@letta-ai/letta-code 0.19.0 → 0.19.1

package/letta.js

@@ -3240,7 +3240,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@letta-ai/letta-code",
-    version: "0.19.0",
+    version: "0.19.1",
     description: "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
     type: "module",
     bin: {
@@ -5612,10 +5612,13 @@ function getStringField(obj, field) {
   return typeof val === "string" ? val : undefined;
 }
 function parseFrontmatter(content) {
+  const normalized = content.replace(/^\uFEFF/, "").replace(/\r\n/g, `
+`).replace(/\r/g, `
+`);
   const frontmatterRegex = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/;
-  const match = content.match(frontmatterRegex);
+  const match = normalized.match(frontmatterRegex);
   if (!match || !match[1] || !match[2]) {
-    return { frontmatter: {}, body: content };
+    return { frontmatter: {}, body: normalized };
   }
   const frontmatterText = match[1];
   const body = match[2];
@@ -7359,6 +7362,71 @@ var init_models2 = __esm(() => {
           parallel_tool_calls: true
         }
       },
+      {
+        id: "gpt-5.4-mini-plus-pro-none",
+        handle: "chatgpt-plus-pro/gpt-5.4-mini",
+        label: "GPT-5.4 Mini (ChatGPT)",
+        description: "GPT-5.4 Mini (no reasoning) via ChatGPT Plus/Pro",
+        updateArgs: {
+          reasoning_effort: "none",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-mini-plus-pro-low",
+        handle: "chatgpt-plus-pro/gpt-5.4-mini",
+        label: "GPT-5.4 Mini (ChatGPT)",
+        description: "GPT-5.4 Mini (low reasoning) via ChatGPT Plus/Pro",
+        updateArgs: {
+          reasoning_effort: "low",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-mini-plus-pro-medium",
+        handle: "chatgpt-plus-pro/gpt-5.4-mini",
+        label: "GPT-5.4 Mini (ChatGPT)",
+        description: "GPT-5.4 Mini (med reasoning) via ChatGPT Plus/Pro",
+        updateArgs: {
+          reasoning_effort: "medium",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-mini-plus-pro-high",
+        handle: "chatgpt-plus-pro/gpt-5.4-mini",
+        label: "GPT-5.4 Mini (ChatGPT)",
+        description: "GPT-5.4 Mini (high reasoning) via ChatGPT Plus/Pro",
+        updateArgs: {
+          reasoning_effort: "high",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-mini-plus-pro-xhigh",
+        handle: "chatgpt-plus-pro/gpt-5.4-mini",
+        label: "GPT-5.4 Mini (ChatGPT)",
+        description: "GPT-5.4 Mini (max reasoning) via ChatGPT Plus/Pro",
+        updateArgs: {
+          reasoning_effort: "xhigh",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
       {
         id: "gpt-5.3-codex-plus-pro-none",
         handle: "chatgpt-plus-pro/gpt-5.3-codex",
@@ -7920,6 +7988,137 @@ var init_models2 = __esm(() => {
           parallel_tool_calls: true
         }
       },
+      {
+        id: "gpt-5.4-mini-none",
+        handle: "openai/gpt-5.4-mini",
+        label: "GPT-5.4 Mini",
+        description: "Fast, efficient GPT-5.4 variant (no reasoning)",
+        updateArgs: {
+          reasoning_effort: "none",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-mini-low",
+        handle: "openai/gpt-5.4-mini",
+        label: "GPT-5.4 Mini",
+        description: "Fast, efficient GPT-5.4 variant (low reasoning)",
+        updateArgs: {
+          reasoning_effort: "low",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-mini-medium",
+        handle: "openai/gpt-5.4-mini",
+        label: "GPT-5.4 Mini",
+        description: "Fast, efficient GPT-5.4 variant (med reasoning)",
+        isFeatured: true,
+        updateArgs: {
+          reasoning_effort: "medium",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-mini-high",
+        handle: "openai/gpt-5.4-mini",
+        label: "GPT-5.4 Mini",
+        description: "Fast, efficient GPT-5.4 variant (high reasoning)",
+        updateArgs: {
+          reasoning_effort: "high",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-mini-xhigh",
+        handle: "openai/gpt-5.4-mini",
+        label: "GPT-5.4 Mini",
+        description: "Fast, efficient GPT-5.4 variant (max reasoning)",
+        updateArgs: {
+          reasoning_effort: "xhigh",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-nano-none",
+        handle: "openai/gpt-5.4-nano",
+        label: "GPT-5.4 Nano",
+        description: "Smallest, cheapest GPT-5.4 variant (no reasoning)",
+        updateArgs: {
+          reasoning_effort: "none",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-nano-low",
+        handle: "openai/gpt-5.4-nano",
+        label: "GPT-5.4 Nano",
+        description: "Smallest, cheapest GPT-5.4 variant (low reasoning)",
+        updateArgs: {
+          reasoning_effort: "low",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-nano-medium",
+        handle: "openai/gpt-5.4-nano",
+        label: "GPT-5.4 Nano",
+        description: "Smallest, cheapest GPT-5.4 variant (med reasoning)",
+        updateArgs: {
+          reasoning_effort: "medium",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-nano-high",
+        handle: "openai/gpt-5.4-nano",
+        label: "GPT-5.4 Nano",
+        description: "Smallest, cheapest GPT-5.4 variant (high reasoning)",
+        updateArgs: {
+          reasoning_effort: "high",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
+      {
+        id: "gpt-5.4-nano-xhigh",
+        handle: "openai/gpt-5.4-nano",
+        label: "GPT-5.4 Nano",
+        description: "Smallest, cheapest GPT-5.4 variant (max reasoning)",
+        updateArgs: {
+          reasoning_effort: "xhigh",
+          verbosity: "low",
+          context_window: 272000,
+          max_output_tokens: 128000,
+          parallel_tool_calls: true
+        }
+      },
       {
         id: "gpt-5.3-codex-none",
         handle: "openai/gpt-5.3-codex",
@@ -39700,944 +39899,6 @@ var init_planName = __esm(() => {
   ];
 });
 
