feat(decisions): /lua-decisions, /lua-new decision and the decisions knowledge file (1.10.0)

[johnmicheal-lua]

Plugin 1.10.0: the Decisions primitive, shipped in lua-cli 3.48.0 and rounded out in 3.49.2 (--model, OpenRouter ids), gets its slash command, its scaffold and its knowledge file.

What a user gets

• /lua-decisions [list | versions <name> | run <name> | publish <name> <version> | delete <name>]. run takes --message or --state, plus --provider, --model <id> (any of the thirteen decision models: Jev, OpenAI, eleven through OpenRouter) and --min-confidence, and reports every answer by type with provider, dated model id, rule, duration, tokens, cache status and cost. Reads and runs go at once; publish and delete confirm once through the Bash prompt (--force, because the CLI's own y/N cannot be answered from a slash).
• /lua-new decision <name>: the builder writes src/decisions/<name>.ts with literal questions (the only shape the compiler reads), registers it in decisions: [...], compiles, reads the manifest back and names the push and publish steps.
• lib/knowledge/decisions.md: builders and limits, result shape, routing (what auto picks, when a fallback runs, why a pinned provider never switches), the OpenRouter rules, the LuaDecision lifecycle, verbs with aliases and exit codes, error codes, sharing and caching, the decisions log source, billing.

Permissions: lua decisions list|versions|run allowed, publish|delete ask; lua push decision rides the generic push allow because a push stages only. Not in the tokenizer: publishing a decision version is agent configuration, not a deploy. Mirror test rows added.

Also: /lua-logs documents --type decisions; the debug subagent reads DecisionError by code; primitives.md §16 and decision-trees.md route judgment calls to Decisions.ask / LuaDecision; cli-reference.md gains the lua decisions row and the two docs pages; version 1.10.0 in the three manifests and the MCP server stamps.

Checks: npm run lint passes (the knowledge-commands check skips without the monorepo beside it, as on main); npm test 68 suites, 2072 tests pass.

Opened from a fork: the author's account has no push access to this repository.

[johnmicheal-lua]

@richard-lua could you review and, if it looks right, merge and cut 1.10.0? CI is green across the MCP job and the six plugin matrix jobs. I can't add you as a reviewer from this account (no write access on this repo), hence the mention.

[rares04]

Code review — HIGH risk

I cannot complete a substantive review because the code diff for plugins/lua-agent-builder/lib/permissions-template.json was not included in the context.

Major

• plugins/lua-agent-builder/lib/permissions-template.json: Unverified Permission Scope. Changes to permission templates are high-risk. Please share the diff so I can verify that glob patterns are sufficiently restrictive and do not allow arbitrary code execution or access to sensitive directories.

---

_{PR Risk Reviewer — automated senior review of b53c50c · risk: high · confidence: 0.10}

[lua-code-reviewer]

Code review: Needs a human · high risk

What to do next: the reviewer cannot judge this change, so it neither approves it nor asks for changes. Read the reasons below; a person who owns this area decides.

Review for @johnmicheal-lua, requested through the code-reviewer team.

A person needs to make this call. The reviewer will not approve it:

• Review confidence 0.80 is below the high-risk bar of 0.85.
• What clears it: a person approves it, or the author adds the context that makes it checkable (a test that exercises the change, or a PR description of what it changes and why it is safe) and re-requests the code-reviewer team.

Summary

Plugin 1.10.0 adds the /lua-decisions command, the decision type in /lua-new, a decisions knowledge file and permission rules: list, versions and run are allowed, publish and delete ask. Version stamps are bumped consistently across the manifests, the MCP server, the API client header and the lockfile. The permission rules are spelled per verb, so a mutation can never ride an allow glob, and the mirror test gains allow and ask rows for every command shape the slash emits. Nothing removes or narrows a contract.

Checks: no concerns (6 passed, 2 did not apply).

