@data-club/ai-hub-server 0.0.9 → 0.0.10

package/src/letta/index.ts

@@ -1,15 +1,18 @@
 /**
  * Public exports for the `letta/` module — the single entry point the rest
- * of the server uses to reach Letta. Per §6.4, **every Letta interaction
- * goes through `LettaClient`**; no raw HTTP, no other entry points.
- *
- * @see SPECIFICATIONS.md §6.4
+ * of the server uses to reach Letta. Every Letta interaction goes through
+ * `LettaClient` (implemented over `@data-club/letta-runtime`'s server-less
+ * local backend); no raw HTTP, no other entry points.
  */
 
 export {
   createDefaultLettaClient,
+  ForkSourceNotFoundError,
+  ServerOverloadedError,
+  type ChatTurnHandle,
   type CreateLettaClientDeps,
   type LettaClient,
+  type LettaMessage,
   type StreamUserMessageOpts,
 } from "./client.js";
 export {
@@ -22,25 +25,9 @@ export {
   type UnsequencedEvent,
 } from "./eventTranslator.js";
 export {
-  ServerOverloadedError,
   SubprocessThrottle,
   readThrottleConfigFromEnv,
   type ThrottleConfig,
   type ThrottleLease,
 } from "./subprocessThrottle.js";
-export {
-  seedAgentToolsetNone,
-  type SeedOutcome,
-  type ToolsetPreference,
-} from "./settingsFileSeed.js";
-export type {
-  LettaAssistantMessage,
-  LettaHiddenReasoningMessage,
-  LettaMessage,
-  LettaReasoningMessage,
-  LettaSdk,
-  LettaStreamEvent,
-  LettaToolCallMessage,
-  LettaToolReturnMessage,
-  LettaUserMessage,
-} from "./types.js";
+export type { SDKMessage } from "./types.js";

package/src/letta/sandbox.ts

@@ -16,8 +16,8 @@
  * @see docs/server/session-sandboxes.md
  */
 
-import { existsSync, mkdirSync } from "node:fs";
-import { cp, rm } from "node:fs/promises";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { cp, link, mkdir, readdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 
 /**
@@ -108,16 +108,150 @@ export function resolveSeedDir(filesDir: string, seedName: string): string {
 }
 