-// src/permissions/readOnlyShell.ts
-import { homedir as homedir8 } from "node:os";
-import { resolve as resolve2 } from "node:path";
-function splitShellSegments(input) {
-  const segments = [];
-  let current = "";
-  let i = 0;
-  let quote = null;
-  while (i < input.length) {
-    const ch = input[i];
-    if (!ch) {
-      i += 1;
-      continue;
-    }
-    if (quote === "single") {
-      current += ch;
-      if (ch === "'") {
-        quote = null;
-      }
-      i += 1;
-      continue;
-    }
-    if (quote === "double") {
-      if (ch === "\\" && i + 1 < input.length) {
-        current += input.slice(i, i + 2);
-        i += 2;
-        continue;
-      }
-      if (ch === "`" || input.startsWith("$(", i)) {
-        return null;
-      }
-      current += ch;
-      if (ch === '"') {
-        quote = null;
-      }
-      i += 1;
-      continue;
-    }
-    if (ch === "'") {
-      quote = "single";
-      current += ch;
-      i += 1;
-      continue;
-    }
-    if (ch === '"') {
-      quote = "double";
-      current += ch;
-      i += 1;
-      continue;
-    }
-    if (input.startsWith(">>", i) || ch === ">") {
-      return null;
-    }
-    if (ch === "`" || input.startsWith("$(", i)) {
-      return null;
-    }
-    if (input.startsWith("&&", i)) {
-      segments.push(current);
-      current = "";
-      i += 2;
-      continue;
-    }
-    if (input.startsWith("||", i)) {
-      segments.push(current);
-      current = "";
-      i += 2;
-      continue;
-    }
-    if (ch === ";") {
-      segments.push(current);
-      current = "";
-      i += 1;
-      continue;
-    }
-    if (ch === "|") {
-      segments.push(current);
-      current = "";
-      i += 1;
-      continue;
-    }
-    current += ch;
-    i += 1;
-  }
-  segments.push(current);
-  return segments.map((segment) => segment.trim()).filter(Boolean);
-}
-function isReadOnlyShellCommand(command, options = {}) {
-  if (!command) {
-    return false;
-  }
-  if (Array.isArray(command)) {
-    if (command.length === 0) {
-      return false;
-    }
-    const joined = command.join(" ");
-    const [executable, ...rest] = command;
-    if (executable && isShellExecutor(executable)) {
-      const nested = extractDashCArgument(rest);
-      if (!nested) {
-        return false;
-      }
-      return isReadOnlyShellCommand(nested, options);
-    }
-    return isReadOnlyShellCommand(joined, options);
-  }
-  const trimmed = command.trim();
-  if (!trimmed) {
-    return false;
-  }
-  const segments = splitShellSegments(trimmed);
-  if (!segments || segments.length === 0) {
-    return false;
-  }
-  for (const segment of segments) {
-    if (!isSafeSegment(segment, options)) {
-      return false;
-    }
-  }
-  return true;
-}
-function isSafeSegment(segment, options) {
-  const tokens = tokenize4(segment);
-  if (tokens.length === 0) {
-    return false;
-  }
-  const command = tokens[0];
-  if (!command) {
-    return false;
-  }
-  if (isShellExecutor(command)) {
-    const nested = extractDashCArgument(tokens.slice(1));
-    if (!nested) {
-      return false;
-    }
-    return isReadOnlyShellCommand(stripQuotes(nested), options);
-  }
-  if (ALWAYS_SAFE_COMMANDS.has(command)) {
-    if (command === "cd") {
-      if (options.allowExternalPaths) {
-        return true;
-      }
-      return !tokens.slice(1).some((t) => hasAbsoluteOrTraversalPathArg(t));
-    }
-    const hasExternalPath = !options.allowExternalPaths && tokens.slice(1).some((t) => hasAbsoluteOrTraversalPathArg(t));
-    if (hasExternalPath) {
-      return false;
-    }
-    return true;
-  }
-  if (command === "sed") {
-    const usesInPlace = tokens.some((token) => token === "-i" || token.startsWith("-i") || token === "--in-place");
-    if (usesInPlace) {
-      return false;
-    }
-    const hasExternalPath = !options.allowExternalPaths && tokens.slice(1).some((t) => hasAbsoluteOrTraversalPathArg(t));
-    if (hasExternalPath) {
-      return false;
-    }
-    return true;
-  }
-  if (command === "git") {
-    const subcommand = tokens[1];
-    if (!subcommand) {
-      return false;
-    }
-    return SAFE_GIT_SUBCOMMANDS.has(subcommand);
-  }
-  if (command === "gh") {
-    const category = tokens[1];
-    if (!category) {
-      return false;
-    }
-    if (!(category in SAFE_GH_COMMANDS)) {
-      return false;
-    }
-    const allowedActions = SAFE_GH_COMMANDS[category];
-    if (allowedActions === null) {
-      return true;
-    }
-    if (allowedActions === undefined) {
-      return false;
-    }
-    const action = tokens[2];
-    if (!action) {
-      return false;
-    }
-    return allowedActions.has(action);
-  }
-  if (command === "letta") {
-    const group = tokens[1];
-    if (!group) {
-      return false;
-    }
-    if (!(group in SAFE_LETTA_COMMANDS)) {
-      return false;
-    }
-    const action = tokens[2];
-    if (!action) {
-      return false;
-    }
-    return SAFE_LETTA_COMMANDS[group]?.has(action) ?? false;
-  }
-  if (command === "find") {
-    return !/-delete|\s-exec\b/.test(segment);
-  }
-  if (command === "sort") {
-    return !/\s-o\b/.test(segment);
-  }
-  return false;
-}
-function isShellExecutor(command) {
-  return command === "bash" || command === "sh";
-}
-function tokenize4(segment) {
-  const matches = segment.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g);
-  if (!matches) {
-    return [];
-  }
-  return matches.map((token) => stripQuotes(token));
-}
-function stripQuotes(value) {
-  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-    return value.slice(1, -1);
-  }
-  return value;
-}
-function extractDashCArgument(tokens) {
-  for (let i = 0;i < tokens.length; i += 1) {
-    const token = tokens[i];
-    if (!token) {
-      continue;
-    }
-    if (token === "-c" || token === "-lc" || /^-[a-zA-Z]*c$/.test(token)) {
-      return tokens[i + 1];
-    }
-  }
-  return;
-}
-function isAbsolutePathArg(value) {
-  if (!value) {
-    return false;
-  }
-  if (value.startsWith("/")) {
-    return true;
-  }
-  return /^[a-zA-Z]:[\\/]/.test(value) || value.startsWith("\\\\");
-}
-function isHomeAnchoredPathArg(value) {
-  if (!value) {
-    return false;
-  }
-  return value.startsWith("~/") || value.startsWith("$HOME/") || value.startsWith("%USERPROFILE%\\") || value.startsWith("%USERPROFILE%/");
-}
-function hasAbsoluteOrTraversalPathArg(value) {
-  if (isAbsolutePathArg(value) || isHomeAnchoredPathArg(value)) {
-    return true;
-  }
-  return /(^|[\\/])\.\.([\\/]|$)/.test(value);
-}
-function getAllowedMemoryPrefixes(agentId) {
-  const home = homedir8();
-  const prefixes = [
-    normalizeSeparators(resolve2(home, ".letta", "agents", agentId, "memory")),
-    normalizeSeparators(resolve2(home, ".letta", "agents", agentId, "memory-worktrees"))
-  ];
-  const parentId = process.env.LETTA_PARENT_AGENT_ID;
-  if (parentId && parentId !== agentId) {
-    prefixes.push(normalizeSeparators(resolve2(home, ".letta", "agents", parentId, "memory")), normalizeSeparators(resolve2(home, ".letta", "agents", parentId, "memory-worktrees")));
-  }
-  return prefixes;
-}
-function normalizeSeparators(p) {
-  return p.replace(/\\/g, "/");
-}
-function expandPath(p) {
-  const home = homedir8();
-  if (p.startsWith("~/")) {
-    return normalizeSeparators(resolve2(home, p.slice(2)));
-  }
-  if (p.startsWith("$HOME/")) {
-    return normalizeSeparators(resolve2(home, p.slice(6)));
-  }
-  if (p.startsWith('"$HOME/')) {
-    return normalizeSeparators(resolve2(home, p.slice(7).replace(/"$/, "")));
-  }
-  return normalizeSeparators(resolve2(p));
-}
-function isUnderMemoryDir(path3, prefixes) {
-  const resolved = expandPath(path3);
-  return prefixes.some((prefix) => resolved === prefix || resolved.startsWith(`${prefix}/`));
-}
-function extractCdTarget(segment) {
-  const tokens = tokenize4(segment);
-  if (tokens[0] === "cd" && tokens[1]) {
-    return tokens[1];
-  }
-  return null;
-}
-function isMemoryDirCommand(command, agentId) {
-  if (!command || !agentId) {
-    return false;
-  }
-  const commandStr = typeof command === "string" ? command : command.join(" ");
-  const trimmed = commandStr.trim();
-  if (!trimmed) {
-    return false;
-  }
-  const prefixes = getAllowedMemoryPrefixes(agentId);
-  const segments = trimmed.split(/&&|\|\||;/).map((s) => s.trim()).filter(Boolean);
-  if (segments.length === 0) {
-    return false;
-  }
-  let cwd2 = null;
-  for (const segment of segments) {
-    const pipeParts = segment.split(/\|/).map((s) => s.trim()).filter(Boolean);
-    for (const part of pipeParts) {
-      const cdTarget = extractCdTarget(part);
-      if (cdTarget) {
-        const resolved = cwd2 ? expandPath(resolve2(expandPath(cwd2), cdTarget)) : expandPath(cdTarget);
-        if (!isUnderMemoryDir(resolved, prefixes)) {
-          return false;
-        }
-        cwd2 = resolved;
-        continue;
-      }
-      if (cwd2 && isUnderMemoryDir(cwd2, prefixes)) {
-        const tokens2 = tokenize4(part);
-        const currentCwd = cwd2;
-        if (!currentCwd) {
-          return false;
-        }
-        const hasExternalPath = tokens2.some((t) => {
-          if (isAbsolutePathArg(t) || isHomeAnchoredPathArg(t)) {
-            return !isUnderMemoryDir(t, prefixes);
-          }
-          if (hasAbsoluteOrTraversalPathArg(t)) {
-            const resolved = expandPath(resolve2(expandPath(currentCwd), t));
-            return !isUnderMemoryDir(resolved, prefixes);
-          }
-          return false;
-        });
-        if (hasExternalPath) {
-          return false;
-        }
-        if (!MEMORY_DIR_APPROVE_ALL) {
-          const cmd = tokens2[0];
-          if (!cmd || !SAFE_MEMORY_DIR_COMMANDS.has(cmd)) {
-            return false;
-          }
-        }
-        continue;
-      }
-      const tokens = tokenize4(part);
-      const hasMemoryPath = tokens.some((t) => t.includes(".letta/agents/") && t.includes("/memory") || t.includes(".letta/agents/") && t.includes("/memory-worktrees"));
-      if (hasMemoryPath) {
-        const agentPaths = tokens.filter((t) => t.includes(".letta/agents/"));
-        if (agentPaths.every((p) => isUnderMemoryDir(p, prefixes))) {
-          if (!MEMORY_DIR_APPROVE_ALL) {
-            const cmd = tokens[0];
-            if (!cmd || !SAFE_MEMORY_DIR_COMMANDS.has(cmd)) {
-              return false;
-            }
-          }
-          continue;
-        }
-      }
-      return false;
-    }
-  }
-  return true;
-}
-var MEMORY_DIR_APPROVE_ALL = true, SAFE_MEMORY_DIR_COMMANDS, ALWAYS_SAFE_COMMANDS, SAFE_GIT_SUBCOMMANDS, SAFE_LETTA_COMMANDS, SAFE_GH_COMMANDS;
-var init_readOnlyShell = __esm(() => {
-  SAFE_MEMORY_DIR_COMMANDS = new Set([
-    "git",
-    "rm",
-    "mv",
-    "mkdir",
-    "cp",
-    "ls",
-    "cat",
-    "head",
-    "tail",
-    "tree",
-    "find",
-    "wc",
-    "split",
-    "echo",
-    "sort",
-    "cd"
-  ]);
-  ALWAYS_SAFE_COMMANDS = new Set([
-    "cat",
-    "head",
-    "tail",
-    "less",
-    "more",
-    "grep",
-    "rg",
-    "ag",
-    "ack",
-    "fgrep",
-    "egrep",
-    "ls",
-    "tree",
-    "file",
-    "stat",
-    "du",
-    "df",
-    "wc",
-    "diff",
-    "cmp",
-    "comm",
-    "cut",
-    "tr",
-    "nl",
-    "column",
-    "fold",
-    "pwd",
-    "whoami",
-    "hostname",
-    "date",
-    "uname",
-    "uptime",
-    "id",
-    "echo",
-    "printf",
-    "env",
-    "printenv",
-    "which",
-    "whereis",
-    "type",
-    "basename",
-    "dirname",
-    "realpath",
-    "readlink",
-    "jq",
-    "yq",
-    "strings",
-    "xxd",
-    "hexdump",
-    "cd"
-  ]);
-  SAFE_GIT_SUBCOMMANDS = new Set([
-    "status",
-    "diff",
-    "log",
-    "show",
-    "branch",
-    "tag",
-    "remote"
-  ]);
-  SAFE_LETTA_COMMANDS = {
-    memfs: new Set(["status", "help", "backups", "export"]),
-    agents: new Set(["list", "help"]),
-    messages: new Set(["search", "list", "help"]),
-    blocks: new Set(["list", "help"])
-  };
-  SAFE_GH_COMMANDS = {
-    pr: new Set(["list", "status", "checks", "diff", "view"]),
-    issue: new Set(["list", "status", "view"]),
-    repo: new Set(["list", "view", "gitignore", "license"]),
-    run: new Set(["list", "view", "watch", "download"]),
-    release: new Set(["list", "view", "download"]),
-    search: null,
-    api: null,
-    status: null
-  };
-});
-
-// src/permissions/shell-command-normalization.ts
-function trimMatchingQuotes(value) {
-  const trimmed = value.trim();
-  if (trimmed.length < 2) {
-    return trimmed;
-  }
-  const first = trimmed[0];
-  const last = trimmed[trimmed.length - 1];
-  if ((first === '"' || first === "'") && last === first) {
-    return trimmed.slice(1, -1);
-  }
-  return trimmed;
-}
-function normalizeExecutableToken(token) {
-  const normalized = trimMatchingQuotes(token).replace(/\\/g, "/");
-  const parts = normalized.split("/").filter(Boolean);
-  const executable = parts[parts.length - 1] ?? normalized;
-  return executable.toLowerCase();
-}
-function tokenizeShell(input) {
-  const tokens = [];
-  let current = "";
-  let quote = null;
-  let escaping = false;
-  const flush = () => {
-    if (current.length > 0) {
-      tokens.push(current);
-      current = "";
-    }
-  };
-  for (let i = 0;i < input.length; i += 1) {
-    const ch = input[i];
-    if (ch === undefined) {
-      continue;
-    }
-    if (escaping) {
-      current += ch;
-      escaping = false;
-      continue;
-    }
-    if (ch === "\\" && quote !== "single") {
-      escaping = true;
-      continue;
-    }
-    if (quote === "single") {
-      if (ch === "'") {
-        quote = null;
-      } else {
-        current += ch;
-      }
-      continue;
-    }
-    if (quote === "double") {
-      if (ch === '"') {
-        quote = null;
-      } else {
-        current += ch;
-      }
-      continue;
-    }
-    if (ch === "'") {
-      quote = "single";
-      continue;
-    }
-    if (ch === '"') {
-      quote = "double";
-      continue;
-    }
-    if (/\s/.test(ch)) {
-      flush();
-      continue;
-    }
-    current += ch;
-  }
-  if (escaping) {
-    current += "\\";
-  }
-  flush();
-  return tokens;
-}
-function isDashCFlag(token) {
-  return token === "-c" || /^-[a-zA-Z]*c[a-zA-Z]*$/.test(token);
-}
-function extractInnerShellCommand(tokens) {
-  if (tokens.length === 0) {
-    return null;
-  }
-  let index = 0;
-  if (normalizeExecutableToken(tokens[0] ?? "") === "env") {
-    index += 1;
-    while (index < tokens.length) {
-      const token = tokens[index] ?? "";
-      if (!token) {
