lua-cli 3.42.0 → 3.44.0

package/dist/index.js

@@ -17839,6 +17839,19 @@ var init_types = __esm({
 
 // src/api/http.client.ts
 import { randomUUID as randomUUID3 } from "crypto";
+function abortedResponse() {
+  return {
+    success: false,
+    error: {
+      message: "Request aborted",
+      code: REQUEST_ABORTED_CODE,
+      statusCode: 0
+    }
+  };
+}
+function isAborted(signal) {
+  return !!signal && signal.aborted === true;
+}
 async function classifyErrorResponse(response) {
   let errorData;
   try {
@@ -17994,7 +18007,7 @@ function coreDrainApiRetryDelayMs(error) {
   const delayMs = retryAfterSeconds * 1e3;
   return Math.min(Math.max(0, delayMs), CORE_DRAINING_MAX_RETRY_MS);
 }
-var DEFAULT_REQUEST_TIMEOUT_MS, HttpClient;
+var DEFAULT_REQUEST_TIMEOUT_MS, REQUEST_ABORTED_CODE, HttpClient;
 var init_http_client = __esm({
   "src/api/http.client.ts"() {
     "use strict";
@@ -18005,6 +18018,9 @@ var init_http_client = __esm({
     init_lua_fetch();
     init_request_credential();
     DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+    REQUEST_ABORTED_CODE = "REQUEST_ABORTED";
+    __name(abortedResponse, "abortedResponse");
+    __name(isAborted, "isAborted");
     HttpClient = class {
       static {
         __name(this, "HttpClient");
@@ -18027,9 +18043,17 @@ var init_http_client = __esm({
       * @private
       */
       async request(url, options = {}, overrides) {
+        const callerSignal = overrides?.signal;
+        if (isAborted(callerSignal)) return abortedResponse();
         const controller = new AbortController();
         const timeoutMs = overrides?.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
         const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+        const onCallerAbort = /* @__PURE__ */ __name(() => controller.abort(), "onCallerAbort");
+        if (typeof callerSignal?.addEventListener === "function") {
+          callerSignal.addEventListener("abort", onCallerAbort, {
+            once: true
+          });
+        }
         try {
           const authorization = this.requestCredential ? `Bearer ${await bearerFor(this.requestCredential)}` : void 0;
           const response = await luaFetch(url, {
@@ -18051,6 +18075,7 @@ var init_http_client = __esm({
           try {
             data = await response.json();
           } catch (jsonError) {
+            if (isAborted(callerSignal)) throw jsonError;
             data = {};
           }
           if (typeof data === "object" && data !== null && "success" in data) {
@@ -18068,6 +18093,9 @@ var init_http_client = __esm({
           if (isAccessDeniedError(error)) {
             throw error;
           }
+          if (isAborted(callerSignal)) {
+            return abortedResponse();
+          }
           if (error instanceof DOMException && error.name === "AbortError") {
             return {
               success: false,
@@ -18084,9 +18112,36 @@ var init_http_client = __esm({
               statusCode: 0
             }
           };
+        } finally {
+          clearTimeout(timeoutId);
+          if (typeof callerSignal?.removeEventListener === "function") {
+            callerSignal.removeEventListener("abort", onCallerAbort);
+          }
         }
       }
       /**
+      * A backoff wait the caller's signal can cut short (BAC-1097): resolves at `ms` or on abort, whichever is
+      * first, and never leaves the timer or the listener behind. The caller re-checks `signal.aborted` afterwards.
+      * @private
+      */
+      sleep(ms, signal) {
+        if (isAborted(signal)) return Promise.resolve();
+        const listenable = typeof signal?.addEventListener === "function";
+        return new Promise((resolve7) => {
+          const onAbort = /* @__PURE__ */ __name(() => {
+            clearTimeout(timer);
+            resolve7();
+          }, "onAbort");
+          const timer = setTimeout(() => {
+            if (listenable) signal.removeEventListener("abort", onAbort);
+            resolve7();
+          }, ms);
+          if (listenable) signal.addEventListener("abort", onAbort, {
+            once: true
+          });
+        });
+      }
+      /**
       * Non-2xx classification shared by `request` and `httpStream` (WF-204): 401s become
       * `AuthenticationError` (ownership vs credential), 403s throw, everything else returns the
       * `{ success:false, error }` envelope with the server body spread in.
@@ -18154,19 +18209,22 @@ var init_http_client = __esm({
           }
         }
         let lastResult = null;
+        const signal = overrides?.signal;
         for (let attempt = 0; attempt <= maxRetries; attempt++) {
+          if (isAborted(signal)) return abortedResponse();
           try {
             const result = await this.request(url, options, overrides);
             if (result.success || !result.error || !this.isRetryableStatus(result.error.statusCode || 0)) {
               return result;
             }
+            if (isAborted(signal)) return result;
             lastResult = result;
           } catch (error) {
             throw error;
           }
           if (attempt < maxRetries) {
             const backoff = this.retryDelayMs(attempt, lastResult?.error, options.method);
-            await new Promise((resolve7) => setTimeout(resolve7, backoff));
+            await this.sleep(backoff, signal);
           }
         }
         return lastResult;
@@ -18215,7 +18273,8 @@ var init_http_client = __esm({
       async httpPostCoreDrainRetry(url, data, headers, overrides) {
         const first = await this.httpPostOnce(url, data, headers, overrides);
         if (!isCoreDrainApiError(first.error)) return first;
-        await new Promise((resolve7) => setTimeout(resolve7, coreDrainApiRetryDelayMs(first.error)));
+        await this.sleep(coreDrainApiRetryDelayMs(first.error), overrides?.signal);
+        if (isAborted(overrides?.signal)) return abortedResponse();
         return this.httpPostOnce(url, data, headers, overrides);
       }
       /**
@@ -20702,6 +20761,23 @@ function setCiMode(enabled) {
 function isCiModeEnabled() {
   return isCiMode;
 }
+function setJsonOutputRequested(enabled) {
+  jsonOutputRequested = enabled;
+}
+function isJsonOutputRequested() {
+  return jsonOutputRequested;
+}
+function commandRequestedJson(command) {
+  for (let current = command; current; current = current.parent) {
+    if (current.getOptionValueSource("json") === "cli" && current.getOptionValue("json")) return true;
+  }
+  return false;
+}
+function registerJsonErrorEnvelope(program2) {
+  program2.hook("preAction", (_thisCommand, actionCommand) => {
+    setJsonOutputRequested(commandRequestedJson(actionCommand));
+  });
+}
 async function showUpdateWarningIfNeeded(versionCheckPromise) {
   try {
     const result = await versionCheckPromise;
@@ -20777,7 +20853,8 @@ async function withErrorHandling(commandFn, commandName, opts) {
     }
     let json2 = false;
     try {
-      json2 = typeof opts?.json === "function" ? !!opts.json() : !!opts?.json;
+      if (opts?.json === void 0) json2 = isJsonOutputRequested();
+      else json2 = typeof opts.json === "function" ? !!opts.json() : !!opts.json;
     } catch {
     }
     const reported = reportCliError(error, {
@@ -20801,7 +20878,7 @@ function writeSuccess(message) {
 function writeError(message) {
   process.stderr.write("\r\x1B[K" + message + "\n");
 }
-var isCiMode;
+var isCiMode, jsonOutputRequested;
 var init_cli = __esm({
   "src/utils/cli.ts"() {
     "use strict";
@@ -20815,6 +20892,11 @@ var init_cli = __esm({
     isCiMode = false;
     __name(setCiMode, "setCiMode");
     __name(isCiModeEnabled, "isCiModeEnabled");
+    jsonOutputRequested = false;
+    __name(setJsonOutputRequested, "setJsonOutputRequested");
+    __name(isJsonOutputRequested, "isJsonOutputRequested");
+    __name(commandRequestedJson, "commandRequestedJson");
+    __name(registerJsonErrorEnvelope, "registerJsonErrorEnvelope");
     __name(showUpdateWarningIfNeeded, "showUpdateWarningIfNeeded");
     __name(withErrorHandling, "withErrorHandling");
     __name(clearPromptLines, "clearPromptLines");
@@ -32961,10 +33043,15 @@ var init_webhook_api_service = __esm({
 });
 
 // src/instances/user.instance.ts
+function omit(source, key) {
+  const { [key]: _dropped, ...rest } = source;
+  return rest;
+}
 var UserDataInstance;
 var init_user_instance = __esm({
   "src/instances/user.instance.ts"() {
     "use strict";
+    __name(omit, "omit");
     UserDataInstance = class {
       static {
         __name(this, "UserDataInstance");
@@ -32980,7 +33067,12 @@ var init_user_instance = __esm({
       * @returns Proxied instance that allows direct access to data properties
       */
       constructor(api, data, profile) {
-        this.data = data && typeof data === "object" ? data : {};
+        Object.defineProperty(this, "data", {
+          value: data && typeof data === "object" ? data : {},
+          writable: true,
+          enumerable: false,
+          configurable: true
+        });
         Object.defineProperty(this, "userAPI", {
           value: api,
           writable: true,
@@ -33092,7 +33184,8 @@ var init_user_instance = __esm({
       */
       async update(data) {
         try {
-          const response = await this.userAPI.update(data);
+          const payload = data && data.data === this.data ? omit(data, "data") : data;
+          const response = await this.userAPI.update(payload);
           this.data = response;
           return this.data;
         } catch (error) {
@@ -34993,6 +35086,29 @@ var init_ai_api_service = __esm({
         }
         return result.data;
       }
+      async image(body) {
+        return this.httpPost(`/developer/ai/${this.agentId}/image`, body, {});
+      }
+      /**
+      * Handles the simplified-vs-full-options branching for `AI.image`.
+      * Simplified (`AI.image(prompt, options?)`) returns the hosted CDN url string; the options overload
+      * (`AI.image({ prompt, ... })`) returns the full `{ url, model, provider }`.
+      */
+      async imageForSandbox(promptOrOptions, options) {
+        const simplified = typeof promptOrOptions === "string";
+        const body = simplified ? {
+          prompt: promptOrOptions,
+          ...options
+        } : promptOrOptions;
+        const result = await this.image(body);
+        if (!result.success) {
+          throw new Error(result.error?.message || "AI image generation failed");
+        }
+        if (!result.data) {
+          throw new Error("AI image generation failed: empty response");
+        }
+        return simplified ? result.data.url : result.data;
+      }
     };
   }
 });
@@ -35379,6 +35495,12 @@ var init_connection_requests_api_service = __esm({
 });
 
