diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 67fed8f..1e83551 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -10,7 +10,7 @@ "name": "lua-agent-builder", "source": "./plugins/lua-agent-builder", "description": "Build, test, and deploy Lua AI agents from inside Claude Code", - "version": "1.13.0", + "version": "1.14.0", "homepage": "https://github.com/lua-ai-global/claude-code-lua-plugin#readme", "repository": "https://github.com/lua-ai-global/claude-code-lua-plugin.git", "license": "MIT", diff --git a/README.md b/README.md index 5dc017b..2476976 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ Then `/lua-auth`: an existing credential is kept; a new login runs `lua auth con | Plugin | Description | |---|---| -| [`lua-agent-builder`](./plugins/lua-agent-builder/) | 23 slash commands, 10 subagents, 13 hooks, a 9-file knowledge base verified against lua-cli source (3.33.0 base; 1.3.0 added per-step model classes and the workflow autonomy envelope from lua-cli 3.36.0, 1.4.0 the Job-tier billing rules and the lua-cli 3.37.0 cost read-outs, 1.5.0 log drains and the `lua logs` read window from lua-cli 3.38.0, read from `main`; 1.6.0 headless mode and a hardened production-gate parser; 1.7.0 `/lua-devices`, device credentials that never reach the conversation, and a re-check against lua-cli 3.44.0 / 3.45.0; 1.8.0 web apps (Lua Apps); 1.9.0 the full QA suite, `/lua-qa full`; 1.10.0 decisions, `/lua-decisions` and `/lua-new decision` from lua-cli 3.48.0 / 3.49.2; 1.11.0 `/lua-deploy webapp` scoped web-app deploys from lua-cli 3.49.0; 1.12.0 org-shared `Data.shared` and web-app viewer decisions from lua-cli 3.50.0; 1.13.0 `lua apps preview` from lua-cli 3.51.0), a local read-only platform MCP server and the public docs MCP | +| [`lua-agent-builder`](./plugins/lua-agent-builder/) | 23 slash commands, 10 subagents, 13 hooks, a 9-file knowledge base verified against lua-cli source (3.33.0 base; 1.3.0 added per-step model classes and the workflow autonomy envelope from lua-cli 3.36.0, 1.4.0 the Job-tier billing rules and the lua-cli 3.37.0 cost read-outs, 1.5.0 log drains and the `lua logs` read window from lua-cli 3.38.0, read from `main`; 1.6.0 headless mode and a hardened production-gate parser; 1.7.0 `/lua-devices`, device credentials that never reach the conversation, and a re-check against lua-cli 3.44.0 / 3.45.0; 1.8.0 web apps (Lua Apps); 1.9.0 the full QA suite, `/lua-qa full`; 1.10.0 decisions, `/lua-decisions` and `/lua-new decision` from lua-cli 3.48.0 / 3.49.2; 1.11.0 `/lua-deploy webapp` scoped web-app deploys from lua-cli 3.49.0; 1.12.0 org-shared `Data.shared` and web-app viewer decisions from lua-cli 3.50.0; 1.13.0 `lua apps preview` from lua-cli 3.51.0; 1.14.0 web-app pages on `@lua-ai-global/ui` 0.3 from lua-cli 3.55.0), a local read-only platform MCP server, the public docs MCP and the public UI component catalog MCP | ## Quick walkthrough diff --git a/docs/USER_GUIDE.md b/docs/USER_GUIDE.md index 7dac9b6..5210782 100644 --- a/docs/USER_GUIDE.md +++ b/docs/USER_GUIDE.md @@ -51,6 +51,8 @@ If you just want to start: [Installation](#installation) → [Your first agent]( `/lua-doctor` checks all of these and offers consent-gated fixes. Platforms: macOS 14+, Ubuntu 22.04+, Windows 11; CI runs the suite on all three with Node 18 and 20. +New in 1.14.0: **web-app pages on the new Lua design.** `lua apps new` now scaffolds pages on `@lua-ai-global/ui` 0.3 (the look Lua Workspace uses) and `@lua-ai-global/app-client` 0.1, which applies the shell's light/dark, density and the person's accent to the page by itself. The builder writes pages with the design's colour tokens only (and no theme code on app-client 0.1), and looks each component up in the new `ui` MCP server (`https://ui.lua.dev/mcp`, the public component catalog) before using it. For an app made earlier it names `lua apps upgrade ` for you to run. Needs lua-cli 3.55.0. + New in 1.13.0: **preview a web app before it goes live.** After `/lua-push webapp`, the builder can open the staged version with `lua apps preview`: a Lua Workspace link on its own address, where Data writes go to a throwaway copy, emails and messages are recorded instead of sent, and outside calls are blocked. Anyone who can edit the agent can open it, for 24 hours by default. Needs lua-cli 3.51.0. New in 1.12.0: **org-shared Data and viewer decisions.