@letta-ai/letta-code 0.21.10 → 0.21.12

package/letta.js

@@ -3269,7 +3269,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@letta-ai/letta-code",
-    version: "0.21.10",
+    version: "0.21.12",
     description: "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
     type: "module",
     bin: {
@@ -6841,7 +6841,7 @@ skills:
 model: auto
 memoryBlocks: none
 mode: stateless
-permissionMode: bypassPermissions
+permissionMode: memory
 ---
 
 You are a history analysis subagent. You create a git worktree from the agent's memory repo, read conversation history from Claude Code or Codex, then **directly create and update memory files** in your worktree based on what you learn.
@@ -6921,12 +6921,18 @@ Keep specific correction counts ("corrected 10+ times"), specific file paths, an
 \`\`\`bash
 MEMORY_DIR=~/.letta/agents/$LETTA_PARENT_AGENT_ID/memory
 WORKTREE_DIR=~/.letta/agents/$LETTA_PARENT_AGENT_ID/memory-worktrees
-BRANCH_NAME="migration-$(date +%s)"
+# Run \`date +%s\` first, then paste that exact output below.
+BRANCH_NAME="migration-<epoch-seconds>"
 mkdir -p "$WORKTREE_DIR"
 cd "$MEMORY_DIR"
 git worktree add "$WORKTREE_DIR/$BRANCH_NAME" -b "$BRANCH_NAME"
 \`\`\`
 
+Use epoch seconds from a prior \`date +%s\` command so branch names match the
+old behavior. Do not use shell command substitution like \`$(date +%s)\` in the
+branch assignment because memory-mode shell permissions deny command
+substitution.
+
 If worktree creation fails (locked index), retry up to 3 times with backoff (sleep 2, 5, 10). Never delete \`.git/index.lock\` manually. All edits go in \`$WORKTREE_DIR/$BRANCH_NAME/\`.
 
 ### 2. Read existing memory
@@ -7043,7 +7049,7 @@ description: Fast initialization of agent memory — reads key project files and
 tools: Read, Write, Edit, Bash, Glob
 model: auto-fast
 memoryBlocks: none
-permissionMode: bypassPermissions
+permissionMode: memory
 ---
 
 You are a fast memory initialization subagent. Your job is to quickly scan a project and create a **skeleton memory hierarchy** for the parent agent. This hierarchy starts minimal and gets fleshed out as the user keeps interacting with the agent.
@@ -7151,7 +7157,7 @@ description: Decompose and reorganize memory files into focused, single-purpose
 tools: Read, Edit, Write, Glob, Grep, Bash, TaskOutput
 model: auto
 memoryBlocks: none
-permissionMode: bypassPermissions
+permissionMode: memory
 ---
 
 You are a memory defragmentation subagent. You work directly on the git-backed memory filesystem to decompose and reorganize memory files.
@@ -7226,12 +7232,18 @@ making changes.
 **Create worktree:**
 
 \`\`\`bash
-BRANCH="defrag-$(date +%s)"
+# Run \`date +%s\` first, then paste that exact output below.
+BRANCH="defrag-<epoch-seconds>"
 mkdir -p "$WORKTREE_DIR"
 cd "$MEMORY_DIR"
 git worktree add "$WORKTREE_DIR/$BRANCH" -b "$BRANCH"
 \`\`\`
 
+Use epoch seconds from a prior \`date +%s\` command so branch names match the
+old behavior. Do not use shell command substitution like \`$(date +%s)\` in the
+branch assignment because memory-mode shell permissions deny command
+substitution.
+
 All subsequent file operations target the worktree:
 \`$WORKTREE_DIR/$BRANCH/system/\` (not the main memory dir).
 
@@ -7506,7 +7518,7 @@ tools: Read, Edit, Write, Glob, Grep, Bash, TaskOutput
 model: auto
 memoryBlocks: none
 mode: stateless
-permissionMode: bypassPermissions
+permissionMode: memory
 ---
 
 You are a reflection subagent — a background agent that asynchronously processes conversations after they occur, similar to a "sleep-time" memory consolidation process.
@@ -52238,9 +52250,138 @@ var init_hooks = __esm(async () => {
   init_types();
 });
 
