefault(flagged, isCiModeEnabled());
+  if (ciDefault) return ciDefault;
   const answer = await safePrompt([
     {
       type: "list",
@@ -66378,6 +67734,7 @@ async function connectIntegrationFlow(context, options = {}) {
       throw new Error("Agent-scoped options cannot be used with --scope user");
     }
   }
+  assertAccountLabelForCi(userScope, options.accountLabel, isCiModeEnabled());
   writeProgress("\u{1F504} Fetching integrations...");
   let availableIntegrations;
   let agentConnectedTypes = /* @__PURE__ */ new Set();
@@ -67136,18 +68493,25 @@ async function listConnections(context) {
   }
 }
 __name(listConnections, "listConnections");
-async function disconnectUserConnection(context, connectionId) {
-  const forget = await safePrompt([
-    {
-      type: "confirm",
-      name: "forget",
-      message: "Also forget what this connection already added to memory? (it is kept otherwise)",
-      default: false
-    }
-  ]);
-  if (!forget) return;
+async function disconnectUserConnection(context, connectionId, forgetFlag) {
+  const decision = resolveDisconnectForget(forgetFlag, isCiModeEnabled());
+  let shouldForget;
+  if (decision === "prompt") {
+    const forget = await safePrompt([
+      {
+        type: "confirm",
+        name: "forget",
+        message: "Also forget what this connection already added to memory? (it is kept otherwise)",
+        default: false
+      }
+    ]);
+    if (!forget) return;
+    shouldForget = forget.forget;
+  } else {
+    shouldForget = decision;
+  }
   writeProgress("\u{1F504} Disconnecting... (please wait, do not close this window)");
-  const result = await context.unifiedToApi.deleteUserConnection(connectionId, forget.forget);
+  const result = await context.unifiedToApi.deleteUserConnection(connectionId, shouldForget);
   if (!result.success) {
     writeError(`\u274C Failed to disconnect: ${result.error?.message || "Unknown error"}`);
     return;
@@ -67156,14 +68520,14 @@ async function disconnectUserConnection(context, connectionId) {
   if (result.data?.deletedWebhooksCount) {
     console.log(`   \u2713 Deleted ${result.data.deletedWebhooksCount} memory source(s)`);
   }
-  if (!forget.forget) {
+  if (!shouldForget) {
     console.log("   \u2139\uFE0F  What it already added to memory was kept.");
   }
   console.log();
   trackEvent("cli_integration_disconnected", {
     scope: "user",
     webhooks_deleted: result.data?.deletedWebhooksCount || 0,
-    forget_memories: forget.forget
+    forget_memories: shouldForget
   });
 }
 __name(disconnectUserConnection, "disconnectUserConnection");
@@ -70442,6 +71806,7 @@ __name(defaultRestore, "defaultRestore");
 // src/commands/version.ts
 init_cli();
 init_command_utils();
+init_cli_error();
 init_analytics();
 init_files();
 init_semver();
@@ -70796,6 +72161,8 @@ async function versionDeleteCommand(versionArg, options = {}) {
         writeInfo("Aborted.");
         return;
       }
+    } else if (!options.force && (!isTTY || isCi)) {
+      throw CliError.usage(`Deleting v${version} needs a confirmation; pass --force to give it non-interactively.`, "Nothing was deleted.");
     }
     const api = new AgentVersionApi(BASE_URLS.API, apiKey, agentId);
     const response = await api.deleteVersion(version);
@@ -71407,7 +72774,7 @@ Arguments:
 
 Skill Actions:
   list      --skill-name <name> --display-name <name> [--visibility public|private]
-  publish   --marketplace-id <id> --version-id <id> [--changelog <text>] [--env-vars-json <json>]
+  publish   --marketplace-id <id> (--version-id <id> | --version <semver>) [--changelog <text>] [--env-vars-json <json>]
   edit      --marketplace-id <id> --display-name <name>
   unlist    --marketplace-id <id> --force
   unpublish --marketplace-id <id> --version-id <id> --force
@@ -71439,6 +72806,7 @@ Examples:
   $ lua marketplace skill org                                           View this organization's owned skills
   $ lua marketplace skill list --skill-name mySkill --display-name "My Skill"
   $ lua marketplace skill publish --marketplace-id xyz --version-id v1
+  $ lua marketplace skill publish --marketplace-id xyz --version 1.2.0     Alternative to --version-id
   $ lua marketplace skill unlist --marketplace-id xyz --force
   $ lua marketplace skill search --query "CRM"
   $ lua marketplace skill view --marketplace-id xyz --json
@@ -71623,7 +72991,7 @@ Examples:
   program2.command("persona [env] [action]").description("\u{1F916} Manage agent persona").option("--persona-version <version>", "Version number or 'latest' for deploy").option("--force", "Skip confirmation prompt").addHelpText("after", `
 Arguments:
   env                      Optional: 'sandbox', 'staging', or 'production' (prompts if not provided)
-  action                   Optional (production only): 'view', 'versions', 'deploy'
+  action                   Optional: 'view', 'versions' (sandbox or production), 'deploy' (production only)
 
