@letta-ai/letta-code 0.28.4 → 0.28.6

package/letta.js

@@ -3138,6 +3138,29 @@ var init_letta_client = __esm(() => {
   init_error();
 });
 
+// src/auth/oauth-refresh.ts
+async function refreshAccessTokenSingleFlight(refreshToken, deviceId, deviceName, refresh = refreshAccessToken) {
+  const refreshKey = `${refreshToken}\x00${deviceId}`;
+  const existing = inFlightRefreshes.get(refreshKey);
+  if (existing) {
+    return await existing;
+  }
+  const pending = refresh(refreshToken, deviceId, deviceName);
+  inFlightRefreshes.set(refreshKey, pending);
+  try {
+    return await pending;
+  } finally {
+    if (inFlightRefreshes.get(refreshKey) === pending) {
+      inFlightRefreshes.delete(refreshKey);
+    }
+  }
+}
+var inFlightRefreshes;
+var init_oauth_refresh = __esm(() => {
+  init_oauth();
+  inFlightRefreshes = new Map;
+});
+
 // src/agent/agent-id.ts
 function isLocalAgentId(agentId) {
   return agentId.startsWith("agent-local-");
@@ -3846,14 +3869,13 @@ class SettingsManager {
   }
   async getSettingsWithSecureTokens() {
     const baseSettings = this.getSettings();
-    let secureTokens = { ...this.secureTokensCache };
+    const secureTokens = { ...this.secureTokensCache };
     if (!getRuntimeContext()) {
       const secretsAvailable2 = await this.isKeychainAvailable();
       if (secretsAvailable2) {
-        secureTokens = {
-          ...secureTokens,
-          ...await this.getSecureTokens()
-        };
+        const storedTokens = await this.getSecureTokens();
+        secureTokens.apiKey = storedTokens.apiKey ?? secureTokens.apiKey;
+        secureTokens.refreshToken = storedTokens.refreshToken ?? secureTokens.refreshToken;
       }
     }
     const fallbackRefreshToken = !secureTokens.refreshToken && baseSettings.refreshToken ? baseSettings.refreshToken : secureTokens.refreshToken;
@@ -4815,7 +4837,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@letta-ai/letta-code",
-    version: "0.28.4",
+    version: "0.28.6",
     description: "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
     type: "module",
     packageManager: "bun@1.3.0",
@@ -5113,7 +5135,7 @@ async function getClient() {
       try {
         const deviceId = settingsManager.getOrCreateDeviceId();
         const deviceName = hostname();
-        const tokens = await refreshAccessToken(settings.refreshToken, deviceId, deviceName);
+        const tokens = await refreshAccessTokenSingleFlight(settings.refreshToken, deviceId, deviceName);
         settingsManager.updateSettings({
           env: { LETTA_API_KEY: tokens.access_token },
           refreshToken: tokens.refresh_token || settings.refreshToken,
@@ -5176,6 +5198,7 @@ var SDK_DIAGNOSTIC_MAX_LEN = 400, SDK_DIAGNOSTIC_MAX_LINES = 4, lastSDKDiagnosti
 var init_client2 = __esm(() => {
   init_letta_client();
   init_oauth();
+  init_oauth_refresh();
   init_settings_manager();
   init_error_reporting();
   init_debug();
@@ -5855,6 +5878,7 @@ __export(exports_oauth, {
   requestDeviceCode: () => requestDeviceCode,
   refreshAccessToken: () => refreshAccessToken,
   pollForToken: () => pollForToken,
+  OAuthRefreshError: () => OAuthRefreshError,
   OAUTH_CONFIG: () => OAUTH_CONFIG,
   LETTA_CLOUD_API_URL: () => LETTA_CLOUD_API_URL
 });
@@ -6035,11 +6059,22 @@ async function refreshAccessToken(refreshToken, deviceId, deviceName) {
     });
     if (!response.ok) {
       const error = await response.json();
-      throw new Error(`Failed to refresh access token from ${authHost}: ${error.error_description || error.error}`);
+      throw new OAuthRefreshError(`Failed to refresh access token from ${authHost}: ${error.error_description || error.error}`, {
+        retryable: response.status === 408 || response.status === 429 || response.status >= 500,
+        status: response.status,
+        oauthCode: error.error
+      });
     }
     return await response.json();
   } catch (error) {
-    throw toOAuthActionError("refresh access token", error);
+    if (error instanceof OAuthRefreshError) {
+      throw error;
+    }
+    const actionError = toOAuthActionError("refresh access token", error);
+    throw new OAuthRefreshError(actionError.message, {
+      retryable: true,
+      cause: error
+    });
   }
 }
 async function revokeToken(refreshToken) {
@@ -6125,7 +6160,7 @@ function classifyCredentialValidationError(error) {
   }
   return { ok: false, reason: "unknown", message };
 }
-var LETTA_CLOUD_API_URL = "https://api.letta.com", OAUTH_CONFIG;
+var LETTA_CLOUD_API_URL = "https://api.letta.com", OAUTH_CONFIG, OAuthRefreshError;
 var init_oauth = __esm(() => {
   init_letta_client();
   init_error();
@@ -6136,6 +6171,18 @@ var init_oauth = __esm(() => {
     authBaseUrl: "https://app.letta.com",
     apiBaseUrl: LETTA_CLOUD_API_URL
   };
+  OAuthRefreshError = class OAuthRefreshError extends Error {
+    retryable;
+    status;
+    oauthCode;
+    constructor(message, options) {
+      super(message, { cause: options.cause });
+      this.name = "OAuthRefreshError";
+      this.retryable = options.retryable;
+      this.status = options.status;
+      this.oauthCode = options.oauthCode;
+    }
+  };
 });
 
 // src/backend/backend-mode.ts
@@ -6157,6 +6204,7 @@ var init_backend_mode = __esm(() => {
 var exports_agent_tags = {};
 __export(exports_agent_tags, {
   buildCreatedAgentTags: () => buildCreatedAgentTags,
+  ONBOARDING_ORIGIN_TAG: () => ONBOARDING_ORIGIN_TAG,
   LETTA_CODE_SUBAGENT_TAG: () => LETTA_CODE_SUBAGENT_TAG,
   LETTA_CODE_ORIGIN_TAG: () => LETTA_CODE_ORIGIN_TAG,
   GIT_MEMORY_ENABLED_TAG: () => GIT_MEMORY_ENABLED_TAG
@@ -6174,7 +6222,7 @@ function buildCreatedAgentTags(options = {}) {
   }
   return Array.from(new Set(tags));
 }
-var LETTA_CODE_ORIGIN_TAG = "origin:letta-code", LETTA_CODE_SUBAGENT_TAG = "role:subagent", GIT_MEMORY_ENABLED_TAG = "git-memory-enabled";
+var LETTA_CODE_ORIGIN_TAG = "origin:letta-code", ONBOARDING_ORIGIN_TAG = "origin:onboarding", LETTA_CODE_SUBAGENT_TAG = "role:subagent", GIT_MEMORY_ENABLED_TAG = "git-memory-enabled";
 
 // src/utils/text-files.ts
 import { readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
@@ -168362,238 +168410,91 @@ var init_approval_controller = __esm(async () => {
   await init_presentation();
 });
 
-// src/channels/slack/file-upload.ts
-import { readFile as readFile4 } from "node:fs/promises";
-import { basename as basename7, extname as extname3 } from "node:path";
-function resolveUploadMimeType(filePath) {
-  switch (extname3(filePath).toLowerCase()) {
-    case ".png":
-      return "image/png";
-    case ".jpg":
-    case ".jpeg":
-      return "image/jpeg";
-    case ".gif":
-      return "image/gif";
-    case ".webp":
-      return "image/webp";
-    case ".pdf":
-      return "application/pdf";
-    case ".txt":
-      return "text/plain";
-    case ".md":
-      return "text/markdown";
-    default:
-      return;
-  }
-}
-async function uploadSlackFile(slackClient, msg) {
-  if (!msg.mediaPath) {
-    throw new Error("mediaPath is required for Slack file uploads.");
-  }
-  const buffer = await readFile4(msg.mediaPath);
-  const uploadFileName = msg.fileName ?? basename7(msg.mediaPath);
-  const uploadTitle = msg.title ?? uploadFileName;
-  const uploadMimeType = resolveUploadMimeType(uploadFileName);
-  const uploadUrlResp = await slackClient.files.getUploadURLExternal({
-    filename: uploadFileName,
-    length: buffer.length
-  });
-  if (!uploadUrlResp.ok || !uploadUrlResp.upload_url || !uploadUrlResp.file_id) {
-    throw new Error(`Failed to get Slack upload URL: ${uploadUrlResp.error ?? "unknown error"}`);
-  }
-  const uploadResp = await fetch(uploadUrlResp.upload_url, {
-    method: "POST",
-    ...uploadMimeType ? { headers: { "Content-Type": uploadMimeType } } : {},
-    body: buffer
-  });
-  if (!uploadResp.ok) {
-    throw new Error(`Failed to upload Slack file: HTTP ${uploadResp.status}`);
-  }
-  const threadTs = resolveSlackOutboundThreadTs({
-    chatId: msg.chatId,
-    threadId: msg.threadId,
-    replyToMessageId: msg.replyToMessageId
-  });
-  const completeResp = await slackClient.files.completeUploadExternal({
-    files: [{ id: uploadUrlResp.file_id, title: uploadTitle }],
-    channel_id: msg.chatId,
-    ...msg.text.trim() ? { initial_comment: msg.text } : {},
-    ...threadTs ? { thread_ts: threadTs } : {}
-  });
-  if (!completeResp.ok) {
-    throw new Error(`Failed to complete Slack upload: ${completeResp.error ?? "unknown error"}`);
-  }
-  return { messageId: uploadUrlResp.file_id };
-}
-var init_file_upload = __esm(() => {
-  init_utils5();
-});
-
-// src/channels/slack/inbound-debounce.ts
-function buildSlackDebounceKey(rawMessage, accountId) {
-  const senderId = rawMessage.user ?? rawMessage.bot_id ?? null;
-  if (!senderId)
-    return null;
-  const messageTs = rawMessage.ts ?? rawMessage.event_ts;
-  const isDm = rawMessage.channel.startsWith("D");
-  const scope = rawMessage.thread_ts ? `${rawMessage.channel}:${rawMessage.thread_ts}` : rawMessage.parent_user_id && messageTs ? `${rawMessage.channel}:maybe-thread:${messageTs}` : messageTs && !isDm ? `${rawMessage.channel}:${messageTs}` : rawMessage.channel;
-  return `slack:${accountId}:${scope}:${senderId}`;
-}
-function buildTopLevelSlackConversationKey(rawMessage, accountId) {
-  if (rawMessage.thread_ts || rawMessage.parent_user_id)
-    return null;
-  if (rawMessage.channel.startsWith("D"))
-    return null;
-  const senderId = rawMessage.user ?? rawMessage.bot_id;
-  return senderId ? `slack:${accountId}:${rawMessage.channel}:${senderId}` : null;
-}
-function resolveSlackInboundDebounceMs(config3) {
-  const raw = process.env.LETTA_SLACK_INBOUND_DEBOUNCE_MS;
-  if (typeof raw === "string" && raw.trim() !== "") {
-    const envOverride = Number(raw);
-    if (Number.isFinite(envOverride) && envOverride >= 0) {
-      return Math.trunc(envOverride);
-    }
-  }
-  const fromConfig = config3.inboundDebounceMs;
-  return typeof fromConfig === "number" && Number.isFinite(fromConfig) && fromConfig >= 0 ? Math.trunc(fromConfig) : 0;
+// src/channels/slack/attachment-stream.ts
+import { randomUUID as randomUUID8 } from "node:crypto";
+import { mkdir as mkdir4, open as open2, rename, rm as rm2 } from "node:fs/promises";
+import { join as join12 } from "node:path";
+function sanitizeFileName(name) {
+  const normalized = name.trim().replace(/[^\w.-]+/g, "_");
+  return normalized.length > 0 ? normalized : "attachment";
 }
-function createSlackInboundDebounceController(params) {
-  const { config: config3 } = params;
-  const debounceMs = resolveSlackInboundDebounceMs(config3);
-  const pendingTopLevelKeys = new Map;
-  const appMentionRetryKeys = new Map;
-  const appMentionDispatchedKeys = new Map;
-  function pruneAppMentionMaps(now) {
-    for (const [key, expiresAt] of appMentionRetryKeys) {
-      if (expiresAt <= now)
-        appMentionRetryKeys.delete(key);
-    }
-    for (const [key, expiresAt] of appMentionDispatchedKeys) {
-      if (expiresAt <= now)
-        appMentionDispatchedKeys.delete(key);
-    }
-  }
-  function dedupeEntries(entries) {
-    const indexByMessageKey = new Map;
-    const deduped = [];
-    for (const entry of entries) {
-      const messageId = entry.inbound.messageId;
-      const messageKey = isNonEmptyString2(messageId) ? `${entry.inbound.chatId}:${messageId}` : null;
-      if (!messageKey) {
-        deduped.push(entry);
-        continue;
+async function saveSlackAttachmentStream(params) {
+  const inboundDir = join12(getChannelDir("slack"), "inbound", sanitizeFileName(params.accountId));
+  await mkdir4(inboundDir, { recursive: true });
+  const filePath = join12(inboundDir, `${Date.now()}-${randomUUID8()}-${sanitizeFileName(params.fileName)}`);
+  const temporaryPath = `${filePath}.partial`;
+  const fileHandle = await open2(temporaryPath, "wx");
+  const reader = params.body.getReader();
+  let sizeBytes = 0;
+  let completed = false;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
       }
-      const existingIndex = indexByMessageKey.get(messageKey);
-      if (existingIndex === undefined) {
-        indexByMessageKey.set(messageKey, deduped.length);
-        deduped.push(entry);
+      if (!value?.byteLength) {
         continue;
       }
-      const current = deduped[existingIndex];
-      if (current && current.opts.source !== "app_mention" && current.inbound.isMention !== true) {
-        deduped[existingIndex] = entry;
+      sizeBytes += value.byteLength;
+      if (params.maxBytes !== undefined && sizeBytes > params.maxBytes) {
+        throw new SlackAttachmentDownloadError("exceeds_auto_download_limit", `Slack attachment exceeds automatic download limit (${params.maxBytes} bytes).`);
       }
-    }
-    return deduped;
-  }
-  const debouncer = createInboundDebouncer({
-    debounceMs,
-    buildKey: ({ raw }) => buildSlackDebounceKey(raw, config3.accountId),
-    shouldDebounce: ({ inbound }) => !inbound.attachments?.length && !inbound.reaction,
-    onFlush: async (entries) => {
-      const dedupedEntries = dedupeEntries(entries);
-      const last = dedupedEntries[dedupedEntries.length - 1];
-      if (!last)
-        return;
-      const flushedKey = buildSlackDebounceKey(last.raw, config3.accountId);
-      const conversationKey = buildTopLevelSlackConversationKey(last.raw, config3.accountId);
-      if (flushedKey && conversationKey) {
-        const pending = pendingTopLevelKeys.get(conversationKey);
-        pending?.delete(flushedKey);
-        if (pending?.size === 0)
-          pendingTopLevelKeys.delete(conversationKey);
-      }
-      if (isNonEmptyString2(last.inbound.messageId)) {
-        const seenKey = `${last.inbound.chatId}:${last.inbound.messageId}`;
-        pruneAppMentionMaps(Date.now());
-        if (last.opts.source === "app_mention") {
-          appMentionDispatchedKeys.set(seenKey, Date.now() + APP_MENTION_RETRY_TTL_MS);
-        } else if (appMentionDispatchedKeys.has(seenKey)) {
-          appMentionDispatchedKeys.delete(seenKey);
-          appMentionRetryKeys.delete(seenKey);
-          return;
+      let offset = 0;
+      while (offset < value.byteLength) {
+        const { bytesWritten } = await fileHandle.write(value, offset, value.byteLength - offset);
+        if (bytesWritten <= 0) {
+          throw new Error("Slack attachment write made no progress.");
         }
-        appMentionRetryKeys.delete(seenKey);
+        offset += bytesWritten;
       }
-      const onMessage = params.getOnMessage();
-      if (!onMessage)
+    }
+    completed = true;
+  } finally {
+    if (!completed) {
+      await reader.cancel().catch(() => {
         return;
-      const text = dedupedEntries.length === 1 ? last.inbound.text : dedupedEntries.map((entry) => entry.inbound.text).filter(Boolean).join(`
-`);
-      try {
-        await onMessage({
-          ...last.inbound,
-          text,
-          isMention: dedupedEntries.some((entry) => entry.opts.wasMentioned || entry.inbound.isMention === true)
-        });
-      } catch (error54) {
-        console.error("[Slack] Error handling debounced inbound message:", error54);
-      }
-    },
-    onError: (error54) => {
-      console.error("[Slack] Inbound debounce flush failed:", error54 instanceof Error ? error54.message : error54);
+      });
     }
-  });
-  return {
-    async dispatch(entry) {
-      const debounceKey = buildSlackDebounceKey(entry.raw, config3.accountId);
-      const conversationKey = buildTopLevelSlackConversationKey(entry.raw, config3.accountId);
-      const canDebounce = debounceMs > 0 && !entry.inbound.attachments?.length && !entry.inbound.reaction && Boolean(debounceKey);
-      if (!canDebounce && conversationKey) {
-        for (const pendingKey of Array.from(pendingTopLevelKeys.get(conversationKey) ?? [])) {
-          try {
-            await debouncer.flushKey(pendingKey);
-          } catch {}
-        }
-      }
-      if (canDebounce && debounceKey && conversationKey) {
-        const pending = pendingTopLevelKeys.get(conversationKey) ?? new Set;
-        pending.add(debounceKey);
-        pendingTopLevelKeys.set(conversationKey, pending);
-      }
-      await debouncer.enqueue(entry);
-    },
-    rememberAppMentionRetry(seenKey) {
-      const now = Date.now();
-      pruneAppMentionMaps(now);
-      appMentionRetryKeys.set(seenKey, now + APP_MENTION_RETRY_TTL_MS);
-    },
-    consumeAppMentionRetry(seenKey) {
-      pruneAppMentionMaps(Date.now());
-      if (!appMentionRetryKeys.has(seenKey))
-        return false;
-      appMentionRetryKeys.delete(seenKey);
-      return true;
-    },
-    clear() {
-      pendingTopLevelKeys.clear();
-      appMentionRetryKeys.clear();
-      appMentionDispatchedKeys.clear();
+    try {
+      reader.releaseLock();
+    } catch {}
+    await fileHandle.close().catch(() => {
+      return;
+    });
+    if (!completed) {
+      await rm2(temporaryPath, { force: true }).catch(() => {
+        return;
+      });
     }
-  };
+  }
+  try {
+    await rename(temporaryPath, filePath);
+  } catch (error54) {
+    await rm2(temporaryPath, { force: true }).catch(() => {
+      return;
+    });
+    throw error54;
+  }
+  return { localPath: filePath, sizeBytes };
 }
-var APP_MENTION_RETRY_TTL_MS = 60000;
-var init_inbound_debounce = __esm(() => {
-  init_utils5();
+var SlackAttachmentDownloadError;
+var init_attachment_stream = __esm(() => {
+  init_config2();
+  SlackAttachmentDownloadError = class SlackAttachmentDownloadError extends Error {
+    reason;
+    constructor(reason, message) {
+      super(message);
+      this.reason = reason;
+      this.name = "SlackAttachmentDownloadError";
+    }
+  };
 });
 
 // src/channels/slack/media.ts
-import { randomUUID as randomUUID8 } from "node:crypto";
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile6 } from "node:fs/promises";
-import { basename as basename8, extname as extname4, join as join12 } from "node:path";
-async function mapSlackThreadMessage(message, attachmentOptions) {
-  const attachments = await resolveSlackMessageAttachments(message, attachmentOptions);
+import { basename as basename7, extname as extname3 } from "node:path";
+async function mapSlackThreadMessage(message, attachmentOptions, sourceThreadId) {
+  const attachments = await resolveSlackMessageAttachments(message, attachmentOptions, sourceThreadId);
   return {
     text: resolveSlackThreadMessageText(message),
     userId: isNonEmptyString3(message.user) ? message.user : undefined,
@@ -168694,10 +168595,6 @@ function assertSlackFileUrl(rawUrl) {
   }
   return parsed;
 }
-function sanitizeFileName(name) {
-  const normalized = name.trim().replace(/[^\w.-]+/g, "_");
-  return normalized.length > 0 ? normalized : "attachment";
-}
 function extensionForMimeType2(mimeType) {
   switch (mimeType?.toLowerCase()) {
     case "image/png":
@@ -168735,7 +168632,7 @@ function resolveMimeType(name, fallback) {
   if (fallback) {
     return fallback;
   }
-  switch (extname4(name).toLowerCase()) {
+  switch (extname3(name).toLowerCase()) {
     case ".png":
       return "image/png";
     case ".jpg":
@@ -168811,51 +168708,93 @@ async function fetchWithSlackAuth(url2, token) {
   }
   return fetch(resolved.href, { redirect: "follow" });
 }
-async function saveSlackAttachment(params) {
-  const inboundDir = join12(getChannelDir("slack"), "inbound", sanitizeFileName(params.accountId));
-  await mkdir4(inboundDir, { recursive: true });
-  const filePath = join12(inboundDir, `${Date.now()}-${randomUUID8()}-${sanitizeFileName(params.fileName)}`);
-  await writeFile6(filePath, params.buffer);
-  return filePath;
+function resolveSlackAttachmentFileName(params) {
+  const hintedName = params.file.name ?? (params.url ? basename7(new URL(params.url).pathname) : undefined) ?? `${params.file.id ?? "attachment"}${extensionForMimeType2(params.file.mimetype)}`;
+  return extname3(hintedName) || !params.mimeType ? hintedName : `${hintedName}${extensionForMimeType2(params.mimeType)}`;
+}
+function resolveSlackAttachmentMimeType(params) {
+  const preferredMimeType = params.responseMimeType && !isGenericSlackMimeType(params.responseMimeType) ? params.responseMimeType : params.file.mimetype && !isGenericSlackMimeType(params.file.mimetype) ? params.file.mimetype : undefined;
+  return resolveMimeType(params.fileName, preferredMimeType);
+}
+function createUndownloadedSlackAttachment(params) {
+  const fileName = resolveSlackAttachmentFileName({ file: params.file });
+  const mimeType = resolveSlackAttachmentMimeType({
+    file: params.file,
+    fileName
+  });
+  return {
+    id: params.file.id,
+    name: fileName,
+    mimeType,
+    sizeBytes: params.file.size,
+    kind: resolveAttachmentKind(mimeType),
+    sourceMessageId: params.sourceMessageId,
+    ...params.sourceThreadId ? { sourceThreadId: params.sourceThreadId } : {},
+    downloadReason: params.reason,
+    ...params.reason === "exceeds_auto_download_limit" ? { autoDownloadLimitBytes: MAX_SLACK_ATTACHMENT_BYTES } : {}
+  };
 }
-async function downloadSlackAttachment(params) {
+async function materializeSlackAttachment(params) {
+  if (params.maxBytes !== undefined && typeof params.file.size === "number" && params.file.size > params.maxBytes) {
+    throw new SlackAttachmentDownloadError("exceeds_auto_download_limit", `Slack attachment is ${params.file.size} bytes; automatic download limit is ${params.maxBytes} bytes.`);
+  }
   const url2 = params.file.url_private_download ?? params.file.url_private;
   if (!url2) {
-    return null;
+    throw new SlackAttachmentDownloadError("missing_download_url", "Slack attachment does not include a private download URL.");
   }
-  const response = await fetchWithSlackAuth(url2, params.token);
+  const response = await fetchWithSlackAuth(url2, params.token).catch((error54) => {
+    throw new SlackAttachmentDownloadError("download_failed", error54 instanceof Error ? error54.message : "Slack attachment fetch failed.");
+  });
   if (!response.ok) {
-    return null;
+    throw new SlackAttachmentDownloadError("download_failed", `Slack attachment fetch failed with HTTP ${response.status}.`);
   }
-  const arrayBuffer = await response.arrayBuffer();
-  if (arrayBuffer.byteLength > MAX_SLACK_ATTACHMENT_BYTES) {
-    return null;
+  const contentLengthHeader = response.headers.get("content-length");
+  const contentLength = contentLengthHeader ? Number(contentLengthHeader) : undefined;
+  if (params.maxBytes !== undefined && contentLength !== undefined && Number.isFinite(contentLength) && contentLength > params.maxBytes) {
+    await response.body?.cancel().catch(() => {
+      return;
+    });
+    throw new SlackAttachmentDownloadError("exceeds_auto_download_limit", `Slack attachment is ${contentLength} bytes; automatic download limit is ${params.maxBytes} bytes.`);
   }
-  const buffer = Buffer.from(arrayBuffer);
-  const hintedName = params.file.name ?? basename8(new URL(url2).pathname) ?? `${params.file.id ?? "attachment"}${extensionForMimeType2(params.file.mimetype)}`;
   const responseMimeType = response.headers.get("content-type")?.split(";")[0]?.trim() || undefined;
-  const fileMimeType = params.file.mimetype;
-  const preferredMimeType = responseMimeType && !isGenericSlackMimeType(responseMimeType) ? responseMimeType : fileMimeType && !isGenericSlackMimeType(fileMimeType) ? fileMimeType : undefined;
-  const mimeType = resolveMimeType(hintedName, preferredMimeType);
-  const fileName = extname4(hintedName) || !mimeType ? hintedName : `${hintedName}${extensionForMimeType2(mimeType)}`;
-  const localPath = await saveSlackAttachment({
+  const hintedName = resolveSlackAttachmentFileName({
+    file: params.file,
+    url: url2
+  });
+  const mimeType = resolveSlackAttachmentMimeType({
+    file: params.file,
+    fileName: hintedName,
+    responseMimeType
+  });
+  const fileName = resolveSlackAttachmentFileName({
+    file: params.file,
+    url: url2,
+    mimeType
+  });
+  if (!response.body) {
+    throw new SlackAttachmentDownloadError("download_failed", "Slack attachment response did not include a body.");
+  }
+  const saved = await saveSlackAttachmentStream({
     accountId: params.accountId,
     fileName,
-    buffer
+    body: response.body,
+    maxBytes: params.maxBytes
   });
   const kind = resolveAttachmentKind(mimeType);
   const attachment = {
     id: params.file.id,
     name: fileName,
     mimeType,
-    sizeBytes: buffer.byteLength,
+    sizeBytes: saved.sizeBytes,
     kind,
-    localPath
+    localPath: saved.localPath,
+    sourceMessageId: params.sourceMessageId,
+    ...params.sourceThreadId ? { sourceThreadId: params.sourceThreadId } : {}
   };
   if (kind === "audio" && params.transcribeVoice) {
     const { isTranscriptionConfigured: isTranscriptionConfigured2, transcribeAudioFile: transcribeAudioFile2 } = await Promise.resolve().then(() => (init_transcription(), exports_transcription));
     if (isTranscriptionConfigured2()) {
-      const result = await transcribeAudioFile2(localPath);
+      const result = await transcribeAudioFile2(saved.localPath);
       if (result.success && result.text) {
         attachment.transcription = result.text;
       } else if (result.error) {
@@ -168906,13 +168845,28 @@ async function resolveSlackFilesAsAttachments(params) {
   if (params.files.length === 0) {
     return [];
   }
-  const resolved = await Promise.all(params.files.map((file3) => downloadSlackAttachment({
-    accountId: params.accountId,
-    token: params.token,
-    file: file3,
-    transcribeVoice: params.transcribeVoice
-  }).catch(() => null)));
-  return resolved.filter((attachment) => Boolean(attachment));
+  const resolved = await Promise.all(params.files.map(async (file3) => {
+    try {
+      return await materializeSlackAttachment({
+        accountId: params.accountId,
+        token: params.token,
+        file: file3,
+        sourceMessageId: params.sourceMessageId,
+        sourceThreadId: params.sourceThreadId,
+        maxBytes: MAX_SLACK_ATTACHMENT_BYTES,
+        transcribeVoice: params.transcribeVoice
+      });
+    } catch (error54) {
+      const reason = error54 instanceof SlackAttachmentDownloadError ? error54.reason : "download_failed";
+      return createUndownloadedSlackAttachment({
+        file: file3,
+        sourceMessageId: params.sourceMessageId,
+        sourceThreadId: params.sourceThreadId,
+        reason
+      });
+    }
+  }));
+  return resolved;
 }
 function resolveSlackThreadAttachmentOptions(params) {
   if (!isNonEmptyString3(params.accountId) || !isNonEmptyString3(params.token)) {
@@ -168933,7 +168887,7 @@ function hasSlackThreadMessageContent(message, attachmentOptions) {
 function hasHydratedSlackThreadMessageContent(message) {
   return message.text.length > 0 || Boolean(message.attachments?.length);
 }
-async function resolveSlackMessageAttachments(message, attachmentOptions) {
+async function resolveSlackMessageAttachments(message, attachmentOptions, sourceThreadId) {
   if (!attachmentOptions) {
     return [];
   }
@@ -168941,14 +168895,19 @@ async function resolveSlackMessageAttachments(message, attachmentOptions) {
     accountId: attachmentOptions.accountId,
     token: attachmentOptions.token,
     files: collectSlackFiles(message),
+    sourceMessageId: message.ts,
+    sourceThreadId: sourceThreadId ?? (isNonEmptyString3(message.thread_ts) ? message.thread_ts : null),
     transcribeVoice: attachmentOptions.transcribeVoice
   });
 }
 async function resolveSlackInboundAttachments(params) {
+  const rawEvent = asRecord4(params.rawEvent);
   return resolveSlackFilesAsAttachments({
     accountId: params.accountId,
     token: params.token,
     files: collectSlackFiles(params.rawEvent),
+    sourceMessageId: isNonEmptyString3(rawEvent?.ts) ? rawEvent.ts : undefined,
+    sourceThreadId: isNonEmptyString3(rawEvent?.thread_ts) ? rawEvent.thread_ts : null,
     transcribeVoice: params.transcribeVoice
   });
 }
@@ -168970,7 +168929,7 @@ async function resolveSlackCurrentMessageAttachments(params) {
       });
       const message = (response.messages ?? []).find((entry) => entry.ts === params.messageTs);
       if (message) {
-        return resolveSlackMessageAttachments(message, attachmentOptions);
+        return resolveSlackMessageAttachments(message, attachmentOptions, params.threadTs);
       }
       const nextCursor = response.response_metadata?.next_cursor;
       cursor = typeof nextCursor === "string" && nextCursor.trim().length > 0 ? nextCursor.trim() : undefined;
@@ -168996,7 +168955,7 @@ async function resolveSlackThreadStarter(params) {
     if (!hasSlackThreadMessageContent(message, attachmentOptions)) {
       return null;
     }
-    const mapped3 = await mapSlackThreadMessage(message, attachmentOptions);
+    const mapped3 = await mapSlackThreadMessage(message, attachmentOptions, params.threadTs);
     return hasHydratedSlackThreadMessageContent(mapped3) ? mapped3 : null;
   } catch {
     return null;
@@ -169041,7 +169000,7 @@ async function resolveSlackThreadHistory(params) {
       const nextCursor = response.response_metadata?.next_cursor;
       cursor = typeof nextCursor === "string" && nextCursor.trim().length > 0 ? nextCursor.trim() : undefined;
     } while (cursor);
-    const mapped3 = await Promise.all(retained.map((message) => mapSlackThreadMessage(message, attachmentOptions)));
+    const mapped3 = await Promise.all(retained.map((message) => mapSlackThreadMessage(message, attachmentOptions, params.threadTs)));
     return mapped3.filter(hasHydratedSlackThreadMessageContent);
   } catch {
     return [];
@@ -169075,7 +169034,7 @@ async function resolveSlackChannelHistory(params) {
 }
 var MAX_SLACK_ATTACHMENTS = 8, MAX_SLACK_ATTACHMENT_BYTES, ALLOWED_SLACK_HOST_SUFFIXES;
 var init_media2 = __esm(() => {
-  init_config2();
+  init_attachment_stream();
   MAX_SLACK_ATTACHMENT_BYTES = 20 * 1024 * 1024;
   ALLOWED_SLACK_HOST_SUFFIXES = [
     "slack.com",
@@ -169084,6 +169043,286 @@ var init_media2 = __esm(() => {
   ];
 });
 
