@letta-ai/letta-code 0.27.7 → 0.27.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@letta-ai/letta-code",
-  "version": "0.27.7",
+  "version": "0.27.9",
   "description": "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
   "type": "module",
   "packageManager": "bun@1.3.0",
@@ -14,11 +14,20 @@
     "scripts",
     "skills",
     "vendor",
+    "dist/app-server-client.js",
+    "dist/app-server-client.js.map",
     "dist/types",
     "docs"
   ],
   "exports": {
     ".": "./letta.js",
+    "./app-server-protocol": {
+      "types": "./dist/types/app-server-protocol.d.ts"
+    },
+    "./app-server-client": {
+      "types": "./dist/types/app-server-client.d.ts",
+      "import": "./dist/app-server-client.js"
+    },
     "./protocol": {
       "types": "./dist/types/protocol.d.ts"
     }
@@ -35,8 +44,8 @@
     "access": "public"
   },
   "dependencies": {
+    "@earendil-works/pi-ai": "^0.79.1",
     "@letta-ai/letta-client": "^1.10.2",
-    "@earendil-works/pi-ai": "^0.78.1",
     "@pierre/diffs": "1.2.2",
     "glob": "^13.0.0",
     "ink-link": "^5.0.0",
@@ -81,6 +90,7 @@
     "check:filename-casing": "node scripts/check-filename-casing.js",
     "check:test-mock-isolation": "bun run scripts/check-test-mock-isolation.js",
     "check:test-coverage": "node scripts/check-test-coverage.cjs",
+    "check:bundled-skill-scripts": "node scripts/check-bundled-skill-scripts.js",
     "check": "bun run scripts/check.js",
     "dev": "LETTA_DEBUG=${LETTA_DEBUG:-1} LETTA_RESPONSES_WS=${LETTA_RESPONSES_WS:-1} bun --loader=.md:text --loader=.mdx:text --loader=.txt:text run src/index.ts",
     "build": "node scripts/postinstall-patches.js && bun run build.js",