-// src/permissions/readOnlyShell.ts
+// src/permissions/memoryScope.ts
 import { homedir as homedir11 } from "node:os";
-import { resolve as resolve4 } from "node:path";
+import { basename, dirname as dirname4, isAbsolute as isAbsolute2, resolve as resolve4 } from "node:path";
+function normalizeScopedPath(path4) {
+  const resolvedPath = resolve4(expandHomePath(path4));
+  const normalized = resolvedPath.replace(/\\/g, "/");
+  return normalized.replace(/\/+$/, "") || "/";
+}
+function expandHomePath(path4) {
+  const value = path4.trim();
+  const homeDir = homedir11();
+  if (value.startsWith("~/")) {
+    return resolve4(homeDir, value.slice(2));
+  }
+  if (value.startsWith("$HOME/")) {
+    return resolve4(homeDir, value.slice(6));
+  }
+  if (value.startsWith('"$HOME/')) {
+    return resolve4(homeDir, value.slice(7).replace(/"$/, ""));
+  }
+  return value;
+}
+function resolveScopedTargetPath(targetPath, workingDirectory) {
+  const trimmedPath = targetPath.trim();
+  if (!trimmedPath)
+    return null;
+  if (trimmedPath.startsWith("~/") || trimmedPath.startsWith("$HOME/")) {
+    return normalizeScopedPath(trimmedPath);
+  }
+  if (isAbsolute2(trimmedPath) || /^[a-zA-Z]:[\\/]/.test(trimmedPath)) {
+    return normalizeScopedPath(trimmedPath);
+  }
+  return normalizeScopedPath(resolve4(workingDirectory, trimmedPath));
+}
+function isPathWithinRoots(path4, roots) {
+  const normalizedPath = normalizeScopedPath(path4);
+  return roots.some((root) => {
+    const normalizedRoot = normalizeScopedPath(root);
+    return normalizedPath === normalizedRoot || normalizedPath.startsWith(`${normalizedRoot}/`);
+  });
+}
+function addRootAndSiblingWorktree(root, acc) {
+  const normalizedRoot = normalizeScopedPath(root);
+  if (!normalizedRoot) {
+    return;
+  }
+  acc.add(normalizedRoot);
+  const leaf = basename(normalizedRoot);
+  if (leaf === "memory") {
+    acc.add(normalizeScopedPath(resolve4(dirname4(normalizedRoot), "memory-worktrees")));
+  }
+}
+function getExplicitEnvRoots(env3) {
+  const orderedRoots = [
+    env3.MEMORY_DIR,
+    env3.LETTA_MEMORY_DIR,
+    env3.PARENT_MEMORY_DIR
+  ].map((value) => value?.trim() ?? "").filter((value) => value.length > 0);
+  const explicitRootSet = new Set;
+  for (const root of orderedRoots) {
+    addRootAndSiblingWorktree(root, explicitRootSet);
+  }
+  return {
+    explicitRoots: [...explicitRootSet],
+    primaryRoot: orderedRoots.length > 0 ? normalizeScopedPath(orderedRoots[0]) : null
+  };
+}
+function deriveAgentId(env3, explicitAgentId) {
+  const explicit = explicitAgentId?.trim();
+  if (explicit) {
+    return explicit;
+  }
+  const envAgentId = (env3.AGENT_ID || env3.LETTA_AGENT_ID || "").trim();
+  if (envAgentId) {
+    return envAgentId;
+  }
+  try {
+    return getCurrentAgentId().trim();
+  } catch {
+    return null;
+  }
+}
+function getFallbackRoots(env3, homeDir, currentAgentId, parentAgentId) {
+  const fallbackRoots = new Set;
+  const resolvedCurrentAgentId = deriveAgentId(env3, currentAgentId);
+  const resolvedParentAgentId = (parentAgentId || env3.LETTA_PARENT_AGENT_ID || "").trim() || null;
+  let primaryRoot = null;
+  if (resolvedCurrentAgentId) {
+    const currentRoot = getMemoryFilesystemRoot(resolvedCurrentAgentId, homeDir);
+    addRootAndSiblingWorktree(currentRoot, fallbackRoots);
+    primaryRoot = normalizeScopedPath(currentRoot);
+  }
+  if (resolvedParentAgentId && resolvedParentAgentId !== resolvedCurrentAgentId) {
+    const parentRoot = getMemoryFilesystemRoot(resolvedParentAgentId, homeDir);
+    addRootAndSiblingWorktree(parentRoot, fallbackRoots);
+    if (!primaryRoot) {
+      primaryRoot = normalizeScopedPath(parentRoot);
+    }
+  }
+  return {
+    roots: [...fallbackRoots],
+    primaryRoot
+  };
+}
+function resolveAllowedMemoryRoots(options = {}) {
+  const env3 = options.env ?? process.env;
+  const homeDir = options.homeDir ?? homedir11();
+  const explicit = getExplicitEnvRoots(env3);
+  if (explicit.explicitRoots.length > 0) {
+    return {
+      roots: explicit.explicitRoots,
+      explicitRoots: explicit.explicitRoots,
+      primaryRoot: explicit.primaryRoot,
+      usedFallback: false
+    };
+  }
+  const fallback = getFallbackRoots(env3, homeDir, options.currentAgentId, options.parentAgentId);
+  return {
+    roots: fallback.roots,
+    explicitRoots: [],
+    primaryRoot: fallback.primaryRoot,
+    usedFallback: fallback.roots.length > 0
+  };
+}
+var init_memoryScope = __esm(() => {
+  init_context();
+  init_memoryFilesystem();
+});
+
+// src/permissions/readOnlyShell.ts
+import { homedir as homedir12 } from "node:os";
+import { resolve as resolve5 } from "node:path";
 function splitShellSegments(input) {
   const segments = [];
   let current = "";
@@ -52312,6 +52453,13 @@ function splitShellSegments(input) {
       i += 1;
       continue;
     }
+    if (ch === `
+` || ch === "\r") {
+      segments.push(current);
+      current = "";
+      i += 1;
+      continue;
+    }
     if (ch === "|") {
       segments.push(current);
       current = "";
@@ -52503,7 +52651,7 @@ function isUnderAllowedPathRoot(value, allowedPathRoots) {
   }
   const resolvedValue = expandPath(value);
   return allowedPathRoots.some((root) => {
-    const normalizedRoot = normalizeSeparators(resolve4(root));
+    const normalizedRoot = normalizeSeparators(resolve5(root));
     return resolvedValue === normalizedRoot || resolvedValue.startsWith(`${normalizedRoot}/`);
   });
 }
@@ -52546,14 +52694,14 @@ function parseGitInvocation(tokens, options) {
   return { subcommand: null, isSafePath: true };
 }
 function getAllowedMemoryPrefixes(agentId) {
-  const home = homedir11();
+  const home = homedir12();
   const prefixes = [
-    normalizeSeparators(resolve4(home, ".letta", "agents", agentId, "memory")),
-    normalizeSeparators(resolve4(home, ".letta", "agents", agentId, "memory-worktrees"))
+    normalizeSeparators(resolve5(home, ".letta", "agents", agentId, "memory")),
+    normalizeSeparators(resolve5(home, ".letta", "agents", agentId, "memory-worktrees"))
   ];
   const parentId = process.env.LETTA_PARENT_AGENT_ID;
   if (parentId && parentId !== agentId) {
-    prefixes.push(normalizeSeparators(resolve4(home, ".letta", "agents", parentId, "memory")), normalizeSeparators(resolve4(home, ".letta", "agents", parentId, "memory-worktrees")));
+    prefixes.push(normalizeSeparators(resolve5(home, ".letta", "agents", parentId, "memory")), normalizeSeparators(resolve5(home, ".letta", "agents", parentId, "memory-worktrees")));
   }
   return prefixes;
 }
@@ -52561,122 +52709,315 @@ function normalizeSeparators(p) {
   return p.replace(/\\/g, "/");
 }
 function expandPath(p) {
-  const home = homedir11();
-  if (p.startsWith("~/")) {
-    return normalizeSeparators(resolve4(home, p.slice(2)));
+  return normalizeScopedPath(p);
+}
+function expandScopedVariables(value, env3, shellVars) {
+  let unresolved = false;
+  const expanded = value.replace(/\$(?:{([A-Za-z_][A-Za-z0-9_]*)}|([A-Za-z_][A-Za-z0-9_]*))/g, (_match, bracedName, bareName) => {
+    const name = bracedName || bareName;
+    if (!name) {
+      unresolved = true;
+      return "";
+    }
+    if (name === "HOME") {
+      return homedir12();
+    }
+    const scopedValue = shellVars[name];
+    if (typeof scopedValue === "string") {
+      return scopedValue;
+    }
+    const envValue = env3[name];
+    if (typeof envValue === "string") {
+      return envValue;
+    }
+    unresolved = true;
+    return "";
+  });
+  return unresolved ? null : expanded;
+}
+function normalizeScopePath(path4, cwd2, env3, shellVars) {
+  const expandedPath = expandScopedVariables(path4, env3, shellVars);
+  if (!expandedPath) {
+    return null;
   }
-  if (p.startsWith("$HOME/")) {
-    return normalizeSeparators(resolve4(home, p.slice(6)));
+  if (expandedPath.startsWith("~/") || expandedPath.startsWith("$HOME/") || expandedPath.startsWith('"$HOME/') || expandedPath.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(expandedPath)) {
+    return normalizeScopedPath(expandedPath);
   }
-  if (p.startsWith('"$HOME/')) {
-    return normalizeSeparators(resolve4(home, p.slice(7).replace(/"$/, "")));
+  if (cwd2) {
+    return normalizeScopedPath(resolve5(cwd2, expandedPath));
   }
-  return normalizeSeparators(resolve4(p));
+  return null;
+}
+function parseScopedAssignmentToken(token) {
+  const match = token.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+  if (!match) {
+    return null;
+  }
+  return {
+    name: match[1] ?? "",
+    value: stripQuotes(match[2] ?? "")
+  };
+}
+function applyScopedAssignments(tokens, env3, shellVars) {
+  if (tokens.length === 0) {
+    return false;
+  }
+  for (const token of tokens) {
+    const assignment = parseScopedAssignmentToken(token);
+    if (!assignment) {
+      return false;
+    }
+    const expandedValue = expandScopedVariables(assignment.value, env3, shellVars);
+    if (expandedValue === null) {
+      return false;
+    }
+    if (expandedValue.startsWith("~/") || expandedValue.startsWith("$HOME/") || expandedValue.startsWith('"$HOME/') || expandedValue.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(expandedValue)) {
+      shellVars[assignment.name] = normalizeScopedPath(expandedValue);
+    } else {
+      shellVars[assignment.name] = expandedValue;
+    }
+  }
+  return true;
 }
-function isUnderMemoryDir(path4, prefixes) {
-  const resolved = expandPath(path4);
-  return prefixes.some((prefix) => resolved === prefix || resolved.startsWith(`${prefix}/`));
+function hasUnsafeRebaseOption(tokens, startIndex) {
+  for (let i = startIndex;i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (!token) {
+      continue;
+    }
+    const lower = token.toLowerCase();
+    if (lower === "--exec" || lower.startsWith("--exec=") || lower === "-x" || lower.startsWith("-x") && lower.length > 2 || lower === "--interactive" || lower === "-i" || lower === "--edit-todo") {
+      return true;
+    }
+  }
+  return false;
 }
-function extractCdTarget(segment) {
+function parseScopedGitInvocation(tokens, cwd2, allowedRoots, env3, shellVars) {
+  let index = 1;
+  let resolvedCwd = cwd2;
+  while (index < tokens.length) {
+    const token = tokens[index];
+    if (!token) {
+      index += 1;
+      continue;
+    }
+    if (token === "-C") {
+      const pathToken = tokens[index + 1];
+      if (!pathToken) {
+        return {
+          subcommand: null,
+          worktreeSubcommand: null,
+          resolvedCwd,
+          isSafe: false
+        };
+      }
+      const nextCwd = normalizeScopePath(pathToken, resolvedCwd, env3, shellVars);
+      if (!nextCwd || !isPathWithinRoots(nextCwd, allowedRoots)) {
+        return {
+          subcommand: null,
+          worktreeSubcommand: null,
+          resolvedCwd,
+          isSafe: false
+        };
+      }
+      resolvedCwd = nextCwd;
+      index += 2;
+      continue;
+    }
+    if (token === "-c") {
+      const configToken = tokens[index + 1];
+      if (!configToken) {
+        return {
+          subcommand: null,
+          worktreeSubcommand: null,
+          resolvedCwd,
+          isSafe: false
+        };
+      }
+      if (!/^http\.extraHeader=/.test(configToken)) {
+        return {
+          subcommand: null,
+          worktreeSubcommand: null,
+          resolvedCwd,
+          isSafe: false
+        };
+      }
+      index += 2;
+      continue;
+    }
+    const subcommand = token;
+    if (!SAFE_MEMORY_GIT_SUBCOMMANDS.has(subcommand)) {
+      if (resolvedCwd && SAFE_MEMORY_COMMANDS.has("git")) {
+        const rawSegment = tokens.join(" ");
+        if (subcommand === "ls-tree" && !/\s-o\b/.test(rawSegment)) {
+          return {
+            subcommand,
+            worktreeSubcommand: null,
+            resolvedCwd,
+            isSafe: true
+          };
+        }
+      }
+      return {
+        subcommand,
+        worktreeSubcommand: null,
+        resolvedCwd,
+        isSafe: false
+      };
+    }
+    const worktreeSubcommand = subcommand === "worktree" ? tokens[index + 1] ?? null : null;
+    if (subcommand === "worktree" && worktreeSubcommand && !new Set(["add", "remove", "list"]).has(worktreeSubcommand)) {
+      return {
+        subcommand,
+        worktreeSubcommand,
+        resolvedCwd,
+        isSafe: false
+      };
+    }
+    if (subcommand === "rebase" && hasUnsafeRebaseOption(tokens, index + 1)) {
+      return {
+        subcommand,
+        worktreeSubcommand,
+        resolvedCwd,
+        isSafe: false
+      };
+    }
+    return { subcommand, worktreeSubcommand, resolvedCwd, isSafe: true };
+  }
+  return {
+    subcommand: null,
+    worktreeSubcommand: null,
+    resolvedCwd,
+    isSafe: false
+  };
+}
+function tokenLooksLikePath(token) {
+  return token.includes("/") || token.includes("\\") || token === "." || token === ".." || token.startsWith("$") || token.startsWith("~") || token.startsWith("$HOME");
+}
+function validateScopedTokens(tokens, cwd2, allowedRoots, env3, shellVars) {
+  return tokens.every((token, index) => {
+    if (!tokenLooksLikePath(token)) {
+      return true;
+    }
+    const previous = index > 0 ? tokens[index - 1] : null;
+    if (previous && ["-m", "--message", "--author", "--format"].includes(previous)) {
+      return true;
+    }
+    const resolved = normalizeScopePath(token, cwd2, env3, shellVars);
+    return resolved ? isPathWithinRoots(resolved, allowedRoots) : false;
+  });
+}
+function isAllowedMemorySegment(segment, cwd2, allowedRoots, env3, shellVars) {
   const tokens = tokenize4(segment);
-  if (tokens[0] === "cd" && tokens[1]) {
-    return tokens[1];
+  if (tokens.length === 0) {
+    return { nextCwd: cwd2, safe: false };
   }
-  return null;
+  if (applyScopedAssignments(tokens, env3, shellVars)) {
+    return { nextCwd: cwd2, safe: true };
+  }
+  const command = tokens[0];
+  if (!command) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  if (command === "cd") {
+    const target = tokens[1];
+    if (!target) {
+      return { nextCwd: cwd2, safe: false };
+    }
+    const resolved = normalizeScopePath(target, cwd2, env3, shellVars);
+    return {
+      nextCwd: resolved,
+      safe: resolved ? isPathWithinRoots(resolved, allowedRoots) : false
+    };
+  }
+  if (!SAFE_MEMORY_COMMANDS.has(command)) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  if (command === "git") {
+    const parsed = parseScopedGitInvocation(tokens, cwd2, allowedRoots, env3, shellVars);
+    if (!parsed.isSafe) {
+      return { nextCwd: parsed.resolvedCwd, safe: false };
+    }
+    const effectiveCwd = parsed.resolvedCwd;
+    if (!effectiveCwd || !isPathWithinRoots(effectiveCwd, allowedRoots)) {
+      return { nextCwd: effectiveCwd, safe: false };
+    }
+    if (!validateScopedTokens(tokens, effectiveCwd, allowedRoots, env3, shellVars)) {
+      return { nextCwd: effectiveCwd, safe: false };
+    }
+    return { nextCwd: effectiveCwd, safe: true };
+  }
+  if (tokens.some((token) => tokenLooksLikePath(token))) {
+    if (!validateScopedTokens(tokens.slice(1), cwd2, allowedRoots, env3, shellVars)) {
+      return { nextCwd: cwd2, safe: false };
+    }
+    return { nextCwd: cwd2, safe: true };
+  }
+  if (!cwd2 || !isPathWithinRoots(cwd2, allowedRoots)) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  if (command === "find" && /-delete|\s-exec\b/.test(segment)) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  if (command === "sort" && /\s-o\b/.test(segment)) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  if (!validateScopedTokens(tokens.slice(1), cwd2, allowedRoots, env3, shellVars)) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  return { nextCwd: cwd2, safe: true };
 }
-function isMemoryDirCommand(command, agentId) {
-  if (!command || !agentId) {
+function isScopedMemoryShellCommand(command, allowedRoots, options = {}) {
+  if (!command || allowedRoots.length === 0) {
     return false;
   }
+  if (Array.isArray(command)) {
+    if (command.length === 0) {
+      return false;
+    }
+    const [executable, ...rest] = command;
+    if (executable && isShellExecutor(executable)) {
+      const nested = extractDashCArgument(rest);
+      if (!nested) {
+        return false;
+      }
+      return isScopedMemoryShellCommand(stripQuotes(nested), allowedRoots, options);
+    }
+  }
   const commandStr = typeof command === "string" ? command : command.join(" ");
   const trimmed = commandStr.trim();
   if (!trimmed) {
     return false;
   }
-  const prefixes = getAllowedMemoryPrefixes(agentId);
-  const segments = trimmed.split(/&&|\|\||;/).map((s) => s.trim()).filter(Boolean);
+  const segments = splitShellSegments(trimmed);
+  if (!segments) {
+    return false;
+  }
   if (segments.length === 0) {
     return false;
   }
-  let cwd2 = null;
+  const env3 = options.env ?? process.env;
+  const shellVars = {};
+  const initialCwd = options.workingDirectory ? normalizeScopePath(options.workingDirectory, null, env3, shellVars) : null;
+  let cwd2 = initialCwd;
   for (const segment of segments) {
-    const pipeParts = segment.split(/\|/).map((s) => s.trim()).filter(Boolean);
-    for (const part of pipeParts) {
-      const cdTarget = extractCdTarget(part);
-      if (cdTarget) {
-        const resolved = cwd2 ? expandPath(resolve4(expandPath(cwd2), cdTarget)) : expandPath(cdTarget);
-        if (!isUnderMemoryDir(resolved, prefixes)) {
-          return false;
-        }
-        cwd2 = resolved;
-        continue;
-      }
-      if (cwd2 && isUnderMemoryDir(cwd2, prefixes)) {
-        const tokens2 = tokenize4(part);
-        const currentCwd = cwd2;
-        if (!currentCwd) {
-          return false;
-        }
-        const hasExternalPath = tokens2.some((t) => {
-          if (isAbsolutePathArg(t) || isHomeAnchoredPathArg(t)) {
-            return !isUnderMemoryDir(t, prefixes);
-          }
-          if (hasAbsoluteOrTraversalPathArg(t)) {
-            const resolved = expandPath(resolve4(expandPath(currentCwd), t));
-            return !isUnderMemoryDir(resolved, prefixes);
-          }
-          return false;
-        });
-        if (hasExternalPath) {
-          return false;
-        }
-        if (!MEMORY_DIR_APPROVE_ALL) {
-          const cmd = tokens2[0];
-          if (!cmd || !SAFE_MEMORY_DIR_COMMANDS.has(cmd)) {
-            return false;
-          }
-        }
-        continue;
-      }
-      const tokens = tokenize4(part);
-      const hasMemoryPath = tokens.some((t) => t.includes(".letta/agents/") && t.includes("/memory") || t.includes(".letta/agents/") && t.includes("/memory-worktrees"));
-      if (hasMemoryPath) {
-        const agentPaths = tokens.filter((t) => t.includes(".letta/agents/"));
-        if (agentPaths.every((p) => isUnderMemoryDir(p, prefixes))) {
-          if (!MEMORY_DIR_APPROVE_ALL) {
-            const cmd = tokens[0];
-            if (!cmd || !SAFE_MEMORY_DIR_COMMANDS.has(cmd)) {
-              return false;
-            }
-          }
-          continue;
-        }
-      }
+    const result = isAllowedMemorySegment(segment, cwd2, allowedRoots, env3, shellVars);
+    if (!result.safe) {
       return false;
     }
+    cwd2 = result.nextCwd;
   }
   return true;
 }
-var MEMORY_DIR_APPROVE_ALL = true, SAFE_MEMORY_DIR_COMMANDS, ALWAYS_SAFE_COMMANDS, EXTERNAL_PATH_METADATA_COMMANDS, SAFE_GIT_SUBCOMMANDS, SAFE_LETTA_COMMANDS, SAFE_GH_COMMANDS;
+function isMemoryDirCommand(command, agentId) {
+  if (!command || !agentId) {
+    return false;
+  }
+  return isScopedMemoryShellCommand(command, getAllowedMemoryPrefixes(agentId));
+}
+var ALWAYS_SAFE_COMMANDS, EXTERNAL_PATH_METADATA_COMMANDS, SAFE_GIT_SUBCOMMANDS, SAFE_MEMORY_GIT_SUBCOMMANDS, SAFE_MEMORY_COMMANDS, SAFE_LETTA_COMMANDS, SAFE_GH_COMMANDS;
 var init_readOnlyShell = __esm(() => {
-  SAFE_MEMORY_DIR_COMMANDS = new Set([
-    "git",
-    "rm",
-    "mv",
-    "mkdir",
-    "cp",
-    "ls",
-    "cat",
-    "head",
-    "tail",
-    "tree",
-    "find",
-    "wc",
-    "split",
-    "echo",
-    "sort",
-    "cd"
-  ]);
+  init_memoryScope();
   ALWAYS_SAFE_COMMANDS = new Set([
     "cat",
     "head",
@@ -52749,6 +53090,42 @@ var init_readOnlyShell = __esm(() => {
     "tag",
     "remote"
   ]);
+  SAFE_MEMORY_GIT_SUBCOMMANDS = new Set([
+    "add",
+    "commit",
+    "push",
+    "pull",
+    "rebase",
+    "status",
+    "diff",
+    "log",
+    "show",
+    "branch",
+    "tag",
+    "remote",
+    "rm",
+    "mv",
+    "merge",
+    "worktree"
+  ]);
+  SAFE_MEMORY_COMMANDS = new Set([
+    "git",
+    "rm",
+    "mv",
+    "mkdir",
+    "cp",
+    "ls",
+    "cat",
+    "head",
+    "tail",
+    "find",
+    "sort",
+    "echo",
+    "wc",
+    "split",
+    "cd",
+    "sleep"
+  ]);
   SAFE_LETTA_COMMANDS = {
     memfs: new Set(["status", "help", "backups", "export"]),
     agents: new Set(["list", "help"]),
@@ -52962,8 +53339,14 @@ var exports_mode = {};
 __export(exports_mode, {
   permissionMode: () => permissionMode
 });
-import { homedir as homedir12 } from "node:os";
-import { isAbsolute as isAbsolute2, join as join14, relative as relative3, resolve as resolve5 } from "node:path";
+import { homedir as homedir13 } from "node:os";
+import { isAbsolute as isAbsolute3, join as join14, relative as relative3 } from "node:path";
+function everyResolvedTargetIsWithinRoots(candidatePaths, roots, workingDirectory) {
+  return candidatePaths.length > 0 && candidatePaths.every((path4) => {
+    const resolvedPath = resolveScopedTargetPath(path4, workingDirectory);
+    return resolvedPath ? isPathWithinRoots(resolvedPath, roots) : false;
+  });
+}
 function getGlobalMode() {
   const global2 = globalThis;
   if (!global2[MODE_KEY]) {
@@ -52992,22 +53375,13 @@ function setGlobalModeBeforePlan(value) {
   global2[MODE_BEFORE_PLAN_KEY] = value;
 }
 function resolvePlanTargetPath(targetPath, workingDirectory) {
-  const trimmedPath = targetPath.trim();
-  if (!trimmedPath)
-    return null;
-  if (trimmedPath.startsWith("~/")) {
-    return resolve5(homedir12(), trimmedPath.slice(2));
-  }
-  if (isAbsolute2(trimmedPath)) {
-    return resolve5(trimmedPath);
-  }
-  return resolve5(workingDirectory, trimmedPath);
+  return resolveScopedTargetPath(targetPath, workingDirectory);
 }
 function isPathInPlansDir(path4, plansDir) {
   if (!path4.endsWith(".md"))
     return false;
   const rel = relative3(plansDir, path4);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function extractApplyPatchPaths(input) {
   const paths = [];
@@ -53194,7 +53568,7 @@ class PermissionModeManager {
           return "allow";
         }
         if (writeTools.includes(toolName)) {
-          const plansDir = join14(homedir12(), ".letta", "plans");
+          const plansDir = join14(homedir13(), ".letta", "plans");
           const targetPath = toolArgs?.file_path || toolArgs?.path;
           let candidatePaths = [];
           if ((toolName === "ApplyPatch" || toolName === "apply_patch" || toolName === "memory_apply_patch") && toolArgs?.input) {
@@ -53245,7 +53619,7 @@ class PermissionModeManager {
           }
           const planWritePath = extractPlanFileWritePathFromShellCommand(command);
           if (planWritePath) {
-            const plansDir = join14(homedir12(), ".letta", "plans");
+            const plansDir = join14(homedir13(), ".letta", "plans");
             const resolvedPath = resolvePlanTargetPath(planWritePath, workingDirectory);
             if (resolvedPath && isPathInPlansDir(resolvedPath, plansDir)) {
               return "allow";
@@ -53254,6 +53628,94 @@ class PermissionModeManager {
         }
         return "deny";
       }
+      case "memory": {
+        const allowedMemoryRoots = resolveAllowedMemoryRoots().roots;
+        const allowedReadOnlyTools = [
+          "Read",
+          "Glob",
+          "Grep",
+          "NotebookRead",
+          "ViewImage",
+          "view_image",
+          "TaskOutput",
+          "task_output",
+          "Skill",
+          "skill",
+          "read_file",
+          "list_dir",
+          "grep_files",
+          "ReadFile",
+          "ListDir",
+          "GrepFiles",
+          "read_file_gemini",
+          "glob_gemini",
+          "list_directory",
+          "search_file_content",
+          "read_many_files",
+          "ReadFileGemini",
+          "GlobGemini",
+          "ListDirectory",
+          "SearchFileContent",
+          "ReadManyFiles"
+        ];
+        const writeTools = [
+          "Write",
+          "Edit",
+          "MultiEdit",
+          "NotebookEdit",
+          "apply_patch",
+          "ApplyPatch",
+          "replace",
+          "Replace",
+          "write_file",
+          "WriteFile",
+          "write_file_gemini",
+          "WriteFileGemini"
+        ];
+        const shellTools = [
+          "Bash",
+          "shell",
+          "Shell",
+          "shell_command",
+          "ShellCommand",
+          "run_shell_command",
+          "RunShellCommand",
+          "run_shell_command_gemini",
+          "RunShellCommandGemini"
+        ];
+        if (allowedReadOnlyTools.includes(toolName)) {
+          return "allow";
+        }
+        if (toolName === "memory_apply_patch") {
+          return allowedMemoryRoots.length > 0 ? "allow" : "deny";
+        }
+        if (writeTools.includes(toolName)) {
+          const targetPath = toolArgs?.file_path || toolArgs?.path;
+          let candidatePaths = [];
+          if ((toolName === "ApplyPatch" || toolName === "apply_patch") && toolArgs?.input) {
+            candidatePaths = extractApplyPatchPaths(toolArgs.input);
+          } else if (typeof targetPath === "string") {
+            candidatePaths = [targetPath];
+          }
+          if (allowedMemoryRoots.length > 0 && everyResolvedTargetIsWithinRoots(candidatePaths, allowedMemoryRoots, workingDirectory)) {
+            return "allow";
+          }
+          return "deny";
+        }
+        if (shellTools.includes(toolName)) {
+          const command = toolArgs?.command;
+          if (command && isReadOnlyShellCommand(command, { allowExternalPaths: true })) {
+            return "allow";
+          }
+          if (command && allowedMemoryRoots.length > 0 && isScopedMemoryShellCommand(command, allowedMemoryRoots, {
+            workingDirectory
+          })) {
+            return "allow";
+          }
+          return "deny";
+        }
+        return "deny";
+      }
       case "default":
         return null;
       default:
@@ -53268,6 +53730,7 @@ class PermissionModeManager {
 }
 var MODE_KEY, PLAN_FILE_KEY, MODE_BEFORE_PLAN_KEY, permissionMode;
 var init_mode = __esm(() => {
+  init_memoryScope();
   init_readOnlyShell();
   init_shell_command_normalization();
   MODE_KEY = Symbol.for("@letta/permissionMode");
@@ -57340,8 +57803,8 @@ import {
   unlink,
   writeFile as writeFile2
 } from "node:fs/promises";
-import { homedir as homedir14 } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute8, relative as relative5, resolve as resolve12 } from "node:path";
+import { homedir as homedir15 } from "node:os";
+import { dirname as dirname7, isAbsolute as isAbsolute9, relative as relative5, resolve as resolve12 } from "node:path";
 import { promisify as promisify10 } from "node:util";
 async function getAgentIdentity() {
   const envAgentId = (process.env.AGENT_ID || process.env.LETTA_AGENT_ID || "").trim();
@@ -57390,7 +57853,7 @@ async function memory(args) {
     const rendered = renderMemoryFile({
       description
     }, body);
-    await mkdir2(dirname6(filePath), { recursive: true });
+    await mkdir2(dirname7(filePath), { recursive: true });
     await writeFile2(filePath, rendered, "utf8");
     affectedPaths = [relPath];
   } else if (command === "str_replace") {
@@ -57459,7 +57922,7 @@ async function memory(args) {
       throw new Error(`memory rename: destination already exists at ${newPathArg}`);
     }
     await loadEditableMemoryFile(oldFilePath, oldPathArg);
-    await mkdir2(dirname6(newFilePath), { recursive: true });
+    await mkdir2(dirname7(newFilePath), { recursive: true });
     await rename(oldFilePath, newFilePath);
     affectedPaths = [oldRelPath, newRelPath];
   } else if (command === "update_description") {
@@ -57507,7 +57970,7 @@ function resolveMemoryDir() {
   })();
   const agentId = contextAgentId || (process.env.AGENT_ID || process.env.LETTA_AGENT_ID || "").trim();
   if (agentId && agentId.trim().length > 0) {
-    return resolve12(homedir14(), ".letta", "agents", agentId, "memory");
+    return resolve12(homedir15(), ".letta", "agents", agentId, "memory");
   }
   throw new Error("memory: unable to resolve memory directory. Ensure MEMORY_DIR (or AGENT_ID) is available.");
 }
@@ -57528,10 +57991,10 @@ function normalizeMemoryLabel(memoryDir, inputPath, fieldName) {
     throw new Error(`memory: '${fieldName}' must be a memory-relative file path, not a home-relative filesystem path`);
   }
   const isWindowsAbsolute = /^[a-zA-Z]:[\\/]/.test(raw);
-  if (isAbsolute8(raw) || isWindowsAbsolute) {
+  if (isAbsolute9(raw) || isWindowsAbsolute) {
     const absolutePath = resolve12(raw);
     const relToMemory = relative5(memoryDir, absolutePath);
-    if (relToMemory && !relToMemory.startsWith("..") && !isAbsolute8(relToMemory)) {
+    if (relToMemory && !relToMemory.startsWith("..") && !isAbsolute9(relToMemory)) {
       return normalizeRelativeMemoryLabel(relToMemory, fieldName);
     }
     throw new Error(memoryPrefixError(memoryDir));
@@ -57577,14 +58040,14 @@ function resolveMemoryFilePath(memoryDir, label) {
 function resolveMemoryPath(memoryDir, path11) {
   const absolute = resolve12(memoryDir, path11);
   const rel = relative5(memoryDir, absolute);
-  if (rel.startsWith("..") || isAbsolute8(rel)) {
+  if (rel.startsWith("..") || isAbsolute9(rel)) {
     throw new Error("memory: resolved path escapes memory directory");
   }
   return absolute;
 }
 function toRepoRelative(memoryDir, absolutePath) {
   const rel = relative5(memoryDir, absolutePath);
-  if (!rel || rel.startsWith("..") || isAbsolute8(rel)) {
+  if (!rel || rel.startsWith("..") || isAbsolute9(rel)) {
     throw new Error("memory: path is outside memory repository");
   }
   return rel.replace(/\\/g, "/");
@@ -57755,8 +58218,8 @@ import {
   unlink as unlink2,
   writeFile as writeFile3
 } from "node:fs/promises";
-import { homedir as homedir15 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute9, relative as relative6, resolve as resolve13 } from "node:path";
+import { homedir as homedir16 } from "node:os";
+import { dirname as dirname8, isAbsolute as isAbsolute10, relative as relative6, resolve as resolve13 } from "node:path";
 import { promisify as promisify11 } from "node:util";
 async function getAgentIdentity2() {
   const envAgentId = (process.env.AGENT_ID || process.env.LETTA_AGENT_ID || "").trim();
@@ -57869,7 +58332,7 @@ async function memory_apply_patch(args) {
     }
   }
   for (const [absPath, content] of pendingWrites.entries()) {
-    await mkdir3(dirname7(absPath), { recursive: true });
+    await mkdir3(dirname8(absPath), { recursive: true });
     await writeFile3(absPath, content, "utf8");
   }
   for (const absPath of pendingDeletes) {
@@ -58043,7 +58506,7 @@ function resolveMemoryDir2() {
   })();
   const agentId = contextAgentId || (process.env.AGENT_ID || process.env.LETTA_AGENT_ID || "").trim();
   if (agentId && agentId.trim().length > 0) {
-    return resolve13(homedir15(), ".letta", "agents", agentId, "memory");
+    return resolve13(homedir16(), ".letta", "agents", agentId, "memory");
   }
   throw new Error("memory_apply_patch: unable to resolve memory directory. Ensure MEMORY_DIR (or AGENT_ID) is available.");
 }
@@ -58064,10 +58527,10 @@ function normalizeMemoryLabel2(memoryDir, inputPath, fieldName) {
     throw new Error(`memory_apply_patch: '${fieldName}' must be a memory-relative file path, not a home-relative filesystem path`);
   }
   const isWindowsAbsolute = /^[a-zA-Z]:[\\/]/.test(raw);
-  if (isAbsolute9(raw) || isWindowsAbsolute) {
+  if (isAbsolute10(raw) || isWindowsAbsolute) {
     const absolutePath = resolve13(raw);
     const relToMemory = relative6(memoryDir, absolutePath);
-    if (relToMemory && !relToMemory.startsWith("..") && !isAbsolute9(relToMemory)) {
+    if (relToMemory && !relToMemory.startsWith("..") && !isAbsolute10(relToMemory)) {
       return normalizeRelativeMemoryLabel2(relToMemory, fieldName);
     }
     throw new Error(memoryPrefixError2(memoryDir));
@@ -58109,7 +58572,7 @@ function memoryPrefixError2(memoryDir) {
 function resolveMemoryPath2(memoryDir, path11) {
   const absolute = resolve13(memoryDir, path11);
   const rel = relative6(memoryDir, absolute);
-  if (rel.startsWith("..") || isAbsolute9(rel)) {
+  if (rel.startsWith("..") || isAbsolute10(rel)) {
     throw new Error("memory_apply_patch: resolved path escapes memory directory");
   }
   return absolute;
@@ -58119,7 +58582,7 @@ function resolveMemoryFilePath2(memoryDir, label) {
 }
 function toRepoRelative2(memoryDir, absolutePath) {
   const rel = relative6(memoryDir, absolutePath);
-  if (!rel || rel.startsWith("..") || isAbsolute9(rel)) {
+  if (!rel || rel.startsWith("..") || isAbsolute10(rel)) {
     throw new Error("memory_apply_patch: path is outside memory repository");
   }
   return rel.replace(/\\/g, "/");
@@ -65158,10 +65621,10 @@ __export(exports_skills, {
 });
 import { existsSync as existsSync17 } from "node:fs";
 import { readdir as readdir4, readFile as readFile5, realpath as realpath2, stat as stat4 } from "node:fs/promises";
-import { dirname as dirname8, join as join19 } from "node:path";
+import { dirname as dirname9, join as join19 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function getBundledSkillsPath() {
-  const thisDir = dirname8(fileURLToPath7(import.meta.url));
+  const thisDir = dirname9(fileURLToPath7(import.meta.url));
   if (thisDir.includes("src/agent") || thisDir.includes("src\\agent")) {
     return join19(thisDir, "../skills/builtin");
   }
@@ -65363,10 +65826,10 @@ var init_skillContentRegistry = __esm(() => {
 // src/tools/impl/Skill.ts
 import { readdirSync as readdirSync7 } from "node:fs";
 import { readFile as readFile6 } from "node:fs/promises";
-import { dirname as dirname9, join as join20 } from "node:path";
+import { dirname as dirname10, join as join20 } from "node:path";
 function hasAdditionalFiles(skillMdPath) {
   try {
-    const skillDir = dirname9(skillMdPath);
+    const skillDir = dirname10(skillMdPath);
     const entries = readdirSync7(skillDir);
     return entries.some((e) => e.toUpperCase() !== "SKILL.MD");
   } catch {
@@ -65425,7 +65888,7 @@ async function skill(args) {
     const agentId = getCurrentAgentId();
     const skillsDir = await getResolvedSkillsDir();
     const { content: skillContent, path: skillPath } = await readSkillContent(skillName, skillsDir, agentId);
-    const skillDir = dirname9(skillPath);
+    const skillDir = dirname10(skillPath);
     const hasExtras = hasAdditionalFiles(skillPath);
     const processedContent = hasExtras ? skillContent.replace(/<SKILL_DIR>/g, skillDir) : skillContent;
     const dirHeader = hasExtras ? `# Skill Directory: ${skillDir}
@@ -66009,15 +66472,32 @@ async function executeSubagent(type, config, model, userPrompt, baseURL, subagen
     const inheritedApiKey = process.env.LETTA_API_KEY || settings.env?.LETTA_API_KEY;
     const inheritedBaseUrl = process.env.LETTA_BASE_URL || settings.env?.LETTA_BASE_URL;
     const subagentWorkingDirectory = resolveSubagentWorkingDirectory();
+    const inheritedMemoryRoots = resolveAllowedMemoryRoots();
+    const childEnv = {
+      ...process.env,
+      ...inheritedApiKey && { LETTA_API_KEY: inheritedApiKey },
+      ...inheritedBaseUrl && { LETTA_BASE_URL: inheritedBaseUrl },
+      LETTA_CODE_AGENT_ROLE: "subagent",
+      ...parentAgentId && { LETTA_PARENT_AGENT_ID: parentAgentId }
+    };
+    if (config.permissionMode === "memory") {
+      if (inheritedMemoryRoots.primaryRoot) {
+        childEnv.MEMORY_DIR = inheritedMemoryRoots.primaryRoot;
+        childEnv.LETTA_MEMORY_DIR = inheritedMemoryRoots.primaryRoot;
+      } else {
+        delete childEnv.MEMORY_DIR;
+        delete childEnv.LETTA_MEMORY_DIR;
+      }
+      const parentMemoryDir = process.env.MEMORY_DIR || process.env.LETTA_MEMORY_DIR;
+      if (parentMemoryDir && parentMemoryDir.trim().length > 0) {
+        childEnv.PARENT_MEMORY_DIR = parentMemoryDir;
+      } else {
+        delete childEnv.PARENT_MEMORY_DIR;
+      }
+    }
     const proc2 = spawn4(launcher.command, launcher.args, {
       cwd: subagentWorkingDirectory,
-      env: {
-        ...process.env,
-        ...inheritedApiKey && { LETTA_API_KEY: inheritedApiKey },
-        ...inheritedBaseUrl && { LETTA_BASE_URL: inheritedBaseUrl },
-        LETTA_CODE_AGENT_ROLE: "subagent",
-        ...parentAgentId && { LETTA_PARENT_AGENT_ID: parentAgentId }
-      }
+      env: childEnv
     });
     proc2.once("spawn", () => {
       updateSubagent(subagentId, { status: "running" });
@@ -66196,6 +66676,7 @@ var init_manager2 = __esm(async () => {
   init_subagentState();
   init_constants();
   init_cli();
+  init_memoryScope();
   init_mode();
   init_session();
   init_context();
@@ -69706,8 +70187,8 @@ function matchesFilePattern(query, pattern, workingDirectory, options) {
     globPattern = globPattern.slice(2);
   }
   if (globPattern.startsWith("~/")) {
-    const homedir16 = __require("node:os").homedir();
-    globPattern = globPattern.replace(/^~/, homedir16);
+    const homedir17 = __require("node:os").homedir();
+    globPattern = globPattern.replace(/^~/, homedir17);
   }
   globPattern = normalizeAbsolutePattern(globPattern, workingDirectory);
   const windowsContext = isWindowsContext(workingDirectory);
@@ -70220,7 +70701,7 @@ function getDefaultDecision(toolName, toolArgs) {
   }
   if (toolName === "Task" || toolName === "task") {
     const subagentType = typeof toolArgs?.subagent_type === "string" ? toolArgs.subagent_type : "";
-    if (READ_ONLY_SUBAGENT_TYPES.has(subagentType)) {
+    if (SAFE_AUTO_APPROVE_SUBAGENT_TYPES.has(subagentType)) {
       return "allow";
     }
     return "ask";
@@ -70251,7 +70732,7 @@ async function checkPermissionWithHooks(toolName, toolArgs, permissions, working
   }
   return result;
 }
-var WORKING_DIRECTORY_TOOLS_V2, WORKING_DIRECTORY_TOOLS_V1, READ_ONLY_SHELL_TOOLS, FILE_TOOLS_V2, FILE_TOOLS_V1, READ_ONLY_SUBAGENT_TYPES;
+var WORKING_DIRECTORY_TOOLS_V2, WORKING_DIRECTORY_TOOLS_V1, READ_ONLY_SHELL_TOOLS, FILE_TOOLS_V2, FILE_TOOLS_V1, SAFE_AUTO_APPROVE_SUBAGENT_TYPES;
 var init_checker = __esm(async () => {
   init_context();
   init_canonical();
@@ -70318,7 +70799,7 @@ var init_checker = __esm(async () => {
     "read_many_files",
     "ReadManyFiles"
   ];
-  READ_ONLY_SUBAGENT_TYPES = new Set([
+  SAFE_AUTO_APPROVE_SUBAGENT_TYPES = new Set([
     "explore",
     "Explore",
     "recall",
@@ -70336,10 +70817,10 @@ __export(exports_loader, {
   loadPermissions: () => loadPermissions,
   getUserSettingsPaths: () => getUserSettingsPaths
 });
-import { homedir as homedir16 } from "node:os";
+import { homedir as homedir17 } from "node:os";
 import { join as join21 } from "node:path";
 function getUserSettingsPaths(options = {}) {
-  const homeDir = options.homeDir || homedir16();
+  const homeDir = options.homeDir || homedir17();
   const xdgConfigHome = options.xdgConfigHome || process.env.XDG_CONFIG_HOME || join21(homeDir, ".config");
   return {
     canonical: join21(homeDir, ".letta", "settings.json"),
@@ -70461,8 +70942,8 @@ var exports_analyzer = {};
 __export(exports_analyzer, {
   analyzeApprovalContext: () => analyzeApprovalContext
 });
-import { homedir as homedir17 } from "node:os";
-import { dirname as dirname11, relative as relative8, resolve as resolve22, win32 as win322 } from "node:path";
+import { homedir as homedir18 } from "node:os";
+import { dirname as dirname12, relative as relative8, resolve as resolve22, win32 as win322 } from "node:path";
 function normalizeOsPath(path20) {
   return path20.replace(/\\/g, "/");
 }
@@ -70488,7 +70969,7 @@ function isPathWithinDirectory(path20, directory) {
   return !relativePath.startsWith("../") && relativePath !== ".." && !relativePath.startsWith("/") && !/^[a-zA-Z]:\//.test(relativePath);
 }
 function dirnameForContext(path20) {
-  return isWindowsPath(path20) ? win322.dirname(path20) : dirname11(path20);
+  return isWindowsPath(path20) ? win322.dirname(path20) : dirname12(path20);
 }
 function formatAbsoluteRulePath(path20) {
   const normalized = normalizeOsPath(path20).replace(/\/+$/, "");
@@ -70498,7 +70979,7 @@ function formatAbsoluteRulePath(path20) {
   return `//${normalized.replace(/^\/+/, "")}`;
 }
 function formatDisplayPath(path20) {
-  return normalizeOsPath(path20).replace(normalizeOsPath(homedir17()), "~");
+  return normalizeOsPath(path20).replace(normalizeOsPath(homedir18()), "~");
 }
 function analyzeApprovalContext(toolName, toolArgs, workingDirectory) {
   const canonicalTool = canonicalToolName(toolName);
@@ -70549,7 +71030,7 @@ function analyzeReadApproval(filePath, workingDir) {
     };
   }
   const relativePath = normalizeOsPath(relativePathForContext(workingDir, absolutePath));
-  const relativeDir = dirname11(relativePath);
+  const relativeDir = dirname12(relativePath);
   const pattern = relativeDir === "." || relativeDir === "" ? "**" : `${relativeDir}/**`;
   return {
     recommendedRule: `Read(${pattern})`,
@@ -70692,7 +71173,7 @@ function detectSkillScript(command, workingDir) {
     return null;
   }
   const normalizedWorkingDir = normalizePathSeparators(workingDir).replace(/\/$/, "");
-  const normalizedHomeDir = normalizePathSeparators(homedir17()).replace(/\/$/, "");
+  const normalizedHomeDir = normalizePathSeparators(homedir18()).replace(/\/$/, "");
   const detect = (source, regex2) => {
     for (const candidate of pathCandidates) {
       const match3 = candidate.match(regex2);
@@ -72224,15 +72705,15 @@ __export(exports_memoryFilesystem, {
   MEMORY_FS_AGENTS_DIR: () => MEMORY_FS_AGENTS_DIR
 });
 import { existsSync as existsSync18, mkdirSync as mkdirSync13 } from "node:fs";
-import { homedir as homedir18 } from "node:os";
+import { homedir as homedir19 } from "node:os";
 import { join as join22 } from "node:path";
-function getMemoryFilesystemRoot(agentId, homeDir = homedir18()) {
+function getMemoryFilesystemRoot(agentId, homeDir = homedir19()) {
   return join22(homeDir, MEMORY_FS_ROOT, MEMORY_FS_AGENTS_DIR, agentId, MEMORY_FS_MEMORY_DIR);
 }
-function getMemorySystemDir(agentId, homeDir = homedir18()) {
+function getMemorySystemDir(agentId, homeDir = homedir19()) {
   return join22(getMemoryFilesystemRoot(agentId, homeDir), MEMORY_SYSTEM_DIR);
 }
-function ensureMemoryFilesystemDirs(agentId, homeDir = homedir18()) {
+function ensureMemoryFilesystemDirs(agentId, homeDir = homedir19()) {
   const root = getMemoryFilesystemRoot(agentId, homeDir);
   const systemDir = getMemorySystemDir(agentId, homeDir);
   if (!existsSync18(root)) {
@@ -73402,18 +73883,29 @@ var init_turn_recovery_policy = __esm(() => {
 });
 
