@letta-ai/letta-code 0.21.11 → 0.21.13

package/letta.js

@@ -3269,7 +3269,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@letta-ai/letta-code",
-    version: "0.21.11",
+    version: "0.21.13",
     description: "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
     type: "module",
     bin: {
@@ -6841,7 +6841,7 @@ skills:
 model: auto
 memoryBlocks: none
 mode: stateless
-permissionMode: bypassPermissions
+permissionMode: memory
 ---
 
 You are a history analysis subagent. You create a git worktree from the agent's memory repo, read conversation history from Claude Code or Codex, then **directly create and update memory files** in your worktree based on what you learn.
@@ -6921,12 +6921,18 @@ Keep specific correction counts ("corrected 10+ times"), specific file paths, an
 \`\`\`bash
 MEMORY_DIR=~/.letta/agents/$LETTA_PARENT_AGENT_ID/memory
 WORKTREE_DIR=~/.letta/agents/$LETTA_PARENT_AGENT_ID/memory-worktrees
-BRANCH_NAME="migration-$(date +%s)"
+# Run \`date +%s\` first, then paste that exact output below.
+BRANCH_NAME="migration-<epoch-seconds>"
 mkdir -p "$WORKTREE_DIR"
 cd "$MEMORY_DIR"
 git worktree add "$WORKTREE_DIR/$BRANCH_NAME" -b "$BRANCH_NAME"
 \`\`\`
 
+Use epoch seconds from a prior \`date +%s\` command so branch names match the
+old behavior. Do not use shell command substitution like \`$(date +%s)\` in the
+branch assignment because memory-mode shell permissions deny command
+substitution.
+
 If worktree creation fails (locked index), retry up to 3 times with backoff (sleep 2, 5, 10). Never delete \`.git/index.lock\` manually. All edits go in \`$WORKTREE_DIR/$BRANCH_NAME/\`.
 
 ### 2. Read existing memory
@@ -7043,7 +7049,7 @@ description: Fast initialization of agent memory — reads key project files and
 tools: Read, Write, Edit, Bash, Glob
 model: auto-fast
 memoryBlocks: none
-permissionMode: bypassPermissions
+permissionMode: memory
 ---
 
 You are a fast memory initialization subagent. Your job is to quickly scan a project and create a **skeleton memory hierarchy** for the parent agent. This hierarchy starts minimal and gets fleshed out as the user keeps interacting with the agent.
@@ -7151,7 +7157,7 @@ description: Decompose and reorganize memory files into focused, single-purpose
 tools: Read, Edit, Write, Glob, Grep, Bash, TaskOutput
 model: auto
 memoryBlocks: none
-permissionMode: bypassPermissions
+permissionMode: memory
 ---
 
 You are a memory defragmentation subagent. You work directly on the git-backed memory filesystem to decompose and reorganize memory files.
@@ -7226,12 +7232,18 @@ making changes.
 **Create worktree:**
 
 \`\`\`bash
-BRANCH="defrag-$(date +%s)"
+# Run \`date +%s\` first, then paste that exact output below.
+BRANCH="defrag-<epoch-seconds>"
 mkdir -p "$WORKTREE_DIR"
 cd "$MEMORY_DIR"
 git worktree add "$WORKTREE_DIR/$BRANCH" -b "$BRANCH"
 \`\`\`
 
+Use epoch seconds from a prior \`date +%s\` command so branch names match the
+old behavior. Do not use shell command substitution like \`$(date +%s)\` in the
+branch assignment because memory-mode shell permissions deny command
+substitution.
+
 All subsequent file operations target the worktree:
 \`$WORKTREE_DIR/$BRANCH/system/\` (not the main memory dir).
 
@@ -7506,7 +7518,7 @@ tools: Read, Edit, Write, Glob, Grep, Bash, TaskOutput
 model: auto
 memoryBlocks: none
 mode: stateless
-permissionMode: bypassPermissions
+permissionMode: memory
 ---
 
 You are a reflection subagent — a background agent that asynchronously processes conversations after they occur, similar to a "sleep-time" memory consolidation process.
@@ -40496,7 +40508,7 @@ import {
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync7,
   renameSync as renameSync2,
-  rmdirSync,
+  rmSync as rmSync2,
   statSync as statSync2,
   writeFileSync as writeFileSync6
 } from "node:fs";
@@ -40574,7 +40586,7 @@ function isLockStale(lockDir) {
 }
 function stealLock(lockDir) {
   try {
-    rmdirSync(lockDir, { recursive: true });
+    rmSync2(lockDir, { recursive: true, force: true });
   } catch {}
 }
 function acquireLock() {
@@ -40595,7 +40607,7 @@ function acquireLock() {
           try {
             const current = readLockOwner(lockDir);
             if (current && current.token === token) {
-              rmdirSync(lockDir, { recursive: true });
+              rmSync2(lockDir, { recursive: true, force: true });
             }
           } catch {}
         }
@@ -52238,9 +52250,138 @@ var init_hooks = __esm(async () => {
   init_types();
 });
 