package/scripts/check-bundled-skill-scripts.js

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+
+/**
+ * Enforces that bundled skill scripts are self-contained.
+ *
+ * Built-in skills are shipped as standalone resources, including inside app
+ * bundles where they can live below node_modules/. A script that imports a bare
+ * package specifier can fail there because Bun disables auto-install when any
+ * node_modules directory exists up the tree. Keep bundled scripts limited to
+ * relative imports and runtime built-ins, or invoke lazy resolvers explicitly
+ * from SKILL.md (npx/uvx/uv run/etc.) instead of relying on a manifest install.
+ */
+
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { builtinModules } from "node:module";
+import { join } from "node:path";
+
+const rootDir = process.cwd();
+const builtinSkillDir = join(rootDir, "src", "skills", "builtin");
+
+const scriptExtensions = new Set([
+  ".cjs",
+  ".cts",
+  ".js",
+  ".mjs",
+  ".mts",
+  ".ts",
+]);
+const forbiddenManifestNames = new Set([
+  "bun.lock",
+  "bun.lockb",
+  "package-lock.json",
+  "package.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+]);
+
+const builtinNames = new Set(
+  builtinModules.flatMap((name) => {
+    const bare = name.startsWith("node:") ? name.slice("node:".length) : name;
+    return [bare, `node:${bare}`];
+  }),
+);
+
+function walk(dir) {
+  if (!existsSync(dir)) return [];
+
+  const files = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...walk(fullPath));
+    } else {
+      files.push(fullPath);
+    }
+  }
+  return files;
+}
+
+function toRepoPath(file) {
+  return file.slice(rootDir.length + 1).replace(/\\/g, "/");
+}
+
+function extensionOf(file) {
+  const basename = file.split(/[\\/]/).pop() ?? file;
+  if (basename.endsWith(".d.ts")) return ".d.ts";
+  const dotIndex = basename.lastIndexOf(".");
+  return dotIndex === -1 ? "" : basename.slice(dotIndex);
+}
+
+function isScriptFile(file) {
+  return scriptExtensions.has(extensionOf(file));
+}
+
+function isRuntimeBuiltin(specifier) {
+  if (specifier.startsWith("node:")) return true;
+  return (
+    builtinNames.has(specifier) || builtinNames.has(specifier.split("/")[0])
+  );
+}
+
+function isAllowedScriptImport(specifier) {
+  return (
+    specifier.startsWith(".") ||
+    specifier.startsWith("/") ||
+    isRuntimeBuiltin(specifier)
+  );
+}
+
+function lineNumberForIndex(content, index) {
+  let line = 1;
+  for (let i = 0; i < index; i++) {
+    if (content.charCodeAt(i) === 10) line++;
+  }
+  return line;
+}
+
+function collectImportViolations(file) {
+  const content = readFileSync(file, "utf8");
+  const patterns = [
+    /\bimport\s+(?:type\s+)?[\s\S]*?\s+from\s+["']([^"']+)["']/g,
+    /\bimport\s+["']([^"']+)["']/g,
+    /\bimport\s*\(\s*["']([^"']+)["']\s*\)/g,
+    /\brequire\s*\(\s*["']([^"']+)["']\s*\)/g,
+    /\bexport\s+(?:type\s+)?[\s\S]*?\s+from\s+["']([^"']+)["']/g,
+  ];
+
+  const violations = [];
+  for (const pattern of patterns) {
+    for (const match of content.matchAll(pattern)) {
+      const specifier = match[1];
+      if (!specifier || isAllowedScriptImport(specifier)) {
+        continue;
+      }
+      violations.push({
+        line: lineNumberForIndex(content, match.index ?? 0),
+        specifier,
+      });
+    }
+  }
+
+  return violations;
+}
+
+const allFiles = walk(builtinSkillDir);
+const scriptFiles = allFiles.filter(
+  (file) => toRepoPath(file).includes("/scripts/") && isScriptFile(file),
+);
+const forbiddenManifests = allFiles.filter((file) => {
+  const repoPath = toRepoPath(file);
+  const filename = repoPath.split("/").pop();
+  return repoPath.includes("/scripts/") && forbiddenManifestNames.has(filename);
+});
+
+let violations = 0;
+
+for (const file of scriptFiles.sort()) {
+  for (const violation of collectImportViolations(file)) {
+    if (violations === 0) {
+      console.error("\n❌ Bundled skill script dependency violations found:\n");
+    }
+    console.error(`${toRepoPath(file)}:${violation.line}`);
+    console.error(`  imports '${violation.specifier}'`);
+    console.error(
+      "  ↳ Bundled skill scripts must be self-contained: use relative files, Node/Bun built-ins, or document an explicit lazy resolver command.\n",
+    );
+    violations++;
+  }
+}
+
+for (const file of forbiddenManifests.sort()) {
+  if (violations === 0) {
+    console.error("\n❌ Bundled skill script dependency violations found:\n");
+  }
+  console.error(toRepoPath(file));
+  console.error(
+    "  ↳ Do not rely on package manager manifests inside bundled skill scripts; scripts should run without a separate install step.\n",
+  );
+  violations++;
+}
+
+if (violations > 0) {
+  console.error(
+    `Found ${violations} bundled skill script dependency violation${violations === 1 ? "" : "s"}.`,
+  );
+  process.exit(1);
+}
+
+console.log("✅ Bundled skill scripts are self-contained.");

package/scripts/check-test-coverage.cjs

@@ -73,9 +73,9 @@ const ciDirs = [
   "src/cli",
   "src/cron",
   "src/experiments",
-  "src/extensions",
   "src/hooks",
   "src/lsp",
+  "src/mods",
   "src/permissions",
   "src/providers",
   "src/queue",

package/scripts/check.js

@@ -19,6 +19,7 @@ const checks = [
   { name: "filename casing", script: ["check:filename-casing"] },
   { name: "test mock isolation", script: ["check:test-mock-isolation"] },
   { name: "test coverage", script: ["check:test-coverage"] },
+  { name: "bundled skill scripts", script: ["check:bundled-skill-scripts"] },
   { name: "biome", script: ["lint"] },
   { name: "typescript", script: ["typecheck"] },
 ];

package/scripts/run-unit-tests.cjs

@@ -13,9 +13,9 @@ const dirs = [
   "src/cli",
   "src/cron",
   "src/experiments",
-  "src/extensions",
   "src/hooks",
   "src/lsp",
+  "src/mods",
   "src/permissions",
   "src/providers",
   "src/queue",

package/skills/converting-mcps-to-skills/SKILL.md

@@ -34,10 +34,6 @@ Where `<SKILL_DIR>` is the Skill Directory shown when the skill was loaded (visi
 