 // src/agent/approval-recovery.ts
-async function fetchRunErrorDetail(runId) {
+async function fetchRunErrorInfo(runId) {
   if (!runId)
     return null;
   try {
     const client = await getClient();
     const run = await client.runs.retrieve(runId);
     const metaError = run.metadata?.error;
-    return metaError?.detail ?? metaError?.message ?? metaError?.error?.detail ?? metaError?.error?.message ?? null;
+    const nestedError = metaError?.error;
+    const errorInfo = {
+      error_type: metaError?.error_type ?? metaError?.type ?? nestedError?.error_type ?? nestedError?.type,
+      message: metaError?.message ?? nestedError?.message,
+      detail: metaError?.detail ?? nestedError?.detail,
+      run_id: metaError?.run_id ?? nestedError?.run_id ?? runId
+    };
+    return errorInfo.error_type || errorInfo.message || errorInfo.detail ? errorInfo : null;
   } catch {
     return null;
   }
 }
+async function fetchRunErrorDetail(runId) {
+  const errorInfo = await fetchRunErrorInfo(runId);
+  return errorInfo?.detail ?? errorInfo?.message ?? null;
+}
 var init_approval_recovery = __esm(async () => {
   init_turn_recovery_policy();
   await init_client2();
@@ -75287,7 +75779,7 @@ import {
   readFile as readFile7,
   writeFile as writeFile4
 } from "node:fs/promises";
-import { homedir as homedir19, tmpdir as tmpdir3 } from "node:os";
+import { homedir as homedir20, tmpdir as tmpdir3 } from "node:os";
 import { join as join25 } from "node:path";
 function buildReflectionSubagentPrompt(input) {
   const lines = [];
@@ -75481,7 +75973,7 @@ function getTranscriptRoot() {
   if (envRoot) {
     return envRoot;
   }
-  return join25(homedir19(), ".letta", DEFAULT_TRANSCRIPT_DIR);
+  return join25(homedir20(), ".letta", DEFAULT_TRANSCRIPT_DIR);
 }
 function defaultState() {
   return { auto_cursor_line: 0 };
@@ -75670,7 +76162,7 @@ import {
   unlinkSync as unlinkSync7,
   writeFileSync as writeFileSync11
 } from "node:fs";
-import { homedir as homedir20 } from "node:os";
+import { homedir as homedir21 } from "node:os";
 import { join as join26 } from "node:path";
 function truncateStr(value, maxLen) {
   if (value === null || value === undefined)
@@ -75811,7 +76303,7 @@ class ChunkLog {
 var MAX_ENTRIES = 100, CONTENT_TRUNCATE_LEN = 200, MAX_SESSION_FILES2 = 5, LOG_BASE_DIR, chunkLog;
 var init_chunkLog = __esm(() => {
   init_debug();
-  LOG_BASE_DIR = join26(homedir20(), ".letta", "logs", "chunk-logs");
+  LOG_BASE_DIR = join26(homedir21(), ".letta", "logs", "chunk-logs");
   chunkLog = new ChunkLog;
 });
 
