feat(lua-agent-builder): web apps on ui 0.3, lua-ui MCP for components (1.14.0, LUA-1481)

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "lua-agent-builder",
       "source": "./plugins/lua-agent-builder",
       "description": "Build, test, and deploy Lua AI agents from inside Claude Code",
-      "version": "1.13.0",
+      "version": "1.14.0",
       "homepage": "https://github.com/lua-ai-global/claude-code-lua-plugin#readme",
       "repository": "https://github.com/lua-ai-global/claude-code-lua-plugin.git",
       "license": "MIT",

README.md

@@ -23,7 +23,7 @@ Then `/lua-auth`: an existing credential is kept; a new login runs `lua auth con
 
 | Plugin | Description |
 |---|---|
-| [`lua-agent-builder`](./plugins/lua-agent-builder/) | 23 slash commands, 10 subagents, 13 hooks, a 9-file knowledge base verified against lua-cli source (3.33.0 base; 1.3.0 added per-step model classes and the workflow autonomy envelope from lua-cli 3.36.0, 1.4.0 the Job-tier billing rules and the lua-cli 3.37.0 cost read-outs, 1.5.0 log drains and the `lua logs` read window from lua-cli 3.38.0, read from `main`; 1.6.0 headless mode and a hardened production-gate parser; 1.7.0 `/lua-devices`, device credentials that never reach the conversation, and a re-check against lua-cli 3.44.0 / 3.45.0; 1.8.0 web apps (Lua Apps); 1.9.0 the full QA suite, `/lua-qa full`; 1.10.0 decisions, `/lua-decisions` and `/lua-new decision` from lua-cli 3.48.0 / 3.49.2; 1.11.0 `/lua-deploy webapp` scoped web-app deploys from lua-cli 3.49.0; 1.12.0 org-shared `Data.shared` and web-app viewer decisions from lua-cli 3.50.0; 1.13.0 `lua apps preview` from lua-cli 3.51.0), a local read-only platform MCP server and the public docs MCP |
+| [`lua-agent-builder`](./plugins/lua-agent-builder/) | 23 slash commands, 10 subagents, 13 hooks, a 9-file knowledge base verified against lua-cli source (3.33.0 base; 1.3.0 added per-step model classes and the workflow autonomy envelope from lua-cli 3.36.0, 1.4.0 the Job-tier billing rules and the lua-cli 3.37.0 cost read-outs, 1.5.0 log drains and the `lua logs` read window from lua-cli 3.38.0, read from `main`; 1.6.0 headless mode and a hardened production-gate parser; 1.7.0 `/lua-devices`, device credentials that never reach the conversation, and a re-check against lua-cli 3.44.0 / 3.45.0; 1.8.0 web apps (Lua Apps); 1.9.0 the full QA suite, `/lua-qa full`; 1.10.0 decisions, `/lua-decisions` and `/lua-new decision` from lua-cli 3.48.0 / 3.49.2; 1.11.0 `/lua-deploy webapp` scoped web-app deploys from lua-cli 3.49.0; 1.12.0 org-shared `Data.shared` and web-app viewer decisions from lua-cli 3.50.0; 1.13.0 `lua apps preview` from lua-cli 3.51.0; 1.14.0 web-app pages on `@lua-ai-global/ui` 0.3 from lua-cli 3.55.0), a local read-only platform MCP server, the public docs MCP and the public UI component catalog MCP |
 
 ## Quick walkthrough
 

docs/USER_GUIDE.md

@@ -51,6 +51,8 @@ If you just want to start: [Installation](#installation) → [Your first agent](
 
 `/lua-doctor` checks all of these and offers consent-gated fixes. Platforms: macOS 14+, Ubuntu 22.04+, Windows 11; CI runs the suite on all three with Node 18 and 20.
 
+New in 1.14.0: **web-app pages on the new Lua design.** `lua apps new` now scaffolds pages on `@lua-ai-global/ui` 0.3 (the look Lua Workspace uses) and `@lua-ai-global/app-client` 0.1, which applies the shell's light/dark, density and the person's accent to the page by itself. The builder writes pages with the design's colour tokens only (and no theme code on app-client 0.1), and looks each component up in the new `ui` MCP server (`https://ui.lua.dev/mcp`, the public component catalog) before using it. For an app made earlier it names `lua apps upgrade <name>` for you to run. Needs lua-cli 3.55.0.
+
 New in 1.13.0: **preview a web app before it goes live.** After `/lua-push webapp`, the builder can open the staged version with `lua apps preview`: a Lua Workspace link on its own address, where Data writes go to a throwaway copy, emails and messages are recorded instead of sent, and outside calls are blocked. Anyone who can edit the agent can open it, for 24 hours by default. Needs lua-cli 3.51.0.
 