+// src/channels/slack/attachment-download.ts
+function isNonEmptyString4(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+async function resolveCanonicalSlackMessage(params) {
+  if (isNonEmptyString4(params.threadTs)) {
+    let cursor;
+    do {
+      const response2 = await params.client.conversations.replies({
+        channel: params.channelId,
+        ts: params.threadTs,
+        limit: 200,
+        inclusive: true,
+        ...cursor ? { cursor } : {}
+      });
+      const message = (response2.messages ?? []).find((entry) => entry.ts === params.messageTs);
+      if (message) {
+        return message;
+      }
+      const nextCursor = response2.response_metadata?.next_cursor;
+      cursor = isNonEmptyString4(nextCursor) ? nextCursor.trim() : undefined;
+    } while (cursor);
+    return null;
+  }
+  const response = await params.client.conversations.history({
+    channel: params.channelId,
+    oldest: params.messageTs,
+    latest: params.messageTs,
+    inclusive: true,
+    limit: 1
+  });
+  return (response.messages ?? []).find((entry) => entry.ts === params.messageTs) ?? null;
+}
+async function downloadSlackAttachmentById(params) {
+  const message = await resolveCanonicalSlackMessage(params);
+  if (!message) {
+    throw new Error(`Slack message ${params.messageTs} was not found in chat ${params.channelId}.`);
+  }
+  const file3 = collectSlackFiles(message).find((entry) => entry.id === params.attachmentId);
+  if (!file3) {
+    throw new Error(`Slack attachment ${params.attachmentId} is not attached to message ${params.messageTs}.`);
+  }
+  return await materializeSlackAttachment({
+    accountId: params.accountId,
+    token: params.token,
+    file: file3,
+    sourceMessageId: params.messageTs,
+    sourceThreadId: params.threadTs ?? null
+  });
+}
+var init_attachment_download = __esm(() => {
+  init_media2();
+});
+
+// src/channels/slack/file-upload.ts
+import { readFile as readFile4 } from "node:fs/promises";
+import { basename as basename8, extname as extname4 } from "node:path";
+function resolveUploadMimeType(filePath) {
+  switch (extname4(filePath).toLowerCase()) {
+    case ".png":
+      return "image/png";
+    case ".jpg":
+    case ".jpeg":
+      return "image/jpeg";
+    case ".gif":
+      return "image/gif";
+    case ".webp":
+      return "image/webp";
+    case ".pdf":
+      return "application/pdf";
+    case ".txt":
+      return "text/plain";
+    case ".md":
+      return "text/markdown";
+    default:
+      return;
+  }
+}
+async function uploadSlackFile(slackClient, msg) {
+  if (!msg.mediaPath) {
+    throw new Error("mediaPath is required for Slack file uploads.");
+  }
+  const buffer = await readFile4(msg.mediaPath);
+  const uploadFileName = msg.fileName ?? basename8(msg.mediaPath);
+  const uploadTitle = msg.title ?? uploadFileName;
+  const uploadMimeType = resolveUploadMimeType(uploadFileName);
+  const uploadUrlResp = await slackClient.files.getUploadURLExternal({
+    filename: uploadFileName,
+    length: buffer.length
+  });
+  if (!uploadUrlResp.ok || !uploadUrlResp.upload_url || !uploadUrlResp.file_id) {
+    throw new Error(`Failed to get Slack upload URL: ${uploadUrlResp.error ?? "unknown error"}`);
+  }
+  const uploadResp = await fetch(uploadUrlResp.upload_url, {
+    method: "POST",
+    ...uploadMimeType ? { headers: { "Content-Type": uploadMimeType } } : {},
+    body: buffer
+  });
+  if (!uploadResp.ok) {
+    throw new Error(`Failed to upload Slack file: HTTP ${uploadResp.status}`);
+  }
+  const threadTs = resolveSlackOutboundThreadTs({
+    chatId: msg.chatId,
+    threadId: msg.threadId,
+    replyToMessageId: msg.replyToMessageId
+  });
+  const completeResp = await slackClient.files.completeUploadExternal({
+    files: [{ id: uploadUrlResp.file_id, title: uploadTitle }],
+    channel_id: msg.chatId,
+    ...msg.text.trim() ? { initial_comment: msg.text } : {},
+    ...threadTs ? { thread_ts: threadTs } : {}
+  });
+  if (!completeResp.ok) {
+    throw new Error(`Failed to complete Slack upload: ${completeResp.error ?? "unknown error"}`);
+  }
+  return { messageId: uploadUrlResp.file_id };
+}
+var init_file_upload = __esm(() => {
+  init_utils5();
+});
+
+// src/channels/slack/inbound-debounce.ts
+function buildSlackDebounceKey(rawMessage, accountId) {
+  const senderId = rawMessage.user ?? rawMessage.bot_id ?? null;
+  if (!senderId)
+    return null;
+  const messageTs = rawMessage.ts ?? rawMessage.event_ts;
+  const isDm = rawMessage.channel.startsWith("D");
+  const scope = rawMessage.thread_ts ? `${rawMessage.channel}:${rawMessage.thread_ts}` : rawMessage.parent_user_id && messageTs ? `${rawMessage.channel}:maybe-thread:${messageTs}` : messageTs && !isDm ? `${rawMessage.channel}:${messageTs}` : rawMessage.channel;
+  return `slack:${accountId}:${scope}:${senderId}`;
+}
+function buildTopLevelSlackConversationKey(rawMessage, accountId) {
+  if (rawMessage.thread_ts || rawMessage.parent_user_id)
+    return null;
+  if (rawMessage.channel.startsWith("D"))
+    return null;
+  const senderId = rawMessage.user ?? rawMessage.bot_id;
+  return senderId ? `slack:${accountId}:${rawMessage.channel}:${senderId}` : null;
+}
+function resolveSlackInboundDebounceMs(config3) {
+  const raw = process.env.LETTA_SLACK_INBOUND_DEBOUNCE_MS;
+  if (typeof raw === "string" && raw.trim() !== "") {
+    const envOverride = Number(raw);
+    if (Number.isFinite(envOverride) && envOverride >= 0) {
+      return Math.trunc(envOverride);
+    }
+  }
+  const fromConfig = config3.inboundDebounceMs;
+  return typeof fromConfig === "number" && Number.isFinite(fromConfig) && fromConfig >= 0 ? Math.trunc(fromConfig) : 0;
+}
+function createSlackInboundDebounceController(params) {
+  const { config: config3 } = params;
+  const debounceMs = resolveSlackInboundDebounceMs(config3);
+  const pendingTopLevelKeys = new Map;
+  const appMentionRetryKeys = new Map;
+  const appMentionDispatchedKeys = new Map;
+  function pruneAppMentionMaps(now) {
+    for (const [key, expiresAt] of appMentionRetryKeys) {
+      if (expiresAt <= now)
+        appMentionRetryKeys.delete(key);
+    }
+    for (const [key, expiresAt] of appMentionDispatchedKeys) {
+      if (expiresAt <= now)
+        appMentionDispatchedKeys.delete(key);
+    }
+  }
+  function dedupeEntries(entries) {
+    const indexByMessageKey = new Map;
+    const deduped = [];
+    for (const entry of entries) {
+      const messageId = entry.inbound.messageId;
+      const messageKey = isNonEmptyString2(messageId) ? `${entry.inbound.chatId}:${messageId}` : null;
+      if (!messageKey) {
+        deduped.push(entry);
+        continue;
+      }
+      const existingIndex = indexByMessageKey.get(messageKey);
+      if (existingIndex === undefined) {
+        indexByMessageKey.set(messageKey, deduped.length);
+        deduped.push(entry);
+        continue;
+      }
+      const current = deduped[existingIndex];
+      if (current && current.opts.source !== "app_mention" && current.inbound.isMention !== true) {
+        deduped[existingIndex] = entry;
+      }
+    }
+    return deduped;
+  }
+  const debouncer = createInboundDebouncer({
+    debounceMs,
+    buildKey: ({ raw }) => buildSlackDebounceKey(raw, config3.accountId),
+    shouldDebounce: ({ inbound }) => !inbound.attachments?.length && !inbound.reaction,
+    onFlush: async (entries) => {
+      const dedupedEntries = dedupeEntries(entries);
+      const last = dedupedEntries[dedupedEntries.length - 1];
+      if (!last)
+        return;
+      const flushedKey = buildSlackDebounceKey(last.raw, config3.accountId);
+      const conversationKey = buildTopLevelSlackConversationKey(last.raw, config3.accountId);
+      if (flushedKey && conversationKey) {
+        const pending = pendingTopLevelKeys.get(conversationKey);
+        pending?.delete(flushedKey);
+        if (pending?.size === 0)
+          pendingTopLevelKeys.delete(conversationKey);
+      }
+      if (isNonEmptyString2(last.inbound.messageId)) {
+        const seenKey = `${last.inbound.chatId}:${last.inbound.messageId}`;
+        pruneAppMentionMaps(Date.now());
+        if (last.opts.source === "app_mention") {
+          appMentionDispatchedKeys.set(seenKey, Date.now() + APP_MENTION_RETRY_TTL_MS);
+        } else if (appMentionDispatchedKeys.has(seenKey)) {
+          appMentionDispatchedKeys.delete(seenKey);
+          appMentionRetryKeys.delete(seenKey);
+          return;
+        }
+        appMentionRetryKeys.delete(seenKey);
+      }
+      const onMessage = params.getOnMessage();
+      if (!onMessage)
+        return;
+      const text = dedupedEntries.length === 1 ? last.inbound.text : dedupedEntries.map((entry) => entry.inbound.text).filter(Boolean).join(`
+`);
+      try {
+        await onMessage({
+          ...last.inbound,
+          text,
+          isMention: dedupedEntries.some((entry) => entry.opts.wasMentioned || entry.inbound.isMention === true)
+        });
+      } catch (error54) {
+        console.error("[Slack] Error handling debounced inbound message:", error54);
+      }
+    },
+    onError: (error54) => {
+      console.error("[Slack] Inbound debounce flush failed:", error54 instanceof Error ? error54.message : error54);
+    }
+  });
+  return {
+    async dispatch(entry) {
+      const debounceKey = buildSlackDebounceKey(entry.raw, config3.accountId);
+      const conversationKey = buildTopLevelSlackConversationKey(entry.raw, config3.accountId);
+      const canDebounce = debounceMs > 0 && !entry.inbound.attachments?.length && !entry.inbound.reaction && Boolean(debounceKey);
+      if (!canDebounce && conversationKey) {
+        for (const pendingKey of Array.from(pendingTopLevelKeys.get(conversationKey) ?? [])) {
+          try {
+            await debouncer.flushKey(pendingKey);
+          } catch {}
+        }
+      }
+      if (canDebounce && debounceKey && conversationKey) {
+        const pending = pendingTopLevelKeys.get(conversationKey) ?? new Set;
+        pending.add(debounceKey);
+        pendingTopLevelKeys.set(conversationKey, pending);
+      }
+      await debouncer.enqueue(entry);
+    },
+    rememberAppMentionRetry(seenKey) {
+      const now = Date.now();
+      pruneAppMentionMaps(now);
+      appMentionRetryKeys.set(seenKey, now + APP_MENTION_RETRY_TTL_MS);
+    },
+    consumeAppMentionRetry(seenKey) {
+      pruneAppMentionMaps(Date.now());
+      if (!appMentionRetryKeys.has(seenKey))
+        return false;
+      appMentionRetryKeys.delete(seenKey);
+      return true;
+    },
+    clear() {
+      pendingTopLevelKeys.clear();
+      appMentionRetryKeys.clear();
+      appMentionDispatchedKeys.clear();
+    }
+  };
+}
+var APP_MENTION_RETRY_TTL_MS = 60000;
+var init_inbound_debounce = __esm(() => {
+  init_utils5();
+});
+
 // src/channels/slack/ingress-controller.ts
 function createSlackIngressController(params) {
   const { config: config3 } = params;
@@ -169816,6 +170055,18 @@ function createSlackAdapter(config3) {
       throw error54;
     }
   }
+  async function downloadAttachment(params) {
+    const slackApp = await ensureApp();
+    return await downloadSlackAttachmentById({
+      accountId: config3.accountId,
+      token: config3.botToken,
+      attachmentId: params.attachmentId,
+      channelId: params.chatId,
+      threadTs: params.threadId,
+      messageTs: params.messageId,
+      client: slackApp.client
+    });
+  }
   async function sendLifecycleErrorReply(source2, errorText) {
     const threadTs = resolveSlackSourceThreadTs(source2);
     const text = formatSlackLifecycleErrorMessage(errorText);
@@ -170018,6 +170269,7 @@ function createSlackAdapter(config3) {
       await Promise.all(status.getUniqueSources(event2.sources).map((source2) => status.activate(source2, SLACK_ASSISTANT_WORKING_STATUS, activity)));
     },
     sendMessage,
+    downloadAttachment,
     sendDirectReply,
     handleControlRequestEvent,
     prepareInboundMessage: (msg, options3) => prepareSlackInboundMessage({
@@ -170037,6 +170289,7 @@ var init_adapter3 = __esm(async () => {
   init_model_picker_blocks();
   init_error_reporting();
   init_agent_thread_tracker();
+  init_attachment_download();
   init_file_upload();
   init_inbound_debounce();
   init_ingress_controller();
@@ -170427,13 +170680,47 @@ async function reactInSlack(ctx) {
   });
   return request.remove ? `Reaction removed on slack (message_id: ${result.messageId})` : `Reaction added on slack (message_id: ${result.messageId})`;
 }
+async function downloadSlackFile(ctx) {
+  const { request } = ctx;
+  if (!request.attachmentId?.trim()) {
+    return "Error: Slack download-file requires attachmentId.";
+  }
+  if (!request.messageId?.trim()) {
+    return "Error: Slack download-file requires messageId from the attachment's Slack context.";
+  }
+  if (typeof ctx.adapter.downloadAttachment !== "function") {
+    return "Error: Running Slack adapter does not support attachment downloads.";
+  }
+  const attachment = await ctx.adapter.downloadAttachment({
+    attachmentId: request.attachmentId,
+    chatId: request.chatId,
+    threadId: request.threadId ?? null,
+    messageId: request.messageId
+  });
+  if (!attachment.localPath) {
+    return `Error: Slack attachment ${request.attachmentId} was not downloaded.`;
+  }
+  return `Slack attachment downloaded (local_path: ${attachment.localPath})`;
+}
 var slackMessageActions;
 var init_message_actions2 = __esm(() => {
   init_target_resolution();
   slackMessageActions = {
     describeMessageTool() {
       return {
-        actions: ["send", "react", "upload-file"]
+        actions: ["send", "react", "upload-file", "download-file"],
+        schema: {
+          properties: {
+            attachmentId: {
+              type: "string",
+              description: "Slack attachment id for action='download-file'. Copy attachment_id from the channel notification."
+            },
+            messageId: {
+              type: "string",
+              description: "Target Slack message id for action='react', or the source message id containing attachmentId for action='download-file'."
+            }
+          }
+        }
       };
     },
     async resolveMessageTarget(params) {
@@ -170453,6 +170740,8 @@ var init_message_actions2 = __esm(() => {
           return await sendSlackMessage(ctx);
         case "react":
           return await reactInSlack(ctx);
+        case "download-file":
+          return await downloadSlackFile(ctx);
         default:
           return `Error: Action "${ctx.request.action}" is not supported on slack.`;
       }
@@ -170692,7 +170981,7 @@ function resolveDiscordChannelMode(channelId, parentChannelId, isThread, allowed
 // src/channels/discord/media.ts
 import { randomUUID as randomUUID10 } from "node:crypto";
 import { mkdirSync as mkdirSync6 } from "node:fs";
-import { writeFile as writeFile7 } from "node:fs/promises";
+import { writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join13 } from "node:path";
 function ensureAttachmentsDir() {
@@ -170756,7 +171045,7 @@ async function resolveDiscordInboundAttachments(params) {
         console.warn(`[Discord] Skipping oversized attachment ${name}: ${buffer.byteLength} bytes`);
         continue;
       }
-      await writeFile7(localPath, buffer);
+      await writeFile6(localPath, buffer);
       const entry = {
         id: attachment.id,
         name,
@@ -170862,7 +171151,7 @@ function formatDiscordDeliveryError(error54) {
 }
 
 // src/channels/discord/utils.ts
-function isNonEmptyString4(value) {
+function isNonEmptyString5(value) {
   return typeof value === "string" && value.length > 0;
 }
 function isDiscordTextChannel(channel) {
@@ -170929,7 +171218,7 @@ function shouldAutoThreadOnDiscordMention(account, channelId) {
   return account.autoThreadOnMention ?? false;
 }
 function buildDiscordIngressMessageKey(accountId, messageId) {
-  if (!isNonEmptyString4(accountId) || !isNonEmptyString4(messageId)) {
+  if (!isNonEmptyString5(accountId) || !isNonEmptyString5(messageId)) {
     return null;
   }
   return `${accountId}:${messageId}`;
@@ -171013,13 +171302,13 @@ function createDiscordAdapter(config3) {
     return false;
   }
   function getLifecycleMessageKey(source2) {
-    if (source2.channel !== "discord" || !isNonEmptyString4(source2.chatId) || !isNonEmptyString4(source2.messageId)) {
+    if (source2.channel !== "discord" || !isNonEmptyString5(source2.chatId) || !isNonEmptyString5(source2.messageId)) {
       return null;
     }
     return `${source2.chatId}:${source2.messageId}`;
   }
   function getLifecycleReplyKey(source2) {
-    if (source2.channel !== "discord" || !isNonEmptyString4(source2.chatId)) {
+    if (source2.channel !== "discord" || !isNonEmptyString5(source2.chatId)) {
       return null;
     }
     return [
@@ -171032,7 +171321,7 @@ function createDiscordAdapter(config3) {
     if (source2.channel !== "discord")
       return null;
     const channelId = source2.threadId ?? source2.chatId;
-    return isNonEmptyString4(channelId) ? channelId : null;
+    return isNonEmptyString5(channelId) ? channelId : null;
   }
   function getTypingSourceKey(source2) {
     const channelId = getTypingChannelId(source2);
@@ -171084,7 +171373,7 @@ function createDiscordAdapter(config3) {
     return true;
   }
   async function sendLifecycleReaction(source2, emoji3, remove = false) {
-    if (!client || !isNonEmptyString4(source2.messageId))
+    if (!client || !isNonEmptyString5(source2.messageId))
       return;
     try {
       const channel = await client.channels.fetch(source2.chatId);
@@ -171623,7 +171912,7 @@ function createDiscordAdapter(config3) {
       clearTypingForChannel(chatId);
     },
     async prepareInboundMessage(msg, options3) {
-      if (!options3?.isFirstRouteTurn || msg.channel !== "discord" || msg.chatType !== "channel" || !isNonEmptyString4(msg.threadId) || !client) {
+      if (!options3?.isFirstRouteTurn || msg.channel !== "discord" || msg.chatType !== "channel" || !isNonEmptyString5(msg.threadId) || !client) {
         return msg;
       }
       const starter = await resolveDiscordThreadStarter({
@@ -172044,7 +172333,7 @@ var WHATSAPP_PHONE_SUFFIX = "@s.whatsapp.net", WHATSAPP_LID_SUFFIX = "@lid", WHA
 
 // src/channels/whatsapp/media.ts
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { mkdir as mkdir5, writeFile as writeFile8 } from "node:fs/promises";
+import { mkdir as mkdir5, writeFile as writeFile7 } from "node:fs/promises";
 import { basename as basename10, extname as extname5, join as join14 } from "node:path";
 function unwrapWhatsAppMessageContent(message) {
   if (!message || typeof message !== "object")
@@ -172226,7 +172515,7 @@ async function collectWhatsAppAttachments(params) {
   if (!buffer) {
     return { attachments: [attachment] };
   }
-  await writeFile8(localPath, buffer);
+  await writeFile7(localPath, buffer);
   attachment.localPath = localPath;
   if (isVoice && params.transcribeVoice) {
     const result = await transcribeAudioFile(localPath);
@@ -176039,7 +176328,7 @@ function isLocalAgentId2(agentId) {
   return isLocalAgentId(agentId);
 }
 function buildChatUrl(agentId, options3) {
-  const base2 = `${APP_BASE}/chat/${agentId}`;
+  const base2 = `${CHAT_BASE}/chat/${agentId}`;
   const params = new URLSearchParams;
   if (options3?.view) {
     params.set("view", options3.view);
@@ -176066,11 +176355,16 @@ function buildAgentTerminalLink(agentId, options3, label = agentId) {
   const url2 = buildChatUrl(agentId, options3);
   return `\x1B]8;;${url2}\x1B\\${label}\x1B]8;;\x1B\\`;
 }
-function buildAppUrl(path5) {
-  return `${APP_BASE}${path5}`;
+function buildChatWebUrl(path5) {
+  return `${CHAT_BASE}${path5}`;
+}
+function buildPlatformUrl(path5) {
+  return `${PLATFORM_BASE}${path5}`;
 }
-var APP_BASE = "https://app.letta.com";
-var init_app_urls = () => {};
+var CHAT_BASE = "https://chat.letta.com", PLATFORM_BASE = "https://platform.letta.com", LETTA_CHAT_API_KEYS_URL;
+var init_app_urls = __esm(() => {
+  LETTA_CHAT_API_KEYS_URL = `${CHAT_BASE}/preferences/api-keys`;
+});
 