 // src/api/agents.api.service.ts
+function isAborted2(signal) {
+  return !!signal && signal.aborted === true;
+}
+function abortReason2(signal) {
+  return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
 function toInvocationOutput(data, callerThreadId) {
   const toolNames = /* @__PURE__ */ new Set();
   for (const step3 of Array.isArray(data.steps) ? data.steps : []) {
@@ -35464,9 +35586,15 @@ var init_agents_api_service = __esm({
         });
         if (body.identifier) query.set("identifier", body.identifier);
         const chatBody = this.toChatGenerateBody(body);
-        return this.httpPostCoreDrainRetry(`/chat/generate/${targetAgentId}?${query.toString()}`, chatBody, {}, typeof body.timeoutMs === "number" ? {
-          timeoutMs: body.timeoutMs
-        } : void 0);
+        const overrides = {
+          ...typeof body.timeoutMs === "number" ? {
+            timeoutMs: body.timeoutMs
+          } : {},
+          ...body.signal ? {
+            signal: body.signal
+          } : {}
+        };
+        return this.httpPostCoreDrainRetry(`/chat/generate/${targetAgentId}?${query.toString()}`, chatBody, {}, Object.keys(overrides).length > 0 ? overrides : void 0);
       }
       /**
       * Sandbox overload: mirrors the `AI.generate` pattern where the simplified
@@ -35477,8 +35605,10 @@ var init_agents_api_service = __esm({
         const input = typeof promptOrInput === "string" ? {
           prompt: promptOrInput
         } : promptOrInput;
+        if (isAborted2(input.signal)) throw abortReason2(input.signal);
         const result = await this.invoke(targetAgentId, input);
         if (!result.success) {
+          if (isAborted2(input.signal)) throw abortReason2(input.signal);
           throw new Error(result.error?.message || "Agent invocation failed");
         }
         if (!result.data) {
@@ -35724,6 +35854,8 @@ var init_agents_api_service = __esm({
         };
       }
     };
+    __name(isAborted2, "isAborted");
+    __name(abortReason2, "abortReason");
     __name(toInvocationOutput, "toInvocationOutput");
     __name(runSummary, "runSummary");
     __name(supervisedCheck, "supervisedCheck");
@@ -38093,9 +38225,7 @@ __name(parseAgentVersionFlag, "parseAgentVersionFlag");
 
 // src/commands/configure.ts
 init_cli();
-
-// src/utils/auth-flows.ts
-import inquirer from "inquirer";
+init_cli_error();
 
 // src/services/auth.ts
 import "dotenv/config";
@@ -38193,6 +38323,44 @@ __name(verifyOTPAndGetToken, "verifyOTPAndGetToken");
 // src/utils/auth-flows.ts
 init_credential_operational_context();
 init_analytics();
+
+// src/utils/prompt-handler.ts
+init_cli();
+import inquirer from "inquirer";
+async function safePrompt(questions) {
+  if (isCiModeEnabled()) {
+    throw new Error("Interactive prompt required but --ci flag is set. Provide all required flags or arguments.");
+  }
+  if (!process.stdin.isTTY && !isCiModeEnabled()) {
+    console.warn("\u26A0\uFE0F  Warning: stdin is not a TTY. Interactive prompts may not work correctly.");
+    console.warn("\u{1F4A1} Tip: Use --ci flag in CI/CD environments to fail loudly on missing required flags.");
+  }
+  try {
+    await new Promise((resolve7) => setTimeout(resolve7, 10));
+    const answers = await inquirer.prompt(questions);
+    return answers;
+  } catch (error) {
+    if (error.name === "ExitPromptError" || error.message?.includes("SIGINT")) {
+      process.exit(0);
+    }
+    throw error;
+  }
+}
+__name(safePrompt, "safePrompt");
+async function confirmAction(message) {
+  const answer = await safePrompt([
+    {
+      type: "confirm",
+      name: "confirmed",
+      message,
+      default: false
+    }
+  ]);
+  return answer?.confirmed ?? false;
+}
+__name(confirmAction, "confirmAction");
+
+// src/utils/auth-flows.ts
 init_cli();
 init_firebase_session();
 init_request_credential();
@@ -38236,7 +38404,7 @@ async function completeEmailLogin(signInToken, email) {
 }
 __name(completeEmailLogin, "completeEmailLogin");
 async function handleApiKeyAuth() {
-  const { apiKey } = await inquirer.prompt([
+  const { apiKey } = await safePrompt([
     {
       type: "password",
       name: "apiKey",
@@ -38279,7 +38447,7 @@ async function handleEmailOtpVerify(email, otp) {
 }
 __name(handleEmailOtpVerify, "handleEmailOtpVerify");
 async function handleEmailAuth() {
-  const { email } = await inquirer.prompt([
+  const { email } = await safePrompt([
     {
       type: "input",
       name: "email",
@@ -38295,7 +38463,7 @@ async function handleEmailAuth() {
 __name(handleEmailAuth, "handleEmailAuth");
 async function verifyOTPWithRetry(email) {
   for (let attempt = 1; attempt <= OTP_CONFIG.MAX_ATTEMPTS; attempt += 1) {
-    const { pin } = await inquirer.prompt([
+    const { pin } = await safePrompt([
       {
         type: "input",
         name: "pin",
@@ -38315,7 +38483,7 @@ async function verifyOTPWithRetry(email) {
 }
 __name(verifyOTPWithRetry, "verifyOTPWithRetry");
 async function promptAuthMethod() {
-  const { authMethod } = await inquirer.prompt([
+  const { authMethod } = await safePrompt([
     {
       type: "list",
       name: "authMethod",
@@ -38356,6 +38524,9 @@ async function configureCommand(options = {}) {
         await handleEmailOtpRequest(email);
       }
     } else {
+      if (isCiModeEnabled()) {
+        throw CliError.usage("lua auth configure needs an interactive prompt and --ci is set.", "Pass --api-key <key>, or --email <email> [--otp <code>]");
+      }
       authMethod = await promptAuthMethod();
       clearPromptLines(2);
       if (authMethod === "api-key") {
@@ -38378,46 +38549,9 @@ init_credential_operational_context();
 init_command_utils();
 init_cli_error();
 init_cli();
-import inquirer4 from "inquirer";
 import { writeFileSync as writeFileSync7, existsSync as existsSync8 } from "fs";
 import { join as join8 } from "path";
 
-// src/utils/prompt-handler.ts
-init_cli();
-import inquirer2 from "inquirer";
-async function safePrompt(questions) {
-  if (isCiModeEnabled()) {
-    throw new Error("Interactive prompt required but --ci flag is set. Provide all required flags or arguments.");
-  }
-  if (!process.stdin.isTTY && !isCiModeEnabled()) {
-    console.warn("\u26A0\uFE0F  Warning: stdin is not a TTY. Interactive prompts may not work correctly.");
-    console.warn("\u{1F4A1} Tip: Use --ci flag in CI/CD environments to fail loudly on missing required flags.");
-  }
-  try {
-    await new Promise((resolve7) => setTimeout(resolve7, 10));
-    const answers = await inquirer2.prompt(questions);
-    return answers;
-  } catch (error) {
-    if (error.name === "ExitPromptError" || error.message?.includes("SIGINT")) {
-      process.exit(0);
-    }
-    throw error;
-  }
-}
-__name(safePrompt, "safePrompt");
-async function confirmAction(message) {
-  const answer = await safePrompt([
-    {
-      type: "confirm",
-      name: "confirmed",
-      message,
-      default: false
-    }
-  ]);
-  return answer?.confirmed ?? false;
-}
-__name(confirmAction, "confirmAction");
-
 // src/utils/governance-scaffold.ts
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync6 } from "fs";
 import { join as join6 } from "path";
@@ -38532,10 +38666,10 @@ ${src}`;
 __name(injectGovernanceIntoAgent, "injectGovernanceIntoAgent");
 