 Options:
   --persona-version <ver>  Version number or 'latest' for deploy action
@@ -71632,6 +73000,7 @@ Options:
 Examples:
   $ lua persona                                                 Interactive selection
   $ lua persona sandbox                                         Manage sandbox persona interactively
+  $ lua persona sandbox versions                                List persona versions (sandbox)
   $ lua persona production                                      Manage production persona interactively
   $ lua persona production view                                 View current deployed persona
   $ lua persona production versions                             List all persona versions
@@ -71748,20 +73117,23 @@ Notes:
   acknowledgement is given AND the credential holds logs:manage \u2014 the scope alone is not
   enough, the flag is required too.
 `).action((options, command) => logsExportCommand(withGroupOptions(options ?? {}, command)));
-  program2.command("skills [actionOrEnv] [action]").description("\u2699\uFE0F  Manage and view skills").option("--skill-name <name>", "Skill name").option("--skill-version <version>", "Version for deploy action (or 'latest')").addHelpText("after", `
+  program2.command("skills [actionOrEnv] [action]").description("\u2699\uFE0F  Manage and view skills").option("--skill-name <name>", "Skill name").option("--skill-version <version>", "Version for deploy action (or 'latest')").option("--json", "Print versions as JSON, including version ids (for versions action)").addHelpText("after", `
 Arguments:
   actionOrEnv              Optional: environment ('sandbox', 'production') or action ('view', 'versions', 'deploy', 'delete')
 
 Options:
   --skill-name <name>      Skill name (for versions/deploy/delete actions)
   --skill-version <ver>    Version for deploy action, or 'latest'
+  --json                   Print versions as JSON, including version ids (for versions action)
 