-// src/permissions/readOnlyShell.ts
+// src/permissions/memoryScope.ts
 import { homedir as homedir11 } from "node:os";
-import { resolve as resolve4 } from "node:path";
+import { basename, dirname as dirname4, isAbsolute as isAbsolute2, resolve as resolve4 } from "node:path";
+function normalizeScopedPath(path4) {
+  const resolvedPath = resolve4(expandHomePath(path4));
+  const normalized = resolvedPath.replace(/\\/g, "/");
+  return normalized.replace(/\/+$/, "") || "/";
+}
+function expandHomePath(path4) {
+  const value = path4.trim();
+  const homeDir = homedir11();
+  if (value.startsWith("~/")) {
+    return resolve4(homeDir, value.slice(2));
+  }
+  if (value.startsWith("$HOME/")) {
+    return resolve4(homeDir, value.slice(6));
+  }
+  if (value.startsWith('"$HOME/')) {
+    return resolve4(homeDir, value.slice(7).replace(/"$/, ""));
+  }
+  return value;
+}
+function resolveScopedTargetPath(targetPath, workingDirectory) {
+  const trimmedPath = targetPath.trim();
+  if (!trimmedPath)
+    return null;
+  if (trimmedPath.startsWith("~/") || trimmedPath.startsWith("$HOME/")) {
+    return normalizeScopedPath(trimmedPath);
+  }
+  if (isAbsolute2(trimmedPath) || /^[a-zA-Z]:[\\/]/.test(trimmedPath)) {
+    return normalizeScopedPath(trimmedPath);
+  }
+  return normalizeScopedPath(resolve4(workingDirectory, trimmedPath));
+}
+function isPathWithinRoots(path4, roots) {
+  const normalizedPath = normalizeScopedPath(path4);
+  return roots.some((root) => {
+    const normalizedRoot = normalizeScopedPath(root);
+    return normalizedPath === normalizedRoot || normalizedPath.startsWith(`${normalizedRoot}/`);
+  });
+}
+function addRootAndSiblingWorktree(root, acc) {
+  const normalizedRoot = normalizeScopedPath(root);
+  if (!normalizedRoot) {
+    return;
+  }
+  acc.add(normalizedRoot);
+  const leaf = basename(normalizedRoot);
+  if (leaf === "memory") {
+    acc.add(normalizeScopedPath(resolve4(dirname4(normalizedRoot), "memory-worktrees")));
+  }
+}
+function getExplicitEnvRoots(env3) {
+  const orderedRoots = [
+    env3.MEMORY_DIR,
+    env3.LETTA_MEMORY_DIR,
+    env3.PARENT_MEMORY_DIR
+  ].map((value) => value?.trim() ?? "").filter((value) => value.length > 0);
+  const explicitRootSet = new Set;
+  for (const root of orderedRoots) {
+    addRootAndSiblingWorktree(root, explicitRootSet);
+  }
+  return {
+    explicitRoots: [...explicitRootSet],
+    primaryRoot: orderedRoots.length > 0 ? normalizeScopedPath(orderedRoots[0]) : null
+  };
+}
+function deriveAgentId(env3, explicitAgentId) {
+  const explicit = explicitAgentId?.trim();
+  if (explicit) {
+    return explicit;
+  }
+  const envAgentId = (env3.AGENT_ID || env3.LETTA_AGENT_ID || "").trim();
+  if (envAgentId) {
+    return envAgentId;
+  }
+  try {
+    return getCurrentAgentId().trim();
+  } catch {
+    return null;
+  }
+}
+function getFallbackRoots(env3, homeDir, currentAgentId, parentAgentId) {
+  const fallbackRoots = new Set;
+  const resolvedCurrentAgentId = deriveAgentId(env3, currentAgentId);
+  const resolvedParentAgentId = (parentAgentId || env3.LETTA_PARENT_AGENT_ID || "").trim() || null;
+  let primaryRoot = null;
+  if (resolvedCurrentAgentId) {
+    const currentRoot = getMemoryFilesystemRoot(resolvedCurrentAgentId, homeDir);
+    addRootAndSiblingWorktree(currentRoot, fallbackRoots);
+    primaryRoot = normalizeScopedPath(currentRoot);
+  }
+  if (resolvedParentAgentId && resolvedParentAgentId !== resolvedCurrentAgentId) {
+    const parentRoot = getMemoryFilesystemRoot(resolvedParentAgentId, homeDir);
+    addRootAndSiblingWorktree(parentRoot, fallbackRoots);
+    if (!primaryRoot) {
+      primaryRoot = normalizeScopedPath(parentRoot);
+    }
+  }
+  return {
+    roots: [...fallbackRoots],
+    primaryRoot
+  };
+}
+function resolveAllowedMemoryRoots(options = {}) {
+  const env3 = options.env ?? process.env;
+  const homeDir = options.homeDir ?? homedir11();
+  const explicit = getExplicitEnvRoots(env3);
+  if (explicit.explicitRoots.length > 0) {
+    return {
+      roots: explicit.explicitRoots,
+      explicitRoots: explicit.explicitRoots,
+      primaryRoot: explicit.primaryRoot,
+      usedFallback: false
+    };
+  }
+  const fallback = getFallbackRoots(env3, homeDir, options.currentAgentId, options.parentAgentId);
+  return {
+    roots: fallback.roots,
+    explicitRoots: [],
+    primaryRoot: fallback.primaryRoot,
+    usedFallback: fallback.roots.length > 0
+  };
+}
+var init_memoryScope = __esm(() => {
+  init_context();
+  init_memoryFilesystem();
+});
+
+// src/permissions/readOnlyShell.ts
+import { homedir as homedir12 } from "node:os";
+import { resolve as resolve5 } from "node:path";
 function splitShellSegments(input) {
   const segments = [];
   let current = "";
@@ -52312,6 +52453,13 @@ function splitShellSegments(input) {
       i += 1;
       continue;
     }
+    if (ch === `
+` || ch === "\r") {
+      segments.push(current);
+      current = "";
+      i += 1;
+      continue;
+    }
     if (ch === "|") {
       segments.push(current);
       current = "";
@@ -52503,7 +52651,7 @@ function isUnderAllowedPathRoot(value, allowedPathRoots) {
   }
   const resolvedValue = expandPath(value);
   return allowedPathRoots.some((root) => {
-    const normalizedRoot = normalizeSeparators(resolve4(root));
+    const normalizedRoot = normalizeSeparators(resolve5(root));
     return resolvedValue === normalizedRoot || resolvedValue.startsWith(`${normalizedRoot}/`);
   });
 }
@@ -52546,14 +52694,14 @@ function parseGitInvocation(tokens, options) {
   return { subcommand: null, isSafePath: true };
 }
 function getAllowedMemoryPrefixes(agentId) {
-  const home = homedir11();
+  const home = homedir12();
   const prefixes = [
-    normalizeSeparators(resolve4(home, ".letta", "agents", agentId, "memory")),
-    normalizeSeparators(resolve4(home, ".letta", "agents", agentId, "memory-worktrees"))
+    normalizeSeparators(resolve5(home, ".letta", "agents", agentId, "memory")),
+    normalizeSeparators(resolve5(home, ".letta", "agents", agentId, "memory-worktrees"))
   ];
   const parentId = process.env.LETTA_PARENT_AGENT_ID;
   if (parentId && parentId !== agentId) {
-    prefixes.push(normalizeSeparators(resolve4(home, ".letta", "agents", parentId, "memory")), normalizeSeparators(resolve4(home, ".letta", "agents", parentId, "memory-worktrees")));
+    prefixes.push(normalizeSeparators(resolve5(home, ".letta", "agents", parentId, "memory")), normalizeSeparators(resolve5(home, ".letta", "agents", parentId, "memory-worktrees")));
   }
   return prefixes;
 }
@@ -52561,122 +52709,315 @@ function normalizeSeparators(p) {
   return p.replace(/\\/g, "/");
 }
 function expandPath(p) {
-  const home = homedir11();
-  if (p.startsWith("~/")) {
-    return normalizeSeparators(resolve4(home, p.slice(2)));
+  return normalizeScopedPath(p);
+}
+function expandScopedVariables(value, env3, shellVars) {
+  let unresolved = false;
+  const expanded = value.replace(/\$(?:{([A-Za-z_][A-Za-z0-9_]*)}|([A-Za-z_][A-Za-z0-9_]*))/g, (_match, bracedName, bareName) => {
+    const name = bracedName || bareName;
+    if (!name) {
+      unresolved = true;
+      return "";
+    }
+    if (name === "HOME") {
+      return homedir12();
+    }
+    const scopedValue = shellVars[name];
+    if (typeof scopedValue === "string") {
+      return scopedValue;
+    }
+    const envValue = env3[name];
+    if (typeof envValue === "string") {
+      return envValue;
+    }
+    unresolved = true;
+    return "";
+  });
+  return unresolved ? null : expanded;
+}
+function normalizeScopePath(path4, cwd2, env3, shellVars) {
+  const expandedPath = expandScopedVariables(path4, env3, shellVars);
+  if (!expandedPath) {
+    return null;
   }
-  if (p.startsWith("$HOME/")) {
-    return normalizeSeparators(resolve4(home, p.slice(6)));
+  if (expandedPath.startsWith("~/") || expandedPath.startsWith("$HOME/") || expandedPath.startsWith('"$HOME/') || expandedPath.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(expandedPath)) {
+    return normalizeScopedPath(expandedPath);
   }
-  if (p.startsWith('"$HOME/')) {
-    return normalizeSeparators(resolve4(home, p.slice(7).replace(/"$/, "")));
+  if (cwd2) {
+    return normalizeScopedPath(resolve5(cwd2, expandedPath));
   }
-  return normalizeSeparators(resolve4(p));
+  return null;
+}
+function parseScopedAssignmentToken(token) {
+  const match = token.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+  if (!match) {
+    return null;
+  }
+  return {
+    name: match[1] ?? "",
+    value: stripQuotes(match[2] ?? "")
+  };
+}
+function applyScopedAssignments(tokens, env3, shellVars) {
+  if (tokens.length === 0) {
+    return false;
+  }
+  for (const token of tokens) {
+    const assignment = parseScopedAssignmentToken(token);
+    if (!assignment) {
+      return false;
+    }
+    const expandedValue = expandScopedVariables(assignment.value, env3, shellVars);
+    if (expandedValue === null) {
+      return false;
+    }
+    if (expandedValue.startsWith("~/") || expandedValue.startsWith("$HOME/") || expandedValue.startsWith('"$HOME/') || expandedValue.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(expandedValue)) {
+      shellVars[assignment.name] = normalizeScopedPath(expandedValue);
+    } else {
+      shellVars[assignment.name] = expandedValue;
+    }
+  }
+  return true;
 }
-function isUnderMemoryDir(path4, prefixes) {
-  const resolved = expandPath(path4);
-  return prefixes.some((prefix) => resolved === prefix || resolved.startsWith(`${prefix}/`));
+function hasUnsafeRebaseOption(tokens, startIndex) {
+  for (let i = startIndex;i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (!token) {
+      continue;
+    }
+    const lower = token.toLowerCase();
+    if (lower === "--exec" || lower.startsWith("--exec=") || lower === "-x" || lower.startsWith("-x") && lower.length > 2 || lower === "--interactive" || lower === "-i" || lower === "--edit-todo") {
+      return true;
+    }
+  }
+  return false;
 }
-function extractCdTarget(segment) {
+function parseScopedGitInvocation(tokens, cwd2, allowedRoots, env3, shellVars) {
+  let index = 1;
+  let resolvedCwd = cwd2;
+  while (index < tokens.length) {
+    const token = tokens[index];
+    if (!token) {
+      index += 1;
+      continue;
+    }
+    if (token === "-C") {
+      const pathToken = tokens[index + 1];
+      if (!pathToken) {
+        return {
+          subcommand: null,
+          worktreeSubcommand: null,
+          resolvedCwd,
+          isSafe: false
+        };
+      }
+      const nextCwd = normalizeScopePath(pathToken, resolvedCwd, env3, shellVars);
+      if (!nextCwd || !isPathWithinRoots(nextCwd, allowedRoots)) {
+        return {
+          subcommand: null,
+          worktreeSubcommand: null,
+          resolvedCwd,
+          isSafe: false
+        };
+      }
+      resolvedCwd = nextCwd;
+      index += 2;
+      continue;
+    }
+    if (token === "-c") {
+      const configToken = tokens[index + 1];
+      if (!configToken) {
+        return {
+          subcommand: null,
+          worktreeSubcommand: null,
+          resolvedCwd,
+          isSafe: false
+        };
+      }
+      if (!/^http\.extraHeader=/.test(configToken)) {
+        return {
+          subcommand: null,
+          worktreeSubcommand: null,
+          resolvedCwd,
+          isSafe: false
+        };
+      }
+      index += 2;
+      continue;
+    }
+    const subcommand = token;
+    if (!SAFE_MEMORY_GIT_SUBCOMMANDS.has(subcommand)) {
+      if (resolvedCwd && SAFE_MEMORY_COMMANDS.has("git")) {
+        const rawSegment = tokens.join(" ");
+        if (subcommand === "ls-tree" && !/\s-o\b/.test(rawSegment)) {
+          return {
+            subcommand,
+            worktreeSubcommand: null,
+            resolvedCwd,
+            isSafe: true
+          };
+        }
+      }
+      return {
+        subcommand,
+        worktreeSubcommand: null,
+        resolvedCwd,
+        isSafe: false
+      };
+    }
+    const worktreeSubcommand = subcommand === "worktree" ? tokens[index + 1] ?? null : null;
+    if (subcommand === "worktree" && worktreeSubcommand && !new Set(["add", "remove", "list"]).has(worktreeSubcommand)) {
+      return {
+        subcommand,
+        worktreeSubcommand,
+        resolvedCwd,
+        isSafe: false
+      };
+    }
+    if (subcommand === "rebase" && hasUnsafeRebaseOption(tokens, index + 1)) {
+      return {
+        subcommand,
+        worktreeSubcommand,
+        resolvedCwd,
+        isSafe: false
+      };
+    }
+    return { subcommand, worktreeSubcommand, resolvedCwd, isSafe: true };
+  }
+  return {
+    subcommand: null,
+    worktreeSubcommand: null,
+    resolvedCwd,
+    isSafe: false
+  };
+}
+function tokenLooksLikePath(token) {
+  return token.includes("/") || token.includes("\\") || token === "." || token === ".." || token.startsWith("$") || token.startsWith("~") || token.startsWith("$HOME");
+}
+function validateScopedTokens(tokens, cwd2, allowedRoots, env3, shellVars) {
+  return tokens.every((token, index) => {
+    if (!tokenLooksLikePath(token)) {
+      return true;
+    }
+    const previous = index > 0 ? tokens[index - 1] : null;
+    if (previous && ["-m", "--message", "--author", "--format"].includes(previous)) {
+      return true;
+    }
+    const resolved = normalizeScopePath(token, cwd2, env3, shellVars);
+    return resolved ? isPathWithinRoots(resolved, allowedRoots) : false;
+  });
+}
+function isAllowedMemorySegment(segment, cwd2, allowedRoots, env3, shellVars) {
   const tokens = tokenize4(segment);
-  if (tokens[0] === "cd" && tokens[1]) {
-    return tokens[1];
+  if (tokens.length === 0) {
+    return { nextCwd: cwd2, safe: false };
   }
-  return null;
+  if (applyScopedAssignments(tokens, env3, shellVars)) {
+    return { nextCwd: cwd2, safe: true };
+  }
+  const command = tokens[0];
+  if (!command) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  if (command === "cd") {
+    const target = tokens[1];
+    if (!target) {
+      return { nextCwd: cwd2, safe: false };
+    }
+    const resolved = normalizeScopePath(target, cwd2, env3, shellVars);
+    return {
+      nextCwd: resolved,
+      safe: resolved ? isPathWithinRoots(resolved, allowedRoots) : false
+    };
+  }
+  if (!SAFE_MEMORY_COMMANDS.has(command)) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  if (command === "git") {
+    const parsed = parseScopedGitInvocation(tokens, cwd2, allowedRoots, env3, shellVars);
+    if (!parsed.isSafe) {
+      return { nextCwd: parsed.resolvedCwd, safe: false };
+    }
+    const effectiveCwd = parsed.resolvedCwd;
+    if (!effectiveCwd || !isPathWithinRoots(effectiveCwd, allowedRoots)) {
+      return { nextCwd: effectiveCwd, safe: false };
+    }
+    if (!validateScopedTokens(tokens, effectiveCwd, allowedRoots, env3, shellVars)) {
+      return { nextCwd: effectiveCwd, safe: false };
+    }
+    return { nextCwd: effectiveCwd, safe: true };
+  }
+  if (tokens.some((token) => tokenLooksLikePath(token))) {
+    if (!validateScopedTokens(tokens.slice(1), cwd2, allowedRoots, env3, shellVars)) {
+      return { nextCwd: cwd2, safe: false };
+    }
+    return { nextCwd: cwd2, safe: true };
+  }
+  if (!cwd2 || !isPathWithinRoots(cwd2, allowedRoots)) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  if (command === "find" && /-delete|\s-exec\b/.test(segment)) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  if (command === "sort" && /\s-o\b/.test(segment)) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  if (!validateScopedTokens(tokens.slice(1), cwd2, allowedRoots, env3, shellVars)) {
+    return { nextCwd: cwd2, safe: false };
+  }
+  return { nextCwd: cwd2, safe: true };
 }
-function isMemoryDirCommand(command, agentId) {
-  if (!command || !agentId) {
+function isScopedMemoryShellCommand(command, allowedRoots, options = {}) {
+  if (!command || allowedRoots.length === 0) {
     return false;
   }
+  if (Array.isArray(command)) {
+    if (command.length === 0) {
+      return false;
+    }
+    const [executable, ...rest] = command;
+    if (executable && isShellExecutor(executable)) {
+      const nested = extractDashCArgument(rest);
+      if (!nested) {
+        return false;
+      }
+      return isScopedMemoryShellCommand(stripQuotes(nested), allowedRoots, options);
+    }
+  }
   const commandStr = typeof command === "string" ? command : command.join(" ");
   const trimmed = commandStr.trim();
   if (!trimmed) {
     return false;
   }
-  const prefixes = getAllowedMemoryPrefixes(agentId);
-  const segments = trimmed.split(/&&|\|\||;/).map((s) => s.trim()).filter(Boolean);
+  const segments = splitShellSegments(trimmed);
+  if (!segments) {
+    return false;
+  }
   if (segments.length === 0) {
     return false;
   }
-  let cwd2 = null;
+  const env3 = options.env ?? process.env;
+  const shellVars = {};
+  const initialCwd = options.workingDirectory ? normalizeScopePath(options.workingDirectory, null, env3, shellVars) : null;
+  let cwd2 = initialCwd;
   for (const segment of segments) {
-    const pipeParts = segment.split(/\|/).map((s) => s.trim()).filter(Boolean);
-    for (const part of pipeParts) {
-      const cdTarget = extractCdTarget(part);
-      if (cdTarget) {
-        const resolved = cwd2 ? expandPath(resolve4(expandPath(cwd2), cdTarget)) : expandPath(cdTarget);
-        if (!isUnderMemoryDir(resolved, prefixes)) {
-          return false;
-        }
-        cwd2 = resolved;
-        continue;
-      }
-      if (cwd2 && isUnderMemoryDir(cwd2, prefixes)) {
-        const tokens2 = tokenize4(part);
-        const currentCwd = cwd2;
-        if (!currentCwd) {
-          return false;
-        }
-        const hasExternalPath = tokens2.some((t) => {
-          if (isAbsolutePathArg(t) || isHomeAnchoredPathArg(t)) {
-            return !isUnderMemoryDir(t, prefixes);
-          }
-          if (hasAbsoluteOrTraversalPathArg(t)) {
-            const resolved = expandPath(resolve4(expandPath(currentCwd), t));
-            return !isUnderMemoryDir(resolved, prefixes);
-          }
-          return false;
-        });
-        if (hasExternalPath) {
-          return false;
-        }
-        if (!MEMORY_DIR_APPROVE_ALL) {
-          const cmd = tokens2[0];
-          if (!cmd || !SAFE_MEMORY_DIR_COMMANDS.has(cmd)) {
-            return false;
-          }
-        }
-        continue;
-      }
-      const tokens = tokenize4(part);
-      const hasMemoryPath = tokens.some((t) => t.includes(".letta/agents/") && t.includes("/memory") || t.includes(".letta/agents/") && t.includes("/memory-worktrees"));
-      if (hasMemoryPath) {
-        const agentPaths = tokens.filter((t) => t.includes(".letta/agents/"));
-        if (agentPaths.every((p) => isUnderMemoryDir(p, prefixes))) {
-          if (!MEMORY_DIR_APPROVE_ALL) {
-            const cmd = tokens[0];
-            if (!cmd || !SAFE_MEMORY_DIR_COMMANDS.has(cmd)) {
-              return false;
-            }
-          }
-          continue;
-        }
-      }
+    const result = isAllowedMemorySegment(segment, cwd2, allowedRoots, env3, shellVars);
+    if (!result.safe) {
       return false;
     }
+    cwd2 = result.nextCwd;
   }
   return true;
 }
-var MEMORY_DIR_APPROVE_ALL = true, SAFE_MEMORY_DIR_COMMANDS, ALWAYS_SAFE_COMMANDS, EXTERNAL_PATH_METADATA_COMMANDS, SAFE_GIT_SUBCOMMANDS, SAFE_LETTA_COMMANDS, SAFE_GH_COMMANDS;
+function isMemoryDirCommand(command, agentId) {
+  if (!command || !agentId) {
+    return false;
+  }
+  return isScopedMemoryShellCommand(command, getAllowedMemoryPrefixes(agentId));
+}
+var ALWAYS_SAFE_COMMANDS, EXTERNAL_PATH_METADATA_COMMANDS, SAFE_GIT_SUBCOMMANDS, SAFE_MEMORY_GIT_SUBCOMMANDS, SAFE_MEMORY_COMMANDS, SAFE_LETTA_COMMANDS, SAFE_GH_COMMANDS;
 var init_readOnlyShell = __esm(() => {
-  SAFE_MEMORY_DIR_COMMANDS = new Set([
-    "git",
-    "rm",
-    "mv",
-    "mkdir",
-    "cp",
-    "ls",
-    "cat",
-    "head",
-    "tail",
-    "tree",
-    "find",
-    "wc",
-    "split",
-    "echo",
-    "sort",
-    "cd"
-  ]);
+  init_memoryScope();
   ALWAYS_SAFE_COMMANDS = new Set([
     "cat",
     "head",
@@ -52749,6 +53090,42 @@ var init_readOnlyShell = __esm(() => {
     "tag",
     "remote"
   ]);
+  SAFE_MEMORY_GIT_SUBCOMMANDS = new Set([
+    "add",
+    "commit",
+    "push",
+    "pull",
+    "rebase",
+    "status",
+    "diff",
+    "log",
+    "show",
+    "branch",
+    "tag",
+    "remote",
+    "rm",
+    "mv",
+    "merge",
+    "worktree"
+  ]);
+  SAFE_MEMORY_COMMANDS = new Set([
+    "git",
+    "rm",
+    "mv",
+    "mkdir",
+    "cp",
+    "ls",
+    "cat",
+    "head",
+    "tail",
+    "find",
+    "sort",
+    "echo",
+    "wc",
+    "split",
+    "cd",
+    "sleep"
+  ]);
   SAFE_LETTA_COMMANDS = {
     memfs: new Set(["status", "help", "backups", "export"]),
     agents: new Set(["list", "help"]),
@@ -52962,8 +53339,14 @@ var exports_mode = {};
 __export(exports_mode, {
   permissionMode: () => permissionMode
 });
-import { homedir as homedir12 } from "node:os";
-import { isAbsolute as isAbsolute2, join as join14, relative as relative3, resolve as resolve5 } from "node:path";
+import { homedir as homedir13 } from "node:os";
+import { isAbsolute as isAbsolute3, join as join14, relative as relative3 } from "node:path";
+function everyResolvedTargetIsWithinRoots(candidatePaths, roots, workingDirectory) {
+  return candidatePaths.length > 0 && candidatePaths.every((path4) => {
+    const resolvedPath = resolveScopedTargetPath(path4, workingDirectory);
+    return resolvedPath ? isPathWithinRoots(resolvedPath, roots) : false;
+  });
+}
 function getGlobalMode() {
   const global2 = globalThis;
   if (!global2[MODE_KEY]) {
@@ -52992,22 +53375,13 @@ function setGlobalModeBeforePlan(value) {
   global2[MODE_BEFORE_PLAN_KEY] = value;
 }
 function resolvePlanTargetPath(targetPath, workingDirectory) {
-  const trimmedPath = targetPath.trim();
-  if (!trimmedPath)
-    return null;
-  if (trimmedPath.startsWith("~/")) {
-    return resolve5(homedir12(), trimmedPath.slice(2));
-  }
-  if (isAbsolute2(trimmedPath)) {
-    return resolve5(trimmedPath);
-  }
-  return resolve5(workingDirectory, trimmedPath);
+  return resolveScopedTargetPath(targetPath, workingDirectory);
 }
 function isPathInPlansDir(path4, plansDir) {
   if (!path4.endsWith(".md"))
     return false;
   const rel = relative3(plansDir, path4);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function extractApplyPatchPaths(input) {
   const paths = [];
@@ -53194,7 +53568,7 @@ class PermissionModeManager {
           return "allow";
         }
         if (writeTools.includes(toolName)) {
-          const plansDir = join14(homedir12(), ".letta", "plans");
+          const plansDir = join14(homedir13(), ".letta", "plans");
           const targetPath = toolArgs?.file_path || toolArgs?.path;
           let candidatePaths = [];
           if ((toolName === "ApplyPatch" || toolName === "apply_patch" || toolName === "memory_apply_patch") && toolArgs?.input) {
@@ -53245,7 +53619,7 @@ class PermissionModeManager {
           }
           const planWritePath = extractPlanFileWritePathFromShellCommand(command);
           if (planWritePath) {
-            const plansDir = join14(homedir12(), ".letta", "plans");
+            const plansDir = join14(homedir13(), ".letta", "plans");
             const resolvedPath = resolvePlanTargetPath(planWritePath, workingDirectory);
             if (resolvedPath && isPathInPlansDir(resolvedPath, plansDir)) {
               return "allow";
@@ -53254,6 +53628,94 @@ class PermissionModeManager {
         }
         return "deny";
       }
+      case "memory": {
+        const allowedMemoryRoots = resolveAllowedMemoryRoots().roots;
+        const allowedReadOnlyTools = [
+          "Read",
+          "Glob",
+          "Grep",
+          "NotebookRead",
+          "ViewImage",
+          "view_image",
+          "TaskOutput",
+          "task_output",
+          "Skill",
+          "skill",
+          "read_file",
+          "list_dir",
+          "grep_files",
+          "ReadFile",
+          "ListDir",
+          "GrepFiles",
+          "read_file_gemini",
+          "glob_gemini",
+          "list_directory",
+          "search_file_content",
+          "read_many_files",
+          "ReadFileGemini",
+          "GlobGemini",
+          "ListDirectory",
+          "SearchFileContent",
+          "ReadManyFiles"
+        ];
+        const writeTools = [
+          "Write",
+          "Edit",
+          "MultiEdit",
+          "NotebookEdit",
+          "apply_patch",
+          "ApplyPatch",
+          "replace",
+          "Replace",
+          "write_file",
+          "WriteFile",
+          "write_file_gemini",
+          "WriteFileGemini"
+        ];
+        const shellTools = [
+          "Bash",
+          "shell",
+          "Shell",
+          "shell_command",
+          "ShellCommand",
+          "run_shell_command",
+          "RunShellCommand",
+          "run_shell_command_gemini",
+          "RunShellCommandGemini"
+        ];
+        if (allowedReadOnlyTools.includes(toolName)) {
+          return "allow";
+        }
+        if (toolName === "memory_apply_patch") {
+          return allowedMemoryRoots.length > 0 ? "allow" : "deny";
+        }
+        if (writeTools.includes(toolName)) {
+          const targetPath = toolArgs?.file_path || toolArgs?.path;
+          let candidatePaths = [];
+          if ((toolName === "ApplyPatch" || toolName === "apply_patch") && toolArgs?.input) {
+            candidatePaths = extractApplyPatchPaths(toolArgs.input);
+          } else if (typeof targetPath === "string") {
+            candidatePaths = [targetPath];
+          }
+          if (allowedMemoryRoots.length > 0 && everyResolvedTargetIsWithinRoots(candidatePaths, allowedMemoryRoots, workingDirectory)) {
+            return "allow";
+          }
+          return "deny";
+        }
+        if (shellTools.includes(toolName)) {
+          const command = toolArgs?.command;
+          if (command && isReadOnlyShellCommand(command, { allowExternalPaths: true })) {
+            return "allow";
+          }
+          if (command && allowedMemoryRoots.length > 0 && isScopedMemoryShellCommand(command, allowedMemoryRoots, {
+            workingDirectory
+          })) {
+            return "allow";
+          }
+          return "deny";
+        }
+        return "deny";
+      }
       case "default":
         return null;
       default:
@@ -53268,6 +53730,7 @@ class PermissionModeManager {
 }
 var MODE_KEY, PLAN_FILE_KEY, MODE_BEFORE_PLAN_KEY, permissionMode;
 var init_mode = __esm(() => {
+  init_memoryScope();
   init_readOnlyShell();
   init_shell_command_normalization();
   MODE_KEY = Symbol.for("@letta/permissionMode");
@@ -57340,8 +57803,8 @@ import {
   unlink,
   writeFile as writeFile2
 } from "node:fs/promises";
-import { homedir as homedir14 } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute8, relative as relative5, resolve as resolve12 } from "node:path";
+import { homedir as homedir15 } from "node:os";
+import { dirname as dirname7, isAbsolute as isAbsolute9, relative as relative5, resolve as resolve12 } from "node:path";
 import { promisify as promisify10 } from "node:util";
 async function getAgentIdentity() {
   const envAgentId = (process.env.AGENT_ID || process.env.LETTA_AGENT_ID || "").trim();
@@ -57390,7 +57853,7 @@ async function memory(args) {
     const rendered = renderMemoryFile({
       description
     }, body);
-    await mkdir2(dirname6(filePath), { recursive: true });
+    await mkdir2(dirname7(filePath), { recursive: true });
     await writeFile2(filePath, rendered, "utf8");
     affectedPaths = [relPath];
   } else if (command === "str_replace") {
@@ -57459,7 +57922,7 @@ async function memory(args) {
       throw new Error(`memory rename: destination already exists at ${newPathArg}`);
     }
     await loadEditableMemoryFile(oldFilePath, oldPathArg);
-    await mkdir2(dirname6(newFilePath), { recursive: true });
+    await mkdir2(dirname7(newFilePath), { recursive: true });
     await rename(oldFilePath, newFilePath);
     affectedPaths = [oldRelPath, newRelPath];
   } else if (command === "update_description") {
@@ -57507,7 +57970,7 @@ function resolveMemoryDir() {
   })();
   const agentId = contextAgentId || (process.env.AGENT_ID || process.env.LETTA_AGENT_ID || "").trim();
   if (agentId && agentId.trim().length > 0) {
-    return resolve12(homedir14(), ".letta", "agents", agentId, "memory");
+    return resolve12(homedir15(), ".letta", "agents", agentId, "memory");
   }
   throw new Error("memory: unable to resolve memory directory. Ensure MEMORY_DIR (or AGENT_ID) is available.");
 }
@@ -57528,10 +57991,10 @@ function normalizeMemoryLabel(memoryDir, inputPath, fieldName) {
     throw new Error(`memory: '${fieldName}' must be a memory-relative file path, not a home-relative filesystem path`);
   }
   const isWindowsAbsolute = /^[a-zA-Z]:[\\/]/.test(raw);
-  if (isAbsolute8(raw) || isWindowsAbsolute) {
+  if (isAbsolute9(raw) || isWindowsAbsolute) {
     const absolutePath = resolve12(raw);
     const relToMemory = relative5(memoryDir, absolutePath);
-    if (relToMemory && !relToMemory.startsWith("..") && !isAbsolute8(relToMemory)) {
+    if (relToMemory && !relToMemory.startsWith("..") && !isAbsolute9(relToMemory)) {
       return normalizeRelativeMemoryLabel(relToMemory, fieldName);
     }
     throw new Error(memoryPrefixError(memoryDir));
@@ -57577,14 +58040,14 @@ function resolveMemoryFilePath(memoryDir, label) {
 function resolveMemoryPath(memoryDir, path11) {
   const absolute = resolve12(memoryDir, path11);
   const rel = relative5(memoryDir, absolute);
-  if (rel.startsWith("..") || isAbsolute8(rel)) {
+  if (rel.startsWith("..") || isAbsolute9(rel)) {
     throw new Error("memory: resolved path escapes memory directory");
   }
   return absolute;
 }
 function toRepoRelative(memoryDir, absolutePath) {
   const rel = relative5(memoryDir, absolutePath);
-  if (!rel || rel.startsWith("..") || isAbsolute8(rel)) {
+  if (!rel || rel.startsWith("..") || isAbsolute9(rel)) {
     throw new Error("memory: path is outside memory repository");
   }
   return rel.replace(/\\/g, "/");
@@ -57755,8 +58218,8 @@ import {
   unlink as unlink2,
   writeFile as writeFile3
 } from "node:fs/promises";
-import { homedir as homedir15 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute9, relative as relative6, resolve as resolve13 } from "node:path";
+import { homedir as homedir16 } from "node:os";
+import { dirname as dirname8, isAbsolute as isAbsolute10, relative as relative6, resolve as resolve13 } from "node:path";
 import { promisify as promisify11 } from "node:util";
 async function getAgentIdentity2() {
   const envAgentId = (process.env.AGENT_ID || process.env.LETTA_AGENT_ID || "").trim();
@@ -57869,7 +58332,7 @@ async function memory_apply_patch(args) {
     }
   }
   for (const [absPath, content] of pendingWrites.entries()) {
-    await mkdir3(dirname7(absPath), { recursive: true });
+    await mkdir3(dirname8(absPath), { recursive: true });
     await writeFile3(absPath, content, "utf8");
   }
   for (const absPath of pendingDeletes) {
@@ -58043,7 +58506,7 @@ function resolveMemoryDir2() {
   })();
   const agentId = contextAgentId || (process.env.AGENT_ID || process.env.LETTA_AGENT_ID || "").trim();
   if (agentId && agentId.trim().length > 0) {
-    return resolve13(homedir15(), ".letta", "agents", agentId, "memory");
+    return resolve13(homedir16(), ".letta", "agents", agentId, "memory");
   }
   throw new Error("memory_apply_patch: unable to resolve memory directory. Ensure MEMORY_DIR (or AGENT_ID) is available.");
 }
@@ -58064,10 +58527,10 @@ function normalizeMemoryLabel2(memoryDir, inputPath, fieldName) {
     throw new Error(`memory_apply_patch: '${fieldName}' must be a memory-relative file path, not a home-relative filesystem path`);
   }
   const isWindowsAbsolute = /^[a-zA-Z]:[\\/]/.test(raw);
-  if (isAbsolute9(raw) || isWindowsAbsolute) {
+  if (isAbsolute10(raw) || isWindowsAbsolute) {
     const absolutePath = resolve13(raw);
     const relToMemory = relative6(memoryDir, absolutePath);
-    if (relToMemory && !relToMemory.startsWith("..") && !isAbsolute9(relToMemory)) {
+    if (relToMemory && !relToMemory.startsWith("..") && !isAbsolute10(relToMemory)) {
       return normalizeRelativeMemoryLabel2(relToMemory, fieldName);
     }
     throw new Error(memoryPrefixError2(memoryDir));
@@ -58109,7 +58572,7 @@ function memoryPrefixError2(memoryDir) {
 function resolveMemoryPath2(memoryDir, path11) {
   const absolute = resolve13(memoryDir, path11);
   const rel = relative6(memoryDir, absolute);
-  if (rel.startsWith("..") || isAbsolute9(rel)) {
+  if (rel.startsWith("..") || isAbsolute10(rel)) {
     throw new Error("memory_apply_patch: resolved path escapes memory directory");
   }
   return absolute;
@@ -58119,7 +58582,7 @@ function resolveMemoryFilePath2(memoryDir, label) {
 }
 function toRepoRelative2(memoryDir, absolutePath) {
   const rel = relative6(memoryDir, absolutePath);
-  if (!rel || rel.startsWith("..") || isAbsolute9(rel)) {
+  if (!rel || rel.startsWith("..") || isAbsolute10(rel)) {
     throw new Error("memory_apply_patch: path is outside memory repository");
   }
   return rel.replace(/\\/g, "/");
@@ -64948,7 +65411,7 @@ async function runProcess(context3) {
 }
 async function shell(args) {
   validateRequiredParams(args, ["command"], "shell");
-  const { command, workdir, timeout_ms, signal, onOutput } = args;
+  const { command, workdir, timeout_ms, env_overrides, signal, onOutput } = args;
   if (!Array.isArray(command) || command.length === 0) {
     throw new Error("command must be a non-empty array of strings");
   }
@@ -64959,7 +65422,10 @@ async function shell(args) {
   const context3 = {
     command,
     cwd: cwd2,
-    env: getShellEnv(),
+    env: {
+      ...getShellEnv(),
+      ...env_overrides ?? {}
+    },
     timeout,
     signal,
     onOutput
@@ -65080,6 +65546,7 @@ async function shell_command(args) {
     signal,
     onOutput
   } = args;
+  const envOverrides = getMemoryGitIdentityEnvOverrides(command, workdir);
   const launchers = buildShellLaunchers(command, { login });
   if (launchers.length === 0) {
     throw new Error("Command must be a non-empty string");
@@ -65091,6 +65558,7 @@ async function shell_command(args) {
       return await shell({
         command: launcher,
         workdir,
+        env_overrides: envOverrides,
         timeout_ms,
         justification,
         signal,
@@ -65109,7 +65577,96 @@ async function shell_command(args) {
   const reason = lastError?.message || "Shell unavailable";
   throw new Error(suffix ? `${reason} (tried: ${suffix})` : reason);
 }
+function getMemoryGitIdentityEnvOverrides(command, workdir) {
+  const agentId = getCurrentAgentIdOrEnv();
+  if (!agentId) {
+    return;
+  }
+  if (!containsGitCommitInvocation(command)) {
+    return;
+  }
+  const scopedToMemoryDir = isMemoryDirCommand(command, agentId) || (workdir ? isMemoryDirCommand(`cd ${shellQuote(workdir)} && ${command}`, agentId) : false);
+  if (!scopedToMemoryDir) {
+    return;
+  }
+  const agentName = (process.env.AGENT_NAME || "").trim() || agentId;
+  const agentEmail = `${agentId}@letta.com`;
+  return {
+    GIT_AUTHOR_NAME: agentName,
+    GIT_AUTHOR_EMAIL: agentEmail,
+    GIT_COMMITTER_NAME: agentName,
+    GIT_COMMITTER_EMAIL: agentEmail
+  };
+}
+function getCurrentAgentIdOrEnv() {
+  const envAgentId = (process.env.AGENT_ID || process.env.LETTA_AGENT_ID || "").trim();
+  if (envAgentId) {
+    return envAgentId;
+  }
+  try {
+    const agentId = getCurrentAgentId().trim();
+    if (agentId) {
+      return agentId;
+    }
+  } catch {}
+  return "";
+}
+function containsGitCommitInvocation(command) {
+  const segments = command.split(/&&|\|\||;|\|/).map((segment) => segment.trim()).filter(Boolean);
+  for (const segment of segments) {
+    const tokens = tokenizeSegment(segment);
+    if (tokens.length === 0) {
+      continue;
+    }
+    let index = 0;
+    while (index < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=.*/.test(tokens[index] ?? "")) {
+      index += 1;
+    }
+    if (tokens[index] !== "git") {
+      continue;
+    }
+    index += 1;
+    while (index < tokens.length) {
+      const token = tokens[index];
+      if (!token) {
+        index += 1;
+        continue;
+      }
+      if (token === "-c" || token === "-C") {
+        index += 2;
+        continue;
+      }
+      if (token.startsWith("-")) {
+        index += 1;
+        continue;
+      }
+      if (token === "commit") {
+        return true;
+      }
+      break;
+    }
+  }
+  return false;
+}
+function tokenizeSegment(segment) {
+  const matches = segment.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g);
+  if (!matches) {
+    return [];
+  }
+  return matches.map(stripWrappingQuotes);
+}
+function stripWrappingQuotes(token) {
+  if (token.startsWith('"') && token.endsWith('"') || token.startsWith("'") && token.endsWith("'")) {
+    return token.slice(1, -1);
+  }
+  return token;
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
 var init_ShellCommand2 = __esm(async () => {
+  init_context();
+  init_readOnlyShell();
   init_shellRunner();
   await init_Shell2();
 });
@@ -65158,10 +65715,10 @@ __export(exports_skills, {
 });
 import { existsSync as existsSync17 } from "node:fs";
 import { readdir as readdir4, readFile as readFile5, realpath as realpath2, stat as stat4 } from "node:fs/promises";
-import { dirname as dirname8, join as join19 } from "node:path";
+import { dirname as dirname9, join as join19 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function getBundledSkillsPath() {
-  const thisDir = dirname8(fileURLToPath7(import.meta.url));
+  const thisDir = dirname9(fileURLToPath7(import.meta.url));
   if (thisDir.includes("src/agent") || thisDir.includes("src\\agent")) {
     return join19(thisDir, "../skills/builtin");
   }
@@ -65363,10 +65920,21 @@ var init_skillContentRegistry = __esm(() => {
 // src/tools/impl/Skill.ts
 import { readdirSync as readdirSync7 } from "node:fs";
 import { readFile as readFile6 } from "node:fs/promises";
-import { dirname as dirname9, join as join20 } from "node:path";
+import { dirname as dirname10, join as join20 } from "node:path";
+function getMemorySkillsDirs(agentId) {
+  const dirs = new Set;
+  const memoryDir = process.env.MEMORY_DIR || process.env.LETTA_MEMORY_DIR;
+  if (memoryDir && memoryDir.trim().length > 0) {
+    dirs.add(join20(memoryDir.trim(), "skills"));
+  }
+  if (agentId) {
+    dirs.add(join20(process.env.HOME || process.env.USERPROFILE || "~", ".letta/agents", agentId, "memory", "skills"));
+  }
+  return Array.from(dirs);
+}
 function hasAdditionalFiles(skillMdPath) {
   try {
-    const skillDir = dirname9(skillMdPath);
+    const skillDir = dirname10(skillMdPath);
     const entries = readdirSync7(skillDir);
     return entries.some((e) => e.toUpperCase() !== "SKILL.MD");
   } catch {
@@ -65386,6 +65954,13 @@ async function readSkillContent(skillId, skillsDir, agentId) {
       return { content, path: agentSkillPath };
     } catch {}
   }
+  for (const memorySkillsDir of getMemorySkillsDirs(agentId)) {
+    const memorySkillPath = join20(memorySkillsDir, skillId, "SKILL.md");
+    try {
+      const content = await readFile6(memorySkillPath, "utf-8");
+      return { content, path: memorySkillPath };
+    } catch {}
+  }
   const globalSkillPath = join20(GLOBAL_SKILLS_DIR, skillId, "SKILL.md");
   try {
     const content = await readFile6(globalSkillPath, "utf-8");
@@ -65425,7 +66000,7 @@ async function skill(args) {
     const agentId = getCurrentAgentId();
     const skillsDir = await getResolvedSkillsDir();
     const { content: skillContent, path: skillPath } = await readSkillContent(skillName, skillsDir, agentId);
-    const skillDir = dirname9(skillPath);
+    const skillDir = dirname10(skillPath);
     const hasExtras = hasAdditionalFiles(skillPath);
     const processedContent = hasExtras ? skillContent.replace(/<SKILL_DIR>/g, skillDir) : skillContent;
     const dirHeader = hasExtras ? `# Skill Directory: ${skillDir}
@@ -66009,15 +66584,32 @@ async function executeSubagent(type, config, model, userPrompt, baseURL, subagen
     const inheritedApiKey = process.env.LETTA_API_KEY || settings.env?.LETTA_API_KEY;
     const inheritedBaseUrl = process.env.LETTA_BASE_URL || settings.env?.LETTA_BASE_URL;
     const subagentWorkingDirectory = resolveSubagentWorkingDirectory();
+    const inheritedMemoryRoots = resolveAllowedMemoryRoots();
+    const childEnv = {
+      ...process.env,
+      ...inheritedApiKey && { LETTA_API_KEY: inheritedApiKey },
+      ...inheritedBaseUrl && { LETTA_BASE_URL: inheritedBaseUrl },
+      LETTA_CODE_AGENT_ROLE: "subagent",
+      ...parentAgentId && { LETTA_PARENT_AGENT_ID: parentAgentId }
+    };
+    if (config.permissionMode === "memory") {
+      if (inheritedMemoryRoots.primaryRoot) {
+        childEnv.MEMORY_DIR = inheritedMemoryRoots.primaryRoot;
+        childEnv.LETTA_MEMORY_DIR = inheritedMemoryRoots.primaryRoot;
+      } else {
+        delete childEnv.MEMORY_DIR;
+        delete childEnv.LETTA_MEMORY_DIR;
+      }
+      const parentMemoryDir = process.env.MEMORY_DIR || process.env.LETTA_MEMORY_DIR;
+      if (parentMemoryDir && parentMemoryDir.trim().length > 0) {
+        childEnv.PARENT_MEMORY_DIR = parentMemoryDir;
+      } else {
+        delete childEnv.PARENT_MEMORY_DIR;
+      }
+    }
     const proc2 = spawn4(launcher.command, launcher.args, {
       cwd: subagentWorkingDirectory,
-      env: {
-        ...process.env,
-        ...inheritedApiKey && { LETTA_API_KEY: inheritedApiKey },
-        ...inheritedBaseUrl && { LETTA_BASE_URL: inheritedBaseUrl },
-        LETTA_CODE_AGENT_ROLE: "subagent",
-        ...parentAgentId && { LETTA_PARENT_AGENT_ID: parentAgentId }
-      }
+      env: childEnv
     });
     proc2.once("spawn", () => {
       updateSubagent(subagentId, { status: "running" });
@@ -66196,6 +66788,7 @@ var init_manager2 = __esm(async () => {
   init_subagentState();
   init_constants();
   init_cli();
+  init_memoryScope();
   init_mode();
   init_session();
   init_context();
@@ -69706,8 +70299,8 @@ function matchesFilePattern(query, pattern, workingDirectory, options) {
     globPattern = globPattern.slice(2);
   }
   if (globPattern.startsWith("~/")) {
-    const homedir16 = __require("node:os").homedir();
-    globPattern = globPattern.replace(/^~/, homedir16);
+    const homedir17 = __require("node:os").homedir();
+    globPattern = globPattern.replace(/^~/, homedir17);
   }
   globPattern = normalizeAbsolutePattern(globPattern, workingDirectory);
   const windowsContext = isWindowsContext(workingDirectory);
@@ -70220,7 +70813,7 @@ function getDefaultDecision(toolName, toolArgs) {
   }
   if (toolName === "Task" || toolName === "task") {
     const subagentType = typeof toolArgs?.subagent_type === "string" ? toolArgs.subagent_type : "";
-    if (READ_ONLY_SUBAGENT_TYPES.has(subagentType)) {
+    if (SAFE_AUTO_APPROVE_SUBAGENT_TYPES.has(subagentType)) {
       return "allow";
     }
     return "ask";
@@ -70251,7 +70844,7 @@ async function checkPermissionWithHooks(toolName, toolArgs, permissions, working
   }
   return result;
 }
-var WORKING_DIRECTORY_TOOLS_V2, WORKING_DIRECTORY_TOOLS_V1, READ_ONLY_SHELL_TOOLS, FILE_TOOLS_V2, FILE_TOOLS_V1, READ_ONLY_SUBAGENT_TYPES;
+var WORKING_DIRECTORY_TOOLS_V2, WORKING_DIRECTORY_TOOLS_V1, READ_ONLY_SHELL_TOOLS, FILE_TOOLS_V2, FILE_TOOLS_V1, SAFE_AUTO_APPROVE_SUBAGENT_TYPES;
 var init_checker = __esm(async () => {
   init_context();
   init_canonical();
@@ -70318,7 +70911,7 @@ var init_checker = __esm(async () => {
     "read_many_files",
     "ReadManyFiles"
   ];
-  READ_ONLY_SUBAGENT_TYPES = new Set([
+  SAFE_AUTO_APPROVE_SUBAGENT_TYPES = new Set([
     "explore",
     "Explore",
     "recall",
@@ -70336,10 +70929,10 @@ __export(exports_loader, {
   loadPermissions: () => loadPermissions,
   getUserSettingsPaths: () => getUserSettingsPaths
 });
-import { homedir as homedir16 } from "node:os";
+import { homedir as homedir17 } from "node:os";
 import { join as join21 } from "node:path";
 function getUserSettingsPaths(options = {}) {
-  const homeDir = options.homeDir || homedir16();
+  const homeDir = options.homeDir || homedir17();
   const xdgConfigHome = options.xdgConfigHome || process.env.XDG_CONFIG_HOME || join21(homeDir, ".config");
   return {
     canonical: join21(homeDir, ".letta", "settings.json"),
@@ -70461,8 +71054,8 @@ var exports_analyzer = {};
 __export(exports_analyzer, {
   analyzeApprovalContext: () => analyzeApprovalContext
 });
-import { homedir as homedir17 } from "node:os";
-import { dirname as dirname11, relative as relative8, resolve as resolve22, win32 as win322 } from "node:path";
+import { homedir as homedir18 } from "node:os";
+import { dirname as dirname12, relative as relative8, resolve as resolve22, win32 as win322 } from "node:path";
 function normalizeOsPath(path20) {
   return path20.replace(/\\/g, "/");
 }
@@ -70488,7 +71081,7 @@ function isPathWithinDirectory(path20, directory) {
   return !relativePath.startsWith("../") && relativePath !== ".." && !relativePath.startsWith("/") && !/^[a-zA-Z]:\//.test(relativePath);
 }
 function dirnameForContext(path20) {
-  return isWindowsPath(path20) ? win322.dirname(path20) : dirname11(path20);
+  return isWindowsPath(path20) ? win322.dirname(path20) : dirname12(path20);
 }
 function formatAbsoluteRulePath(path20) {
   const normalized = normalizeOsPath(path20).replace(/\/+$/, "");
@@ -70498,7 +71091,7 @@ function formatAbsoluteRulePath(path20) {
   return `//${normalized.replace(/^\/+/, "")}`;
 }
 function formatDisplayPath(path20) {
-  return normalizeOsPath(path20).replace(normalizeOsPath(homedir17()), "~");
+  return normalizeOsPath(path20).replace(normalizeOsPath(homedir18()), "~");
 }
 function analyzeApprovalContext(toolName, toolArgs, workingDirectory) {
   const canonicalTool = canonicalToolName(toolName);
@@ -70549,7 +71142,7 @@ function analyzeReadApproval(filePath, workingDir) {
     };
   }
   const relativePath = normalizeOsPath(relativePathForContext(workingDir, absolutePath));
-  const relativeDir = dirname11(relativePath);
+  const relativeDir = dirname12(relativePath);
   const pattern = relativeDir === "." || relativeDir === "" ? "**" : `${relativeDir}/**`;
   return {
     recommendedRule: `Read(${pattern})`,
@@ -70692,7 +71285,7 @@ function detectSkillScript(command, workingDir) {
     return null;
   }
   const normalizedWorkingDir = normalizePathSeparators(workingDir).replace(/\/$/, "");
-  const normalizedHomeDir = normalizePathSeparators(homedir17()).replace(/\/$/, "");
+  const normalizedHomeDir = normalizePathSeparators(homedir18()).replace(/\/$/, "");
   const detect = (source, regex2) => {
     for (const candidate of pathCandidates) {
       const match3 = candidate.match(regex2);
@@ -72224,15 +72817,15 @@ __export(exports_memoryFilesystem, {
   MEMORY_FS_AGENTS_DIR: () => MEMORY_FS_AGENTS_DIR
 });
 import { existsSync as existsSync18, mkdirSync as mkdirSync13 } from "node:fs";
-import { homedir as homedir18 } from "node:os";
+import { homedir as homedir19 } from "node:os";
 import { join as join22 } from "node:path";
-function getMemoryFilesystemRoot(agentId, homeDir = homedir18()) {
+function getMemoryFilesystemRoot(agentId, homeDir = homedir19()) {
   return join22(homeDir, MEMORY_FS_ROOT, MEMORY_FS_AGENTS_DIR, agentId, MEMORY_FS_MEMORY_DIR);
 }
-function getMemorySystemDir(agentId, homeDir = homedir18()) {
+function getMemorySystemDir(agentId, homeDir = homedir19()) {
   return join22(getMemoryFilesystemRoot(agentId, homeDir), MEMORY_SYSTEM_DIR);
 }
-function ensureMemoryFilesystemDirs(agentId, homeDir = homedir18()) {
+function ensureMemoryFilesystemDirs(agentId, homeDir = homedir19()) {
   const root = getMemoryFilesystemRoot(agentId, homeDir);
   const systemDir = getMemorySystemDir(agentId, homeDir);
   if (!existsSync18(root)) {
@@ -75298,7 +75891,7 @@ import {
   readFile as readFile7,
   writeFile as writeFile4
 } from "node:fs/promises";
-import { homedir as homedir19, tmpdir as tmpdir3 } from "node:os";
+import { homedir as homedir20, tmpdir as tmpdir3 } from "node:os";
 import { join as join25 } from "node:path";
 function buildReflectionSubagentPrompt(input) {
   const lines = [];
@@ -75492,7 +76085,7 @@ function getTranscriptRoot() {
   if (envRoot) {
     return envRoot;
   }
-  return join25(homedir19(), ".letta", DEFAULT_TRANSCRIPT_DIR);
+  return join25(homedir20(), ".letta", DEFAULT_TRANSCRIPT_DIR);
 }
 function defaultState() {
   return { auto_cursor_line: 0 };
@@ -75681,7 +76274,7 @@ import {
   unlinkSync as unlinkSync7,
   writeFileSync as writeFileSync11
 } from "node:fs";
-import { homedir as homedir20 } from "node:os";
+import { homedir as homedir21 } from "node:os";
 import { join as join26 } from "node:path";
 function truncateStr(value, maxLen) {
   if (value === null || value === undefined)
@@ -75822,7 +76415,7 @@ class ChunkLog {
 var MAX_ENTRIES = 100, CONTENT_TRUNCATE_LEN = 200, MAX_SESSION_FILES2 = 5, LOG_BASE_DIR, chunkLog;
 var init_chunkLog = __esm(() => {
   init_debug();
-  LOG_BASE_DIR = join26(homedir20(), ".letta", "logs", "chunk-logs");
+  LOG_BASE_DIR = join26(homedir21(), ".letta", "logs", "chunk-logs");
   chunkLog = new ChunkLog;
 });
 