 // src/utils/init-prompts.ts
-import inquirer3 from "inquirer";
+import inquirer2 from "inquirer";
 import chalk from "chalk";
 async function promptAgentChoice() {
-  const { agentChoice } = await inquirer3.prompt([
+  const { agentChoice } = await safePrompt([
     {
       type: "list",
       name: "agentChoice",
@@ -38564,7 +38698,7 @@ async function promptOrganizationSelection(orgs) {
     name: org.registeredName || org.name || "Unknown Organization",
     value: org
   }));
-  const { selectedOrg } = await inquirer3.prompt([
+  const { selectedOrg } = await safePrompt([
     {
       type: "list",
       name: "selectedOrg",
@@ -38583,7 +38717,7 @@ async function promptAgentSelection(org) {
     name: agent.name,
     value: agent
   }));
-  const { selectedAgent } = await inquirer3.prompt([
+  const { selectedAgent } = await safePrompt([
     {
       type: "list",
       name: "selectedAgent",
@@ -38597,7 +38731,7 @@ __name(promptAgentSelection, "promptAgentSelection");
 async function promptMetadataCollection(requiredFields) {
   const metadata = {};
   for (const field of requiredFields) {
-    const { [field]: value3 } = await inquirer3.prompt([
+    const { [field]: value3 } = await safePrompt([
       {
         type: "input",
         name: field,
@@ -38611,7 +38745,7 @@ async function promptMetadataCollection(requiredFields) {
 }
 __name(promptMetadataCollection, "promptMetadataCollection");
 async function promptAgentName() {
-  const { agentName } = await inquirer3.prompt([
+  const { agentName } = await safePrompt([
     {
       type: "input",
       name: "agentName",
@@ -38638,7 +38772,7 @@ async function promptModelSelection(models) {
   ];
   for (const provider of providers) {
     const providerModels = models.filter((m) => m.provider === provider);
-    choices.push(new inquirer3.Separator(`  \u2500\u2500 ${provider} \u2500\u2500`));
+    choices.push(new inquirer2.Separator(`  \u2500\u2500 ${provider} \u2500\u2500`));
     for (const m of providerModels) {
       choices.push({
         name: `${chalk.bold(m.code)}  ${chalk.gray(m.description)}`,
@@ -38647,7 +38781,7 @@ async function promptModelSelection(models) {
       });
     }
   }
-  const { selectedModel } = await inquirer3.prompt([
+  const { selectedModel } = await safePrompt([
     {
       type: "list",
       name: "selectedModel",
@@ -38680,7 +38814,7 @@ __name(displayPersonaInstructions, "displayPersonaInstructions");
 async function promptDuplicateOptions(sourceOrg, allOrgs, sourceAgentName) {
   let targetOrg = sourceOrg;
   if (allOrgs.length > 1) {
-    const { sameOrg } = await inquirer3.prompt([
+    const { sameOrg } = await safePrompt([
       {
         type: "list",
         name: "sameOrg",
@@ -38704,7 +38838,7 @@ async function promptDuplicateOptions(sourceOrg, allOrgs, sourceAgentName) {
     }
   }
   const defaultName = `${sourceAgentName} (Copy)`;
-  const { newName } = await inquirer3.prompt([
+  const { newName } = await safePrompt([
     {
       type: "input",
       name: "newName",
@@ -38713,7 +38847,7 @@ async function promptDuplicateOptions(sourceOrg, allOrgs, sourceAgentName) {
       validate: /* @__PURE__ */ __name((input) => input.trim().length > 0 || "Name is required", "validate")
     }
   ]);
-  const { includedBuckets } = await inquirer3.prompt([
+  const { includedBuckets } = await safePrompt([
     {
       type: "checkbox",
       name: "includedBuckets",
@@ -38757,7 +38891,7 @@ async function promptDuplicateOptions(sourceOrg, allOrgs, sourceAgentName) {
   console.log(chalk.white(`  Including:     ${includedBuckets.length > 0 ? includedBuckets.join(", ") : "core agent definition only"}`));
   console.log(chalk.cyan("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501"));
   console.log("");
-  const { confirmed } = await inquirer3.prompt([
+  const { confirmed } = await safePrompt([
     {
       type: "confirm",
       name: "confirmed",
@@ -41032,7 +41166,7 @@ async function initCommand(options = {}) {
             writeError("\n\u26A0\uFE0F  You don't have access to the agent in this project");
             writeInfo(`   Agent ID: ${existingAgentId}
 `);
-            const { action } = await inquirer4.prompt([
+            const { action } = await safePrompt([
               {
                 type: "list",
                 name: "action",
@@ -41069,7 +41203,7 @@ async function initCommand(options = {}) {
             writeInfo("\n\u{1F4CB} Found existing project configuration");
             writeInfo(`   Current Agent ID: ${existingAgentId}
 `);
-            const { wantSwitch } = await inquirer4.prompt([
+            const { wantSwitch } = await safePrompt([
               {
                 type: "list",
                 name: "wantSwitch",
@@ -41356,7 +41490,7 @@ __name(createNewAgentNonInteractive, "createNewAgentNonInteractive");
 async function createNewAgentFlow(apiKey, organizations, promoCode) {
   const agentTypes = await fetchAgentTypes(apiKey);
   const selectedAgentType = selectBaseAgentType(agentTypes);
-  const { orgChoice } = await inquirer4.prompt([
+  const { orgChoice } = await safePrompt([
     {
       type: "list",
       name: "orgChoice",
@@ -41387,7 +41521,7 @@ async function createNewAgentFlow(apiKey, organizations, promoCode) {
     }
   }
   if (!orgId) {
-    const { organizationName } = await inquirer4.prompt([
+    const { organizationName } = await safePrompt([
       {
         type: "input",
         name: "organizationName",
@@ -41515,7 +41649,7 @@ async function promptPersonaReplacement(existingYaml, newPersona) {
   }
   writeInfo("\n\u{1F4DD} Persona Configuration:");
   writeInfo("   Existing persona found in project");
-  const { replacePersona } = await inquirer4.prompt([
+  const { replacePersona } = await safePrompt([
     {
       type: "confirm",
       name: "replacePersona",
@@ -41535,7 +41669,7 @@ async function checkAndRestoreBackup(apiKey, agentId, options) {
   }
   const conflicts = checkRestoreConflicts(manifest, targetDir);
   if (!options.autoRestore && conflicts.existingFiles.length > 0) {
-    const { confirm } = await inquirer4.prompt([
+    const { confirm } = await safePrompt([
       {
         type: "confirm",
         name: "confirm",
@@ -41584,7 +41718,7 @@ __name(checkAndRestoreBackup, "checkAndRestoreBackup");
 init_request_credential();
 init_cli();
 init_analytics();
-import inquirer5 from "inquirer";
+import inquirer3 from "inquirer";
 function report(result, requested) {
   const deleted = result.sessionCleared || result.apiKeyCleared;
   if (!deleted) {
@@ -41618,7 +41752,7 @@ async function destroyCommand(options) {
       });
       return;
     }
-    const { confirm } = await inquirer5.prompt([
+    const { confirm } = await inquirer3.prompt([
       {
         type: "confirm",
         name: "confirm",
@@ -41767,7 +41901,7 @@ async function sessionsRevokeCommand(sessionId) {
 __name(sessionsRevokeCommand, "sessionsRevokeCommand");
 
 // src/commands/apiKey.ts
-import inquirer6 from "inquirer";
+import inquirer4 from "inquirer";
 init_request_credential();
 init_cli();
 init_analytics();
@@ -41793,7 +41927,7 @@ async function apiKeyCommand(options) {
       });
       return;
     }
-    const { confirm } = await inquirer6.prompt([
+    const { confirm } = await inquirer4.prompt([
       {
         type: "confirm",
         name: "confirm",
@@ -48425,7 +48559,7 @@ async function compileCommand(options) {
 __name(compileCommand, "compileCommand");
 
 // src/commands/test.ts
-import inquirer7 from "inquirer";
+import inquirer5 from "inquirer";
 
 // src/commands/test-output.helpers.ts
 import { inspect } from "util";
@@ -51093,7 +51227,7 @@ async function promptToolSelection(tools) {
     name: tool.skillName ? `${tool.name} (${tool.skillName}) - ${tool.description}` : `${tool.name} - ${tool.description}`,
     value: tool
   }));
-  const { selectedTool } = await inquirer7.prompt([
+  const { selectedTool } = await inquirer5.prompt([
     {
       type: "list",
       name: "selectedTool",
@@ -52968,17 +53102,20 @@ function pushAllExitCode(variant) {
   return variant === "partial" || variant === "error" ? CLI_EXIT.ERROR : void 0;
 }
 __name(pushAllExitCode, "pushAllExitCode");
-function formatPushFailureSummary(failedItems) {
+function formatPushFailureSummary(failedItems, opts = {}) {
   if (failedItems.length === 0) return "";
+  const includeLogsHint = opts.includeLogsHint !== false;
   const lines = [];
   lines.push(`
 \u26A0\uFE0F  ${failedItems.length} component(s) failed to push:`);
   for (const item of failedItems) {
     lines.push(`   ${item.kind} "${item.name}": ${item.error}`);
-    lines.push(`   \u{1F4A1} Diagnose: ${buildLogsCommand({
-      primitiveType: item.kind,
-      name: item.name
-    })}`);
+    if (includeLogsHint) {
+      lines.push(`   \u{1F4A1} Diagnose: ${buildLogsCommand({
+        primitiveType: item.kind,
+        name: item.name
+      })}`);
+    }
   }
   return lines.join("\n");
 }
@@ -53996,7 +54133,9 @@ ${icon} Pushing ${items.length} ${handler.displayName}(s)...`);
     }
   }
   if (failedItems.length > 0) {
-    console.error(formatPushFailureSummary(failedItems));
+    console.error(formatPushFailureSummary(failedItems, {
+      includeLogsHint: false
+    }));
   }
   const agentPushResult = await agentHandler.pushAgentConfig(apiKey, agentId, manifest);
   if (agentPushResult.persona?.success) {
@@ -54217,7 +54356,6 @@ init_cli_error();
 // src/utils/deploy-helpers.ts
 init_cli();
 init_cli_error();
-import inquirer8 from "inquirer";
 function formatVersionChoice(version) {
   const currentIndicator = version.isCurrent ? " (CURRENT)" : "";
   const date = new Date(version.createdDate).toLocaleDateString();
@@ -54228,8 +54366,17 @@ function sortVersionsByDate(versions) {
   return versions.sort((a, b) => new Date(b.createdDate).getTime() - new Date(a.createdDate).getTime());
 }
 __name(sortVersionsByDate, "sortVersionsByDate");
+function assertDeployInputsForCi(options, ci = isCiModeEnabled()) {
+  if (!ci) return;
+  const hints = [];
+  if (!options.version) hints.push("Pass --set-version <version|latest>");
+  if (!options.force) hints.push("Pass --force: --ci never auto-confirms a deploy to all users");
+  if (hints.length === 0) return;
+  throw CliError.usage("lua deploy cannot prompt under --ci.", hints.join("\n"));
+}
+__name(assertDeployInputsForCi, "assertDeployInputsForCi");
 async function promptVersionSelection(versions) {
-  const { selectedVersion } = await inquirer8.prompt([
+  const { selectedVersion } = await safePrompt([
     {
       type: "list",
       name: "selectedVersion",
@@ -54245,7 +54392,7 @@ async function promptVersionSelection(versions) {
 }
 __name(promptVersionSelection, "promptVersionSelection");
 async function confirmDeployment() {
-  const { confirmed } = await inquirer8.prompt([
+  const { confirmed } = await safePrompt([
     {
       type: "confirm",
       name: "confirmed",
@@ -54452,6 +54599,7 @@ async function deployCommand(type, cmdObj) {
       }
       selectedType = answer.type;
     }
+    assertDeployInputsForCi(options);
     const apiKey = await requireAuthOrExit();
     let personaDeployed = false;
     let versionedOutcome = null;
@@ -54875,7 +55023,7 @@ __name(deployAllCommand, "deployAllCommand");
 // src/commands/chat.ts
 init_cli();
 import * as readline from "readline";
-import inquirer9 from "inquirer";
+import inquirer6 from "inquirer";
 