 Examples:
   $ lua skills                                                 Interactive selection
   $ lua skills sandbox                                         View sandbox skills
   $ lua skills production                                      Manage production skills
   $ lua skills view                                            List all production skills
+  $ lua skills production view                                 Same non-interactive listing as 'lua skills view'
   $ lua skills versions --skill-name mySkill                   View skill versions
+  $ lua skills versions --skill-name mySkill --json             View skill version ids as JSON
   $ lua skills deploy --skill-name mySkill --skill-version 1.0.3   Deploy specific version
   $ lua skills deploy --skill-name mySkill --skill-version latest  Deploy latest version
   $ lua skills delete --skill-name mySkill                     Delete a skill from server
@@ -71870,7 +73242,7 @@ Examples:
   $ lua jobs versions -i myJob                         View job versions
   $ lua jobs history -i myJob                          View execution history
 `).action(jobsCommand);
-  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, retry-step, resolve-step, raise-budget, approve, signal, replay, export, schedules)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/export/goals create/schedules create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create/schedules create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs/schedules create: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start/schedules create: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list/approval-payload --path: page size").option("--cursor <c>", "runs/goals list/approval-payload --path: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status, 6 for a gated run").option("--compose <on|off>", "policy models set: may the composer be shown the model menu").option("--max-class <fast|balanced|strong>", "policy models set: ceiling for class requests and the class map").option("--consent-actions <n>", "policy models set: estimated actions above which a composed run shows the card").option("--allow <codes>", "policy models set: comma-separated approved codes to narrow the set to").option("--class-fast <codes>", "policy models set: ordered overrides of the fast class (comma-separated)").option("--class-balanced <codes>", "policy models set: ordered overrides of the balanced class (comma-separated)").option("--class-strong <codes>", "policy models set: ordered overrides of the strong class (comma-separated)").option("--class-map <pairs>", "policy models set: comma-separated <taskClass>=<modelClass> pairs").option("--pins <class-only|allowed>", "policy models set: may a composed definition pin a concrete code").option("--fallback <same-class|same-provider>", "policy models set: where a failed leg may hop to").option("--enabled <on|off>", "policy autonomy set: may a start inside the envelope skip the consent card").option("--max-duration <seconds>", "policy autonomy set: the envelope\u2019s duration bound, in seconds").option("--max-actions <n>", "policy autonomy set: the envelope\u2019s estimated-actions bound").option("--max-runs-per-hour <n>", "policy autonomy set: autonomous starts per hour, per agent").option("--forms <list>", "policy autonomy set: comma-separated forms the envelope admits (graph,script,static)").option("--clear <keys>", "policy autonomy set: comma-separated members to clear back to the platform default").option("--agent <agentId>", "policy autonomy: not supported \u2014 no route writes a per-agent envelope (see the refusal)").option("--kind <kind>", "clear-gate: the gate kind to clear (e.g. model_policy)").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/retry-step/resolve-step/logs: step id").option("--outcome <skip|complete|fail>", "resolve-step: the decision on the parked step (--action is accepted too)").option("--action <skip|complete|fail>", "resolve-step: alias of --outcome").option("--output <json|@file>", "resolve-step: the output a completed step would have produced (required with --outcome complete)").option("--credits <n>", "raise-budget: the new priced cap of a budget-parked run, in the run's own budget unit \u2014 credits, or actions on a seat plan (above the current one)").option("--max-steps <n>", "raise-budget: the new step cap").option("--max-job-seconds <n>", "raise-budget: the new Job-tier seconds cap").option("--max-duration-seconds <n>", "raise-budget: the new wall-clock cap").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve/approval-payload: the wfa_\u2026 approval id (lua workflows status <runId> --steps --json \u2192 suspend.approvalId), not the step id").option("--path <array.path>", "approval-payload: page one array of a large payload (--cursor / --limit inside it)").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/retry-step/resolve-step/raise-budget/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph \xB7 export: overwrite files").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip) \xB7 export: target dir").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create/schedules create: cadence entry (repeatable, \u2264 5); goals: none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit/schedules create: IANA timezone for bare cron cadences").option("--notify <emailApp|email|app|off>", "schedules create: where each fire notifies").option("--backfill-on-enable <n|none>", "schedules create/patch/resume: replay \u2264 n missed fires on re-enable (patch: none clears it)").option("--backfill-now", "schedules resume (or patch --paused false): one-shot backfill on THIS re-enable").option("--paused <true|false>", "schedules patch: pause (true) or re-enable (false) the schedule").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit/schedules create: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
+  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, retry-step, resolve-step, raise-budget, approve, signal, replay, export, schedules)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/export/goals create/schedules create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create/schedules create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs/schedules create: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start/schedules create: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list/approval-payload --path: page size").option("--cursor <c>", "runs/goals list/approval-payload --path: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status, 6 for a gated run").option("--compose <on|off>", "policy models set: may the composer be shown the model menu").option("--max-class <fast|balanced|strong>", "policy models set: ceiling for class requests and the class map").option("--consent-actions <n>", "policy models set: estimated actions above which a composed run shows the card").option("--allow <codes>", "policy models set: comma-separated approved codes to narrow the set to").option("--class-fast <codes>", "policy models set: ordered overrides of the fast class (comma-separated)").option("--class-balanced <codes>", "policy models set: ordered overrides of the balanced class (comma-separated)").option("--class-strong <codes>", "policy models set: ordered overrides of the strong class (comma-separated)").option("--class-map <pairs>", "policy models set: comma-separated <taskClass>=<modelClass> pairs").option("--pins <class-only|allowed>", "policy models set: may a composed definition pin a concrete code").option("--fallback <same-class|same-provider>", "policy models set: where a failed leg may hop to").option("--enabled <on|off>", "policy autonomy set: may a start inside the envelope skip the consent card").option("--max-duration <seconds>", "policy autonomy set: the envelope\u2019s duration bound, in seconds").option("--max-actions <n>", "policy autonomy set: the envelope\u2019s estimated-actions bound").option("--max-runs-per-hour <n>", "policy autonomy set: autonomous starts per hour, per agent").option("--forms <list>", "policy autonomy set: comma-separated forms the envelope admits (graph,script,static)").option("--clear <keys>", "policy autonomy set: comma-separated members to clear back to the platform default").option("--agent <agentId>", "policy autonomy: not supported \u2014 no route writes a per-agent envelope (see the refusal)").option("--kind <kind>", "clear-gate: the gate kind to clear (e.g. model_policy)").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/retry-step/resolve-step/logs: step id").option("--outcome <skip|complete|fail>", "resolve-step: the decision on the parked step (--action is accepted too)").option("--action <skip|complete|fail>", "resolve-step: alias of --outcome").option("--output <json|@file>", "resolve-step: the output a completed step would have produced (required with --outcome complete)").option("--credits <n>", "raise-budget: the new priced cap of a budget-parked run, in the run's own budget unit \u2014 credits, or actions on a seat plan (above the current one)").option("--max-steps <n>", "raise-budget: the new step cap").option("--max-job-seconds <n>", "raise-budget: the new Job-tier seconds cap").option("--max-duration-seconds <n>", "raise-budget: the new wall-clock cap").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve/approval-payload: the wfa_\u2026 approval id (lua workflows status <runId> --steps --json \u2192 suspend.approvalId), not the step id").option("--path <array.path>", "approval-payload: page one array of a large payload (--cursor / --limit inside it)").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/retry-step/resolve-step/raise-budget/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: only events at/after this time (Nd/Nh/Nm or ISO) \xB7 archive-runs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph \xB7 export: overwrite files").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip) \xB7 export: target dir").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create/schedules create: cadence entry (repeatable, \u2264 5); goals: none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit/schedules create: IANA timezone for bare cron cadences").option("--notify <emailApp|email|app|off>", "schedules create: where each fire notifies").option("--backfill-on-enable <n|none>", "schedules create/patch/resume: replay \u2264 n missed fires on re-enable (patch: none clears it)").option("--backfill-now", "schedules resume (or patch --paused false): one-shot backfill on THIS re-enable").option("--paused <true|false>", "schedules patch: pause (true) or re-enable (false) the schedule").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit/schedules create: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
 Arguments:
   action    list \xB7 view \xB7 versions \xB7 deploy \xB7 activate \xB7 deactivate \xB7 start \xB7 run \xB7 runs \xB7 status \xB7
             watch \xB7 cancel \xB7 resume \xB7 retry-step \xB7 resolve-step \xB7 raise-budget \xB7 approve \xB7 approval-payload \xB7
@@ -72005,7 +73377,7 @@ Examples:
   $ lua mcp deactivate --server-name api-server Deactivate a server
   $ lua mcp delete --server-name old-server     Delete a server
 `).action(mcpCommand);
-  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--scope <scope>", "Who owns the connection: 'agent' (default) or 'user'").option("--force", "Skip the confirmation prompt (for convert)").option("--connection-id <id>", "Exact connection ID to update, disconnect, convert or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval in minutes for virtual webhooks, 1-2880 (default 1; e.g. 1, 5, 15, 60, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for info and webhooks events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
+  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--scope <scope>", "Who owns the connection: 'agent' (default) or 'user'").option("--force", "Skip the confirmation prompt (for convert)").option("--forget", "Also forget what a personal connection (--scope user) added to memory on disconnect (default: false, memories kept)").option("--connection-id <id>", "Exact connection ID to update, disconnect, convert or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval in minutes for virtual webhooks, 1-2880 (default 1; e.g. 1, 5, 15, 60, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for info and webhooks events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
 Arguments:
   action                 Optional: 'connect', 'update', 'list', 'available', 'info', 'disconnect',
                          'convert', 'webhooks' (alias: 'triggers'), or 'mcp'
@@ -72024,6 +73396,8 @@ Options:
   --triggers <events>    Comma-separated triggers to enable (e.g., task_task.created,task_task.updated)
   --custom-webhook       Use custom webhook URL instead of agent trigger
   --hook-url <url>       Custom webhook URL (use with --custom-webhook)
+  --forget               Disconnect (--scope user): also forget what the connection added to memory
+                         (default: false, memories kept)
   --json                 Output as JSON (for info and webhooks events commands)
 