@@ -76839,6 +77432,7 @@ var init_engine = __esm(async () => {
     default: "Normal approval flow.",
     acceptEdits: "File edits auto-approved.",
     plan: "Read-only mode. Focus on exploration and planning.",
+    memory: "Memory-scoped mode. Reads are broad; mutations are limited to allowed memory roots.",
     bypassPermissions: "All tools auto-approved. Bias toward action."
   };
   sharedReminderProviders = {
@@ -76951,10 +77545,10 @@ var init_constants2 = __esm(() => {
 // src/websocket/listener/remote-settings.ts
 import { existsSync as existsSync21, readFileSync as readFileSync12 } from "node:fs";
 import { mkdir as mkdir5, writeFile as writeFile5 } from "node:fs/promises";
-import { homedir as homedir21 } from "node:os";
+import { homedir as homedir22 } from "node:os";
 import path20 from "node:path";
 function getRemoteSettingsPath() {
-  return path20.join(homedir21(), ".letta", "remote-settings.json");
+  return path20.join(homedir22(), ".letta", "remote-settings.json");
 }
 function loadRemoteSettings() {
   if (_cache !== null) {
@@ -76998,7 +77592,7 @@ function saveRemoteSettings(updates) {
 }
 function loadLegacyCwdCache() {
   try {
-    const legacyPath = path20.join(homedir21(), ".letta", "cwd-cache.json");
+    const legacyPath = path20.join(homedir22(), ".letta", "cwd-cache.json");
     if (!existsSync21(legacyPath))
       return {};
     const raw = readFileSync12(legacyPath, "utf-8");
@@ -78673,7 +79267,7 @@ __export(exports_diff, {
   ADV_DIFF_IGNORE_WHITESPACE: () => ADV_DIFF_IGNORE_WHITESPACE,
   ADV_DIFF_CONTEXT_LINES: () => ADV_DIFF_CONTEXT_LINES
 });
-import { basename as basename2 } from "node:path";
+import { basename as basename3 } from "node:path";
 function readFileOrNull(p) {
   try {
     return __require("node:fs").readFileSync(p, "utf-8");
@@ -78697,7 +79291,7 @@ function applyAllOccurrences(content, oldStr, newStr) {
   return { ok: true, out: content.split(oldStr).join(newStr) };
 }
 function computeAdvancedDiff(input, opts) {
-  const fileName = basename2(input.filePath || "");
+  const fileName = basename3(input.filePath || "");
   const fileContent = opts?.oldStrOverride !== undefined ? opts.oldStrOverride : readFileOrNull(input.filePath);
   if (fileContent === null && input.kind !== "write") {
     return { mode: "fallback", reason: "File not readable" };
@@ -78763,7 +79357,7 @@ function computeAdvancedDiff(input, opts) {
   return { mode: "advanced", fileName, oldStr, newStr, hunks };
 }
 function parsePatchToAdvancedDiff(patchLines, filePath) {
-  const fileName = basename2(filePath);
+  const fileName = basename3(filePath);
   const hunks = [];
   let currentHunk = null;
   let oldLine = 1;
@@ -79090,7 +79684,7 @@ var init_formatArgsDisplay = __esm(async () => {
 });
 