 // src/api/chat.api.service.ts
 init_http_client();
@@ -55976,7 +56124,7 @@ async function chatCommand(cmdObj) {
           selectedEnvironment = envResolution.environment;
           break;
         case "prompt": {
-          const { environment } = await inquirer9.prompt([
+          const { environment } = await inquirer6.prompt([
             {
               type: "list",
               name: "environment",
@@ -56555,7 +56703,7 @@ init_command_utils();
 init_developer_api_service();
 import fs19 from "fs";
 import path27 from "path";
-import inquirer10 from "inquirer";
+import inquirer7 from "inquirer";
 init_analytics();
 init_cli_error();
 function resolveEnvironment(env, hasNonInteractiveFlags) {
@@ -56652,7 +56800,7 @@ async function envCommand(env, cmdObj) {
         selectedEnvironment = envResolution.environment;
         break;
       case "prompt":
-        const { environment } = await inquirer10.prompt([
+        const { environment } = await inquirer7.prompt([
           {
             type: "list",
             name: "environment",
@@ -56842,7 +56990,7 @@ async function manageEnvironmentVariables(context) {
     const variables = await loadEnvironmentVariables(context);
     console.log("\n" + "=".repeat(60));
     displayVariables(variables, context, true);
-    const { action } = await inquirer10.prompt([
+    const { action } = await inquirer7.prompt([
       {
         type: "list",
         name: "action",
@@ -56937,7 +57085,7 @@ async function saveProductionEnvVariables(context, variables) {
 }
 __name(saveProductionEnvVariables, "saveProductionEnvVariables");
 async function addVariable(context, currentVariables) {
-  const answers = await inquirer10.prompt([
+  const answers = await inquirer7.prompt([
     {
       type: "input",
       name: "key",
@@ -56978,7 +57126,7 @@ async function updateVariable(context, currentVariables) {
     console.log("\n\u2139\uFE0F  No variables to update.\n");
     return;
   }
-  const { selectedKey } = await inquirer10.prompt([
+  const { selectedKey } = await inquirer7.prompt([
     {
       type: "list",
       name: "selectedKey",
@@ -56990,7 +57138,7 @@ async function updateVariable(context, currentVariables) {
     }
   ]);
   const currentVariable = currentVariables.find((v) => v.key === selectedKey);
-  const { newValue } = await inquirer10.prompt([
+  const { newValue } = await inquirer7.prompt([
     {
       type: "input",
       name: "newValue",
@@ -57019,7 +57167,7 @@ async function deleteVariable(context, currentVariables) {
     console.log("\n\u2139\uFE0F  No variables to delete.\n");
     return;
   }
-  const { selectedKey } = await inquirer10.prompt([
+  const { selectedKey } = await inquirer7.prompt([
     {
       type: "list",
       name: "selectedKey",
@@ -57030,7 +57178,7 @@ async function deleteVariable(context, currentVariables) {
       }))
     }
   ]);
-  const { confirm } = await inquirer10.prompt([
+  const { confirm } = await inquirer7.prompt([
     {
       type: "confirm",
       name: "confirm",
@@ -57063,7 +57211,7 @@ async function viewVariable(currentVariables) {
     console.log("\n\u2139\uFE0F  No variables to view.\n");
     return;
   }
-  const { selectedKey } = await inquirer10.prompt([
+  const { selectedKey } = await inquirer7.prompt([
     {
       type: "list",
       name: "selectedKey",
@@ -57080,7 +57228,7 @@ async function viewVariable(currentVariables) {
   console.log("=".repeat(60));
   console.log(variable.value);
   console.log("=".repeat(60) + "\n");
-  await inquirer10.prompt([
+  await inquirer7.prompt([
     {
       type: "input",
       name: "continue",
@@ -57094,7 +57242,6 @@ __name(viewVariable, "viewVariable");
 init_dist();
 init_cli();
 init_constants();
-import inquirer11 from "inquirer";
 init_command_utils();
 init_compiler2();
 init_artifact_loader();
@@ -57396,7 +57543,7 @@ async function viewPersonaInteractive(persona) {
     console.log("No persona configured.");
   }
   console.log("=".repeat(60) + "\n");
-  await inquirer11.prompt([
+  await safePrompt([
     {
       type: "input",
       name: "continue",
@@ -57520,7 +57667,7 @@ async function viewVersionDetailsInteractive(version) {
   console.log("=".repeat(60) + "\n");
   console.log(version.persona);
   console.log("\n" + "=".repeat(60) + "\n");
-  await inquirer11.prompt([
+  await safePrompt([
     {
       type: "input",
       name: "continue",
@@ -59077,7 +59224,7 @@ async function docsCommand() {
 __name(docsCommand, "docsCommand");
 