@@ -75857,6 +76349,7 @@ class StreamProcessor {
       const errorDetail = chunkWithError.error.detail || "";
       errorInfo = {
         message: errorDetail ? `${errorText}: ${errorDetail}` : errorText,
+        detail: errorDetail || undefined,
         run_id: this.lastRunId || undefined
       };
     }
@@ -76827,6 +77320,7 @@ var init_engine = __esm(async () => {
     default: "Normal approval flow.",
     acceptEdits: "File edits auto-approved.",
     plan: "Read-only mode. Focus on exploration and planning.",
+    memory: "Memory-scoped mode. Reads are broad; mutations are limited to allowed memory roots.",
     bypassPermissions: "All tools auto-approved. Bias toward action."
   };
   sharedReminderProviders = {
@@ -76939,10 +77433,10 @@ var init_constants2 = __esm(() => {
 // src/websocket/listener/remote-settings.ts
 import { existsSync as existsSync21, readFileSync as readFileSync12 } from "node:fs";
 import { mkdir as mkdir5, writeFile as writeFile5 } from "node:fs/promises";
-import { homedir as homedir21 } from "node:os";
+import { homedir as homedir22 } from "node:os";
 import path20 from "node:path";
 function getRemoteSettingsPath() {
-  return path20.join(homedir21(), ".letta", "remote-settings.json");
+  return path20.join(homedir22(), ".letta", "remote-settings.json");
 }
 function loadRemoteSettings() {
   if (_cache !== null) {
@@ -76986,7 +77480,7 @@ function saveRemoteSettings(updates) {
 }
 function loadLegacyCwdCache() {
   try {
-    const legacyPath = path20.join(homedir21(), ".letta", "cwd-cache.json");
+    const legacyPath = path20.join(homedir22(), ".letta", "cwd-cache.json");
     if (!existsSync21(legacyPath))
       return {};
     const raw = readFileSync12(legacyPath, "utf-8");
@@ -77186,13 +77680,52 @@ function requestApprovalOverWS(runtime, socket, requestId, controlRequest) {
   if (socket.readyState !== WebSocket.OPEN) {
     return Promise.reject(new Error("WebSocket not open"));
   }
+  const abortSignal = runtime.activeAbortController?.signal ?? null;
+  const isInterrupted = () => runtime.cancelRequested || abortSignal?.aborted === true;
+  if (isInterrupted()) {
+    return Promise.reject(new Error("Cancelled by user"));
+  }
   return new Promise((resolve23, reject) => {
+    let settled = false;
+    const cleanupAbortListener = () => {
+      abortSignal?.removeEventListener("abort", handleAbort);
+    };
+    const wrappedResolve = (response) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanupAbortListener();
+      resolve23(response);
+    };
+    const wrappedReject = (error) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanupAbortListener();
+      reject(error);
+    };
+    const handleAbort = () => {
+      runtime.pendingApprovalResolvers.delete(requestId);
+      runtime.listener.approvalRuntimeKeyByRequestId.delete(requestId);
+      wrappedReject(new Error("Cancelled by user"));
+    };
+    abortSignal?.addEventListener("abort", handleAbort, { once: true });
+    if (isInterrupted()) {
+      handleAbort();
+      return;
+    }
     runtime.pendingApprovalResolvers.set(requestId, {
-      resolve: resolve23,
-      reject,
+      resolve: wrappedResolve,
+      reject: wrappedReject,
       controlRequest
     });
     runtime.listener.approvalRuntimeKeyByRequestId.set(requestId, runtime.key);
+    if (isInterrupted()) {
+      handleAbort();
+      return;
+    }
     runtime.lastStopReason = "requires_approval";
     setLoopStatus(runtime, "WAITING_ON_APPROVAL");
     emitLoopStatusIfOpen(runtime.listener, {
@@ -77489,12 +78022,18 @@ function populateInterruptQueue(runtime, input) {
   return false;
 }
 function consumeInterruptQueue(runtime, agentId, conversationId) {
+  const ctx = runtime.pendingInterruptedContext;
+  const matchingContext = !!ctx && ctx.agentId === agentId && ctx.conversationId === conversationId && ctx.continuationEpoch === runtime.continuationEpoch;
   if (!runtime.pendingInterruptedResults || runtime.pendingInterruptedResults.length === 0) {
+    if (matchingContext) {
+      runtime.pendingInterruptedResults = null;
+      runtime.pendingInterruptedContext = null;
+      runtime.pendingInterruptedToolCallIds = null;
+    }
     return null;
   }
-  const ctx = runtime.pendingInterruptedContext;
   let result = null;
-  if (ctx && ctx.agentId === agentId && ctx.conversationId === conversationId && ctx.continuationEpoch === runtime.continuationEpoch) {
+  if (matchingContext) {
     result = {
       approvalMessage: {
         type: "approval",
@@ -77691,6 +78230,104 @@ function mirrorRecoverableNoticeToDesktopDebugPanel(message) {
 `);
   } catch {}
 }
+function toStructuredApiError(errorInfo) {
+  if (!errorInfo?.error_type || !errorInfo.run_id) {
+    return;
+  }
+  return {
+    message_type: "error_message",
+    message: errorInfo.message || errorInfo.detail || "An error occurred",
+    error_type: errorInfo.error_type,
+    run_id: errorInfo.run_id,
+    ...errorInfo.detail ? { detail: errorInfo.detail } : {}
+  };
+}
+function getStructuredApiErrorFromError(error) {
+  if (!(error instanceof Error)) {
+    return;
+  }
+  const errorWithStructuredInfo = error;
+  return errorWithStructuredInfo.apiError ?? toStructuredApiError(errorWithStructuredInfo.runErrorInfo);
+}
+function buildStructuredFormatInput(apiError) {
+  return {
+    error: {
+      error: {
+        type: apiError.error_type,
+        message: apiError.message,
+        ...apiError.detail ? { detail: apiError.detail } : {}
+      },
+      run_id: apiError.run_id
+    }
+  };
+}
+function isAbortLikeError(error) {
+  if (error instanceof APIUserAbortError) {
+    return true;
+  }
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  const errorWithCode = error;
+  return error.name === "AbortError" || error.message === "The operation was aborted" || errorWithCode.code === "ABORT_ERR";
+}
+function isTerminatedProcessNoise(message) {
+  return message.trim().toLowerCase() === "terminated";
+}
+function isProxyTransportError(detail, error, message) {
+  if (error instanceof APIError2 && error.status >= 500 && detail.toLowerCase().includes("trying to proxy")) {
+    return true;
+  }
+  return detail.toLowerCase().includes("error occurred while trying to proxy") || message.toLowerCase().includes("error occurred while trying to proxy");
+}
+function getLoopErrorNoticeDecision(params) {
+  const apiError = params.apiError ?? toStructuredApiError(params.errorInfo) ?? toStructuredApiError(params.runErrorInfo) ?? getStructuredApiErrorFromError(params.error);
+  const detail = apiError?.detail ?? params.errorInfo?.detail ?? params.runErrorInfo?.detail ?? extractConflictDetail(params.error) ?? "";
+  if (params.cancelRequested || params.abortSignal?.aborted || isAbortLikeError(params.error) || isTerminatedProcessNoise(params.message)) {
+    return {
+      visibility: "debug_only",
+      message: params.message
+    };
+  }
+  const cloudflareMessage = checkCloudflareEdgeError2(detail) ?? checkCloudflareEdgeError2(params.message);
+  if (cloudflareMessage) {
+    return {
+      visibility: "transcript",
+      message: cloudflareMessage,
+      apiError
+    };
+  }
+  if (isProxyTransportError(detail, params.error, params.message)) {
+    return {
+      visibility: "transcript",
+      message: "Connection to Letta service failed. Please retry.",
+      apiError
+    };
+  }
+  const formattedMessage = formatErrorDetails2(apiError ? buildStructuredFormatInput(apiError) : params.error ?? params.message, params.agentId ?? undefined, params.conversationId ?? undefined);
+  return {
+    visibility: "transcript",
+    message: formattedMessage,
+    apiError
+  };
+}
+function emitLoopErrorNotice(socket, runtime, params) {
+  const decision = getLoopErrorNoticeDecision(params);
+  if (decision.visibility === "debug_only") {
+    debugLog("recovery", `Debug-only loop error (${params.stopReason}): ${params.message}`);
+    mirrorRecoverableNoticeToDesktopDebugPanel(params.message);
+    return;
+  }
+  emitLoopErrorDelta(socket, runtime, {
+    message: decision.message,
+    stopReason: params.stopReason,
+    isTerminal: params.isTerminal,
+    runId: params.runId,
+    agentId: params.agentId,
+    conversationId: params.conversationId,
+    apiError: decision.apiError
+  });
+}
 function emitRecoverableStatusNotice(socket, runtime, params) {
   const visibility = getRecoverableStatusNoticeVisibility(params.kind);
   if (visibility === "debug_only") {
@@ -77726,6 +78363,9 @@ function emitRecoverableRetryNotice(socket, runtime, params) {
 }
 var DESKTOP_DEBUG_PANEL_INFO_PREFIX = "[LETTA_DESKTOP_DEBUG_PANEL_INFO]";
 var init_recoverable_notices = __esm(async () => {
+  init_error();
+  init_turn_recovery_policy();
+  init_errorFormatter();
   init_debug();
   await init_protocol_outbound();
 });
@@ -78515,7 +79155,7 @@ __export(exports_diff, {
   ADV_DIFF_IGNORE_WHITESPACE: () => ADV_DIFF_IGNORE_WHITESPACE,
   ADV_DIFF_CONTEXT_LINES: () => ADV_DIFF_CONTEXT_LINES
 });
-import { basename as basename2 } from "node:path";
+import { basename as basename3 } from "node:path";
 function readFileOrNull(p) {
   try {
     return __require("node:fs").readFileSync(p, "utf-8");
@@ -78539,7 +79179,7 @@ function applyAllOccurrences(content, oldStr, newStr) {
   return { ok: true, out: content.split(oldStr).join(newStr) };
 }
 function computeAdvancedDiff(input, opts) {
-  const fileName = basename2(input.filePath || "");
+  const fileName = basename3(input.filePath || "");
   const fileContent = opts?.oldStrOverride !== undefined ? opts.oldStrOverride : readFileOrNull(input.filePath);
   if (fileContent === null && input.kind !== "write") {
     return { mode: "fallback", reason: "File not readable" };
@@ -78605,7 +79245,7 @@ function computeAdvancedDiff(input, opts) {
   return { mode: "advanced", fileName, oldStr, newStr, hunks };
 }
 function parsePatchToAdvancedDiff(patchLines, filePath) {
-  const fileName = basename2(filePath);
+  const fileName = basename3(filePath);
   const hunks = [];
   let currentHunk = null;
   let oldLine = 1;
@@ -78932,7 +79572,7 @@ var init_formatArgsDisplay = __esm(async () => {
 });
 