-        index += 1;
-        continue;
-      }
-      if (/^-[A-Za-z]+$/.test(token)) {
-        index += 1;
-        continue;
-      }
-      if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) {
-        index += 1;
-        continue;
-      }
-      break;
-    }
-  }
-  const executableToken = tokens[index];
-  if (!executableToken) {
-    return null;
-  }
-  if (!SHELL_EXECUTORS.has(normalizeExecutableToken(executableToken))) {
-    return null;
-  }
-  for (let i = index + 1;i < tokens.length; i += 1) {
-    const token = tokens[i];
-    if (!token) {
-      continue;
-    }
-    if (!isDashCFlag(token)) {
-      continue;
-    }
-    const innerCommand = tokens[i + 1];
-    if (!innerCommand) {
-      return null;
-    }
-    return trimMatchingQuotes(innerCommand);
-  }
-  return null;
-}
-function unwrapShellLauncherCommand(command) {
-  let current = command.trim();
-  for (let depth = 0;depth < 5; depth += 1) {
-    if (!current) {
-      break;
-    }
-    const tokens = tokenizeShell(current);
-    const inner = extractInnerShellCommand(tokens);
-    if (!inner || inner === current) {
-      break;
-    }
-    current = inner.trim();
-  }
-  return current;
-}
-function normalizeBashRulePayload(payload) {
-  const trimmed = payload.trim();
-  if (!trimmed) {
-    return "";
-  }
-  const hasWildcardSuffix = trimmed.endsWith(":*");
-  const withoutWildcard = hasWildcardSuffix ? trimmed.slice(0, -2).trimEnd() : trimmed;
-  const unwrapped = unwrapShellLauncherCommand(withoutWildcard);
-  if (hasWildcardSuffix) {
-    return `${unwrapped}:*`;
-  }
-  return unwrapped;
-}
-var SHELL_EXECUTORS;
-var init_shell_command_normalization = __esm(() => {
-  SHELL_EXECUTORS = new Set(["bash", "sh", "zsh", "dash", "ksh"]);
-});
-
-// src/permissions/mode.ts
-var exports_mode = {};
-__export(exports_mode, {
-  permissionMode: () => permissionMode
-});
-import { homedir as homedir9 } from "node:os";
-import { isAbsolute, join as join9, relative as relative2, resolve as resolve3 } from "node:path";
-function getGlobalMode() {
-  const global2 = globalThis;
-  if (!global2[MODE_KEY]) {
-    global2[MODE_KEY] = "default";
-  }
-  return global2[MODE_KEY];
-}
-function setGlobalMode(value) {
-  const global2 = globalThis;
-  global2[MODE_KEY] = value;
-}
-function getGlobalPlanFilePath() {
-  const global2 = globalThis;
-  return global2[PLAN_FILE_KEY] || null;
-}
-function setGlobalPlanFilePath(value) {
-  const global2 = globalThis;
-  global2[PLAN_FILE_KEY] = value;
-}
-function getGlobalModeBeforePlan() {
-  const global2 = globalThis;
-  return global2[MODE_BEFORE_PLAN_KEY] ?? null;
-}
-function setGlobalModeBeforePlan(value) {
-  const global2 = globalThis;
-  global2[MODE_BEFORE_PLAN_KEY] = value;
-}
-function resolvePlanTargetPath(targetPath, workingDirectory) {
-  const trimmedPath = targetPath.trim();
-  if (!trimmedPath)
-    return null;
-  if (trimmedPath.startsWith("~/")) {
-    return resolve3(homedir9(), trimmedPath.slice(2));
-  }
-  if (isAbsolute(trimmedPath)) {
-    return resolve3(trimmedPath);
-  }
-  return resolve3(workingDirectory, trimmedPath);
-}
-function isPathInPlansDir(path3, plansDir) {
-  if (!path3.endsWith(".md"))
-    return false;
-  const rel = relative2(plansDir, path3);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
-}
-function extractApplyPatchPaths(input) {
-  const paths = [];
-  const fileDirectivePattern = /\*\*\* (?:Add|Update|Delete) File:\s*(.+)/g;
-  const moveDirectivePattern = /\*\*\* Move to:\s*(.+)/g;
-  for (const match of input.matchAll(fileDirectivePattern)) {
-    const matchPath = match[1]?.trim();
-    if (matchPath)
-      paths.push(matchPath);
-  }
-  for (const match of input.matchAll(moveDirectivePattern)) {
-    const matchPath = match[1]?.trim();
-    if (matchPath)
-      paths.push(matchPath);
-  }
-  return paths;
-}
-function stripMatchingQuotes(value) {
-  const trimmed = value.trim();
-  if (trimmed.length < 2) {
-    return trimmed;
-  }
-  const first = trimmed[0];
-  const last = trimmed[trimmed.length - 1];
-  if ((first === '"' || first === "'") && last === first) {
-    return trimmed.slice(1, -1);
-  }
-  return trimmed;
-}
-function extractPlanFileWritePathFromShellCommand(command) {
-  if (!command) {
-    return null;
-  }
-  const commandString = typeof command === "string" ? command : command.join(" ") ?? "";
-  const normalizedCommand = unwrapShellLauncherCommand(commandString).trim();
-  if (!normalizedCommand) {
-    return null;
-  }
-  const lines = normalizedCommand.split(/\r?\n/);
-  const firstLine = lines[0]?.trim() ?? "";
-  if (!firstLine) {
-    return null;
-  }
-  const firstLineMatch = firstLine.match(/^cat\s+(?:>\s*(?<path1>"[^"]+"|'[^']+'|\S+)\s+<<-?\s*(?<delim1>"[^"]+"|'[^']+'|\S+)|<<-?\s*(?<delim2>"[^"]+"|'[^']+'|\S+)\s+>\s*(?<path2>"[^"]+"|'[^']+'|\S+))\s*$/);
-  if (!firstLineMatch?.groups) {
-    return null;
-  }
-  const rawPath = firstLineMatch.groups.path1 || firstLineMatch.groups.path2;
-  const rawDelim = firstLineMatch.groups.delim1 || firstLineMatch.groups.delim2;
-  if (!rawPath || !rawDelim) {
-    return null;
-  }
-  const delimiter = stripMatchingQuotes(rawDelim);
-  if (!delimiter) {
-    return null;
-  }
-  let terminatorLine = -1;
-  for (let i = 1;i < lines.length; i += 1) {
-    if ((lines[i] ?? "") === delimiter) {
-      terminatorLine = i;
-      break;
-    }
-  }
-  if (terminatorLine === -1) {
-    return null;
-  }
-  for (let i = terminatorLine + 1;i < lines.length; i += 1) {
-    if ((lines[i] ?? "").trim().length > 0) {
-      return null;
-    }
-  }
-  return stripMatchingQuotes(rawPath);
-}
-
-class PermissionModeManager {
-  get currentMode() {
-    return getGlobalMode();
-  }
-  set currentMode(value) {
-    setGlobalMode(value);
-  }
-  setMode(mode) {
-    const prevMode = this.currentMode;
-    if (mode === "plan" && prevMode !== "plan") {
-      setGlobalModeBeforePlan(prevMode);
-    }
-    this.currentMode = mode;
-    if (mode !== "plan") {
-      setGlobalPlanFilePath(null);
-    }
-    if (prevMode === "plan" && mode !== "plan") {
-      setGlobalModeBeforePlan(null);
-    }
-  }
-  getModeBeforePlan() {
-    return getGlobalModeBeforePlan();
-  }
-  getMode() {
-    return this.currentMode;
-  }
-  setPlanFilePath(path3) {
-    setGlobalPlanFilePath(path3);
-  }
-  getPlanFilePath() {
-    return getGlobalPlanFilePath();
-  }
-  checkModeOverride(toolName, toolArgs, workingDirectory = process.cwd()) {
-    switch (this.currentMode) {
-      case "bypassPermissions":
-        return "allow";
-      case "acceptEdits":
-        if ([
-          "Write",
-          "Edit",
-          "MultiEdit",
-          "NotebookEdit",
-          "apply_patch",
-          "replace",
-          "write_file"
-        ].includes(toolName)) {
-          return "allow";
-        }
-        return null;
-      case "plan": {
-        const allowedInPlan = [
-          "Read",
-          "Glob",
-          "Grep",
-          "NotebookRead",
-          "TodoWrite",
-          "ExitPlanMode",
-          "exit_plan_mode",
-          "AskUserQuestion",
-          "ask_user_question",
-          "read_file",
-          "list_dir",
-          "grep_files",
-          "update_plan",
-          "task_output",
-          "ReadFile",
-          "ListDir",
-          "GrepFiles",
-          "UpdatePlan",
-          "TaskOutput",
-          "read_file_gemini",
-          "glob_gemini",
-          "list_directory",
-          "search_file_content",
-          "write_todos",
-          "read_many_files",
-          "ReadFileGemini",
-          "GlobGemini",
-          "ListDirectory",
-          "SearchFileContent",
-          "WriteTodos",
-          "ReadManyFiles"
-        ];
-        const writeTools = [
-          "Write",
-          "Edit",
-          "MultiEdit",
-          "apply_patch",
-          "ApplyPatch",
-          "write_file_gemini",
-          "WriteFileGemini",
-          "replace",
-          "Replace"
-        ];
-        if (allowedInPlan.includes(toolName)) {
-          return "allow";
-        }
-        if (writeTools.includes(toolName)) {
-          const plansDir = join9(homedir9(), ".letta", "plans");
-          const targetPath = toolArgs?.file_path || toolArgs?.path;
-          let candidatePaths = [];
-          if ((toolName === "ApplyPatch" || toolName === "apply_patch") && toolArgs?.input) {
-            const input = toolArgs.input;
-            candidatePaths = extractApplyPatchPaths(input);
-          } else if (typeof targetPath === "string") {
-            candidatePaths = [targetPath];
-          }
-          if (candidatePaths.length > 0 && candidatePaths.every((path3) => {
-            const resolvedPath = resolvePlanTargetPath(path3, workingDirectory);
-            return resolvedPath ? isPathInPlansDir(resolvedPath, plansDir) : false;
-          })) {
-            return "allow";
-          }
-        }
-        const readOnlySubagentTypes = new Set([
-          "explore",
-          "Explore",
-          "plan",
-          "Plan",
-          "recall",
-          "Recall"
-        ]);
-        if (toolName === "Task" || toolName === "task") {
-          const subagentType = toolArgs?.subagent_type;
-          if (subagentType && readOnlySubagentTypes.has(subagentType)) {
-            return "allow";
-          }
-        }
-        if (toolName === "Skill" || toolName === "skill") {
-          return "allow";
-        }
-        const shellTools = [
-          "Bash",
-          "shell",
-          "Shell",
-          "shell_command",
-          "ShellCommand",
-          "run_shell_command",
-          "RunShellCommand",
-          "run_shell_command_gemini",
-          "RunShellCommandGemini"
-        ];
-        if (shellTools.includes(toolName)) {
-          const command = toolArgs?.command;
-          if (command && isReadOnlyShellCommand(command, { allowExternalPaths: true })) {
-            return "allow";
-          }
-          const planWritePath = extractPlanFileWritePathFromShellCommand(command);
-          if (planWritePath) {
-            const plansDir = join9(homedir9(), ".letta", "plans");
-            const resolvedPath = resolvePlanTargetPath(planWritePath, workingDirectory);
-            if (resolvedPath && isPathInPlansDir(resolvedPath, plansDir)) {
-              return "allow";
-            }
-          }
-        }
-        return "deny";
-      }
-      case "default":
-        return null;
-      default:
-        return null;
-    }
-  }
-  reset() {
-    this.currentMode = "default";
-    setGlobalPlanFilePath(null);
-    setGlobalModeBeforePlan(null);
-  }
-}
-var MODE_KEY, PLAN_FILE_KEY, MODE_BEFORE_PLAN_KEY, permissionMode;
-var init_mode = __esm(() => {
-  init_readOnlyShell();
-  init_shell_command_normalization();
-  MODE_KEY = Symbol.for("@letta/permissionMode");
-  PLAN_FILE_KEY = Symbol.for("@letta/planFilePath");
-  MODE_BEFORE_PLAN_KEY = Symbol.for("@letta/permissionModeBeforePlan");
-  permissionMode = new PermissionModeManager;
-});
-
 // src/queue/queueRuntime.ts
 function isCoalescable(kind) {
   return kind === "message" || kind === "task_notification";
@@ -41104,8 +40365,8 @@ import {
   statSync as statSync2,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { join as join10, normalize as normalize3, relative as relative3, sep as sep2 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { join as join9, normalize as normalize3, relative as relative2, sep as sep2 } from "node:path";
 function normalizeParent2(relativePath) {
   if (relativePath.length === 0) {
     return "";
@@ -41296,7 +40557,7 @@ async function buildDirectory2(dir, relativePath, entries, merkle, statsMap, pre
       continue;
     }
     try {
-      const childStat = statSync2(join10(dir, entry));
+      const childStat = statSync2(join9(dir, entry));
       childNames.push(entry);
       childStatsMap.set(entry, childStat);
     } catch {}
@@ -41321,14 +40582,14 @@ async function buildDirectory2(dir, relativePath, entries, merkle, statsMap, pre
       break;
     }
     if (context2.newEntryCount > 0 && context2.newEntryCount % 500 === 0) {
-      await new Promise((resolve5) => setImmediate(resolve5));
+      await new Promise((resolve3) => setImmediate(resolve3));
     }
     const entryStat = childStatsMap.get(entry);
     if (!entryStat) {
       continue;
     }
-    const fullPath = join10(dir, entry);
-    const entryPath = relative3(process.cwd(), fullPath);
+    const fullPath = join9(dir, entry);
+    const entryPath = relative2(process.cwd(), fullPath);
     if (!entryPath) {
       continue;
     }
@@ -41394,9 +40655,9 @@ function sanitizeWorkspacePath2(workspacePath) {
   return sanitized.length === 0 ? "workspace" : sanitized;
 }
 function getProjectStorageDir2() {
-  const homeDir = homedir10();
+  const homeDir = homedir8();
   const sanitizedWorkspace = sanitizeWorkspacePath2(process.cwd());
-  return join10(homeDir, ".letta", "projects", sanitizedWorkspace);
+  return join9(homeDir, ".letta", "projects", sanitizedWorkspace);
 }
 function ensureProjectStorageDir2() {
   const storageDir = getProjectStorageDir2();
@@ -41406,7 +40667,7 @@ function ensureProjectStorageDir2() {
   return storageDir;
 }
 function getProjectIndexPath2() {
-  return join10(getProjectStorageDir2(), PROJECT_INDEX_FILENAME2);
+  return join9(getProjectStorageDir2(), PROJECT_INDEX_FILENAME2);
 }
 function loadCachedIndex2() {
   const indexPath = getProjectIndexPath2();
@@ -41451,7 +40712,7 @@ function loadCachedIndex2() {
 function cacheProjectIndex2(result) {
   try {
     const storageDir = ensureProjectStorageDir2();
-    const indexPath = join10(storageDir, PROJECT_INDEX_FILENAME2);
+    const indexPath = join9(storageDir, PROJECT_INDEX_FILENAME2);
     const payload = {
       metadata: {
         rootHash: result.rootHash
@@ -42026,7 +41287,7 @@ async function executeCommandHook(hook, input, workingDirectory = process.cwd())
   };
 }
 function executeWithLauncher(launcher, inputJson, workingDirectory, input, timeout, command, startTime) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve3, reject) => {
     let stdout = "";
     let stderr = "";
     let timedOut = false;
@@ -42053,7 +41314,7 @@ function executeWithLauncher(launcher, inputJson, workingDirectory, input, timeo
 `);
           console.log(`\x1B[90m${indented}\x1B[0m`);
         }
-        resolve5(result);
+        resolve3(result);
       }
     };
     let child;
@@ -42214,12 +41475,12 @@ var init_executor = __esm(async () => {
 });
 
