From 5fc21b5b42bb749c450524433c2d6c3e7c59a3ad Mon Sep 17 00:00:00 2001 From: Selcuk Cigir Date: Mon, 19 Oct 2026 12:11:19 +0300 Subject: [PATCH 1/2] feat(knowledge): web-app pages on ui 0.3 and the lua-ui MCP (1.14.0) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit lua-cli 3.55.0 scaffolds pages on @lua-ai-global/ui ~0.3 (the Workspace enterprise restyle) and app-client ~0.1, which applies the shell's light/dark, density and accent to itself. - .mcp.json: the lua-ui server (https://ui.lua.dev/mcp, public Storybook catalog of @lua-ai-global/ui); lua-skill-builder gets its three tools, the permission template allows the whole (read-only) server - web-apps.md §2/§4/§9 and lua-skill-builder step 4: no theme code (keep void lua.start() only), semantic tokens only, look components up in the lua-ui MCP first, Page/ListRow/EmptyState, lua apps upgrade (named for the user) when a component is newer than the installed ui, gateway restyle of ui < 0.3 apps - lints: lua.dev remote host, kebab-case MCP tool names, lua-ui registry and allow rule, lua apps upgrade - version 1.14.0 everywhere; dist/server.js rebuilt Refs LUA-1481. Co-Authored-By: Claude Opus 5.5 (1M context) --- .claude-plugin/marketplace.json | 2 +- README.md | 2 +- docs/USER_GUIDE.md | 2 ++ .../lua-agent-builder/.claude-plugin/plugin.json | 2 +- plugins/lua-agent-builder/.mcp.json | 4 ++++ plugins/lua-agent-builder/CHANGELOG.md | 16 ++++++++++++++++ plugins/lua-agent-builder/README.md | 3 ++- plugins/lua-agent-builder/SECURITY.md | 2 +- .../agents/lua-skill-builder.md | 6 +++--- .../lua-agent-builder/lib/knowledge/web-apps.md | 15 ++++++++++----- .../lib/permissions-template.json | 4 +++- .../mcp/lua-platform/dist/server.js | 6 +++--- .../mcp/lua-platform/package-lock.json | 4 ++-- .../mcp/lua-platform/package.json | 2 +- .../mcp/lua-platform/src/api-client.mjs | 2 +- .../mcp/lua-platform/src/server.mjs | 6 +++--- plugins/lua-agent-builder/package.json | 2 +- .../scripts/lint-knowledge-commands.mjs | 2 +- .../scripts/lint-mcp-config.mjs | 13 +++++++------ .../lua-agent-builder/scripts/lint-mcp-refs.mjs | 7 ++++++- .../scripts/lint-permissions.mjs | 2 +- .../test/lib/permissions-mirror.test.mjs | 1 + 22 files changed, 71 insertions(+), 34 deletions(-) diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 67fed8f..1e83551 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -10,7 +10,7 @@ "name": "lua-agent-builder", "source": "./plugins/lua-agent-builder", "description": "Build, test, and deploy Lua AI agents from inside Claude Code", - "version": "1.13.0", + "version": "1.14.0", "homepage": "https://github.com/lua-ai-global/claude-code-lua-plugin#readme", "repository": "https://github.com/lua-ai-global/claude-code-lua-plugin.git", "license": "MIT", diff --git a/README.md b/README.md index 5dc017b..2476976 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ Then `/lua-auth`: an existing credential is kept; a new login runs `lua auth con | Plugin | Description | |---|---| -| [`lua-agent-builder`](./plugins/lua-agent-builder/) | 23 slash commands, 10 subagents, 13 hooks, a 9-file knowledge base verified against lua-cli source (3.33.0 base; 1.3.0 added per-step model classes and the workflow autonomy envelope from lua-cli 3.36.0, 1.4.0 the Job-tier billing rules and the lua-cli 3.37.0 cost read-outs, 1.5.0 log drains and the `lua logs` read window from lua-cli 3.38.0, read from `main`; 1.6.0 headless mode and a hardened production-gate parser; 1.7.0 `/lua-devices`, device credentials that never reach the conversation, and a re-check against lua-cli 