 // src/helpers/diffPreview.ts
-import path21, { basename as basename3 } from "node:path";
+import path21, { basename as basename4 } from "node:path";
 function parseHunkLinePrefix(raw) {
   if (raw.length === 0) {
     return { type: "context", content: "" };
@@ -79038,7 +79678,7 @@ async function computeDiffPreviews(toolName, toolArgs, workingDirectory = proces
           filePath: resolvedFilePath,
           content: toolArgs.content || ""
         });
-        previews.push(toDiffPreview(result, basename3(filePath)));
+        previews.push(toDiffPreview(result, basename4(filePath)));
       }
     } else if (isFileEditTool2(toolName)) {
       const filePath = toolArgs.file_path;
@@ -79050,7 +79690,7 @@ async function computeDiffPreviews(toolName, toolArgs, workingDirectory = proces
             filePath: resolvedFilePath,
             edits: toolArgs.edits
           });
-          previews.push(toDiffPreview(result, basename3(filePath)));
+          previews.push(toDiffPreview(result, basename4(filePath)));
         } else {
           const result = computeAdvancedDiff2({
             kind: "edit",
@@ -79059,7 +79699,7 @@ async function computeDiffPreviews(toolName, toolArgs, workingDirectory = proces
             newString: toolArgs.new_string || "",
             replaceAll: toolArgs.replace_all
           });
-          previews.push(toDiffPreview(result, basename3(filePath)));
+          previews.push(toDiffPreview(result, basename4(filePath)));
         }
       }
     } else if (isPatchTool2(toolName) && toolArgs.input) {
@@ -79068,7 +79708,7 @@ async function computeDiffPreviews(toolName, toolArgs, workingDirectory = proces
         if (op.kind === "add" || op.kind === "update") {
           const result = parsePatchToAdvancedDiff2(op.patchLines, op.path);
           if (result) {
-            previews.push(toDiffPreview(result, basename3(op.path)));
+            previews.push(toDiffPreview(result, basename4(op.path)));
           }
         }
       }
@@ -79078,7 +79718,7 @@ async function computeDiffPreviews(toolName, toolArgs, workingDirectory = proces
         if (op.kind === "add" || op.kind === "update") {
           const result = parsePatchToAdvancedDiff2(op.patchLines, op.path);
           if (result) {
-            previews.push(toDiffPreview(result, basename3(op.path)));
+            previews.push(toDiffPreview(result, basename4(op.path)));
           }
         }
       }
@@ -79309,13 +79949,15 @@ async function drainRecoveryStreamWithEmission(recoveryStream, socket, runtime,
       }
     }
     if (errorInfo) {
-      emitLoopErrorDelta(socket, runtime, {
+      emitLoopErrorNotice(socket, runtime, {
         message: errorInfo.message || "Stream error",
         stopReason: errorInfo.error_type || "error",
         isTerminal: false,
         runId: runtime.activeRunId || errorInfo.run_id,
         agentId: params.agentId ?? undefined,
-        conversationId: params.conversationId
+        conversationId: params.conversationId,
+        errorInfo,
+        abortSignal: params.abortSignal
       });
     }
     if (shouldOutput) {
@@ -79366,7 +80008,7 @@ function finalizeHandledRecoveryTurn(runtime, socket, params) {
   const runId = runtime.activeRunId;
   clearActiveRunState(runtime);
   emitRuntimeStateUpdates(runtime, scope);
-  emitLoopErrorDelta(socket, runtime, {
+  emitLoopErrorNotice(socket, runtime, {
     message: `Recovery continuation ended unexpectedly: ${terminalStopReason}`,
     stopReason: terminalStopReason,
     isTerminal: true,
@@ -79703,7 +80345,8 @@ var init_recovery = __esm(async () => {
     init_approval_suggestions(),
     init_interrupts(),
     init_protocol_outbound(),
-    init_queue()
+    init_queue(),
+    init_recoverable_notices()
   ]);
 });
 
@@ -80004,8 +80647,8 @@ async function sendMessageStreamWithRetry(conversationId, messages, opts, socket
               throw new Error("Cancelled by user");
           }
         }
-        const detail = await fetchRunErrorDetail(runtime.activeRunId);
-        throw new Error(detail || `Pre-stream approval conflict after ${preStreamRecoveryAttempts} recovery attempts`);
+        const runErrorInfo = await fetchRunErrorInfo(runtime.activeRunId);
+        throw Object.assign(new Error(runErrorInfo?.detail || runErrorInfo?.message || `Pre-stream approval conflict after ${preStreamRecoveryAttempts} recovery attempts`), { runErrorInfo });
       }
       if (action === "retry_transient") {
         runtime.isRecoveringApprovals = true;
@@ -80138,8 +80781,8 @@ async function sendApprovalContinuationWithRetry(conversationId, messages, opts,
           }
           continue;
         }
-        const detail = await fetchRunErrorDetail(runtime.activeRunId);
-        throw new Error(detail || `Approval continuation conflict after ${preStreamRecoveryAttempts} recovery attempts`);
+        const runErrorInfo = await fetchRunErrorInfo(runtime.activeRunId);
+        throw Object.assign(new Error(runErrorInfo?.detail || runErrorInfo?.message || `Approval continuation conflict after ${preStreamRecoveryAttempts} recovery attempts`), { runErrorInfo });
       }
       if (action === "retry_transient") {
         runtime.isRecoveringApprovals = true;
@@ -80265,7 +80908,7 @@ async function handleApprovalStop(params) {
       agent_id: agentId,
       conversation_id: conversationId
     });
-    emitLoopErrorDelta(socket, runtime, {
+    emitLoopErrorNotice(socket, runtime, {
       message: "requires_approval stop returned no approvals",
       stopReason: "error",
       isTerminal: true,
@@ -80568,6 +81211,7 @@ var init_turn_approval = __esm(async () => {
     init_interrupts(),
     init_protocol_outbound(),
     init_queue(),
+    init_recoverable_notices(),
     init_recovery(),
     init_send()
   ]);
@@ -80899,13 +81543,16 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
         }
         if (errorInfo) {
           latestErrorText = errorInfo.message || latestErrorText;
-          emitLoopErrorDelta(socket, runtime, {
+          emitLoopErrorNotice(socket, runtime, {
             message: errorInfo.message || "Stream error",
             stopReason: errorInfo.error_type || "error",
             isTerminal: false,
             runId: runId || errorInfo.run_id,
             agentId,
-            conversationId
+            conversationId,
+            errorInfo,
+            cancelRequested: runtime.cancelRequested,
+            abortSignal: turnAbortSignal
           });
         }
         if (shouldOutput) {
@@ -80965,7 +81612,8 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
       }
       if (stopReason !== "requires_approval") {
         const lastRunId = runId || msgRunIds[msgRunIds.length - 1] || null;
-        const errorDetail = latestErrorText || (lastRunId ? await fetchRunErrorDetail(lastRunId) : null);
+        const runErrorInfo = lastRunId ? await fetchRunErrorInfo(lastRunId) : null;
+        const errorDetail = latestErrorText || runErrorInfo?.detail || runErrorInfo?.message || null;
         if (shouldAttemptPostStopApprovalRecovery({
           stopReason,
           runIdsSeen: msgRunIds.length,
@@ -81127,13 +81775,16 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
           conversation_id: conversationId
         });
         const errorMessage = errorDetail || `Unexpected stop reason: ${stopReason}`;
-        emitLoopErrorDelta(socket, runtime, {
+        emitLoopErrorNotice(socket, runtime, {
           message: errorMessage,
           stopReason: effectiveStopReason,
           isTerminal: true,
           runId,
           agentId,
-          conversationId
+          conversationId,
+          runErrorInfo: runErrorInfo ?? undefined,
+          cancelRequested: runtime.cancelRequested,
+          abortSignal: turnAbortSignal
         });
         break;
       }
@@ -81217,12 +81868,15 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
       conversation_id: conversationId
     });
     const errorMessage = error instanceof Error ? error.message : String(error);
-    emitLoopErrorDelta(socket, runtime, {
+    emitLoopErrorNotice(socket, runtime, {
       message: errorMessage,
       stopReason: "error",
       isTerminal: true,
       agentId: agentId || undefined,
-      conversationId
+      conversationId,
+      error,
+      cancelRequested: runtime.cancelRequested,
+      abortSignal: turnAbortSignal
     });
     if (isDebugEnabled()) {
       console.error("[Listen] Error handling message:", error);
@@ -81588,18 +82242,24 @@ function buildDeviceStatus(runtime, params) {
 function buildLoopStatus(runtime, params) {
   const listener = getListenerRuntime(runtime);
   if (!listener) {
-    return { status: "WAITING_ON_INPUT", active_run_ids: [] };
+    return {
+      status: "WAITING_ON_INPUT",
+      active_run_ids: [],
+      plan_file_path: null
+    };
   }
   const scope = getScopeForRuntime(runtime, params);
   const scopedAgentId = resolveScopedAgentId(listener, scope);
   const scopedConversationId = resolveScopedConversationId(listener, scope);
+  const conversationPermissionModeState = getConversationPermissionModeState(listener, scopedAgentId, scopedConversationId);
   const conversationRuntime = getConversationRuntime(listener, scopedAgentId, scopedConversationId);
   const interruptedCacheActive = hasInterruptedCacheForScope(listener, scope);
   const recovered = getRecoveredApprovalStateForScope(listener, scope);
   const status = interruptedCacheActive ? !conversationRuntime?.isProcessing ? "WAITING_ON_INPUT" : conversationRuntime?.loopStatus === "WAITING_ON_APPROVAL" ? "WAITING_ON_INPUT" : conversationRuntime?.loopStatus ?? "WAITING_ON_INPUT" : recovered && recovered.pendingRequestIds.size > 0 && conversationRuntime?.loopStatus === "WAITING_ON_INPUT" ? "WAITING_ON_APPROVAL" : conversationRuntime?.loopStatus ?? "WAITING_ON_INPUT";
   return {
     status,
-    active_run_ids: interruptedCacheActive && !conversationRuntime?.isProcessing ? [] : conversationRuntime?.activeRunId ? [conversationRuntime.activeRunId] : []
+    active_run_ids: interruptedCacheActive && !conversationRuntime?.isProcessing ? [] : conversationRuntime?.activeRunId ? [conversationRuntime.activeRunId] : [],
+    plan_file_path: conversationPermissionModeState.mode === "plan" ? conversationPermissionModeState.planFilePath : null
   };
 }
 function buildQueueSnapshot(runtime, params) {
@@ -81829,7 +82489,8 @@ function emitLoopErrorDelta(socket, runtime, params) {
     ...createLifecycleMessageBase("loop_error", params.runId),
     message: params.message,
     stop_reason: params.stopReason,
-    is_terminal: params.isTerminal
+    is_terminal: params.isTerminal,
+    ...params.apiError ? { api_error: params.apiError } : {}
   }, {
     agent_id: params.agentId,
     conversation_id: params.conversationId
@@ -83072,12 +83733,13 @@ function handleModeChange(msg, socket, runtime, scope) {
     }
   } catch (error) {
     trackListenerError("listener_mode_change_failed", error, "listener_mode_change");
-    emitLoopErrorDelta(socket, runtime, {
+    emitLoopErrorNotice(socket, runtime, {
       message: error instanceof Error ? error.message : "Mode change failed",
       stopReason: "error",
       isTerminal: false,
       agentId: scope?.agent_id,
-      conversationId: scope?.conversation_id
+      conversationId: scope?.conversation_id,
+      error
     });
     if (isDebugEnabled()) {
       console.error("[Listen] Mode change failed:", error);
@@ -83431,7 +84093,7 @@ async function handleSkillCommand(parsed, socket) {
     symlinkSync,
     unlinkSync: unlinkSync8
   } = await import("node:fs");
-  const { basename: basename4, join: join28 } = await import("node:path");
+  const { basename: basename5, join: join28 } = await import("node:path");
   const lettaHome = process.env.LETTA_HOME || join28(process.env.HOME || process.env.USERPROFILE || "~", ".letta");
   const globalSkillsDir = join28(lettaHome, "skills");
   if (parsed.type === "skill_enable") {
@@ -83455,7 +84117,7 @@ async function handleSkillCommand(parsed, socket) {
         }, "listener_skill_send_failed", "listener_skill_command");
         return true;
       }
-      const linkName = basename4(parsed.skill_path);
+      const linkName = basename5(parsed.skill_path);
       const linkPath = join28(globalSkillsDir, linkName);
       mkdirSync15(globalSkillsDir, { recursive: true });
       if (existsSync22(linkPath)) {
@@ -83827,6 +84489,7 @@ async function handleAbortMessageInput(listener, params, deps = {}) {
   }
   const interruptedRunId = scopedRuntime.activeRunId;
   scopedRuntime.cancelRequested = true;
+  const pendingRequestsSnapshot = hasPendingApprovals ? resolvedDeps.getPendingControlRequests(listener, scope) : [];
   if (scopedRuntime.activeExecutingToolCallIds.length > 0 && (!scopedRuntime.pendingInterruptedResults || scopedRuntime.pendingInterruptedResults.length === 0)) {
     scopedRuntime.pendingInterruptedResults = scopedRuntime.activeExecutingToolCallIds.map((toolCallId) => ({
       type: "tool",
@@ -83872,9 +84535,8 @@ async function handleAbortMessageInput(listener, params, deps = {}) {
       agentId: scope.agent_id,
       conversationId: scope.conversation_id
     });
-  } else if (hasPendingApprovals) {
-    const pendingRequests = resolvedDeps.getPendingControlRequests(listener, scope);
-    scopedRuntime.pendingInterruptedResults = pendingRequests.map((req) => ({
+  } else if (hasPendingApprovals && (!scopedRuntime.pendingInterruptedResults || scopedRuntime.pendingInterruptedResults.length === 0) && pendingRequestsSnapshot.length > 0) {
+    scopedRuntime.pendingInterruptedResults = pendingRequestsSnapshot.map((req) => ({
       type: "approval",
       tool_call_id: req.request.tool_call_id,
       approve: false,
@@ -83885,6 +84547,7 @@ async function handleAbortMessageInput(listener, params, deps = {}) {
       conversationId: scope.conversation_id,
       continuationEpoch: scopedRuntime.continuationEpoch
     };
+    scopedRuntime.pendingInterruptedToolCallIds = null;
     resolvedDeps.emitInterruptedStatusDelta(params.socket, scopedRuntime, {
       runId: interruptedRunId,
       agentId: scope.agent_id,
@@ -83929,12 +84592,13 @@ async function handleCwdChange(msg, socket, runtime) {
       conversation_id: conversationId
     });
   } catch (error) {
-    emitLoopErrorDelta(socket, runtime, {
+    emitLoopErrorNotice(socket, runtime, {
       message: error instanceof Error ? error.message : "Working directory change failed",
       stopReason: "error",
       isTerminal: false,
       agentId,
-      conversationId
+      conversationId,
+      error
     });
   }
 }
@@ -84153,7 +84817,7 @@ async function connectWithRetry(runtime, opts, attempt = 0, startTime = Date.now
         return;
       }
       if (parsed.type === "__invalid_input") {
-        emitLoopErrorDelta(socket, runtime, {
+        emitLoopErrorNotice(socket, runtime, {
           message: parsed.reason,
           stopReason: "error",
           isTerminal: false,
@@ -84196,7 +84860,7 @@ async function connectWithRetry(runtime, opts, attempt = 0, startTime = Date.now
         }
         const inputPayload = parsed.payload;
         if (inputPayload.kind !== "create_message") {
-          emitLoopErrorDelta(socket, runtime, {
+          emitLoopErrorNotice(socket, runtime, {
             message: `Unsupported input payload kind: ${String(inputPayload.kind)}`,
             stopReason: "error",
             isTerminal: false,
@@ -84213,7 +84877,7 @@ async function connectWithRetry(runtime, opts, attempt = 0, startTime = Date.now
         };
         const hasApprovalPayload = incoming.messages.some((payload) => ("type" in payload) && payload.type === "approval");
         if (hasApprovalPayload) {
-          emitLoopErrorDelta(socket, runtime, {
+          emitLoopErrorNotice(socket, runtime, {
             message: "Protocol violation: approval payloads are not allowed in input.kind=create_message. Use input.kind=approval_response.",
             stopReason: "error",
             isTerminal: false,
@@ -84770,12 +85434,13 @@ async function connectWithRetry(runtime, opts, attempt = 0, startTime = Date.now
       if (!parsedScope) {
         return;
       }
-      emitLoopErrorDelta(socket, runtime, {
+      emitLoopErrorNotice(socket, runtime, {
         message: error instanceof Error ? error.message : "Failed to process listener message",
         stopReason: "error",
         isTerminal: false,
         agentId: parsedScope.agent_id,
-        conversationId: parsedScope.conversation_id
+        conversationId: parsedScope.conversation_id,
+        error
       });
     }
   });
@@ -85073,6 +85738,7 @@ var init_client4 = __esm(async () => {
     init_protocol_inbound(),
     init_protocol_outbound(),
     init_queue(),
+    init_recoverable_notices(),
     init_recovery(),
     init_send(),
     init_turn(),
@@ -85171,7 +85837,7 @@ import {
   readFileSync as readFileSync14,
   unlinkSync as unlinkSync8
 } from "node:fs";
-import { homedir as homedir25 } from "node:os";
+import { homedir as homedir26 } from "node:os";
 import { join as join31 } from "node:path";
 import { format as format2 } from "node:util";
 function isDebugEnabled2() {
@@ -85277,7 +85943,7 @@ function debugWarn2(prefix, message, ...args) {
 }
 var DEBUG_LOG_DIR2, MAX_SESSION_FILES3 = 5, DEFAULT_TAIL_LINES2 = 50, debugLogFile2;
 var init_debug2 = __esm(() => {
-  DEBUG_LOG_DIR2 = join31(homedir25(), ".letta", "logs", "debug");
+  DEBUG_LOG_DIR2 = join31(homedir26(), ".letta", "logs", "debug");
   debugLogFile2 = new DebugLogFile2;
 });
 