 // src/channels/registry-presentation.ts
 function channelDisplayName2(channelId) {
@@ -177257,14 +177551,19 @@ function escapeXmlText(text) {
 function escapeXmlAttribute(text) {
   return escapeXmlText(text).replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
+function formatMebibytes(bytes) {
+  const mebibytes = bytes / (1024 * 1024);
+  const rounded = mebibytes >= 100 ? Math.round(mebibytes).toString() : mebibytes.toFixed(1);
+  return `${rounded.replace(/\.0$/, "")} MiB`;
+}
 function hasNotificationAttachmentPaths(msg) {
-  if (msg.attachments?.length) {
+  if (msg.attachments?.some((attachment) => attachment.localPath)) {
     return true;
   }
-  if (msg.threadContext?.starter?.attachments?.length) {
+  if (msg.threadContext?.starter?.attachments?.some((attachment) => attachment.localPath)) {
     return true;
   }
-  return Boolean(msg.threadContext?.history?.some((entry) => entry.attachments?.length));
+  return Boolean(msg.threadContext?.history?.some((entry) => entry.attachments?.some((attachment) => attachment.localPath)));
 }
 function buildChannelReminderText(msg) {
   const localTime = escapeXmlText(getLocalTime());
@@ -177287,7 +177586,7 @@ function buildChannelReminderText(msg) {
     lines.splice(lines.length - 2, 0, threadLine);
   }
   if (msg.channel === "slack") {
-    lines.splice(lines.length - 2, 0, 'On Slack, MessageChannel also supports action="react" with emoji + messageId, and action="upload-file" with media.', 'For Slack requests that require nontrivial work or several tool calls, send a short MessageChannel action="send" acknowledgement before starting other tools. This gives the Slack user verbal acknowledgement and a View in web link. Do not do this for no-ops, reaction-only responses, or simple no-tool answers.');
+    lines.splice(lines.length - 2, 0, 'On Slack, MessageChannel also supports action="react" with emoji + messageId, action="upload-file" with media, and action="download-file" with attachmentId + messageId.', 'For Slack requests that require nontrivial work or several tool calls, send a short MessageChannel action="send" acknowledgement before starting other tools. This gives the Slack user verbal acknowledgement and a View in web link. Do not do this for no-ops, reaction-only responses, or simple no-tool answers.');
   }
   if (msg.channel === "telegram") {
     lines.splice(lines.length - 2, 0, 'On Telegram, MessageChannel also supports action="react" with emoji + messageId, and action="upload-file" with media.');
@@ -177307,11 +177606,13 @@ function buildChannelReminderText(msg) {
   return lines.join(`
 `);
 }
-function buildAttachmentXml(attachment) {
-  const attrs = [
-    `kind="${escapeXmlAttribute(attachment.kind)}"`,
-    `local_path="${escapeXmlAttribute(attachment.localPath)}"`
-  ];
+function buildAttachmentXml(attachment, context3) {
+  const attrs = [`kind="${escapeXmlAttribute(attachment.kind)}"`];
+  if (attachment.localPath) {
+    attrs.push(`local_path="${escapeXmlAttribute(attachment.localPath)}"`);
+  } else {
+    attrs.push('download_status="not_downloaded"');
+  }
   if (attachment.id) {
     attrs.push(`attachment_id="${escapeXmlAttribute(attachment.id)}"`);
   }
@@ -177324,6 +177625,19 @@ function buildAttachmentXml(attachment) {
   if (typeof attachment.sizeBytes === "number") {
     attrs.push(`size_bytes="${attachment.sizeBytes}"`);
   }
+  const sourceMessageId = attachment.sourceMessageId ?? context3.messageId;
+  if (!attachment.localPath && sourceMessageId) {
+    attrs.push(`source_message_id="${escapeXmlAttribute(sourceMessageId)}"`);
+  }
+  if (!attachment.localPath && attachment.sourceThreadId) {
+    attrs.push(`source_thread_id="${escapeXmlAttribute(attachment.sourceThreadId)}"`);
+  }
+  if (attachment.downloadReason) {
+    attrs.push(`download_reason="${escapeXmlAttribute(attachment.downloadReason)}"`);
+  }
+  if (typeof attachment.autoDownloadLimitBytes === "number") {
+    attrs.push(`auto_download_limit_bytes="${attachment.autoDownloadLimitBytes}"`);
+  }
   const children = [];
   if (attachment.transcription) {
     children.push(`<attempted_transcription>${escapeXmlText(attachment.transcription)}</attempted_transcription>`);
@@ -177331,6 +177645,17 @@ function buildAttachmentXml(attachment) {
   if (attachment.transcriptionError) {
     children.push(`<attempted_transcription_error>${escapeXmlText(attachment.transcriptionError)}</attempted_transcription_error>`);
   }
+  if (!attachment.localPath && context3.channel === "slack" && attachment.id && sourceMessageId) {
+    const accountArg = context3.accountId ? `, accountId="${escapeXmlAttribute(context3.accountId)}"` : "";
+    const threadArg = attachment.sourceThreadId ? `, threadId="${escapeXmlAttribute(attachment.sourceThreadId)}"` : "";
+    const action3 = `MessageChannel with action="download-file", channel="slack", chat_id="${escapeXmlAttribute(context3.chatId)}"${accountArg}${threadArg}, attachmentId="${escapeXmlAttribute(attachment.id)}", and messageId="${escapeXmlAttribute(sourceMessageId)}"`;
+    if (attachment.downloadReason === "exceeds_auto_download_limit") {
+      const sizeNote = typeof attachment.sizeBytes === "number" ? `This file is ${formatMebibytes(attachment.sizeBytes)}${typeof attachment.autoDownloadLimitBytes === "number" ? `, above the ${formatMebibytes(attachment.autoDownloadLimitBytes)} automatic download limit` : ""}. ` : "";
+      children.push(`<download-instruction>${sizeNote}Call ${action3}. The tool downloads the file into the same Slack inbound attachment directory and returns its local_path. Do not ask the sender to reattach it.</download-instruction>`);
+    } else {
+      children.push(`<download-retry>Automatic download did not complete. Call ${action3} to retry. The action may return a precise error if Slack still cannot provide the file.</download-retry>`);
+    }
+  }
   if (children.length > 0) {
     return `<attachment ${attrs.join(" ")}>
   ${children.join(`
@@ -177380,7 +177705,7 @@ ${escapeXmlText(replyContext.text)}
   }
   return `<reply-context${attrString} />`;
 }
-function buildThreadContextEntryXml(tagName, entry) {
+function buildThreadContextEntryXml(tagName, entry, context3) {
   const attrs = [];
   if (entry.senderId) {
     attrs.push(`sender_id="${escapeXmlAttribute(entry.senderId)}"`);
@@ -177394,7 +177719,10 @@ function buildThreadContextEntryXml(tagName, entry) {
   const attrString = attrs.length > 0 ? ` ${attrs.join(" ")}` : "";
   const body = [
     ...entry.text ? [escapeXmlText(entry.text)] : [],
-    ...(entry.attachments ?? []).map(buildAttachmentXml)
+    ...(entry.attachments ?? []).map((attachment) => buildAttachmentXml(attachment, {
+      ...context3,
+      messageId: entry.messageId
+    }))
   ].join(`
 `);
   return `<${tagName}${attrString}>
@@ -177408,13 +177736,21 @@ function buildThreadContextXml(msg) {
   }
   const parts = [];
   if (threadContext.starter) {
-    parts.push(buildThreadContextEntryXml("thread-starter", threadContext.starter));
+    parts.push(buildThreadContextEntryXml("thread-starter", threadContext.starter, {
+      channel: msg.channel,
+      accountId: msg.accountId,
+      chatId: msg.chatId
+    }));
   }
   const historyEntries = threadContext.history ?? [];
   if (historyEntries.length > 0) {
     parts.push([
       "<thread-history>",
-      ...historyEntries.map((entry) => buildThreadContextEntryXml("thread-message", entry)),
+      ...historyEntries.map((entry) => buildThreadContextEntryXml("thread-message", entry, {
+        channel: msg.channel,
+        accountId: msg.accountId,
+        chatId: msg.chatId
+      })),
       "</thread-history>"
     ].join(`
 `));
@@ -177449,7 +177785,12 @@ function buildChannelNotificationXml(msg) {
   const reactionXml = buildReactionXml(msg);
   const replyContextXml = buildReplyContextXml(msg);
   const threadContextXml = buildThreadContextXml(msg);
-  const attachmentXml = (msg.attachments ?? []).map(buildAttachmentXml);
+  const attachmentXml = (msg.attachments ?? []).map((attachment) => buildAttachmentXml(attachment, {
+    channel: msg.channel,
+    accountId: msg.accountId,
+    chatId: msg.chatId,
+    messageId: msg.messageId
+  }));
   const body = [
     threadContextXml,
     replyContextXml,
@@ -179705,7 +180046,10 @@ This tool is currently scoped to a routed external channel turn. Plain assistant
   const slackWorkAcknowledgement = discovery.activeChannels.includes("slack") ? `
 
 For Slack requests that require nontrivial work or several tool calls, send one short MessageChannel call with action="send" before starting other tools. This gives the Slack user verbal acknowledgement and a View in web link. Do not do this for no-ops, reaction-only responses, or simple no-tool answers.` : "";
-  return `${description}${scopedReplyContract}${slackWorkAcknowledgement}
+  const slackAttachmentDownload = discovery.activeChannels.includes("slack") ? `
+
+Slack attachments that exceed the automatic download limit include an exact recovery instruction. Use action="download-file" with channel, chat_id, attachmentId, and messageId from that instruction. The action saves the file in the normal Slack inbound attachment directory and returns its local_path.` : "";
+  return `${description}${scopedReplyContract}${slackWorkAcknowledgement}${slackAttachmentDownload}
 
 Currently active channels: ${channelList}. Available actions across the active channels: ${actionList}. The JSON schema reflects the currently active channel plugins.`;
 }
@@ -183403,7 +183747,7 @@ var init_apply_patch = __esm(() => {
 });
 
 // src/tools/impl/artifact-files.ts
-import { mkdir as mkdir6, readFile as readFile6, stat as stat3, writeFile as writeFile9 } from "node:fs/promises";
+import { mkdir as mkdir6, readFile as readFile5, stat as stat3, writeFile as writeFile8 } from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
 import { dirname as dirname7, isAbsolute as isAbsolute5, join as join19, relative as relative2, resolve as resolve8 } from "node:path";
 function assertArtifactsExperimentEnabled(toolName) {
@@ -183461,7 +183805,7 @@ async function read_artifact_file(args) {
   if (stats.size > MAX_READ_FILE_BYTES) {
     throw new Error(`read_artifact_file: file is too large to read (${stats.size} bytes)`);
   }
-  const buffer = await readFile6(absolutePath);
+  const buffer = await readFile5(absolutePath);
   return {
     path: relativePath,
     content: buffer.toString(encoding),
@@ -183475,7 +183819,7 @@ async function write_artifact_file(args) {
   const encoding = getEncoding(args.encoding);
   const buffer = Buffer.from(args.content, encoding);
   await mkdir6(dirname7(absolutePath), { recursive: true });
-  await writeFile9(absolutePath, buffer);
+  await writeFile8(absolutePath, buffer);
   return {
     path: relativePath,
     bytes: buffer.byteLength,
@@ -184164,6 +184508,9 @@ class TurnLifecycle {
   get activeRunId() {
     return this.#state.kind === "active" ? this.#state.runId : null;
   }
+  get executingToolCallIds() {
+    return this.#state.kind === "active" || this.#state.kind === "cancelling" ? this.#state.executingToolCallIds : [];
+  }
   get lastStopReason() {
     return this.#lastStopReason;
   }
@@ -187318,7 +187665,7 @@ var init_worktree_lock = __esm(() => {
 
 // src/websocket/listener/remote-settings.ts
 import { existsSync as existsSync20, readFileSync as readFileSync16 } from "node:fs";
-import { mkdir as mkdir7, writeFile as writeFile10 } from "node:fs/promises";
+import { mkdir as mkdir7, writeFile as writeFile9 } from "node:fs/promises";
 import { homedir as homedir16 } from "node:os";
 import path12 from "node:path";
 function getRemoteSettingsPath() {
@@ -187362,7 +187709,7 @@ function saveRemoteSettings(updates) {
   };
   const snapshot = _cache;
   const settingsPath = getRemoteSettingsPath();
-  mkdir7(path12.dirname(settingsPath), { recursive: true }).then(() => writeFile10(settingsPath, JSON.stringify(snapshot, null, 2))).catch(() => {});
+  mkdir7(path12.dirname(settingsPath), { recursive: true }).then(() => writeFile9(settingsPath, JSON.stringify(snapshot, null, 2))).catch(() => {});
 }
 function loadLegacyCwdCache() {
   try {
@@ -188157,7 +188504,7 @@ var require_filesystem = __commonJS((exports, module3) => {
     fs5.close(fd, () => {});
     return buffer.subarray(0, bytesRead);
   };
-  var readFile7 = (path13) => new Promise((resolve13, reject) => {
+  var readFile6 = (path13) => new Promise((resolve13, reject) => {
     fs5.open(path13, "r", (err, fd) => {
       if (err) {
         reject(err);
@@ -188174,7 +188521,7 @@ var require_filesystem = __commonJS((exports, module3) => {
     LDD_PATH,
     SELF_PATH,
     readFileSync: readFileSync19,
-    readFile: readFile7
+    readFile: readFile6
   };
 });
 