3.44.0 / 3.45.0; 1.8.0 web apps (Lua Apps); 1.9.0 the full QA suite, `/lua-qa full`; 1.10.0 decisions, `/lua-decisions` and `/lua-new decision` from lua-cli 3.48.0 / 3.49.2; 1.11.0 `/lua-deploy webapp` scoped web-app deploys from lua-cli 3.49.0; 1.12.0 org-shared `Data.shared` and web-app viewer decisions from lua-cli 3.50.0; 1.13.0 `lua apps preview` from lua-cli 3.51.0), a local read-only platform MCP server and the public docs MCP | +| [`lua-agent-builder`](./plugins/lua-agent-builder/) | 23 slash commands, 10 subagents, 13 hooks, a 9-file knowledge base verified against lua-cli source (3.33.0 base; 1.3.0 added per-step model classes and the workflow autonomy envelope from lua-cli 3.36.0, 1.4.0 the Job-tier billing rules and the lua-cli 3.37.0 cost read-outs, 1.5.0 log drains and the `lua logs` read window from lua-cli 3.38.0, read from `main`; 1.6.0 headless mode and a hardened production-gate parser; 1.7.0 `/lua-devices`, device credentials that never reach the conversation, and a re-check against lua-cli 3.44.0 / 3.45.0; 1.8.0 web apps (Lua Apps); 1.9.0 the full QA suite, `/lua-qa full`; 1.10.0 decisions, `/lua-decisions` and `/lua-new decision` from lua-cli 3.48.0 / 3.49.2; 1.11.0 `/lua-deploy webapp` scoped web-app deploys from lua-cli 3.49.0; 1.12.0 org-shared `Data.shared` and web-app viewer decisions from lua-cli 3.50.0; 1.13.0 `lua apps preview` from lua-cli 3.51.0; 1.14.0 web-app pages on `@lua-ai-global/ui` 0.3 from lua-cli 3.55.0), a local read-only platform MCP server, the public docs MCP and the public UI component catalog MCP | ## Quick walkthrough diff --git a/docs/USER_GUIDE.md b/docs/USER_GUIDE.md index 7dac9b6..23e4e00 100644 --- a/docs/USER_GUIDE.md +++ b/docs/USER_GUIDE.md @@ -51,6 +51,8 @@ If you just want to start: [Installation](#installation) → [Your first agent]( `/lua-doctor` checks all of these and offers consent-gated fixes. Platforms: macOS 14+, Ubuntu 22.04+, Windows 11; CI runs the suite on all three with Node 18 and 20. +New in 1.14.0: **web-app pages on the new Lua design.** `lua apps new` now scaffolds pages on `@lua-ai-global/ui` 0.3 (the look Lua Workspace uses) and `@lua-ai-global/app-client` 0.1, which applies the shell's light/dark, density and the person's accent to the page by itself. The builder writes pages with the design's colour tokens only and no theme code, and looks each component up in the new `lua-ui` MCP (`https://ui.lua.dev/mcp`, the public component catalog) before using it. For an app made earlier it names `lua apps upgrade ` for you to run. Needs lua-cli 3.55.0. + New in 1.13.0: **preview a web app before it goes live.** After `/lua-push webapp`, the builder can open the staged version with `lua apps preview`: a Lua Workspace link on its own address, where Data writes go to a throwaway copy, emails and messages are recorded instead of sent, and outside calls are blocked. Anyone who can edit the agent can open it, for 24 hours by default. Needs lua-cli 3.51.0. New in 1.12.0: **org-shared Data and viewer decisions.** When several agents of one organization need the same dataset, the builder now recommends `Data.shared(name)` (same methods as `Data`; an org admin creates the collection and names its readers and writers through the admin API) and explains its errors, including why every call fails in a local test run. A web app's routes can decide workflow approvals and answer input steps as the signed-in person with `Workflows.viewer`. Needs lua-cli 3.50.0. diff --git a/plugins/lua-agent-builder/.claude-plugin/plugin.json b/plugins/lua-agent-builder/.claude-plugin/plugin.json