@@ -85306,10 +85972,10 @@ __export(exports_skills2, {
 });
 import { existsSync as existsSync24 } from "node:fs";
 import { readdir as readdir7, readFile as readFile8, realpath as realpath4, stat as stat6 } from "node:fs/promises";
-import { dirname as dirname12, join as join32 } from "node:path";
+import { dirname as dirname13, join as join32 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 function getBundledSkillsPath2() {
-  const thisDir = dirname12(fileURLToPath8(import.meta.url));
+  const thisDir = dirname13(fileURLToPath8(import.meta.url));
   if (thisDir.includes("src/agent") || thisDir.includes("src\\agent")) {
     return join32(thisDir, "../skills/builtin");
   }
@@ -85505,12 +86171,12 @@ import {
   writeFileSync as fsWriteFileSync2,
   mkdirSync as mkdirSync17
 } from "node:fs";
-import { dirname as dirname13 } from "node:path";
+import { dirname as dirname14 } from "node:path";
 async function readFile9(path23) {
   return fsReadFileSync2(path23, { encoding: "utf-8" });
 }
 async function writeFile7(path23, content) {
-  const dir = dirname13(path23);
+  const dir = dirname14(path23);
   if (!existsSync25(dir)) {
     mkdirSync17(dir, { recursive: true });
   }
@@ -85555,7 +86221,7 @@ async function queryTerminalBackground(timeoutMs = 100) {
   }
   const wasRaw = process.stdin.isRaw;
   const wasFlowing = process.stdin.readableFlowing;
-  return new Promise((resolve26) => {
+  return new Promise((resolve25) => {
     let response = "";
     let resolved = false;
     const cleanup = () => {
@@ -85572,7 +86238,7 @@ async function queryTerminalBackground(timeoutMs = 100) {
     };
     const timeout = setTimeout(() => {
       cleanup();
-      resolve26(null);
+      resolve25(null);
     }, timeoutMs);
     const onData = (data) => {
       response += data.toString();
@@ -85582,7 +86248,7 @@ async function queryTerminalBackground(timeoutMs = 100) {
       if (match3) {
         clearTimeout(timeout);
         cleanup();
-        resolve26({
+        resolve25({
           r: parseHexComponent(match3[1] ?? "0"),
           g: parseHexComponent(match3[2] ?? "0"),
           b: parseHexComponent(match3[3] ?? "0")
@@ -85597,7 +86263,7 @@ async function queryTerminalBackground(timeoutMs = 100) {
     } catch {
       clearTimeout(timeout);
       cleanup();
-      resolve26(null);
+      resolve25(null);
     }
   });
 }
@@ -86806,10 +87472,10 @@ __export(exports_setup, {
   runSetup: () => runSetup
 });
 async function runSetup() {
-  return new Promise((resolve27) => {
+  return new Promise((resolve26) => {
     const { waitUntilExit } = render_default(import_react32.default.createElement(SetupUI, {
       onComplete: () => {
-        resolve27();
+        resolve26();
       }
     }));
     waitUntilExit().catch((error) => {
@@ -87339,10 +88005,10 @@ __export(exports_import, {
 });
 import { createReadStream } from "node:fs";
 import { chmod, mkdir as mkdir7, readFile as readFile10, writeFile as writeFile8 } from "node:fs/promises";
-import { dirname as dirname14, resolve as resolve27 } from "node:path";
+import { dirname as dirname15, resolve as resolve26 } from "node:path";
 async function importAgentFromFile(options) {
   const client = await getClient();
-  const resolvedPath = resolve27(options.filePath);
+  const resolvedPath = resolve26(options.filePath);
   const file = createReadStream(resolvedPath);
   const importResponse = await client.agents.importFile({
     file,
@@ -87377,7 +88043,7 @@ async function extractSkillsFromAf(afPath, destDir) {
     return [];
   }
   for (const skill2 of afData.skills) {
-    const skillDir = resolve27(destDir, skill2.name);
+    const skillDir = resolve26(destDir, skill2.name);
     await mkdir7(skillDir, { recursive: true });
     if (skill2.files) {
       await writeSkillFiles(skillDir, skill2.files);
@@ -87397,8 +88063,8 @@ async function writeSkillFiles(skillDir, files) {
   }
 }
 async function writeSkillFile(skillDir, filePath, content) {
-  const fullPath = resolve27(skillDir, filePath);
-  await mkdir7(dirname14(fullPath), { recursive: true });
+  const fullPath = resolve26(skillDir, filePath);
+  await mkdir7(dirname15(fullPath), { recursive: true });
   await writeFile8(fullPath, content, "utf-8");
   const isScript = filePath.startsWith("scripts/") || content.trimStart().startsWith("#!");
   if (isScript) {
@@ -87704,12 +88370,12 @@ async function prepareHeadlessToolExecutionContext(params) {
   };
 }
 async function flushAndExit(code) {
-  const flushWritable = (stream2) => new Promise((resolve28) => {
+  const flushWritable = (stream2) => new Promise((resolve27) => {
     if (stream2.destroyed || stream2.writableEnded) {
-      resolve28();
+      resolve27();
       return;
     }
-    stream2.write("", () => resolve28());
+    stream2.write("", () => resolve27());
   });
   await Promise.allSettled([
     flushWritable(process.stdout),
@@ -87735,7 +88401,8 @@ async function handleHeadlessCommand(parsedArgs, model, skillsDirectoryOverride,
         "default",
         "acceptEdits",
         "bypassPermissions",
-        "plan"
+        "plan",
+        "memory"
       ];
       if (validModes.includes(permissionModeValue)) {
         permissionMode3.setMode(permissionModeValue);
@@ -88656,7 +89323,7 @@ ${loadedContents.join(`
             } else {
               console.error(`Conversation is busy, waiting ${Math.round(retryDelayMs / 1000)}s and retrying...`);
             }
-            await new Promise((resolve28) => setTimeout(resolve28, retryDelayMs));
+            await new Promise((resolve27) => setTimeout(resolve27, retryDelayMs));
             continue;
           }
         }
@@ -88705,7 +89372,7 @@ ${loadedContents.join(`
             const delaySeconds = Math.round(delayMs / 1000);
             console.error(`Transient API error before streaming (attempt ${attempt} of ${LLM_API_ERROR_MAX_RETRIES2}), retrying in ${delaySeconds}s...`);
           }
-          await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+          await new Promise((resolve27) => setTimeout(resolve27, delayMs));
           conversationBusyRetries = 0;
           continue;
         }
@@ -88944,7 +89611,7 @@ ${loadedContents.join(`
             const delaySeconds = Math.round(delayMs / 1000);
             console.error(`LLM API error encountered (attempt ${attempt} of ${LLM_API_ERROR_MAX_RETRIES2}), retrying in ${delaySeconds}s...`);
           }
-          await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+          await new Promise((resolve27) => setTimeout(resolve27, delayMs));
           refreshCurrentInputOtids();
           continue;
         }
@@ -89030,7 +89697,7 @@ ${loadedContents.join(`
             } else {
               console.error(`Empty LLM response, retrying (attempt ${attempt} of ${EMPTY_RESPONSE_MAX_RETRIES2})...`);
             }
-            await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+            await new Promise((resolve27) => setTimeout(resolve27, delayMs));
             refreshCurrentInputOtids();
             continue;
           }
@@ -89058,7 +89725,7 @@ ${loadedContents.join(`
               const delaySeconds = Math.round(delayMs / 1000);
               console.error(`LLM API error encountered (attempt ${attempt} of ${LLM_API_ERROR_MAX_RETRIES2}), retrying in ${delaySeconds}s...`);
             }
-            await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+            await new Promise((resolve27) => setTimeout(resolve27, delayMs));
             refreshCurrentInputOtids();
             continue;
           }
@@ -89392,9 +90059,9 @@ async function runBidirectionalMode(agent, conversationId, client, _outputFormat
     const syntheticUserLine = serializeQueuedMessageAsUserLine(queuedMessage);
     maybeNotifyBlocked(syntheticUserLine);
     if (lineResolver) {
-      const resolve28 = lineResolver;
+      const resolve27 = lineResolver;
       lineResolver = null;
-      resolve28(syntheticUserLine);
+      resolve27(syntheticUserLine);
       return;
     }
     lineQueue.push(syntheticUserLine);
@@ -89402,9 +90069,9 @@ async function runBidirectionalMode(agent, conversationId, client, _outputFormat
   rl.on("line", (line) => {
     maybeNotifyBlocked(line);
     if (lineResolver) {
-      const resolve28 = lineResolver;
+      const resolve27 = lineResolver;
       lineResolver = null;
-      resolve28(line);
+      resolve27(line);
     } else {
       lineQueue.push(line);
     }
@@ -89413,17 +90080,17 @@ async function runBidirectionalMode(agent, conversationId, client, _outputFormat
     setMessageQueueAdder(null);
     msgQueueRuntime.clear("shutdown");
     if (lineResolver) {
-      const resolve28 = lineResolver;
+      const resolve27 = lineResolver;
       lineResolver = null;
-      resolve28(null);
+      resolve27(null);
     }
   });
   async function getNextLine() {
     if (lineQueue.length > 0) {
       return lineQueue.shift() ?? null;
     }
-    return new Promise((resolve28) => {
-      lineResolver = resolve28;
+    return new Promise((resolve27) => {
+      lineResolver = resolve27;
     });
   }
   async function requestPermission(toolCallId, toolName, toolInput) {
@@ -89927,7 +90594,7 @@ async function runBidirectionalMode(agent, conversationId, client, _outputFormat
                 uuid: `retry-bidir-${randomUUID8()}`
               };
               console.log(JSON.stringify(retryMsg));
-              await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+              await new Promise((resolve27) => setTimeout(resolve27, delayMs));
               continue;
             }
             throw preStreamError;
@@ -90223,10 +90890,10 @@ async function detectAndEnableKittyProtocol() {
     detectionComplete = true;
     return;
   }
-  return new Promise((resolve28) => {
+  return new Promise((resolve27) => {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
       detectionComplete = true;
-      resolve28();
+      resolve27();
       return;
     }
     const originalRawMode = process.stdin.isRaw;
@@ -90259,7 +90926,7 @@ async function detectAndEnableKittyProtocol() {
         console.error("[kitty] protocol query unsupported; enabled anyway (best-effort)");
       }
       detectionComplete = true;
-      resolve28();
+      resolve27();
     };
     const handleData = (data) => {
       if (timeoutId === undefined) {
@@ -90617,10 +91284,10 @@ __export(exports_settings, {
   loadProjectSettings: () => loadProjectSettings,
   getSetting: () => getSetting
 });
-import { homedir as homedir28 } from "node:os";
+import { homedir as homedir29 } from "node:os";
 import { join as join36 } from "node:path";
 function getSettingsPath() {
-  return join36(homedir28(), ".letta", "settings.json");
+  return join36(homedir29(), ".letta", "settings.json");
 }
 async function loadSettings() {
   const settingsPath = getSettingsPath();
@@ -106126,16 +106793,16 @@ function clipStyledSpans(spans, maxColumns) {
   return { spans: clipped, clipped: false };
 }
 function languageFromPath(filePath) {
-  const basename4 = filePath.split("/").pop() ?? filePath;
-  const lower = basename4.toLowerCase();
+  const basename5 = filePath.split("/").pop() ?? filePath;
+  const lower = basename5.toLowerCase();
   if (lower === "makefile")
     return "makefile";
   if (lower === "dockerfile")
     return "dockerfile";
-  const dotIdx = basename4.lastIndexOf(".");
+  const dotIdx = basename5.lastIndexOf(".");
   if (dotIdx < 0)
     return;
-  const ext3 = basename4.slice(dotIdx + 1).toLowerCase();
+  const ext3 = basename5.slice(dotIdx + 1).toLowerCase();
   return EXT_TO_LANG[ext3];
 }
 function colorForClassName(className, palette) {
@@ -110171,7 +110838,7 @@ var init_plan_viewer_template = () => {};
 
 // src/web/generate-plan-viewer.ts
 import { chmodSync as chmodSync2, existsSync as existsSync28, mkdirSync as mkdirSync20, writeFileSync as writeFileSync14 } from "node:fs";
-import { homedir as homedir29 } from "node:os";
+import { homedir as homedir30 } from "node:os";
 import { join as join37 } from "node:path";
 async function generateAndOpenPlanViewer(planContent, planFilePath, options) {
   const data = {
@@ -110205,7 +110872,7 @@ async function generateAndOpenPlanViewer(planContent, planFilePath, options) {
 var VIEWERS_DIR;
 var init_generate_plan_viewer = __esm(() => {
   init_plan_viewer_template();
-  VIEWERS_DIR = join37(homedir29(), ".letta", "viewers");
+  VIEWERS_DIR = join37(homedir30(), ".letta", "viewers");
 });
 