@@ -188216,7 +188563,7 @@ var require_elf = __commonJS((exports, module3) => {
 var require_detect_libc = __commonJS((exports, module3) => {
   var childProcess = __require("child_process");
   var { isLinux, getReport } = require_process();
-  var { LDD_PATH, SELF_PATH, readFile: readFile7, readFileSync: readFileSync19 } = require_filesystem();
+  var { LDD_PATH, SELF_PATH, readFile: readFile6, readFileSync: readFileSync19 } = require_filesystem();
   var { interpreterPath } = require_elf();
   var cachedFamilyInterpreter;
   var cachedFamilyFilesystem;
@@ -188296,7 +188643,7 @@ var require_detect_libc = __commonJS((exports, module3) => {
     }
     cachedFamilyFilesystem = null;
     try {
-      const lddContent = await readFile7(LDD_PATH);
+      const lddContent = await readFile6(LDD_PATH);
       cachedFamilyFilesystem = getFamilyFromLddContent(lddContent);
     } catch (e2) {}
     return cachedFamilyFilesystem;
@@ -188318,7 +188665,7 @@ var require_detect_libc = __commonJS((exports, module3) => {
     }
     cachedFamilyInterpreter = null;
     try {
-      const selfContent = await readFile7(SELF_PATH);
+      const selfContent = await readFile6(SELF_PATH);
       const path13 = interpreterPath(selfContent);
       cachedFamilyInterpreter = familyFromInterpreterPath(path13);
     } catch (e2) {}
@@ -188378,7 +188725,7 @@ var require_detect_libc = __commonJS((exports, module3) => {
     }
     cachedVersionFilesystem = null;
     try {
-      const lddContent = await readFile7(LDD_PATH);
+      const lddContent = await readFile6(LDD_PATH);
       const versionMatch = lddContent.match(RE_GLIBC_VERSION);
       if (versionMatch) {
         cachedVersionFilesystem = versionMatch[1];
@@ -194572,7 +194919,7 @@ __export(exports_image_resize_sips, {
   convertHeicToJpegWithSips: () => convertHeicToJpegWithSips
 });
 import { execFile as execFile2 } from "node:child_process";
-import { mkdtemp, readFile as readFile7, rm as rm2, writeFile as writeFile11 } from "node:fs/promises";
+import { mkdtemp, readFile as readFile6, rm as rm3, writeFile as writeFile10 } from "node:fs/promises";
 import { tmpdir as tmpdir6 } from "node:os";
 import { join as join29 } from "node:path";
 function execFileAsync2(file3, args) {
@@ -194591,7 +194938,7 @@ async function convertHeicToJpegWithSips(buffer) {
   const inputPath = join29(workDir, "input.heic");
   const outputPath = join29(workDir, "output.jpg");
   try {
-    await writeFile11(inputPath, buffer);
+    await writeFile10(inputPath, buffer);
     await execFileAsync2("/usr/bin/sips", [
       "-s",
       "format",
@@ -194603,9 +194950,9 @@ async function convertHeicToJpegWithSips(buffer) {
       "--out",
       outputPath
     ]);
-    return Buffer.from(await readFile7(outputPath));
+    return Buffer.from(await readFile6(outputPath));
   } finally {
-    await rm2(workDir, { recursive: true, force: true });
+    await rm3(workDir, { recursive: true, force: true });
   }
 }
 var init_image_resize_sips = () => {};
@@ -194685,13 +195032,40 @@ async function normalizeMessageContentImages(content, resize = resizeImageIfNeed
   const filteredParts = normalizedParts.filter((part) => part !== null);
   return didChange ? filteredParts : content;
 }
-async function normalizeMessageImageParts(messages, resize = resizeImageIfNeeded3) {
+async function normalizeApprovalImages(message, resize, failureMode) {
+  if (!Array.isArray(message.approvals)) {
+    return message;
+  }
   let didChange = false;
+  const approvals = await Promise.all(message.approvals.map(async (approval) => {
+    if (!("tool_return" in approval)) {
+      return approval;
+    }
+    const toolReturn = await normalizeMessageContentImages(approval.tool_return, resize, failureMode);
+    if (toolReturn === approval.tool_return) {
+      return approval;
+    }
+    didChange = true;
+    return {
+      ...approval,
+      tool_return: toolReturn
+    };
+  }));
+  return didChange ? { ...message, approvals } : message;
+}
+async function normalizeMessageImageParts(messages, options3 = {}) {
+  let didChange = false;
+  const resize = options3.resize ?? resizeImageIfNeeded3;
   const normalizedMessages = await Promise.all(messages.map(async (message) => {
+    const failureMode = getImageFailureMode(message, options3.failureModesByMessageOtid);
     if (!("content" in message)) {
-      return message;
+      const normalizedApproval = await normalizeApprovalImages(message, resize, failureMode);
+      if (normalizedApproval !== message) {
+        didChange = true;
+      }
+      return normalizedApproval;
     }
-    const normalizedContent = await normalizeMessageContentImages(message.content, resize);
+    const normalizedContent = await normalizeMessageContentImages(message.content, resize, failureMode);
     if (normalizedContent !== message.content) {
       didChange = true;
       return {
@@ -194703,18 +195077,51 @@ async function normalizeMessageImageParts(messages, resize = resizeImageIfNeeded
   }));
   return didChange ? normalizedMessages : messages;
 }
+function getImageFailureMode(message, failureModesByMessageOtid) {
+  if (!failureModesByMessageOtid) {
+    return "strict";
+  }
+  const otid = message.otid;
+  return typeof otid === "string" ? failureModesByMessageOtid[otid] ?? "strict" : "strict";
+}
+function buildImageFailureModesByMessageOtid(messages, failureMode) {
+  const entries = [];
+  for (const message of messages) {
+    if (!("content" in message)) {
+      continue;
+    }
+    const otid = message.otid;
+    if (typeof otid === "string" && otid.length > 0) {
+      entries.push([otid, failureMode]);
+    }
+  }
+  return entries.length > 0 ? Object.fromEntries(entries) : undefined;
+}
+function mergeImageFailureModesByMessageOtid(...failureModes) {
+  const presentModes = failureModes.filter((modes) => modes !== undefined);
+  return presentModes.length > 0 ? Object.assign({}, ...presentModes) : undefined;
+}
 function assertSupportedBase64ImageMediaTypes(messages) {
   for (const message of messages) {
-    if (!("content" in message) || typeof message.content === "string") {
+    if ("content" in message) {
+      assertSupportedBase64ImageContent(message.content);
       continue;
     }
-    for (const part of message.content) {
-      if (!isBase64ImageContentPart(part)) {
+    for (const approval of message.approvals ?? []) {
+      if (!("tool_return" in approval)) {
         continue;
       }
-      if (!isSupportedBase64ImageMediaType(part.source.media_type)) {
-        throw new Error(`Unsupported base64 image media type after normalization: ${part.source.media_type}`);
-      }
+      assertSupportedBase64ImageContent(approval.tool_return);
+    }
+  }
+}
+function assertSupportedBase64ImageContent(content) {
+  if (typeof content === "string") {
+    return;
+  }
+  for (const part of content) {
+    if (isBase64ImageContentPart(part) && !isSupportedBase64ImageMediaType(part.source.media_type)) {
+      throw new Error(`Unsupported base64 image media type after normalization: ${part.source.media_type}`);
     }
   }
 }
@@ -194927,7 +195334,7 @@ __export(exports_skills2, {
   GLOBAL_SKILLS_DIR: () => GLOBAL_SKILLS_DIR
 });
 import { existsSync as existsSync22 } from "node:fs";
-import { readdir as readdir3, readFile as readFile8, realpath, stat as stat4 } from "node:fs/promises";
+import { readdir as readdir3, readFile as readFile7, realpath, stat as stat4 } from "node:fs/promises";
 import { dirname as dirname12, join as join30 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getBundledSkillsPath() {
@@ -195099,7 +195506,7 @@ async function findSkillFiles(currentPath, rootPath, skills, errors7, source2, v
   }
 }
 async function parseSkillFile(filePath, rootPath, source2) {
-  const content = await readFile8(filePath, "utf-8");
+  const content = await readFile7(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(content);
   const normalizedRoot = rootPath.endsWith("/") ? rootPath.slice(0, -1) : rootPath;
   const relativePath = filePath.slice(normalizedRoot.length + 1);
@@ -195533,12 +195940,15 @@ function getStreamRequestContext(stream11) {
   return streamRequestContexts.get(stream11);
 }
 function buildConversationMessagesCreateRequestBody(conversationId, messages, opts = { streamTokens: true, background: true }, clientTools, clientSkills = []) {
+  return buildRequestBodyFromPreparedMessages(conversationId, normalizeOutgoingApprovalMessages(messages, opts.approvalNormalization), opts, clientTools, clientSkills);
+}
+function buildRequestBodyFromPreparedMessages(conversationId, messages, opts, clientTools, clientSkills) {
   const isDefaultConversation = conversationId === "default";
   if (isDefaultConversation && !opts.agentId) {
     throw new Error("agentId is required in opts when using default conversation");
   }
   return {
-    messages: normalizeOutgoingApprovalMessages(messages, opts.approvalNormalization),
+    messages,
     streaming: true,
     stream_tokens: opts.streamTokens ?? true,
     include_pings: true,
@@ -195560,7 +195970,10 @@ async function sendMessageStreamWithBackend(backend, conversationId, messages, o
 }) {
   const requestStartTime = isTimingsEnabled() ? performance.now() : undefined;
   const requestStartedAtMs = Date.now();
-  const normalizedMessages = opts.skipImageNormalization ? messages : await normalizeMessageImageParts(messages);
+  const canonicalMessages = normalizeOutgoingApprovalMessages(messages, opts.approvalNormalization);
+  const normalizedMessages = await normalizeMessageImageParts(canonicalMessages, {
+    failureModesByMessageOtid: opts.imageFailureModesByMessageOtid
+  });
   assertSupportedBase64ImageMediaTypes(normalizedMessages);
   const preparedToolContext = opts.preparedToolContext ? opts.preparedToolContext : await (async () => {
     await waitForToolsetReady();
@@ -195579,7 +195992,7 @@ async function sendMessageStreamWithBackend(backend, conversationId, messages, o
   const isApprovalContinuation = isApprovalContinuationRequest(normalizedMessages);
   const canUsePreviousResponseState = isApprovalContinuation && opts.allowResponseStateReuse === true;
   const previousResponseId = canUsePreviousResponseState ? responseStateIdsByScope.get(responseStateScope) : undefined;
-  const requestBody = buildConversationMessagesCreateRequestBody(conversationId, normalizedMessages, opts, clientTools, clientSkills);
+  const requestBody = buildRequestBodyFromPreparedMessages(conversationId, normalizedMessages, opts, clientTools, clientSkills);
   if (isDebugEnabled()) {
     debugLog("agent-message", "sendMessageStream: conversationId=%s, agentId=%s", conversationId, opts.agentId ?? "(none)");
     const formattedSkills = clientSkills.map((skill) => `${skill.name} (${skill.location})`);
@@ -198391,7 +198804,7 @@ var require_typescript = __commonJS((exports, module3) => {
       walkUpParenthesizedTypesAndGetParentAndChild: () => walkUpParenthesizedTypesAndGetParentAndChild,
       whitespaceOrMapCommentRegExp: () => whitespaceOrMapCommentRegExp,
       writeCommentRange: () => writeCommentRange,
-      writeFile: () => writeFile12,
+      writeFile: () => writeFile11,
       writeFileEnsuringDirectories: () => writeFileEnsuringDirectories,
       zipWith: () => zipWith
     });
@@ -204183,7 +204596,7 @@ ${lanes.join(`
           writeOutputIsTTY() {
             return process.stdout.isTTY;
           },
-          readFile: readFile9,
+          readFile: readFile8,
           writeFile: writeFile22,
           watchFile: watchFile2,
           watchDirectory,
@@ -204376,7 +204789,7 @@ ${lanes.join(`
         function fsWatchWorker(fileOrDirectory, recursive, callback) {
           return _fs.watch(fileOrDirectory, fsSupportsRecursiveFsWatch ? { persistent: true, recursive: !!recursive } : { persistent: true }, callback);
         }
-        function readFile9(fileName, _encoding) {
+        function readFile8(fileName, _encoding) {
           let buffer;
           try {
             buffer = _fs.readFileSync(fileName);
@@ -215700,7 +216113,7 @@ ${lanes.join(`
       sourceFilePath = isSourceFileInCommonSourceDirectory ? sourceFilePath.substring(commonSourceDirectory.length) : sourceFilePath;
       return combinePaths(newDirPath, sourceFilePath);
     }
-    function writeFile12(host, diagnostics2, fileName, text, writeByteOrderMark, sourceFiles, data) {
+    function writeFile11(host, diagnostics2, fileName, text, writeByteOrderMark, sourceFiles, data) {
       host.writeFile(fileName, text, writeByteOrderMark, (hostErrorMessage) => {
         diagnostics2.add(createCompilerDiagnostic(Diagnostics.Could_not_write_file_0_Colon_1, fileName, hostErrorMessage));
       }, sourceFiles, data);
@@ -226153,8 +226566,8 @@ ${lanes.join(`
       return;
     }
     function tryRenameExternalModule(factory2, moduleName, sourceFile) {
-      const rename = sourceFile.renamedDependencies && sourceFile.renamedDependencies.get(moduleName.text);
-      return rename ? factory2.createStringLiteral(rename) : undefined;
+      const rename2 = sourceFile.renamedDependencies && sourceFile.renamedDependencies.get(moduleName.text);
+      return rename2 ? factory2.createStringLiteral(rename2) : undefined;
     }
     function tryGetModuleNameFromFile(factory2, file3, host, options3) {
       if (!file3) {
@@ -228683,8 +229096,8 @@ ${lanes.join(`
       function isMissingList(arr) {
         return !!arr.isMissingList;
       }
-      function parseBracketedList(kind, parseElement, open2, close) {
-        if (parseExpected(open2)) {
+      function parseBracketedList(kind, parseElement, open3, close) {
+        if (parseExpected(open3)) {
           const result = parseDelimitedList(kind, parseElement);
           parseExpected(close);
           return result;
@@ -230389,12 +230802,12 @@ ${lanes.join(`
         parseExpected(20);
         return finishNode(factory2.createJsxSpreadAttribute(expression), pos);
       }
-      function parseJsxClosingElement(open2, inExpressionContext) {
+      function parseJsxClosingElement(open3, inExpressionContext) {
         const pos = getNodePos();
         parseExpected(31);
         const tagName = parseJsxElementName();
         if (parseExpected(32, undefined, false)) {
-          if (inExpressionContext || !tagNamesAreEquivalent(open2.tagName, tagName)) {
+          if (inExpressionContext || !tagNamesAreEquivalent(open3.tagName, tagName)) {
             nextToken();
           } else {
             scanJsxText();
@@ -235323,7 +235736,7 @@ ${lanes.join(`
       const possibleOption = getSpellingSuggestion(unknownOption, diagnostics2.optionDeclarations, getOptionName);
       return possibleOption ? createDiagnosticForNodeInSourceFileOrCompilerDiagnostic(sourceFile, node, diagnostics2.unknownDidYouMeanDiagnostic, unknownOptionErrorText || unknownOption, possibleOption.name) : createDiagnosticForNodeInSourceFileOrCompilerDiagnostic(sourceFile, node, diagnostics2.unknownOptionDiagnostic, unknownOptionErrorText || unknownOption);
     }
-    function parseCommandLineWorker(diagnostics2, commandLine, readFile9) {
+    function parseCommandLineWorker(diagnostics2, commandLine, readFile8) {
       const options3 = {};
       let watchOptions;
       const fileNames = [];
@@ -235361,7 +235774,7 @@ ${lanes.join(`
         }
       }
       function parseResponseFile(fileName) {
-        const text = tryReadFile(fileName, readFile9 || ((fileName2) => sys.readFile(fileName2)));
+        const text = tryReadFile(fileName, readFile8 || ((fileName2) => sys.readFile(fileName2)));
         if (!isString(text)) {
           errors7.push(text);
           return;
@@ -235464,8 +235877,8 @@ ${lanes.join(`
       unknownDidYouMeanDiagnostic: Diagnostics.Unknown_compiler_option_0_Did_you_mean_1,
       optionTypeMismatchDiagnostic: Diagnostics.Compiler_option_0_expects_an_argument
     };
-    function parseCommandLine(commandLine, readFile9) {
-      return parseCommandLineWorker(compilerOptionsDidYouMeanDiagnostics, commandLine, readFile9);
+    function parseCommandLine(commandLine, readFile8) {
+      return parseCommandLineWorker(compilerOptionsDidYouMeanDiagnostics, commandLine, readFile8);
     }
     function getOptionFromName(optionName, allowShort) {
       return getOptionDeclarationFromName(getOptionsNameMap, optionName, allowShort);
@@ -235533,8 +235946,8 @@ ${lanes.join(`
       result.originalFileName = result.fileName;
       return parseJsonSourceFileConfigFileContent(result, host, getNormalizedAbsolutePath(getDirectoryPath(configFileName), cwd), optionsToExtend, getNormalizedAbsolutePath(configFileName, cwd), undefined, extraFileExtensions, extendedConfigCache, watchOptionsToExtend);
     }
-    function readConfigFile(fileName, readFile9) {
-      const textOrDiagnostic = tryReadFile(fileName, readFile9);
+    function readConfigFile(fileName, readFile8) {
+      const textOrDiagnostic = tryReadFile(fileName, readFile8);
       return isString(textOrDiagnostic) ? parseConfigFileTextToJson(fileName, textOrDiagnostic) : { config: {}, error: textOrDiagnostic };
     }
     function parseConfigFileTextToJson(fileName, jsonText) {
@@ -235544,14 +235957,14 @@ ${lanes.join(`
         error: jsonSourceFile.parseDiagnostics.length ? jsonSourceFile.parseDiagnostics[0] : undefined
       };
     }
-    function readJsonConfigFile(fileName, readFile9) {
-      const textOrDiagnostic = tryReadFile(fileName, readFile9);
+    function readJsonConfigFile(fileName, readFile8) {
+      const textOrDiagnostic = tryReadFile(fileName, readFile8);
       return isString(textOrDiagnostic) ? parseJsonText(fileName, textOrDiagnostic) : { fileName, parseDiagnostics: [textOrDiagnostic] };
     }
-    function tryReadFile(fileName, readFile9) {
+    function tryReadFile(fileName, readFile8) {
       let text;
       try {
-        text = readFile9(fileName);
+        text = readFile8(fileName);
       } catch (e2) {
         return createCompilerDiagnostic(Diagnostics.Cannot_read_file_0_Colon_1, fileName, e2.message);
       }
@@ -298293,7 +298706,7 @@ ${lanes.join(`
           return;
         }
         const buildInfo = host.getBuildInfo() || { version: version2 };
-        writeFile12(host, emitterDiagnostics, buildInfoPath, getBuildInfoText(buildInfo), false, undefined, { buildInfo });
+        writeFile11(host, emitterDiagnostics, buildInfoPath, getBuildInfoText(buildInfo), false, undefined, { buildInfo });
         emittedFilesList == null || emittedFilesList.push(buildInfoPath);
       }
       function emitJsFileOrBundle(sourceFileOrBundle, jsFilePath, sourceMapFilePath) {
@@ -298452,14 +298865,14 @@ ${lanes.join(`
           }
           if (sourceMapFilePath) {
             const sourceMap = sourceMapGenerator.toString();
-            writeFile12(host, emitterDiagnostics, sourceMapFilePath, sourceMap, false, sourceFiles);
+            writeFile11(host, emitterDiagnostics, sourceMapFilePath, sourceMap, false, sourceFiles);
           }
         } else {
           writer.writeLine();
         }
         const text = writer.getText();
         const data = { sourceMapUrlPos, diagnostics: transform22.diagnostics };
-        writeFile12(host, emitterDiagnostics, jsFilePath, text, !!compilerOptions.emitBOM, sourceFiles, data);
+        writeFile11(host, emitterDiagnostics, jsFilePath, text, !!compilerOptions.emitBOM, sourceFiles, data);
         writer.clear();
         return !data.skippedDtsWrite;
       }
@@ -302981,12 +303394,12 @@ ${lanes.join(`
     function createCompilerHost(options3, setParentNodes) {
       return createCompilerHostWorker(options3, setParentNodes);
     }
-    function createGetSourceFile(readFile9, setParentNodes) {
+    function createGetSourceFile(readFile8, setParentNodes) {
       return (fileName, languageVersionOrOptions, onError) => {
         let text;
         try {
           mark("beforeIORead");
-          text = readFile9(fileName);
+          text = readFile8(fileName);
           mark("afterIORead");
           measure("I/O Read", "beforeIORead", "afterIORead");
         } catch (e2) {
@@ -303777,7 +304190,7 @@ ${lanes.join(`
         getRedirectFromOutput,
         forEachResolvedProjectReference: forEachResolvedProjectReference2
       });
-      const readFile9 = host.readFile.bind(host);
+      const readFile8 = host.readFile.bind(host);
       (_e = tracing) == null || _e.push(tracing.Phase.Program, "shouldProgramCreateNewSourceFiles", { hasOldProgram: !!oldProgram });
       const shouldCreateNewSourceFile = shouldProgramCreateNewSourceFiles(oldProgram, options3);
       (_f = tracing) == null || _f.pop();
@@ -303953,7 +304366,7 @@ ${lanes.join(`
         shouldTransformImportCall,
         emitBuildInfo,
         fileExists,
-        readFile: readFile9,
+        readFile: readFile8,
         directoryExists,
         getSymlinkCache,
         realpath: (_o = host.realpath) == null ? undefined : _o.bind(host),
@@ -330254,11 +330667,11 @@ ${newComment.split(`
     }
     function convertNamedExport(sourceFile, assignment, changes, exports2) {
       const { text } = assignment.left.name;
-      const rename = exports2.get(text);
-      if (rename !== undefined) {
+      const rename2 = exports2.get(text);
+      if (rename2 !== undefined) {
         const newNodes = [
-          makeConst(undefined, rename, assignment.right),
-          makeExportDeclaration([factory.createExportSpecifier(false, rename, text)])
+          makeConst(undefined, rename2, assignment.right),
+          makeExportDeclaration([factory.createExportSpecifier(false, rename2, text)])
         ];
         changes.replaceNodeWithNodes(sourceFile, assignment.parent, newNodes);
       } else {
@@ -346878,11 +347291,11 @@ ${content}
         }
         return createOutliningSpanFromBounds(node.getStart(sourceFile), node.getEnd(), "code");
       }
-      function spanForObjectOrArrayLiteral(node, open2 = 19) {
-        return spanForNode(node, false, !isArrayLiteralExpression(node.parent) && !isCallExpression(node.parent), open2);
+      function spanForObjectOrArrayLiteral(node, open3 = 19) {
+        return spanForNode(node, false, !isArrayLiteralExpression(node.parent) && !isCallExpression(node.parent), open3);
       }
-      function spanForNode(hintSpanNode, autoCollapse = false, useFullStart = true, open2 = 19, close = open2 === 19 ? 20 : 24) {
-        const openToken = findChildOfKind(n, open2, sourceFile);
+      function spanForNode(hintSpanNode, autoCollapse = false, useFullStart = true, open3 = 19, close = open3 === 19 ? 20 : 24) {
+        const openToken = findChildOfKind(n, open3, sourceFile);
         const closeToken = findChildOfKind(n, close, sourceFile);
         return openToken && closeToken && spanBetweenTokens(openToken, closeToken, hintSpanNode, sourceFile, autoCollapse, useFullStart);
       }
@@ -349150,9 +349563,9 @@ ${options3.prefix}` : `
       return end;
     }
     function getClassOrObjectBraceEnds(cls, sourceFile) {
-      const open2 = findChildOfKind(cls, 19, sourceFile);
+      const open3 = findChildOfKind(cls, 19, sourceFile);
       const close = findChildOfKind(cls, 20, sourceFile);
-      return [open2 == null ? undefined : open2.end, close == null ? undefined : close.end];
+      return [open3 == null ? undefined : open3.end, close == null ? undefined : close.end];
     }
     function getMembersOrProperties(node) {
       return isObjectLiteralExpression(node) ? node.properties : node.members;
@@ -354391,7 +354804,7 @@ ${options3.prefix}` : `
       walkUpParenthesizedTypesAndGetParentAndChild: () => walkUpParenthesizedTypesAndGetParentAndChild,
       whitespaceOrMapCommentRegExp: () => whitespaceOrMapCommentRegExp,
       writeCommentRange: () => writeCommentRange,
-      writeFile: () => writeFile12,
+      writeFile: () => writeFile11,
       writeFileEnsuringDirectories: () => writeFileEnsuringDirectories,
       zipWith: () => zipWith
     });
@@ -367596,7 +368009,8 @@ function buildLoopStatus(runtime, params) {
   if (!listener) {
     return {
       status: "WAITING_ON_INPUT",
-      active_run_ids: []
+      active_run_ids: [],
+      executing_tool_call_ids: []
     };
   }
   const scope = getScopeForRuntime(runtime, params);
@@ -367608,7 +368022,8 @@ function buildLoopStatus(runtime, params) {
   const status = interruptedCacheActive ? !conversationRuntime?.isProcessing ? "WAITING_ON_INPUT" : conversationRuntime?.loopStatus === "WAITING_ON_APPROVAL" ? "WAITING_ON_INPUT" : conversationRuntime?.loopStatus ?? "WAITING_ON_INPUT" : recovered && recovered.pendingRequestIds.size > 0 && conversationRuntime?.loopStatus === "WAITING_ON_INPUT" ? "WAITING_ON_APPROVAL" : conversationRuntime?.loopStatus ?? "WAITING_ON_INPUT";
   return {
     status,
-    active_run_ids: interruptedCacheActive && !conversationRuntime?.isProcessing ? [] : conversationRuntime?.activeRunId ? [conversationRuntime.activeRunId] : []
+    active_run_ids: interruptedCacheActive && !conversationRuntime?.isProcessing ? [] : conversationRuntime?.activeRunId ? [conversationRuntime.activeRunId] : [],
+    executing_tool_call_ids: status === "EXECUTING_CLIENT_SIDE_TOOL" && conversationRuntime ? [...conversationRuntime.turnLifecycle.executingToolCallIds] : []
   };
 }
 function buildQueueSnapshot(runtime, params) {
@@ -368054,6 +368469,13 @@ async function switchCurrentRuntimeWorkingDirectory(workingDirectory) {
   process.env.USER_CWD = workingDirectory;
   updateRuntimeContext({ workingDirectory });
 }
+async function updateToolExecutionContextCwd(executionContextId, workingDirectory) {
+  if (!executionContextId) {
+    return;
+  }
+  const { updateToolExecutionContextWorkingDirectory } = await init_manager4().then(() => exports_manager2);
+  updateToolExecutionContextWorkingDirectory(executionContextId, workingDirectory);
+}
 async function switchConversationWorkingDirectory(params) {
   const { runtime, workingDirectory } = params;
   const agentId = normalizeCwdAgentId(params.agentId);
@@ -368227,7 +368649,7 @@ import {
   lstat,
   mkdir as mkdir8,
   readdir as readdir5,
-  readFile as readFile9,
+  readFile as readFile8,
   realpath as realpath2,
   rmdir,
   stat as stat6,
@@ -368464,7 +368886,7 @@ async function readProvisionConfig(primaryRoot) {
     include: []
   };
   try {
-    const raw = await readFile9(path19.join(primaryRoot, ".letta", "settings.json"), "utf8");
+    const raw = await readFile8(path19.join(primaryRoot, ".letta", "settings.json"), "utf8");
     const parsed = JSON.parse(raw);
     const worktree = parsed.worktree;
     if (!worktree) {
@@ -368556,7 +368978,7 @@ async function copyLocalSettingsFile(primaryRoot, worktreePath) {
 }
 async function readWorktreeIncludeEntries(primaryRoot) {
   try {
-    const raw = await readFile9(path19.join(primaryRoot, ".worktreeinclude"), "utf8");
+    const raw = await readFile8(path19.join(primaryRoot, ".worktreeinclude"), "utf8");
     return raw.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
   } catch {
     return [];
@@ -368657,13 +369079,10 @@ async function switchSessionToWorktree(params) {
       agentId: runtimeContext.agentId ?? null,
       conversationId: runtimeContext.conversationId
     });
-    return true;
-  }
-  await switchCurrentRuntimeWorkingDirectory(worktreePath);
-  if (params.executionContextId) {
-    const { updateToolExecutionContextWorkingDirectory } = await init_manager4().then(() => exports_manager2);
-    updateToolExecutionContextWorkingDirectory(params.executionContextId, worktreePath);
+  } else {
+    await switchCurrentRuntimeWorkingDirectory(worktreePath);
   }
+  await updateToolExecutionContextCwd(params.executionContextId, worktreePath);
   return true;
 }
 async function resolveWorktreeGitDir(worktreePath) {
@@ -371064,15 +371483,15 @@ var require_parse3 = __commonJS((exports, module3) => {
       }
       if (value === "{" && opts.nobrace !== true) {
         increment("braces");
-        const open2 = {
+        const open3 = {
           type: "brace",
           value,
           output: "(",
           outputIndex: state.output.length,
           tokensIndex: state.tokens.length
         };
-        braces.push(open2);
-        push(open2);
+        braces.push(open3);
+        push(open3);
         continue;
       }
       if (value === "}") {
@@ -371723,12 +372142,12 @@ var init_list_directory_gemini = __esm(() => {
 import { existsSync as existsSync27 } from "node:fs";
 import {
   mkdir as mkdir9,
-  readFile as readFile10,
-  rename,
-  rm as rm3,
+  readFile as readFile9,
+  rename as rename2,
+  rm as rm4,
   stat as stat8,
   unlink as unlink2,
-  writeFile as writeFile12
+  writeFile as writeFile11
 } from "node:fs/promises";
 import { dirname as dirname14, isAbsolute as isAbsolute15, relative as relative3, resolve as resolve18 } from "node:path";
 async function getMemoryWriteSyncMode() {
@@ -371809,7 +372228,7 @@ async function applyMemoryCommand(memoryDir, args) {
       throw new Error(`memory create: block already exists at ${pathArg}`);
     }
     await mkdir9(dirname14(filePath), { recursive: true });
-    await writeFile12(filePath, rendered, "utf8");
+    await writeFile11(filePath, rendered, "utf8");
     return [relPath];
   }
   if (command === "str_replace") {
@@ -371826,7 +372245,7 @@ async function applyMemoryCommand(memoryDir, args) {
     }
     const nextBody = `${file3.body.slice(0, idx)}${newString}${file3.body.slice(idx + oldString.length)}`;
     const rendered = renderMemoryFile(file3.frontmatter, nextBody);
-    await writeFile12(filePath, rendered, "utf8");
+    await writeFile11(filePath, rendered, "utf8");
     return [relPath];
   }
   if (command === "insert") {
@@ -371849,7 +372268,7 @@ async function applyMemoryCommand(memoryDir, args) {
     const nextBody = existingLines.join(`
 `);
     const rendered = renderMemoryFile(file3.frontmatter, nextBody);
-    await writeFile12(filePath, rendered, "utf8");
+    await writeFile11(filePath, rendered, "utf8");
     return [relPath];
   }
   if (command === "delete") {
@@ -371858,7 +372277,7 @@ async function applyMemoryCommand(memoryDir, args) {
     const targetPath = resolveMemoryPath(memoryDir, label);
     if (existsSync27(targetPath) && (await stat8(targetPath)).isDirectory()) {
       const relPath2 = toRepoRelative(memoryDir, targetPath);
-      await rm3(targetPath, { recursive: true, force: false });
+      await rm4(targetPath, { recursive: true, force: false });
       return [relPath2];
     }
     const filePath = resolveMemoryFilePath(memoryDir, label);
@@ -371881,7 +372300,7 @@ async function applyMemoryCommand(memoryDir, args) {
     }
     await loadEditableMemoryFile(oldFilePath, oldPathArg);
     await mkdir9(dirname14(newFilePath), { recursive: true });
-    await rename(oldFilePath, newFilePath);
+    await rename2(oldFilePath, newFilePath);
     return [oldRelPath, newRelPath];
   }
   if (command === "update_description") {
@@ -371895,7 +372314,7 @@ async function applyMemoryCommand(memoryDir, args) {
       ...file3.frontmatter,
       description: newDescription
     }, file3.body);
-    await writeFile12(filePath, rendered, "utf8");
+    await writeFile11(filePath, rendered, "utf8");
     return [relPath];
   }
   throw new Error(`Unsupported memory command: ${command}`);
@@ -371986,7 +372405,7 @@ function toRepoRelative(memoryDir, absolutePath) {
   return rel.replace(/\\/g, "/");
 }
 async function loadEditableMemoryFile(filePath, sourcePath) {
-  const content = await readFile10(filePath, "utf8").catch((error54) => {
+  const content = await readFile9(filePath, "utf8").catch((error54) => {
     const message = error54 instanceof Error ? error54.message : String(error54);
     throw new Error(`memory: failed to read ${sourcePath}: ${message}`);
   });
@@ -372082,7 +372501,7 @@ var init_memory4 = __esm(() => {
 
 // src/tools/impl/memory-apply-patch.ts
 import { existsSync as existsSync28 } from "node:fs";
-import { access, mkdir as mkdir10, rm as rm4, stat as stat9, unlink as unlink3 } from "node:fs/promises";
+import { access, mkdir as mkdir10, rm as rm5, stat as stat9, unlink as unlink3 } from "node:fs/promises";
 import { dirname as dirname15, isAbsolute as isAbsolute16, relative as relative4, resolve as resolve19 } from "node:path";
 async function getMemoryWriteSyncMode2() {
   const { getBackend: getBackend2 } = await Promise.resolve().then(() => (init_backend2(), exports_backend));
@@ -372235,7 +372654,7 @@ async function applyMemoryPatch(memoryDir, input) {
       continue;
     const stats = await stat9(absPath);
     if (stats.isDirectory()) {
-      await rm4(absPath, { recursive: true, force: false });
+      await rm5(absPath, { recursive: true, force: false });
     } else {
       await unlink3(absPath);
     }
@@ -373246,6 +373665,7 @@ function normalizeMessageChannelInput(args) {
     replyToMessageId: firstNonEmptyString3(args.replyTo),
     threadId: firstNonEmptyString3(args.threadId) ?? null,
     messageId: firstNonEmptyString3(args.messageId),
+    attachmentId: firstNonEmptyString3(args.attachmentId),
     emoji: firstNonEmptyString3(args.emoji),
     remove: firstDefinedBoolean(args.remove),
     mediaPath: firstNonEmptyString3(args.media),
@@ -373262,6 +373682,7 @@ function buildMessageChannelRequest(input, chatId, threadId) {
     replyToMessageId: input.replyToMessageId,
     threadId: threadId ?? input.threadId ?? null,
     messageId: input.messageId,
+    attachmentId: input.attachmentId,
     emoji: input.emoji,
     remove: input.remove,
     mediaPath: input.mediaPath,
@@ -373367,6 +373788,9 @@ async function message_channel(args) {
   if (typeof input === "string") {
     return input;
   }
+  if (input.channel === "slack" && input.action === "download-file" && input.target) {
+    return "Error: Slack download-file requires chat_id from a routed channel context; target is not supported.";
+  }
   try {
     let executionContext;
     if (input.chatId) {
@@ -373393,8 +373817,9 @@ async function message_channel(args) {
         accountId: resolvedAccountId,
         channelTurnSources: args.channelTurnSources
       });
+      const requestThreadId = input.action === "download-file" ? input.threadId : inferredThreadId ?? route2.threadId ?? input.threadId;
       executionContext = {
-        request: buildMessageChannelRequest(input, input.chatId, inferredThreadId ?? route2.threadId ?? input.threadId),
+        request: buildMessageChannelRequest(input, input.chatId, requestThreadId),
         route: route2,
         adapter: adapter2,
         plugin: plugin2
@@ -375709,10 +376134,10 @@ globstar while`, file3, fr, pattern4, pr, swallowee);
       }
       return filtered.join("/");
     }).join("|");
-    const [open2, close] = set3.length > 1 ? ["(?:", ")"] : ["", ""];
-    re = "^" + open2 + re + close + "$";
+    const [open3, close] = set3.length > 1 ? ["(?:", ")"] : ["", ""];
+    re = "^" + open3 + re + close + "$";
     if (this.partial) {
-      re = "^(?:\\/|" + open2 + re.slice(1, -1) + close + ")$";
+      re = "^(?:\\/|" + open3 + re.slice(1, -1) + close + ")$";
     }
     if (this.negate)
       re = "^(?!" + re + ").+$";
@@ -381703,7 +382128,7 @@ __export(exports_skill, {
   getResolvedSkillsDir: () => getResolvedSkillsDir
 });
 import { existsSync as existsSync29, readdirSync as readdirSync10 } from "node:fs";
-import { readFile as readFile11 } from "node:fs/promises";
+import { readFile as readFile10 } from "node:fs/promises";
 import { dirname as dirname16, join as join34 } from "node:path";
 function getMemorySkillsDirs2(agentId) {
   const dirs = new Set;
@@ -381735,41 +382160,41 @@ async function readSkillContent(skillId, skillsDir, agentId) {
   for (const projectSkillsDir of projectSkillsDirs) {
     const projectSkillPath = join34(projectSkillsDir, skillId, "SKILL.md");
     try {
-      const content = await readFile11(projectSkillPath, "utf-8");
+      const content = await readFile10(projectSkillPath, "utf-8");
       return { content, path: projectSkillPath };
     } catch {}
   }
   if (agentId) {
     const agentSkillPath = join34(getAgentSkillsDir(agentId), skillId, "SKILL.md");
     try {
-      const content = await readFile11(agentSkillPath, "utf-8");
+      const content = await readFile10(agentSkillPath, "utf-8");
       return { content, path: agentSkillPath };
     } catch {}
   }
   for (const memorySkillsDir of getMemorySkillsDirs2(agentId)) {
     const memorySkillPath = join34(memorySkillsDir, skillId, "SKILL.md");
     try {
-      const content = await readFile11(memorySkillPath, "utf-8");
+      const content = await readFile10(memorySkillPath, "utf-8");
       return { content, path: memorySkillPath };
     } catch {}
   }
   const globalSkillPath = join34(GLOBAL_SKILLS_DIR, skillId, "SKILL.md");
   try {
-    const content = await readFile11(globalSkillPath, "utf-8");
+    const content = await readFile10(globalSkillPath, "utf-8");
     return { content, path: globalSkillPath };
   } catch {}
   const bundledSkills = await getBundledSkills();
   const bundledSkill = bundledSkills.find((s2) => s2.id === skillId);
   if (bundledSkill?.path && isSkillAvailableForAgent(bundledSkill, agentId)) {
     try {
-      const content = await readFile11(bundledSkill.path, "utf-8");
+      const content = await readFile10(bundledSkill.path, "utf-8");
       return { content, path: bundledSkill.path };
     } catch {}
   }
   try {
     const bundledSkillsDir = join34(process.cwd(), "skills", "skills");
     const bundledSkillPath = join34(bundledSkillsDir, skillId, "SKILL.md");
-    const content = await readFile11(bundledSkillPath, "utf-8");
+    const content = await readFile10(bundledSkillPath, "utf-8");
     return { content, path: bundledSkillPath };
   } catch {
     throw new Error(`Skill "${skillId}" not found. Check that the skill name is correct and that it appears in the available skills list.`);
@@ -383124,7 +383549,11 @@ function buildSubagentArgs(type3, config3, model, userPrompt, existingAgentId, e
       args.push("--agent", existingAgentId, "--new");
     }
   } else {
-    args.push("--new-agent", "--system", type3);
+    if (options3.systemPromptOverride) {
+      args.push("--new-agent", "--system-custom", options3.systemPromptOverride);
+    } else {
+      args.push("--new-agent", "--system", type3);
+    }
     const subagentTags = [`type:${type3}`];
     if (options3.parentAgentId) {
       subagentTags.push(`parent:${options3.parentAgentId}`);
@@ -383171,7 +383600,7 @@ function buildSubagentArgs(type3, config3, model, userPrompt, existingAgentId, e
   }
   return args;
 }
-async function executeSubagent(type3, config3, model, userPrompt, baseURL, subagentId, isRetry = false, signal, existingAgentId, existingConversationId, maxTurns, parentAgentIdOverride, transcriptPath, memoryScope) {
+async function executeSubagent(type3, config3, model, userPrompt, subagentId, isRetry = false, signal, existingAgentId, existingConversationId, maxTurns, parentAgentIdOverride, transcriptPath, memoryScope, systemPromptOverride) {
   if (signal?.aborted) {
     return {
       agentId: "",
@@ -383199,7 +383628,8 @@ async function executeSubagent(type3, config3, model, userPrompt, baseURL, subag
       backendMode,
       promptTransport: "stdin",
       parentAgentId,
-      extraTools: config3.fork && inheritedChannelContext ? ["MessageChannel"] : undefined
+      extraTools: config3.fork && inheritedChannelContext ? ["MessageChannel"] : undefined,
+      systemPromptOverride
     });
     const launcher = resolveSubagentLauncher(cliArgs);
     const settings3 = await settingsManager.getSettingsWithSecureTokens();
@@ -383314,7 +383744,7 @@ async function executeSubagent(type3, config3, model, userPrompt, baseURL, subag
           agentId: parentAgentIdOverride
         });
         if (primaryModel) {
-          return executeSubagent(type3, config3, primaryModel, userPrompt, baseURL, subagentId, true, signal, undefined, undefined, maxTurns, parentAgentIdOverride, transcriptPath);
+          return executeSubagent(type3, config3, primaryModel, userPrompt, subagentId, true, signal, undefined, undefined, maxTurns, parentAgentIdOverride, transcriptPath);
         }
       }
       const propagatedError = state.finalError?.trim();
@@ -383369,14 +383799,6 @@ async function executeSubagent(type3, config3, model, userPrompt, baseURL, subag
     };
   }
 }
-function getBaseURL() {
-  const settings3 = settingsManager.getSettings();
-  const baseURL = process.env.LETTA_BASE_URL || settings3.env?.LETTA_BASE_URL || "https://api.letta.com";
-  if (baseURL === "https://api.letta.com") {
-    return "https://app.letta.com";
-  }
-  return baseURL;
-}
 function buildDeploySystemReminder(senderAgentName, senderAgentId) {
   return `${SYSTEM_REMINDER_OPEN}
 This task is from "${senderAgentName}" (agent ID: ${senderAgentId}), which deployed you as a subagent inside the Letta Code CLI (docs.letta.com/letta-code).
@@ -383420,7 +383842,7 @@ ${SYSTEM_REMINDER_CLOSE}
 