Checklist detail

Checklist

correctness	tests	security	data	billing	performance	repo rules	compat
pass	pass	pass	n/a	pass	n/a	pass	pass

Tests (from reading the code, not a run): the tests cover the change, and they would likely fail without it. test/lib/permissions-mirror.test.mjs adds allow rows (decisions list/versions/run including the --model and --provider overrides, logs --type decisions, push decision) and ask rows (decisions publish/delete --force). These fail without the new rules in permissions-template.json. The api-client test pins X-Lua-Client to the package.json version, which covers the version bump.

Compatibility across versions: no concerns.

Contracts and consumers

Surfaces touched: service client.
Consumer search: nothing to search for.

Advisory (1, not blocking)

• plugins/lua-agent-builder/lib/permissions-template.json:125 Mutation aliases of lua decisions are not in ask — Only the canonical publish and delete are in the ask tier. The aliases rollback, deploy, rm, remove and del are in no list. Today they fall to Claude Code's default prompt (or a denial in -p mode), which is safe. However, nothing pins that behaviour if a user has a broader allow rule in their own settings. Fix: Add ask rows for lua decisions rollback|deploy|rm|remove|del * and mirror them in permissions-mirror.test.mjs, as was done for the device aliases.

_{Automated review by lua-code-reviewer[bot]. Every new push is reviewed again automatically. To have this head reviewed again, request the code-reviewer team as a reviewer.}

Machine data (for the fleet)

Reviewed head b53c50c54952 (round 1) · CI: green · confidence 0.80 · model: anthropic/claude-opus-5-5

Compatibility across versions

item	status	evidence
Mixed-version safety	pass	permissions-template.json only adds allow and ask entries. On lua-cli below 3.48.0, lua decisions exits 1 'unknown command' as documented in decisions.md; no existing rule changes.
Caches and serialized data	n/a
Idempotency of new writes	n/a

[selcuk-lua]

Code review — LOW risk

This 1.10.0 release adds the Decisions primitive as documentation, a new /lua-decisions slash command, a /lua-new decision scaffold path, and permission-template rules. The security-sensitive change (permission template) follows the existing per-verb allow/ask discipline — list|versions|run allowed, publish|delete in ask, lua push decision riding the generic staged-push allow — and is mirrored in permissions-mirror.test.mjs. Nothing here changes production-gate behavior or adds a tokenizer bypass. Safe to merge; one minor consistency note.

Minor

• plugins/lua-agent-builder/lib/permissions-template.json:23 — Bash(lua decisions list*) is unanchored (no trailing space/--) unlike the sibling versions * / run * rules, so it would match any future lua decisions list… verb. No current exploit since no such verb exists, but it diverges from the per-verb spelling the template otherwise enforces. Anchor it (e.g. Bash(lua decisions list) + Bash(lua decisions list --*)) and add a mirror-test assertion.

Note: the generated mcp/lua-platform/dist/server.js bundle and lockfile/version bumps were not reviewable in full here (binary/oversized), and 8 lower-risk files were omitted — confidence reflects that.

---

_{PR Risk Reviewer — automated senior review of b53c50c · risk: low · confidence: 0.82}

[richard-lua]

Code review — LOW risk

This is a well-scoped documentation + permissions release adding the Decisions primitive (/lua-decisions, /lua-new decision, decisions.md, version bump to 1.10.0). The only security-sensitive change is the permission template, and it correctly follows the established contract: lua decisions list|versions|run in allow, publish/delete in ask (per-verb spellings, not a blanket Bash(lua decisions *) that would admit delete), lua push decision riding the generic staged-push allow, and nothing added to the tokenizer. The additions are mirrored in permissions-mirror.test.mjs (both the allowed read forms and the asked mutation forms), which is the project's guard against shadowing regressions.

No findings. The change introduces no new executable logic, the permission rules are consistent with the documented precedence (deny → ask → allow) and covered by tests, and the MCP dist/server.js delta is only a version-string bump. The --force flag on publish/delete is intentional and justified (the Bash prompt is the single confirmation), consistent with the existing devices/drains patterns.

---

_{PR Risk Reviewer — automated senior review of b53c50c · risk: low · confidence: 0.80}