 // src/hooks/loader.ts
-import { homedir as homedir11 } from "node:os";
-import { resolve as resolve5 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { resolve as resolve3 } from "node:path";
 function isProjectSettingsPathCollidingWithGlobal(workingDirectory) {
-  const home = process.env.HOME || homedir11();
-  const globalSettingsPath = resolve5(home, ".letta", "settings.json");
-  const projectSettingsPath = resolve5(workingDirectory, ".letta", "settings.json");
+  const home = process.env.HOME || homedir9();
+  const globalSettingsPath = resolve3(home, ".letta", "settings.json");
+  const projectSettingsPath = resolve3(workingDirectory, ".letta", "settings.json");
   return globalSettingsPath === projectSettingsPath;
 }
 function loadGlobalHooks() {
@@ -42604,6 +41865,946 @@ var init_hooks = __esm(async () => {
   init_types();
 });
 
+// src/permissions/readOnlyShell.ts
+import { homedir as homedir10 } from "node:os";
+import { resolve as resolve4 } from "node:path";
+function splitShellSegments(input) {
+  const segments = [];
+  let current = "";
+  let i = 0;
+  let quote = null;
+  while (i < input.length) {
+    const ch = input[i];
+    if (!ch) {
+      i += 1;
+      continue;
+    }
+    if (quote === "single") {
+      current += ch;
+      if (ch === "'") {
+        quote = null;
+      }
+      i += 1;
+      continue;
+    }
+    if (quote === "double") {
+      if (ch === "\\" && i + 1 < input.length) {
+        current += input.slice(i, i + 2);
+        i += 2;
+        continue;
+      }
+      if (ch === "`" || input.startsWith("$(", i)) {
+        return null;
+      }
+      current += ch;
+      if (ch === '"') {
+        quote = null;
+      }
+      i += 1;
+      continue;
+    }
+    if (ch === "'") {
+      quote = "single";
+      current += ch;
+      i += 1;
+      continue;
+    }
+    if (ch === '"') {
+      quote = "double";
+      current += ch;
+      i += 1;
+      continue;
+    }
+    if (input.startsWith(">>", i) || ch === ">") {
+      return null;
+    }
+    if (ch === "`" || input.startsWith("$(", i)) {
+      return null;
+    }
+    if (input.startsWith("&&", i)) {
+      segments.push(current);
+      current = "";
+      i += 2;
+      continue;
+    }
+    if (input.startsWith("||", i)) {
+      segments.push(current);
+      current = "";
+      i += 2;
+      continue;
+    }
+    if (ch === ";") {
+      segments.push(current);
+      current = "";
+      i += 1;
+      continue;
+    }
+    if (ch === "|") {
+      segments.push(current);
+      current = "";
+      i += 1;
+      continue;
+    }
+    current += ch;
+    i += 1;
+  }
+  segments.push(current);
+  return segments.map((segment) => segment.trim()).filter(Boolean);
+}
+function isReadOnlyShellCommand(command, options = {}) {
+  if (!command) {
+    return false;
+  }
+  if (Array.isArray(command)) {
+    if (command.length === 0) {
+      return false;
+    }
+    const joined = command.join(" ");
+    const [executable, ...rest] = command;
+    if (executable && isShellExecutor(executable)) {
+      const nested = extractDashCArgument(rest);
+      if (!nested) {
+        return false;
+      }
+      return isReadOnlyShellCommand(nested, options);
+    }
+    return isReadOnlyShellCommand(joined, options);
+  }
+  const trimmed = command.trim();
+  if (!trimmed) {
+    return false;
+  }
+  const segments = splitShellSegments(trimmed);
+  if (!segments || segments.length === 0) {
+    return false;
+  }
+  for (const segment of segments) {
+    if (!isSafeSegment(segment, options)) {
+      return false;
+    }
+  }
+  return true;
+}
+function isSafeSegment(segment, options) {
+  const tokens = tokenize4(segment);
+  if (tokens.length === 0) {
+    return false;
+  }
+  const command = tokens[0];
+  if (!command) {
+    return false;
+  }
+  if (isShellExecutor(command)) {
+    const nested = extractDashCArgument(tokens.slice(1));
+    if (!nested) {
+      return false;
+    }
+    return isReadOnlyShellCommand(stripQuotes(nested), options);
+  }
+  if (ALWAYS_SAFE_COMMANDS.has(command)) {
+    if (command === "cd") {
+      if (options.allowExternalPaths) {
+        return true;
+      }
+      return !tokens.slice(1).some((t) => hasAbsoluteOrTraversalPathArg(t));
+    }
+    const hasExternalPath = !options.allowExternalPaths && tokens.slice(1).some((t) => hasAbsoluteOrTraversalPathArg(t));
+    if (hasExternalPath) {
+      return false;
+    }
+    return true;
+  }
+  if (command === "sed") {
+    const usesInPlace = tokens.some((token) => token === "-i" || token.startsWith("-i") || token === "--in-place");
+    if (usesInPlace) {
+      return false;
+    }
+    const hasExternalPath = !options.allowExternalPaths && tokens.slice(1).some((t) => hasAbsoluteOrTraversalPathArg(t));
+    if (hasExternalPath) {
+      return false;
+    }
+    return true;
+  }
+  if (command === "git") {
+    const subcommand = tokens[1];
+    if (!subcommand) {
+      return false;
+    }
+    return SAFE_GIT_SUBCOMMANDS.has(subcommand);
+  }
+  if (command === "gh") {
+    const category = tokens[1];
+    if (!category) {
+      return false;
+    }
+    if (!(category in SAFE_GH_COMMANDS)) {
+      return false;
+    }
+    const allowedActions = SAFE_GH_COMMANDS[category];
+    if (allowedActions === null) {
+      return true;
+    }
+    if (allowedActions === undefined) {
+      return false;
+    }
+    const action = tokens[2];
+    if (!action) {
+      return false;
+    }
+    return allowedActions.has(action);
+  }
+  if (command === "letta") {
+    const group = tokens[1];
+    if (!group) {
+      return false;
+    }
+    if (!(group in SAFE_LETTA_COMMANDS)) {
+      return false;
+    }
+    const action = tokens[2];
+    if (!action) {
+      return false;
+    }
+    return SAFE_LETTA_COMMANDS[group]?.has(action) ?? false;
+  }
+  if (command === "find") {
+    return !/-delete|\s-exec\b/.test(segment);
+  }
+  if (command === "sort") {
+    return !/\s-o\b/.test(segment);
+  }
+  return false;
+}
+function isShellExecutor(command) {
+  return command === "bash" || command === "sh";
+}
+function tokenize4(segment) {
+  const matches = segment.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g);
+  if (!matches) {
+    return [];
+  }
+  return matches.map((token) => stripQuotes(token));
+}
+function stripQuotes(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function extractDashCArgument(tokens) {
+  for (let i = 0;i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (!token) {
+      continue;
+    }
+    if (token === "-c" || token === "-lc" || /^-[a-zA-Z]*c$/.test(token)) {
+      return tokens[i + 1];
+    }
+  }
+  return;
+}
+function isAbsolutePathArg(value) {
+  if (!value) {
+    return false;
+  }
+  if (value.startsWith("/")) {
+    return true;
+  }
+  return /^[a-zA-Z]:[\\/]/.test(value) || value.startsWith("\\\\");
+}
+function isHomeAnchoredPathArg(value) {
+  if (!value) {
+    return false;
+  }
+  return value.startsWith("~/") || value.startsWith("$HOME/") || value.startsWith("%USERPROFILE%\\") || value.startsWith("%USERPROFILE%/");
+}
+function hasAbsoluteOrTraversalPathArg(value) {
+  if (isAbsolutePathArg(value) || isHomeAnchoredPathArg(value)) {
+    return true;
+  }
+  return /(^|[\\/])\.\.([\\/]|$)/.test(value);
+}
+function getAllowedMemoryPrefixes(agentId) {
+  const home = homedir10();
+  const prefixes = [
+    normalizeSeparators(resolve4(home, ".letta", "agents", agentId, "memory")),
+    normalizeSeparators(resolve4(home, ".letta", "agents", agentId, "memory-worktrees"))
+  ];
+  const parentId = process.env.LETTA_PARENT_AGENT_ID;
+  if (parentId && parentId !== agentId) {
+    prefixes.push(normalizeSeparators(resolve4(home, ".letta", "agents", parentId, "memory")), normalizeSeparators(resolve4(home, ".letta", "agents", parentId, "memory-worktrees")));
+  }
+  return prefixes;
+}
+function normalizeSeparators(p) {
+  return p.replace(/\\/g, "/");
+}
+function expandPath(p) {
+  const home = homedir10();
+  if (p.startsWith("~/")) {
+    return normalizeSeparators(resolve4(home, p.slice(2)));
+  }
+  if (p.startsWith("$HOME/")) {
+    return normalizeSeparators(resolve4(home, p.slice(6)));
+  }
+  if (p.startsWith('"$HOME/')) {
+    return normalizeSeparators(resolve4(home, p.slice(7).replace(/"$/, "")));
+  }
+  return normalizeSeparators(resolve4(p));
+}
+function isUnderMemoryDir(path4, prefixes) {
+  const resolved = expandPath(path4);
+  return prefixes.some((prefix) => resolved === prefix || resolved.startsWith(`${prefix}/`));
+}
+function extractCdTarget(segment) {
+  const tokens = tokenize4(segment);
+  if (tokens[0] === "cd" && tokens[1]) {
+    return tokens[1];
+  }
+  return null;
+}
+function isMemoryDirCommand(command, agentId) {
+  if (!command || !agentId) {
+    return false;
+  }
+  const commandStr = typeof command === "string" ? command : command.join(" ");
+  const trimmed = commandStr.trim();
+  if (!trimmed) {
+    return false;
+  }
+  const prefixes = getAllowedMemoryPrefixes(agentId);
+  const segments = trimmed.split(/&&|\|\||;/).map((s) => s.trim()).filter(Boolean);
+  if (segments.length === 0) {
+    return false;
+  }
+  let cwd2 = null;
+  for (const segment of segments) {
+    const pipeParts = segment.split(/\|/).map((s) => s.trim()).filter(Boolean);
+    for (const part of pipeParts) {
+      const cdTarget = extractCdTarget(part);
+      if (cdTarget) {
+        const resolved = cwd2 ? expandPath(resolve4(expandPath(cwd2), cdTarget)) : expandPath(cdTarget);
+        if (!isUnderMemoryDir(resolved, prefixes)) {
+          return false;
+        }
+        cwd2 = resolved;
+        continue;
+      }
+      if (cwd2 && isUnderMemoryDir(cwd2, prefixes)) {
+        const tokens2 = tokenize4(part);
+        const currentCwd = cwd2;
+        if (!currentCwd) {
+          return false;
+        }
+        const hasExternalPath = tokens2.some((t) => {
+          if (isAbsolutePathArg(t) || isHomeAnchoredPathArg(t)) {
+            return !isUnderMemoryDir(t, prefixes);
+          }
+          if (hasAbsoluteOrTraversalPathArg(t)) {
+            const resolved = expandPath(resolve4(expandPath(currentCwd), t));
+            return !isUnderMemoryDir(resolved, prefixes);
+          }
+          return false;
+        });
+        if (hasExternalPath) {
+          return false;
+        }
+        if (!MEMORY_DIR_APPROVE_ALL) {
+          const cmd = tokens2[0];
+          if (!cmd || !SAFE_MEMORY_DIR_COMMANDS.has(cmd)) {
+            return false;
+          }
+        }
+        continue;
+      }
+      const tokens = tokenize4(part);
+      const hasMemoryPath = tokens.some((t) => t.includes(".letta/agents/") && t.includes("/memory") || t.includes(".letta/agents/") && t.includes("/memory-worktrees"));
+      if (hasMemoryPath) {
+        const agentPaths = tokens.filter((t) => t.includes(".letta/agents/"));
+        if (agentPaths.every((p) => isUnderMemoryDir(p, prefixes))) {
+          if (!MEMORY_DIR_APPROVE_ALL) {
+            const cmd = tokens[0];
+            if (!cmd || !SAFE_MEMORY_DIR_COMMANDS.has(cmd)) {
+              return false;
+            }
+          }
+          continue;
+        }
+      }
+      return false;
+    }
+  }
+  return true;
+}
+var MEMORY_DIR_APPROVE_ALL = true, SAFE_MEMORY_DIR_COMMANDS, ALWAYS_SAFE_COMMANDS, SAFE_GIT_SUBCOMMANDS, SAFE_LETTA_COMMANDS, SAFE_GH_COMMANDS;
+var init_readOnlyShell = __esm(() => {
+  SAFE_MEMORY_DIR_COMMANDS = new Set([
+    "git",
+    "rm",
+    "mv",
+    "mkdir",
+    "cp",
+    "ls",
+    "cat",
+    "head",
+    "tail",
+    "tree",
+    "find",
+    "wc",
+    "split",
+    "echo",
+    "sort",
+    "cd"
+  ]);
+  ALWAYS_SAFE_COMMANDS = new Set([
+    "cat",
+    "head",
+    "tail",
+    "less",
+    "more",
+    "grep",
+    "rg",
+    "ag",
+    "ack",
+    "fgrep",
+    "egrep",
+    "ls",
+    "tree",
+    "file",
+    "stat",
+    "du",
+    "df",
+    "wc",
+    "diff",
+    "cmp",
+    "comm",
+    "cut",
+    "tr",
+    "nl",
+    "column",
+    "fold",
+    "pwd",
+    "whoami",
+    "hostname",
+    "date",
+    "uname",
+    "uptime",
+    "id",
+    "echo",
+    "printf",
+    "env",
+    "printenv",
+    "which",
+    "whereis",
+    "type",
+    "basename",
+    "dirname",
+    "realpath",
+    "readlink",
+    "jq",
+    "yq",
+    "strings",
+    "xxd",
+    "hexdump",
+    "cd"
+  ]);
+  SAFE_GIT_SUBCOMMANDS = new Set([
+    "status",
+    "diff",
+    "log",
+    "show",
+    "branch",
+    "tag",
+    "remote"
+  ]);
+  SAFE_LETTA_COMMANDS = {
+    memfs: new Set(["status", "help", "backups", "export"]),
+    agents: new Set(["list", "help"]),
+    messages: new Set(["search", "list", "help"]),
+    blocks: new Set(["list", "help"])
+  };
+  SAFE_GH_COMMANDS = {
+    pr: new Set(["list", "status", "checks", "diff", "view"]),
+    issue: new Set(["list", "status", "view"]),
+    repo: new Set(["list", "view", "gitignore", "license"]),
+    run: new Set(["list", "view", "watch", "download"]),
+    release: new Set(["list", "view", "download"]),
+    search: null,
+    api: null,
+    status: null
+  };
+});
+
+// src/permissions/shell-command-normalization.ts
+function trimMatchingQuotes(value) {
+  const trimmed = value.trim();
+  if (trimmed.length < 2) {
+    return trimmed;
+  }
+  const first = trimmed[0];
+  const last = trimmed[trimmed.length - 1];
+  if ((first === '"' || first === "'") && last === first) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function normalizeExecutableToken(token) {
+  const normalized = trimMatchingQuotes(token).replace(/\\/g, "/");
+  const parts = normalized.split("/").filter(Boolean);
+  const executable = parts[parts.length - 1] ?? normalized;
+  return executable.toLowerCase();
+}
+function tokenizeShell(input) {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  let escaping = false;
+  const flush = () => {
+    if (current.length > 0) {
+      tokens.push(current);
+      current = "";
+    }
+  };
+  for (let i = 0;i < input.length; i += 1) {
+    const ch = input[i];
+    if (ch === undefined) {
+      continue;
+    }
+    if (escaping) {
+      current += ch;
+      escaping = false;
+      continue;
+    }
+    if (ch === "\\" && quote !== "single") {
+      escaping = true;
+      continue;
+    }
+    if (quote === "single") {
+      if (ch === "'") {
+        quote = null;
+      } else {
+        current += ch;
+      }
+      continue;
+    }
+    if (quote === "double") {
+      if (ch === '"') {
+        quote = null;
+      } else {
+        current += ch;
+      }
+      continue;
+    }
+    if (ch === "'") {
+      quote = "single";
+      continue;
+    }
+    if (ch === '"') {
+      quote = "double";
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      flush();
+      continue;
+    }
+    current += ch;
+  }
+  if (escaping) {
+    current += "\\";
+  }
+  flush();
+  return tokens;
+}
+function isDashCFlag(token) {
+  return token === "-c" || /^-[a-zA-Z]*c[a-zA-Z]*$/.test(token);
+}
+function extractInnerShellCommand(tokens) {
+  if (tokens.length === 0) {
+    return null;
+  }
+  let index = 0;
+  if (normalizeExecutableToken(tokens[0] ?? "") === "env") {
+    index += 1;
+    while (index < tokens.length) {
+      const token = tokens[index] ?? "";
+      if (!token) {
+        index += 1;
+        continue;
+      }
+      if (/^-[A-Za-z]+$/.test(token)) {
+        index += 1;
+        continue;
+      }
+      if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) {
+        index += 1;
+        continue;
+      }
+      break;
+    }
+  }
+  const executableToken = tokens[index];
+  if (!executableToken) {
+    return null;
+  }
+  if (!SHELL_EXECUTORS.has(normalizeExecutableToken(executableToken))) {
+    return null;
+  }
+  for (let i = index + 1;i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (!token) {
+      continue;
+    }
+    if (!isDashCFlag(token)) {
+      continue;
+    }
+    const innerCommand = tokens[i + 1];
+    if (!innerCommand) {
+      return null;
+    }
+    return trimMatchingQuotes(innerCommand);
+  }
+  return null;
+}
+function unwrapShellLauncherCommand(command) {
+  let current = command.trim();
+  for (let depth = 0;depth < 5; depth += 1) {
+    if (!current) {
+      break;
+    }
+    const tokens = tokenizeShell(current);
+    const inner = extractInnerShellCommand(tokens);
+    if (!inner || inner === current) {
+      break;
+    }
+    current = inner.trim();
+  }
+  return current;
+}
+function normalizeBashRulePayload(payload) {
+  const trimmed = payload.trim();
+  if (!trimmed) {
+    return "";
+  }
+  const hasWildcardSuffix = trimmed.endsWith(":*");
+  const withoutWildcard = hasWildcardSuffix ? trimmed.slice(0, -2).trimEnd() : trimmed;
+  const unwrapped = unwrapShellLauncherCommand(withoutWildcard);
+  if (hasWildcardSuffix) {
+    return `${unwrapped}:*`;
+  }
+  return unwrapped;
+}
+var SHELL_EXECUTORS;
+var init_shell_command_normalization = __esm(() => {
+  SHELL_EXECUTORS = new Set(["bash", "sh", "zsh", "dash", "ksh"]);
+});
+
+// src/permissions/mode.ts
+var exports_mode = {};
+__export(exports_mode, {
+  permissionMode: () => permissionMode
+});
+import { homedir as homedir11 } from "node:os";
+import { isAbsolute as isAbsolute2, join as join10, relative as relative3, resolve as resolve5 } from "node:path";
+function getGlobalMode() {
+  const global2 = globalThis;
+  if (!global2[MODE_KEY]) {
+    global2[MODE_KEY] = "default";
+  }
+  return global2[MODE_KEY];
+}
+function setGlobalMode(value) {
+  const global2 = globalThis;
+  global2[MODE_KEY] = value;
+}
+function getGlobalPlanFilePath() {
+  const global2 = globalThis;
+  return global2[PLAN_FILE_KEY] || null;
+}
+function setGlobalPlanFilePath(value) {
+  const global2 = globalThis;
+  global2[PLAN_FILE_KEY] = value;
+}
+function getGlobalModeBeforePlan() {
+  const global2 = globalThis;
+  return global2[MODE_BEFORE_PLAN_KEY] ?? null;
+}
+function setGlobalModeBeforePlan(value) {
+  const global2 = globalThis;
+  global2[MODE_BEFORE_PLAN_KEY] = value;
+}
+function resolvePlanTargetPath(targetPath, workingDirectory) {
+  const trimmedPath = targetPath.trim();
+  if (!trimmedPath)
+    return null;
+  if (trimmedPath.startsWith("~/")) {
+    return resolve5(homedir11(), trimmedPath.slice(2));
+  }
+  if (isAbsolute2(trimmedPath)) {
+    return resolve5(trimmedPath);
+  }
+  return resolve5(workingDirectory, trimmedPath);
+}
+function isPathInPlansDir(path4, plansDir) {
+  if (!path4.endsWith(".md"))
+    return false;
+  const rel = relative3(plansDir, path4);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
+}
+function extractApplyPatchPaths(input) {
+  const paths = [];
+  const fileDirectivePattern = /\*\*\* (?:Add|Update|Delete) File:\s*(.+)/g;
+  const moveDirectivePattern = /\*\*\* Move to:\s*(.+)/g;
+  for (const match of input.matchAll(fileDirectivePattern)) {
+    const matchPath = match[1]?.trim();
+    if (matchPath)
+      paths.push(matchPath);
+  }
+  for (const match of input.matchAll(moveDirectivePattern)) {
+    const matchPath = match[1]?.trim();
+    if (matchPath)
+      paths.push(matchPath);
+  }
+  return paths;
+}
+function stripMatchingQuotes(value) {
+  const trimmed = value.trim();
+  if (trimmed.length < 2) {
+    return trimmed;
+  }
+  const first = trimmed[0];
+  const last = trimmed[trimmed.length - 1];
+  if ((first === '"' || first === "'") && last === first) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function extractPlanFileWritePathFromShellCommand(command) {
+  if (!command) {
+    return null;
+  }
+  const commandString = typeof command === "string" ? command : command.join(" ") ?? "";
+  const normalizedCommand = unwrapShellLauncherCommand(commandString).trim();
+  if (!normalizedCommand) {
+    return null;
+  }
+  const lines = normalizedCommand.split(/\r?\n/);
+  const firstLine = lines[0]?.trim() ?? "";
+  if (!firstLine) {
+    return null;
+  }
+  const firstLineMatch = firstLine.match(/^cat\s+(?:>\s*(?<path1>"[^"]+"|'[^']+'|\S+)\s+<<-?\s*(?<delim1>"[^"]+"|'[^']+'|\S+)|<<-?\s*(?<delim2>"[^"]+"|'[^']+'|\S+)\s+>\s*(?<path2>"[^"]+"|'[^']+'|\S+))\s*$/);
+  if (!firstLineMatch?.groups) {
+    return null;
+  }
+  const rawPath = firstLineMatch.groups.path1 || firstLineMatch.groups.path2;
+  const rawDelim = firstLineMatch.groups.delim1 || firstLineMatch.groups.delim2;
+  if (!rawPath || !rawDelim) {
+    return null;
+  }
+  const delimiter = stripMatchingQuotes(rawDelim);
+  if (!delimiter) {
+    return null;
+  }
+  let terminatorLine = -1;
+  for (let i = 1;i < lines.length; i += 1) {
+    if ((lines[i] ?? "") === delimiter) {
+      terminatorLine = i;
+      break;
+    }
+  }
+  if (terminatorLine === -1) {
+    return null;
+  }
+  for (let i = terminatorLine + 1;i < lines.length; i += 1) {
+    if ((lines[i] ?? "").trim().length > 0) {
+      return null;
+    }
+  }
+  return stripMatchingQuotes(rawPath);
+}
+
+class PermissionModeManager {
+  get currentMode() {
+    return getGlobalMode();
+  }
+  set currentMode(value) {
+    setGlobalMode(value);
+  }
+  setMode(mode) {
+    const prevMode = this.currentMode;
+    if (mode === "plan" && prevMode !== "plan") {
+      setGlobalModeBeforePlan(prevMode);
+    }
+    this.currentMode = mode;
+    if (mode !== "plan") {
+      setGlobalPlanFilePath(null);
+    }
+    if (prevMode === "plan" && mode !== "plan") {
+      setGlobalModeBeforePlan(null);
+    }
+  }
+  getModeBeforePlan() {
+    return getGlobalModeBeforePlan();
+  }
+  getMode() {
+    return this.currentMode;
+  }
+  setPlanFilePath(path4) {
+    setGlobalPlanFilePath(path4);
+  }
+  getPlanFilePath() {
+    return getGlobalPlanFilePath();
+  }
+  checkModeOverride(toolName, toolArgs, workingDirectory = process.cwd(), modeOverride, planFilePathOverride) {
+    const effectiveMode = modeOverride ?? this.currentMode;
+    const _effectivePlanFilePath = planFilePathOverride !== undefined ? planFilePathOverride : this.getPlanFilePath();
+    switch (effectiveMode) {
+      case "bypassPermissions":
+        return "allow";
+      case "acceptEdits":
+        if ([
+          "Write",
+          "Edit",
+          "MultiEdit",
+          "NotebookEdit",
+          "apply_patch",
+          "replace",
+          "write_file"
+        ].includes(toolName)) {
+          return "allow";
+        }
+        return null;
+      case "plan": {
+        const allowedInPlan = [
+          "Read",
+          "Glob",
+          "Grep",
+          "NotebookRead",
+          "TodoWrite",
+          "ExitPlanMode",
+          "exit_plan_mode",
+          "AskUserQuestion",
+          "ask_user_question",
+          "read_file",
+          "list_dir",
+          "grep_files",
+          "update_plan",
+          "task_output",
+          "ReadFile",
+          "ListDir",
+          "GrepFiles",
+          "UpdatePlan",
+          "TaskOutput",
+          "read_file_gemini",
+          "glob_gemini",
+          "list_directory",
+          "search_file_content",
+          "write_todos",
+          "read_many_files",
+          "ReadFileGemini",
+          "GlobGemini",
+          "ListDirectory",
+          "SearchFileContent",
+          "WriteTodos",
+          "ReadManyFiles"
+        ];
+        const writeTools = [
+          "Write",
+          "Edit",
+          "MultiEdit",
+          "apply_patch",
+          "ApplyPatch",
+          "write_file_gemini",
+          "WriteFileGemini",
+          "replace",
+          "Replace"
+        ];
+        if (allowedInPlan.includes(toolName)) {
+          return "allow";
+        }
+        if (writeTools.includes(toolName)) {
+          const plansDir = join10(homedir11(), ".letta", "plans");
+          const targetPath = toolArgs?.file_path || toolArgs?.path;
+          let candidatePaths = [];
+          if ((toolName === "ApplyPatch" || toolName === "apply_patch") && toolArgs?.input) {
+            const input = toolArgs.input;
+            candidatePaths = extractApplyPatchPaths(input);
+          } else if (typeof targetPath === "string") {
+            candidatePaths = [targetPath];
+          }
+          if (candidatePaths.length > 0 && candidatePaths.every((path4) => {
+            const resolvedPath = resolvePlanTargetPath(path4, workingDirectory);
+            return resolvedPath ? isPathInPlansDir(resolvedPath, plansDir) : false;
+          })) {
+            return "allow";
+          }
+        }
+        const readOnlySubagentTypes = new Set([
+          "explore",
+          "Explore",
+          "plan",
+          "Plan",
+          "recall",
+          "Recall"
+        ]);
+        if (toolName === "Task" || toolName === "task") {
+          const subagentType = toolArgs?.subagent_type;
+          if (subagentType && readOnlySubagentTypes.has(subagentType)) {
+            return "allow";
+          }
+        }
+        if (toolName === "Skill" || toolName === "skill") {
+          return "allow";
+        }
+        const shellTools = [
+          "Bash",
+          "shell",
+          "Shell",
+          "shell_command",
+          "ShellCommand",
+          "run_shell_command",
+          "RunShellCommand",
+          "run_shell_command_gemini",
+          "RunShellCommandGemini"
+        ];
+        if (shellTools.includes(toolName)) {
+          const command = toolArgs?.command;
+          if (command && isReadOnlyShellCommand(command, { allowExternalPaths: true })) {
+            return "allow";
+          }
+          const planWritePath = extractPlanFileWritePathFromShellCommand(command);
+          if (planWritePath) {
+            const plansDir = join10(homedir11(), ".letta", "plans");
+            const resolvedPath = resolvePlanTargetPath(planWritePath, workingDirectory);
+            if (resolvedPath && isPathInPlansDir(resolvedPath, plansDir)) {
+              return "allow";
+            }
+          }
+        }
+        return "deny";
+      }
+      case "default":
+        return null;
+      default:
+        return null;
+    }
+  }
+  reset() {
+    this.currentMode = "default";
+    setGlobalPlanFilePath(null);
+    setGlobalModeBeforePlan(null);
+  }
+}
+var MODE_KEY, PLAN_FILE_KEY, MODE_BEFORE_PLAN_KEY, permissionMode;
+var init_mode = __esm(() => {
+  init_readOnlyShell();
+  init_shell_command_normalization();
+  MODE_KEY = Symbol.for("@letta/permissionMode");
+  PLAN_FILE_KEY = Symbol.for("@letta/planFilePath");
+  MODE_BEFORE_PLAN_KEY = Symbol.for("@letta/permissionModeBeforePlan");
+  permissionMode = new PermissionModeManager;
+});
+
 // src/telemetry/index.ts
 class TelemetryManager {
   events = [];
@@ -46531,13 +46732,23 @@ var init_Edit2 = () => {};
 