 `;
 }
-async function spawnSubagent(type3, prompt, userModel, subagentId, signal, existingAgentId, existingConversationId, maxTurns, forkedContext, parentAgentId, transcriptPath, parentConversationId, memoryScope) {
+async function spawnSubagent(type3, prompt, userModel, subagentId, signal, existingAgentId, existingConversationId, maxTurns, forkedContext, parentAgentId, transcriptPath, parentConversationId, memoryScope, systemPromptOverride) {
   const allConfigs = await getAllSubagentConfigs();
   const config3 = allConfigs[type3];
   if (!config3) {
@@ -383459,7 +383881,6 @@ async function spawnSubagent(type3, prompt, userModel, subagentId, signal, exist
     subagentType: type3,
     backendMode
   });
-  const baseURL = getBaseURL();
   let finalPrompt = prompt;
   if (isDeployingExisting && resolvedParentAgentId) {
     try {
@@ -383479,7 +383900,7 @@ async function spawnSubagent(type3, prompt, userModel, subagentId, signal, exist
     });
     updateSubagent(subagentId, { agentURL: forkAgentURL });
   }
-  const result = await executeSubagent(type3, config3, model, finalPrompt, baseURL, subagentId, false, signal, existingAgentId, existingConversationId, maxTurns, resolvedParentAgentId, transcriptPath, memoryScope);
+  const result = await executeSubagent(type3, config3, model, finalPrompt, subagentId, false, signal, existingAgentId, existingConversationId, maxTurns, resolvedParentAgentId, transcriptPath, memoryScope, systemPromptOverride);
   return result;
 }
 var NO_BASE_TOOL_SUBAGENT_TYPES;
@@ -383734,6 +384155,7 @@ function spawnBackgroundSubagentTask(args) {
     prompt,
     description,
     model,
+    systemPromptOverride,
     toolCallId,
     existingAgentId,
     existingConversationId,
@@ -383776,7 +384198,7 @@ function spawnBackgroundSubagentTask(args) {
   backgroundTasks.set(taskId, bgTask);
   writeTaskTranscriptStart(outputFile, description, subagentType);
   const parentAgentIdForSpawn = resolvedParentScope?.agentId;
-  spawnSubagentFn(subagentType, prompt, model, subagentId, abortController.signal, existingAgentId, existingConversationId, maxTurns, forkedContext, parentAgentIdForSpawn, transcriptPath, resolvedParentScope?.conversationId, memoryScope).then(async (result) => {
+  spawnSubagentFn(subagentType, prompt, model, subagentId, abortController.signal, existingAgentId, existingConversationId, maxTurns, forkedContext, parentAgentIdForSpawn, transcriptPath, resolvedParentScope?.conversationId, memoryScope, systemPromptOverride).then(async (result) => {
     bgTask.status = result.success ? "completed" : "failed";
     if (result.error) {
       bgTask.error = result.error;
@@ -387667,8 +388089,8 @@ globstar while`, file3, fr, pattern4, pr, swallowee);
       });
       return pp.filter((p) => p !== GLOBSTAR2).join("/");
     }).join("|");
-    const [open2, close] = set3.length > 1 ? ["(?:", ")"] : ["", ""];
-    re = "^" + open2 + re + close + "$";
+    const [open3, close] = set3.length > 1 ? ["(?:", ")"] : ["", ""];
+    re = "^" + open3 + re + close + "$";
     if (this.negate)
       re = "^(?!" + re + ").+$";
     try {
@@ -393736,16 +394158,16 @@ function toolResultToStoredReturnValue(message) {
     };
   });
 }
-function projectThinkingContent(message, content, contentIndex, date6, agentId, conversationId) {
-  if (content.thinking.length === 0)
+function projectThinkingContent(message, reasoning, contentStartIndex, date6, agentId, conversationId) {
+  if (reasoning.length === 0)
     return;
   return {
-    id: `${message.id}:reasoning:${contentIndex}`,
+    id: `${message.id}:reasoning:${contentStartIndex}`,
     date: date6,
     agent_id: agentId,
     conversation_id: conversationId,
     message_type: "reasoning_message",
-    reasoning: content.thinking
+    reasoning
   };
 }
 function projectToolCallContent(message, content, date6, agentId, conversationId) {
@@ -393815,6 +394237,8 @@ function projectLocalMessageToStoredMessages(message, fallbackAgentId, fallbackC
   const messages = [];
   let pendingTextContent = [];
   let pendingTextStartIndex = -1;
+  let pendingReasoningContent = [];
+  let pendingReasoningStartIndex = -1;
   const flushPendingText = () => {
     if (pendingTextContent.length === 0)
       return;
@@ -393831,29 +394255,46 @@ function projectLocalMessageToStoredMessages(message, fallbackAgentId, fallbackC
     pendingTextContent = [];
     pendingTextStartIndex = -1;
   };
+  const flushPendingReasoning = () => {
+    if (pendingReasoningContent.length > 0) {
+      const reasoningMessage = projectThinkingContent(message, pendingReasoningContent.join(`
+
+`), pendingReasoningStartIndex, date6, agentId, conversationId);
+      if (reasoningMessage)
+        messages.push(reasoningMessage);
+    }
+    pendingReasoningContent = [];
+    pendingReasoningStartIndex = -1;
+  };
   for (let contentIndex = 0;contentIndex < message.content.length; contentIndex++) {
     const content = message.content[contentIndex];
     if (!content)
       continue;
     if (isThinkingContent(content)) {
       flushPendingText();
-      const reasoningMessage = projectThinkingContent(message, content, contentIndex, date6, agentId, conversationId);
-      if (reasoningMessage)
-        messages.push(reasoningMessage);
+      if (content.thinking.length > 0) {
+        if (pendingReasoningStartIndex === -1) {
+          pendingReasoningStartIndex = contentIndex;
+        }
+        pendingReasoningContent.push(content.thinking);
+      }
       continue;
     }
     if (isLocalToolCallContent(content)) {
       flushPendingText();
+      flushPendingReasoning();
       messages.push(projectToolCallContent(message, content, date6, agentId, conversationId));
       continue;
     }
     if (isTextContent(content)) {
+      flushPendingReasoning();
       if (pendingTextStartIndex === -1)
         pendingTextStartIndex = contentIndex;
       pendingTextContent.push({ type: "text", text: content.text });
     }
   }
   flushPendingText();
+  flushPendingReasoning();
   return messages;
 }
 function withProjectedMessageDates(messages, _sourceMessageIndex) {
@@ -394937,7 +395378,7 @@ class LocalStore {
     }
     this.ensureAgent(agentId);
     const conversationId = this.nextConversationId();
-    const conversation = createLocalConversationRecord(conversationId, agentId, this.conversationSeq, body);
+    const conversation = this.withConversationModelDefaults(createLocalConversationRecord(conversationId, agentId, this.conversationSeq, body));
     const key = this.conversationKey(conversation.id, agentId);
     this.conversations.set(key, conversation);
     this.localMessagesByConversationKey.set(key, []);
@@ -394956,32 +395397,31 @@ class LocalStore {
       }
       const created = this.ensureConversation(conversationId);
       const updated2 = updateLocalConversationRecord(created, body, currentIsoTimestamp());
-      const projected = this.applyConversationModelDefaults(updated2, body, created);
+      const projected = this.withConversationModelDefaults(updated2);
       this.conversations.set(this.conversationKey(conversationId, created.agent_id), projected);
       this.persistConversationState(conversationId, created.agent_id);
       return projected;
     }
-    const updated = this.applyConversationModelDefaults(updateLocalConversationRecord(current, body, currentIsoTimestamp()), body, current);
+    const updated = this.withConversationModelDefaults(updateLocalConversationRecord(current, body, currentIsoTimestamp()));
     this.conversations.set(this.conversationKey(conversationId, current.agent_id), updated);
     this.persistConversationState(conversationId, current.agent_id);
     return updated;
   }
-  applyConversationModelDefaults(conversation, body, previousConversation) {
-    const requestedModel = body.model;
+  withConversationModelDefaults(conversation) {
+    const requestedModel = conversation.model;
     if (typeof requestedModel !== "string")
       return conversation;
     const normalizedRequestedModel = normalizeLocalModelHandle(requestedModel, isRecord(conversation.model_settings) ? conversation.model_settings : {});
-    if (previousConversation.model === normalizedRequestedModel)
-      return conversation;
     const defaults5 = this.modelSettingsDefaultsForModel(normalizedRequestedModel);
     if (!defaults5 || Object.keys(defaults5).length === 0)
       return conversation;
     const existingSettings = isRecord(conversation.model_settings) ? conversation.model_settings : {};
     return {
       ...conversation,
+      model: normalizedRequestedModel,
       model_settings: {
-        ...existingSettings,
-        ...defaults5
+        ...defaults5,
+        ...existingSettings
       }
     };
   }
@@ -395877,7 +396317,7 @@ class LocalStore {
     const existing = this.conversations.get(key);
     if (existing && options3.forceRefresh !== true)
       return existing;
-    const normalizedInput = normalizeStoredLocalModelRecord(input);
+    const normalizedInput = this.withConversationModelDefaults(normalizeStoredLocalModelRecord(input));
     const timing = transcriptTimingForConversationDir(conversationDir);
     const requiresFullTimestampRepair = isSyntheticLocalTimestamp(normalizedInput.created_at) || isSyntheticLocalTimestamp(normalizedInput.updated_at) || isSyntheticLocalTimestamp(normalizedInput.last_message_at);
     const conversation = requiresFullTimestampRepair ? normalizedInput : repairSyntheticConversationTimestamps(normalizedInput, [], timing);
@@ -397075,8 +397515,8 @@ var init_error_formatter = __esm(() => {
   init_app_urls();
   init_error_context();
   init_zai_errors();
-  LETTA_USAGE_URL = buildAppUrl("/settings/organization/usage");
-  LETTA_AGENTS_URL = buildAppUrl("/projects/default-project/agents");
+  LETTA_USAGE_URL = buildChatWebUrl("/preferences/usage");
+  LETTA_AGENTS_URL = buildPlatformUrl("/projects/default-project/agents");
   CLOUDFLARE_EDGE_5XX_MARKER_PATTERN = /(^|\s)(502|52[0-6])\s*<!doctype html|error code\s*(502|52[0-6])/i;
   CLOUDFLARE_EDGE_5XX_TITLE_PATTERN = /\|\s*(502|52[0-6])\s*:/i;
   CLOUDFLARE_EDGE_5XX_FORMATTED_PATTERN = /\bCloudflare\s+(502|52[0-6])\b/i;
@@ -399020,24 +399460,6 @@ var init_local_model_config = __esm(() => {
   UNSUPPORTED_LOCAL_CHATGPT_OAUTH_MODELS = new Set(["gpt-5.6-luna"]);
 });
 
-// src/backend/dev/pi-output-budget.ts
-function assertViablePiOutputBudget(model, context3, requestedMaxTokens) {
-  if (model.provider !== "llama-cpp")
-    return;
-  const requested = requestedMaxTokens ?? model.maxTokens;
-  if (!Number.isFinite(requested) || requested <= 0)
-    return;
-  const clamped = clampMaxTokensToContext(model, context3, requested);
-  const minimum3 = Math.min(requested, MIN_VIABLE_OUTPUT_TOKENS);
-  if (clamped >= minimum3)
-    return;
-  throw new Error(`Context window of ${model.contextWindow} tokens leaves only ${clamped} output token${clamped === 1 ? "" : "s"}; at least ${minimum3} are required. Compact the conversation or increase the context window.`);
-}
-var MIN_VIABLE_OUTPUT_TOKENS = 1024;
-var init_pi_output_budget = __esm(() => {
-  init_simple_options();
-});
-
 // src/backend/local/local-context-estimate.ts
 function positiveUsageNumber(value) {
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : undefined;
@@ -399301,12 +399723,26 @@ function errorFromAssistantEvent(part) {
     return new Error("Unknown provider stream error");
   return new Error(part.error.errorMessage ?? "Unknown local provider error");
 }
-function otidForContentIndex(otids, prefix, contentIndex) {
-  const existing = otids.get(contentIndex);
+function contentMatchesMessageType(content, messageType) {
+  if (!content || typeof content !== "object" || !("type" in content)) {
+    return false;
+  }
+  return messageType === "assistant_message" ? content.type === "text" : content.type === "thinking";
+}
+function contiguousContentStartIndex(partial4, contentIndex, messageType) {
+  let startIndex = contentIndex;
+  while (startIndex > 0 && contentMatchesMessageType(partial4.content[startIndex - 1], messageType)) {
+    startIndex -= 1;
+  }
+  return startIndex;
+}
+function otidForContentSegment(otids, prefix, contentIndex, partial4, messageType) {
+  const segmentStartIndex = contiguousContentStartIndex(partial4, contentIndex, messageType);
+  const existing = otids.get(segmentStartIndex);
   if (existing)
     return existing;
-  const otid = `${prefix}-${contentIndex}-${randomUUID20()}`;
-  otids.set(contentIndex, otid);
+  const otid = `${prefix}-${segmentStartIndex}-${randomUUID20()}`;
+  otids.set(segmentStartIndex, otid);
   return otid;
 }
 function createProviderLettaStream(events, contextTokensEstimate) {
@@ -399337,7 +399773,7 @@ function createProviderLettaStream(events, contextTokensEstimate) {
           if (part.type === "text_delta") {
             yield {
               message_type: "assistant_message",
-              otid: otidForContentIndex(assistantOtids, "provider-assistant", part.contentIndex),
+              otid: otidForContentSegment(assistantOtids, "provider-assistant", part.contentIndex, part.partial, "assistant_message"),
               content: [{ type: "text", text: part.delta }]
             };
             continue;
@@ -399345,7 +399781,7 @@ function createProviderLettaStream(events, contextTokensEstimate) {
           if (part.type === "thinking_delta") {
             yield {
               message_type: "reasoning_message",
-              otid: otidForContentIndex(reasoningOtids, "provider-reasoning", part.contentIndex),
+              otid: otidForContentSegment(reasoningOtids, "provider-reasoning", part.contentIndex, part.partial, "reasoning_message"),
               reasoning: part.delta
             };
             continue;
@@ -399372,7 +399808,7 @@ function createProviderLettaStream(events, contextTokensEstimate) {
             }
             pendingStopReason = {
               message_type: "stop_reason",
-              stop_reason: sawToolCall || part.reason === "toolUse" ? "requires_approval" : "end_turn"
+              stop_reason: sawToolCall || part.reason === "toolUse" ? "requires_approval" : part.reason === "length" ? "max_tokens_exceeded" : "end_turn"
             };
             continue;
           }
@@ -399882,7 +400318,6 @@ class PiStreamAdapter {
         messageCount: context3.messages.length,
         contextWindow: resolved.model.contextWindow
       });
-      assertViablePiOutputBudget(resolved.model, context3, options3.maxTokens);
       const result = this.runStream(resolved.model, context3, options3);
       let streamError;
       let finalMessage;
@@ -400023,7 +400458,6 @@ var init_pi_stream_adapter = __esm(() => {
   init_context_window_overflow();
   init_local_provider_errors();
   init_pi_model_factory();
-  init_pi_output_budget();
   init_provider_turn_executor();
   LOCAL_PROVIDER_ADAPTIVE_IMAGE_ELISION_AFTER_RETRIES = LOCAL_PROVIDER_MAX_RETRIES - 1;
   PiProviderError = class PiProviderError extends Error {
@@ -402208,6 +402642,7 @@ __export(exports_oauth2, {
   requestDeviceCode: () => requestDeviceCode2,
   refreshAccessToken: () => refreshAccessToken3,
   pollForToken: () => pollForToken2,
+  OAuthRefreshError: () => OAuthRefreshError2,
   OAUTH_CONFIG: () => OAUTH_CONFIG2,
   LETTA_CLOUD_API_URL: () => LETTA_CLOUD_API_URL2
 });
@@ -402388,11 +402823,22 @@ async function refreshAccessToken3(refreshToken, deviceId, deviceName) {
     });
     if (!response.ok) {
       const error54 = await response.json();
-      throw new Error(`Failed to refresh access token from ${authHost}: ${error54.error_description || error54.error}`);
+      throw new OAuthRefreshError2(`Failed to refresh access token from ${authHost}: ${error54.error_description || error54.error}`, {
+        retryable: response.status === 408 || response.status === 429 || response.status >= 500,
+        status: response.status,
+        oauthCode: error54.error
+      });
     }
     return await response.json();
   } catch (error54) {
-    throw toOAuthActionError2("refresh access token", error54);
+    if (error54 instanceof OAuthRefreshError2) {
+      throw error54;
+    }
+    const actionError = toOAuthActionError2("refresh access token", error54);
+    throw new OAuthRefreshError2(actionError.message, {
+      retryable: true,
+      cause: error54
+    });
   }
 }
 async function revokeToken2(refreshToken) {
@@ -402478,7 +402924,7 @@ function classifyCredentialValidationError2(error54) {
   }
   return { ok: false, reason: "unknown", message };
 }
-var LETTA_CLOUD_API_URL2 = "https://api.letta.com", OAUTH_CONFIG2;
+var LETTA_CLOUD_API_URL2 = "https://api.letta.com", OAUTH_CONFIG2, OAuthRefreshError2;
 var init_oauth4 = __esm(() => {
   init_letta_client();
   init_error();
@@ -402489,6 +402935,18 @@ var init_oauth4 = __esm(() => {
     authBaseUrl: "https://app.letta.com",
     apiBaseUrl: LETTA_CLOUD_API_URL2
   };
+  OAuthRefreshError2 = class OAuthRefreshError2 extends Error {
+    retryable;
+    status;
+    oauthCode;
+    constructor(message, options3) {
+      super(message, { cause: options3.cause });
+      this.name = "OAuthRefreshError";
+      this.retryable = options3.retryable;
+      this.status = options3.status;
+      this.oauthCode = options3.oauthCode;
+    }
+  };
 });
 
 // node_modules/react/cjs/react.development.js
@@ -423490,18 +423948,18 @@ var stdoutColor, stderrColor, GENERATOR, STYLER, IS_EMPTY, levelMapping, styles4
     return getModelAnsi("rgb", level, type3, ...ansi_styles_default2.hexToRgb(...arguments_));
   }
   return ansi_styles_default2[type3][model](...arguments_);
-}, usedModels, proto, createStyler = (open2, close, parent) => {
+}, usedModels, proto, createStyler = (open3, close, parent) => {
   let openAll;
   let closeAll;
   if (parent === undefined) {
-    openAll = open2;
+    openAll = open3;
     closeAll = close;
   } else {
-    openAll = parent.openAll + open2;
+    openAll = parent.openAll + open3;
     closeAll = close + parent.closeAll;
   }
   return {
-    open: open2,
+    open: open3,
     close,
     openAll,
     closeAll,
@@ -441275,7 +441733,7 @@ var init_conversation_search = __esm(() => {
 });
 
 // src/utils/file-lock.ts
-import { open as open2, readFile as readFile14, stat as stat10, unlink as unlink4 } from "node:fs/promises";
+import { open as open3, readFile as readFile13, stat as stat10, unlink as unlink4 } from "node:fs/promises";
 async function withFileLock(lockPath, fn, options3) {
   const opts = { ...DEFAULT_OPTIONS, ...options3 };
   const release = await acquireFileLock(lockPath, opts);
@@ -441293,7 +441751,7 @@ async function acquireFileLock(lockPath, opts) {
   });
   while (true) {
     try {
-      const handle2 = await open2(lockPath, "wx");
+      const handle2 = await open3(lockPath, "wx");
       try {
         await handle2.writeFile(payload, "utf-8");
         await handle2.close();
@@ -441329,7 +441787,7 @@ async function acquireFileLock(lockPath, opts) {
 async function tryReapStaleLock(lockPath, staleMs) {
   let raw2;
   try {
-    raw2 = await readFile14(lockPath, "utf-8");
+    raw2 = await readFile13(lockPath, "utf-8");
   } catch {
     return true;
   }
@@ -441386,9 +441844,9 @@ import {
   appendFile,
   mkdir as mkdir12,
   readdir as readdir8,
-  readFile as readFile15,
+  readFile as readFile14,
   stat as stat11,
-  writeFile as writeFile13
+  writeFile as writeFile12
 } from "node:fs/promises";
 import { join as join46 } from "node:path";
 function buildReflectionSubagentPrompt(input) {
@@ -441446,7 +441904,7 @@ async function collectParentMemoryFiles(memoryDir) {
         continue;
       }
       try {
-        const content = await readFile15(entryPath, "utf-8");
+        const content = await readFile14(entryPath, "utf-8");
         const { frontmatter } = parseFrontmatter(content);
         const description = typeof frontmatter.description === "string" ? frontmatter.description : undefined;
         files.push({
@@ -441775,11 +442233,11 @@ function lineToTranscriptEntry(line, capturedAt) {
 }
 async function ensurePaths(paths) {
   await mkdir12(paths.rootDir, { recursive: true });
-  await writeFile13(paths.transcriptPath, "", { encoding: "utf-8", flag: "a" });
+  await writeFile12(paths.transcriptPath, "", { encoding: "utf-8", flag: "a" });
 }
 async function readTranscriptLines(paths) {
   try {
-    const raw2 = await readFile15(paths.transcriptPath, "utf-8");
+    const raw2 = await readFile14(paths.transcriptPath, "utf-8");
     return raw2.split(`
 `).map((line) => line.trim()).filter((line) => line.length > 0);
   } catch {
@@ -441852,7 +442310,7 @@ function buildUnreflectedStateFromTranscript(lines) {
 async function readState(paths) {
   let raw2 = null;
   try {
-    raw2 = await readFile15(paths.statePath, "utf-8");
+    raw2 = await readFile14(paths.statePath, "utf-8");
   } catch {
     raw2 = null;
   }
@@ -441877,7 +442335,7 @@ async function readState(paths) {
 }
 async function writeState(paths, state) {
   state.steps_since_last_successful_reflection = Math.max(0, state.total_completed_steps - state.reflected_completed_steps);
-  await writeFile13(paths.statePath, `${JSON.stringify(state, null, 2)}
+  await writeFile12(paths.statePath, `${JSON.stringify(state, null, 2)}
 `, "utf-8");
 }
 function buildPayloadPath(rootDir, kind) {
@@ -442255,7 +442713,7 @@ async function buildReflectionAutoPayload(options3) {
     candidates: sortedCandidates
   };
   const candidatesPath = buildPayloadPath(payloadRoot, "candidates");
-  await writeFile13(candidatesPath, `${JSON.stringify(candidateSet, null, 2)}
+  await writeFile12(candidatesPath, `${JSON.stringify(candidateSet, null, 2)}
 `, "utf-8");
   return { candidatesPath, candidates: candidateSet };
 }
@@ -442263,7 +442721,7 @@ function isReflectionAutoPriority(value) {
   return value === "high" || value === "medium" || value === "low";
 }
 async function readReflectionAutoSelection(options3) {
-  const raw2 = options3.selectionReport ?? (options3.selectionOutputPath ? await readFile15(options3.selectionOutputPath, "utf-8") : "");
+  const raw2 = options3.selectionReport ?? (options3.selectionOutputPath ? await readFile14(options3.selectionOutputPath, "utf-8") : "");
   const parsed = parseReflectionAutoSelectionJson(raw2);
   if (!parsed || typeof parsed !== "object") {
     throw new Error("Reflection selector did not return valid JSON.");
@@ -442383,7 +442841,7 @@ async function buildAutoReflectionPayload(agentId, conversationId, systemPrompt)
       return null;
     }
     const payloadPath = buildPayloadPath(paths.rootDir, "auto");
-    await writeFile13(payloadPath, transcript, "utf-8");
+    await writeFile12(payloadPath, transcript, "utf-8");
     state.last_reflection_started_at = new Date().toISOString();
     await writeState(paths, state);
     return {
@@ -442472,7 +442930,7 @@ async function buildMultiReflectionPayload(options3) {
         return null;
       }
       const payloadPath2 = buildPayloadPath(payloadRoot, "slice");
-      await writeFile13(payloadPath2, transcript, "utf-8");
+      await writeFile12(payloadPath2, transcript, "utf-8");
       state.last_reflection_started_at = new Date().toISOString();
       await writeState(paths, state);
       return {
@@ -442514,7 +442972,7 @@ async function buildMultiReflectionPayload(options3) {
     transcripts
   };
   const payloadPath = buildPayloadPath(payloadRoot, "multi");
-  await writeFile13(payloadPath, `${JSON.stringify(manifest, null, 2)}
+  await writeFile12(payloadPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf-8");
   return {
     payloadPath,
@@ -442898,10 +443356,9 @@ async function prepareReflectionMemoryWorktreeLaunch(params) {
     parentMemoryDir: memoryDir
   });
   try {
-    const parentMemory = await buildParentMemorySnapshot(worktree.worktreeDir);
-    const reflectionPrompt = buildReflectionSubagentPrompt({
+    const reflectionPrompt = params.reflectionPromptOverride ?? buildReflectionSubagentPrompt({
       instruction: params.instruction,
-      parentMemory
+      parentMemory: await buildParentMemorySnapshot(worktree.worktreeDir)
     });
     return { worktree, reflectionPrompt };
   } catch (error54) {
@@ -442982,7 +443439,8 @@ async function launchReflectionSubagent(options3) {
     }
     const { worktree, reflectionPrompt } = await prepareReflectionMemoryWorktreeLaunch({
       agentId,
-      instruction: options3.instruction
+      instruction: options3.instruction,
+      reflectionPromptOverride: options3.reflectionPromptOverride
     });
     preparedWorktree = worktree;
     const { spawnBackgroundSubagentTask: spawnBackgroundSubagentTask2, waitForBackgroundSubagentAgentId: waitForBackgroundSubagentAgentId2 } = await Promise.resolve().then(() => (init_task(), exports_task));
@@ -443001,6 +443459,7 @@ async function launchReflectionSubagent(options3) {
       prompt: reflectionPrompt,
       description,
       model: options3.model,
+      systemPromptOverride: options3.reflectionSystemPromptOverride,
       silentCompletion: true,
       transcriptPath: autoPayload.payloadPath,
       memoryScope: buildReflectionMemoryScope(worktree),
@@ -443322,19 +443781,18 @@ function getListenerBlockedReason(lifecycle, pendingApprovalsLen) {
   return null;
 }
 