 // src/helpers/diffPreview.ts
-import path21, { basename as basename3 } from "node:path";
+import path21, { basename as basename4 } from "node:path";
 function parseHunkLinePrefix(raw) {
   if (raw.length === 0) {
     return { type: "context", content: "" };
@@ -79196,7 +79790,7 @@ async function computeDiffPreviews(toolName, toolArgs, workingDirectory = proces
           filePath: resolvedFilePath,
           content: toolArgs.content || ""
         });
-        previews.push(toDiffPreview(result, basename3(filePath)));
+        previews.push(toDiffPreview(result, basename4(filePath)));
       }
     } else if (isFileEditTool2(toolName)) {
       const filePath = toolArgs.file_path;
@@ -79208,7 +79802,7 @@ async function computeDiffPreviews(toolName, toolArgs, workingDirectory = proces
             filePath: resolvedFilePath,
             edits: toolArgs.edits
           });
-          previews.push(toDiffPreview(result, basename3(filePath)));
+          previews.push(toDiffPreview(result, basename4(filePath)));
         } else {
           const result = computeAdvancedDiff2({
             kind: "edit",
@@ -79217,7 +79811,7 @@ async function computeDiffPreviews(toolName, toolArgs, workingDirectory = proces
             newString: toolArgs.new_string || "",
             replaceAll: toolArgs.replace_all
           });
-          previews.push(toDiffPreview(result, basename3(filePath)));
+          previews.push(toDiffPreview(result, basename4(filePath)));
         }
       }
     } else if (isPatchTool2(toolName) && toolArgs.input) {
@@ -79226,7 +79820,7 @@ async function computeDiffPreviews(toolName, toolArgs, workingDirectory = proces
         if (op.kind === "add" || op.kind === "update") {
           const result = parsePatchToAdvancedDiff2(op.patchLines, op.path);
           if (result) {
-            previews.push(toDiffPreview(result, basename3(op.path)));
+            previews.push(toDiffPreview(result, basename4(op.path)));
           }
         }
       }
@@ -79236,7 +79830,7 @@ async function computeDiffPreviews(toolName, toolArgs, workingDirectory = proces
         if (op.kind === "add" || op.kind === "update") {
           const result = parsePatchToAdvancedDiff2(op.patchLines, op.path);
           if (result) {
-            previews.push(toDiffPreview(result, basename3(op.path)));
+            previews.push(toDiffPreview(result, basename4(op.path)));
           }
         }
       }
@@ -81760,18 +82354,24 @@ function buildDeviceStatus(runtime, params) {
 function buildLoopStatus(runtime, params) {
   const listener = getListenerRuntime(runtime);
   if (!listener) {
-    return { status: "WAITING_ON_INPUT", active_run_ids: [] };
+    return {
+      status: "WAITING_ON_INPUT",
+      active_run_ids: [],
+      plan_file_path: null
+    };
   }
   const scope = getScopeForRuntime(runtime, params);
   const scopedAgentId = resolveScopedAgentId(listener, scope);
   const scopedConversationId = resolveScopedConversationId(listener, scope);
+  const conversationPermissionModeState = getConversationPermissionModeState(listener, scopedAgentId, scopedConversationId);
   const conversationRuntime = getConversationRuntime(listener, scopedAgentId, scopedConversationId);
   const interruptedCacheActive = hasInterruptedCacheForScope(listener, scope);
   const recovered = getRecoveredApprovalStateForScope(listener, scope);
   const status = interruptedCacheActive ? !conversationRuntime?.isProcessing ? "WAITING_ON_INPUT" : conversationRuntime?.loopStatus === "WAITING_ON_APPROVAL" ? "WAITING_ON_INPUT" : conversationRuntime?.loopStatus ?? "WAITING_ON_INPUT" : recovered && recovered.pendingRequestIds.size > 0 && conversationRuntime?.loopStatus === "WAITING_ON_INPUT" ? "WAITING_ON_APPROVAL" : conversationRuntime?.loopStatus ?? "WAITING_ON_INPUT";
   return {
     status,
-    active_run_ids: interruptedCacheActive && !conversationRuntime?.isProcessing ? [] : conversationRuntime?.activeRunId ? [conversationRuntime.activeRunId] : []
+    active_run_ids: interruptedCacheActive && !conversationRuntime?.isProcessing ? [] : conversationRuntime?.activeRunId ? [conversationRuntime.activeRunId] : [],
+    plan_file_path: conversationPermissionModeState.mode === "plan" ? conversationPermissionModeState.planFilePath : null
   };
 }
 function buildQueueSnapshot(runtime, params) {
@@ -83239,7 +83839,7 @@ function handleModeChange(msg, socket, runtime, scope) {
       current.modeBeforePlan = null;
     }
     persistPermissionModeMapForRuntime(runtime);
-    emitDeviceStatusUpdate(socket, runtime, scope);
+    emitRuntimeStateUpdates(runtime, scope);
     if (isDebugEnabled()) {
       console.log(`[Listen] Mode changed to: ${msg.mode}`);
     }
@@ -83601,11 +84201,11 @@ async function handleSkillCommand(parsed, socket) {
     existsSync: existsSync22,
     lstatSync: lstatSync2,
     mkdirSync: mkdirSync15,
-    rmdirSync: rmdirSync2,
+    rmdirSync,
     symlinkSync,
     unlinkSync: unlinkSync8
   } = await import("node:fs");
-  const { basename: basename4, join: join28 } = await import("node:path");
+  const { basename: basename5, join: join28 } = await import("node:path");
   const lettaHome = process.env.LETTA_HOME || join28(process.env.HOME || process.env.USERPROFILE || "~", ".letta");
   const globalSkillsDir = join28(lettaHome, "skills");
   if (parsed.type === "skill_enable") {
@@ -83629,14 +84229,14 @@ async function handleSkillCommand(parsed, socket) {
         }, "listener_skill_send_failed", "listener_skill_command");
         return true;
       }
-      const linkName = basename4(parsed.skill_path);
+      const linkName = basename5(parsed.skill_path);
       const linkPath = join28(globalSkillsDir, linkName);
       mkdirSync15(globalSkillsDir, { recursive: true });
       if (existsSync22(linkPath)) {
         const stat6 = lstatSync2(linkPath);
         if (stat6.isSymbolicLink()) {
           if (process.platform === "win32") {
-            rmdirSync2(linkPath);
+            rmdirSync(linkPath);
           } else {
             unlinkSync8(linkPath);
           }
@@ -83694,7 +84294,7 @@ async function handleSkillCommand(parsed, socket) {
         return true;
       }
       if (process.platform === "win32") {
-        rmdirSync2(linkPath);
+        rmdirSync(linkPath);
       } else {
         unlinkSync8(linkPath);
       }
@@ -85261,6 +85861,7 @@ var init_client4 = __esm(async () => {
   __listenClientTestUtils = {
     createRuntime: createLegacyTestRuntime,
     createListenerRuntime: createRuntime,
+    handleModeChange,
     getOrCreateScopedRuntime,
     buildListModelsEntries,
     buildListModelsResponse,
@@ -85349,7 +85950,7 @@ import {
   readFileSync as readFileSync14,
   unlinkSync as unlinkSync8
 } from "node:fs";
-import { homedir as homedir25 } from "node:os";
+import { homedir as homedir26 } from "node:os";
 import { join as join31 } from "node:path";
 import { format as format2 } from "node:util";
 function isDebugEnabled2() {
@@ -85455,7 +86056,7 @@ function debugWarn2(prefix, message, ...args) {
 }
 var DEBUG_LOG_DIR2, MAX_SESSION_FILES3 = 5, DEFAULT_TAIL_LINES2 = 50, debugLogFile2;
 var init_debug2 = __esm(() => {
-  DEBUG_LOG_DIR2 = join31(homedir25(), ".letta", "logs", "debug");
+  DEBUG_LOG_DIR2 = join31(homedir26(), ".letta", "logs", "debug");
   debugLogFile2 = new DebugLogFile2;
 });
 