index 20f1b4b..ecd7b52 100644 --- a/plugins/lua-agent-builder/.claude-plugin/plugin.json +++ b/plugins/lua-agent-builder/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "lua-agent-builder", - "version": "1.13.0", + "version": "1.14.0", "description": "Build, test, and deploy Lua AI agents from inside Claude Code", "author": { "name": "Lua AI", diff --git a/plugins/lua-agent-builder/.mcp.json b/plugins/lua-agent-builder/.mcp.json index 1ffa4db..0701821 100644 --- a/plugins/lua-agent-builder/.mcp.json +++ b/plugins/lua-agent-builder/.mcp.json @@ -7,6 +7,10 @@ "lua-docs": { "type": "http", "url": "https://docs.heylua.ai/mcp" + }, + "lua-ui": { + "type": "http", + "url": "https://ui.lua.dev/mcp" } } } diff --git a/plugins/lua-agent-builder/CHANGELOG.md b/plugins/lua-agent-builder/CHANGELOG.md index 996625f..67c3b0c 100644 --- a/plugins/lua-agent-builder/CHANGELOG.md +++ b/plugins/lua-agent-builder/CHANGELOG.md @@ -2,6 +2,22 @@ All notable changes to the `lua-agent-builder` plugin. Versions follow the tag `release-prod.yml` cuts from `package.json` (`v`). lua-cli is a TypeScript SDK/CLI; it is unrelated to the Lua programming language. +## 1.14.0 — 2026-10-19 + +**Web-app pages on the new design: `@lua-ai-global/ui` 0.3, app-client 0.1 and the `lua-ui` MCP** (lua-cli 3.55.0; LUA-1481). + +### New + +- **The `lua-ui` MCP server** in `.mcp.json`: `https://ui.lua.dev/mcp`, the public Storybook catalog of `@lua-ai-global/ui` (no auth; `list-all-documentation`, `get-documentation`, `get-documentation-for-story`). The skill builder has the three tools in its `tools:` line (plugin and bare spellings, like `lua-docs`) and looks a component's props up there before writing it. The permission template allows the whole server (`mcp__plugin_lua-agent-builder_lua-ui`, `mcp__lua-ui`): every tool only reads docs. + +### Changed + +- **`web-apps.md` §4.** The template stack is ui `~0.3` (the enterprise restyle Lua Workspace uses: flat surfaces, 6px radius, denser controls, Inter) and app-client `~0.1`, with the new `page` (`PageColumn`, `PageTitle`, `PageSection`, `Panel`, `StatGrid`, `Stat`), `list-row` (`ListRow`) and `empty-state` (`EmptyState`) components. New "Look and theme" bullet: app-client applies the shell's light/dark, density and the person's accent to `` on `lua.start()` and every `lua:init`, so pages keep only `void lua.start()` (no theme lines) and use semantic tokens, never palette classes or hex. New `lua apps upgrade ` bullet: what it changes (ui/app-client ranges, the old theme lines, the copied client, the bundled pane), that 0.2 → 0.3 needs no code changes, `lua apps dev` to look the pages over, and that the gateway restyles ui < 0.3 apps until they are rebuilt. §2 notes newer templates import the package already. §9 gains the "page ignores the accent" and "ui export missing" rows. +- **`agents/lua-skill-builder.md`** step 4 for web apps: no theme code (it used to say keep the theme lines), semantic tokens only, the lua-ui MCP before any component, the new page components, and `lua apps upgrade` named for the user (never run by the builder: it edits files and installs packages, outside the approved npm forms) when a component is newer than the installed ui. +- **Lints**: `lint-mcp-config` accepts a remote server on a `lua.dev` host as well as `heylua.ai`; `lint-mcp-refs` knows the `lua-ui` tools and accepts kebab-case tool names; `lint-permissions` and `permissions-mirror.test.mjs` require the lua-ui allow rule; `lint-knowledge-commands` learns `lua apps upgrade`. + +`PINNED_MIN_LUA_CLI` is