 **For stdio servers:**
 ```bash
-# First, install dependencies (one time)
-cd <SKILL_DIR>/scripts && npm install
-
-# Then connect
 npx tsx <SKILL_DIR>/scripts/mcp-stdio.ts "<command>" list-tools
 
 # Examples
@@ -110,12 +106,9 @@ npx tsx mcp-http.ts http://localhost:3001/mcp call vault '{"action":"search","qu
 
 ### mcp-stdio.ts - stdio Transport
 
-Connects to MCP servers that run as subprocesses. Requires npm install first.
+Connects to MCP servers that run as subprocesses. No dependencies required.
 
 ```bash
-# One-time setup
-cd <SKILL_DIR>/scripts && npm install
-
 npx tsx mcp-stdio.ts "<command>" [options] <action> [args]
 
 Actions:
@@ -163,10 +156,6 @@ Here are some well-known MCP servers:
 - Add `--header "Authorization: Bearer YOUR_KEY"` for HTTP
 - Or `--env "API_KEY=xxx"` for stdio servers that need env vars
 
-**stdio "npm install" error:**
-- Run `cd <SKILL_DIR>/scripts && npm install` first
-- The stdio client requires the MCP SDK
-
 **Tool call fails:**
 - Use `info <tool>` to see the expected input schema
 - Ensure JSON arguments match the schema

package/skills/converting-mcps-to-skills/scripts/mcp-stdio.ts

@@ -2,9 +2,6 @@
 /**
  * MCP stdio Client - Connect to any MCP server over stdio
  *
- * NOTE: Requires npm install in this directory first:
- *   cd <this-directory> && npm install
- *
  * Usage:
  *   npx tsx mcp-stdio.ts "<command>" <action> [args]
  *
@@ -25,8 +22,31 @@
  *   npx tsx mcp-stdio.ts "node server.js" --env "API_KEY=xxx" list-tools
  */
 
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { type ChildProcessWithoutNullStreams, spawn } from "node:child_process";
+
+interface JsonRpcRequest {
+  jsonrpc: "2.0";
+  method: string;
+  params?: object;
+  id: number;
+}
+
+interface JsonRpcNotification {
+  jsonrpc: "2.0";
+  method: string;
+  params?: object;
+}
+
+interface JsonRpcResponse {
+  jsonrpc: "2.0";
+  result?: unknown;
+  error?: {
+    code: number;
+    message: string;
+    data?: unknown;
+  };
+  id: number;
+}
 
 interface ParsedArgs {
   serverCommand: string;
@@ -81,7 +101,7 @@ function parseArgs(): ParsedArgs {
 }
 
 function parseCommand(commandStr: string): { command: string; args: string[] } {
-  // Simple parsing - split on spaces, respecting quotes
+  // Simple parsing - split on spaces, respecting quotes.
   const parts: string[] = [];
   let current = "";
   let inQuote = false;
@@ -113,21 +133,79 @@ function parseCommand(commandStr: string): { command: string; args: string[] } {
   };
 }
 
-let client: Client | null = null;
-let transport: StdioClientTransport | null = null;
+let serverProcess: ChildProcessWithoutNullStreams | null = null;
+let stdoutBuffer = "";
+let nextRequestId = 1;
+const pendingRequests = new Map<
+  number,
+  {
+    resolve: (response: JsonRpcResponse) => void;
+    reject: (error: Error) => void;
+  }
+>();
+
+function handleStdout(chunk: Buffer): void {
+  stdoutBuffer += chunk.toString("utf8");
+
+  while (true) {
+    const newlineIndex = stdoutBuffer.indexOf("\n");
+    if (newlineIndex === -1) {
+      return;
+    }
+
+    const line = stdoutBuffer.slice(0, newlineIndex).trim();
+    stdoutBuffer = stdoutBuffer.slice(newlineIndex + 1);
+
+    if (!line) {
+      continue;
+    }
+
+    let message: unknown;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      process.stderr.write(`[server stdout] ${line}\n`);
+      continue;
+    }
+
+    if (
+      typeof message !== "object" ||
+      message === null ||
+      !("id" in message) ||
+      typeof message.id !== "number"
+    ) {
+      continue;
+    }
+
+    const pending = pendingRequests.get(message.id);
+    if (!pending) {
+      continue;
+    }
+
+    pendingRequests.delete(message.id);
+    pending.resolve(message as JsonRpcResponse);
+  }
+}
+
+function rejectPendingRequests(error: Error): void {
+  for (const pending of pendingRequests.values()) {
+    pending.reject(error);
+  }
+  pendingRequests.clear();
+}
 