 // src/cli/components/StaticPlanApproval.tsx
@@ -112445,7 +113112,7 @@ var init_pasteRegistry = __esm(() => {
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync29, readFileSync as readFileSync16, statSync as statSync10, unlinkSync as unlinkSync10 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { basename as basename4, extname as extname5, isAbsolute as isAbsolute18, join as join38, resolve as resolve28 } from "node:path";
+import { basename as basename5, extname as extname5, isAbsolute as isAbsolute19, join as join38, resolve as resolve27 } from "node:path";
 function countLines2(text) {
   return (text.match(/\r\n|\r|\n/g) || []).length + 1;
 }
@@ -112492,8 +113159,8 @@ function translatePasteForImages(paste) {
           }
         } catch {}
       }
-      if (!isAbsolute18(filePath))
-        filePath = resolve28(process.cwd(), filePath);
+      if (!isAbsolute19(filePath))
+        filePath = resolve27(process.cwd(), filePath);
       const ext3 = extname5(filePath || "").toLowerCase();
       if (IMAGE_EXTS.has(ext3) && existsSync29(filePath) && statSync10(filePath).isFile()) {
         const buf = readFileSync16(filePath);
@@ -112502,7 +113169,7 @@ function translatePasteForImages(paste) {
         const id = allocateImage({
           data: b64,
           mediaType: mt,
-          filename: basename4(filePath)
+          filename: basename5(filePath)
         });
         s = `[Image #${id}]`;
       }
@@ -113268,8 +113935,8 @@ import {
   readFileSync as readFileSync17,
   writeFileSync as writeFileSync15
 } from "node:fs";
-import { homedir as homedir30, platform as platform5 } from "node:os";
-import { dirname as dirname15, join as join39 } from "node:path";
+import { homedir as homedir31, platform as platform5 } from "node:os";
+import { dirname as dirname16, join as join39 } from "node:path";
 function detectTerminalType() {
   if (process.env.CURSOR_TRACE_ID || process.env.CURSOR_CHANNEL) {
     return "cursor";
@@ -113301,7 +113968,7 @@ function getKeybindingsPath(terminal) {
   }[terminal];
   const os7 = platform5();
   if (os7 === "darwin") {
-    return join39(homedir30(), "Library", "Application Support", appName, "User", "keybindings.json");
+    return join39(homedir31(), "Library", "Application Support", appName, "User", "keybindings.json");
   }
   if (os7 === "win32") {
     const appData = process.env.APPDATA;
@@ -113310,7 +113977,7 @@ function getKeybindingsPath(terminal) {
     return join39(appData, appName, "User", "keybindings.json");
   }
   if (os7 === "linux") {
-    return join39(homedir30(), ".config", appName, "User", "keybindings.json");
+    return join39(homedir31(), ".config", appName, "User", "keybindings.json");
   }
   return null;
 }
@@ -113360,7 +114027,7 @@ function installKeybinding(keybindingsPath) {
     if (keybindingExists(keybindingsPath)) {
       return { success: true, alreadyExists: true };
     }
-    const parentDir = dirname15(keybindingsPath);
+    const parentDir = dirname16(keybindingsPath);
     if (!existsSync30(parentDir)) {
       mkdirSync21(parentDir, { recursive: true });
     }
@@ -113467,10 +114134,10 @@ function getWezTermConfigPath() {
     if (existsSync30(xdgPath))
       return xdgPath;
   }
-  const configPath = join39(homedir30(), ".config", "wezterm", "wezterm.lua");
+  const configPath = join39(homedir31(), ".config", "wezterm", "wezterm.lua");
   if (existsSync30(configPath))
     return configPath;
-  return join39(homedir30(), ".wezterm.lua");
+  return join39(homedir31(), ".wezterm.lua");
 }
 function wezTermDeleteFixExists(configPath) {
   if (!existsSync30(configPath))
@@ -113519,7 +114186,7 @@ return config`);
 ${WEZTERM_DELETE_FIX}
 `;
     }
-    const parentDir = dirname15(configPath);
+    const parentDir = dirname16(configPath);
     if (!existsSync30(parentDir)) {
       mkdirSync21(parentDir, { recursive: true });
     }
@@ -114102,7 +114769,7 @@ __export(exports_custom, {
 });
 import { existsSync as existsSync31 } from "node:fs";
 import { readdir as readdir9, readFile as readFile11 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname16, join as join40 } from "node:path";
+import { basename as basename6, dirname as dirname17, join as join40 } from "node:path";
 async function getCustomCommands() {
   if (cachedCommands !== null) {
     return cachedCommands;
@@ -114162,8 +114829,8 @@ async function findCommandFiles(currentPath, rootPath, commands2, source2) {
 async function parseCommandFile(filePath, rootPath, source2) {
   const content = await readFile11(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(content);
-  const id = basename5(filePath, ".md");
-  const relativePath = dirname16(filePath).slice(rootPath.length);
+  const id = basename6(filePath, ".md");
+  const relativePath = dirname17(filePath).slice(rootPath.length);
   const namespace = relativePath.replace(/^[/\\]/, "") || undefined;
   let description = getStringField(frontmatter, "description");
   if (!description) {
@@ -114511,12 +115178,12 @@ var init_HelpDialog = __esm(async () => {
 });
 
 // src/hooks/writer.ts
-import { homedir as homedir31 } from "node:os";
-import { resolve as resolve29 } from "node:path";
+import { homedir as homedir32 } from "node:os";
+import { resolve as resolve28 } from "node:path";
 function isProjectSettingsPathCollidingWithGlobal2(workingDirectory) {
-  const home = process.env.HOME || homedir31();
-  const globalSettingsPath = resolve29(home, ".letta", "settings.json");
-  const projectSettingsPath = resolve29(workingDirectory, ".letta", "settings.json");
+  const home = process.env.HOME || homedir32();
+  const globalSettingsPath = resolve28(home, ".letta", "settings.json");
+  const projectSettingsPath = resolve28(workingDirectory, ".letta", "settings.json");
   return globalSettingsPath === projectSettingsPath;
 }
 function loadHooksFromLocation(location, workingDirectory = process.cwd()) {
@@ -117154,7 +117821,7 @@ var init_AgentInfoBar = __esm(async () => {
 
 // src/cli/helpers/fileSearch.ts
 import { readdirSync as readdirSync13, statSync as statSync11 } from "node:fs";
-import { join as join41, relative as relative15, resolve as resolve30 } from "node:path";
+import { join as join41, relative as relative15, resolve as resolve29 } from "node:path";
 function searchDirectoryRecursive(dir, pattern, maxResults = 200, results = [], depth = 0, maxDepth = 10, lowerPattern = pattern.toLowerCase()) {
   if (results.length >= maxResults || depth >= maxDepth) {
     return results;
@@ -117197,7 +117864,7 @@ async function searchFiles(query, deep = false) {
       const dirPart = query.slice(0, lastSlashIndex);
       const pattern = query.slice(lastSlashIndex + 1);
       try {
-        const resolvedDir = resolve30(getIndexRoot(), dirPart);
+        const resolvedDir = resolve29(getIndexRoot(), dirPart);
         try {
           statSync11(resolvedDir);
           searchDir = resolvedDir;
@@ -119325,7 +119992,7 @@ import {
   writeFileSync as writeFileSync16
 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { dirname as dirname17, join as join42 } from "node:path";
+import { dirname as dirname18, join as join42 } from "node:path";
 function runCommand(command, args, cwd2, input) {
   try {
     return execFileSync4(command, args, {
@@ -119572,8 +120239,8 @@ function runGit6(args, cwd2) {
 }
 function writeWorkflow(repoDir, workflowPath, content) {
   const absolutePath = join42(repoDir, workflowPath);
-  if (!existsSync32(dirname17(absolutePath))) {
-    mkdirSync22(dirname17(absolutePath), { recursive: true });
+  if (!existsSync32(dirname18(absolutePath))) {
+    mkdirSync22(dirname18(absolutePath), { recursive: true });
   }
   const next = `${content.trimEnd()}
 `;
@@ -123479,7 +124146,7 @@ __export(exports_generate_memory_viewer, {
 });
 import { execFile as execFileCb5 } from "node:child_process";
 import { chmodSync as chmodSync3, existsSync as existsSync33, mkdirSync as mkdirSync23, writeFileSync as writeFileSync17 } from "node:fs";
-import { homedir as homedir32 } from "node:os";
+import { homedir as homedir33 } from "node:os";
 import { join as join43 } from "node:path";
 import { promisify as promisify14 } from "node:util";
 async function runGitSafe(cwd2, args) {
@@ -123793,7 +124460,7 @@ var init_generate_memory_viewer = __esm(async () => {
     init_memoryGit()
   ]);
   execFile14 = promisify14(execFileCb5);
-  VIEWERS_DIR2 = join43(homedir32(), ".letta", "viewers");
+  VIEWERS_DIR2 = join43(homedir33(), ".letta", "viewers");
   REFLECTION_PATTERN = /\(reflection\)|🔮|reflection:/i;
 });
 
@@ -126511,11 +127178,11 @@ var init_PersonalitySelector = __esm(async () => {
 
 // src/utils/aws-credentials.ts
 import { readFile as readFile12 } from "node:fs/promises";
-import { homedir as homedir33 } from "node:os";
+import { homedir as homedir34 } from "node:os";
 import { join as join44 } from "node:path";
 async function parseAwsCredentials() {
-  const credentialsPath = join44(homedir33(), ".aws", "credentials");
-  const configPath = join44(homedir33(), ".aws", "config");
+  const credentialsPath = join44(homedir34(), ".aws", "credentials");
+  const configPath = join44(homedir34(), ".aws", "config");
   const profiles = new Map;
   try {
     const content = await readFile12(credentialsPath, "utf-8");
@@ -131996,7 +132663,7 @@ async function executeStatusLineCommand(command, payload, options) {
   };
 }
 function runWithLauncher(launcher, inputJson, timeout, signal, workingDirectory, startTime) {
-  return new Promise((resolve31, reject) => {
+  return new Promise((resolve30, reject) => {
     const [executable, ...args] = launcher;
     if (!executable) {
       reject(new Error("Empty launcher"));
@@ -132009,7 +132676,7 @@ function runWithLauncher(launcher, inputJson, timeout, signal, workingDirectory,
     const safeResolve = (result) => {
       if (!resolved) {
         resolved = true;
-        resolve31(result);
+        resolve30(result);
       }
     };
     let child;
@@ -132455,7 +133122,7 @@ __export(exports_shellAliases, {
   clearAliasCache: () => clearAliasCache
 });
 import { existsSync as existsSync36, readFileSync as readFileSync20 } from "node:fs";
-import { homedir as homedir34 } from "node:os";
+import { homedir as homedir35 } from "node:os";
 import { join as join46 } from "node:path";
 function parseAliasesFromFile(filePath) {
   const aliases = new Map;
@@ -132525,7 +133192,7 @@ function loadAliases(forceReload = false) {
   if (aliasCache && !forceReload) {
     return aliasCache;
   }
-  const home = homedir34();
+  const home = homedir35();
   const allAliases = new Map;
   for (const file of ALIAS_FILES) {
     const filePath = join46(home, file);
@@ -133186,14 +133853,14 @@ __export(exports_export, {
   packageSkills: () => packageSkills
 });
 import { readdir as readdir10, readFile as readFile13 } from "node:fs/promises";
-import { relative as relative16, resolve as resolve31 } from "node:path";
+import { relative as relative16, resolve as resolve30 } from "node:path";
 async function packageSkills(agentId, skillsDir) {
   const skills = [];
   const skillNames = new Set;
   const dirsToCheck = skillsDir ? [skillsDir] : [
     agentId && getAgentSkillsDir(agentId),
-    resolve31(process.cwd(), ".skills"),
-    resolve31(process.env.HOME || "~", ".letta", "skills")
+    resolve30(process.cwd(), ".skills"),
+    resolve30(process.env.HOME || "~", ".letta", "skills")
   ].filter((dir) => Boolean(dir));
   for (const baseDir of dirsToCheck) {
     try {
@@ -133203,8 +133870,8 @@ async function packageSkills(agentId, skillsDir) {
           continue;
         if (skillNames.has(entry.name))
           continue;
-        const skillDir = resolve31(baseDir, entry.name);
-        const skillMdPath = resolve31(skillDir, "SKILL.md");
+        const skillDir = resolve30(baseDir, entry.name);
+        const skillMdPath = resolve30(skillDir, "SKILL.md");
         try {
           await readFile13(skillMdPath, "utf-8");
         } catch {
@@ -133234,7 +133901,7 @@ async function readSkillFiles(skillDir) {
   async function walk(dir) {
     const entries = await readdir10(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = resolve31(dir, entry.name);
+      const fullPath = resolve30(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(fullPath);
       } else {
@@ -133379,7 +134046,7 @@ __export(exports_App, {
 });
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { existsSync as existsSync37, readFileSync as readFileSync21, renameSync as renameSync3, writeFileSync as writeFileSync18 } from "node:fs";
-import { homedir as homedir35, tmpdir as tmpdir6 } from "node:os";
+import { homedir as homedir36, tmpdir as tmpdir6 } from "node:os";
 import { join as join47, relative as relative17 } from "node:path";
 function deriveReasoningEffort(modelSettings, llmConfig) {
   if (modelSettings && "provider_type" in modelSettings) {
@@ -135718,7 +136385,7 @@ ${newState.originalPrompt}`,
                   cancelled = true;
                   break;
                 }
-                await new Promise((resolve32) => setTimeout(resolve32, 100));
+                await new Promise((resolve31) => setTimeout(resolve31, 100));
               }
               buffersRef.current.byId.delete(statusId);
               buffersRef.current.order = buffersRef.current.order.filter((id) => id !== statusId);
@@ -135782,7 +136449,7 @@ ${newState.originalPrompt}`,
                 cancelled = true;
                 break;
               }
-              await new Promise((resolve32) => setTimeout(resolve32, 100));
+              await new Promise((resolve31) => setTimeout(resolve31, 100));
             }
             if (retryStatusId) {
               buffersRef.current.byId.delete(retryStatusId);
@@ -136540,7 +137207,7 @@ ${feedback}
           });
           buffersRef.current.order.push(statusId);
           refreshDerived();
-          await new Promise((resolve32) => setTimeout(resolve32, delayMs));
+          await new Promise((resolve31) => setTimeout(resolve31, delayMs));
           buffersRef.current.byId.delete(statusId);
           buffersRef.current.order = buffersRef.current.order.filter((id) => id !== statusId);
           refreshDerived();
@@ -136600,7 +137267,7 @@ ${feedback}
               cancelled = true;
               break;
             }
-            await new Promise((resolve32) => setTimeout(resolve32, 100));
+            await new Promise((resolve31) => setTimeout(resolve31, 100));
           }
           if (retryStatusId) {
             buffersRef.current.byId.delete(retryStatusId);
@@ -141543,7 +142210,7 @@ ${guidance}`);
         }
         if (mode === "bypassPermissions") {
           const planFilePath = activePlanPath ?? fallbackPlanPath;
-          const plansDir = join47(homedir35(), ".letta", "plans");
+          const plansDir = join47(homedir36(), ".letta", "plans");
           handlePlanKeepPlanning(`You must write your plan to a plan file before exiting plan mode.
 ` + (planFilePath ? `Plan file path: ${planFilePath}
 ` : "") + `Use a write tool to create your plan in ${plansDir}, then use ExitPlanMode to present the plan to the user.`);
@@ -141578,7 +142245,7 @@ ${guidance}`);
       if (!hasUsablePlan) {
         lastAutoHandledExitPlanToolCallIdRef.current = approval.toolCallId;
         const planFilePath = activePlanPath ?? fallbackPlanPath;
-        const plansDir = join47(homedir35(), ".letta", "plans");
+        const plansDir = join47(homedir36(), ".letta", "plans");
         handlePlanKeepPlanning(`You must write your plan to a plan file before exiting plan mode.
 ` + (planFilePath ? `Plan file path: ${planFilePath}
 ` : "") + `Use a write tool to create your plan in ${plansDir}, then use ExitPlanMode to present the plan to the user.`);
@@ -142990,8 +143657,8 @@ import {
   readFileSync as readFileSync22,
   writeFileSync as writeFileSync19
 } from "node:fs";
-import { homedir as homedir36, platform as platform6 } from "node:os";
-import { dirname as dirname18, join as join48 } from "node:path";
+import { homedir as homedir37, platform as platform6 } from "node:os";
+import { dirname as dirname19, join as join48 } from "node:path";
 function detectTerminalType2() {
   if (process.env.CURSOR_TRACE_ID || process.env.CURSOR_CHANNEL) {
     return "cursor";
@@ -143023,7 +143690,7 @@ function getKeybindingsPath2(terminal) {
   }[terminal];
   const os8 = platform6();
   if (os8 === "darwin") {
-    return join48(homedir36(), "Library", "Application Support", appName, "User", "keybindings.json");
+    return join48(homedir37(), "Library", "Application Support", appName, "User", "keybindings.json");
   }
   if (os8 === "win32") {
     const appData = process.env.APPDATA;
@@ -143032,7 +143699,7 @@ function getKeybindingsPath2(terminal) {
     return join48(appData, appName, "User", "keybindings.json");
   }
   if (os8 === "linux") {
-    return join48(homedir36(), ".config", appName, "User", "keybindings.json");
+    return join48(homedir37(), ".config", appName, "User", "keybindings.json");
   }
   return null;
 }
@@ -143082,7 +143749,7 @@ function installKeybinding2(keybindingsPath) {
     if (keybindingExists2(keybindingsPath)) {
       return { success: true, alreadyExists: true };
     }
-    const parentDir = dirname18(keybindingsPath);
+    const parentDir = dirname19(keybindingsPath);
     if (!existsSync38(parentDir)) {
       mkdirSync24(parentDir, { recursive: true });
     }
@@ -143189,10 +143856,10 @@ function getWezTermConfigPath2() {
     if (existsSync38(xdgPath))
       return xdgPath;
   }
-  const configPath = join48(homedir36(), ".config", "wezterm", "wezterm.lua");
+  const configPath = join48(homedir37(), ".config", "wezterm", "wezterm.lua");
   if (existsSync38(configPath))
     return configPath;
-  return join48(homedir36(), ".wezterm.lua");
+  return join48(homedir37(), ".wezterm.lua");
 }
 function wezTermDeleteFixExists2(configPath) {
   if (!existsSync38(configPath))
@@ -143241,7 +143908,7 @@ return config`);
 ${WEZTERM_DELETE_FIX2}
 `;
     }
-    const parentDir = dirname18(configPath);
+    const parentDir = dirname19(configPath);
     if (!existsSync38(parentDir)) {
       mkdirSync24(parentDir, { recursive: true });
     }
@@ -143290,10 +143957,10 @@ __export(exports_settings2, {
   loadProjectSettings: () => loadProjectSettings2,
   getSetting: () => getSetting2
 });
-import { homedir as homedir37 } from "node:os";
+import { homedir as homedir38 } from "node:os";
 import { join as join49 } from "node:path";
 function getSettingsPath2() {
-  return join49(homedir37(), ".letta", "settings.json");
+  return join49(homedir38(), ".letta", "settings.json");
 }
 async function loadSettings2() {
   const settingsPath = getSettingsPath2();
@@ -143815,10 +144482,10 @@ __export(exports_import2, {
 });
 import { createReadStream as createReadStream2 } from "node:fs";
 import { chmod as chmod2, mkdir as mkdir8, readFile as readFile14, writeFile as writeFile9 } from "node:fs/promises";
-import { dirname as dirname19, resolve as resolve32 } from "node:path";
+import { dirname as dirname20, resolve as resolve31 } from "node:path";
 async function importAgentFromFile2(options) {
   const client = await getClient();
-  const resolvedPath = resolve32(options.filePath);
+  const resolvedPath = resolve31(options.filePath);
   const file = createReadStream2(resolvedPath);
   const importResponse = await client.agents.importFile({
     file,
@@ -143853,7 +144520,7 @@ async function extractSkillsFromAf2(afPath, destDir) {
     return [];
   }
   for (const skill2 of afData.skills) {
-    const skillDir = resolve32(destDir, skill2.name);
+    const skillDir = resolve31(destDir, skill2.name);
     await mkdir8(skillDir, { recursive: true });
     if (skill2.files) {
       await writeSkillFiles2(skillDir, skill2.files);
@@ -143873,8 +144540,8 @@ async function writeSkillFiles2(skillDir, files) {
   }
 }
 async function writeSkillFile2(skillDir, filePath, content) {
-  const fullPath = resolve32(skillDir, filePath);
-  await mkdir8(dirname19(fullPath), { recursive: true });
+  const fullPath = resolve31(skillDir, filePath);
+  await mkdir8(dirname20(fullPath), { recursive: true });
   await writeFile9(fullPath, content, "utf-8");
   const isScript = filePath.startsWith("scripts/") || content.trimStart().startsWith("#!");
   if (isScript) {
@@ -143984,15 +144651,15 @@ __export(exports_memoryFilesystem2, {
   MEMORY_FS_AGENTS_DIR: () => MEMORY_FS_AGENTS_DIR2
 });
 import { existsSync as existsSync39, mkdirSync as mkdirSync25 } from "node:fs";
-import { homedir as homedir38 } from "node:os";
+import { homedir as homedir39 } from "node:os";
 import { join as join50 } from "node:path";
-function getMemoryFilesystemRoot2(agentId, homeDir = homedir38()) {
+function getMemoryFilesystemRoot2(agentId, homeDir = homedir39()) {
   return join50(homeDir, MEMORY_FS_ROOT2, MEMORY_FS_AGENTS_DIR2, agentId, MEMORY_FS_MEMORY_DIR2);
 }
-function getMemorySystemDir2(agentId, homeDir = homedir38()) {
+function getMemorySystemDir2(agentId, homeDir = homedir39()) {
   return join50(getMemoryFilesystemRoot2(agentId, homeDir), MEMORY_SYSTEM_DIR2);
 }
-function ensureMemoryFilesystemDirs2(agentId, homeDir = homedir38()) {
+function ensureMemoryFilesystemDirs2(agentId, homeDir = homedir39()) {
   const root = getMemoryFilesystemRoot2(agentId, homeDir);
   const systemDir = getMemorySystemDir2(agentId, homeDir);
   if (!existsSync39(root)) {
@@ -148638,7 +149305,7 @@ async function runListenSubcommand(argv) {
 await init_memoryGit();
 import { cpSync, existsSync as existsSync22, mkdirSync as mkdirSync15, rmSync as rmSync2, statSync as statSync8 } from "node:fs";
 import { readdir as readdir6 } from "node:fs/promises";
-import { homedir as homedir22 } from "node:os";
+import { homedir as homedir23 } from "node:os";
 import { join as join28 } from "node:path";
 import { parseArgs as parseArgs7 } from "node:util";
 function printUsage4() {
@@ -148684,10 +149351,10 @@ function parseMemfsArgs(argv) {
   });
 }
 function getMemoryRoot(agentId) {
-  return join28(homedir22(), ".letta", "agents", agentId, "memory");
+  return join28(homedir23(), ".letta", "agents", agentId, "memory");
 }
 function getAgentRoot(agentId) {
-  return join28(homedir22(), ".letta", "agents", agentId);
+  return join28(homedir23(), ".letta", "agents", agentId);
 }
 function formatBackupTimestamp(date = new Date) {
   const pad = (value) => String(value).padStart(2, "0");
@@ -149236,13 +149903,20 @@ async function runSubcommand(argv) {
 }
 
