plugin 1.2.0: source-verified against lua-cli 3.33.0, hook-based production gate, live five-agent E2E

[lua-stefan-kruger]

Summary

Plugin 1.2.0: every command shape, SDK primitive, API route and safety contract re-verified against lua-cli 3.33.0 source (lua-core-services/packages/lua-cli/src), an architect review applied, and a live five-agent end-to-end run through the plugin itself (claude -p --plugin-dir …) that built, tested, pushed and deployed each agent on the real platform.

Production gate redesign (found by the live run)

Claude Code evaluates deny/ask permission rules past a leading env assignment (docs: "A deny or ask rule matches past any leading assignment"), so the template's Bash(lua deploy*) deny also matched the user-confirmed LUA_DEPLOY_CONFIRMED=1 lua deploy … form. With the template installed, no deploy could ever run — all five first deploy attempts were denied at the go-live gate.

• hooks/confirm-deploy.mjs is now the gate: registered on every Bash call (no if glob), classifies with lib/tokenizer.mjs, exits 2 on a bare production verb. A hook block beats any allow rule.
• lib/tokenizer.mjs covers every spelling lua-cli accepts: the aliases.ts action aliases (publish, on/enable, submit/publish_version, deploy/fleet-apply/rollout, prod/prd/live) and all three binaries (lua, heylua, lua-ai).
• lib/permissions-template.json: bare production verbs removed from deny/ask; only the literal prefixed forms are allowed; heylua/lua-ai denied wholesale; read-only MCP tools pre-approved under the plugin-scoped names.
• test/lib/permissions-mirror.test.mjs + scripts/lint-permissions.mjs model the documented semantics and fail if a deny/ask rule would shadow a confirmed form or an allow rule admits a bare one.
• post-deploy-smoke now fires for every verb that makes something live (SMOKE_LABELS), not only lua deploy.

Other correctness fixes

• lua test skill --name takes a tool name and --input is the tool's own fields (no {"tool": …} envelope) — fixed in knowledge, /lua-test, skill-builder, debug agent, user guide. Three of five live builders had hit this.
• Plugin MCP tools are exposed as mcp__plugin_lua-agent-builder_<server>__<tool>; all subagent tools: lists, prose and the permission template now use that form (verified live).
• Deploy pilot: aborts when the server has a model and the local LuaAgent declares none (the agent push overwrites model/modelSettings/batching with null); tolerates a project without git; MCP rollback is lua mcp deactivate (ask tier).
• /lua-workflow: --wait-for-human removed from default start/watch (it keeps streaming through a park and exits 7 at timeout, never 8).
• warn-version-zero: deploy --set-version latest picks the most recently created version (sortVersionsByDate), not the highest semver.
• check-lua-auth: probe is lua models list --json --ci (exit 0/10 ok, 9 not authenticated, 11 unreachable, timeout neutral); lua agents was timing out on large accounts.
• lua sync --check compiles with serverSync: true and registers entity records — documented.
• Runtime caveat documented: the production sandbox runtime still posts the third Data.create argument as searchText, so the { index } options form typed in lua-cli 3.33.0 returns 400 searchText must be a string in production while passing locally.

MCP server (mcp/lua-platform)

• 403 message names the real scopes (workflows:read for workflows), base URL join keeps a path prefix, get_deployment_status runs list calls in parallel and versions in chunks of 5 with a 45 s wall-clock budget (partial: true), tail_logs gains logType, versionId caveat documented.
• dist/server.js is now committed (marketplace installs have no build step); lint/typecheck scripts repaired (checkJs tsconfig). 147 tests.

New surface

• /lua-env, /lua-integrations, /lua-status, /lua-version, /lua-workflow, /lua-template slashes; workflow-script type in /lua-new.
• lib/knowledge/cli-reference.md and workflows.md (request-context bindings, --from-run, LuaWorkflowBuildError), voice flags, env resolution, template authoring checklist, RAG/resources note.
• .mcp.json registers the public docs MCP (https://docs.heylua.ai/mcp).

Test plan

• npm run lint (18 lint scripts, LUA_CLI_SRC pointed at the 3.33.0 checkout) — green
• npm test — 428 tests; mcp/lua-platform: 147 tests, lint, typecheck, build — green
• Hooks exercised with synthetic payloads: bare verbs and alias spellings exit 2, prefixed forms exit 0, wrappers/pipes refused, --auto-deploy blocked
• Permission semantics reproduced with scratch --settings files in claude -p
• Live E2E (org "Claude Plugin E2E", 36 scripted sessions): helpdesk-triage (deploy all, production chat, /lua-qa, template create/view), outreach-orchestrator (workflow deploy, start → approval → complete), ops-scheduler (deploy all, jobs firing), shopfront-commerce (skill deploy, MCP activate, sandbox chat), field-ops-voice (version create → prefixed promote); deployment state confirmed via the MCP get_deployment_status tool inside a plugin session and via lua-cli

Upstream (lua-cli / platform) observations, not fixed here

• sandbox-runtime Data.create lags the lua-cli 3.33.0 { searchText?, index? } typing (see above)
• lua test workflow --agents fake still runs real AI.generate and real Channels.email.send
• lua push all re-versions primitives that are already in sync
• lua init template ships .npmignore instead of .gitignore; --org-id prints "Using organization: undefined"
• lua agents takes 18–25 s on a 144-org account
• lua marketplace template draft on an agent with no active version exits 10 (http_400)

🤖 Generated with Claude Code

https://claude.ai/code/session_01AfAcTzKPi9LdoGvRcjJNQo