 // src/commands/channels.ts
-import inquirer12 from "inquirer";
+import inquirer8 from "inquirer";
 import open5 from "open";
 init_cli();
 init_command_utils();
@@ -59590,7 +59737,7 @@ async function executeNonInteractive3(agentApi, agentId, action) {
 }
 __name(executeNonInteractive3, "executeNonInteractive");
 async function channelsInteractive(agentApi, agentId, apiKey, config) {
-  const { operation } = await inquirer12.prompt([
+  const { operation } = await inquirer8.prompt([
     {
       type: "list",
       name: "operation",
@@ -59676,7 +59823,7 @@ async function listChannelsInteractive(agentApi, agentId, config) {
     name: "\u2190 Back to main menu",
     value: -1
   });
-  const { selectedIndex } = await inquirer12.prompt([
+  const { selectedIndex } = await inquirer8.prompt([
     {
       type: "list",
       name: "selectedIndex",
@@ -59853,7 +60000,7 @@ function displayEmailDetails(channel) {
 }
 __name(displayEmailDetails, "displayEmailDetails");
 async function createChannel(agentApi, agentId) {
-  const { channelType } = await inquirer12.prompt([
+  const { channelType } = await inquirer8.prompt([
     {
       type: "list",
       name: "channelType",
@@ -59907,7 +60054,7 @@ async function createChannel(agentApi, agentId) {
 __name(createChannel, "createChannel");
 async function createWhatsAppChannel(agentApi, agentId) {
   writeInfo("\u{1F4F1} Creating WhatsApp Channel\n");
-  const answers = await inquirer12.prompt([
+  const answers = await inquirer8.prompt([
     {
       type: "input",
       name: "phoneNumberId",
@@ -59959,7 +60106,7 @@ async function createWhatsAppChannel(agentApi, agentId) {
 __name(createWhatsAppChannel, "createWhatsAppChannel");
 async function createFacebookChannel(agentApi, agentId) {
   writeInfo("\u{1F4AC} Creating Facebook Messenger Channel\n");
-  const answers = await inquirer12.prompt([
+  const answers = await inquirer8.prompt([
     {
       type: "password",
       name: "accessToken",
@@ -60001,7 +60148,7 @@ async function createFacebookChannel(agentApi, agentId) {
 __name(createFacebookChannel, "createFacebookChannel");
 async function createEmailChannel(agentApi, agentId) {
   writeInfo("\u{1F4E7} Creating Email Channel\n");
-  const { mode } = await inquirer12.prompt([
+  const { mode } = await inquirer8.prompt([
     {
       type: "list",
       name: "mode",
@@ -60019,7 +60166,7 @@ async function createEmailChannel(agentApi, agentId) {
     }
   ]);
   clearPromptLines(2);
-  const { displayName } = await inquirer12.prompt([
+  const { displayName } = await inquirer8.prompt([
     {
       type: "input",
       name: "displayName",
@@ -60037,7 +60184,7 @@ async function createEmailChannel(agentApi, agentId) {
     }
   };
   if (mode === "existing") {
-    const { email } = await inquirer12.prompt([
+    const { email } = await inquirer8.prompt([
       {
         type: "input",
         name: "email",
@@ -60133,7 +60280,7 @@ var SLACK_AGENT_PROMPTS_MAX = 4;
 var SLACK_AGENT_PROMPT_TITLE_MAX = 75;
 var SLACK_AGENT_PROMPT_MESSAGE_MAX = 2e3;
 async function promptSlackAgentMode(current) {
-  const { enabled } = await inquirer12.prompt([
+  const { enabled } = await inquirer8.prompt([
     {
       type: "confirm",
       name: "enabled",
@@ -60142,7 +60289,7 @@ async function promptSlackAgentMode(current) {
     }
   ]);
   if (!enabled) return null;
-  const { description } = await inquirer12.prompt([
+  const { description } = await inquirer8.prompt([
     {
       type: "input",
       name: "description",
@@ -60159,7 +60306,7 @@ async function promptSlackAgentMode(current) {
   }
   const prompts = [];
   while (prompts.length < SLACK_AGENT_PROMPTS_MAX) {
-    const { title } = await inquirer12.prompt([
+    const { title } = await inquirer8.prompt([
       {
         type: "input",
         name: "title",
@@ -60168,7 +60315,7 @@ async function promptSlackAgentMode(current) {
       }
     ]);
     if (!title.trim()) break;
-    const { message } = await inquirer12.prompt([
+    const { message } = await inquirer8.prompt([
       {
         type: "input",
         name: "message",
@@ -60191,7 +60338,7 @@ async function promptSlackAgentMode(current) {
 }
 __name(promptSlackAgentMode, "promptSlackAgentMode");
 async function offerToOpen(url, question) {
-  const { openIt } = await inquirer12.prompt([
+  const { openIt } = await inquirer8.prompt([
     {
       type: "confirm",
       name: "openIt",
@@ -60203,7 +60350,7 @@ async function offerToOpen(url, question) {
 }
 __name(offerToOpen, "offerToOpen");
 async function startSlackApp(agentApi, agentId, kind) {
-  const { source } = await inquirer12.prompt([
+  const { source } = await inquirer8.prompt([
     {
       type: "list",
       name: "source",
@@ -60263,7 +60410,7 @@ __name(printManifestUpdate, "printManifestUpdate");
 async function createSlackPrivateChannel(agentApi, agentId) {
   writeInfo("\u{1F512} Creating Private Slack Channel\n");
   const { existingApp, agentMode } = await startSlackApp(agentApi, agentId, "private");
-  const answers = await inquirer12.prompt([
+  const answers = await inquirer8.prompt([
     {
       type: "password",
       name: "accessToken",
@@ -60308,7 +60455,7 @@ __name(createSlackPrivateChannel, "createSlackPrivateChannel");
 async function createSlackPublicChannel(agentApi, agentId) {
   writeInfo("\u{1F310} Creating Public Slack Channel\n");
   const { existingApp, agentMode } = await startSlackApp(agentApi, agentId, "public");
-  const answers = await inquirer12.prompt([
+  const answers = await inquirer8.prompt([
     {
       type: "input",
       name: "appId",
@@ -60392,7 +60539,7 @@ async function slackConnectionActions(agentApi, agentId, channel) {
     name: "\u2190 Back",
     value: "back"
   });
-  const { action } = await inquirer12.prompt([
+  const { action } = await inquirer8.prompt([
     {
       type: "list",
       name: "action",
@@ -60424,7 +60571,7 @@ async function slackConnectionActions(agentApi, agentId, channel) {
     writeSuccess(`\u2705 Agent mode ${agentMode ? "saved" : "turned off"}. It takes effect once Slack has the new manifest:`);
     printManifestUpdate(response.data.manifestUrl ?? slackManifestEditorUrl(channel.data.appId, channel.data.teamId), response.data.manifest);
   } else if (action === "secret") {
-    const { signingSecret } = await inquirer12.prompt([
+    const { signingSecret } = await inquirer8.prompt([
       slackSigningSecretPrompt()
     ]);
     const response = await agentApi.saveSlackSigningSecret(agentId, channel.identifier, signingSecret.trim());
@@ -60461,7 +60608,7 @@ __name(slackConnectionActions, "slackConnectionActions");
 // src/commands/logs.ts
 init_cli();
 init_command_utils();
-import inquirer13 from "inquirer";
+import inquirer9 from "inquirer";
 import chalk2 from "chalk";
 init_device_api_service();
 init_constants();
@@ -60961,7 +61108,7 @@ async function nonInteractiveLogs(logsApi, agentId, apiKey, options) {
 }