 /**
- * Recursively copies the seed folder into the (not-yet-existing) sandbox
- * target. The target's parent is created via `mkdir -p` if needed; the
- * target itself is created by `cp({ recursive: true })`. Throws on any
- * I/O failure — the caller is responsible for rolling back the just-
- * created Letta conversation if this throws.
+ * Filename of the optional per-seed materialization manifest, looked up in
+ * the seed folder's root. When absent, `materializeSandbox` behaves exactly
+ * as before (full recursive copy). The manifest itself is never
+ * materialized into the sandbox.
+ */
+export const SEED_MANIFEST_FILENAME = "seed.manifest.json";
+
+/**
+ * Parsed shape of `seed.manifest.json`.
+ *
+ * `link` — glob patterns (relative to the seed root, `/`-separated) of
+ * files to **hardlink** into the sandbox instead of copying. Intended for
+ * large read-only assets (multi-hundred-MB SQLite databases) where a
+ * per-session copy would cost seconds of latency and gigabytes of disk.
+ *
+ * Operator contract for linked files (documented in
+ * docs/server/session-sandboxes.md):
+ * - make them read-only (`chmod 444`) — a hardlink shares the inode, so a
+ *   write through any sandbox would mutate every session's view;
+ * - update them by replace-and-rename (new inode), never in place —
+ *   running sessions then keep the old data, new sessions get the new;
+ * - SQLite seeds should be in `journal_mode=DELETE` (not WAL) so read-only
+ *   opens need no `-shm`/`-wal` sidecar writes.
+ */
+export interface SeedManifest {
+  link?: string[];
+}
+
+/**
+ * Converts a manifest glob into an anchored RegExp over the seed-relative
+ * posix path. Supported syntax (deliberately minimal, dependency-free):
+ * `**` matches any depth, `*` matches within one path segment, `?` matches
+ * a single non-separator char. Everything else is literal.
+ */
+function globToRegExp(glob: string): RegExp {
+  let out = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i] as string;
+    if (ch === "*") {
+      if (glob[i + 1] === "*") {
+        out += ".*";
+        i++;
+      } else {
+        out += "[^/]*";
+      }
+    } else if (ch === "?") {
+      out += "[^/]";
+    } else {
+      out += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${out}$`);
+}
+
+/**
+ * Reads and validates the seed manifest, if present. Returns `null` when
+ * the seed has no manifest (the common case — plain full-copy seeds).
+ * Throws with an operator-actionable message on malformed JSON or shape —
+ * a broken manifest should fail session-create loudly, not silently fall
+ * back to copying a 500 MB database per session.
+ *
+ * @param seedDir - absolute seed folder path.
+ */
+export function readSeedManifest(seedDir: string): SeedManifest | null {
+  const manifestPath = join(seedDir, SEED_MANIFEST_FILENAME);
+  if (!existsSync(manifestPath)) return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+  } catch (err) {
+    throw new Error(
+      `Seed manifest is not valid JSON: ${manifestPath} (${String(err)})`,
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`Seed manifest must be a JSON object: ${manifestPath}`);
+  }
+  const linkRaw = (parsed as Record<string, unknown>).link;
+  if (linkRaw !== undefined) {
+    if (
+      !Array.isArray(linkRaw) ||
+      linkRaw.some((p) => typeof p !== "string" || p.length === 0)
+    ) {
+      throw new Error(
+        `Seed manifest "link" must be an array of non-empty glob strings: ${manifestPath}`,
+      );
+    }
+  }
+  return linkRaw === undefined ? {} : { link: linkRaw as string[] };
+}
+
+/**
+ * Recursively materializes one directory level of the seed into the
+ * sandbox: entries whose seed-relative path matches a `link` glob are
+ * hardlinked (zero-copy, instant — seeds and sandboxes live under the same
+ * `AI_HUB_FILES_DIR`, hence the same filesystem); everything else is
+ * copied. A hardlink attempt that fails with `EXDEV` (cross-device — some
+ * exotic bind-mount layout) degrades to a copy rather than failing the
+ * session.
+ */
+async function materializeWithManifest(
+  seedDir: string,
+  targetDir: string,
+  relDir: string,
+  linkMatchers: RegExp[],
+): Promise<void> {
+  const srcDir = relDir === "" ? seedDir : join(seedDir, relDir);
+  const dstDir = relDir === "" ? targetDir : join(targetDir, relDir);
+  await mkdir(dstDir, { recursive: true });
+  const entries = await readdir(srcDir, { withFileTypes: true });
+  for (const entry of entries) {
+    const rel = relDir === "" ? entry.name : `${relDir}/${entry.name}`;
+    if (rel === SEED_MANIFEST_FILENAME) continue;
+    if (entry.isDirectory()) {
+      await materializeWithManifest(seedDir, targetDir, rel, linkMatchers);
+      continue;
+    }
+    const src = join(seedDir, rel);
+    const dst = join(targetDir, rel);
+    if (entry.isFile() && linkMatchers.some((m) => m.test(rel))) {
+      try {
+        await link(src, dst);
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code !== "EXDEV") throw err;
+        await cp(src, dst);
+      }
+      continue;
+    }
+    // Non-linked files and symlinks: same per-entry semantics as the
+    // full-copy path below.
+    await cp(src, dst, { errorOnExist: false });
+  }
+}
+
+/**
+ * Materializes the seed folder into the (not-yet-existing) sandbox target.
  *
- * Symlinks in the seed are followed (`{ verbatimSymlinks: false }` is
- * Node's default). Permissions are preserved. The implementation uses
- * `fs.promises.cp` so it's a single syscall sequence per file with no
- * intermediate I/O on our side.
+ * Without a `seed.manifest.json` in the seed root this is a full recursive
+ * copy — byte-for-byte the pre-manifest behavior. With a manifest, files
+ * matching its `link` globs are hardlinked instead of copied (see
+ * {@link SeedManifest}); the manifest file itself is skipped.
+ *
+ * Throws on any I/O failure — the caller is responsible for rolling back
+ * the just-created Letta conversation if this throws.
  *
  * @param seedDir - source folder (must exist).
  * @param targetDir - destination folder (must NOT exist).
@@ -129,6 +263,12 @@ export async function materializeSandbox(
   if (!existsSync(seedDir)) {
     throw new Error(`Seed folder does not exist on disk: ${seedDir}`);
   }
+  const manifest = readSeedManifest(seedDir);
+  if (manifest !== null) {
+    const linkMatchers = (manifest.link ?? []).map(globToRegExp);
+    await materializeWithManifest(seedDir, targetDir, "", linkMatchers);
+    return;
+  }
   // `recursive: true` + `errorOnExist: false` matches `cp -R` semantics —
   // if `targetDir` somehow already exists (impossible in the happy path
   // since session ids are fresh UUIDs, but cheap to be safe), the