@@ -85484,10 +86085,10 @@ __export(exports_skills2, {
 });
 import { existsSync as existsSync24 } from "node:fs";
 import { readdir as readdir7, readFile as readFile8, realpath as realpath4, stat as stat6 } from "node:fs/promises";
-import { dirname as dirname12, join as join32 } from "node:path";
+import { dirname as dirname13, join as join32 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 function getBundledSkillsPath2() {
-  const thisDir = dirname12(fileURLToPath8(import.meta.url));
+  const thisDir = dirname13(fileURLToPath8(import.meta.url));
   if (thisDir.includes("src/agent") || thisDir.includes("src\\agent")) {
     return join32(thisDir, "../skills/builtin");
   }
@@ -85683,12 +86284,12 @@ import {
   writeFileSync as fsWriteFileSync2,
   mkdirSync as mkdirSync17
 } from "node:fs";
-import { dirname as dirname13 } from "node:path";
+import { dirname as dirname14 } from "node:path";
 async function readFile9(path23) {
   return fsReadFileSync2(path23, { encoding: "utf-8" });
 }
 async function writeFile7(path23, content) {
-  const dir = dirname13(path23);
+  const dir = dirname14(path23);
   if (!existsSync25(dir)) {
     mkdirSync17(dir, { recursive: true });
   }
@@ -85733,7 +86334,7 @@ async function queryTerminalBackground(timeoutMs = 100) {
   }
   const wasRaw = process.stdin.isRaw;
   const wasFlowing = process.stdin.readableFlowing;
-  return new Promise((resolve26) => {
+  return new Promise((resolve25) => {
     let response = "";
     let resolved = false;
     const cleanup = () => {
@@ -85750,7 +86351,7 @@ async function queryTerminalBackground(timeoutMs = 100) {
     };
     const timeout = setTimeout(() => {
       cleanup();
-      resolve26(null);
+      resolve25(null);
     }, timeoutMs);
     const onData = (data) => {
       response += data.toString();
@@ -85760,7 +86361,7 @@ async function queryTerminalBackground(timeoutMs = 100) {
       if (match3) {
         clearTimeout(timeout);
         cleanup();
-        resolve26({
+        resolve25({
           r: parseHexComponent(match3[1] ?? "0"),
           g: parseHexComponent(match3[2] ?? "0"),
           b: parseHexComponent(match3[3] ?? "0")
@@ -85775,7 +86376,7 @@ async function queryTerminalBackground(timeoutMs = 100) {
     } catch {
       clearTimeout(timeout);
       cleanup();
-      resolve26(null);
+      resolve25(null);
     }
   });
 }
@@ -86984,10 +87585,10 @@ __export(exports_setup, {
   runSetup: () => runSetup
 });
 async function runSetup() {
-  return new Promise((resolve27) => {
+  return new Promise((resolve26) => {
     const { waitUntilExit } = render_default(import_react32.default.createElement(SetupUI, {
       onComplete: () => {
-        resolve27();
+        resolve26();
       }
     }));
     waitUntilExit().catch((error) => {
@@ -87517,10 +88118,10 @@ __export(exports_import, {
 });
 import { createReadStream } from "node:fs";
 import { chmod, mkdir as mkdir7, readFile as readFile10, writeFile as writeFile8 } from "node:fs/promises";
-import { dirname as dirname14, resolve as resolve27 } from "node:path";
+import { dirname as dirname15, resolve as resolve26 } from "node:path";
 async function importAgentFromFile(options) {
   const client = await getClient();
-  const resolvedPath = resolve27(options.filePath);
+  const resolvedPath = resolve26(options.filePath);
   const file = createReadStream(resolvedPath);
   const importResponse = await client.agents.importFile({
     file,
@@ -87555,7 +88156,7 @@ async function extractSkillsFromAf(afPath, destDir) {
     return [];
   }
   for (const skill2 of afData.skills) {
-    const skillDir = resolve27(destDir, skill2.name);
+    const skillDir = resolve26(destDir, skill2.name);
     await mkdir7(skillDir, { recursive: true });
     if (skill2.files) {
       await writeSkillFiles(skillDir, skill2.files);
@@ -87575,8 +88176,8 @@ async function writeSkillFiles(skillDir, files) {
   }
 }
 async function writeSkillFile(skillDir, filePath, content) {
-  const fullPath = resolve27(skillDir, filePath);
-  await mkdir7(dirname14(fullPath), { recursive: true });
+  const fullPath = resolve26(skillDir, filePath);
+  await mkdir7(dirname15(fullPath), { recursive: true });
   await writeFile8(fullPath, content, "utf-8");
   const isScript = filePath.startsWith("scripts/") || content.trimStart().startsWith("#!");
   if (isScript) {
@@ -87882,12 +88483,12 @@ async function prepareHeadlessToolExecutionContext(params) {
   };
 }
 async function flushAndExit(code) {
-  const flushWritable = (stream2) => new Promise((resolve28) => {
+  const flushWritable = (stream2) => new Promise((resolve27) => {
     if (stream2.destroyed || stream2.writableEnded) {
-      resolve28();
+      resolve27();
       return;
     }
-    stream2.write("", () => resolve28());
+    stream2.write("", () => resolve27());
   });
   await Promise.allSettled([
     flushWritable(process.stdout),
@@ -87913,7 +88514,8 @@ async function handleHeadlessCommand(parsedArgs, model, skillsDirectoryOverride,
         "default",
         "acceptEdits",
         "bypassPermissions",
-        "plan"
+        "plan",
+        "memory"
       ];
       if (validModes.includes(permissionModeValue)) {
         permissionMode3.setMode(permissionModeValue);
@@ -88834,7 +89436,7 @@ ${loadedContents.join(`
             } else {
               console.error(`Conversation is busy, waiting ${Math.round(retryDelayMs / 1000)}s and retrying...`);
             }
-            await new Promise((resolve28) => setTimeout(resolve28, retryDelayMs));
+            await new Promise((resolve27) => setTimeout(resolve27, retryDelayMs));
             continue;
           }
         }
@@ -88883,7 +89485,7 @@ ${loadedContents.join(`
             const delaySeconds = Math.round(delayMs / 1000);
             console.error(`Transient API error before streaming (attempt ${attempt} of ${LLM_API_ERROR_MAX_RETRIES2}), retrying in ${delaySeconds}s...`);
           }
-          await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+          await new Promise((resolve27) => setTimeout(resolve27, delayMs));
           conversationBusyRetries = 0;
           continue;
         }
@@ -89122,7 +89724,7 @@ ${loadedContents.join(`
             const delaySeconds = Math.round(delayMs / 1000);
             console.error(`LLM API error encountered (attempt ${attempt} of ${LLM_API_ERROR_MAX_RETRIES2}), retrying in ${delaySeconds}s...`);
           }
-          await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+          await new Promise((resolve27) => setTimeout(resolve27, delayMs));
           refreshCurrentInputOtids();
           continue;
         }
@@ -89208,7 +89810,7 @@ ${loadedContents.join(`
             } else {
               console.error(`Empty LLM response, retrying (attempt ${attempt} of ${EMPTY_RESPONSE_MAX_RETRIES2})...`);
             }
-            await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+            await new Promise((resolve27) => setTimeout(resolve27, delayMs));
             refreshCurrentInputOtids();
             continue;
           }
@@ -89236,7 +89838,7 @@ ${loadedContents.join(`
               const delaySeconds = Math.round(delayMs / 1000);
               console.error(`LLM API error encountered (attempt ${attempt} of ${LLM_API_ERROR_MAX_RETRIES2}), retrying in ${delaySeconds}s...`);
             }
-            await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+            await new Promise((resolve27) => setTimeout(resolve27, delayMs));
             refreshCurrentInputOtids();
             continue;
           }
@@ -89570,9 +90172,9 @@ async function runBidirectionalMode(agent, conversationId, client, _outputFormat
     const syntheticUserLine = serializeQueuedMessageAsUserLine(queuedMessage);
     maybeNotifyBlocked(syntheticUserLine);
     if (lineResolver) {
-      const resolve28 = lineResolver;
+      const resolve27 = lineResolver;
       lineResolver = null;
-      resolve28(syntheticUserLine);
+      resolve27(syntheticUserLine);
       return;
     }
     lineQueue.push(syntheticUserLine);
@@ -89580,9 +90182,9 @@ async function runBidirectionalMode(agent, conversationId, client, _outputFormat
   rl.on("line", (line) => {
     maybeNotifyBlocked(line);
     if (lineResolver) {
-      const resolve28 = lineResolver;
+      const resolve27 = lineResolver;
       lineResolver = null;
-      resolve28(line);
+      resolve27(line);
     } else {
       lineQueue.push(line);
     }
@@ -89591,17 +90193,17 @@ async function runBidirectionalMode(agent, conversationId, client, _outputFormat
     setMessageQueueAdder(null);
     msgQueueRuntime.clear("shutdown");
     if (lineResolver) {
-      const resolve28 = lineResolver;
+      const resolve27 = lineResolver;
       lineResolver = null;
-      resolve28(null);
+      resolve27(null);
     }
   });
   async function getNextLine() {
     if (lineQueue.length > 0) {
       return lineQueue.shift() ?? null;
     }
-    return new Promise((resolve28) => {
-      lineResolver = resolve28;
+    return new Promise((resolve27) => {
+      lineResolver = resolve27;
     });
   }
   async function requestPermission(toolCallId, toolName, toolInput) {
@@ -90105,7 +90707,7 @@ async function runBidirectionalMode(agent, conversationId, client, _outputFormat
                 uuid: `retry-bidir-${randomUUID8()}`
               };
               console.log(JSON.stringify(retryMsg));
-              await new Promise((resolve28) => setTimeout(resolve28, delayMs));
+              await new Promise((resolve27) => setTimeout(resolve27, delayMs));
               continue;
             }
             throw preStreamError;
@@ -90401,10 +91003,10 @@ async function detectAndEnableKittyProtocol() {
     detectionComplete = true;
     return;
   }
-  return new Promise((resolve28) => {
+  return new Promise((resolve27) => {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
       detectionComplete = true;
-      resolve28();
+      resolve27();
       return;
     }
     const originalRawMode = process.stdin.isRaw;
@@ -90437,7 +91039,7 @@ async function detectAndEnableKittyProtocol() {
         console.error("[kitty] protocol query unsupported; enabled anyway (best-effort)");
       }
       detectionComplete = true;
-      resolve28();
+      resolve27();
     };
     const handleData = (data) => {
       if (timeoutId === undefined) {
@@ -90795,10 +91397,10 @@ __export(exports_settings, {
   loadProjectSettings: () => loadProjectSettings,
   getSetting: () => getSetting
 });
-import { homedir as homedir28 } from "node:os";
+import { homedir as homedir29 } from "node:os";
 import { join as join36 } from "node:path";
 function getSettingsPath() {
-  return join36(homedir28(), ".letta", "settings.json");
+  return join36(homedir29(), ".letta", "settings.json");
 }
 async function loadSettings() {
   const settingsPath = getSettingsPath();
@@ -106304,16 +106906,16 @@ function clipStyledSpans(spans, maxColumns) {
   return { spans: clipped, clipped: false };
 }
 function languageFromPath(filePath) {
-  const basename4 = filePath.split("/").pop() ?? filePath;
-  const lower = basename4.toLowerCase();
+  const basename5 = filePath.split("/").pop() ?? filePath;
+  const lower = basename5.toLowerCase();
   if (lower === "makefile")
     return "makefile";
   if (lower === "dockerfile")
     return "dockerfile";
-  const dotIdx = basename4.lastIndexOf(".");
+  const dotIdx = basename5.lastIndexOf(".");
   if (dotIdx < 0)
     return;
-  const ext3 = basename4.slice(dotIdx + 1).toLowerCase();
+  const ext3 = basename5.slice(dotIdx + 1).toLowerCase();
   return EXT_TO_LANG[ext3];
 }
 function colorForClassName(className, palette) {
@@ -110349,7 +110951,7 @@ var init_plan_viewer_template = () => {};
 