-// src/websocket/listener/queue.ts
-var exports_queue = {};
-__export(exports_queue, {
-  shouldQueueInboundMessage: () => shouldQueueInboundMessage,
-  shouldProcessInboundMessageDirectly: () => shouldProcessInboundMessageDirectly,
-  scheduleQueuePump: () => scheduleQueuePump,
-  pickBatchActingUserId: () => pickBatchActingUserId,
-  normalizeMessageContentImages: () => normalizeMessageContentImages2,
-  normalizeInboundMessages: () => normalizeInboundMessages,
-  getQueueItemsScope: () => getQueueItemsScope,
-  getQueueItemScope: () => getQueueItemScope,
-  consumeQueuedTurn: () => consumeQueuedTurn
+// src/websocket/listener/image-policy.ts
+function getInboundImageFailureMode(incoming) {
+  return (incoming?.channelTurnSources?.length ?? 0) > 0 ? "drop" : "strict";
+}
+function getInboundImageFailureModes(incoming) {
+  return getInboundImageFailureMode(incoming) === "drop" ? buildImageFailureModesByMessageOtid(incoming.messages, "drop") : undefined;
+}
+var init_image_policy = __esm(async () => {
+  await init_message_image_normalization();
 });
+
+// src/websocket/listener/queue.ts
 function getQueueItemScope(item) {
   if (!item) {
     return {};
@@ -443438,27 +443896,6 @@ async function buildChannelTurnProgressBuilder(agentId) {
     return createChannelTurnProgressBuilder();
   }
 }
-async function normalizeMessageContentImages2(content, resize = resizeImageIfNeeded3, failureMode = "strict") {
-  return await normalizeMessageContentImages(content, resize, failureMode);
-}
-async function normalizeInboundMessages(messages, resize = resizeImageIfNeeded3, options3 = {}) {
-  let didChange = false;
-  const normalizedMessages = await Promise.all(messages.map(async (message) => {
-    if (!("content" in message)) {
-      return message;
-    }
-    const normalizedContent = await normalizeMessageContentImages2(message.content, resize, options3.imageFailureMode ?? "strict");
-    if (normalizedContent !== message.content) {
-      didChange = true;
-      return {
-        ...message,
-        content: normalizedContent
-      };
-    }
-    return message;
-  }));
-  return didChange ? normalizedMessages : messages;
-}
 function getPrimaryQueueMessageItem(items3) {
   for (const item of items3) {
     if (item.kind === "message") {
@@ -443559,10 +443996,18 @@ function consumeQueuedTurn(runtime) {
   let hasTaskNotification = false;
   let hasCronPrompt = false;
   let hasModContinue = false;
+  let batchImageFailureMode = null;
   for (const item of queuedItems) {
     if (!isCoalescable(item.kind) || !hasSameQueueScope(firstQueuedItem, item)) {
       break;
     }
+    if (item.kind === "message") {
+      const itemImageFailureMode = getInboundImageFailureMode(runtime.queuedMessagesByItemId.get(item.id));
+      if (batchImageFailureMode !== null && itemImageFailureMode !== batchImageFailureMode) {
+        break;
+      }
+      batchImageFailureMode = itemImageFailureMode;
+    }
     queueLen += 1;
     if (item.kind === "message") {
       hasMessage = true;
@@ -443695,8 +444140,7 @@ var init_queue = __esm(async () => {
   init_runtime6();
   await __promiseAll([
     init_progress_builder(),
-    init_image_resize(),
-    init_message_image_normalization(),
+    init_image_policy(),
     init_protocol_outbound()
   ]);
 });
@@ -445421,6 +445865,303 @@ var init_approval = __esm(async () => {
   ]);
 });
 
+// src/websocket/listen-register.ts
+import { createHash as createHash6 } from "node:crypto";
+function deriveListenerInstanceId(surface, connectionName) {
+  const nameHash = createHash6("sha256").update(connectionName).digest("hex").slice(0, 16);
+  return `${surface}-${nameHash}`;
+}
+function isTransientRegistrationError(error54) {
+  if (error54 instanceof RegistrationError) {
+    return error54.statusCode === 0 || error54.statusCode === 429 || error54.statusCode >= 500;
+  }
+  return true;
+}
+function parseRetryAfterMs(value) {
+  if (!value) {
+    return;
+  }
+  const seconds = Number(value);
+  if (Number.isFinite(seconds) && seconds >= 0) {
+    return seconds * 1000;
+  }
+  const dateMs = Date.parse(value);
+  if (Number.isFinite(dateMs)) {
+    return Math.max(0, dateMs - Date.now());
+  }
+  return;
+}
+async function registerWithCloud(opts, fetchImpl = fetch) {
+  const registerUrl = `${opts.serverUrl}/v1/environments/register`;
+  const response = await fetchImpl(registerUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${opts.apiKey}`,
+      "X-Letta-Source": "letta-code"
+    },
+    body: JSON.stringify({
+      deviceId: opts.deviceId,
+      ...opts.listenerInstanceId ? { listenerInstanceId: opts.listenerInstanceId } : {},
+      connectionName: opts.connectionName,
+      metadata: {
+        lettaCodeVersion: getVersion(),
+        os: process.platform,
+        nodeVersion: process.version,
+        environmentMessageProtocol: "v2-input",
+        supported_commands: SUPPORTED_REMOTE_COMMANDS,
+        self_update: getSelfUpdateStatus()
+      }
+    })
+  }).catch((fetchError) => {
+    const msg = fetchError instanceof Error ? fetchError.message : String(fetchError);
+    throw new RegistrationError(`Network error: ${msg}`, 0);
+  });
+  if (!response.ok) {
+    let detail = `HTTP ${response.status}`;
+    const retryAfterMs = parseRetryAfterMs(response.headers.get("Retry-After"));
+    const text2 = await response.text().catch(() => "");
+    if (text2) {
+      try {
+        const parsed = JSON.parse(text2);
+        if (parsed.message) {
+          detail = parsed.message;
+        } else if (parsed.error) {
+          detail = `HTTP ${response.status}: ${parsed.error}`;
+          if (parsed.errorCode) {
+            detail += ` (${parsed.errorCode})`;
+          }
+        } else {
+          detail += `: ${text2.slice(0, 200)}`;
+        }
+      } catch {
+        detail += `: ${text2.slice(0, 200)}`;
+      }
+    }
+    throw new RegistrationError(detail, response.status, retryAfterMs);
+  }
+  let body3;
+  try {
+    body3 = await response.json();
+  } catch {
+    throw new RegistrationError("Server returned non-JSON response — is the server running?", response.status);
+  }
+  const result = body3;
+  if (typeof result.connectionId !== "string" || typeof result.wsUrl !== "string") {
+    throw new RegistrationError("Server returned unexpected response shape (missing connectionId or wsUrl)", response.status);
+  }
+  return {
+    connectionId: result.connectionId,
+    wsUrl: result.wsUrl,
+    supportsSplitStatusChannels: result.supportsSplitStatusChannels === true
+  };
+}
+async function registerWithCloudRetry(opts, callbacks) {
+  const startTime = Date.now();
+  const maxDurationMs = callbacks?.maxDurationMs ?? REGISTER_MAX_DURATION_MS;
+  const sleep9 = callbacks?.sleep ?? ((delayMs) => new Promise((resolve31) => setTimeout(resolve31, delayMs)));
+  let attempt = 0;
+  for (;; ) {
+    try {
+      return await registerWithCloud(opts, callbacks?.fetchImpl);
+    } catch (error54) {
+      const elapsed = Date.now() - startTime;
+      if (!isTransientRegistrationError(error54) || elapsed >= maxDurationMs) {
+        throw error54;
+      }
+      attempt++;
+      const backoffDelay = Math.min(REGISTER_INITIAL_DELAY_MS * 2 ** (attempt - 1), REGISTER_MAX_DELAY_MS);
+      const delay2 = error54 instanceof RegistrationError && error54.retryAfterMs !== undefined ? Math.max(error54.retryAfterMs, backoffDelay) : backoffDelay;
+      const jitterWindow = Math.min(REGISTER_MAX_JITTER_MS, Math.floor(delay2 * REGISTER_JITTER_RATIO));
+      const jitter = jitterWindow > 0 ? Math.floor((callbacks?.random ?? Math.random)() * jitterWindow) : 0;
+      const retryDelay = delay2 + jitter;
+      if (error54 instanceof Error) {
+        callbacks?.onRetry?.(attempt, retryDelay, error54);
+      }
+      await sleep9(retryDelay);
+    }
+  }
+}
+var RegistrationError, REGISTER_INITIAL_DELAY_MS = 1000, REGISTER_MAX_DELAY_MS = 30000, REGISTER_MAX_DURATION_MS, REGISTER_MAX_JITTER_MS = 1000, REGISTER_JITTER_RATIO = 0.25;
+var init_listen_register = __esm(() => {
+  init_auto_update();
+  init_version();
+  init_listener_constants();
+  RegistrationError = class RegistrationError extends Error {
+    statusCode;
+    retryAfterMs;
+    constructor(message, statusCode2, retryAfterMs) {
+      super(message);
+      this.name = "RegistrationError";
+      this.statusCode = statusCode2;
+      this.retryAfterMs = retryAfterMs;
+    }
+  };
+  REGISTER_MAX_DURATION_MS = 2 * 60 * 1000;
+});
+
+// src/websocket/listener/auth.ts
+function getListenerOAuthDeps() {
+  return listenerOAuthDepsOverride ?? defaultListenerOAuthDeps;
+}
+function errorMessage(error54) {
+  return error54 instanceof Error ? error54.message : String(error54);
+}
+function getListenerServerUrl(settings3) {
+  return process.env.LETTA_BASE_URL || settings3.env?.LETTA_BASE_URL || getListenerOAuthDeps().LETTA_CLOUD_API_URL;
+}
+function normalizeListenerBaseUrl(url2) {
+  return url2.trim().replace(/\/+$/, "");
+}
+function isCloudListenerServerUrl(serverUrl) {
+  return normalizeListenerBaseUrl(serverUrl) === normalizeListenerBaseUrl(getListenerOAuthDeps().LETTA_CLOUD_API_URL);
+}
+function shouldRefreshListenerAccessToken(settings3, apiKey) {
+  if (!settings3.refreshToken) {
+    return false;
+  }
+  if (!apiKey) {
+    return true;
+  }
+  return settings3.tokenExpiresAt !== undefined && Date.now() >= settings3.tokenExpiresAt - LISTENER_TOKEN_REFRESH_WINDOW_MS;
+}
+function isAccessTokenStillValid(settings3, apiKey) {
+  return Boolean(apiKey && (settings3.tokenExpiresAt === undefined || Date.now() < settings3.tokenExpiresAt));
+}
+async function refreshListenerAccessToken(settings3, deviceId, connectionName) {
+  if (!settings3.refreshToken) {
+    throw new MissingListenerApiKeyError;
+  }
+  const now = Date.now();
+  console.log("Access token expired, refreshing...");
+  const tokens = await refreshAccessTokenSingleFlight(settings3.refreshToken, deviceId, connectionName, getListenerOAuthDeps().refreshAccessToken);
+  settingsManager.updateSettings({
+    env: { LETTA_API_KEY: tokens.access_token },
+    refreshToken: tokens.refresh_token ?? settings3.refreshToken,
+    tokenExpiresAt: now + tokens.expires_in * 1000
+  });
+  await settingsManager.flush();
+  console.log("Token refreshed successfully.");
+  return tokens.access_token;
+}
+async function runListenerOAuthLogin(deviceId, connectionName) {
+  const oauthDeps = getListenerOAuthDeps();
+  console.log(`No API key found. Starting OAuth login...
+`);
+  const deviceData = await oauthDeps.requestDeviceCode();
+  console.log(`To authenticate, visit: ${deviceData.verification_uri_complete}`);
+  console.log(`Your code: ${deviceData.user_code}
+`);
+  console.log(`Waiting for authorization...
+`);
+  const tokens = await oauthDeps.pollForToken(deviceData.device_code, deviceData.interval, deviceData.expires_in, deviceId, connectionName);
+  const now = Date.now();
+  settingsManager.updateSettings({
+    env: { LETTA_API_KEY: tokens.access_token },
+    ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
+    tokenExpiresAt: now + tokens.expires_in * 1000
+  });
+  await settingsManager.flush();
+  console.log(`Authenticated successfully.
+`);
+  return tokens.access_token;
+}
+async function resolveListenerAuth(deviceId, connectionName, options3) {
+  const allowInteractiveOAuth = options3.allowInteractiveOAuth ?? true;
+  const settings3 = await settingsManager.getSettingsWithSecureTokens();
+  const serverUrl = getListenerServerUrl(settings3);
+  const envApiKey = process.env.LETTA_API_KEY;
+  if (envApiKey) {
+    return { serverUrl, apiKey: envApiKey };
+  }
+  let apiKey = settings3.env?.LETTA_API_KEY;
+  if (!isCloudListenerServerUrl(serverUrl)) {
+    if (!apiKey) {
+      throw new MissingListenerApiKeyError;
+    }
+    return { serverUrl, apiKey };
+  }
+  if (shouldRefreshListenerAccessToken(settings3, apiKey)) {
+    try {
+      apiKey = await refreshListenerAccessToken(settings3, deviceId, connectionName);
+    } catch (refreshError) {
+      const retryable = !(refreshError instanceof OAuthRefreshError) || refreshError.retryable;
+      if (retryable && isAccessTokenStillValid(settings3, apiKey)) {
+        console.warn(`Token refresh failed; using the current access token: ${errorMessage(refreshError)}`);
+        return { serverUrl, apiKey };
+      }
+      if (retryable) {
+        throw new ListenerAuthRetryableError(refreshError);
+      }
+      if (!allowInteractiveOAuth) {
+        throw new ListenerReauthenticationRequiredError(refreshError);
+      }
+      console.warn(`Token refresh failed: ${errorMessage(refreshError)}`);
+      apiKey = undefined;
+    }
+  }
+  if (!apiKey) {
+    if (!allowInteractiveOAuth) {
+      throw new ListenerReauthenticationRequiredError;
+    }
+    apiKey = await runListenerOAuthLogin(deviceId, connectionName);
+  }
+  return { serverUrl, apiKey };
+}
+async function resolveListenerRegistrationOptions(deviceId, connectionName, options3 = {}) {
+  const auth = await resolveListenerAuth(deviceId, connectionName, options3);
+  return {
+    ...auth,
+    deviceId,
+    connectionName,
+    listenerInstanceId: deriveListenerInstanceId(options3.surface ?? "server", connectionName)
+  };
+}
+async function resolveListenerReconnectAuth(options3) {
+  try {
+    const auth = await resolveListenerAuth(options3.deviceId, options3.connectionName, { allowInteractiveOAuth: false });
+    return { kind: "ready", apiKey: auth.apiKey };
+  } catch (error54) {
+    if (error54 instanceof ListenerAuthRetryableError) {
+      return { kind: "retry" };
+    }
+    throw error54;
+  }
+}
+var LISTENER_TOKEN_REFRESH_WINDOW_MS, defaultListenerOAuthDeps, listenerOAuthDepsOverride = null, MissingListenerApiKeyError, ListenerAuthRetryableError, ListenerReauthenticationRequiredError;
+var init_auth = __esm(() => {
+  init_oauth();
+  init_oauth_refresh();
+  init_settings_manager();
+  init_listen_register();
+  LISTENER_TOKEN_REFRESH_WINDOW_MS = 5 * 60 * 1000;
+  defaultListenerOAuthDeps = {
+    LETTA_CLOUD_API_URL,
+    pollForToken,
+    refreshAccessToken,
+    requestDeviceCode
+  };
+  MissingListenerApiKeyError = class MissingListenerApiKeyError extends Error {
+    constructor() {
+      super("LETTA_API_KEY not found");
+      this.name = "MissingListenerApiKeyError";
+    }
+  };
+  ListenerAuthRetryableError = class ListenerAuthRetryableError extends Error {
+    constructor(refreshError) {
+      super(`Could not refresh listener credentials: ${errorMessage(refreshError)}`);
+      this.name = "ListenerAuthRetryableError";
+    }
+  };
+  ListenerReauthenticationRequiredError = class ListenerReauthenticationRequiredError extends Error {
+    constructor(refreshError) {
+      const detail = refreshError ? `: ${errorMessage(refreshError)}` : "";
+      super(`Saved Letta API credentials require reauthentication${detail}. Run letta to sign in again, or set LETTA_API_KEY.`);
+      this.name = "ListenerReauthenticationRequiredError";
+    }
+  };
+});
+
 // src/agent/acting-user.ts
 function actingUserRequestOptions(actingUserId) {
   if (!actingUserId) {
@@ -445792,7 +446533,7 @@ __export(exports_custom, {
   COMMANDS_DIR: () => COMMANDS_DIR
 });
 import { existsSync as existsSync43 } from "node:fs";
-import { readdir as readdir9, readFile as readFile16 } from "node:fs/promises";
+import { readdir as readdir9, readFile as readFile15 } from "node:fs/promises";
 import { basename as basename20, dirname as dirname24, join as join48 } from "node:path";
 async function getCustomCommands() {
   if (cachedCommands !== null) {
@@ -445851,7 +446592,7 @@ async function findCommandFiles(currentPath, rootPath, commands, source2) {
   } catch (_error) {}
 }
 async function parseCommandFile(filePath, rootPath, source2) {
-  const content = await readFile16(filePath, "utf-8");
+  const content = await readFile15(filePath, "utf-8");
   const { frontmatter, body: body3 } = parseFrontmatter(content);
   const id2 = basename20(filePath, ".md");
   const relativePath = dirname24(filePath).slice(rootPath.length);
@@ -446010,7 +446751,7 @@ var init_init_command = __esm(() => {
 });
 
 // src/cli/helpers/skill-name-frontmatter-repair.ts
-import { readdir as readdir10, readFile as readFile17, stat as stat12, writeFile as writeFile14 } from "node:fs/promises";
+import { readdir as readdir10, readFile as readFile16, stat as stat12, writeFile as writeFile13 } from "node:fs/promises";
 import { basename as basename21, dirname as dirname25, join as join49, relative as relative8 } from "node:path";
 async function pathExists(path32) {
   try {
@@ -446117,7 +446858,7 @@ async function repairMissingSkillNameFrontmatter(memoryDir) {
     const displayPath = relative8(memoryDir, skillFile).replace(/\\/g, "/");
     result.scanned++;
     try {
-      const content = await readFile17(skillFile, "utf8");
+      const content = await readFile16(skillFile, "utf8");
       const repair3 = repairSkillNameFrontmatterContent(content, basename21(dirname25(skillFile)));
       if (repair3.reason) {
         result.skipped.push({ path: displayPath, reason: repair3.reason });
@@ -446126,7 +446867,7 @@ async function repairMissingSkillNameFrontmatter(memoryDir) {
       if (!repair3.changed) {
         continue;
       }
-      await writeFile14(skillFile, repair3.content, "utf8");
+      await writeFile13(skillFile, repair3.content, "utf8");
       result.repaired.push(displayPath);
     } catch (error54) {
       result.skipped.push({
@@ -447215,7 +447956,7 @@ function isCreateAgentCommand(value) {
   if (!value || typeof value !== "object")
     return false;
   const c = value;
-  return c.type === "create_agent" && typeof c.request_id === "string" && (c.personality === "memo" || c.personality === "blank" || c.personality === "tutorial" || c.personality === "linus" || c.personality === "kawaii") && (c.model === undefined || typeof c.model === "string") && (c.pin_global === undefined || typeof c.pin_global === "boolean");
+  return c.type === "create_agent" && typeof c.request_id === "string" && (c.personality === "memo" || c.personality === "blank" || c.personality === "tutorial" || c.personality === "linus" || c.personality === "kawaii") && (c.model === undefined || typeof c.model === "string") && (c.tags === undefined || isStringArray6(c.tags)) && (c.pin_global === undefined || typeof c.pin_global === "boolean");
 }
 function isAgentListCommand(value) {
   if (!value || typeof value !== "object")
@@ -449685,9 +450426,9 @@ async function drainStream(stream12, buffers, refresh, abortSignal, onFirstMessa
       }
     }
   } catch (e2) {
-    const errorMessage = e2 instanceof Error ? e2.message : String(e2);
+    const errorMessage2 = e2 instanceof Error ? e2.message : String(e2);
     const sdkDiagnostic = consumeLastSDKDiagnostic();
-    const errorMessageWithDiagnostic = sdkDiagnostic ? `${errorMessage} [${sdkDiagnostic}]` : errorMessage;
+    const errorMessageWithDiagnostic = sdkDiagnostic ? `${errorMessage2} [${sdkDiagnostic}]` : errorMessage2;
     debugWarn("drainStream", "Stream error caught: %s last_chunk=%s stream=%s", errorMessageWithDiagnostic, lastChunkDebugSummary, summarizeStreamForDebug(stream12));
     if (e2 instanceof Error && e2.stack) {
       debugWarn("drainStream", "Stream error stack: %s", e2.stack);
@@ -450697,6 +451438,19 @@ function emitToolExecutionFinishedEvents(socket, runtime, params) {
     });
   }
 }
+function emitToolExecutionAbortedEvents(socket, runtime, params) {
+  for (const toolCallId of params.toolCallIds) {
+    const delta2 = {
+      ...createLifecycleMessageBase("client_tool_end", params.runId),
+      tool_call_id: toolCallId,
+      status: "error"
+    };
+    emitCanonicalMessageDelta(socket, runtime, delta2, {
+      agent_id: params.agentId,
+      conversation_id: params.conversationId
+    });
+  }
+}
 function createToolExecutionOutputEmitter(socket, runtime, params) {
   const outputByToolCallId = new Map;
   const emitToolOutput = (toolCallId, outputState) => {
@@ -451287,6 +452041,17 @@ var init_approval_suggestions = __esm(async () => {
   ]);
 });
 