package/src/letta/types.ts

@@ -1,65 +1,14 @@
 /**
  * Project-shaped Letta types.
  *
- * Re-exports only the SDK surfaces ai-hub uses, so the rest of the server
- * code never has to traverse `@letta-ai/letta-client`'s deep namespace
- * structure. **No raw HTTP, ever** — these are aliases over the SDK's own
- * types, not parallel inventions (§6.4).
- *
- * If the SDK rev removes or renames one of these, the typechecker flags it
- * at upgrade time and `letta/client.ts` is the single place to adapt.
- *
- * @see SPECIFICATIONS.md §6.4 — SDK-only access pattern
- * @see SPECIFICATIONS.md §6.4.1 — first-class surfaces we depend on
- */
-
-import type Letta from "@letta-ai/letta-client";
-import type {
-  AssistantMessage,
-  HiddenReasoningMessage,
-  Message as LettaSdkMessage,
-  ReasoningMessage,
-  ToolCallMessage,
-  UserMessage,
-} from "@letta-ai/letta-client/resources/agents/messages.js";
-import type { LettaStreamingResponse } from "@letta-ai/letta-client/resources/agents/messages.js";
-import type { ToolReturnMessage } from "@letta-ai/letta-client/resources/tools.js";
-
-/**
- * The underlying SDK client. We `import type` everywhere except in
- * `letta/client.ts` (where the constructor actually runs) so the rest of the
- * codebase stays SDK-version-agnostic in shape.
- */
-export type LettaSdk = Letta;
-
-/**
- * One streaming event from `client.conversations.messages.create({ streaming: true })`.
- *
- * The union spans every variant Letta emits in an SSE stream — assistant
- * text, reasoning, tool calls, tool returns, errors, pings, stop reasons,
- * usage stats. `letta/eventTranslator.ts` is the pure function from this
- * union to ai-hub's wire-protocol events (§9).
- *
- * @see SPECIFICATIONS.md §9 — wire protocol
- */
-export type LettaStreamEvent = LettaStreamingResponse;
-
-/**
- * Alias for `AssistantMessage` — used by the translator + tests. See
- * `letta/eventTranslator.ts` for the streamed-delta vs. cumulative-content
- * note.
+ * Post-migration (server-less local backend), the message shape comes from
+ * `@data-club/letta-runtime` — the fork's `messages list` subcommand prints
+ * the backend's Letta-format records verbatim, and `LettaMessageRecord`
+ * types the fields AI Hub's renderers actually read. The old
+ * `@letta-ai/letta-client` aliases are gone with the server.
  */
-export type LettaAssistantMessage = AssistantMessage;
-/** Alias for `ReasoningMessage` — see `eventTranslator.ts`. */
-export type LettaReasoningMessage = ReasoningMessage;
-/** Alias for `HiddenReasoningMessage` — see `eventTranslator.ts`. */
-export type LettaHiddenReasoningMessage = HiddenReasoningMessage;
-/** Alias for `ToolCallMessage` — see `eventTranslator.ts`. */
-export type LettaToolCallMessage = ToolCallMessage;
-/** Alias for `ToolReturnMessage` — see `eventTranslator.ts`. */
-export type LettaToolReturnMessage = ToolReturnMessage;
-/** Alias for `UserMessage` — only appears in history reads, not in streams. */
-export type LettaUserMessage = UserMessage;
 