 // src/tools/impl/EnterPlanMode.ts
 import { relative as relative4 } from "node:path";
-async function enter_plan_mode(_args) {
-  if (permissionMode.getMode() !== "plan" || !permissionMode.getPlanFilePath()) {
-    const planFilePath2 = generatePlanFilePath();
-    permissionMode.setMode("plan");
-    permissionMode.setPlanFilePath(planFilePath2);
+async function enter_plan_mode(args) {
+  const scopedState = args._executionContextId ? getExecutionContextPermissionModeState(args._executionContextId) : undefined;
+  if (scopedState) {
+    if (scopedState.mode !== "plan" || !scopedState.planFilePath) {
+      const planFilePath2 = generatePlanFilePath();
+      scopedState.modeBeforePlan = scopedState.modeBeforePlan ?? scopedState.mode;
+      scopedState.mode = "plan";
+      scopedState.planFilePath = planFilePath2;
+    }
+  } else {
+    if (permissionMode.getMode() !== "plan" || !permissionMode.getPlanFilePath()) {
+      const planFilePath2 = generatePlanFilePath();
+      permissionMode.setMode("plan");
+      permissionMode.setPlanFilePath(planFilePath2);
+    }
   }
-  const planFilePath = permissionMode.getPlanFilePath();
+  const planFilePath = scopedState?.planFilePath ?? permissionMode.getPlanFilePath();
   const cwd2 = process.env.USER_CWD || process.cwd();
   const applyPatchRelativePath = planFilePath ? relative4(cwd2, planFilePath).replace(/\\/g, "/") : null;
   return {
@@ -46557,14 +46768,22 @@ Plan file path: ${planFilePath}
 ${applyPatchRelativePath ? `If using apply_patch, use this exact relative patch path: ${applyPatchRelativePath}` : ""}`
   };
 }
-var init_EnterPlanMode2 = __esm(() => {
+var init_EnterPlanMode2 = __esm(async () => {
   init_planName();
   init_mode();
+  await init_manager3();
 });
 
 // src/tools/impl/ExitPlanMode.ts
-async function exit_plan_mode() {
-  if (permissionMode.getMode() === "plan") {
+async function exit_plan_mode(args = {}) {
+  const scopedState = args._executionContextId ? getExecutionContextPermissionModeState(args._executionContextId) : undefined;
+  if (scopedState) {
+    if (scopedState.mode === "plan") {
+      scopedState.mode = scopedState.modeBeforePlan ?? "default";
+      scopedState.modeBeforePlan = null;
+      scopedState.planFilePath = null;
+    }
+  } else if (permissionMode.getMode() === "plan") {
     const restoredMode = permissionMode.getModeBeforePlan() ?? "default";
     permissionMode.setMode(restoredMode);
   }
@@ -46575,8 +46794,9 @@ async function exit_plan_mode() {
 ` + "Tip: If this plan will be referenced in the future by your future-self, " + "other agents, or humans, consider renaming the plan file to something easily " + "identifiable with a timestamp (e.g., `2026-01-auth-refactor.md`) rather than the random name."
   };
 }
-var init_ExitPlanMode2 = __esm(() => {
+var init_ExitPlanMode2 = __esm(async () => {
   init_mode();
+  await init_manager3();
 });
 