+// src/websocket/listener/continuation-input.ts
+function appendQueuedTurnToInput(input, queuedTurn) {
+  return {
+    input: [...input, ...queuedTurn.messages],
+    imageFailureModesByMessageOtid: getInboundImageFailureModes(queuedTurn)
+  };
+}
+var init_continuation_input = __esm(async () => {
+  await init_image_policy();
+});
+
 // src/websocket/listener/turn-terminal.ts
 function finishListenerTurn(runtime, lease, options3) {
   const transition = runtime.turnLifecycle.finish(lease, options3.stopReason);
@@ -451711,25 +452476,25 @@ async function resolveRecoveredApprovalResponse(runtime, socket, response, proce
       conversationId: recovered.conversationId,
       shouldEmit: () => runtime.turnLifecycle.isCurrent(recoveryLease)
     });
-    await ensureSecretsHydrated(runtime.listener, recovered.agentId);
-    if (!runtime.turnLifecycle.isCurrent(recoveryLease)) {
-      return true;
-    }
-    const preparedToolContext = await prepareToolExecutionContext({
-      agentId: recovered.agentId,
-      conversationId: recovered.conversationId,
-      workingDirectory,
-      permissionModeState: getOrCreateConversationPermissionModeStateRef(runtime.listener, recovered.agentId, recovered.conversationId),
-      modEvents: ensureListenerModAdapter(runtime.listener).events
-    });
-    if (!runtime.turnLifecycle.isCurrent(recoveryLease)) {
-      return true;
-    }
-    runtime.currentToolset = preparedToolContext.toolset;
-    runtime.currentToolsetPreference = preparedToolContext.toolsetPreference;
-    runtime.currentLoadedTools = preparedToolContext.preparedToolContext.loadedToolNames;
     let approvalResults;
     try {
+      await ensureSecretsHydrated(runtime.listener, recovered.agentId);
+      if (!runtime.turnLifecycle.isCurrent(recoveryLease)) {
+        return true;
+      }
+      const preparedToolContext = await prepareToolExecutionContext({
+        agentId: recovered.agentId,
+        conversationId: recovered.conversationId,
+        workingDirectory,
+        permissionModeState: getOrCreateConversationPermissionModeStateRef(runtime.listener, recovered.agentId, recovered.conversationId),
+        modEvents: ensureListenerModAdapter(runtime.listener).events
+      });
+      if (!runtime.turnLifecycle.isCurrent(recoveryLease)) {
+        return true;
+      }
+      runtime.currentToolset = preparedToolContext.toolset;
+      runtime.currentToolsetPreference = preparedToolContext.toolsetPreference;
+      runtime.currentLoadedTools = preparedToolContext.preparedToolContext.loadedToolNames;
       approvalResults = await executeApprovals(decisions, undefined, {
         abortSignal: recoveryLease.signal,
         onStreamingOutput: emitToolExecutionOutput,
@@ -451741,6 +452506,17 @@ async function resolveRecoveredApprovalResponse(runtime, socket, response, proce
         } : undefined,
         channelTurnSources: executionChannelTurnSources
       });
+    } catch (error54) {
+      emitToolExecutionOutput.flush();
+      if (runtime.turnLifecycle.isCurrent(recoveryLease)) {
+        emitToolExecutionAbortedEvents(socket, runtime, {
+          toolCallIds: approvedToolCallIds,
+          runId: executionRunId,
+          agentId: recovered.agentId,
+          conversationId: recovered.conversationId
+        });
+      }
+      throw error54;
     } finally {
       emitToolExecutionOutput.flush();
     }
@@ -451760,7 +452536,7 @@ async function resolveRecoveredApprovalResponse(runtime, socket, response, proce
       return true;
     }
     emitRuntimeStateUpdates(runtime, scope);
-    const continuationMessages = [
+    let continuationMessages = [
       {
         type: "approval",
         approvals: approvalResults,
@@ -451768,11 +452544,13 @@ async function resolveRecoveredApprovalResponse(runtime, socket, response, proce
       }
     ];
     let continuationBatchId = `batch-recovered-${crypto.randomUUID()}`;
+    let queuedChannelTurnSources;
     const consumedQueuedTurn = consumeQueuedTurn(runtime);
     if (consumedQueuedTurn) {
       const { dequeuedBatch, queuedTurn } = consumedQueuedTurn;
       continuationBatchId = dequeuedBatch.batchId;
-      continuationMessages.push(...queuedTurn.messages);
+      continuationMessages = appendQueuedTurnToInput(continuationMessages, queuedTurn).input;
+      queuedChannelTurnSources = queuedTurn.channelTurnSources;
       emitDequeuedUserMessage(socket, runtime, queuedTurn, dequeuedBatch);
     }
     if (!runtime.turnLifecycle.isCurrent(recoveryLease)) {
@@ -451782,7 +452560,8 @@ async function resolveRecoveredApprovalResponse(runtime, socket, response, proce
       type: "message",
       agentId: recovered.agentId,
       conversationId: recovered.conversationId,
-      messages: continuationMessages
+      messages: continuationMessages,
+      ...queuedChannelTurnSources?.length ? { channelTurnSources: queuedChannelTurnSources } : {}
     }, socket, runtime, opts?.onStatusChange, opts?.connectionId, continuationBatchId, recoveryLease);
     if (runtime.turnLifecycle.isCurrent(recoveryLease)) {
       throw new Error("Recovered continuation returned without finalizing");
@@ -451853,6 +452632,7 @@ var init_recovery = __esm(async () => {
     init_stream(),
     init_toolset(),
     init_approval_suggestions(),
+    init_continuation_input(),
     init_interrupts(),
     init_mod_adapter2(),
     init_protocol_outbound(),
@@ -452082,17 +452862,20 @@ async function resolveStaleApprovals(runtime, socket, turnLease, deps = {}) {
       return null;
     }
     try {
-      const continuationMessages = [
+      let continuationMessages = [
         {
           type: "approval",
           approvals: approvalResults,
           otid: crypto.randomUUID()
         }
       ];
+      let queuedImageFailureModes;
       const consumedQueuedTurn = consumeQueuedTurn(runtime);
       if (consumedQueuedTurn) {
         const { dequeuedBatch, queuedTurn } = consumedQueuedTurn;
-        continuationMessages.push(...queuedTurn.messages);
+        const appended = appendQueuedTurnToInput(continuationMessages, queuedTurn);
+        continuationMessages = appended.input;
+        queuedImageFailureModes = appended.imageFailureModesByMessageOtid;
         emitDequeuedUserMessage(socket, runtime, queuedTurn, dequeuedBatch);
       }
       const continuationMessagesWithSkillContent = injectQueuedSkillContent(continuationMessages);
@@ -452101,7 +452884,8 @@ async function resolveStaleApprovals(runtime, socket, turnLease, deps = {}) {
         streamTokens: true,
         background: true,
         workingDirectory: recoveryWorkingDirectory,
-        preparedToolContext: preparedToolContext.preparedToolContext
+        preparedToolContext: preparedToolContext.preparedToolContext,
+        ...queuedImageFailureModes ? { imageFailureModesByMessageOtid: queuedImageFailureModes } : {}
       }, socket, runtime, turnLease, { allowApprovalRecovery: false });
       assertCurrentTurnLease();
       if (recoverySendResult.kind !== "stream") {
@@ -452442,6 +453226,7 @@ var init_send = __esm(async () => {
     init_message(),
     init_toolset(),
     init_approval(),
+    init_continuation_input(),
     init_mod_adapter2(),
     init_protocol_outbound(),
     init_queue(),
@@ -454823,6 +455608,17 @@ async function handleApprovalStop(params) {
       channelTurnSources: runtime.activeChannelTurn?.sources,
       onFileWrite
     });
+  } catch (error54) {
+    emitToolExecutionOutput.flush();
+    if (!shouldInterrupt()) {
+      emitToolExecutionAbortedEvents(socket, runtime, {
+        toolCallIds: lastExecutingToolCallIds,
+        runId: executionRunId,
+        agentId,
+        conversationId
+      });
+    }
+    throw error54;
   } finally {
     emitToolExecutionOutput.flush();
   }
@@ -454846,7 +455642,7 @@ async function handleApprovalStop(params) {
   if (shouldInterrupt()) {
     return interruptTermination();
   }
-  const nextInput = [
+  let nextInput = [
     {
       type: "approval",
       approvals: persistedExecutionResults,
@@ -454854,11 +455650,14 @@ async function handleApprovalStop(params) {
     }
   ];
   let continuationBatchId = dequeuedBatchId;
+  let queuedImageFailureModes;
   const consumedQueuedTurn = consumeQueuedTurn(runtime);
   if (consumedQueuedTurn) {
     const { dequeuedBatch, queuedTurn } = consumedQueuedTurn;
     continuationBatchId = dequeuedBatch.batchId;
-    nextInput.push(...queuedTurn.messages);
+    const appended = appendQueuedTurnToInput(nextInput, queuedTurn);
+    nextInput = appended.input;
+    queuedImageFailureModes = appended.imageFailureModesByMessageOtid;
     emitDequeuedUserMessage(socket, runtime, queuedTurn, dequeuedBatch);
   }
   const nextInputWithSkillContent = injectQueuedSkillContent(nextInput);
@@ -454871,8 +455670,11 @@ async function handleApprovalStop(params) {
   });
   let sendResult;
   try {
+    const sendOptions = buildSendOptions() ?? {};
+    const imageFailureModesByMessageOtid = mergeImageFailureModesByMessageOtid(sendOptions.imageFailureModesByMessageOtid, queuedImageFailureModes);
     sendResult = await sendApprovalContinuationWithRetry(conversationId, nextInputWithSkillContent, {
-      ...buildSendOptions(),
+      ...sendOptions,
+      ...imageFailureModesByMessageOtid ? { imageFailureModesByMessageOtid } : {},
       ...continuationWasFullyAutoHandled ? { allowResponseStateReuse: true } : {}
     }, socket, runtime, turnLease, { providerFallback });
   } catch (error54) {
@@ -454940,8 +455742,10 @@ var init_turn_approval = __esm(async () => {
   init_transport();
   await __promiseAll([
     init_approval_execution(),
+    init_message_image_normalization(),
     init_approval(),
     init_approval_suggestions(),
+    init_continuation_input(),
     init_interrupts(),
     init_protocol_outbound(),
     init_queue(),
@@ -456110,14 +456914,7 @@ async function prepareListenerTurn(params) {
   if (connectionId) {
     onStatusChange?.("processing", connectionId);
   }
-  const { normalizeInboundMessages: normalizeInboundMessages2 } = await init_queue().then(() => exports_queue);
-  const normalizedMessages = await normalizeInboundMessages2(msg.messages, undefined, {
-    imageFailureMode: (msg.channelTurnSources?.length ?? 0) > 0 ? "drop" : "strict"
-  });
-  if (isInterrupted()) {
-    return { kind: "interrupted" };
-  }
-  trackListenerUserInput(normalizedMessages, "unknown");
+  trackListenerUserInput(msg.messages, "unknown");
   const messagesToSend = [];
   let queuedInterruptedToolCallIds = [];
   const consumed = consumeInterruptQueue(runtime, agentId, conversationId);
@@ -456125,12 +456922,16 @@ async function prepareListenerTurn(params) {
     messagesToSend.push(consumed.approvalMessage);
     queuedInterruptedToolCallIds = consumed.interruptedToolCallIds;
   }
-  messagesToSend.push(...normalizedMessages.map((message) => ("content" in message) && !message.otid ? {
+  messagesToSend.push(...msg.messages.map((message) => ("content" in message) && !message.otid ? {
     ...message,
     otid: "client_message_id" in message && typeof message.client_message_id === "string" ? message.client_message_id : crypto.randomUUID()
   } : message));
+  const imageFailureModesByMessageOtid = getInboundImageFailureModes({
+    channelTurnSources: msg.channelTurnSources,
+    messages: messagesToSend
+  });
   let inboundUserTranscriptLines = buildInboundUserTranscriptLines(messagesToSend);
-  const firstMessage = normalizedMessages[0];
+  const firstMessage = msg.messages[0];
   const isApprovalMessage = firstMessage && "type" in firstMessage && firstMessage.type === "approval" && "approvals" in firstMessage;
   let cachedAgent = null;
   if (!isApprovalMessage) {
@@ -456242,6 +457043,7 @@ async function prepareListenerTurn(params) {
     kind: "ready",
     getCachedAgent: () => cachedAgent,
     currentInput,
+    imageFailureModesByMessageOtid,
     inboundUserTranscriptLines,
     pendingNormalizationInterruptedToolCallIds: [
       ...queuedInterruptedToolCallIds
@@ -456260,6 +457062,7 @@ var init_turn_setup = __esm(async () => {
   init_warmup();
   await __promiseAll([
     init_toolset(),
+    init_image_policy(),
     init_interrupts(),
     init_mod_adapter2(),
     init_turn_events()
@@ -456394,7 +457197,9 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
       workingDirectory: turnWorkingDirectory,
       permissionModeState: turnPermissionModeState,
       preparedToolContext: preparedToolContext.preparedToolContext,
-      skipImageNormalization: true,
+      ...setup.imageFailureModesByMessageOtid ? {
+        imageFailureModesByMessageOtid: setup.imageFailureModesByMessageOtid
+      } : {},
       ...providerFallback.overrideModel ? { overrideModel: providerFallback.overrideModel } : {},
       ...msg.actingUserId ? { actingUserId: msg.actingUserId } : {},
       ...pendingNormalizationInterruptedToolCallIds.length > 0 ? {
@@ -456706,7 +457511,7 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
           });
           break;
         }
-        const errorMessage = errorDetail || `Unexpected stop reason: ${stopReason}`;
+        const errorMessage2 = errorDetail || `Unexpected stop reason: ${stopReason}`;
         const terminalRunId = runId || runtime.activeRunId || runErrorInfo2?.run_id;
         const transition = finishTurn({
           stopReason: effectiveStopReason,
@@ -456717,7 +457522,7 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
           break;
         }
         const formattedError = emitLoopErrorNotice(socket, runtime, {
-          message: errorMessage,
+          message: errorMessage2,
           stopReason: effectiveStopReason,
           isTerminal: true,
           runId: terminalRunId,
@@ -456727,7 +457532,7 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
           cancelRequested: turnAbortSignal.aborted,
           abortSignal: turnAbortSignal
         });
-        runtime.lastTerminalLoopErrorMessage = formattedError ?? errorMessage;
+        runtime.lastTerminalLoopErrorMessage = formattedError ?? errorMessage2;
         runtime.lastTerminalLoopErrorRunId = terminalRunId ?? null;
         break;
       }
@@ -456849,7 +457654,7 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
       });
       return;
     }
-    const errorMessage = error54 instanceof Error ? error54.message : String(error54);
+    const errorMessage2 = error54 instanceof Error ? error54.message : String(error54);
     const terminalRunId = runtime.activeRunId;
     const transition = finishTurn({
       stopReason: "error",
@@ -456860,7 +457665,7 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
       return;
     }
     const formattedError = emitLoopErrorNotice(socket, runtime, {
-      message: errorMessage,
+      message: errorMessage2,
       stopReason: "error",
       isTerminal: true,
       runId: terminalRunId,
@@ -456870,7 +457675,7 @@ async function handleIncomingMessage(msg, socket, runtime, onStatusChange, conne
       cancelRequested: turnAbortSignal.aborted,
       abortSignal: turnAbortSignal
     });
-    runtime.lastTerminalLoopErrorMessage = formattedError ?? errorMessage;
+    runtime.lastTerminalLoopErrorMessage = formattedError ?? errorMessage2;
     runtime.lastTerminalLoopErrorRunId = terminalRunId ?? null;
     if (isDebugEnabled()) {
       console.error("[Listen] Error handling message:", error54);
@@ -458343,11 +459148,11 @@ async function handleExecuteCommand(command, socket, conversationRuntime, opts)
       error: error54,
       context: "listener_command_execution"
     });
-    const errorMessage = error54 instanceof Error ? error54.message : String(error54);
+    const errorMessage2 = error54 instanceof Error ? error54.message : String(error54);
     emitSlashCommandEnd(socket, conversationRuntime, scope, {
       command_id: command.command_id,
       input,
-      output: `Failed: ${errorMessage}`,
+      output: `Failed: ${errorMessage2}`,
       success: false
     });
   }
@@ -460748,7 +461553,7 @@ var init_grep_in_files = __esm(() => {
 });
 
 // src/websocket/listener/file-commands.ts
-import { readdir as readdir11, readFile as readFile18 } from "node:fs/promises";
+import { readdir as readdir11, readFile as readFile17 } from "node:fs/promises";
 import { homedir as homedir30 } from "node:os";
 import path35 from "node:path";
 function trackListenerError2(errorType, error54, context4) {
@@ -460803,7 +461608,7 @@ async function getIgnoreConfig(root2) {
     return cached3;
   let patterns2 = [];
   try {
-    const content = await readFile18(path35.join(absRoot, ".letta", ".lettaignore"), "utf-8");
+    const content = await readFile17(path35.join(absRoot, ".letta", ".lettaignore"), "utf-8");
     patterns2 = parseLettaIgnore(content);
   } catch {
     patterns2 = [];
@@ -463546,7 +464351,7 @@ function handleMemoryProtocolCommand(parsed, context4) {
           ensureLocalMemfsCheckout: ensureLocalMemfsCheckout2,
           isMemfsEnabledOnServer: isMemfsEnabledOnServer2
         } = await Promise.resolve().then(() => (init_memory_filesystem2(), exports_memory_filesystem));
-        const { readFile: readFile19 } = await import("node:fs/promises");
+        const { readFile: readFile18 } = await import("node:fs/promises");
         const { existsSync: existsSync46 } = await import("node:fs");
         const { isAbsolute: isAbsolute24, join: join52, normalize: normalize5, relative: relative13, sep: sep6 } = await import("node:path");
         if (isAbsolute24(parsed.path) || parsed.path.length === 0) {
@@ -463572,7 +464377,7 @@ function handleMemoryProtocolCommand(parsed, context4) {
             return;
           }
         }
-        const buffer = await readFile19(absolutePath);
+        const buffer = await readFile18(absolutePath);
         const content = encoding === "base64" ? buffer.toString("base64") : buffer.toString("utf-8");
         const pathspec = rel.split(sep6).join("/");
         safeSocketSend(socket, {
@@ -463612,7 +464417,7 @@ function handleMemoryProtocolCommand(parsed, context4) {
           isMemfsEnabledOnServer: isMemfsEnabledOnServer2
         } = await Promise.resolve().then(() => (init_memory_filesystem2(), exports_memory_filesystem));
         const { commitMemoryWrite: commitMemoryWrite2 } = await Promise.resolve().then(() => (init_memory_git(), exports_memory_git));
-        const { writeFile: writeFile15, mkdir: mkdir13 } = await import("node:fs/promises");
+        const { writeFile: writeFile14, mkdir: mkdir13 } = await import("node:fs/promises");
         const { existsSync: existsSync46 } = await import("node:fs");
         const { dirname: dirname27, isAbsolute: isAbsolute24, join: join52, normalize: normalize5, relative: relative13, sep: sep6 } = await import("node:path");
         if (isAbsolute24(parsed.path) || parsed.path.length === 0) {
@@ -463640,7 +464445,7 @@ function handleMemoryProtocolCommand(parsed, context4) {
         }
         const buffer = encoding === "base64" ? Buffer.from(parsed.content, "base64") : Buffer.from(parsed.content, "utf-8");
         await mkdir13(dirname27(absolutePath), { recursive: true });
-        await writeFile15(absolutePath, buffer);
+        await writeFile14(absolutePath, buffer);
         const { getBackend: getBackend2 } = await Promise.resolve().then(() => (init_backend2(), exports_backend));
         const backend4 = getBackend2();
         const memorySyncMode = backend4.capabilities.localMemfs && !backend4.capabilities.remoteMemfs ? "local" : undefined;
@@ -464280,7 +465085,8 @@ async function handleCreateAgentCommand(parsed, socket, safeSocketSend) {
     const { createAgentForPersonality: createAgentForPersonality2 } = await Promise.resolve().then(() => (init_personality(), exports_personality));
     const result = await createAgentForPersonality2({
       personalityId: parsed.personality,
-      model: parsed.model
+      model: parsed.model,
+      ...parsed.tags && { tags: parsed.tags }
     });
     if (parsed.pin_global !== false) {
       settingsManager.pinAgent(result.agent.id);
@@ -465803,11 +466609,13 @@ async function connectWithRetry(runtime, opts, attempt = 0, startTime = Date.now
   if (attempt === 0) {
     await loadTools();
   }
-  const settings3 = await settingsManager.getSettingsWithSecureTokens();
-  const apiKey = process.env.LETTA_API_KEY || settings3.env?.LETTA_API_KEY;
-  if (!apiKey) {
-    throw new Error("Missing LETTA_API_KEY");
+  const auth = await resolveListenerReconnectAuth(opts);
+  if (auth.kind === "retry")
+    return connectWithRetry(runtime, opts, attempt + 1, startTime);
+  if (runtime !== getActiveRuntime() || runtime.intentionallyClosed) {
+    return;
   }
+  const apiKey = auth.apiKey;
   const url2 = new URL(opts.wsUrl);
   url2.searchParams.set("deviceId", opts.deviceId);
   url2.searchParams.set("connectionName", opts.connectionName);
@@ -465994,6 +466802,7 @@ var init_lifecycle = __esm(async () => {
   init_debug();
   init_message_queue_bridge();
   init_terminal_handler();
+  init_auth();
   init_channel_turn_session();
   init_constants3();
   init_cwd();
@@ -466766,7 +467575,7 @@ var execFile15, __dirname2, localXdgOpenPath, platform8, arch3, pTryEach = async
   }
   subprocess.unref();
   return subprocess;
-}, open3 = (target2, options3) => {
+}, open4 = (target2, options3) => {
   if (typeof target2 !== "string") {
     throw new TypeError("Expected a `target`");
   }
@@ -466835,14 +467644,14 @@ var init_open = __esm(() => {
   }));
   defineLazyProperty(apps, "browser", () => "browser");
   defineLazyProperty(apps, "browserPrivate", () => "browserPrivate");
-  open_default = open3;
+  open_default = open4;
 });
 
 // src/cli/commands/connect-oauth-core.ts
 async function openOAuthBrowser(authorizationUrl) {
   try {
-    const { default: open4 } = await Promise.resolve().then(() => (init_open(), exports_open));
-    const subprocess = await open4(authorizationUrl, { wait: false });
+    const { default: open5 } = await Promise.resolve().then(() => (init_open(), exports_open));
+    const subprocess = await open5(authorizationUrl, { wait: false });
     subprocess.on("error", () => {});
   } catch {}
 }
@@ -468857,141 +469666,6 @@ var init_startup = __esm(() => {
   init_mode();
 });
 
-// src/websocket/listen-register.ts
-import { createHash as createHash7 } from "node:crypto";
-function deriveListenerInstanceId(surface, connectionName) {
-  const nameHash = createHash7("sha256").update(connectionName).digest("hex").slice(0, 16);
-  return `${surface}-${nameHash}`;
-}
-function isTransientRegistrationError(error54) {
-  if (error54 instanceof RegistrationError) {
-    return error54.statusCode === 0 || error54.statusCode === 429 || error54.statusCode >= 500;
-  }
-  return true;
-}
-function parseRetryAfterMs(value) {
-  if (!value) {
-    return;
-  }
-  const seconds = Number(value);
-  if (Number.isFinite(seconds) && seconds >= 0) {
-    return seconds * 1000;
-  }
-  const dateMs = Date.parse(value);
-  if (Number.isFinite(dateMs)) {
-    return Math.max(0, dateMs - Date.now());
-  }
-  return;
-}
-async function registerWithCloud(opts, fetchImpl = fetch) {
-  const registerUrl = `${opts.serverUrl}/v1/environments/register`;
-  const response = await fetchImpl(registerUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${opts.apiKey}`,
-      "X-Letta-Source": "letta-code"
-    },
-    body: JSON.stringify({
-      deviceId: opts.deviceId,
-      ...opts.listenerInstanceId ? { listenerInstanceId: opts.listenerInstanceId } : {},
-      connectionName: opts.connectionName,
-      metadata: {
-        lettaCodeVersion: getVersion(),
-        os: process.platform,
-        nodeVersion: process.version,
-        environmentMessageProtocol: "v2-input",
-        supported_commands: SUPPORTED_REMOTE_COMMANDS,
-        self_update: getSelfUpdateStatus()
-      }
-    })
-  }).catch((fetchError) => {
-    const msg = fetchError instanceof Error ? fetchError.message : String(fetchError);
-    throw new RegistrationError(`Network error: ${msg}`, 0);
-  });
-  if (!response.ok) {
-    let detail = `HTTP ${response.status}`;
-    const retryAfterMs2 = parseRetryAfterMs(response.headers.get("Retry-After"));
-    const text2 = await response.text().catch(() => "");
-    if (text2) {
-      try {
-        const parsed = JSON.parse(text2);
-        if (parsed.message) {
-          detail = parsed.message;
-        } else if (parsed.error) {
-          detail = `HTTP ${response.status}: ${parsed.error}`;
-          if (parsed.errorCode) {
-            detail += ` (${parsed.errorCode})`;
-          }
-        } else {
-          detail += `: ${text2.slice(0, 200)}`;
-        }
-      } catch {
-        detail += `: ${text2.slice(0, 200)}`;
-      }
-    }
-    throw new RegistrationError(detail, response.status, retryAfterMs2);
-  }
-  let body3;
-  try {
-    body3 = await response.json();
-  } catch {
-    throw new RegistrationError("Server returned non-JSON response — is the server running?", response.status);
-  }
-  const result = body3;
-  if (typeof result.connectionId !== "string" || typeof result.wsUrl !== "string") {
-    throw new RegistrationError("Server returned unexpected response shape (missing connectionId or wsUrl)", response.status);
-  }
-  return {
-    connectionId: result.connectionId,
-    wsUrl: result.wsUrl,
-    supportsSplitStatusChannels: result.supportsSplitStatusChannels === true
-  };
-}
-async function registerWithCloudRetry(opts, callbacks) {
-  const startTime = Date.now();
-  const maxDurationMs = callbacks?.maxDurationMs ?? REGISTER_MAX_DURATION_MS;
-  const sleep9 = callbacks?.sleep ?? ((delayMs) => new Promise((resolve31) => setTimeout(resolve31, delayMs)));
-  let attempt = 0;
-  for (;; ) {
-    try {
-      return await registerWithCloud(opts, callbacks?.fetchImpl);
-    } catch (error54) {
-      const elapsed = Date.now() - startTime;
-      if (!isTransientRegistrationError(error54) || elapsed >= maxDurationMs) {
-        throw error54;
-      }
-      attempt++;
-      const backoffDelay = Math.min(REGISTER_INITIAL_DELAY_MS * 2 ** (attempt - 1), REGISTER_MAX_DELAY_MS);
-      const delay2 = error54 instanceof RegistrationError && error54.retryAfterMs !== undefined ? Math.max(error54.retryAfterMs, backoffDelay) : backoffDelay;
-      const jitterWindow = Math.min(REGISTER_MAX_JITTER_MS, Math.floor(delay2 * REGISTER_JITTER_RATIO));
-      const jitter = jitterWindow > 0 ? Math.floor((callbacks?.random ?? Math.random)() * jitterWindow) : 0;
-      const retryDelay = delay2 + jitter;
-      if (error54 instanceof Error) {
-        callbacks?.onRetry?.(attempt, retryDelay, error54);
-      }
-      await sleep9(retryDelay);
-    }
-  }
-}
-var RegistrationError, REGISTER_INITIAL_DELAY_MS = 1000, REGISTER_MAX_DELAY_MS = 30000, REGISTER_MAX_DURATION_MS, REGISTER_MAX_JITTER_MS = 1000, REGISTER_JITTER_RATIO = 0.25;
-var init_listen_register = __esm(() => {
-  init_auto_update();
-  init_version();
-  init_listener_constants();
-  RegistrationError = class RegistrationError extends Error {
-    statusCode;
-    retryAfterMs;
-    constructor(message, statusCode2, retryAfterMs2) {
-      super(message);
-      this.name = "RegistrationError";
-      this.statusCode = statusCode2;
-      this.retryAfterMs = retryAfterMs2;
-    }
-  };
-  REGISTER_MAX_DURATION_MS = 2 * 60 * 1000;
-});
-
 // src/websocket/listener/client.ts
 function asListenerRuntimeForTests(runtime) {
   return "listener" in runtime ? runtime.listener : runtime;
@@ -469284,8 +469958,6 @@ var init_client7 = __esm(async () => {
     shouldAttemptPostStopApprovalRecovery,
     markAwaitingAcceptedApprovalContinuationRunId,
     resolveStaleApprovals,
-    normalizeMessageContentImages: normalizeMessageContentImages2,
-    normalizeInboundMessages,
     consumeQueuedTurn,
     handleIncomingMessage,
     handleApprovalResponseInput,
@@ -469729,7 +470401,7 @@ function ConstellationLoginView({
         const deviceData = await requestDeviceCode();
         setUserCode(deviceData.user_code);
         setVerificationUri(deviceData.verification_uri_complete);
-        Promise.resolve().then(() => (init_open(), exports_open)).then(({ default: open4 }) => open4(deviceData.verification_uri_complete, { wait: false })).then((subprocess) => {
+        Promise.resolve().then(() => (init_open(), exports_open)).then(({ default: open5 }) => open5(deviceData.verification_uri_complete, { wait: false })).then((subprocess) => {
           subprocess.on("error", () => {});
         }).catch(() => {});
         const deviceId = settingsManager.getOrCreateDeviceId();
@@ -471654,7 +472326,7 @@ __export(exports_skills3, {
   GLOBAL_SKILLS_DIR: () => GLOBAL_SKILLS_DIR2
 });
 import { existsSync as existsSync54 } from "node:fs";
-import { readdir as readdir15, readFile as readFile22, realpath as realpath6, stat as stat15 } from "node:fs/promises";
+import { readdir as readdir15, readFile as readFile21, realpath as realpath6, stat as stat15 } from "node:fs/promises";
 import { dirname as dirname31, join as join62 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 function getBundledSkillsPath2() {
@@ -471826,7 +472498,7 @@ async function findSkillFiles2(currentPath, rootPath, skills, errors7, source2,
   }
 }
 async function parseSkillFile2(filePath, rootPath, source2) {
-  const content = await readFile22(filePath, "utf-8");
+  const content = await readFile21(filePath, "utf-8");
   const { frontmatter, body: body3 } = parseFrontmatter(content);
   const normalizedRoot = rootPath.endsWith("/") ? rootPath.slice(0, -1) : rootPath;
   const relativePath = filePath.slice(normalizedRoot.length + 1);
@@ -471886,9 +472558,9 @@ var init_skills4 = __esm(() => {
 var exports_fs = {};
 __export(exports_fs, {
   writeJsonFile: () => writeJsonFile2,
-  writeFile: () => writeFile17,
+  writeFile: () => writeFile16,
   readJsonFile: () => readJsonFile4,
-  readFile: () => readFile23,
+  readFile: () => readFile22,
   mkdir: () => mkdir15,
   exists: () => exists2
 });
@@ -471899,10 +472571,10 @@ import {
   mkdirSync as mkdirSync38
 } from "node:fs";
 import { dirname as dirname32 } from "node:path";
-async function readFile23(path39) {
+async function readFile22(path39) {
   return fsReadFileSync2(path39, { encoding: "utf-8" });
 }
-async function writeFile17(path39, content) {
+async function writeFile16(path39, content) {
   const dir = dirname32(path39);
   if (!existsSync55(dir)) {
     mkdirSync38(dir, { recursive: true });
@@ -471916,14 +472588,14 @@ async function mkdir15(path39, options3) {
   mkdirSync38(path39, options3);
 }
 async function readJsonFile4(path39) {
-  const text2 = await readFile23(path39);
+  const text2 = await readFile22(path39);
   return JSON.parse(text2);
 }
 async function writeJsonFile2(path39, data, options3) {
   const indent = options3?.indent ?? 2;
   const content = `${JSON.stringify(data, null, indent)}
 `;
-  await writeFile17(path39, content);
+  await writeFile16(path39, content);
 }
 var init_fs2 = () => {};
 