 New in 1.12.0: **org-shared Data and viewer decisions.** When several agents of one organization need the same dataset, the builder now recommends `Data.shared(name)` (same methods as `Data`; an org admin creates the collection and names its readers and writers through the admin API) and explains its errors, including why every call fails in a local test run. A web app's routes can decide workflow approvals and answer input steps as the signed-in person with `Workflows.viewer`. Needs lua-cli 3.50.0.

plugins/lua-agent-builder/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lua-agent-builder",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Build, test, and deploy Lua AI agents from inside Claude Code",
   "author": {
     "name": "Lua AI",

plugins/lua-agent-builder/.mcp.json

@@ -7,6 +7,10 @@
     "lua-docs": {
       "type": "http",
       "url": "https://docs.heylua.ai/mcp"
+    },
+    "ui": {
+      "type": "http",
+      "url": "https://ui.lua.dev/mcp"
     }
   }
 }

plugins/lua-agent-builder/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to the `lua-agent-builder` plugin. Versions follow the tag `release-prod.yml` cuts from `package.json` (`v<version>`). lua-cli is a TypeScript SDK/CLI; it is unrelated to the Lua programming language.
 
+## 1.14.0 — 2026-10-19
+
+**Web-app pages on the new design: `@lua-ai-global/ui` 0.3, app-client 0.1 and the `ui` MCP server** (lua-cli 3.55.0; LUA-1481).
+
+### New
+
+- **The `ui` MCP server** in `.mcp.json`: `https://ui.lua.dev/mcp`, the public Storybook catalog of `@lua-ai-global/ui` (no auth; `list-all-documentation`, `get-documentation`, `get-documentation-for-story`). The key is `ui`, not `lua-ui`, so every composed `mcp__plugin_<plugin>_<server>__<tool>` name is at most 64 characters (`lua-ui` made the story tool 65). Claude Code does resolve longer composed names (the existing `…_lua-docs__query_docs_filesystem_lua_cli` is 69), so this is margin, not a fix. The plugin names are `mcp__plugin_lua-agent-builder_ui__list-all-documentation` (56), `…__get-documentation` (51) and `…__get-documentation-for-story` (61). The skill builder has the three tools in its `tools:` line (plugin and bare `mcp__ui__…` spellings, like `lua-docs`) and looks a component's props up there before writing it; when the tools are unavailable it reads the installed package's `exports` and `dist/**/*.d.ts` instead of guessing. The permission template allows the three tools one by one in both spellings, never the whole server.
+
+### Changed
+
+- **`web-apps.md` §4.** The template stack is ui `~0.3` (the enterprise restyle Lua Workspace uses: flat surfaces, 6px radius, denser controls, Inter) and app-client `~0.1`, with the new `page` (`PageColumn`, `PageTitle`, `PageSection`, `Panel`, `StatGrid`, `Stat`), `list-row` (`ListRow`) and `empty-state` (`EmptyState`) components. New "Look and theme" bullet: app-client 0.1+ applies the shell's light/dark, density and the person's accent to `<html>` on `lua.start()` and every `lua:init`, so on app-client 0.1+ pages keep only `void lua.start()` (no theme lines of their own); an app on app-client 0.0.x or the copied 3.42–3.45 client keeps its theme lines and is pointed at `lua apps upgrade`. Either way, semantic tokens only, never palette classes or hex. New `lua apps upgrade <name>` bullet: what it changes (ui/app-client ranges, the old theme lines, the copied client, the bundled pane), that 0.2 → 0.3 needs no code changes, `lua apps dev` to look the pages over, and that the gateway restyles ui < 0.3 apps until they are rebuilt. §2 notes newer templates import the package already. §9 gains the "page ignores the accent" and "ui export missing" rows.
+- **`agents/lua-skill-builder.md`** step 4 for web apps: theme code gated on the app-client version in `web/package.json` (none on 0.1+; keep the template's lines on 0.0.x / the copied client), semantic tokens only, the `ui` MCP server before any component (installed `.d.ts` files as the fallback), the new page components, and `lua apps upgrade` named for the user (never run by the builder: it edits files and installs packages, outside the approved npm forms) when a component is newer than the installed ui.
+- **Lints**:
+  - `lint-mcp-config` pins remote servers to exact hosts (`docs.heylua.ai`, `ui.lua.dev`; https, no port) instead of any `*.heylua.ai`.
+  - `lint-mcp-refs` knows the `ui` tools, accepts kebab-case tool names, and checks tool names: each server-reported tool must match `^[A-Za-z0-9_-]{1,64}$`, and each composed `mcp__plugin_lua-agent-builder_<server>__<tool>` must use only `[A-Za-z0-9_-]` and stay within 128 characters. The composed limit is not 64, because live composed names of 65–69 characters already resolve.
+  - `lint-permissions` and `permissions-mirror.test.mjs` require the six per-tool `ui` rules and forbid a whole-server allow rule for any remote (http/sse) server in `.mcp.json`.
+  - `lint-knowledge-commands` learns `lua apps upgrade`.
+
+`PINNED_MIN_LUA_CLI` is unchanged: the new facts are marked lua-cli 3.55.0 (3.54.0 for `lua apps upgrade` itself).
+
 ## 1.13.0 — 2026-10-12
 