 // src/tools/impl/Glob.ts
@@ -64052,8 +64272,6 @@ var init_toolDefinitions = __esm(async () => {
   init_AskUserQuestion2();
   init_BashOutput2();
   init_Edit2();
-  init_EnterPlanMode2();
-  init_ExitPlanMode2();
   init_Glob2();
   init_GlobGemini2();
   init_Grep2();
@@ -64111,6 +64329,8 @@ var init_toolDefinitions = __esm(async () => {
   init_WriteTodosGemini2();
   await __promiseAll([
     init_Bash2(),
+    init_EnterPlanMode2(),
+    init_ExitPlanMode2(),
     init_Memory2(),
     init_Read2(),
     init_ReadFileGemini2(),
@@ -65780,9 +66000,9 @@ function shouldAttachTrace(result) {
   }
   return result.decision === "ask" || result.decision === "deny";
 }
-function checkPermission(toolName, toolArgs, permissions, workingDirectory = process.cwd()) {
+function checkPermission(toolName, toolArgs, permissions, workingDirectory = process.cwd(), modeState) {
   const engine = isPermissionsV2Enabled() ? "v2" : "v1";
-  const primary = checkPermissionForEngine(engine, toolName, toolArgs, permissions, workingDirectory);
+  const primary = checkPermissionForEngine(engine, toolName, toolArgs, permissions, workingDirectory, modeState);
   let result = primary.result;
   const includeTrace = shouldAttachTrace(primary.result);
   if (includeTrace) {
@@ -65801,7 +66021,7 @@ function checkPermission(toolName, toolArgs, permissions, workingDirectory = pro
   }
   if (envFlagEnabled("LETTA_PERMISSIONS_DUAL_EVAL")) {
     const shadowEngine = engine === "v2" ? "v1" : "v2";
-    const shadow = checkPermissionForEngine(shadowEngine, toolName, toolArgs, permissions, workingDirectory);
+    const shadow = checkPermissionForEngine(shadowEngine, toolName, toolArgs, permissions, workingDirectory, modeState);
     const mismatch = primary.result.decision !== shadow.result.decision || primary.result.matchedRule !== shadow.result.matchedRule;
     if (mismatch) {
       console.error(`[permissions] dual-eval mismatch ${JSON.stringify({
@@ -65850,7 +66070,7 @@ function traceEvent(trace, stage, message, pattern, matched) {
     event.matched = matched;
   trace.events.push(event);
 }
-function checkPermissionForEngine(engine, toolName, toolArgs, permissions, workingDirectory) {
+function checkPermissionForEngine(engine, toolName, toolArgs, permissions, workingDirectory, modeState) {
   const canonicalTool = canonicalToolName(toolName);
   const queryTool = engine === "v2" ? canonicalTool : toolName;
   const query = buildPermissionQuery(queryTool, toolArgs, engine);
@@ -65888,20 +66108,20 @@ function checkPermissionForEngine(engine, toolName, toolArgs, permissions, worki
       };
     }
   }
-  const modeOverride = permissionMode.checkModeOverride(toolName, toolArgs, workingDirectory);
+  const effectiveMode = modeState?.mode ?? permissionMode.getMode();
+  const effectivePlanFilePath = modeState?.planFilePath ?? permissionMode.getPlanFilePath();
+  const modeOverride = permissionMode.checkModeOverride(toolName, toolArgs, workingDirectory, effectiveMode, effectivePlanFilePath);
   if (modeOverride) {
-    const currentMode = permissionMode.getMode();
-    let reason = `Permission mode: ${currentMode}`;
-    if (currentMode === "plan" && modeOverride === "deny") {
-      const planFilePath = permissionMode.getPlanFilePath();
-      const applyPatchRelativePath = planFilePath ? relative6(workingDirectory, planFilePath).replace(/\\/g, "/") : null;
-      reason = `Plan mode is active. You can only use read-only tools (Read, Grep, Glob, etc.) and write to the plan file. ` + `Write your plan to: ${planFilePath || "(error: plan file path not configured)"}. ` + (applyPatchRelativePath ? `If using apply_patch, use this exact relative path in patch headers: ${applyPatchRelativePath}. ` : "") + `Use ExitPlanMode when your plan is ready for user approval.`;
+    let reason = `Permission mode: ${effectiveMode}`;
+    if (effectiveMode === "plan" && modeOverride === "deny") {
+      const applyPatchRelativePath = effectivePlanFilePath ? relative6(workingDirectory, effectivePlanFilePath).replace(/\\/g, "/") : null;
+      reason = `Plan mode is active. You can only use read-only tools (Read, Grep, Glob, etc.) and write to the plan file. ` + `Write your plan to: ${effectivePlanFilePath || "(error: plan file path not configured)"}. ` + (applyPatchRelativePath ? `If using apply_patch, use this exact relative path in patch headers: ${applyPatchRelativePath}. ` : "") + `Use ExitPlanMode when your plan is ready for user approval.`;
     }
     traceEvent(trace, "mode-override", reason);
     return {
       result: {
         decision: modeOverride,
-        matchedRule: `${currentMode} mode`,
+        matchedRule: `${effectiveMode} mode`,
         reason
       },
       trace
@@ -66171,8 +66391,8 @@ function getDefaultDecision(toolName, toolArgs) {
   }
   return "ask";
 }
-async function checkPermissionWithHooks(toolName, toolArgs, permissions, workingDirectory = process.cwd()) {
-  const result = checkPermission(toolName, toolArgs, permissions, workingDirectory);
+async function checkPermissionWithHooks(toolName, toolArgs, permissions, workingDirectory = process.cwd(), modeState) {
+  const result = checkPermission(toolName, toolArgs, permissions, workingDirectory, modeState);
   if (result.decision === "ask") {
     const hookResult = await runPermissionRequestHooks(toolName, toolArgs, "ask", undefined, workingDirectory);
     if (hookResult.blocked) {
@@ -67017,6 +67237,7 @@ __export(exports_manager2, {
   getInternalToolName: () => getInternalToolName,
   getExternalToolsAsClientTools: () => getExternalToolsAsClientTools,
   getExternalToolDefinition: () => getExternalToolDefinition,
+  getExecutionContextPermissionModeState: () => getExecutionContextPermissionModeState,
   getClientToolsFromRegistry: () => getClientToolsFromRegistry,
   getAllLettaToolNames: () => getAllLettaToolNames,
   executeTool: () => executeTool,
@@ -67084,6 +67305,9 @@ function saveExecutionContext(snapshot) {
 function getExecutionContextById(contextId) {
   return getExecutionContexts().get(contextId);
 }
+function getExecutionContextPermissionModeState(contextId) {
+  return getExecutionContextById(contextId)?.permissionModeState;
+}
 function clearCapturedToolExecutionContexts() {
   getExecutionContexts().clear();
 }
@@ -67201,12 +67425,31 @@ function getClientToolsFromRegistry() {
   const externalTools = getExternalToolsAsClientTools();
   return [...builtInTools, ...externalTools];
 }
-function captureToolExecutionContext(workingDirectory = process.env.USER_CWD || process.cwd()) {
+function captureToolExecutionContext(workingDirectory = process.env.USER_CWD || process.cwd(), permissionModeState) {
+  const effectivePermissionModeState = permissionModeState ?? {
+    get mode() {
+      return permissionMode.getMode();
+    },
+    set mode(value) {
+      permissionMode.setMode(value);
+    },
+    get planFilePath() {
+      return permissionMode.getPlanFilePath();
+    },
+    set planFilePath(value) {
+      permissionMode.setPlanFilePath(value);
+    },
+    get modeBeforePlan() {
+      return permissionMode.getModeBeforePlan();
+    },
+    set modeBeforePlan(_value) {}
+  };
   const snapshot = {
     toolRegistry: new Map(toolRegistry),
     externalTools: new Map(getExternalToolsRegistry()),
     externalExecutor: getExternalToolExecutor(),
-    workingDirectory
+    workingDirectory,
+    permissionModeState: effectivePermissionModeState
   };
   const contextId = saveExecutionContext(snapshot);
   const builtInTools = Array.from(snapshot.toolRegistry.entries()).map(([name, tool]) => ({
@@ -67246,11 +67489,11 @@ function getToolPermissions(toolName) {
 function requiresApproval(toolName) {
   return TOOL_PERMISSIONS[toolName]?.requiresApproval ?? false;
 }
-async function checkToolPermission(toolName, toolArgs, workingDirectory = process.cwd()) {
+async function checkToolPermission(toolName, toolArgs, workingDirectory = process.cwd(), permissionModeStateArg) {
   const { checkPermissionWithHooks: checkPermissionWithHooks2 } = await init_checker().then(() => exports_checker);
   const { loadPermissions: loadPermissions2 } = await Promise.resolve().then(() => (init_loader2(), exports_loader));
   const permissions = await loadPermissions2(workingDirectory);
-  return checkPermissionWithHooks2(toolName, toolArgs, permissions, workingDirectory);
+  return checkPermissionWithHooks2(toolName, toolArgs, permissions, workingDirectory, permissionModeStateArg);
 }
 async function savePermissionRule2(rule, ruleType, scope, workingDirectory = process.cwd()) {
   if (scope === "session") {
@@ -67567,6 +67810,18 @@ async function executeTool(name, args, options) {
     if (internalName === "Skill" && options?.toolCallId) {
       enhancedArgs = { ...enhancedArgs, toolCallId: options.toolCallId };
     }
+    const PLAN_MODE_TOOL_NAMES = new Set([
+      "EnterPlanMode",
+      "enter_plan_mode",
+      "ExitPlanMode",
+      "exit_plan_mode"
+    ]);
+    if (PLAN_MODE_TOOL_NAMES.has(internalName) && options?.toolContextId) {
+      enhancedArgs = {
+        ...enhancedArgs,
+        _executionContextId: options.toolContextId
+      };
+    }
     const result = await withExecutionWorkingDirectory(workingDirectory, () => tool.fn(enhancedArgs));
     const duration = Date.now() - startTime;
     if (FILE_MODIFYING_TOOLS.has(internalName)) {
@@ -67696,6 +67951,7 @@ var init_manager3 = __esm(async () => {
   init_subagents();
   init_fileIndex();
   init_constants();
+  init_mode();
   init_debug();
   await __promiseAll([
     init_approval_execution(),
@@ -67904,6 +68160,75 @@ var init_constants2 = __esm(() => {
   SYSTEM_REMINDER_RE = /<system-reminder>[\s\S]*?<\/system-reminder>/g;
 });
 
+// src/websocket/listener/remote-settings.ts
+import { existsSync as existsSync16, readFileSync as readFileSync8 } from "node:fs";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir18 } from "node:os";
+import path20 from "node:path";
+function getRemoteSettingsPath() {
+  return path20.join(homedir18(), ".letta", "remote-settings.json");
+}
+function loadRemoteSettings() {
+  if (_cache !== null) {
+    return _cache;
+  }
+  let loaded = {};
+  try {
+    const settingsPath = getRemoteSettingsPath();
+    if (existsSync16(settingsPath)) {
+      const raw = readFileSync8(settingsPath, "utf-8");
+      const parsed = JSON.parse(raw);
+      loaded = parsed;
+    }
+  } catch {}
+  if (loaded.cwdMap) {
+    const validCwdMap = {};
+    for (const [key, value] of Object.entries(loaded.cwdMap)) {
+      if (typeof value === "string" && existsSync16(value)) {
+        validCwdMap[key] = value;
+      }
+    }
+    loaded.cwdMap = validCwdMap;
+  }
+  if (!loaded.cwdMap) {
+    loaded.cwdMap = loadLegacyCwdCache();
+  }
+  _cache = loaded;
+  return _cache;
+}
+function saveRemoteSettings(updates) {
+  if (_cache === null) {
+    loadRemoteSettings();
+  }
+  _cache = {
+    ..._cache,
+    ...updates
+  };
+  const snapshot = _cache;
+  const settingsPath = getRemoteSettingsPath();
+  mkdir3(path20.dirname(settingsPath), { recursive: true }).then(() => writeFile3(settingsPath, JSON.stringify(snapshot, null, 2))).catch(() => {});
+}
+function loadLegacyCwdCache() {
+  try {
+    const legacyPath = path20.join(homedir18(), ".letta", "cwd-cache.json");
+    if (!existsSync16(legacyPath))
+      return {};
+    const raw = readFileSync8(legacyPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    const result = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (typeof value === "string" && existsSync16(value)) {
+        result[key] = value;
+      }
+    }
+    return result;
+  } catch {
+    return {};
+  }
+}
+var _cache = null;
+var init_remote_settings = () => {};
+
 // src/websocket/listener/scope.ts
 function getOnlyConversationRuntime(runtime) {
   if (!runtime || runtime.conversationRuntimes.size !== 1) {
@@ -67949,10 +68274,6 @@ function resolveRuntimeScope(runtime, params) {
 }
 
