[lua-stefan-kruger]

What

Ships live build session mode on main as 1.17.0, and brings the builder's prompts up to lua-cli 3.62.0 lua test / lua push / lua compile behaviour. Part of LUA-1855: Lua session pods pin the unmerged feat/lbs/plugin-session-mode head (6444a92, plugin.json 1.14.0) because main has no hooks/session-guard.mjs, and the Job tier pins 1.12.0. Once this is released as v1.17.0, a lua-core-services PR moves both pins to that tag's commit.

Commits

1. Merge feat/lbs/plugin-session-mode into main (1.16.0). I used a merge rather than a rebase, so the commit the pods pin today stays in the history. There were four conflicts:
   • inject-context.mjs: keeps both the 1.16.0 /lua-audit offer and the session line.
   • The two READMEs: counts now read 25 commands, 11 subagents and 16 hooks, and the knowledge list includes browser and build-session.
   • CHANGELOG: the "Unreleased (planned 1.15.0)" session entry becomes 1.17.0.
2. Session mode as 1.17.0.
   • Every session-mode "1.15.0" now reads 1.17.0, because 1.15.0 and 1.16.0 shipped as the browser and /lua-audit releases.
   • /lua-audit and /lua-browser are new on main since the branch was cut, so they get their ## Build session sections. session-docs.test.mjs failed without them.
     • /lua-audit: the lua-auditor playbook runs inline and stays read-only.
     • /lua-browser: browsers list runs directly. browser read|run and browsers delete go through request_action, because the shared B23 table classes them as approval.
   • I checked the vendored lib/session-commands.mjs against shared-types on lua-core-services main. Since the vendored commit, the table only gained --operations and the build-session rows, and both are already here.
3. lua-cli 3.62.0 in the prompts (lua-skill-builder, lua-debug, /lua-test, cli-reference.md §4, primitives.md §14/§23/§24, build-session.md, the session brief, USER_GUIDE):
   • lua test --ci never prompts. A missing kind, --name, or tool --input exits 2 and lists what exists. --name <skill> exits 2 and lists that skill's tools. The builder always passes --name <tool> and --input ('{}' for a tool with no fields). The old "picker exits 0 having tested nothing" text stays as the below-3.62.0 note.
   • Offline doubles. These run with --offline or LUA_TEST_DOUBLES, and are always on in a session. The docs list which families they cover. The builder adds --offline for a tool that writes or sends. The /lua-test live-data gate for web-app write routes is unchanged.
   • lua compile type-checks. By default a type error is a warning. --strict-types / --no-type-check / LUA_TYPE_CHECK change that, and in a session a type error always fails the compile. Strict skill tools also apply: a string in tools is an error. The builder fixes reported type errors in its compile loop.
   • lua push <kind> <name> is documented. The plugin keeps emitting --name.
   • Session brief and build-session.md. They now say there is no lua new command and no lua-docs program; sessions tried both. They also name lua integrations info, because lua-cli has no inspect.
   • Version markers. lua-cli 3.62.0 is not on npm yet (newest is 3.61.1), so every new behaviour is marked ⏳ 3.62.0.
4. Release 1.17.0. Bumps package.json, plugin.json, marketplace.json, the MCP package and lock, and the client/server metadata, and rebuilds dist/server.js.

Tests

Run in plugins/lua-agent-builder:

• npm ci && npm run lint: all 18 checks ✓.
• npm test -- --coverage: 72 suites, 2545 tests passed.
• node scripts/check-coverage.mjs ✓
• lint-knowledge-commands, run against lua-cli 3.62.0 source (LUA_CLI_SRC=<lua-core-services main>/packages/lua-cli): 1312 references check out. CI skips this check because it has no monorepo.

Run in mcp/lua-platform:

• npm ci && npm test: 149 passed.
• npm run build, with the committed dist/ matching the build.
• check-bundle-size ✓

Merge

main needs one approving review, and auto-merge is off in this repo. I'll merge (squash, like #28) once it is approved. release-prod then cuts v1.17.0.

🤖 Generated with Claude Code

[lua-stefan-kruger]

@selcuk-lua @rares04 could one of you review this? It brings the plugin's session-mode branch onto main, and updates the lua-cli guidance for 3.62.0 (lua test skill --ci --name <tool> --input, lua push <kind> <name>, the type check in lua compile, and offline doubles in sessions). It unblocks LUA-1855: the pod images can then move off plugin 1.14.0 and 1.12.0. All CI checks pass.

[selcuk-lua]

Code review — MEDIUM risk

This PR introduces live build session mode (LUA_BUILD_SESSION=1) — a vendored command classifier, a session-mode decision library, new SessionStart/PreToolUse/PostToolUse hooks, extensive knowledge docs, and a 1.17.0 release bump with lua-cli 3.62.0 prompt updates. The reviewed security-sensitive files are well-structured and exceptionally well-tested (2545 tests; explicit invariants that session mode never removes a block and that flags-off behavior is byte-identical). The code correctly positions itself as defense-in-depth — its own comments name the :8092 Lua-API proxy as the real boundary. No exploitable flaw was found in the reviewed code; the findings are advisory. Note only 7 of 69 changed files were available for review, which bounds confidence.

Minor

• plugins/lua-agent-builder/lib/session-commands.mjs:1 — The classification table is a hand-maintained mirror of a private shared-types source pinned to commit 7c53151b…, synced via a manual "port the change here" process and a parity fixture that only checks copied rows. New upstream verbs/aliases fail closed to approval/high (safe), but a verb upstream reclassifies to a stricter class stays misclassified until a human syncs. Add a CI check that flags when the vendored commit lags upstream, or generate the table at build time.
• plugins/lua-agent-builder/lib/session-commands.mjs:214 — The marketplace.read gate guesses the verb slot via pos[1] ?? pos[0], which is fragile for lua marketplace skill/template <id> bare forms. The destructive/mutating post-checks and existing tests mitigate the dangerous cases, but make the (noun, verb) grammar explicit and add fixtures for the bare-id forms.
• plugins/lua-agent-builder/lib/session-mode.mjs:260 — untrustedOutputNote appends an UNTRUSTED DATA banner after the tool result rather than fencing it (a documented PostToolUse limitation). Prompt-injection defense for third-party-writable runtime text therefore relies on model compliance plus the proxy. Acceptable as belt-and-suspenders; ensure the proxy-side fence is the tracked authoritative control and never relied on solely via this banner.

---

_{PR Risk Reviewer — automated senior review of cbb35c1 · risk: medium · confidence: 0.62}