 __name(nonInteractiveLogs, "nonInteractiveLogs");
 async function interactiveLogs(logsApi, agentId, apiKey) {
-  const { viewType } = await inquirer13.prompt([
+  const { viewType } = await inquirer9.prompt([
     {
       type: "list",
       name: "viewType",
@@ -60989,7 +61136,7 @@ __name(interactiveLogs, "interactiveLogs");
 async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
   let keepFiltering = true;
   while (keepFiltering) {
-    const { filterType } = await inquirer13.prompt([
+    const { filterType } = await inquirer9.prompt([
       {
         type: "list",
         name: "filterType",
@@ -60999,7 +61146,7 @@ async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
             name: "\u{1F4CB} All logs",
             value: "all"
           },
-          new inquirer13.Separator(),
+          new inquirer9.Separator(),
           {
             name: "Skills",
             value: "skill"
@@ -61024,7 +61171,7 @@ async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
             name: "Devices",
             value: "device"
           },
-          new inquirer13.Separator(),
+          new inquirer9.Separator(),
           {
             name: "\u{1F4AC} User Messages",
             value: "user_message"
@@ -61057,12 +61204,12 @@ async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
             name: "\u{1F4DE} Voice Calls",
             value: "calls"
           },
-          new inquirer13.Separator(),
+          new inquirer9.Separator(),
           {
             name: "\u2190 Back",
             value: "back"
           },
-          new inquirer13.Separator()
+          new inquirer9.Separator()
         ]
       }
     ]);
@@ -61095,7 +61242,7 @@ async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
 `);
       continue;
     }
-    const { selectedId } = await inquirer13.prompt([
+    const { selectedId } = await inquirer9.prompt([
       {
         type: "list",
         name: "selectedId",
@@ -61105,17 +61252,17 @@ async function filterAndShowLogsInteractive(logsApi, agentId, apiKey) {
             name: `All ${capitalizedType}s`,
             value: "all"
           },
-          new inquirer13.Separator(),
+          new inquirer9.Separator(),
           ...items.map((item) => ({
             name: item.name,
             value: item.id
           })),
-          new inquirer13.Separator(),
+          new inquirer9.Separator(),
           {
             name: "\u2190 Back",
             value: "back"
           },
-          new inquirer13.Separator()
+          new inquirer9.Separator()
         ]
       }
     ]);
@@ -61144,7 +61291,7 @@ async function viewAgentLogsInteractive(logsApi, agentId, filters = {}) {
     }
     const data = response.data;
     displayLogsCore(data.logs, data.pagination, "All Agent Logs", true);
-    const { action } = await inquirer13.prompt([
+    const { action } = await inquirer9.prompt([
       {
         type: "list",
         name: "action",
@@ -61199,7 +61346,7 @@ async function handleNavigation(action, pagination, setPage) {
       if (pagination.hasNextPage) setPage(pagination.nextPage);
       return true;
     case "goto":
-      const { page } = await inquirer13.prompt({
+      const { page } = await inquirer9.prompt({
         type: "number",
         name: "page",
         message: `Enter page number (1-${pagination.totalPages}):`,
@@ -68829,6 +68976,21 @@ function priorAttemptTail(a) {
   return `${parts.length ? ` \u2014 ${parts.join(" \xB7 ")}` : ""}${e?.providerMessage ? ` \u2014 ${e.providerMessage}` : ""}`;
 }
 __name(priorAttemptTail, "priorAttemptTail");
+function budgetTokensParts(b) {
+  const n2 = /* @__PURE__ */ __name((v) => v.toLocaleString("en-US"), "n");
+  const split = [
+    typeof b.uncachedInputTokens === "number" ? `${n2(b.uncachedInputTokens)} uncached` : void 0,
+    typeof b.cachedInputTokens === "number" ? `${n2(b.cachedInputTokens)} cached` : void 0
+  ].filter((p) => !!p);
+  const input = `${n2(b.inputTokens)}${b.maxInputTokens !== void 0 ? ` of ${n2(b.maxInputTokens)}` : ""} input tokens${split.length ? ` (${split.join(" / ")})` : ""}`;
+  return typeof b.outputTokens === "number" ? [
+    input,
+    `${n2(b.outputTokens)} output tokens`
+  ] : [
+    input
+  ];
+}
+__name(budgetTokensParts, "budgetTokensParts");
 function stepFailureLine(e) {
   if (!e || !e.reason && e.providerStatus === void 0 && !e.providerMessage) return void 0;
   const b = e.budget;
@@ -68837,7 +68999,7 @@ function stepFailureLine(e) {
     e.providerStatus !== void 0 ? `HTTP ${e.providerStatus}` : void 0,
     e.model ? `model ${e.model}` : void 0,
     e.turnIndex !== void 0 ? `message ${e.turnIndex}${e.assistantTurns !== void 0 ? ` (${e.assistantTurns} replies)` : ""}${b?.maxMessages !== void 0 ? ` of ${b.maxMessages}` : ""}` : void 0,
-    b ? `${b.inputTokens.toLocaleString("en-US")}${b.maxInputTokens !== void 0 ? ` of ${b.maxInputTokens.toLocaleString("en-US")}` : ""} input tokens` : void 0,
+    ...b ? budgetTokensParts(b) : [],
     e.providerRetries ? `${e.providerRetries} provider ${e.providerRetries === 1 ? "retry" : "retries"}` : void 0
   ].filter((p) => !!p);
   return `${parts.join(" \xB7 ")}${e.providerMessage ? `${parts.length ? " \u2014 " : ""}${e.providerMessage}` : ""}`;
@@ -68850,7 +69012,7 @@ function attemptCountersLine(c) {
   const replies = c.assistantTurns ?? b?.assistantTurns;
   const parts = [
     messages !== void 0 ? `message ${messages}${replies !== void 0 ? ` (${replies} replies)` : ""}${b?.maxMessages !== void 0 ? ` of ${b.maxMessages}` : ""}` : void 0,
-    b ? `${b.inputTokens.toLocaleString("en-US")}${b.maxInputTokens !== void 0 ? ` of ${b.maxInputTokens.toLocaleString("en-US")}` : ""} input tokens` : void 0,
+    ...b ? budgetTokensParts(b) : [],
     c.repairRounds ? `${c.repairRounds} repair ${c.repairRounds === 1 ? "round" : "rounds"}` : void 0,
     c.providerRetries ? `${c.providerRetries} provider ${c.providerRetries === 1 ? "retry" : "retries"}` : void 0
   ].filter((p) => !!p);
@@ -71793,12 +71955,13 @@ async function recomposeCore(ctx, name, _o) {
     return WORKFLOW_EXIT.OK;
   }
   const saved = d.composed?.saved;
-  const version = saved?.version ?? saved?.versionId ?? "(new)";
+  const savedVersion = saved?.version ?? saved?.versionId;
+  const version = savedVersion ?? "(new)";
   writeSuccess(`\u2705 ${wf.name} recomposed \u2192 version ${version} \xB7 ${rewrittenCount} agent step${rewrittenCount === 1 ? "" : "s"} rewritten`);
   if (saved?.supersededBy) {
     writeInfo(`\u2139\uFE0F  a concurrent recompose already holds the pin at version ${saved.supersededBy} \u2014 that is what runs.`);
   }
-  for (const line of recomposeNextSteps(wf, version)) console.log(line);
+  for (const line of recomposeNextSteps(wf, savedVersion)) console.log(line);
   return WORKFLOW_EXIT.OK;
 }
 __name(recomposeCore, "recomposeCore");
@@ -73606,7 +73769,7 @@ init_skills_api_service();
 init_developer_api_service();
 init_semver();
 init_analytics();
-import inquirer14 from "inquirer";
+import inquirer10 from "inquirer";
 