-/** Full assembled Letta message (used by `messages.list`). */
-export type LettaMessage = LettaSdkMessage;
+export type {
+  LettaMessageRecord as LettaMessage,
+  SDKMessage,
+} from "@data-club/letta-runtime";

package/src/observability/logger.ts

@@ -46,8 +46,6 @@ const REDACT_PATHS: ReadonlyArray<string> = [
   "*.Authorization",
   "service_token_signing_key",
   "serviceTokenSigningKey",
-  "letta_api_key",
-  "lettaApiKey",
   "metrics_scrape_token",
   "metricsScrapeToken",
   "encryption_key",

package/src/routes/admin/agents.ts

@@ -39,7 +39,6 @@ import {
 } from "../../handlers/responses.js";
 import type { AIHubServerContext, RouteHandler } from "../../handlers/types.js";
 import { seedDirExists, validateSeedName } from "../../letta/sandbox.js";
-import { seedAgentToolsetNone } from "../../letta/settingsFileSeed.js";
 
 /* ────────────────────────────────────────────────────────────────────────── */
 /*  Helpers                                                                   */
@@ -247,42 +246,6 @@ function respondSpecializedFailure(
   }
 }
 
-/**
- * Best-effort seed of `~/.letta/settings.json` with `{toolset: "none"}` for
- * the given Letta agent id. Idempotent. Logs the outcome but **does not
- * throw**: if seeding fails (read-only home dir, permission denied, …) the
- * agent creation should still succeed — the toolset suppression is then
- * a runtime concern the operator notices when chats start producing weird
- * file-edit tool calls. The intent here is hands-off automation, not a
- * required precondition.
- *
- * @param ctx - server context (for logging).
- * @param lettaAgentId - id to seed the toolset preference for.
- *
- * @see ../../letta/settingsFileSeed.ts
- */
-function seedToolsetNoneBestEffort(
-  ctx: AIHubServerContext,
-  lettaAgentId: string,
-): void {
-  try {
-    seedAgentToolsetNone({
-      agentId: lettaAgentId,
-      lettaBaseUrl: process.env.LETTA_BASE_URL,
-      logger: ctx.logger,
-    });
-  } catch (err) {
-    ctx.logger.warn(
-      {
-        agent_id: lettaAgentId,
-        err: err instanceof Error ? err.message : String(err),
-        event: "letta_code_settings_seed_failed",
-      },
-      "Failed to seed Letta Code toolset preference; continuing anyway.",
-    );
-  }
-}
-
 /* ────────────────────────────────────────────────────────────────────────── */
 /*  GET /admin/agents                                                         */
 /* ────────────────────────────────────────────────────────────────────────── */
@@ -415,12 +378,6 @@ export const handleCreateAgent: RouteHandler = protectedRoute(
     const row = ctx.db.select().from(agent).where(eq(agent.id, id)).get();
     if (!row) throw new Error("Just-inserted agent vanished.");
 