 async function connect(
   serverCommand: string,
   env: Record<string, string>,
   cwd?: string,
-): Promise<Client> {
+): Promise<void> {
   const { command, args } = parseCommand(serverCommand);
 
   if (!command) {
     throw new Error("No command specified");
   }
 
-  // Merge with process.env
+  // Merge with process.env.
   const mergedEnv: Record<string, string> = {};
   for (const [key, value] of Object.entries(process.env)) {
     if (value !== undefined) {
@@ -136,47 +214,86 @@ async function connect(
   }
   Object.assign(mergedEnv, env);
 
-  transport = new StdioClientTransport({
-    command,
-    args,
-    env: mergedEnv,
+  serverProcess = spawn(command, args, {
     cwd,
-    stderr: "pipe",
+    env: mergedEnv,
+    stdio: ["pipe", "pipe", "pipe"],
   });
 
-  // Forward stderr for debugging
-  if (transport.stderr) {
-    transport.stderr.on("data", (chunk: Buffer) => {
-      process.stderr.write(`[server] ${chunk.toString()}`);
-    });
-  }
+  serverProcess.stdout.on("data", handleStdout);
+  serverProcess.stderr.on("data", (chunk: Buffer) => {
+    process.stderr.write(`[server] ${chunk.toString()}`);
+  });
+  serverProcess.on("error", (error) => {
+    rejectPendingRequests(error);
+  });
+  serverProcess.on("exit", (code, signal) => {
+    rejectPendingRequests(
+      new Error(`MCP server exited with code ${code} signal ${signal}`),
+    );
+  });
 
-  client = new Client(
-    {
+  const initializeResponse = await sendRequest("initialize", {
+    protocolVersion: "2024-11-05",
+    capabilities: {},
+    clientInfo: {
       name: "mcp-stdio-cli",
       version: "1.0.0",
     },
-    {
-      capabilities: {},
-    },
-  );
+  });
+
+  if (initializeResponse.error) {
+    throw new Error(
+      `Initialization failed: ${initializeResponse.error.message}`,
+    );
+  }
+
+  sendNotification("notifications/initialized", {});
+}
+
+function sendMessage(message: JsonRpcRequest | JsonRpcNotification): void {
+  if (!serverProcess) {
+    throw new Error("MCP server is not connected");
+  }
 
-  await client.connect(transport);
-  return client;
+  serverProcess.stdin.write(`${JSON.stringify(message)}\n`);
+}
+
+function sendNotification(method: string, params?: object): void {
+  sendMessage({ jsonrpc: "2.0", method, params });
+}
+
+function sendRequest(
+  method: string,
+  params?: object,
+): Promise<JsonRpcResponse> {
+  const id = nextRequestId++;
+  const request: JsonRpcRequest = { jsonrpc: "2.0", method, params, id };
+
+  return new Promise((resolve, reject) => {
+    pendingRequests.set(id, { resolve, reject });
+    sendMessage(request);
+  });
 }
 
 async function cleanup(): Promise<void> {
-  if (client) {
-    try {
-      await client.close();
-    } catch {
-      // Ignore cleanup errors
-    }
+  if (serverProcess && !serverProcess.killed) {
+    serverProcess.kill();
   }
+  serverProcess = null;
 }
 