 // src/commands/template.ts
 init_cli();
@@ -73734,6 +73897,54 @@ init_command_utils();
 init_analytics();
 init_files();
 init_cli_error();
+
+// src/commands/template-install-flags.ts
+init_cli_error();
+var PERSONA_HINT = "Use --persona-vars NAME=value[,NAME=value...] (repeatable)";
+var ACCEPT_HINT = "e.g. skills/refund-skill (the primitives named in the 409 MODIFIED_SINCE_INSTALL response)";
+function parsePersonaVars(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  const result = {};
+  for (const entry of raw) {
+    for (const pair of entry.split(/,(?=\s*[A-Za-z_][A-Za-z0-9_]*\s*=)/)) {
+      const trimmed2 = pair.trim();
+      if (!trimmed2) continue;
+      const eqIdx = trimmed2.indexOf("=");
+      if (eqIdx === -1) {
+        throw CliError.usage(`Invalid --persona-vars entry "${trimmed2}": expected KEY=value`, PERSONA_HINT);
+      }
+      const key = trimmed2.slice(0, eqIdx).trim();
+      if (!key) {
+        throw CliError.usage(`Invalid --persona-vars entry "${trimmed2}": the variable name is empty`, PERSONA_HINT);
+      }
+      if (Object.prototype.hasOwnProperty.call(result, key)) {
+        throw CliError.usage(`Duplicate --persona-vars key "${key}"`, PERSONA_HINT);
+      }
+      result[key] = trimmed2.slice(eqIdx + 1).trim();
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+__name(parsePersonaVars, "parsePersonaVars");
+function parseAcceptModified(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  const result = [];
+  for (const entry of raw) {
+    for (const part of entry.split(",")) {
+      const trimmed2 = part.trim();
+      if (!trimmed2) continue;
+      const slash = trimmed2.indexOf("/");
+      if (slash <= 0 || slash === trimmed2.length - 1) {
+        throw CliError.usage(`Invalid --accept-modified entry "${trimmed2}": expected kind/key`, ACCEPT_HINT);
+      }
+      if (!result.includes(trimmed2)) result.push(trimmed2);
+    }
+  }
+  return result.length > 0 ? result : void 0;
+}
+__name(parseAcceptModified, "parseAcceptModified");
+
+// src/commands/template.ts
 function showTemplateUsage() {
   console.log("\nUsage:");
   console.log("  lua marketplace template                       Interactive mode");
@@ -73744,7 +73955,7 @@ function showTemplateUsage() {
   console.log("  publish    --template-id <id> [--source-version <n>] [--changelog <text>] [--env-contract KEY=desc,...] [--skip-auto-apply]");
   console.log("  view       --template-id <id> [--version <n>] [--json]");
   console.log("  versions   --template-id <id> [--json]");
-  console.log("  install    --template-id <id> [--version <n>] [--env-vars k=v,...] --force");
+  console.log("  install    --template-id <id> [--version <n>] [--env-vars k=v,...] [--persona-vars K=v,...] [--accept-modified kind/key,...] --force");
   console.log("  apply      --template-id <id> [--version <n>] (--agents a,b | --file <path> | --all-installed) --force [--no-wait]");
   console.log("  status     --template-id <id> [--json]");
   console.log("  health     --template-id <id> [--window-days <n>] [--json]   Fleet workflow health per install (R46)");
@@ -74360,6 +74571,8 @@ async function templateInstallAction(templateApi, config, options) {
   const templateId = await resolveTemplateId(templateApi, options, "Which template would you like to install?", false);
   const version = options.version ? Number.parseInt(options.version, 10) : void 0;
   const envValues = options.envVars ? parseKeyValuePairs(options.envVars) : void 0;
+  const personaVars = parsePersonaVars(options.personaVars);
+  const acceptModifiedPrimitives = parseAcceptModified(options.acceptModified);
   if (!options.force) {
     writeInfo("\n\u{1F4CB} Install Summary:");
     writeInfo(`  Template: ${templateId}`);
@@ -74368,6 +74581,12 @@ async function templateInstallAction(templateApi, config, options) {
     if (envValues && Object.keys(envValues).length > 0) {
       writeInfo(`  Env values: ${Object.keys(envValues).length} configured`);
     }
+    if (personaVars) {
+      writeInfo(`  Persona vars: ${Object.keys(personaVars).length} configured`);
+    }
+    if (acceptModifiedPrimitives) {
+      writeInfo(`  Accepting modified: ${acceptModifiedPrimitives.join(", ")}`);
+    }
     throw CliError.usage("This action requires --force to confirm", "Use --force to confirm installation");
   }
   if (options.skipEnvCheck) {
@@ -74377,7 +74596,9 @@ async function templateInstallAction(templateApi, config, options) {
   const install = await templateApi.install(templateId, agentId, {
     version,
     envValues,
-    allowCreatorUpdates: options.allowCreatorUpdates
+    allowCreatorUpdates: options.allowCreatorUpdates,
+    personaVars,
+    acceptModifiedPrimitives
   });
   if (options.json) {
     console.log(JSON.stringify(install, null, 2));
@@ -75059,12 +75280,12 @@ __name(transferOwnershipNonInteractive, "transferOwnershipNonInteractive");
 async function viewListedSkillsNonInteractive(marketplaceApi, options, mode) {
   writeProgress(mode === "authored" ? "\u{1F504} Loading skills you authored..." : "\u{1F504} Loading this organization's skills...");
   const skills = mode === "authored" ? await marketplaceApi.getCreatorSkills() : await marketplaceApi.getOrgSkills();
-  if (!skills || skills.length === 0) {
-    writeInfo(mode === "authored" ? "\u{1F4E6} You haven't authored any marketplace skills yet." : "\u{1F4E6} This organization doesn't own any marketplace skills yet.");
+  if (options.json) {
+    console.log(JSON.stringify(skills ?? [], null, 2));
     return;
   }
-  if (options.json) {
-    console.log(JSON.stringify(skills, null, 2));
+  if (!skills || skills.length === 0) {
+    writeInfo(mode === "authored" ? "\u{1F4E6} You haven't authored any marketplace skills yet." : "\u{1F4E6} This organization doesn't own any marketplace skills yet.");
     return;
   }
   console.log(mode === "authored" ? `
@@ -75293,12 +75514,12 @@ async function listInstalledSkillsNonInteractive(marketplaceApi, config, options
   }
   writeProgress("\u{1F504} Loading installed marketplace skills...");
   const skills = await marketplaceApi.getInstalledSkills(agentId);
-  if (!skills || skills.length === 0) {
-    writeInfo("\u{1F4E6} No marketplace skills installed on this agent.");
+  if (options.json) {
+    console.log(JSON.stringify(skills ?? [], null, 2));
     return;
   }
-  if (options.json) {
-    console.log(JSON.stringify(skills, null, 2));
+  if (!skills || skills.length === 0) {
+    writeInfo("\u{1F4E6} No marketplace skills installed on this agent.");
     return;
   }
   console.log(`
@@ -75901,7 +76122,7 @@ async function handleEnvVarConfiguration(initialEnvVars) {
             name: "Delete a variable",
             value: "delete"
           },
-          new inquirer14.Separator(),
+          new inquirer10.Separator(),
           {
             name: "Finish and continue",
             value: "done"
@@ -75938,7 +76159,7 @@ async function handleEnvVarAction(action, envVars, detectedKeys) {
         name: `From .env file: ${key}`,
         value: key
       })),
-      new inquirer14.Separator(),
+      new inquirer10.Separator(),
       {
         name: "Manually enter a variable name",
         value: "manual"
@@ -75983,7 +76204,7 @@ async function handleEnvVarAction(action, envVars, detectedKeys) {
         message: "Which variable do you want to edit?",
         choices: [
           ...keys,
-          new inquirer14.Separator(),
+          new inquirer10.Separator(),
           {
             name: "Back",
             value: "back"
@@ -76005,7 +76226,7 @@ async function handleEnvVarAction(action, envVars, detectedKeys) {
         message: "Which variable do you want to delete?",
         choices: [
           ...keys,
-          new inquirer14.Separator(),
+          new inquirer10.Separator(),
           {
             name: "Back",
             value: "back"
@@ -76108,7 +76329,7 @@ async function browseAndSelectSkill(marketplaceApi, purpose, publishedVersionsOn
         }))
       ];
       if (hasNextPage || hasPrevPage) {
-        choices.push(new inquirer14.Separator());
+        choices.push(new inquirer10.Separator());
         if (hasPrevPage) {
           choices.push({
             name: `\u2190 Previous page (${currentPage - 1}/${totalPages})`,
@@ -76126,7 +76347,7 @@ async function browseAndSelectSkill(marketplaceApi, purpose, publishedVersionsOn
           });
         }
       }
-      choices.push(new inquirer14.Separator());
+      choices.push(new inquirer10.Separator());
       choices.push({
         name: "\u2190 Back to menu",
         value: {
@@ -77476,6 +77697,11 @@ var CALLBACK_PORT = 19837;
 var CALLBACK_HOST = "127.0.0.1";
 var CALLBACK_URL = `http://${CALLBACK_HOST}:${CALLBACK_PORT}/callback`;
 var AGENT_WEBHOOK_URL = `${BASE_URLS.API}/webhook/unifiedto/data`;
+var DEFAULT_HIDE_SENSITIVE = false;
+function coerceHideSensitive(raw) {
+  return raw === "true";
+}
+__name(coerceHideSensitive, "coerceHideSensitive");
 var DEFAULT_VIRTUAL_WEBHOOK_INTERVAL = 1;
 var VIRTUAL_WEBHOOK_INTERVAL_CHOICES = [
   {
@@ -77702,7 +77928,7 @@ async function executeNonInteractive12(context, action, cmdOptions) {
     connectionId: cmdOptions?.connectionId,
     authMethod: cmdOptions?.authMethod,
     scopes: cmdOptions?.scopes,
-    hideSensitive: cmdOptions?.hideSensitive === "true",
+    hideSensitive: coerceHideSensitive(cmdOptions?.hideSensitive),
     hideSensitiveProvided: cmdOptions?.hideSensitive !== void 0,
     accountLabel: cmdOptions?.accountLabel,
     scope: cmdOptions?.scope,
@@ -78308,7 +78534,7 @@ async function connectIntegrationFlow(context, options = {}) {
     });
     console.log("\nYou will enter these on the Unified.to authorization page.\n");
   }
-  let hideSensitive = false;
+  let hideSensitive = DEFAULT_HIDE_SENSITIVE;
   if (userScope) {
   } else if (options.hideSensitive !== void 0) {
     hideSensitive = options.hideSensitive;
@@ -78318,7 +78544,7 @@ async function connectIntegrationFlow(context, options = {}) {
         type: "confirm",
         name: "hide",
         message: "Hide sensitive data (PII) from MCP tools?",
-        default: false
+        default: DEFAULT_HIDE_SENSITIVE
       }
     ]);
     if (sensitiveAnswer) {
@@ -78533,7 +78759,7 @@ Integration: ${selectedIntegration.name}`);
   }
 }
 __name(connectIntegrationFlow, "connectIntegrationFlow");
-async function finalizeConnection(context, integration, connectionId, scopes, hideSensitive = false, webhookConfig = {
+async function finalizeConnection(context, integration, connectionId, scopes, hideSensitive = DEFAULT_HIDE_SENSITIVE, webhookConfig = {
   triggers: [],
   webhookUrl: "",
   isCustomWebhook: false
@@ -79117,7 +79343,7 @@ async function updateConnectionFlow(context, options = {}) {
     console.log(`
 \u2713 Will request ${selectedScopes.length} scope(s)`);
   }
-  let hideSensitive = false;
+  let hideSensitive = DEFAULT_HIDE_SENSITIVE;
   if (options.hideSensitive !== void 0) {
     hideSensitive = options.hideSensitive;
   } else {
@@ -79126,7 +79352,7 @@ async function updateConnectionFlow(context, options = {}) {
         type: "confirm",
         name: "hide",
         message: "Hide sensitive data (PII) from MCP tools?",
-        default: false
+        default: DEFAULT_HIDE_SENSITIVE
       }
     ]);
     if (sensitiveAnswer) {
@@ -82109,7 +82335,7 @@ init_command_utils();
 init_files();
 init_cli();
 init_constants();
-import inquirer15 from "inquirer";
+import inquirer11 from "inquirer";
 init_lua_fetch();
 init_request_credential();
 async function sourceListCommand(opts) {
@@ -82155,7 +82381,7 @@ async function sourceRollbackCommand(opts) {
   const dlBlobs = opts.downloadBlobs ?? downloadBlobsParallel;
   const restore = opts.restoreFiles ?? defaultRestore;
   if (!opts.force) {
-    const { confirm } = await inquirer15.prompt([
+    const { confirm } = await inquirer11.prompt([
       {
         type: "confirm",
         name: "confirm",
@@ -82348,8 +82574,18 @@ function parseVersion2(arg) {
 __name(parseVersion2, "parseVersion");
 