-    // Seed `~/.letta/settings.json` so Letta Code's bundled CLI suppresses
-    // its auto-toolset (Read/Write/Bash/etc.) when chat sessions spawn
-    // against this agent. ai-hub wants only the tools the ADE admin
-    // explicitly attached. Best-effort: a write failure logs + continues.
-    seedToolsetNoneBestEffort(ctx, row.lettaAgentId);
-
     ctx.logger.info(
       {
         actor_id: auth.user.id,
@@ -553,12 +510,6 @@ export const handlePatchAgent: RouteHandler = protectedRoute(
     // remove the old agent's seeded record — it may still be backing live
     // sessions per the §11 schema note: existing sessions keep their
     // original `letta_conversation_id` against the original Letta agent.)
-    if (
-      body.letta_agent_id !== undefined &&
-      body.letta_agent_id !== existing.lettaAgentId
-    ) {
-      seedToolsetNoneBestEffort(ctx, body.letta_agent_id);
-    }
 
     ctx.logger.info(
       {

package/src/routes/admin/settings.ts

@@ -3,13 +3,10 @@
  *
  * Five endpoints:
  *
- * - `GET    /admin/settings` — Letta connection (api key **masked**), theme,
- *   metrics + signing-key rotation timestamps. Encrypted Letta API key
- *   surfaces only as `letta_api_key_masked` (`••••••••<last4>`); plaintext
- *   never leaves the server outside the `Reveal once` flow (Step 12).
- * - `PATCH  /admin/settings` — body `{ letta_base_url?, letta_ade_url?, letta_api_key?, theme?: { default?, switcher_enabled? } }`.
- *   API key, when supplied, is encrypted under `AI_HUB_ENCRYPTION_KEY`. Theme
- *   fields live as **separate columns**, not in `feature_toggles`.
+ * - `GET    /admin/settings` — theme / language / agents settings plus
+ *   metrics + signing-key rotation timestamps.
+ * - `PATCH  /admin/settings` — body `{ theme?: { default?, switcher_enabled? }, language?, agents? }`.
+ *   Theme fields live as **separate columns**, not in `feature_toggles`.
  * - `GET    /admin/settings/feature-toggles` — flat JSON blob from §8.4.
  * - `PATCH  /admin/settings/feature-toggles` — merge-patch the same blob.
  *   Unknown keys are accepted (forward-compat for future toggles).
@@ -36,7 +33,6 @@ import { randomBytes } from "node:crypto";
 import { eq } from "drizzle-orm";
 import { z } from "zod";
 
-import { encryptString } from "../../auth/encryption.js";
 import { protectedRoute } from "../../auth/middleware.js";
 import { adminSetting } from "../../db/schema.js";
 import type { AdminSettingRow } from "../../db/schema.js";
@@ -56,60 +52,6 @@ function nowIso(): string {
   return new Date().toISOString();
 }
 