 // src/web/generate-plan-viewer.ts
 import { chmodSync as chmodSync2, existsSync as existsSync28, mkdirSync as mkdirSync20, writeFileSync as writeFileSync14 } from "node:fs";
-import { homedir as homedir29 } from "node:os";
+import { homedir as homedir30 } from "node:os";
 import { join as join37 } from "node:path";
 async function generateAndOpenPlanViewer(planContent, planFilePath, options) {
   const data = {
@@ -110383,7 +110985,7 @@ async function generateAndOpenPlanViewer(planContent, planFilePath, options) {
 var VIEWERS_DIR;
 var init_generate_plan_viewer = __esm(() => {
   init_plan_viewer_template();
-  VIEWERS_DIR = join37(homedir29(), ".letta", "viewers");
+  VIEWERS_DIR = join37(homedir30(), ".letta", "viewers");
 });
 
 // src/cli/components/StaticPlanApproval.tsx
@@ -112623,7 +113225,7 @@ var init_pasteRegistry = __esm(() => {
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync29, readFileSync as readFileSync16, statSync as statSync10, unlinkSync as unlinkSync10 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { basename as basename4, extname as extname5, isAbsolute as isAbsolute18, join as join38, resolve as resolve28 } from "node:path";
+import { basename as basename5, extname as extname5, isAbsolute as isAbsolute19, join as join38, resolve as resolve27 } from "node:path";
 function countLines2(text) {
   return (text.match(/\r\n|\r|\n/g) || []).length + 1;
 }
@@ -112670,8 +113272,8 @@ function translatePasteForImages(paste) {
           }
         } catch {}
       }
-      if (!isAbsolute18(filePath))
-        filePath = resolve28(process.cwd(), filePath);
+      if (!isAbsolute19(filePath))
+        filePath = resolve27(process.cwd(), filePath);
       const ext3 = extname5(filePath || "").toLowerCase();
       if (IMAGE_EXTS.has(ext3) && existsSync29(filePath) && statSync10(filePath).isFile()) {
         const buf = readFileSync16(filePath);
@@ -112680,7 +113282,7 @@ function translatePasteForImages(paste) {
         const id = allocateImage({
           data: b64,
           mediaType: mt,
-          filename: basename4(filePath)
+          filename: basename5(filePath)
         });
         s = `[Image #${id}]`;
       }
@@ -113446,8 +114048,8 @@ import {
   readFileSync as readFileSync17,
   writeFileSync as writeFileSync15
 } from "node:fs";
-import { homedir as homedir30, platform as platform5 } from "node:os";
-import { dirname as dirname15, join as join39 } from "node:path";
+import { homedir as homedir31, platform as platform5 } from "node:os";
+import { dirname as dirname16, join as join39 } from "node:path";
 function detectTerminalType() {
   if (process.env.CURSOR_TRACE_ID || process.env.CURSOR_CHANNEL) {
     return "cursor";
@@ -113479,7 +114081,7 @@ function getKeybindingsPath(terminal) {
   }[terminal];
   const os7 = platform5();
   if (os7 === "darwin") {
-    return join39(homedir30(), "Library", "Application Support", appName, "User", "keybindings.json");
+    return join39(homedir31(), "Library", "Application Support", appName, "User", "keybindings.json");
   }
   if (os7 === "win32") {
     const appData = process.env.APPDATA;
@@ -113488,7 +114090,7 @@ function getKeybindingsPath(terminal) {
     return join39(appData, appName, "User", "keybindings.json");
   }
   if (os7 === "linux") {
-    return join39(homedir30(), ".config", appName, "User", "keybindings.json");
+    return join39(homedir31(), ".config", appName, "User", "keybindings.json");
   }
   return null;
 }
@@ -113538,7 +114140,7 @@ function installKeybinding(keybindingsPath) {
     if (keybindingExists(keybindingsPath)) {
       return { success: true, alreadyExists: true };
     }
-    const parentDir = dirname15(keybindingsPath);
+    const parentDir = dirname16(keybindingsPath);
     if (!existsSync30(parentDir)) {
       mkdirSync21(parentDir, { recursive: true });
     }
@@ -113645,10 +114247,10 @@ function getWezTermConfigPath() {
     if (existsSync30(xdgPath))
       return xdgPath;
   }
-  const configPath = join39(homedir30(), ".config", "wezterm", "wezterm.lua");
+  const configPath = join39(homedir31(), ".config", "wezterm", "wezterm.lua");
   if (existsSync30(configPath))
     return configPath;
-  return join39(homedir30(), ".wezterm.lua");
+  return join39(homedir31(), ".wezterm.lua");
 }
 function wezTermDeleteFixExists(configPath) {
   if (!existsSync30(configPath))
@@ -113697,7 +114299,7 @@ return config`);
 ${WEZTERM_DELETE_FIX}
 `;
     }
-    const parentDir = dirname15(configPath);
+    const parentDir = dirname16(configPath);
     if (!existsSync30(parentDir)) {
       mkdirSync21(parentDir, { recursive: true });
     }
@@ -114280,7 +114882,7 @@ __export(exports_custom, {
 });
 import { existsSync as existsSync31 } from "node:fs";
 import { readdir as readdir9, readFile as readFile11 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname16, join as join40 } from "node:path";
+import { basename as basename6, dirname as dirname17, join as join40 } from "node:path";
 async function getCustomCommands() {
   if (cachedCommands !== null) {
     return cachedCommands;
@@ -114340,8 +114942,8 @@ async function findCommandFiles(currentPath, rootPath, commands2, source2) {
 async function parseCommandFile(filePath, rootPath, source2) {
   const content = await readFile11(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(content);
-  const id = basename5(filePath, ".md");
-  const relativePath = dirname16(filePath).slice(rootPath.length);
+  const id = basename6(filePath, ".md");
+  const relativePath = dirname17(filePath).slice(rootPath.length);
   const namespace = relativePath.replace(/^[/\\]/, "") || undefined;
   let description = getStringField(frontmatter, "description");
   if (!description) {
@@ -114689,12 +115291,12 @@ var init_HelpDialog = __esm(async () => {
 });
 