 // src/commands/version.ts
+function parsePersonaVersionOption(raw) {
+  if (raw === void 0) return void 0;
+  const text = String(raw).trim().replace(/^v/i, "");
+  if (!/^\d+$/.test(text)) {
+    throw new Error(`--persona-version must be a persona version number (got "${raw}").`);
+  }
+  return Number(text);
+}
+__name(parsePersonaVersionOption, "parsePersonaVersionOption");
 async function versionCreateCommand(options = {}) {
   return withErrorHandling(async () => {
+    const personaVersion = parsePersonaVersionOption(options.personaVersion);
     const { apiKey, agentId } = await initializeCommand();
     let config = readYamlConfig();
     let backupVersion = config?.backup?.activeVersion;
@@ -82385,7 +82621,10 @@ async function versionCreateCommand(options = {}) {
     const result = await api.createVersion({
       message,
       sourceManifestVersion: backupVersion,
-      commitHash: options.commitHash
+      commitHash: options.commitHash,
+      ...personaVersion !== void 0 ? {
+        personaVersion
+      } : {}
     });
     if (!result.success || !result.data) {
       const errCode = result.error?.code;
@@ -82395,6 +82634,9 @@ async function versionCreateCommand(options = {}) {
       }
       throw new Error(result.error?.message ?? "Failed to create version");
     }
+    if (personaVersion !== void 0 && result.data.snapshot?.persona?.version !== personaVersion) {
+      throw new Error(`v${result.data.version} was created but pins persona version ${String(result.data.snapshot?.persona?.version ?? "none")}, not ${personaVersion}: this server does not support --persona-version. Do not promote v${result.data.version}; delete it with \`lua version delete ${result.data.version}\`.`);
+    }
     writeInfo(`\u2713 Created v${result.data.version} (staged). Run \`lua version promote v${result.data.version}\` to deploy.`);
     try {
       const gitResult = await tryGitCommit({
@@ -83648,7 +83890,13 @@ function setupMarketplaceCommands(program2) {
   program2.command("marketplace [noun] [action]").description("\u{1F6CD}\uFE0F  Browse, install, and manage marketplace skills and agent templates").option("--skill-name <name>", "Skill name (for skill list/update/uninstall)").option("--marketplace-id <id>", "Marketplace skill ID").option("--new-org-id <id>", "Destination organization ID (for skill transfer)").option("--version-id <id>", "Version ID (for skill publish/install)").option("--env-vars-json <json>", "JSON string with env var metadata (for skill publish)").option("--query <text>", "Search query (for skill search)").option("--page <n>", "Page number (for skill search)").option("--limit <n>", "Results per page (for skill search)").option("--name <name>", "Template name, an internal identifier (for template create)").option("--description <text>", "Description (for template create)").option("--template-id <id>", "Template ID").option("--window-days <n>", "Fleet-health window in days (template health, R46)").option("--source-version <n>", "Agent version to freeze into this template version (default: active) (for template publish)").option("--env-contract <pair>", "KEY=description env contract entry, repeatable; use KEY?=description for optional (for template publish)", (val, previous) => [
     ...previous,
     val
-  ], []).option("--skip-auto-apply", "Publish without auto-updating the installs that consented to creator updates (for template publish)").option("--version <n>", "Template version (for template view/install/apply)").option("--allow-creator-updates", "Allow the template creator to push future updates onto this install").option("--skip-env-check", "Deprecated no-op: the env-contract check is server-enforced; use `lua env` to satisfy the contract (for template install/apply)").option("--agents <ids>", "Comma-separated target agent IDs (for template apply)").option("--file <path>", "Path to a file with one target agent ID per line (for template apply)").option("--all-installed", "Target every agent that already has this template installed (for template apply)").option("--no-wait", "Print the apply runId immediately instead of polling for completion (for template apply)").option("--display-name <name>", "Display name (for skill list/edit, template create)").option("--visibility <visibility>", "Who can see and install it: public or private (for skill list, template create)").option("--changelog <text>", "Changelog for this version (for skill/template publish)").option("--env-vars <pairs>", "Comma-separated key=value pairs (for skill/template install/update)").option("--json", "Output as JSON").option("--force", "Skip confirmation prompts").option("--yes", "Auto-confirm ONLY the template-publish consequence prompt (section clear/narrow); unlike --force it skips no other confirmation").addHelpText("after", `
+  ], []).option("--skip-auto-apply", "Publish without auto-updating the installs that consented to creator updates (for template publish)").option("--version <n>", "Template version (for template view/install/apply)").option("--allow-creator-updates", "Allow the template creator to push future updates onto this install").option("--persona-vars <pairs>", "Comma-separated KEY=value answers for the template's persona {{vars}}; repeatable, put a value containing ',KEY=' in its own occurrence (for template install)", (val, previous) => [
+    ...previous ?? [],
+    val
+  ]).option("--accept-modified <entries>", "Comma-separated kind/key primitives you allow the install to overwrite after a 409 MODIFIED_SINCE_INSTALL; repeatable (for template install)", (val, previous) => [
+    ...previous ?? [],
+    val
+  ]).option("--skip-env-check", "Deprecated no-op: the env-contract check is server-enforced; use `lua env` to satisfy the contract (for template install/apply)").option("--agents <ids>", "Comma-separated target agent IDs (for template apply)").option("--file <path>", "Path to a file with one target agent ID per line (for template apply)").option("--all-installed", "Target every agent that already has this template installed (for template apply)").option("--no-wait", "Print the apply runId immediately instead of polling for completion (for template apply)").option("--display-name <name>", "Display name (for skill list/edit, template create)").option("--visibility <visibility>", "Who can see and install it: public or private (for skill list, template create)").option("--changelog <text>", "Changelog for this version (for skill/template publish)").option("--env-vars <pairs>", "Comma-separated key=value pairs (for skill/template install/update)").option("--json", "Output as JSON").option("--force", "Skip confirmation prompts").option("--yes", "Auto-confirm ONLY the template-publish consequence prompt (section clear/narrow); unlike --force it skips no other confirmation").addHelpText("after", `
 Arguments:
   noun                   Optional: 'skill' or 'template' (prompts if not provided)
   action                 Optional: specific action for non-interactive mode
@@ -83674,7 +83922,7 @@ Template Actions:
   publish    --template-id <id> [--source-version <n>] [--changelog <text>] [--env-contract KEY=desc,...]
   view       --template-id <id> [--version <n>] [--json]
   versions   --template-id <id> [--json]
-  install    --template-id <id> [--version <n>] [--env-vars <k=v,...>] --force
+  install    --template-id <id> [--version <n>] [--env-vars <k=v,...>] [--persona-vars <K=v,...>] [--accept-modified <kind/key,...>] --force
   apply      --template-id <id> [--version <n>] (--agents <a,b,c> | --file <path> | --all-installed) --force [--no-wait]
   status     --template-id <id> [--json]
   installed  [--json]
@@ -83696,6 +83944,7 @@ Examples:
   $ lua marketplace template                                            Template action menu
   $ lua marketplace template create --name support-bot --display-name "Support Bot"
   $ lua marketplace template publish --template-id xyz --changelog "Add refund skill"
+  $ lua marketplace template install --template-id xyz --persona-vars COMPANY_NAME=Acme,TONE=warm --force
   $ lua marketplace template apply --template-id xyz --all-installed --force
 `).action(marketplaceCommand);
 }
@@ -84270,7 +84519,7 @@ Examples:
   $ lua mcp deactivate --server-name api-server Deactivate a server
   $ lua mcp delete --server-name old-server     Delete a server
 `).action(mcpCommand);
-  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: true)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--scope <scope>", "Who owns the connection: 'agent' (default) or 'user'").option("--force", "Skip the confirmation prompt (for convert)").option("--forget", "Also forget what a personal connection (--scope user) added to memory on disconnect (default: false, memories kept)").option("--connection-id <id>", "Exact connection ID to update, disconnect, convert or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval in minutes for virtual webhooks, 1-2880 (default 1; e.g. 1, 5, 15, 60, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for list, info, requests and webhooks list/events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
+  program2.command("integrations [action] [subaction]").description("\u{1F517} Connect third-party integrations via Unified.to").option("--integration <type>", "Integration type (e.g., linear, googlecalendar)").option("--auth-method <method>", "Authentication method: 'oauth' or 'token'").option("--scopes <scopes>", "Comma-separated OAuth scopes (or 'all' for all scopes)").option("--hide-sensitive <bool>", "Hide sensitive data from MCP tools (default: false; pass 'true' to hide)").option("--account-label <label>", "Account label used to distinguish multiple connected accounts").option("--scope <scope>", "Who owns the connection: 'agent' (default) or 'user'").option("--force", "Skip the confirmation prompt (for convert)").option("--forget", "Also forget what a personal connection (--scope user) added to memory on disconnect (default: false, memories kept)").option("--connection-id <id>", "Exact connection ID to update, disconnect, convert or pause/resume").option("--connection <id>", "Connection ID for trigger").option("--webhook-id <id>", "Trigger ID to delete/pause/resume").option("--object <type>", "Object type for webhook (e.g., task_task, calendar_event)").option("--event <type>", "Event type for webhook: created, updated, or deleted").option("--hook-url <url>", "Custom webhook URL (default: agent trigger)").option("--interval <minutes>", "Polling interval in minutes for virtual webhooks, 1-2880 (default 1; e.g. 1, 5, 15, 60, 1440, 2880)").option("--triggers <events>", "Comma-separated triggers (e.g., task_task.created,task_task.updated)").option("--custom-webhook", "Use custom webhook URL instead of agent trigger").option("--json", "Output as JSON (for list, info, requests and webhooks list/events commands)").option("--reason <text>", "Optional reason for pausing a trigger").addHelpText("after", `
 Arguments:
   action                 Optional: 'connect', 'update', 'list', 'available', 'info', 'disconnect',
                          'convert', 'webhooks' (alias: 'triggers'), or 'mcp'
@@ -84285,7 +84534,7 @@ Options:
                          create later. Publishing an agent removes its access.
   --auth-method <method> Authentication method: 'oauth' or 'token'
   --scopes <scopes>      Comma-separated OAuth scopes, or 'all' for all available scopes
-  --hide-sensitive <bool> Hide sensitive data from MCP tools (default: true, use 'false' to show)
+  --hide-sensitive <bool> Hide sensitive data from MCP tools (default: false, use 'true' to hide)
   --triggers <events>    Comma-separated triggers to enable (e.g., task_task.created,task_task.updated)
   --custom-webhook       Use custom webhook URL instead of agent trigger
   --hook-url <url>       Custom webhook URL (use with --custom-webhook)
@@ -84476,11 +84725,12 @@ Examples:
 `).action(voiceTestCommand);
   voice.command("list").description("List LuaVoice primitives in the compiled manifest").option("--json", "Output as JSON").action(voiceListCommand);
   const versionGroup = program2.command("version").description("\u{1F3F7}\uFE0F  Manage agent versions \u2014 atomic snapshots of agent state");
-  versionGroup.command("create").description("Snapshot current staged state into a new version").option("-m, --message <message>", "Optional description for this version").option("--auto-push", "Push first if local changes are not yet staged").option("--commit-hash <hash>", "Optional git commit hash to associate with this version").addHelpText("after", `
+  versionGroup.command("create").description("Snapshot current staged state into a new version").option("-m, --message <message>", "Optional description for this version").option("--auto-push", "Push first if local changes are not yet staged").option("--commit-hash <hash>", "Optional git commit hash to associate with this version").option("--persona-version <n>", "Pin this persona version (staged or published) instead of the newest published one").addHelpText("after", `
 Examples:
   $ lua version create                         Snapshot current state
   $ lua version create -m "Add FAQ skill"      Include a description
   $ lua version create --auto-push             Push then snapshot in one step
+  $ lua version create --persona-version 7     Pin staged persona v7 (practice it before go-live)
 `).action((opts) => versionCreateCommand(opts));
   versionGroup.command("list").description("List versions of the current agent").option("--all", "Show all versions (no server-side cap)").option("--limit <n>", "Cap output to this many entries", (v) => parseInt(v, 10)).option("--status <status>", "Filter by status: active | staged | superseded | deleted | all", "all").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
@@ -84677,6 +84927,7 @@ program.hook("preAction", (thisCommand) => {
     setCiMode(true);
   }
 });
+registerJsonErrorEnvelope(program);
 setupAuthCommands(program);
 setupSkillCommands(program);
 setupMarketplaceCommands(program);