 **Preview a web app version before it is live** (lua-cli 3.51.0).

plugins/lua-agent-builder/README.md

@@ -20,7 +20,7 @@ New login runs in your own terminal (`lua auth configure`) — the plugin never
 ```
 plugins/lua-agent-builder/
 ├── .claude-plugin/plugin.json   # plugin manifest
-├── .mcp.json                    # lua-platform (local stdio) + lua-docs (https://docs.heylua.ai/mcp)
+├── .mcp.json                    # lua-platform (local stdio) + lua-docs (https://docs.heylua.ai/mcp) + ui (https://ui.lua.dev/mcp)
 ├── commands/                    # 23 slash commands
 ├── agents/                      # 10 subagents (architect, skill-builder, debug, deploy-pilot, qa, qa-cartographer, qa-player, qa-grader, qa-analyst, qa-reporter)
 ├── hooks/                       # 12 Node ESM hooks + hooks.json
@@ -80,6 +80,7 @@ plugins/lua-agent-builder/
 
 - `lua-platform` (local, `mcp/lua-platform/dist/server.js`, one self-contained bundle — no `node_modules` needed at runtime): five read-only tools — `list_agents`, `get_agent`, `list_primitive_versions`, `get_deployment_status`, `tail_logs` — over the same lua-api routes lua-cli uses, with lua-cli's credential resolution (env → `.env` → renewable session → credentials file).
 - `lua-docs` (remote, `https://docs.heylua.ai/mcp`): the public docs search (`search_lua_cli`, `query_docs_filesystem_lua_cli`).
+- `ui` (remote, `https://ui.lua.dev/mcp`, no auth): the `@lua-ai-global/ui` component catalog, a public Storybook MCP (`list-all-documentation`, `get-documentation`, `get-documentation-for-story`). The skill builder looks a component's props up here before writing web-app pages. The permission template allows the three tools one by one, never the whole server. The key is short on purpose, so every composed tool name stays within 64 characters.
 - Claude Code names a plugin's MCP tools `mcp__plugin_lua-agent-builder_<server>__<tool>`; the subagents, slashes and the permission template use that form (the plain `mcp__lua-platform__…` spelling only exists for a server you register yourself with `claude mcp add`).
 
 ## Build & test

plugins/lua-agent-builder/SECURITY.md

@@ -11,7 +11,7 @@ We aim to acknowledge within 2 business days and ship a fix within 30 days for h
 This plugin's surface includes:
 
 - **Hooks** (`hooks/*.mjs`) — run as subprocesses of Claude Code on `SessionStart`, `UserPromptSubmit`, and `Pre/PostToolUse(Bash)` events.
-- **MCP servers** — `mcp/lua-platform/dist/server.js`, a local stdio server exposing 5 read-only tools (a single self-contained bundle since 1.6.0 — its npm dependencies, `@modelcontextprotocol/sdk` included, are inlined at build time from the lockfile); it talks to `https://api.heylua.ai` over HTTPS with the user's lua-cli credential (and, for a session login, refreshes the stored refresh token at Google's securetoken endpoint exactly like lua-cli does). `lua-docs` is the public remote MCP at `https://docs.heylua.ai/mcp` (read-only docs search).
+- **MCP servers** — `mcp/lua-platform/dist/server.js`, a local stdio server exposing 5 read-only tools (a single self-contained bundle since 1.6.0 — its npm dependencies, `@modelcontextprotocol/sdk` included, are inlined at build time from the lockfile); it talks to `https://api.heylua.ai` over HTTPS with the user's lua-cli credential (and, for a session login, refreshes the stored refresh token at Google's securetoken endpoint exactly like lua-cli does). `lua-docs` is the public remote MCP at `https://docs.heylua.ai/mcp` (read-only docs search); `ui` is the public remote Storybook MCP at `https://ui.lua.dev/mcp` (read-only `@lua-ai-global/ui` component docs, no credential sent). Remote servers are pinned to those exact hosts (`scripts/lint-mcp-config.mjs`), and their tools are pre-approved one by one, never as a whole server, so a tool a host adds later still prompts (`scripts/lint-permissions.mjs`).
 - **Slash commands and subagents** (`commands/*.md`, `agents/*.md`) — Markdown prompts that Claude reads and executes.
 - **Permission rules** (`lib/permissions-template.json`) — merged into the user's `.claude/settings.json` by `/lua-doctor` Step 5 with consent.