unchanged: the new facts are marked lua-cli 3.55.0 (3.54.0 for `lua apps upgrade` itself). + ## 1.13.0 — 2026-10-12 **Preview a web app version before it is live** (lua-cli 3.51.0). diff --git a/plugins/lua-agent-builder/README.md b/plugins/lua-agent-builder/README.md index 190fea1..39ee0ed 100644 --- a/plugins/lua-agent-builder/README.md +++ b/plugins/lua-agent-builder/README.md @@ -20,7 +20,7 @@ New login runs in your own terminal (`lua auth configure`) — the plugin never ``` plugins/lua-agent-builder/ ├── .claude-plugin/plugin.json # plugin manifest -├── .mcp.json # lua-platform (local stdio) + lua-docs (https://docs.heylua.ai/mcp) +├── .mcp.json # lua-platform (local stdio) + lua-docs (https://docs.heylua.ai/mcp) + lua-ui (https://ui.lua.dev/mcp) ├── commands/ # 23 slash commands ├── agents/ # 10 subagents (architect, skill-builder, debug, deploy-pilot, qa, qa-cartographer, qa-player, qa-grader, qa-analyst, qa-reporter) ├── hooks/ # 12 Node ESM hooks + hooks.json @@ -80,6 +80,7 @@ plugins/lua-agent-builder/ - `lua-platform` (local, `mcp/lua-platform/dist/server.js`, one self-contained bundle — no `node_modules` needed at runtime): five read-only tools — `list_agents`, `get_agent`, `list_primitive_versions`, `get_deployment_status`, `tail_logs` — over the same lua-api routes lua-cli uses, with lua-cli's credential resolution (env → `.env` → renewable session → credentials file). - `lua-docs` (remote, `https://docs.heylua.ai/mcp`): the public docs search (`search_lua_cli`, `query_docs_filesystem_lua_cli`). +- `lua-ui` (remote, `https://ui.lua.dev/mcp`, no auth): the `@lua-ai-global/ui` component catalog, a public Storybook MCP (`list-all-documentation`, `get-documentation`, `get-documentation-for-story`). The skill builder looks a component's props up here before writing web-app pages; the permission template allows the whole server (all three tools only read docs). - Claude Code names a plugin's MCP tools `mcp__plugin_lua-agent-builder___`; the subagents, slashes and the permission template use that form (the plain `mcp__lua-platform__…` spelling only exists for a server you register yourself with `claude mcp add`). ## Build & test diff --git a/plugins/lua-agent-builder/SECURITY.md b/plugins/lua-agent-builder/SECURITY.md index 6ab9dbf..0a650cd 100644 --- a/plugins/lua-agent-builder/SECURITY.md +++ b/plugins/lua-agent-builder/SECURITY.md @@ -11,7 +11,7 @@ We aim to acknowledge within 2 business days and ship a fix within 30 days for h This plugin's surface includes: - **Hooks** (`hooks/*.mjs`) — run as subprocesses of Claude Code on `SessionStart`, `UserPromptSubmit`, and `Pre/PostToolUse(Bash)` events. -- **MCP servers** — `mcp/lua-platform/dist/server.js`, a local stdio server exposing 5 read-only tools (a single self-contained bundle since 1.6.0 — its npm dependencies, `@modelcontextprotocol/sdk` included, are inlined at build time from the lockfile); it talks to `https://api.heylua.ai` over HTTPS with the user's lua-cli credential (and, for a session login, refreshes the stored refresh token at Google's securetoken endpoint exactly like lua-cli does). `lua-docs` is the public remote MCP at `https://docs.heylua.ai/mcp` (read-only docs search). +- **MCP servers** — `mcp/lua-platform/dist/server.js`, a local stdio server exposing 5 read-only tools (a single self-contained bundle since 1.6.0 — its npm dependencies, `@modelcontextprotocol/sdk` included, are inlined at build time from the lockfile); it talks to `https://api.heylua.ai` over HTTPS with the user's lua-cli credential (and, for a session