-/**
- * Computes a privacy-preserving display of the encrypted Letta API key.
- *
- * Per [08-admin-settings.md], the UI shows `••••••••` while the value is in
- * the field — operators reveal-once if they need to copy. The server's
- * `GET /admin/settings` never returns plaintext.
- *
- * @param row - the admin_setting row.
- * @returns a masked string, or `null` when no key is stored.
- */
-function maskLettaApiKey(row: AdminSettingRow): string | null {
-  if (!row.lettaApiKeyEncrypted) return null;
-  // We can't decrypt without the key, and decrypting just to show "<last 4>"
-  // would defeat the purpose of encrypting at rest. Use a constant placeholder
-  // so the UI knows a key is configured without revealing length / contents.
-  return "••••••••";
-}
-
-/** Possible sources for the effective Letta API key at runtime. */
-type LettaApiKeySource = "db" | "env" | "none";
-
-/**
- * Determines the *effective* source of the Letta API key at this moment.
- * Mirrors `letta/client.ts:resolveApiKey` (DB → env → throw) so the admin
- * UI can show the truth about which source the runtime will use, not just
- * what's stored in the DB.
- *
- * Returning the SOURCE — not the value — keeps plaintext off the wire.
- *
- * @param row - the admin_setting row (may be missing).
- * @param envSource - env-var record from the server context. Lets tests
- *   exercise the source-resolution without touching the real `process.env`.
- * @returns `"db"` when DB column has a non-empty value (the runtime will
- *   use it); `"env"` when DB is empty AND `LETTA_API_KEY` in `envSource`
- *   is set and non-empty; `"none"` otherwise.
- */
-function resolveApiKeySource(
-  row: AdminSettingRow | null,
-  envSource: Record<string, string | undefined>,
-): LettaApiKeySource {
-  // We deliberately can't tell here whether the DB-encrypted bytes decrypt
-  // to a non-whitespace string without doing the decrypt — but the rule is
-  // "non-empty bytes ⇒ candidate." The runtime resolver does the actual
-  // whitespace check; the UI source is just "is there a DB value worth
-  // showing?" The mismatch (DB has whitespace-only after decrypt) is rare
-  // enough that we don't pay the cost of decrypting here just to detect
-  // it; `letta_api_key_set` aligned with `lettaApiKeyEncrypted IS NOT NULL`
-  // matches the existing PATCH semantics (we never write whitespace).
-  if (row?.lettaApiKeyEncrypted) return "db";
-  const envKey = envSource.LETTA_API_KEY;
-  if (envKey && envKey.trim().length > 0) return "env";
-  return "none";
-}
-
 /**
  * Reads the singleton admin-settings row. Throws if the row hasn't been
  * seeded — should not happen after first-boot.
@@ -130,27 +72,8 @@ function readSettings(ctx: {
  * @param row - the admin_setting row.
  * @returns the JSON-safe response shape.
  */
-function settingsView(
-  row: AdminSettingRow,
-  envSource: Record<string, string | undefined>,
-): Record<string, unknown> {
-  const source = resolveApiKeySource(row, envSource);
+function settingsView(row: AdminSettingRow): Record<string, unknown> {
   return {
-    letta_base_url: row.lettaBaseUrl ?? null,
-    letta_ade_url: row.lettaAdeUrl ?? null,
-    letta_api_key_masked: maskLettaApiKey(row),
-    // True when EITHER the DB column is populated OR env.LETTA_API_KEY is
-    // set — matches the runtime resolver's "is the chat path going to
-    // work?" answer. The admin UI uses this to decide whether to render a
-    // "configured" badge vs. a "missing" warning, regardless of which
-    // source supplies the value.
-    letta_api_key_set: source !== "none",
-    // Source the runtime is *currently* using (per resolveApiKey precedence
-    // in letta/client.ts). Drives the admin UI's source-indicator text —
-    // "(from env)" vs "(from admin panel)" vs "(not configured)" — so
-    // operators don't get confused when the DB row is empty but chat
-    // still works (env fallback) or vice versa.
-    letta_api_key_source: source,
     theme: {
       default: row.themeDefault,
       switcher_enabled: row.themeSwitcherEnabled,
@@ -179,11 +102,6 @@ function settingsView(
 /**
  * `GET /admin/settings` — super_admin-only deployment configuration.
  *
- * Encrypted Letta API key surfaces only as the masked placeholder
- * (`letta_api_key_masked: "••••••••"`) + the boolean `letta_api_key_set`;
- * plaintext never leaves the server through this endpoint. Step 12 wires the
- * `Reveal once` flow as a separate UI affordance.
- *
  * @see SPECIFICATIONS.md §6.3.4
  * @see ui-sketches/08-admin-settings.md
  */
@@ -192,7 +110,7 @@ export const handleGetSettings: RouteHandler = protectedRoute(
   async (_req, ctx) => {
     const row = readSettings(ctx);
     if (!row) return internalError("Admin settings row is missing — server misconfigured.");
-    return jsonResponse(200, settingsView(row, ctx.envSource));
+    return jsonResponse(200, settingsView(row));
   },
 );
 