 // src/hooks/writer.ts
-import { homedir as homedir31 } from "node:os";
-import { resolve as resolve29 } from "node:path";
+import { homedir as homedir32 } from "node:os";
+import { resolve as resolve28 } from "node:path";
 function isProjectSettingsPathCollidingWithGlobal2(workingDirectory) {
-  const home = process.env.HOME || homedir31();
-  const globalSettingsPath = resolve29(home, ".letta", "settings.json");
-  const projectSettingsPath = resolve29(workingDirectory, ".letta", "settings.json");
+  const home = process.env.HOME || homedir32();
+  const globalSettingsPath = resolve28(home, ".letta", "settings.json");
+  const projectSettingsPath = resolve28(workingDirectory, ".letta", "settings.json");
   return globalSettingsPath === projectSettingsPath;
 }
 function loadHooksFromLocation(location, workingDirectory = process.cwd()) {
@@ -117332,7 +117934,7 @@ var init_AgentInfoBar = __esm(async () => {
 
 // src/cli/helpers/fileSearch.ts
 import { readdirSync as readdirSync13, statSync as statSync11 } from "node:fs";
-import { join as join41, relative as relative15, resolve as resolve30 } from "node:path";
+import { join as join41, relative as relative15, resolve as resolve29 } from "node:path";
 function searchDirectoryRecursive(dir, pattern, maxResults = 200, results = [], depth = 0, maxDepth = 10, lowerPattern = pattern.toLowerCase()) {
   if (results.length >= maxResults || depth >= maxDepth) {
     return results;
@@ -117375,7 +117977,7 @@ async function searchFiles(query, deep = false) {
       const dirPart = query.slice(0, lastSlashIndex);
       const pattern = query.slice(lastSlashIndex + 1);
       try {
-        const resolvedDir = resolve30(getIndexRoot(), dirPart);
+        const resolvedDir = resolve29(getIndexRoot(), dirPart);
         try {
           statSync11(resolvedDir);
           searchDir = resolvedDir;
@@ -119499,11 +120101,11 @@ import {
   mkdirSync as mkdirSync22,
   mkdtempSync,
   readFileSync as readFileSync18,
-  rmSync as rmSync3,
+  rmSync as rmSync4,
   writeFileSync as writeFileSync16
 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { dirname as dirname17, join as join42 } from "node:path";
+import { dirname as dirname18, join as join42 } from "node:path";
 function runCommand(command, args, cwd2, input) {
   try {
     return execFileSync4(command, args, {
@@ -119750,8 +120352,8 @@ function runGit6(args, cwd2) {
 }
 function writeWorkflow(repoDir, workflowPath, content) {
   const absolutePath = join42(repoDir, workflowPath);
-  if (!existsSync32(dirname17(absolutePath))) {
-    mkdirSync22(dirname17(absolutePath), { recursive: true });
+  if (!existsSync32(dirname18(absolutePath))) {
+    mkdirSync22(dirname18(absolutePath), { recursive: true });
   }
   const next = `${content.trimEnd()}
 `;
@@ -119882,7 +120484,7 @@ async function installGithubApp(options) {
       agentUrl: resolvedAgentId ? buildChatUrl(resolvedAgentId) : null
     };
   } finally {
-    rmSync3(tempDir, { recursive: true, force: true });
+    rmSync4(tempDir, { recursive: true, force: true });
   }
 }
 var DEFAULT_WORKFLOW_PATH = ".github/workflows/letta.yml", ALTERNATE_WORKFLOW_PATH = ".github/workflows/letta-code.yml";
@@ -123657,7 +124259,7 @@ __export(exports_generate_memory_viewer, {
 });
 import { execFile as execFileCb5 } from "node:child_process";
 import { chmodSync as chmodSync3, existsSync as existsSync33, mkdirSync as mkdirSync23, writeFileSync as writeFileSync17 } from "node:fs";
-import { homedir as homedir32 } from "node:os";
+import { homedir as homedir33 } from "node:os";
 import { join as join43 } from "node:path";
 import { promisify as promisify14 } from "node:util";
 async function runGitSafe(cwd2, args) {
@@ -123971,7 +124573,7 @@ var init_generate_memory_viewer = __esm(async () => {
     init_memoryGit()
   ]);
   execFile14 = promisify14(execFileCb5);
-  VIEWERS_DIR2 = join43(homedir32(), ".letta", "viewers");
+  VIEWERS_DIR2 = join43(homedir33(), ".letta", "viewers");
   REFLECTION_PATTERN = /\(reflection\)|🔮|reflection:/i;
 });
 
@@ -126689,11 +127291,11 @@ var init_PersonalitySelector = __esm(async () => {
 
 // src/utils/aws-credentials.ts
 import { readFile as readFile12 } from "node:fs/promises";
-import { homedir as homedir33 } from "node:os";
+import { homedir as homedir34 } from "node:os";
 import { join as join44 } from "node:path";
 async function parseAwsCredentials() {
-  const credentialsPath = join44(homedir33(), ".aws", "credentials");
-  const configPath = join44(homedir33(), ".aws", "config");
+  const credentialsPath = join44(homedir34(), ".aws", "credentials");
+  const configPath = join44(homedir34(), ".aws", "config");
   const profiles = new Map;
   try {
     const content = await readFile12(credentialsPath, "utf-8");
@@ -132174,7 +132776,7 @@ async function executeStatusLineCommand(command, payload, options) {
   };
 }
 function runWithLauncher(launcher, inputJson, timeout, signal, workingDirectory, startTime) {
-  return new Promise((resolve31, reject) => {
+  return new Promise((resolve30, reject) => {
     const [executable, ...args] = launcher;
     if (!executable) {
       reject(new Error("Empty launcher"));
@@ -132187,7 +132789,7 @@ function runWithLauncher(launcher, inputJson, timeout, signal, workingDirectory,
     const safeResolve = (result) => {
       if (!resolved) {
         resolved = true;
-        resolve31(result);
+        resolve30(result);
       }
     };
     let child;
@@ -132633,7 +133235,7 @@ __export(exports_shellAliases, {
   clearAliasCache: () => clearAliasCache
 });
 import { existsSync as existsSync36, readFileSync as readFileSync20 } from "node:fs";
-import { homedir as homedir34 } from "node:os";
+import { homedir as homedir35 } from "node:os";
 import { join as join46 } from "node:path";
 function parseAliasesFromFile(filePath) {
   const aliases = new Map;
@@ -132703,7 +133305,7 @@ function loadAliases(forceReload = false) {
   if (aliasCache && !forceReload) {
     return aliasCache;
   }
-  const home = homedir34();
+  const home = homedir35();
   const allAliases = new Map;
   for (const file of ALIAS_FILES) {
     const filePath = join46(home, file);
@@ -133364,14 +133966,14 @@ __export(exports_export, {
   packageSkills: () => packageSkills
 });
 import { readdir as readdir10, readFile as readFile13 } from "node:fs/promises";
-import { relative as relative16, resolve as resolve31 } from "node:path";
+import { relative as relative16, resolve as resolve30 } from "node:path";
 async function packageSkills(agentId, skillsDir) {
   const skills = [];
   const skillNames = new Set;
   const dirsToCheck = skillsDir ? [skillsDir] : [
     agentId && getAgentSkillsDir(agentId),
-    resolve31(process.cwd(), ".skills"),
-    resolve31(process.env.HOME || "~", ".letta", "skills")
+    resolve30(process.cwd(), ".skills"),
+    resolve30(process.env.HOME || "~", ".letta", "skills")
   ].filter((dir) => Boolean(dir));
   for (const baseDir of dirsToCheck) {
     try {
@@ -133381,8 +133983,8 @@ async function packageSkills(agentId, skillsDir) {
           continue;
         if (skillNames.has(entry.name))
           continue;
-        const skillDir = resolve31(baseDir, entry.name);
-        const skillMdPath = resolve31(skillDir, "SKILL.md");
+        const skillDir = resolve30(baseDir, entry.name);
+        const skillMdPath = resolve30(skillDir, "SKILL.md");
         try {
           await readFile13(skillMdPath, "utf-8");
         } catch {
@@ -133412,7 +134014,7 @@ async function readSkillFiles(skillDir) {
   async function walk(dir) {
     const entries = await readdir10(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = resolve31(dir, entry.name);
+      const fullPath = resolve30(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(fullPath);
       } else {
@@ -133557,7 +134159,7 @@ __export(exports_App, {
 });
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { existsSync as existsSync37, readFileSync as readFileSync21, renameSync as renameSync3, writeFileSync as writeFileSync18 } from "node:fs";
-import { homedir as homedir35, tmpdir as tmpdir6 } from "node:os";
+import { homedir as homedir36, tmpdir as tmpdir6 } from "node:os";
 import { join as join47, relative as relative17 } from "node:path";
 function deriveReasoningEffort(modelSettings, llmConfig) {
   if (modelSettings && "provider_type" in modelSettings) {
@@ -135896,7 +136498,7 @@ ${newState.originalPrompt}`,
                   cancelled = true;
                   break;
                 }
-                await new Promise((resolve32) => setTimeout(resolve32, 100));
+                await new Promise((resolve31) => setTimeout(resolve31, 100));
               }
               buffersRef.current.byId.delete(statusId);
               buffersRef.current.order = buffersRef.current.order.filter((id) => id !== statusId);
@@ -135960,7 +136562,7 @@ ${newState.originalPrompt}`,
                 cancelled = true;
                 break;
               }
-              await new Promise((resolve32) => setTimeout(resolve32, 100));
+              await new Promise((resolve31) => setTimeout(resolve31, 100));
             }
             if (retryStatusId) {
               buffersRef.current.byId.delete(retryStatusId);
@@ -136718,7 +137320,7 @@ ${feedback}
           });
           buffersRef.current.order.push(statusId);
           refreshDerived();
-          await new Promise((resolve32) => setTimeout(resolve32, delayMs));
+          await new Promise((resolve31) => setTimeout(resolve31, delayMs));
           buffersRef.current.byId.delete(statusId);
           buffersRef.current.order = buffersRef.current.order.filter((id) => id !== statusId);
           refreshDerived();
@@ -136778,7 +137380,7 @@ ${feedback}
               cancelled = true;
               break;
             }
-            await new Promise((resolve32) => setTimeout(resolve32, 100));
+            await new Promise((resolve31) => setTimeout(resolve31, 100));
           }
           if (retryStatusId) {
             buffersRef.current.byId.delete(retryStatusId);
@@ -141721,7 +142323,7 @@ ${guidance}`);
         }
         if (mode === "bypassPermissions") {
           const planFilePath = activePlanPath ?? fallbackPlanPath;
-          const plansDir = join47(homedir35(), ".letta", "plans");
+          const plansDir = join47(homedir36(), ".letta", "plans");
           handlePlanKeepPlanning(`You must write your plan to a plan file before exiting plan mode.
 ` + (planFilePath ? `Plan file path: ${planFilePath}
 ` : "") + `Use a write tool to create your plan in ${plansDir}, then use ExitPlanMode to present the plan to the user.`);
@@ -141756,7 +142358,7 @@ ${guidance}`);
       if (!hasUsablePlan) {
         lastAutoHandledExitPlanToolCallIdRef.current = approval.toolCallId;
         const planFilePath = activePlanPath ?? fallbackPlanPath;
-        const plansDir = join47(homedir35(), ".letta", "plans");
+        const plansDir = join47(homedir36(), ".letta", "plans");
         handlePlanKeepPlanning(`You must write your plan to a plan file before exiting plan mode.
 ` + (planFilePath ? `Plan file path: ${planFilePath}
 ` : "") + `Use a write tool to create your plan in ${plansDir}, then use ExitPlanMode to present the plan to the user.`);
@@ -143168,8 +143770,8 @@ import {
   readFileSync as readFileSync22,
   writeFileSync as writeFileSync19
 } from "node:fs";
-import { homedir as homedir36, platform as platform6 } from "node:os";
-import { dirname as dirname18, join as join48 } from "node:path";
+import { homedir as homedir37, platform as platform6 } from "node:os";
+import { dirname as dirname19, join as join48 } from "node:path";
 function detectTerminalType2() {
   if (process.env.CURSOR_TRACE_ID || process.env.CURSOR_CHANNEL) {
     return "cursor";
@@ -143201,7 +143803,7 @@ function getKeybindingsPath2(terminal) {
   }[terminal];
   const os8 = platform6();
   if (os8 === "darwin") {
-    return join48(homedir36(), "Library", "Application Support", appName, "User", "keybindings.json");
+    return join48(homedir37(), "Library", "Application Support", appName, "User", "keybindings.json");
   }
   if (os8 === "win32") {
     const appData = process.env.APPDATA;
@@ -143210,7 +143812,7 @@ function getKeybindingsPath2(terminal) {
     return join48(appData, appName, "User", "keybindings.json");
   }
   if (os8 === "linux") {
-    return join48(homedir36(), ".config", appName, "User", "keybindings.json");
+    return join48(homedir37(), ".config", appName, "User", "keybindings.json");
   }
   return null;
 }
@@ -143260,7 +143862,7 @@ function installKeybinding2(keybindingsPath) {
     if (keybindingExists2(keybindingsPath)) {
       return { success: true, alreadyExists: true };
     }
-    const parentDir = dirname18(keybindingsPath);
+    const parentDir = dirname19(keybindingsPath);
     if (!existsSync38(parentDir)) {
       mkdirSync24(parentDir, { recursive: true });
     }
@@ -143367,10 +143969,10 @@ function getWezTermConfigPath2() {
     if (existsSync38(xdgPath))
       return xdgPath;
   }
-  const configPath = join48(homedir36(), ".config", "wezterm", "wezterm.lua");
+  const configPath = join48(homedir37(), ".config", "wezterm", "wezterm.lua");
   if (existsSync38(configPath))
     return configPath;
-  return join48(homedir36(), ".wezterm.lua");
+  return join48(homedir37(), ".wezterm.lua");
 }
 function wezTermDeleteFixExists2(configPath) {
   if (!existsSync38(configPath))
@@ -143419,7 +144021,7 @@ return config`);
 ${WEZTERM_DELETE_FIX2}
 `;
     }
-    const parentDir = dirname18(configPath);
+    const parentDir = dirname19(configPath);
     if (!existsSync38(parentDir)) {
       mkdirSync24(parentDir, { recursive: true });
     }
@@ -143468,10 +144070,10 @@ __export(exports_settings2, {
   loadProjectSettings: () => loadProjectSettings2,
   getSetting: () => getSetting2
 });
-import { homedir as homedir37 } from "node:os";
+import { homedir as homedir38 } from "node:os";
 import { join as join49 } from "node:path";
 function getSettingsPath2() {
-  return join49(homedir37(), ".letta", "settings.json");
+  return join49(homedir38(), ".letta", "settings.json");
 }
 async function loadSettings2() {
   const settingsPath = getSettingsPath2();
@@ -143993,10 +144595,10 @@ __export(exports_import2, {
 });
 import { createReadStream as createReadStream2 } from "node:fs";
 import { chmod as chmod2, mkdir as mkdir8, readFile as readFile14, writeFile as writeFile9 } from "node:fs/promises";
-import { dirname as dirname19, resolve as resolve32 } from "node:path";
+import { dirname as dirname20, resolve as resolve31 } from "node:path";
 async function importAgentFromFile2(options) {
   const client = await getClient();
-  const resolvedPath = resolve32(options.filePath);
+  const resolvedPath = resolve31(options.filePath);
   const file = createReadStream2(resolvedPath);
   const importResponse = await client.agents.importFile({
     file,
@@ -144031,7 +144633,7 @@ async function extractSkillsFromAf2(afPath, destDir) {
     return [];
   }
   for (const skill2 of afData.skills) {
-    const skillDir = resolve32(destDir, skill2.name);
+    const skillDir = resolve31(destDir, skill2.name);
     await mkdir8(skillDir, { recursive: true });
     if (skill2.files) {
       await writeSkillFiles2(skillDir, skill2.files);
@@ -144051,8 +144653,8 @@ async function writeSkillFiles2(skillDir, files) {
   }
 }
 async function writeSkillFile2(skillDir, filePath, content) {
-  const fullPath = resolve32(skillDir, filePath);
-  await mkdir8(dirname19(fullPath), { recursive: true });
+  const fullPath = resolve31(skillDir, filePath);
+  await mkdir8(dirname20(fullPath), { recursive: true });
   await writeFile9(fullPath, content, "utf-8");
   const isScript = filePath.startsWith("scripts/") || content.trimStart().startsWith("#!");
   if (isScript) {
@@ -144162,15 +144764,15 @@ __export(exports_memoryFilesystem2, {
   MEMORY_FS_AGENTS_DIR: () => MEMORY_FS_AGENTS_DIR2
 });
 import { existsSync as existsSync39, mkdirSync as mkdirSync25 } from "node:fs";
-import { homedir as homedir38 } from "node:os";
+import { homedir as homedir39 } from "node:os";
 import { join as join50 } from "node:path";
-function getMemoryFilesystemRoot2(agentId, homeDir = homedir38()) {
+function getMemoryFilesystemRoot2(agentId, homeDir = homedir39()) {
   return join50(homeDir, MEMORY_FS_ROOT2, MEMORY_FS_AGENTS_DIR2, agentId, MEMORY_FS_MEMORY_DIR2);
 }
-function getMemorySystemDir2(agentId, homeDir = homedir38()) {
+function getMemorySystemDir2(agentId, homeDir = homedir39()) {
   return join50(getMemoryFilesystemRoot2(agentId, homeDir), MEMORY_SYSTEM_DIR2);
 }
-function ensureMemoryFilesystemDirs2(agentId, homeDir = homedir38()) {
+function ensureMemoryFilesystemDirs2(agentId, homeDir = homedir39()) {
   const root = getMemoryFilesystemRoot2(agentId, homeDir);
   const systemDir = getMemorySystemDir2(agentId, homeDir);
   if (!existsSync39(root)) {
@@ -148814,9 +149416,9 @@ async function runListenSubcommand(argv) {
 