-async function listTools(client: Client): Promise<void> {
-  const result = await client.listTools();
+async function listTools(): Promise<void> {
+  const response = await sendRequest("tools/list");
+
+  if (response.error) {
+    console.error("Error:", response.error.message);
+    process.exit(1);
+  }
+
+  const result = response.result as {
+    tools: Array<{ name: string; description?: string; inputSchema: object }>;
+  };
 
   console.log("Available tools:\n");
   for (const tool of result.tools) {
@@ -192,8 +309,17 @@ async function listTools(client: Client): Promise<void> {
   console.log("\nUse 'call <tool> <json-args>' to invoke a tool");
 }
 
-async function listResources(client: Client): Promise<void> {
-  const result = await client.listResources();
+async function listResources(): Promise<void> {
+  const response = await sendRequest("resources/list");
+
+  if (response.error) {
+    console.error("Error:", response.error.message);
+    process.exit(1);
+  }
+
+  const result = response.result as {
+    resources: Array<{ uri: string; name: string; description?: string }>;
+  };
 
   if (!result.resources || result.resources.length === 0) {
     console.log("No resources available.");
@@ -211,8 +337,17 @@ async function listResources(client: Client): Promise<void> {
   }
 }
 
-async function getToolSchema(client: Client, toolName: string): Promise<void> {
-  const result = await client.listTools();
+async function getToolSchema(toolName: string): Promise<void> {
+  const response = await sendRequest("tools/list");
+
+  if (response.error) {
+    console.error("Error:", response.error.message);
+    process.exit(1);
+  }
+
+  const result = response.result as {
+    tools: Array<{ name: string; description?: string; inputSchema: object }>;
+  };
 
   const tool = result.tools.find((t) => t.name === toolName);
   if (!tool) {
@@ -231,11 +366,7 @@ async function getToolSchema(client: Client, toolName: string): Promise<void> {
   console.log(JSON.stringify(tool.inputSchema, null, 2));
 }
 
-async function callTool(
-  client: Client,
-  toolName: string,
-  argsJson: string,
-): Promise<void> {
+async function callTool(toolName: string, argsJson: string): Promise<void> {
   let args: Record<string, unknown>;
   try {
     args = JSON.parse(argsJson || "{}");
@@ -244,20 +375,25 @@ async function callTool(
     process.exit(1);
   }
 
-  const result = await client.callTool({
+  const response = await sendRequest("tools/call", {
     name: toolName,
     arguments: args,
   });
 
-  console.log(JSON.stringify(result, null, 2));
+  if (response.error) {
+    console.error("Error:", response.error.message);
+    if (response.error.data) {
+      console.error("Details:", JSON.stringify(response.error.data, null, 2));
+    }
+    process.exit(1);
+  }
+
+  console.log(JSON.stringify(response.result, null, 2));
 }
 
 function printUsage(): void {
   console.log(`MCP stdio Client - Connect to any MCP server over stdio
 
-NOTE: Requires npm install in this directory first:
-  cd <this-directory> && npm install
-
 Usage: npx tsx mcp-stdio.ts "<command>" [options] <action> [args]
 
 Actions:
@@ -298,7 +434,6 @@ async function main(): Promise<void> {
     process.exit(1);
   }
 
-  // Handle process exit
   process.on("SIGINT", async () => {
     await cleanup();
     process.exit(0);
@@ -310,15 +445,15 @@ async function main(): Promise<void> {
   });
 
   try {
-    const connectedClient = await connect(serverCommand, env, cwd);
+    await connect(serverCommand, env, cwd);
 
     switch (action) {
       case "list-tools":
-        await listTools(connectedClient);
+        await listTools();
         break;
 
       case "list-resources":
-        await listResources(connectedClient);
+        await listResources();
         break;
 
       case "info": {
@@ -328,7 +463,7 @@ async function main(): Promise<void> {
           console.error("Usage: info <tool>");
           process.exit(1);
         }
-        await getToolSchema(connectedClient, toolName);
+        await getToolSchema(toolName);
         break;
       }
 
@@ -339,7 +474,7 @@ async function main(): Promise<void> {
           console.error("Usage: call <tool> '<json-args>'");
           process.exit(1);
         }
-        await callTool(connectedClient, toolName, argsJson || "{}");
+        await callTool(toolName, argsJson || "{}");
         break;
       }