** When several agents of one organization need the same dataset, the builder now recommends `Data.shared(name)` (same methods as `Data`; an org admin creates the collection and names its readers and writers through the admin API) and explains its errors, including why every call fails in a local test run. A web app's routes can decide workflow approvals and answer input steps as the signed-in person with `Workflows.viewer`. Needs lua-cli 3.50.0. diff --git a/plugins/lua-agent-builder/.claude-plugin/plugin.json b/plugins/lua-agent-builder/.claude-plugin/plugin.json index 20f1b4b..ecd7b52 100644 --- a/plugins/lua-agent-builder/.claude-plugin/plugin.json +++ b/plugins/lua-agent-builder/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "lua-agent-builder", - "version": "1.13.0", + "version": "1.14.0", "description": "Build, test, and deploy Lua AI agents from inside Claude Code", "author": { "name": "Lua AI", diff --git a/plugins/lua-agent-builder/.mcp.json b/plugins/lua-agent-builder/.mcp.json index 1ffa4db..bec5709 100644 --- a/plugins/lua-agent-builder/.mcp.json +++ b/plugins/lua-agent-builder/.mcp.json @@ -7,6 +7,10 @@ "lua-docs": { "type": "http", "url": "https://docs.heylua.ai/mcp" + }, + "ui": { + "type": "http", + "url": "https://ui.lua.dev/mcp" } } } diff --git a/plugins/lua-agent-builder/CHANGELOG.md b/plugins/lua-agent-builder/CHANGELOG.md index 996625f..25f1ec9 100644 --- a/plugins/lua-agent-builder/CHANGELOG.md +++ b/plugins/lua-agent-builder/CHANGELOG.md @@ -2,6 +2,26 @@ All notable changes to the `lua-agent-builder` plugin. Versions follow the tag `release-prod.yml` cuts from `package.json` (`v`). lua-cli is a TypeScript SDK/CLI; it is unrelated to the Lua programming language. +## 1.14.0 — 2026-10-19 + +**Web-app pages on the new design: `@lua-ai-global/ui` 0.3, app-client 0.1 and the `ui` MCP server** (lua-cli 3.55.0; LUA-1481). + +### New + +- **The `ui` MCP server** in `.mcp.json`: `https://ui.lua.dev/mcp`, the public Storybook catalog of `@lua-ai-global/ui` (no auth; `list-all-documentation`, `get-documentation`, `get-documentation-for-story`). The key is `ui`, not `lua-ui`, so every composed `mcp__plugin____` name is at most 64 characters (`lua-ui` made the story tool 65). Claude Code does resolve longer composed names (the existing `…_lua-docs__query_docs_filesystem_lua_cli` is 69), so this is margin, not a fix. The plugin names are `mcp__plugin_lua-agent-builder_ui__list-all-documentation` (56), `…__get-documentation` (51) and `…__get-documentation-for-story` (61). The skill builder has the three tools in its `tools:` line (plugin and bare `mcp__ui__…` spellings, like `lua-docs`) and looks a component's props up there before writing it; when the tools are unavailable it reads the installed package's `exports` and `dist/**/*.d.ts` instead of guessing. The permission template allows the three tools one by one in both spellings, never the whole server. + +### Changed + +- **`web-apps.md` §4.** The template stack is ui `~0.3` (the enterprise restyle Lua Workspace uses: flat surfaces, 6px radius, denser controls, Inter) and app-client `~0.1`, with the new `page` (`PageColumn`, `PageTitle`, `PageSection`, `Panel`, `StatGrid`, `Stat`), `list-row` (`ListRow`) and `empty-state` (`EmptyState`) components. New "Look and theme" bullet: app-client 0.1+ applies the shell's light/dark, density and the person's accent to `` on `lua.start()` and every `lua:init`, so on app-client 0.1+ pages keep only `void lua.start()` (no theme lines of their own); an app on app-client 0.0.x or the copied 3.42–3.45 client keeps its theme lines and is pointed at `lua apps upgrade`. Either way, semantic tokens only, never palette classes or hex. New `lua apps upgrade ` bullet: what it changes (ui/app-client ranges, the old theme lines, the copied client, the bundled pane), that 0.2 → 0.3 needs no code changes, `lua apps dev` to look the pages over, and that the gateway restyles ui < 0.3 apps until they are rebuilt. §2 notes newer templates import the package already. §9 gains the "page ignores the accent" and "ui export missing" rows. +- **`agents/lua-skill-builder.md`** step 4 for web apps: theme code gated on the app-client version in `web/package.json` (none