 // src/websocket/listener/cwd.ts
-import { existsSync as existsSync16 } from "node:fs";
-import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir as homedir18 } from "node:os";
-import path20 from "node:path";
 function getWorkingDirectoryScopeKey(agentId, conversationId) {
   const normalizedConversationId = normalizeConversationId(conversationId);
   const normalizedAgentId = normalizeCwdAgentId(agentId);
@@ -67965,21 +68286,12 @@ function getConversationWorkingDirectory(runtime, agentId, conversationId) {
   const scopeKey = getWorkingDirectoryScopeKey(agentId, conversationId);
   return runtime.workingDirectoryByConversation.get(scopeKey) ?? runtime.bootWorkingDirectory;
 }
-function getCwdCachePath() {
-  return path20.join(homedir18(), ".letta", "cwd-cache.json");
-}
 function loadPersistedCwdMap() {
-  if (!shouldPersistCwd)
-    return new Map;
   try {
-    const cachePath = getCwdCachePath();
-    if (!existsSync16(cachePath))
-      return new Map;
-    const raw = __require("node:fs").readFileSync(cachePath, "utf-8");
-    const parsed = JSON.parse(raw);
+    const settings = loadRemoteSettings();
     const map = new Map;
-    for (const [key, value] of Object.entries(parsed)) {
-      if (typeof value === "string" && existsSync16(value)) {
+    if (settings.cwdMap) {
+      for (const [key, value] of Object.entries(settings.cwdMap)) {
         map.set(key, value);
       }
     }
@@ -67989,11 +68301,7 @@ function loadPersistedCwdMap() {
   }
 }
 function persistCwdMap(map) {
-  if (!shouldPersistCwd)
-    return;
-  const cachePath = getCwdCachePath();
-  const obj = Object.fromEntries(map);
-  mkdir3(path20.dirname(cachePath), { recursive: true }).then(() => writeFile3(cachePath, JSON.stringify(obj, null, 2))).catch(() => {});
+  saveRemoteSettings({ cwdMap: Object.fromEntries(map) });
 }
 function setConversationWorkingDirectory(runtime, agentId, conversationId, workingDirectory) {
   const scopeKey = getWorkingDirectoryScopeKey(agentId, conversationId);
@@ -68004,9 +68312,73 @@ function setConversationWorkingDirectory(runtime, agentId, conversationId, worki
   }
   persistCwdMap(runtime.workingDirectoryByConversation);
 }
-var shouldPersistCwd;
 var init_cwd = __esm(() => {
-  shouldPersistCwd = process.env.PERSIST_CWD === "1";
+  init_remote_settings();
+});
+
+// src/websocket/listener/permissionMode.ts
+function getPermissionModeScopeKey(agentId, conversationId) {
+  const normalizedConversationId = normalizeConversationId(conversationId);
+  const normalizedAgentId = normalizeCwdAgentId(agentId);
+  if (normalizedConversationId === "default") {
+    return `agent:${normalizedAgentId ?? "__unknown__"}::conversation:default`;
+  }
+  return `conversation:${normalizedConversationId}`;
+}
+function getConversationPermissionModeState(runtime, agentId, conversationId) {
+  const scopeKey = getPermissionModeScopeKey(agentId, conversationId);
+  return runtime.permissionModeByConversation.get(scopeKey) ?? {
+    mode: permissionMode.getMode(),
+    planFilePath: null,
+    modeBeforePlan: null
+  };
+}
+function setConversationPermissionModeState(runtime, agentId, conversationId, state) {
+  const scopeKey = getPermissionModeScopeKey(agentId, conversationId);
+  if (state.mode === permissionMode.getMode() && state.planFilePath === null && state.modeBeforePlan === null) {
+    runtime.permissionModeByConversation.delete(scopeKey);
+  } else {
+    runtime.permissionModeByConversation.set(scopeKey, { ...state });
+  }
+  persistPermissionModeMap(runtime.permissionModeByConversation);
+}
+function loadPersistedPermissionModeMap() {
+  try {
+    const settings = loadRemoteSettings();
+    const map = new Map;
+    if (!settings.permissionModeMap) {
+      return map;
+    }
+    for (const [key, persisted] of Object.entries(settings.permissionModeMap)) {
+      const restoredMode = persisted.mode === "plan" ? persisted.modeBeforePlan ?? "default" : persisted.mode;
+      map.set(key, {
+        mode: restoredMode,
+        planFilePath: null,
+        modeBeforePlan: null
+      });
+    }
+    return map;
+  } catch {
+    return new Map;
+  }
+}
+function persistPermissionModeMap(map) {
+  const permissionModeMap = {};
+  for (const [key, state] of map) {
+    const modeToSave = state.mode === "plan" ? state.modeBeforePlan ?? "default" : state.mode;
+    if (modeToSave === "default" && state.modeBeforePlan === null) {
+      continue;
+    }
+    permissionModeMap[key] = {
+      mode: modeToSave,
+      modeBeforePlan: state.mode === "plan" ? null : state.modeBeforePlan ?? null
+    };
+  }
+  saveRemoteSettings({ permissionModeMap });
+}
+var init_permissionMode = __esm(() => {
+  init_mode();
+  init_remote_settings();
 });
 
 // src/websocket/listener/runtime.ts
@@ -68266,12 +68638,13 @@ function buildDeviceStatus(runtime, params) {
       return "auto";
     }
   })();
+  const conversationPermissionModeState = getConversationPermissionModeState(listener, scopedAgentId, scopedConversationId);
   return {
     current_connection_id: listener.connectionId,
     connection_name: listener.connectionName,
     is_online: listener.socket?.readyState === WebSocket2.OPEN,
     is_processing: !!conversationRuntime?.isProcessing,
-    current_permission_mode: permissionMode.getMode(),
+    current_permission_mode: conversationPermissionModeState.mode,
     current_working_directory: getConversationWorkingDirectory(listener, scopedAgentId, scopedConversationId),
     letta_code_version: process.env.npm_package_version || null,
     current_toolset: toolsetPreference === "auto" ? null : toolsetPreference,
@@ -68525,6 +68898,7 @@ var init_protocol_outbound = __esm(async () => {
   init_mode();
   init_constants2();
   init_cwd();
+  init_permissionMode();
   init_runtime();
   await __promiseAll([
     init_settings_manager(),
@@ -71812,7 +72186,7 @@ async function sendMessageStream(conversationId, messages, opts = { streamTokens
   const requestStartedAtMs = Date.now();
   const client = await getClient2();
   await waitForToolsetReady();
-  const { clientTools, contextId } = captureToolExecutionContext(opts.workingDirectory);
+  const { clientTools, contextId } = captureToolExecutionContext(opts.workingDirectory, opts.permissionModeState);
   const { clientSkills, errors: clientSkillDiscoveryErrors } = await buildClientSkillsPayload({
     agentId: opts.agentId
   });
@@ -74210,7 +74584,7 @@ async function classifyApprovals(approvals, opts = {}) {
       continue;
     }
     const parsedArgs = safeJsonParseOr(approval.toolArgs || "{}", {});
-    const permission = await checkToolPermission(toolName, parsedArgs, opts.workingDirectory);
+    const permission = await checkToolPermission(toolName, parsedArgs, opts.workingDirectory, opts.permissionModeState);
     const context3 = opts.getContext ? await opts.getContext(toolName, parsedArgs, opts.workingDirectory) : null;
     let decision = permission.decision;
     if (opts.alwaysRequiresUserInput?.(toolName) && decision === "allow") {
@@ -74316,7 +74690,8 @@ async function resolveStaleApprovals(runtime, socket, abortSignal) {
       alwaysRequiresUserInput: isInteractiveApprovalTool,
       requireArgsForAutoApprove: true,
       missingNameReason: "Tool call incomplete - missing name",
-      workingDirectory: recoveryWorkingDirectory
+      workingDirectory: recoveryWorkingDirectory,
+      permissionModeState: getConversationPermissionModeState(runtime.listener, runtime.agentId, runtime.conversationId)
     });
     const decisions = [
       ...autoAllowed.map((ac) => ({
@@ -74697,6 +75072,7 @@ var init_send = __esm(async () => {
   init_interactivePolicy();
   init_constants2();
   init_cwd();
+  init_permissionMode();
   await __promiseAll([
     init_approval_execution(),
     init_approval_recovery(),
@@ -75507,6 +75883,7 @@ async function handleApprovalStop(params) {
     agentId,
     conversationId,
     turnWorkingDirectory,
+    turnPermissionModeState,
     dequeuedBatchId,
     runId,
     msgRunIds,
@@ -75559,7 +75936,8 @@ async function handleApprovalStop(params) {
     treatAskAsDeny: false,
     requireArgsForAutoApprove: true,
     missingNameReason: "Tool call incomplete - missing name",
-    workingDirectory: turnWorkingDirectory
+    workingDirectory: turnWorkingDirectory,
+    permissionModeState: turnPermissionModeState
   });
   const lastNeedsUserInputToolCallIds = needsUserInput.map((ac) => ac.approval.toolCallId);
   let lastExecutionResults = null;
@@ -75738,6 +76116,9 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
   const conversationId = requestedConversationId ?? "default";
   const normalizedAgentId = normalizeCwdAgentId(agentId);
   const turnWorkingDirectory = getConversationWorkingDirectory(runtime.listener, normalizedAgentId, conversationId);
+  const turnPermissionModeState = {
+    ...getConversationPermissionModeState(runtime.listener, normalizedAgentId, conversationId)
+  };
   const msgRunIds = [];
   let postStopApprovalRecoveryRetries = 0;
   let llmApiErrorRetries = 0;
@@ -75820,6 +76201,7 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
       streamTokens: true,
       background: true,
       workingDirectory: turnWorkingDirectory,
+      permissionModeState: turnPermissionModeState,
       ...pendingNormalizationInterruptedToolCallIds.length > 0 ? {
         approvalNormalization: {
           interruptedToolCallIds: pendingNormalizationInterruptedToolCallIds
@@ -76102,6 +76484,7 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
         agentId,
         conversationId,
         turnWorkingDirectory,
+        turnPermissionModeState,
         dequeuedBatchId,
         runId,
         msgRunIds,
@@ -76189,6 +76572,7 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
       console.error("[Listen] Error handling message:", error);
     }
   } finally {
+    setConversationPermissionModeState(runtime.listener, normalizedAgentId, conversationId, turnPermissionModeState);
     runtime.activeAbortController = null;
     runtime.cancelRequested = false;
     runtime.isRecoveringApprovals = false;
@@ -76205,6 +76589,7 @@ var init_turn = __esm(async () => {
   init_debug();
   init_constants2();
   init_cwd();
+  init_permissionMode();
   init_runtime();
   await __promiseAll([
     init_approval_recovery(),
@@ -76227,11 +76612,22 @@ import path22 from "node:path";
 import WebSocket4 from "ws";
 function handleModeChange(msg, socket, runtime, scope) {
   try {
-    permissionMode.setMode(msg.mode);
-    if (msg.mode === "plan" && !permissionMode.getPlanFilePath()) {
-      const planFilePath = generatePlanFilePath();
-      permissionMode.setPlanFilePath(planFilePath);
-    }
+    const agentId = scope?.agent_id ?? null;
+    const conversationId = scope?.conversation_id ?? "default";
+    const current = getConversationPermissionModeState(runtime, agentId, conversationId);
+    const next = { ...current };
+    if (msg.mode === "plan" && current.mode !== "plan") {
+      next.modeBeforePlan = current.mode;
+    }
+    next.mode = msg.mode;
+    if (msg.mode === "plan" && !current.planFilePath) {
+      next.planFilePath = generatePlanFilePath();
+    }
+    if (msg.mode !== "plan") {
+      next.planFilePath = null;
+      next.modeBeforePlan = null;
+    }
+    setConversationPermissionModeState(runtime, agentId, conversationId, next);
     emitDeviceStatusUpdate(socket, runtime, scope);
     if (isDebugEnabled()) {
       console.log(`[Listen] Mode changed to: ${msg.mode}`);
@@ -76366,6 +76762,7 @@ function createRuntime() {
     reminderState: createSharedReminderState(),
     bootWorkingDirectory,
     workingDirectoryByConversation: loadPersistedCwdMap(),
+    permissionModeByConversation: loadPersistedPermissionModeMap(),
     connectionId: null,
     connectionName: null,
     conversationRuntimes: new Map,
@@ -76786,6 +77183,12 @@ function createLegacyTestRuntime() {
         listener.workingDirectoryByConversation = value;
       }
     },
+    permissionModeByConversation: {
+      get: () => listener.permissionModeByConversation,
+      set: (value) => {
+        listener.permissionModeByConversation = value;
+      }
+    },
     bootWorkingDirectory: {
       get: () => listener.bootWorkingDirectory,
       set: (value) => {
@@ -76908,12 +77311,12 @@ var __listenClientTestUtils;
 var init_client4 = __esm(async () => {
   init_planName();
   init_constants();
-  init_mode();
   init_queueRuntime();
   init_debug();
   init_terminalHandler();
   init_constants2();
   init_cwd();
+  init_permissionMode();
   init_runtime();
   await __promiseAll([
     init_client2(),
@@ -78370,14 +78773,14 @@ function SetupUI({ onComplete }) {
       children: [
         /* @__PURE__ */ jsx_dev_runtime10.jsxDEV(AnimatedLogo, {
           color: colors.welcome.accent,
-          animate: false
+          animate: AUTH_LOGO_ANIMATE
         }, undefined, false, undefined, this),
         /* @__PURE__ */ jsx_dev_runtime10.jsxDEV(Text2, {
           children: " "
         }, undefined, false, undefined, this),
         /* @__PURE__ */ jsx_dev_runtime10.jsxDEV(Text2, {
           bold: true,
-          children: "Login to Letta Platform"
+          children: AUTH_LOGIN_LABEL
         }, undefined, false, undefined, this),
         /* @__PURE__ */ jsx_dev_runtime10.jsxDEV(Text2, {
           children: " "
@@ -78422,7 +78825,8 @@ function SetupUI({ onComplete }) {
     padding: 1,
     children: [
       /* @__PURE__ */ jsx_dev_runtime10.jsxDEV(AnimatedLogo, {
-        color: colors.welcome.accent
+        color: colors.welcome.accent,
+        animate: AUTH_LOGO_ANIMATE
       }, undefined, false, undefined, this),
       /* @__PURE__ */ jsx_dev_runtime10.jsxDEV(Text2, {
         children: " "
@@ -78445,7 +78849,7 @@ function SetupUI({ onComplete }) {
           color: selectedOption === 0 ? colors.selector.itemHighlighted : undefined,
           children: [
             selectedOption === 0 ? "> " : "  ",
-            "Login to Letta Platform"
+            AUTH_LOGIN_LABEL
           ]
         }, undefined, true, undefined, this)
       }, undefined, false, undefined, this),
@@ -78468,7 +78872,7 @@ function SetupUI({ onComplete }) {
     ]
   }, undefined, true, undefined, this);
 }
-var import_react31, jsx_dev_runtime10;
+var import_react31, jsx_dev_runtime10, AUTH_LOGIN_LABEL = "Login to Letta Code", AUTH_LOGO_ANIMATE = false;
 var init_setup_ui = __esm(async () => {
   init_colors();
   init_oauth();
@@ -103344,7 +103748,7 @@ var init_pasteRegistry = __esm(() => {
 