 Webhook/Trigger Options:
@@ -72036,6 +73410,8 @@ Webhook/Trigger Options:
 
 Note: Multiple accounts of one integration are supported; use --connection-id when updating one.
 Note: Triggers, account labels and --hide-sensitive are agent-scoped; they don't apply to --scope user.
+Note: --account-label is required under --ci for agent-scoped connects (the label prompt would
+      otherwise fire after OAuth succeeds); --scope defaults to agent under --ci.
 
 Examples:
   $ lua integrations                                    Interactive management
@@ -72055,6 +73431,8 @@ Examples:
   $ lua integrations info linear                        Show Linear integration details
   $ lua integrations info linear --json                 Output as JSON (for scripting)
   $ lua integrations disconnect --connection-id abc123  Disconnect an integration
+  $ lua integrations connect --integration github --auth-method oauth --scopes all --account-label 'Support inbox' --ci
+  $ lua integrations disconnect --connection-id abc123 --scope user --forget --ci
 
 Webhook/Trigger Examples ('triggers' is an alias for 'webhooks'):
   $ lua integrations webhooks list                      List all triggers
@@ -72226,8 +73604,10 @@ Examples:
 `).action(() => versionStatusCommand());
   versionGroup.command("delete <version>").description("Soft-delete a version").option("--force", "Skip confirmation prompt").addHelpText("after", `
 Examples:
-  $ lua version delete 3          Delete v3 (confirms first)
-  $ lua version delete v3 --force Skip confirmation
+  $ lua version delete 3                Delete v3 (confirms first)
+  $ lua version delete v3 --force       Skip confirmation
+  $ lua version delete v3 --ci          Refused: needs --force (usage error, exit 2)
+  $ lua version delete v3 --ci --force  Delete non-interactively
 `).action((version, opts) => versionDeleteCommand(version, opts));
   const gitGroup = program2.command("git").description("Manage opt-in git auto-commits for this project");
   gitGroup.command("connect").description("Enable git auto-commits (runs sanity checks, writes git.enabled: true)").option("--auto-push", "Also enable post-commit auto-push (requires `lua git auth github` + a GitHub HTTPS origin remote)").action((opts) => gitConnectCommand({