login, refreshes the stored refresh token at Google's securetoken endpoint exactly like lua-cli does). `lua-docs` is the public remote MCP at `https://docs.heylua.ai/mcp` (read-only docs search); `lua-ui` is the public remote Storybook MCP at `https://ui.lua.dev/mcp` (read-only `@lua-ai-global/ui` component docs, no credential sent). - **Slash commands and subagents** (`commands/*.md`, `agents/*.md`) — Markdown prompts that Claude reads and executes. - **Permission rules** (`lib/permissions-template.json`) — merged into the user's `.claude/settings.json` by `/lua-doctor` Step 5 with consent. diff --git a/plugins/lua-agent-builder/agents/lua-skill-builder.md b/plugins/lua-agent-builder/agents/lua-skill-builder.md index 7e0513c..9d44379 100644 --- a/plugins/lua-agent-builder/agents/lua-skill-builder.md +++ b/plugins/lua-agent-builder/agents/lua-skill-builder.md @@ -2,7 +2,7 @@ name: lua-skill-builder description: Scaffolds, registers, compiles and tests one lua-cli primitive — tool, skill, webhook, trigger, job, preprocessor, postprocessor, mcp server, device, device-trigger, voice, workflow, workflow-script or web app — in the current project. Use when the user describes a new piece of agent functionality. model: sonnet -tools: [Read, Write, Edit, Glob, Grep, Bash, WebFetch, mcp__plugin_lua-agent-builder_lua-platform__get_agent, mcp__lua-platform__get_agent, mcp__plugin_lua-agent-builder_lua-docs__search_lua_cli, mcp__lua-docs__search_lua_cli, mcp__plugin_lua-agent-builder_lua-docs__query_docs_filesystem_lua_cli, mcp__lua-docs__query_docs_filesystem_lua_cli] +tools: [Read, Write, Edit, Glob, Grep, Bash, WebFetch, mcp__plugin_lua-agent-builder_lua-platform__get_agent, mcp__lua-platform__get_agent, mcp__plugin_lua-agent-builder_lua-docs__search_lua_cli, mcp__lua-docs__search_lua_cli, mcp__plugin_lua-agent-builder_lua-docs__query_docs_filesystem_lua_cli, mcp__lua-docs__query_docs_filesystem_lua_cli, mcp__plugin_lua-agent-builder_lua-ui__list-all-documentation, mcp__lua-ui__list-all-documentation, mcp__plugin_lua-agent-builder_lua-ui__get-documentation, mcp__lua-ui__get-documentation, mcp__plugin_lua-agent-builder_lua-ui__get-documentation-for-story, mcp__lua-ui__get-documentation-for-story] --- You receive `{ type, name, description }` from `/lua-new`. lua-cli is a TypeScript SDK — never write Lua-language code. @@ -33,7 +33,7 @@ If the project has `examples/` (from `lua init --with-examples`), mirror the mat 1. `npm --prefix src/apps//web install --ignore-scripts` 2. `npm --prefix src/apps//web install --ignore-scripts @lua-ai-global/app-client`, change `from './lua/client'` to `from '@lua-ai-global/app-client'` in `web/src/main.tsx` and `web/src/App.tsx`, delete `web/src/lua/client.ts` (skip when the scaffold has no such file) 3. Write the routes in `app.ts` from the description: one `route()` per action, Zod `params` / `query` / `body` on every route that takes input, `auth.userId` on every write that records who did it, reads/writes through `Data` (the agent's own collections — reuse the names the project's tools already use; `Grep` for `Data.` first), handler errors as `json({ code, message }, status)`. Keep the template's `GET /hello` only if nothing replaces it (an app needs at least one route) - 4. Write the pages in `web/src/` with `@lua-ai-global/ui` components (`@lua-ai-global/ui/`), the theme tokens (`bg-background`, `text-foreground`, `text-muted-foreground`), `lua.api(method, path, body?)` for every call and `LuaApiError` for failures. Keep `void lua.start()` and the theme lines in `main.tsx`. No CDN `