@@ -203,16 +121,6 @@ export const handleGetSettings: RouteHandler = protectedRoute(
 /** Body for `PATCH /admin/settings`. Every field optional; empty body is a no-op. */
 const patchSettingsSchema = z
   .object({
-    letta_base_url: z.string().url().nullable().optional(),
-    letta_ade_url: z.string().url().nullable().optional(),
-    // The API key accepts:
-    //   - a non-empty string → encrypt + store; runtime will use this DB
-    //     value over env on the next request.
-    //   - an empty/whitespace string → clear the DB column to NULL; the
-    //     runtime then falls back to env.LETTA_API_KEY (the operator-spec'd
-    //     "if admin panel is empty, use env" precedence).
-    //   - omitted → no change.
-    letta_api_key: z.string().max(2048).optional(),
     theme: z
       .object({
         default: z.enum(["light", "dark"]).optional(),
@@ -241,9 +149,8 @@ const patchSettingsSchema = z
 /**
  * `PATCH /admin/settings` — partial update of deployment configuration.
  *
- * The Letta API key, when supplied, is encrypted under
- * `AI_HUB_ENCRYPTION_KEY` (env-only) before write. Theme fields live as
- * separate columns (`theme_default`, `theme_switcher_enabled`) per §8.4.
+ * Theme fields live as separate columns (`theme_default`,
+ * `theme_switcher_enabled`) per §8.4.
  *
  * @see SPECIFICATIONS.md §6.3.4
  * @see SPECIFICATIONS.md §8.4 — theme settings are explicit columns
@@ -264,17 +171,6 @@ export const handlePatchSettings: RouteHandler = protectedRoute(
     const body = parsed.data;
 
     const update: Partial<typeof adminSetting.$inferInsert> = { updatedAt: nowIso() };
-    if (body.letta_base_url !== undefined) update.lettaBaseUrl = body.letta_base_url;
-    if (body.letta_ade_url !== undefined) update.lettaAdeUrl = body.letta_ade_url;
-    if (body.letta_api_key !== undefined) {
-      // Empty / whitespace-only string clears the DB column to NULL. The
-      // runtime then falls back to env.LETTA_API_KEY (see
-      // letta/client.ts:resolveApiKey). Non-empty values are encrypted +
-      // stored as the operator's override of env.
-      const trimmed = body.letta_api_key.trim();
-      update.lettaApiKeyEncrypted =
-        trimmed.length === 0 ? null : encryptString(ctx.encryptionKey, body.letta_api_key);
-    }
     if (body.theme?.default !== undefined) update.themeDefault = body.theme.default;
     if (body.theme?.switcher_enabled !== undefined)
       update.themeSwitcherEnabled = body.theme.switcher_enabled;
@@ -305,7 +201,7 @@ export const handlePatchSettings: RouteHandler = protectedRoute(
 
     const fresh = readSettings(ctx);
     if (!fresh) return internalError();
-    return jsonResponse(200, settingsView(fresh, ctx.envSource));
+    return jsonResponse(200, settingsView(fresh));
   },
 );
 

package/src/routes/auth.ts

@@ -384,10 +384,6 @@ export const handleLogout: RouteHandler = protectedRoute({}, async () => {
 /**
  * `GET /auth/me` — returns the `{ user, deployment }` envelope.
  *
- * `deployment.letta_ade_url` is included only for callers with role >=
- * `power_user` (handled inside `buildDeploymentView`); `user`-role callers
- * don't even see the field exists — by design (§6.3.4).
- *
  * The resolved theme is computed client-side from
  * `user.theme_preference + deployment.{theme_default, theme_switcher_enabled}`
  * per §7.6 — the server does not pre-compute it.
@@ -493,7 +489,7 @@ export const handleMePreferences: RouteHandler = protectedRoute(
       .get();
     return jsonResponse(200, {
       user: buildUserView(freshRow),
-      deployment: buildDeploymentView(settings ?? null, freshRow.role),
+      deployment: buildDeploymentView(settings ?? null),
     });
   },
 );