 // src/cli/helpers/clipboard.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync25, readFileSync as readFileSync10, statSync as statSync7, unlinkSync as unlinkSync8 } from "node:fs";
+import { existsSync as existsSync25, readFileSync as readFileSync11, statSync as statSync7, unlinkSync as unlinkSync8 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename4, extname as extname5, isAbsolute as isAbsolute17, join as join33, resolve as resolve26 } from "node:path";
 function countLines2(text) {
@@ -103397,7 +103801,7 @@ function translatePasteForImages(paste) {
         filePath = resolve26(process.cwd(), filePath);
       const ext3 = extname5(filePath || "").toLowerCase();
       if (IMAGE_EXTS.has(ext3) && existsSync25(filePath) && statSync7(filePath).isFile()) {
-        const buf = readFileSync10(filePath);
+        const buf = readFileSync11(filePath);
         const b64 = buf.toString("base64");
         const mt = ext3 === ".png" ? "image/png" : ext3 === ".jpg" || ext3 === ".jpeg" ? "image/jpeg" : ext3 === ".gif" ? "image/gif" : ext3 === ".webp" ? "image/webp" : ext3 === ".bmp" ? "image/bmp" : ext3 === ".svg" ? "image/svg+xml" : ext3 === ".tif" || ext3 === ".tiff" ? "image/tiff" : ext3 === ".heic" ? "image/heic" : ext3 === ".heif" ? "image/heif" : ext3 === ".avif" ? "image/avif" : "application/octet-stream";
         const id = allocateImage({
@@ -103457,7 +103861,7 @@ async function tryImportClipboardImageMac() {
     return null;
   const { tempPath, uti } = clipboardResult;
   try {
-    const buffer = readFileSync10(tempPath);
+    const buffer = readFileSync11(tempPath);
     try {
       unlinkSync8(tempPath);
     } catch {}
@@ -104053,7 +104457,7 @@ import {
   copyFileSync,
   existsSync as existsSync26,
   mkdirSync as mkdirSync19,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   writeFileSync as writeFileSync13
 } from "node:fs";
 import { homedir as homedir28, platform as platform4 } from "node:os";
@@ -104123,7 +104527,7 @@ function keybindingExists(keybindingsPath) {
   if (!existsSync26(keybindingsPath))
     return false;
   try {
-    const content = readFileSync11(keybindingsPath, { encoding: "utf-8" });
+    const content = readFileSync12(keybindingsPath, { encoding: "utf-8" });
     const keybindings = parseKeybindings(content);
     if (!keybindings)
       return false;
@@ -104156,7 +104560,7 @@ function installKeybinding(keybindingsPath) {
     let backupPath = null;
     if (existsSync26(keybindingsPath)) {
       backupPath = createBackup(keybindingsPath);
-      const content = readFileSync11(keybindingsPath, { encoding: "utf-8" });
+      const content = readFileSync12(keybindingsPath, { encoding: "utf-8" });
       const parsed = parseKeybindings(content);
       if (parsed === null) {
         return {
@@ -104187,7 +104591,7 @@ function removeKeybinding(keybindingsPath) {
     if (!existsSync26(keybindingsPath)) {
       return { success: true };
     }
-    const content = readFileSync11(keybindingsPath, { encoding: "utf-8" });
+    const content = readFileSync12(keybindingsPath, { encoding: "utf-8" });
     const keybindings = parseKeybindings(content);
     if (!keybindings) {
       return {
@@ -104264,7 +104668,7 @@ function wezTermDeleteFixExists(configPath) {
   if (!existsSync26(configPath))
     return false;
   try {
-    const content = readFileSync11(configPath, { encoding: "utf-8" });
+    const content = readFileSync12(configPath, { encoding: "utf-8" });
     return content.includes("Letta Code: Fix Delete key") || content.includes("key = 'Delete'") && content.includes("SendString") && content.includes("\\x1b[3~");
   } catch {
     return false;
@@ -104281,7 +104685,7 @@ function installWezTermDeleteFix() {
     if (existsSync26(configPath)) {
       backupPath = `${configPath}.letta-backup`;
       copyFileSync(configPath, backupPath);
-      content = readFileSync11(configPath, { encoding: "utf-8" });
+      content = readFileSync12(configPath, { encoding: "utf-8" });
     }
     if (content.includes("return {") && !content.includes("local config")) {
       content = content.replace(/return\s*\{/, "local config = {");
@@ -110039,7 +110443,7 @@ import {
   existsSync as existsSync28,
   mkdirSync as mkdirSync20,
   mkdtempSync,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   rmSync as rmSync3,
   writeFileSync as writeFileSync14
 } from "node:fs";
@@ -110297,7 +110701,7 @@ function writeWorkflow(repoDir, workflowPath, content) {
   const next = `${content.trimEnd()}
 `;
   if (existsSync28(absolutePath)) {
-    const previous = readFileSync12(absolutePath, "utf8");
+    const previous = readFileSync13(absolutePath, "utf8");
     if (previous === next) {
       return false;
     }
@@ -112561,7 +112965,7 @@ var init_McpSelector = __esm(async () => {
 });
 
 // src/agent/memoryScanner.ts
-import { readdirSync as readdirSync12, readFileSync as readFileSync13, statSync as statSync9 } from "node:fs";
+import { readdirSync as readdirSync12, readFileSync as readFileSync14, statSync as statSync9 } from "node:fs";
 import { join as join38, relative as relative14 } from "node:path";
 function scanMemoryFilesystem(memoryRoot) {
   const nodes = [];
@@ -112626,7 +113030,7 @@ function getFileNodes(nodes) {
 }
 function readFileContent(fullPath) {
   try {
-    return readFileSync13(fullPath, "utf-8");
+    return readFileSync14(fullPath, "utf-8");
   } catch {
     return "(unable to read file)";
   }
@@ -122143,7 +122547,7 @@ var init_contextChart = __esm(() => {
 
 // src/cli/helpers/initCommand.ts
 import { execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync31, readdirSync as readdirSync13, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync31, readdirSync as readdirSync13, readFileSync as readFileSync15 } from "node:fs";
 import { join as join41 } from "node:path";
 function hasActiveInitSubagent() {
   const snapshot = getSnapshot2();
@@ -122191,7 +122595,7 @@ function gatherExistingMemory(agentId) {
           walk(join41(dir, entry.name), rel);
         } else if (entry.name.endsWith(".md")) {
           try {
-            const content = readFileSync14(join41(dir, entry.name), "utf-8");
+            const content = readFileSync15(join41(dir, entry.name), "utf-8");
             paths.push(rel);
             sections.push(`── ${rel}
 ${content.slice(0, 2000)}`);
@@ -123588,7 +123992,7 @@ __export(exports_shellAliases, {
   expandAliases: () => expandAliases,
   clearAliasCache: () => clearAliasCache
 });
-import { existsSync as existsSync32, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync32, readFileSync as readFileSync16 } from "node:fs";
 import { homedir as homedir33 } from "node:os";
 import { join as join43 } from "node:path";
 function parseAliasesFromFile(filePath) {
@@ -123597,7 +124001,7 @@ function parseAliasesFromFile(filePath) {
     return aliases;
   }
   try {
-    const content = readFileSync15(filePath, "utf-8");
+    const content = readFileSync16(filePath, "utf-8");
     const lines = content.split(`
 `);
     let inFunction = false;
@@ -124492,7 +124896,7 @@ var exports_App = {};
 __export(exports_App, {
   default: () => App2
 });
-import { existsSync as existsSync33, readFileSync as readFileSync16, renameSync as renameSync2, writeFileSync as writeFileSync16 } from "node:fs";
+import { existsSync as existsSync33, readFileSync as readFileSync17, renameSync as renameSync2, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir34, tmpdir as tmpdir6 } from "node:os";
 import { join as join44, relative as relative16 } from "node:path";
 function deriveReasoningEffort(modelSettings, llmConfig) {
@@ -124677,7 +125081,7 @@ function _readPlanFile(fallbackPlanFilePath) {
     return `Plan file not found at ${planFilePath}`;
   }
   try {
-    return readFileSync16(planFilePath, "utf-8");
+    return readFileSync17(planFilePath, "utf-8");
   } catch {
     return `Failed to read plan file at ${planFilePath}`;
   }
@@ -124898,6 +125302,8 @@ function App2({
   const [pendingApprovals, setPendingApprovals] = import_react101.useState([]);
   const [approvalContexts, setApprovalContexts] = import_react101.useState([]);
   const [approvalResults, setApprovalResults] = import_react101.useState([]);
+  const lastAutoApprovedEnterPlanToolCallIdRef = import_react101.useRef(null);
+  const lastAutoHandledExitPlanToolCallIdRef = import_react101.useRef(null);
   const [isExecutingTool, setIsExecutingTool] = import_react101.useState(false);
   const [queuedApprovalResults, setQueuedApprovalResults] = import_react101.useState(null);
   const toolAbortControllerRef = import_react101.useRef(null);
@@ -125966,10 +126372,10 @@ function App2({
     if (!planFilePath)
       return;
     try {
-      const { readFileSync: readFileSync17, existsSync: existsSync34 } = __require("node:fs");
+      const { readFileSync: readFileSync18, existsSync: existsSync34 } = __require("node:fs");
       if (!existsSync34(planFilePath))
         return;
-      const planContent = readFileSync17(planFilePath, "utf-8");
+      const planContent = readFileSync18(planFilePath, "utf-8");
       const previewItem = {
         kind: "approval_preview",
         id: `approval-preview-${toolCallId}`,
@@ -131900,6 +132306,9 @@ ${guidance}`);
     const currentIndex = approvalResults.length;
     const approval = pendingApprovals[currentIndex];
     if (approval?.toolName === "ExitPlanMode") {
+      if (lastAutoHandledExitPlanToolCallIdRef.current === approval.toolCallId) {
+        return;
+      }
       const mode = permissionMode.getMode();
       const activePlanPath = permissionMode.getPlanFilePath();
       const fallbackPlanPath = lastPlanFilePathRef.current;
@@ -131907,6 +132316,7 @@ ${guidance}`);
       if (mode !== "plan") {
         if (mode === "bypassPermissions") {
           if (hasUsablePlan) {
+            lastAutoHandledExitPlanToolCallIdRef.current = approval.toolCallId;
             handlePlanApprove();
             return;
           }
@@ -131927,6 +132337,7 @@ ${guidance}`);
           lines: ["⚠️ Plan mode session expired (use /plan to re-enter)"]
         });
         buffersRef.current.order.push(statusId);
+        lastAutoHandledExitPlanToolCallIdRef.current = approval.toolCallId;
         const denialResults = [
           {
             type: "approval",
@@ -131946,6 +132357,7 @@ ${guidance}`);
         return;
       }
       if (!hasUsablePlan) {
+        lastAutoHandledExitPlanToolCallIdRef.current = approval.toolCallId;
         const planFilePath = activePlanPath ?? fallbackPlanPath;
         const plansDir = join44(homedir34(), ".letta", "plans");
         handlePlanKeepPlanning(`You must write your plan to a plan file before exiting plan mode.
@@ -132089,6 +132501,10 @@ If using apply_patch, use this exact relative patch path: ${applyPatchRelativePa
     const approval = pendingApprovals[currentIndex];
     if (approval?.toolName === "EnterPlanMode") {
       if (permissionMode.getMode() === "bypassPermissions") {
+        if (lastAutoApprovedEnterPlanToolCallIdRef.current === approval.toolCallId) {
+          return;
+        }
+        lastAutoApprovedEnterPlanToolCallIdRef.current = approval.toolCallId;
         handleEnterPlanModeApprove(true);
       }
     }
@@ -133317,7 +133733,7 @@ import {
   copyFileSync as copyFileSync2,
   existsSync as existsSync34,
   mkdirSync as mkdirSync22,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync18,
   writeFileSync as writeFileSync17
 } from "node:fs";
 import { homedir as homedir35, platform as platform5 } from "node:os";
@@ -133387,7 +133803,7 @@ function keybindingExists2(keybindingsPath) {
   if (!existsSync34(keybindingsPath))
     return false;
   try {
-    const content = readFileSync17(keybindingsPath, { encoding: "utf-8" });
+    const content = readFileSync18(keybindingsPath, { encoding: "utf-8" });
     const keybindings = parseKeybindings2(content);
     if (!keybindings)
       return false;
@@ -133420,7 +133836,7 @@ function installKeybinding2(keybindingsPath) {
     let backupPath = null;
     if (existsSync34(keybindingsPath)) {
       backupPath = createBackup2(keybindingsPath);
-      const content = readFileSync17(keybindingsPath, { encoding: "utf-8" });
+      const content = readFileSync18(keybindingsPath, { encoding: "utf-8" });
       const parsed = parseKeybindings2(content);
       if (parsed === null) {
         return {
@@ -133451,7 +133867,7 @@ function removeKeybinding2(keybindingsPath) {
     if (!existsSync34(keybindingsPath)) {
       return { success: true };
     }
-    const content = readFileSync17(keybindingsPath, { encoding: "utf-8" });
+    const content = readFileSync18(keybindingsPath, { encoding: "utf-8" });
     const keybindings = parseKeybindings2(content);
     if (!keybindings) {
       return {
@@ -133528,7 +133944,7 @@ function wezTermDeleteFixExists2(configPath) {
   if (!existsSync34(configPath))
     return false;
   try {
-    const content = readFileSync17(configPath, { encoding: "utf-8" });
+    const content = readFileSync18(configPath, { encoding: "utf-8" });
     return content.includes("Letta Code: Fix Delete key") || content.includes("key = 'Delete'") && content.includes("SendString") && content.includes("\\x1b[3~");
   } catch {
     return false;
@@ -133545,7 +133961,7 @@ function installWezTermDeleteFix2() {
     if (existsSync34(configPath)) {
       backupPath = `${configPath}.letta-backup`;
       copyFileSync2(configPath, backupPath);
-      content = readFileSync17(configPath, { encoding: "utf-8" });
+      content = readFileSync18(configPath, { encoding: "utf-8" });
     }
     if (content.includes("return {") && !content.includes("local config")) {
       content = content.replace(/return\s*\{/, "local config = {");
@@ -138981,8 +139397,10 @@ class PermissionModeManager2 {
   getPlanFilePath() {
     return getGlobalPlanFilePath2();
   }
-  checkModeOverride(toolName, toolArgs, workingDirectory = process.cwd()) {
-    switch (this.currentMode) {
+  checkModeOverride(toolName, toolArgs, workingDirectory = process.cwd(), modeOverride, planFilePathOverride) {
+    const effectiveMode = modeOverride ?? this.currentMode;
+    const _effectivePlanFilePath = planFilePathOverride !== undefined ? planFilePathOverride : this.getPlanFilePath();
+    switch (effectiveMode) {
       case "bypassPermissions":
         return "allow";
       case "acceptEdits":
@@ -140356,6 +140774,7 @@ var telemetry2 = new TelemetryManager2;
 init_subagents();
 init_fileIndex();
 init_constants();
+init_mode();
 init_debug();
 await __promiseAll([
   init_approval_execution(),
@@ -140648,7 +141067,7 @@ import {
   existsSync as existsSync19,
   mkdirSync as mkdirSync14,
   readdirSync as readdirSync9,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   unlinkSync as unlinkSync6
 } from "node:fs";
 import { homedir as homedir23 } from "node:os";
@@ -140705,7 +141124,7 @@ class DebugLogFile2 {
     try {
       if (!existsSync19(this.logPath))
         return;
-      const content = readFileSync8(this.logPath, "utf8");
+      const content = readFileSync9(this.logPath, "utf8");
       const lines = content.trimEnd().split(`
 `);
       return lines.slice(-maxLines).join(`
@@ -142186,4 +142605,4 @@ Error during initialization: ${message}`);
 }
 main();
 
-//# debugId=3F2642C6F96B1B5B64756E2164756E21
+//# debugId=271668920D12255A64756E2164756E21