on 0.1+; keep the template's lines on 0.0.x / the copied client), semantic tokens only, the `ui` MCP server before any component (installed `.d.ts` files as the fallback), the new page components, and `lua apps upgrade` named for the user (never run by the builder: it edits files and installs packages, outside the approved npm forms) when a component is newer than the installed ui. +- **Lints**: + - `lint-mcp-config` pins remote servers to exact hosts (`docs.heylua.ai`, `ui.lua.dev`; https, no port) instead of any `*.heylua.ai`. + - `lint-mcp-refs` knows the `ui` tools, accepts kebab-case tool names, and checks tool names: each server-reported tool must match `^[A-Za-z0-9_-]{1,64}$`, and each composed `mcp__plugin_lua-agent-builder___` must use only `[A-Za-z0-9_-]` and stay within 128 characters. The composed limit is not 64, because live composed names of 65–69 characters already resolve. + - `lint-permissions` and `permissions-mirror.test.mjs` require the six per-tool `ui` rules and forbid a whole-server allow rule for any remote (http/sse) server in `.mcp.json`. + - `lint-knowledge-commands` learns `lua apps upgrade`. + +`PINNED_MIN_LUA_CLI` is unchanged: the new facts are marked lua-cli 3.55.0 (3.54.0 for `lua apps upgrade` itself). + ## 1.13.0 — 2026-10-12 **Preview a web app version before it is live** (lua-cli 3.51.0). diff --git a/plugins/lua-agent-builder/README.md b/plugins/lua-agent-builder/README.md index 190fea1..7423925 100644 --- a/plugins/lua-agent-builder/README.md +++ b/plugins/lua-agent-builder/README.md @@ -20,7 +20,7 @@ New login runs in your own terminal (`lua auth configure`) — the plugin never ``` plugins/lua-agent-builder/ ├── .claude-plugin/plugin.json # plugin manifest -├── .mcp.json # lua-platform (local stdio) + lua-docs (https://docs.heylua.ai/mcp) +├── .mcp.json # lua-platform (local stdio) + lua-docs (https://docs.heylua.ai/mcp) + ui (https://ui.lua.dev/mcp) ├── commands/ # 23 slash commands ├── agents/ # 10 subagents (architect, skill-builder, debug, deploy-pilot, qa, qa-cartographer, qa-player, qa-grader, qa-analyst, qa-reporter) ├── hooks/ # 12 Node ESM hooks + hooks.json @@ -80,6 +80,7 @@ plugins/lua-agent-builder/ - `lua-platform` (local, `mcp/lua-platform/dist/server.js`, one self-contained bundle — no `node_modules` needed at runtime): five read-only tools — `list_agents`, `get_agent`, `list_primitive_versions`, `get_deployment_status`, `tail_logs` — over the same lua-api routes lua-cli uses, with lua-cli's credential resolution (env → `.env` → renewable session → credentials file). - `lua-docs` (remote, `https://docs.heylua.ai/mcp`): the public docs search (`search_lua_cli`, `query_docs_filesystem_lua_cli`). +- `ui` (remote, `https://ui.lua.dev/mcp`, no auth): the `@lua-ai-global/ui` component catalog, a public Storybook MCP (`list-all-documentation`, `get-documentation`, `get-documentation-for-story`). The skill builder looks a component's props up here before writing web-app pages. The permission template allows the three tools one by one, never the whole server. The key is short on purpose, so every composed tool name stays within 64 characters. - Claude Code names a plugin's MCP tools `mcp__plugin_lua-agent-builder___`; the subagents, slashes and the permission template use that form (the plain `mcp__lua-platform__…` spelling only exists for a server you register yourself with `claude mcp add`). ## Build & test diff --git a/plugins/lua-agent-builder/SECURITY.md b/plugins/lua-agent-builder/SECURITY.md index 6ab9dbf..a8e7525 100644 --- a/plugins/lua-agent-builder/SECURITY.md +++ b/plugins/lua-agent-builder/SECURITY.md @@ -11,7 +11,7 @@ We aim to acknowledge within 2 business days and ship a fix within 30 days for h This plugin's surface includes: - **Hooks** (`hooks/*.mjs`) — run as subprocesses of Claude Code on `SessionStart`, `UserPromptSubmit`, and `Pre/PostToolUse(Bash)` events. -- **MCP servers** — `mcp/lua-platform/dist/server.js`, a local stdio server exposing 5 read-only tools (a single self-contained bundle since 1.6.0 — its npm dependencies, `@modelcontextprotocol/sdk` included, are inlined at build time from the lockfile); it talks to `https://api.heylua.ai` over HTTPS with the user's lua-cli credential (and, for a session login, refreshes the stored refresh