 // src/cli/subcommands/memfs.ts
 await init_memoryGit();
-import { cpSync, existsSync as existsSync22, mkdirSync as mkdirSync15, rmSync as rmSync2, statSync as statSync8 } from "node:fs";
+import { cpSync, existsSync as existsSync22, mkdirSync as mkdirSync15, rmSync as rmSync3, statSync as statSync8 } from "node:fs";
 import { readdir as readdir6 } from "node:fs/promises";
-import { homedir as homedir22 } from "node:os";
+import { homedir as homedir23 } from "node:os";
 import { join as join28 } from "node:path";
 import { parseArgs as parseArgs7 } from "node:util";
 function printUsage4() {
@@ -148862,10 +149464,10 @@ function parseMemfsArgs(argv) {
   });
 }
 function getMemoryRoot(agentId) {
-  return join28(homedir22(), ".letta", "agents", agentId, "memory");
+  return join28(homedir23(), ".letta", "agents", agentId, "memory");
 }
 function getAgentRoot(agentId) {
-  return join28(homedir22(), ".letta", "agents", agentId);
+  return join28(homedir23(), ".letta", "agents", agentId);
 }
 function formatBackupTimestamp(date = new Date) {
   const pad = (value) => String(value).padStart(2, "0");
@@ -149007,7 +149609,7 @@ async function runMemfsSubcommand(argv) {
         return 1;
       }
       const root = getMemoryRoot(agentId);
-      rmSync2(root, { recursive: true, force: true });
+      rmSync3(root, { recursive: true, force: true });
       cpSync(backupPath, root, { recursive: true });
       console.log(JSON.stringify({ restoredFrom: backupPath }, null, 2));
       return 0;
@@ -149414,13 +150016,20 @@ async function runSubcommand(argv) {
 }
 
 // src/permissions/mode.ts
+init_memoryScope();
 init_readOnlyShell();
 init_shell_command_normalization();
-import { homedir as homedir23 } from "node:os";
-import { isAbsolute as isAbsolute16, join as join29, relative as relative12, resolve as resolve24 } from "node:path";
+import { homedir as homedir24 } from "node:os";
+import { isAbsolute as isAbsolute17, join as join29, relative as relative12 } from "node:path";
 var MODE_KEY2 = Symbol.for("@letta/permissionMode");
 var PLAN_FILE_KEY2 = Symbol.for("@letta/planFilePath");
 var MODE_BEFORE_PLAN_KEY2 = Symbol.for("@letta/permissionModeBeforePlan");
+function everyResolvedTargetIsWithinRoots2(candidatePaths, roots, workingDirectory) {
+  return candidatePaths.length > 0 && candidatePaths.every((path23) => {
+    const resolvedPath = resolveScopedTargetPath(path23, workingDirectory);
+    return resolvedPath ? isPathWithinRoots(resolvedPath, roots) : false;
+  });
+}
 function getGlobalMode2() {
   const global2 = globalThis;
   if (!global2[MODE_KEY2]) {
@@ -149449,22 +150058,13 @@ function setGlobalModeBeforePlan2(value) {
   global2[MODE_BEFORE_PLAN_KEY2] = value;
 }
 function resolvePlanTargetPath2(targetPath, workingDirectory) {
-  const trimmedPath = targetPath.trim();
-  if (!trimmedPath)
-    return null;
-  if (trimmedPath.startsWith("~/")) {
-    return resolve24(homedir23(), trimmedPath.slice(2));
-  }
-  if (isAbsolute16(trimmedPath)) {
-    return resolve24(trimmedPath);
-  }
-  return resolve24(workingDirectory, trimmedPath);
+  return resolveScopedTargetPath(targetPath, workingDirectory);
 }
 function isPathInPlansDir2(path23, plansDir) {
   if (!path23.endsWith(".md"))
     return false;
   const rel = relative12(plansDir, path23);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute16(rel);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute17(rel);
 }
 function extractApplyPatchPaths2(input) {
   const paths = [];
@@ -149651,7 +150251,7 @@ class PermissionModeManager2 {
           return "allow";
         }
         if (writeTools.includes(toolName)) {
-          const plansDir = join29(homedir23(), ".letta", "plans");
+          const plansDir = join29(homedir24(), ".letta", "plans");
           const targetPath = toolArgs?.file_path || toolArgs?.path;
           let candidatePaths = [];
           if ((toolName === "ApplyPatch" || toolName === "apply_patch" || toolName === "memory_apply_patch") && toolArgs?.input) {
@@ -149702,7 +150302,7 @@ class PermissionModeManager2 {
           }
           const planWritePath = extractPlanFileWritePathFromShellCommand2(command);
           if (planWritePath) {
-            const plansDir = join29(homedir23(), ".letta", "plans");
+            const plansDir = join29(homedir24(), ".letta", "plans");
             const resolvedPath = resolvePlanTargetPath2(planWritePath, workingDirectory);
             if (resolvedPath && isPathInPlansDir2(resolvedPath, plansDir)) {
               return "allow";
@@ -149711,6 +150311,94 @@ class PermissionModeManager2 {
         }
         return "deny";
       }
+      case "memory": {
+        const allowedMemoryRoots = resolveAllowedMemoryRoots().roots;
+        const allowedReadOnlyTools = [
+          "Read",
+          "Glob",
+          "Grep",
+          "NotebookRead",
+          "ViewImage",
+          "view_image",
+          "TaskOutput",
+          "task_output",
+          "Skill",
+          "skill",
+          "read_file",
+          "list_dir",
+          "grep_files",
+          "ReadFile",
+          "ListDir",
+          "GrepFiles",
+          "read_file_gemini",
+          "glob_gemini",
+          "list_directory",
+          "search_file_content",
+          "read_many_files",
+          "ReadFileGemini",
+          "GlobGemini",
+          "ListDirectory",
+          "SearchFileContent",
+          "ReadManyFiles"
+        ];
+        const writeTools = [
+          "Write",
+          "Edit",
+          "MultiEdit",
+          "NotebookEdit",
+          "apply_patch",
+          "ApplyPatch",
+          "replace",
+          "Replace",
+          "write_file",
+          "WriteFile",
+          "write_file_gemini",
+          "WriteFileGemini"
+        ];
+        const shellTools = [
+          "Bash",
+          "shell",
+          "Shell",
+          "shell_command",
+          "ShellCommand",
+          "run_shell_command",
+          "RunShellCommand",
+          "run_shell_command_gemini",
+          "RunShellCommandGemini"
+        ];
+        if (allowedReadOnlyTools.includes(toolName)) {
+          return "allow";
+        }
+        if (toolName === "memory_apply_patch") {
+          return allowedMemoryRoots.length > 0 ? "allow" : "deny";
+        }
+        if (writeTools.includes(toolName)) {
+          const targetPath = toolArgs?.file_path || toolArgs?.path;
+          let candidatePaths = [];
+          if ((toolName === "ApplyPatch" || toolName === "apply_patch") && toolArgs?.input) {
+            candidatePaths = extractApplyPatchPaths2(toolArgs.input);
+          } else if (typeof targetPath === "string") {
+            candidatePaths = [targetPath];
+          }
+          if (allowedMemoryRoots.length > 0 && everyResolvedTargetIsWithinRoots2(candidatePaths, allowedMemoryRoots, workingDirectory)) {
+            return "allow";
+          }
+          return "deny";
+        }
+        if (shellTools.includes(toolName)) {
+          const command = toolArgs?.command;
+          if (command && isReadOnlyShellCommand(command, { allowExternalPaths: true })) {
+            return "allow";
+          }
+          if (command && allowedMemoryRoots.length > 0 && isScopedMemoryShellCommand(command, allowedMemoryRoots, {
+            workingDirectory
+          })) {
+            return "allow";
+          }
+          return "deny";
+        }
+        return "deny";
+      }
       case "default":
         return null;
       default:
@@ -149733,8 +150421,8 @@ await __promiseAll([
   init_secrets()
 ]);
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { homedir as homedir24 } from "node:os";
-import { join as join30, resolve as resolve25 } from "node:path";
+import { homedir as homedir25 } from "node:os";
+import { join as join30, resolve as resolve24 } from "node:path";
 var DEFAULT_SETTINGS3 = {
   lastAgent: null,
   tokenStreaming: false,
@@ -150120,7 +150808,7 @@ class SettingsManager2 {
     if (!this.settings)
       return;
     const settingsPath = this.getSettingsPath();
-    const home = process.env.HOME || homedir24();
+    const home = process.env.HOME || homedir25();
     const dirPath = join30(home, ".letta");
     try {
       if (!exists(dirPath)) {
@@ -150181,14 +150869,14 @@ class SettingsManager2 {
     }
   }
   getSettingsPath() {
-    const home = process.env.HOME || homedir24();
+    const home = process.env.HOME || homedir25();
     return join30(home, ".letta", "settings.json");
   }
   getProjectSettingsPath(workingDirectory) {
     return join30(workingDirectory, ".letta", "settings.json");
   }
   isProjectSettingsPathCollidingWithGlobal(workingDirectory) {
-    return resolve25(this.getProjectSettingsPath(workingDirectory)) === resolve25(this.getSettingsPath());
+    return resolve24(this.getProjectSettingsPath(workingDirectory)) === resolve24(this.getSettingsPath());
   }
   getLocalProjectSettingsPath(workingDirectory) {
     return join30(workingDirectory, ".letta", "settings.local.json");
@@ -151150,8 +151838,8 @@ function acquireSwitchLock2() {
   const lock = getSwitchLock2();
   lock.refCount++;
   if (lock.refCount === 1) {
-    lock.promise = new Promise((resolve26) => {
-      lock.resolve = resolve26;
+    lock.promise = new Promise((resolve25) => {
+      lock.resolve = resolve25;
     });
   }
 }
@@ -151636,7 +152324,7 @@ Note: Flags should use double dashes for full names (e.g., --yolo, not -yolo)`);
     printHelp();
     const helpDelayMs = Number.parseInt(process.env.LETTA_TEST_HELP_EXIT_DELAY_MS ?? "", 10);
     if (Number.isFinite(helpDelayMs) && helpDelayMs > 0) {
-      await new Promise((resolve33) => setTimeout(resolve33, helpDelayMs));
+      await new Promise((resolve32) => setTimeout(resolve32, helpDelayMs));
     }
     process.exit(0);
   }
@@ -151858,9 +152546,9 @@ Note: Flags should use double dashes for full names (e.g., --yolo, not -yolo)`);
         process.exit(1);
       }
     } else {
-      const { resolve: resolve33 } = await import("path");
+      const { resolve: resolve32 } = await import("path");
       const { existsSync: existsSync40 } = await import("fs");
-      const resolvedPath = resolve33(fromAfFile);
+      const resolvedPath = resolve32(fromAfFile);
       if (!existsSync40(resolvedPath)) {
         console.error(`Error: AgentFile not found: ${resolvedPath}`);
         process.exit(1);
@@ -151971,6 +152659,7 @@ Error: ${message}`);
         "default",
         "acceptEdits",
         "plan",
+        "memory",
         "bypassPermissions"
       ];
       if (validModes.includes(mode)) {
@@ -152735,4 +153424,4 @@ Error during initialization: ${message}`);
 }
 main();
 
-//# debugId=AA1793542E1A081B64756E2164756E21
+//# debugId=9A1A4B9B002D45C364756E2164756E21