@letta-ai/letta-code 0.27.3 → 0.27.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@letta-ai/letta-code",
-  "version": "0.27.3",
+  "version": "0.27.4",
   "description": "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
   "type": "module",
   "packageManager": "bun@1.3.0",

package/skills/creating-extensions/references/events.md

@@ -126,7 +126,21 @@ letta.events.on("tool_start", (event) => {
 
 Handlers run in registration order. Later handlers see the current args after earlier mutations/returns. If a handler throws, its partial `event.args` mutation is rolled back and the error is recorded as an extension diagnostic.
 
-`tool_start` is intentionally a trusted local extension point: it can rewrite commands, file paths, and other tool inputs before execution. Keep transforms focused and unsurprising. It does not support blocking; use existing hooks for blocking safety decisions.
+`tool_start` is intentionally a trusted local extension point: it can rewrite commands, file paths, and other tool inputs before execution. Keep transforms focused and unsurprising.
+
+### Denying tool execution
+
+Handlers can deny a tool by returning `{ deny: true, reason?: "..." }`. All handlers still run (for side effects like logging or state updates), but if any handler denies, the tool is blocked. The first denial reason is shown to the model as the tool error message.
+
+```ts
+letta.events.on("tool_start", (event) => {
+  if (event.toolName === "Bash" && String(event.args.command).includes("rm -rf")) {
+    return { deny: true, reason: "Destructive command blocked." };
+  }
+});
+```
+
+Denial runs before `PreToolUse` hooks. If an extension denies a tool, hooks are not invoked for that tool call.
 
 `turn_start` fires before outbound turns that include a user message. In the TUI this includes normal submits and prompt-style command turns. In headless it includes one-shot prompts and bidirectional user turns.