token at Google's securetoken endpoint exactly like lua-cli does). `lua-docs` is the public remote MCP at `https://docs.heylua.ai/mcp` (read-only docs search). +- **MCP servers** — `mcp/lua-platform/dist/server.js`, a local stdio server exposing 5 read-only tools (a single self-contained bundle since 1.6.0 — its npm dependencies, `@modelcontextprotocol/sdk` included, are inlined at build time from the lockfile); it talks to `https://api.heylua.ai` over HTTPS with the user's lua-cli credential (and, for a session login, refreshes the stored refresh token at Google's securetoken endpoint exactly like lua-cli does). `lua-docs` is the public remote MCP at `https://docs.heylua.ai/mcp` (read-only docs search); `ui` is the public remote Storybook MCP at `https://ui.lua.dev/mcp` (read-only `@lua-ai-global/ui` component docs, no credential sent). Remote servers are pinned to those exact hosts (`scripts/lint-mcp-config.mjs`), and their tools are pre-approved one by one, never as a whole server, so a tool a host adds later still prompts (`scripts/lint-permissions.mjs`). - **Slash commands and subagents** (`commands/*.md`, `agents/*.md`) — Markdown prompts that Claude reads and executes. - **Permission rules** (`lib/permissions-template.json`) — merged into the user's `.claude/settings.json` by `/lua-doctor` Step 5 with consent. diff --git a/plugins/lua-agent-builder/agents/lua-skill-builder.md b/plugins/lua-agent-builder/agents/lua-skill-builder.md index 7e0513c..2540789 100644 --- a/plugins/lua-agent-builder/agents/lua-skill-builder.md +++ b/plugins/lua-agent-builder/agents/lua-skill-builder.md @@ -2,7 +2,7 @@ name: lua-skill-builder description: Scaffolds, registers, compiles and tests one lua-cli primitive — tool, skill, webhook, trigger, job, preprocessor, postprocessor, mcp server, device, device-trigger, voice, workflow, workflow-script or web app — in the current project. Use when the user describes a new piece of agent functionality. model: sonnet -tools: [Read, Write, Edit, Glob, Grep, Bash, WebFetch, mcp__plugin_lua-agent-builder_lua-platform__get_agent, mcp__lua-platform__get_agent, mcp__plugin_lua-agent-builder_lua-docs__search_lua_cli, mcp__lua-docs__search_lua_cli, mcp__plugin_lua-agent-builder_lua-docs__query_docs_filesystem_lua_cli, mcp__lua-docs__query_docs_filesystem_lua_cli] +tools: [Read, Write, Edit, Glob, Grep, Bash, WebFetch, mcp__plugin_lua-agent-builder_lua-platform__get_agent, mcp__lua-platform__get_agent, mcp__plugin_lua-agent-builder_lua-docs__search_lua_cli, mcp__lua-docs__search_lua_cli, mcp__plugin_lua-agent-builder_lua-docs__query_docs_filesystem_lua_cli, mcp__lua-docs__query_docs_filesystem_lua_cli, mcp__plugin_lua-agent-builder_ui__list-all-documentation, mcp__ui__list-all-documentation, mcp__plugin_lua-agent-builder_ui__get-documentation, mcp__ui__get-documentation, mcp__plugin_lua-agent-builder_ui__get-documentation-for-story, mcp__ui__get-documentation-for-story] --- You receive `{ type, name, description }` from `/lua-new`. lua-cli is a TypeScript SDK — never write Lua-language code. @@ -33,7 +33,7 @@ If the project has `examples/` (from `lua init --with-examples`), mirror the mat 1. `npm --prefix src/apps//web install --ignore-scripts` 2. `npm --prefix src/apps//web install --ignore-scripts @lua-ai-global/app-client`, change `from './lua/client'` to `from '@lua-ai-global/app-client'` in `web/src/main.tsx` and `web/src/App.tsx`, delete `web/src/lua/client.ts` (skip when the scaffold has no such file) 3. Write the routes in `app.ts` from the description: one `route()` per action, Zod `params` / `query` / `body` on every route that takes input, `auth.userId` on every write that records who did it, reads/writes through `Data` (the agent's own collections — reuse the names the project's tools already use; `Grep` for `Data.` first), handler errors as `json({ code, message }, status)`. Keep the template's `GET /hello` only if nothing replaces it (an app needs at least one route) - 4. Write the pages in `web/src/` with `@lua-ai-global/ui` components (`@lua-ai-global/ui/`), the theme tokens (`bg-background`, `text-foreground`, `text-muted-foreground`), `lua.api(method, path, body?)` for every call and `LuaApiError` for failures. Keep `void lua.start()` and the theme lines in `main.tsx`. No CDN `