 // src/permissions/mode.ts
+init_memoryScope();
 init_readOnlyShell();
 init_shell_command_normalization();
-import { homedir as homedir23 } from "node:os";
-import { isAbsolute as isAbsolute16, join as join29, relative as relative12, resolve as resolve24 } from "node:path";
+import { homedir as homedir24 } from "node:os";
+import { isAbsolute as isAbsolute17, join as join29, relative as relative12 } from "node:path";
 var MODE_KEY2 = Symbol.for("@letta/permissionMode");
 var PLAN_FILE_KEY2 = Symbol.for("@letta/planFilePath");
 var MODE_BEFORE_PLAN_KEY2 = Symbol.for("@letta/permissionModeBeforePlan");
+function everyResolvedTargetIsWithinRoots2(candidatePaths, roots, workingDirectory) {
+  return candidatePaths.length > 0 && candidatePaths.every((path23) => {
+    const resolvedPath = resolveScopedTargetPath(path23, workingDirectory);
+    return resolvedPath ? isPathWithinRoots(resolvedPath, roots) : false;
+  });
+}
 function getGlobalMode2() {
   const global2 = globalThis;
   if (!global2[MODE_KEY2]) {
@@ -149271,22 +149945,13 @@ function setGlobalModeBeforePlan2(value) {
   global2[MODE_BEFORE_PLAN_KEY2] = value;
 }
 function resolvePlanTargetPath2(targetPath, workingDirectory) {
-  const trimmedPath = targetPath.trim();
-  if (!trimmedPath)
-    return null;
-  if (trimmedPath.startsWith("~/")) {
-    return resolve24(homedir23(), trimmedPath.slice(2));
-  }
-  if (isAbsolute16(trimmedPath)) {
-    return resolve24(trimmedPath);
-  }
-  return resolve24(workingDirectory, trimmedPath);
+  return resolveScopedTargetPath(targetPath, workingDirectory);
 }
 function isPathInPlansDir2(path23, plansDir) {
   if (!path23.endsWith(".md"))
     return false;
   const rel = relative12(plansDir, path23);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute16(rel);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute17(rel);
 }
 function extractApplyPatchPaths2(input) {
   const paths = [];
@@ -149473,7 +150138,7 @@ class PermissionModeManager2 {
           return "allow";
         }
         if (writeTools.includes(toolName)) {
-          const plansDir = join29(homedir23(), ".letta", "plans");
+          const plansDir = join29(homedir24(), ".letta", "plans");
           const targetPath = toolArgs?.file_path || toolArgs?.path;
           let candidatePaths = [];
           if ((toolName === "ApplyPatch" || toolName === "apply_patch" || toolName === "memory_apply_patch") && toolArgs?.input) {
@@ -149524,7 +150189,7 @@ class PermissionModeManager2 {
           }
           const planWritePath = extractPlanFileWritePathFromShellCommand2(command);
           if (planWritePath) {
-            const plansDir = join29(homedir23(), ".letta", "plans");
+            const plansDir = join29(homedir24(), ".letta", "plans");
             const resolvedPath = resolvePlanTargetPath2(planWritePath, workingDirectory);
             if (resolvedPath && isPathInPlansDir2(resolvedPath, plansDir)) {
               return "allow";
@@ -149533,6 +150198,94 @@ class PermissionModeManager2 {
         }
         return "deny";
       }
+      case "memory": {
+        const allowedMemoryRoots = resolveAllowedMemoryRoots().roots;
+        const allowedReadOnlyTools = [
+          "Read",
+          "Glob",
+          "Grep",
+          "NotebookRead",
+          "ViewImage",
+          "view_image",
+          "TaskOutput",
+          "task_output",
+          "Skill",
+          "skill",
+          "read_file",
+          "list_dir",
+          "grep_files",
+          "ReadFile",
+          "ListDir",
+          "GrepFiles",
+          "read_file_gemini",
+          "glob_gemini",
+          "list_directory",
+          "search_file_content",
+          "read_many_files",
+          "ReadFileGemini",
+          "GlobGemini",
+          "ListDirectory",
+          "SearchFileContent",
+          "ReadManyFiles"
+        ];
+        const writeTools = [
+          "Write",
+          "Edit",
+          "MultiEdit",
+          "NotebookEdit",
+          "apply_patch",
+          "ApplyPatch",
+          "replace",
+          "Replace",
+          "write_file",
+          "WriteFile",
+          "write_file_gemini",
+          "WriteFileGemini"
+        ];
+        const shellTools = [
+          "Bash",
+          "shell",
+          "Shell",
+          "shell_command",
+          "ShellCommand",
+          "run_shell_command",
+          "RunShellCommand",
+          "run_shell_command_gemini",
+          "RunShellCommandGemini"
+        ];
+        if (allowedReadOnlyTools.includes(toolName)) {
+          return "allow";
+        }
+        if (toolName === "memory_apply_patch") {
+          return allowedMemoryRoots.length > 0 ? "allow" : "deny";
+        }
+        if (writeTools.includes(toolName)) {
+          const targetPath = toolArgs?.file_path || toolArgs?.path;
+          let candidatePaths = [];
+          if ((toolName === "ApplyPatch" || toolName === "apply_patch") && toolArgs?.input) {
+            candidatePaths = extractApplyPatchPaths2(toolArgs.input);
+          } else if (typeof targetPath === "string") {
+            candidatePaths = [targetPath];
+          }
+          if (allowedMemoryRoots.length > 0 && everyResolvedTargetIsWithinRoots2(candidatePaths, allowedMemoryRoots, workingDirectory)) {
+            return "allow";
+          }
+          return "deny";
+        }
+        if (shellTools.includes(toolName)) {
+          const command = toolArgs?.command;
+          if (command && isReadOnlyShellCommand(command, { allowExternalPaths: true })) {
+            return "allow";
+          }
+          if (command && allowedMemoryRoots.length > 0 && isScopedMemoryShellCommand(command, allowedMemoryRoots, {
+            workingDirectory
+          })) {
+            return "allow";
+          }
+          return "deny";
+        }
+        return "deny";
+      }
       case "default":
         return null;
       default:
@@ -149555,8 +150308,8 @@ await __promiseAll([
   init_secrets()
 ]);
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { homedir as homedir24 } from "node:os";
-import { join as join30, resolve as resolve25 } from "node:path";
+import { homedir as homedir25 } from "node:os";
+import { join as join30, resolve as resolve24 } from "node:path";
 var DEFAULT_SETTINGS3 = {
   lastAgent: null,
   tokenStreaming: false,
@@ -149942,7 +150695,7 @@ class SettingsManager2 {
     if (!this.settings)
       return;
     const settingsPath = this.getSettingsPath();
-    const home = process.env.HOME || homedir24();
+    const home = process.env.HOME || homedir25();
     const dirPath = join30(home, ".letta");
     try {
       if (!exists(dirPath)) {
@@ -150003,14 +150756,14 @@ class SettingsManager2 {
     }
   }
   getSettingsPath() {
-    const home = process.env.HOME || homedir24();
+    const home = process.env.HOME || homedir25();
     return join30(home, ".letta", "settings.json");
   }
   getProjectSettingsPath(workingDirectory) {
     return join30(workingDirectory, ".letta", "settings.json");
   }
   isProjectSettingsPathCollidingWithGlobal(workingDirectory) {
-    return resolve25(this.getProjectSettingsPath(workingDirectory)) === resolve25(this.getSettingsPath());
+    return resolve24(this.getProjectSettingsPath(workingDirectory)) === resolve24(this.getSettingsPath());
   }
   getLocalProjectSettingsPath(workingDirectory) {
     return join30(workingDirectory, ".letta", "settings.local.json");
@@ -150972,8 +151725,8 @@ function acquireSwitchLock2() {
   const lock = getSwitchLock2();
   lock.refCount++;
   if (lock.refCount === 1) {
-    lock.promise = new Promise((resolve26) => {
-      lock.resolve = resolve26;
+    lock.promise = new Promise((resolve25) => {
+      lock.resolve = resolve25;
     });
   }
 }
@@ -151458,7 +152211,7 @@ Note: Flags should use double dashes for full names (e.g., --yolo, not -yolo)`);
     printHelp();
     const helpDelayMs = Number.parseInt(process.env.LETTA_TEST_HELP_EXIT_DELAY_MS ?? "", 10);
     if (Number.isFinite(helpDelayMs) && helpDelayMs > 0) {
-      await new Promise((resolve33) => setTimeout(resolve33, helpDelayMs));
+      await new Promise((resolve32) => setTimeout(resolve32, helpDelayMs));
     }
     process.exit(0);
   }
@@ -151680,9 +152433,9 @@ Note: Flags should use double dashes for full names (e.g., --yolo, not -yolo)`);
         process.exit(1);
       }
     } else {
-      const { resolve: resolve33 } = await import("path");
+      const { resolve: resolve32 } = await import("path");
       const { existsSync: existsSync40 } = await import("fs");
-      const resolvedPath = resolve33(fromAfFile);
+      const resolvedPath = resolve32(fromAfFile);
       if (!existsSync40(resolvedPath)) {
         console.error(`Error: AgentFile not found: ${resolvedPath}`);
         process.exit(1);
@@ -151793,6 +152546,7 @@ Error: ${message}`);
         "default",
         "acceptEdits",
         "plan",
+        "memory",
         "bypassPermissions"
       ];
       if (validModes.includes(mode)) {
@@ -152557,4 +153311,4 @@ Error during initialization: ${message}`);
 }
 main();
 
-//# debugId=275910C1663139CA64756E2164756E21
+//# debugId=1C3BE0588811294864756E2164756E21