@@ -472122,7 +472794,7 @@ import {
   execFile as execFile17
 } from "node:child_process";
 import { accessSync as accessSync2, constants as constants4, realpathSync as realpathSync6 } from "node:fs";
-import { readdir as readdir16, rm as rm6 } from "node:fs/promises";
+import { readdir as readdir16, rm as rm7 } from "node:fs/promises";
 import { dirname as dirname33, join as join63 } from "node:path";
 import { promisify as promisify15 } from "node:util";
 function debugLog4(...args) {
@@ -472354,7 +473026,7 @@ async function cleanupOrphanedDirs2(globalPath) {
       if (entry.startsWith(".letta-code-")) {
         const orphanPath = join63(lettaAiDir, entry);
         debugLog4("Cleaning orphaned temp directory:", orphanPath);
-        await rm6(orphanPath, { recursive: true, force: true });
+        await rm7(orphanPath, { recursive: true, force: true });
       }
     }
   } catch {}
@@ -473822,7 +474494,7 @@ __export(exports_import, {
   extractSkillsFromAf: () => extractSkillsFromAf
 });
 import { createReadStream as createReadStream2 } from "node:fs";
-import { access as access2, chmod, mkdir as mkdir16, readFile as readFile24, writeFile as writeFile18 } from "node:fs/promises";
+import { access as access2, chmod, mkdir as mkdir16, readFile as readFile23, writeFile as writeFile17 } from "node:fs/promises";
 import { dirname as dirname34, isAbsolute as isAbsolute25, relative as relative13, resolve as resolve36, sep as sep7, win32 as win325 } from "node:path";
 function validateImportedSkillName(name) {
   const trimmedName = name.trim();
@@ -473923,7 +474595,7 @@ async function importAgentFromFile(options3) {
 }
 async function extractSkillsFromAf(afPath, destDir) {
   const extracted = [];
-  const content = await readFile24(afPath, "utf-8");
+  const content = await readFile23(afPath, "utf-8");
   const afData = JSON.parse(content);
   if (!afData.skills || !Array.isArray(afData.skills)) {
     return [];
@@ -473952,7 +474624,7 @@ async function writeSkillFiles(skillDir, files) {
 async function writeSkillFile(skillDir, filePath, content) {
   const fullPath = resolveImportedSkillFilePath(skillDir, filePath);
   await mkdir16(dirname34(fullPath), { recursive: true });
-  await writeFile18(fullPath, content, "utf-8");
+  await writeFile17(fullPath, content, "utf-8");
   const isScript = filePath.startsWith("scripts/") || content.trimStart().startsWith("#!");
   if (isScript) {
     try {
@@ -474005,7 +474677,7 @@ function parseRegistryHandle(handle2) {
 async function importAgentFromRegistry(options3) {
   const { tmpdir: tmpdir10 } = await import("node:os");
   const { join: join68 } = await import("node:path");
-  const { writeFile: writeFile19, unlink: unlink5 } = await import("node:fs/promises");
+  const { writeFile: writeFile18, unlink: unlink5 } = await import("node:fs/promises");
   const { author, name } = parseRegistryHandle(options3.handle);
   const rawUrl = `https://raw.githubusercontent.com/${AGENT_REGISTRY_OWNER}/${AGENT_REGISTRY_REPO}/refs/heads/${AGENT_REGISTRY_BRANCH}/agents/@${author}/${name}/${name}.af`;
   const response = await fetch(rawUrl);
@@ -474017,7 +474689,7 @@ async function importAgentFromRegistry(options3) {
   }
   const afContent = await response.text();
   const tempPath = join68(tmpdir10(), `letta-import-${author}-${name}-${Date.now()}.af`);
-  await writeFile19(tempPath, afContent, "utf-8");
+  await writeFile18(tempPath, afContent, "utf-8");
   try {
     const result = await importAgentFromFile({
       filePath: tempPath,
@@ -474125,7 +474797,8 @@ async function ensureDefaultAgents(backend4, options3) {
     const createOptions = personality === "tutorial" ? {
       ...await buildCreateAgentOptionsForPersonality2({
         personalityId: "tutorial",
-        model
+        model,
+        tags: [ONBOARDING_ORIGIN_TAG]
       }),
       memoryPromptMode
     } : {
@@ -476245,7 +476918,7 @@ ${loadedContents.join(`
       markIncompleteToolsAsCancelled(buffers, true, "stream_error");
       const errorLines = toLines(buffers).filter((line) => line.kind === "error");
       const errorMessages2 = errorLines.map((line) => ("text" in line) ? line.text : "").filter(Boolean);
-      let errorMessage = errorMessages2.length > 0 ? errorMessages2.join("; ") : `Unexpected stop reason: ${stopReason}`;
+      let errorMessage2 = errorMessages2.length > 0 ? errorMessages2.join("; ") : `Unexpected stop reason: ${stopReason}`;
       if (lastRunId && errorMessages2.length === 0) {
         try {
           const run = await getBackend().retrieveRun(lastRunId);
@@ -476257,18 +476930,18 @@ ${loadedContents.join(`
                 run_id: lastRunId
               }
             };
-            errorMessage = formatErrorDetails2(errorObject, agent2.id);
+            errorMessage2 = formatErrorDetails2(errorObject, agent2.id);
           }
         } catch (_e) {
-          errorMessage = `${errorMessage}
+          errorMessage2 = `${errorMessage2}
 (Unable to fetch additional error details from server)`;
         }
       }
-      trackHeadlessBoundaryError("headless_turn_failed", errorMessage, "headless_turn_execution");
+      trackHeadlessBoundaryError("headless_turn_failed", errorMessage2, "headless_turn_execution");
       if (outputFormat === "stream-json") {
         const errorMsg = {
           type: "error",
-          message: errorMessage,
+          message: errorMessage2,
           stop_reason: stopReason,
           run_id: lastRunId ?? undefined,
           session_id: sessionId,
@@ -476276,7 +476949,7 @@ ${loadedContents.join(`
         };
         await writeWireMessageAsync(errorMsg);
       } else {
-        console.error(`Error: ${errorMessage}`);
+        console.error(`Error: ${errorMessage2}`);
       }
       await exitHeadless(1, "headless_stop_reason_error");
     }
@@ -478832,7 +479505,7 @@ var init_queued_message_parts = __esm(() => {
 // src/cli/helpers/reflection-arena-hf-upload.ts
 import { execFile as execFileCb5 } from "node:child_process";
 import { existsSync as existsSync60 } from "node:fs";
-import { appendFile as appendFile2, chmod as chmod2, mkdir as mkdir17, writeFile as writeFile19 } from "node:fs/promises";
+import { appendFile as appendFile2, chmod as chmod2, mkdir as mkdir17, writeFile as writeFile18 } from "node:fs/promises";
 import { homedir as homedir38 } from "node:os";
 import { join as join69 } from "node:path";
 import { promisify as promisify16 } from "node:util";
@@ -478871,7 +479544,7 @@ async function runGit6(cwd2, args, env5) {
 }
 async function writeGitAskpass(repoRoot) {
   const askpassPath = join69(repoRoot, "hf-askpass.sh");
-  await writeFile19(askpassPath, [
+  await writeFile18(askpassPath, [
     "#!/bin/sh",
     'case "$1" in',
     "  *Username*) printf '%s\\n' 'hf_user' ;;",
@@ -478956,7 +479629,7 @@ var init_reflection_arena_hf_upload = __esm(() => {
 // src/cli/helpers/reflection-arena.ts
 import { execFile as execFileCb6 } from "node:child_process";
 import { randomInt, randomUUID as randomUUID30 } from "node:crypto";
-import { appendFile as appendFile3, mkdir as mkdir18, readFile as readFile25, writeFile as writeFile20 } from "node:fs/promises";
+import { appendFile as appendFile3, mkdir as mkdir18, readFile as readFile24, writeFile as writeFile19 } from "node:fs/promises";
 import { homedir as homedir39 } from "node:os";
 import { join as join70 } from "node:path";
 import { promisify as promisify17 } from "node:util";
@@ -479001,11 +479674,11 @@ function getReflectionArenaRunPath(runId) {
 }
 async function saveReflectionArenaRun(run) {
   await mkdir18(getReflectionArenaRunsDir(), { recursive: true });
-  await writeFile20(getReflectionArenaRunPath(run.runId), `${JSON.stringify(run, null, 2)}
+  await writeFile19(getReflectionArenaRunPath(run.runId), `${JSON.stringify(run, null, 2)}
 `, "utf-8");
 }
 async function loadReflectionArenaRun(runId) {
-  const raw2 = await readFile25(getReflectionArenaRunPath(runId), "utf-8");
+  const raw2 = await readFile24(getReflectionArenaRunPath(runId), "utf-8");
   return JSON.parse(raw2);
 }
 async function updateReflectionArenaRun(runId, update2) {
@@ -479197,7 +479870,7 @@ async function appendChoiceRecord(run) {
 }
 async function readTranscriptPayloadForTelemetry(payloadPath) {
   try {
-    const transcript = await readFile25(payloadPath, "utf-8");
+    const transcript = await readFile24(payloadPath, "utf-8");
     return {
       transcriptPayload: transcript.slice(0, REFLECTION_ARENA_TELEMETRY_TRANSCRIPT_MAX_CHARS),
       transcriptPayloadChars: transcript.length,
@@ -489773,7 +490446,7 @@ var init_AgentInfoBar = __esm(async () => {
     const isLocalAgent = agentId ? isLocalAgentId2(agentId) : false;
     const showCloudLinks = Boolean(isCloudUser && agentId && !isLocalAgent);
     const adeConversationUrl = showCloudLinks && agentId && agentId !== "loading" ? buildChatUrl(agentId, { conversationId }) : "";
-    const usageUrl = buildAppUrl("/settings/organization/usage");
+    const usageUrl = buildChatWebUrl("/preferences/usage");
     const showBottomBar = agentId && agentId !== "loading";
     const reasoningLabel = shouldHideReasoningForModelDisplay(currentModel) ? null : formatReasoningLabel(currentReasoningEffort);
     const modelLine = currentModel ? `${currentModel}${reasoningLabel ? ` (${reasoningLabel})` : ""}` : null;
@@ -493294,7 +493967,7 @@ function buildInstallPrBody(workflowPath) {
     "",
     "You can also specify a particular agent: `@letta-code [--agent agent-xxx]`",
     "",
-    "View agent runs and conversations at [app.letta.com](https://app.letta.com).",
+    "Chat with your agent at [chat.letta.com](https://chat.letta.com).",
     "",
     "### Important Notes",
     "",
@@ -493615,7 +494288,7 @@ var init_InstallGithubAppFlow = __esm(async () => {
     const solidLine = SOLID_LINE12.repeat(Math.max(terminalWidth, 10));
     const [step, setStep] = import_react87.useState("checking");
     const [status, setStatus] = import_react87.useState("Checking GitHub CLI prerequisites...");
-    const [errorMessage, setErrorMessage] = import_react87.useState("");
+    const [errorMessage2, setErrorMessage] = import_react87.useState("");
     const [currentRepo, setCurrentRepo] = import_react87.useState(null);
     const [repoChoiceIndex, setRepoChoiceIndex] = import_react87.useState(0);
     const [repoInput, setRepoInput] = import_react87.useState("");
@@ -494183,14 +494856,14 @@ var init_InstallGithubAppFlow = __esm(async () => {
           color: "red",
           children: [
             "Error: ",
-            errorMessage.split(`
+            errorMessage2.split(`
 `)[0] || "Unknown error"
           ]
         }, undefined, true, undefined, this),
         /* @__PURE__ */ jsx_dev_runtime61.jsxDEV(Box_default, {
           height: 1
         }, undefined, false, undefined, this),
-        errorMessage.split(`
+        errorMessage2.split(`
 `).slice(1).filter((line) => line.trim().length > 0).map((line, idx) => /* @__PURE__ */ jsx_dev_runtime61.jsxDEV(Text2, {
           dimColor: true,
           children: line
@@ -494435,7 +495108,7 @@ var init_McpConnectFlow = __esm(async () => {
                   const authorizationUrl = event2.url;
                   setAuthUrl(authorizationUrl);
                   setConnectionStatus("Opening browser for authorization...");
-                  Promise.resolve().then(() => (init_open(), exports_open)).then(({ default: open4 }) => open4(authorizationUrl)).catch(() => {});
+                  Promise.resolve().then(() => (init_open(), exports_open)).then(({ default: open5 }) => open5(authorizationUrl)).catch(() => {});
                 }
                 break;
               case "waiting_for_auth" /* WAITING_FOR_AUTH */:
@@ -496859,13 +497532,16 @@ html.dark .warning-badge { background: hsl(42, 30%, 18%); color: hsl(42, 80%, 70
   var agentIdEl = document.getElementById('agent-id');
   agentIdEl.textContent = agentId;
   if (agentId) {
-    var adeBase;
-    if (serverUrl) {
-      adeBase = serverUrl.replace(/\\/v1\\/?$/, '').replace('api.letta.com', 'app.letta.com');
+    var chatBase;
+    var normalizedServerUrl = serverUrl.replace(/\\/+$/, '');
+    if (normalizedServerUrl === 'https://api.letta.com' || normalizedServerUrl === 'https://api.letta.com/v1') {
+      chatBase = 'https://chat.letta.com';
+    } else if (normalizedServerUrl) {
+      chatBase = normalizedServerUrl.replace(/\\/v1$/, '');
     } else {
-      adeBase = 'https://app.letta.com';
+      chatBase = 'https://chat.letta.com';
     }
-    agentIdEl.href = adeBase + '/chat/' + encodeURIComponent(agentId);
+    agentIdEl.href = chatBase + '/chat/' + encodeURIComponent(agentId);
     agentIdEl.target = '_blank';
   }
   document.getElementById('generated-at').textContent = 'Generated ' + new Date(DATA.generatedAt).toLocaleString();
@@ -500626,7 +501302,7 @@ var init_PersonalitySelector = __esm(async () => {
 });
 
 // src/utils/aws-credentials.ts
-import { readFile as readFile26 } from "node:fs/promises";
+import { readFile as readFile25 } from "node:fs/promises";
 import { homedir as homedir45 } from "node:os";
 import { join as join77 } from "node:path";
 async function parseAwsCredentials() {
@@ -500634,11 +501310,11 @@ async function parseAwsCredentials() {
   const configPath = join77(homedir45(), ".aws", "config");
   const profiles = new Map;
   try {
-    const content = await readFile26(credentialsPath, "utf-8");
+    const content = await readFile25(credentialsPath, "utf-8");
     parseIniFile(content, profiles, false);
   } catch {}
   try {
-    const content = await readFile26(configPath, "utf-8");
+    const content = await readFile25(configPath, "utf-8");
     parseIniFile(content, profiles, true);
   } catch {}
   return Array.from(profiles.values());
@@ -505910,7 +506586,7 @@ function formatUsageStats({
     const monthlyCredits = Math.round(balance.monthly_credit_balance);
     const purchasedCredits = Math.round(balance.purchased_credit_balance);
     const toDollars = (credits) => (credits / 1000).toFixed(2);
-    outputLines.push(`Plan: [${balance.billing_tier}]`, buildAppUrl("/settings/organization/usage"), "", `Available credits:     ◎${formatNumber2(totalCredits)} ($${toDollars(totalCredits)})`, `Monthly credits:       ◎${formatNumber2(monthlyCredits)} ($${toDollars(monthlyCredits)})`, `Purchased credits:     ◎${formatNumber2(purchasedCredits)} ($${toDollars(purchasedCredits)})`);
+    outputLines.push(`Plan: [${balance.billing_tier}]`, buildChatWebUrl("/preferences/usage"), "", `Available credits:     ◎${formatNumber2(totalCredits)} ($${toDollars(totalCredits)})`, `Monthly credits:       ◎${formatNumber2(monthlyCredits)} ($${toDollars(monthlyCredits)})`, `Purchased credits:     ◎${formatNumber2(purchasedCredits)} ($${toDollars(purchasedCredits)})`);
   }
   return outputLines.join(`
 `);
@@ -516961,13 +517637,13 @@ var init_cleanLastNewline = () => {};
 function processLine(node, line, state) {
   const lineInfo = typeof state.lineInfo === "function" ? state.lineInfo(line) : state.lineInfo[line - 1];
   if (lineInfo == null) {
-    const errorMessage = `processLine: line ${line}, contains no state.lineInfo`;
-    console.error(errorMessage, {
+    const errorMessage2 = `processLine: line ${line}, contains no state.lineInfo`;
+    console.error(errorMessage2, {
       node,
       line,
       state
     });
-    throw new Error(errorMessage);
+    throw new Error(errorMessage2);
   }
   node.tagName = "div";
   node.properties["data-line"] = lineInfo.lineNumber;
@@ -520439,9 +521115,9 @@ var instanceId = -1, DiffHunksRenderer = class {
           let deletionLineContent = deletionLine != null ? deletionLines[deletionLine.lineIndex] : undefined;
           let additionLineContent = additionLine != null ? additionLines[additionLine.lineIndex] : undefined;
           if (deletionLineContent == null && additionLineContent == null) {
-            const errorMessage = "DiffHunksRenderer.processDiffResult: deletionLine and additionLine are null, something is wrong";
-            console.error(errorMessage, { file: fileDiff.name });
-            throw new Error(errorMessage);
+            const errorMessage2 = "DiffHunksRenderer.processDiffResult: deletionLine and additionLine are null, something is wrong";
+            console.error(errorMessage2, { file: fileDiff.name });
+            throw new Error(errorMessage2);
           }
           const lineType = type3 === "change" ? additionLine != null ? "change-addition" : "change-deletion" : type3;
           const lineDecoration = this.getUnifiedLineDecoration({
@@ -520483,9 +521159,9 @@ var instanceId = -1, DiffHunksRenderer = class {
             lineIndex: additionLine?.lineIndex
           });
           if (deletionLineContent == null && additionLineContent == null) {
-            const errorMessage = "DiffHunksRenderer.processDiffResult: deletionLine and additionLine are null, something is wrong";
-            console.error(errorMessage, { file: fileDiff.name });
-            throw new Error(errorMessage);
+            const errorMessage2 = "DiffHunksRenderer.processDiffResult: deletionLine and additionLine are null, something is wrong";
+            console.error(errorMessage2, { file: fileDiff.name });
+            throw new Error(errorMessage2);
           }
           const missingSide = (() => {
             if (type3 === "change") {
@@ -528012,7 +528688,7 @@ The deployment target for this project is CITATION-DOGFOOD-OK.
 
 // src/mods/learning-harness.ts
 import { spawn as spawn13 } from "node:child_process";
-import { access as access3, copyFile as copyFile2, mkdir as mkdir19, readFile as readFile27, writeFile as writeFile21 } from "node:fs/promises";
+import { access as access3, copyFile as copyFile2, mkdir as mkdir19, readFile as readFile26, writeFile as writeFile20 } from "node:fs/promises";
 import path42 from "node:path";
 function slugify2(value) {
   const slug = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -528260,14 +528936,14 @@ async function existingPath(filePath) {
   return await fileExists(filePath) ? filePath : undefined;
 }
 async function writeJsonArtifact(filePath, value) {
-  await writeFile21(filePath, `${JSON.stringify(value, null, 2)}
+  await writeFile20(filePath, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
 async function writeCommandArtifacts(prefix, command, args, result) {
-  await writeFile21(`${prefix}.command.txt`, `${renderCommand(command, args)}
+  await writeFile20(`${prefix}.command.txt`, `${renderCommand(command, args)}
 `, "utf8");
-  await writeFile21(`${prefix}.stdout`, result.stdout, "utf8");
-  await writeFile21(`${prefix}.stderr`, result.stderr, "utf8");
+  await writeFile20(`${prefix}.stdout`, result.stdout, "utf8");
+  await writeFile20(`${prefix}.stderr`, result.stderr, "utf8");
   await writeJsonArtifact(`${prefix}.result.json`, result);
 }
 async function prepareMemoryFiles(memoryDir, memoryFiles) {
@@ -528275,7 +528951,7 @@ async function prepareMemoryFiles(memoryDir, memoryFiles) {
   for (const [relativePath, content] of Object.entries(memoryFiles ?? {})) {
     const filePath = safeJoin(memoryDir, relativePath);
     await mkdir19(path42.dirname(filePath), { recursive: true });
-    await writeFile21(filePath, content, "utf8");
+    await writeFile20(filePath, content, "utf8");
   }
 }
 function renderEvaluationPrompt(prompt, memoryDir) {
@@ -528938,7 +529614,7 @@ function renderProposerGuide(params) {
 `;
 }
 async function writeHistoryArtifacts(params) {
-  await writeFile21(params.historyPath, renderHistoryIndex({
+  await writeFile20(params.historyPath, renderHistoryIndex({
     attempts: params.attempts,
     historyManifestPath: params.historyManifestPath,
     proposerGuidePath: params.proposerGuidePath,
@@ -528946,7 +529622,7 @@ async function writeHistoryArtifacts(params) {
     spec: params.spec
   }), "utf8");
   await writeJsonArtifact(params.historyManifestPath, buildHistoryManifest(params));
-  await writeFile21(params.proposerGuidePath, renderProposerGuide(params), "utf8");
+  await writeFile20(params.proposerGuidePath, renderProposerGuide(params), "utf8");
 }
 async function defaultCommandRunner(command, args, options3) {
   const startedAt = Date.now();
@@ -529037,7 +529713,7 @@ function createScenarioSuiteEvaluator(params) {
               outputFormat
             })
           ];
-          await writeFile21(hasConfiguredScenarios ? path42.join(scenarioDir, "prompt.md") : path42.join(context4.runDir, "eval-prompt.md"), evalPrompt, "utf8");
+          await writeFile20(hasConfiguredScenarios ? path42.join(scenarioDir, "prompt.md") : path42.join(context4.runDir, "eval-prompt.md"), evalPrompt, "utf8");
           const scenarioEvalResult = await context4.runner(context4.cliCommand, evalArgs, {
             cwd: context4.repoRoot,
             env: {
@@ -529229,7 +529905,7 @@ async function runModLearningCandidate(params) {
         outputFormat: "json"
       })
     ];
-    await writeFile21(path42.join(runDir, "generation-prompt.md"), generationPrompt, "utf8");
+    await writeFile20(path42.join(runDir, "generation-prompt.md"), generationPrompt, "utf8");
     generationResult = await params.runner(params.cliCommand, generationArgs, {
       cwd: repoRoot,
       env: {
@@ -529308,7 +529984,7 @@ async function runModLearningCandidate(params) {
     spec: options3.spec
   };
   await writeJsonArtifact(path42.join(runDir, "report.json"), report);
-  await writeFile21(reportPath, renderMarkdownReport(report), "utf8");
+  await writeFile20(reportPath, renderMarkdownReport(report), "utf8");
   await writeCandidateManifest(report);
   emitProgress("done", params.candidateCount > 1 ? `Optimization iteration ${params.candidateIndex}/${params.candidateCount} complete` : "mod optimization complete", {
     attempts: [...params.previousAttempts, summarizeAttempt(report)],
@@ -529486,7 +530162,7 @@ async function runModLearning(options3) {
     spec: normalizedOptions.spec
   });
   await writeJsonArtifact(path42.join(runDir, "report.json"), report);
-  await writeFile21(reportPath, renderMarkdownReport(report), "utf8");
+  await writeFile20(reportPath, renderMarkdownReport(report), "utf8");
   normalizedOptions.onProgress?.({
     candidateCount,
     candidateIndex: selectedCandidateIndex,
@@ -529504,7 +530180,7 @@ async function runModLearning(options3) {
   return report;
 }
 async function readModLearningEnv(envPath) {
-  return JSON.parse(await readFile27(envPath, "utf8"));
+  return JSON.parse(await readFile26(envPath, "utf8"));
 }
 var init_learning_harness = __esm(async () => {
   await init_mod_engine();
@@ -530589,19 +531265,12 @@ Messages will be executed locally using your letta-code environment.`, true);
     const deviceName = hostname8();
     updateCommandResult3(ctx.buffersRef, ctx.refreshDerived, cmdId, msg, `Registering listener "${connectionName}"...
 Device: ${deviceName} (${deviceId.slice(0, 8)}...)`, true, "running");
-    const serverUrl = getServerUrl();
-    const settings3 = await settingsManager.getSettingsWithSecureTokens();
-    const apiKey = process.env.LETTA_API_KEY || settings3.env?.LETTA_API_KEY;
-    if (!apiKey) {
-      throw new Error("Missing LETTA_API_KEY");
-    }
-    const { connectionId, wsUrl, supportsSplitStatusChannels } = await registerWithCloudRetry({
-      serverUrl,
-      apiKey,
-      deviceId,
-      connectionName,
-      listenerInstanceId: deriveListenerInstanceId("listen", connectionName)
-    }, {
+    const resolveRegisterOptions = () => resolveListenerRegistrationOptions(deviceId, connectionName, {
+      allowInteractiveOAuth: false,
+      surface: "listen"
+    });
+    const registerOptions = await resolveRegisterOptions();
+    const { connectionId, wsUrl, supportsSplitStatusChannels } = await registerWithCloudRetry(registerOptions, {
       onRetry: (attempt, delayMs, error54) => {
         updateCommandResult3(ctx.buffersRef, ctx.refreshDerived, cmdId, msg, `Registering listener "${connectionName}"...
 Retry ${attempt} in ${Math.round(delayMs / 1000)}s: ${error54.message}`, true, "running");
@@ -530655,13 +531324,8 @@ Awaiting instructions${urlText}`, true, "finished");
         onNeedsReregister: async () => {
           updateCommandResult3(ctx.buffersRef, ctx.refreshDerived, cmdId, msg, `Environment expired, re-registering "${connectionName}"...`, true, "running");
           try {
-            const reregisterResult = await registerWithCloudRetry({
-              serverUrl,
-              apiKey,
-              deviceId,
-              connectionName,
-              listenerInstanceId: deriveListenerInstanceId("listen", connectionName)
-            }, {
+            const nextRegisterOptions = await resolveRegisterOptions();
+            const reregisterResult = await registerWithCloudRetry(nextRegisterOptions, {
               maxDurationMs: Infinity,
               onRetry: (attempt, delayMs, error54) => {
                 updateCommandResult3(ctx.buffersRef, ctx.refreshDerived, cmdId, msg, `Re-registering "${connectionName}"...
@@ -530694,10 +531358,10 @@ Retry ${attempt} in ${Math.round(delayMs / 1000)}s: ${error54.message}`, true, "
 }
 var activeCommandId3 = null;
 var init_listen = __esm(() => {
-  init_client2();
   init_app_urls();
   init_settings_manager();
   init_listen_register();
+  init_auth();
 });
 
 // src/cli/app/submit-connection-commands.ts
@@ -531896,7 +532560,7 @@ var exports_export = {};
 __export(exports_export, {
   packageSkills: () => packageSkills
 });
-import { readdir as readdir17, readFile as readFile28 } from "node:fs/promises";
+import { readdir as readdir17, readFile as readFile27 } from "node:fs/promises";
 import { relative as relative16, resolve as resolve40 } from "node:path";
 async function packageSkills(agentId, skillsDir) {
   const skills = [];
@@ -531917,7 +532581,7 @@ async function packageSkills(agentId, skillsDir) {
         const skillDir = resolve40(baseDir, entry.name);
         const skillMdPath = resolve40(skillDir, "SKILL.md");
         try {
-          await readFile28(skillMdPath, "utf-8");
+          await readFile27(skillMdPath, "utf-8");
         } catch {
           console.warn(`Skipping invalid skill ${entry.name}: missing SKILL.md`);
           continue;
@@ -531949,7 +532613,7 @@ async function readSkillFiles(skillDir) {
       if (entry.isDirectory()) {
         await walk(fullPath);
       } else {
-        const content = await readFile28(fullPath, "utf-8");
+        const content = await readFile27(fullPath, "utf-8");
         const relativePath = relative16(skillDir, fullPath).replace(/\\/g, "/");
         files[relativePath] = content;
       }
@@ -532768,7 +533432,7 @@ ${SYSTEM_REMINDER_CLOSE}`),
         const adeUrl = buildChatUrl(agentId, {
           conversationId: conversationIdRef.current
         });
-        Promise.resolve().then(() => (init_open(), exports_open)).then(({ default: open4 }) => open4(adeUrl, { wait: false })).catch(() => {});
+        Promise.resolve().then(() => (init_open(), exports_open)).then(({ default: open5 }) => open5(adeUrl, { wait: false })).catch(() => {});
         cmd.finish(`Opening ADE...
 → ${adeUrl}`, true);
         return { submitted: true };
@@ -538727,7 +539391,8 @@ async function ensureDefaultAgents2(backend4, options3) {
     const createOptions = personality === "tutorial" ? {
       ...await buildCreateAgentOptionsForPersonality2({
         personalityId: "tutorial",
-        model
+        model,
+        tags: [ONBOARDING_ORIGIN_TAG]
       }),
       memoryPromptMode
     } : {
@@ -538975,7 +539640,7 @@ __export(exports_import2, {
   extractSkillsFromAf: () => extractSkillsFromAf2
 });
 import { createReadStream as createReadStream3 } from "node:fs";
-import { access as access4, chmod as chmod3, mkdir as mkdir20, readFile as readFile29, writeFile as writeFile22 } from "node:fs/promises";
+import { access as access4, chmod as chmod3, mkdir as mkdir20, readFile as readFile28, writeFile as writeFile21 } from "node:fs/promises";
 import { dirname as dirname38, isAbsolute as isAbsolute27, relative as relative17, resolve as resolve41, sep as sep8, win32 as win326 } from "node:path";
 function validateImportedSkillName2(name) {
   const trimmedName = name.trim();
@@ -539076,7 +539741,7 @@ async function importAgentFromFile2(options3) {
 }
 async function extractSkillsFromAf2(afPath, destDir) {
   const extracted = [];
-  const content = await readFile29(afPath, "utf-8");
+  const content = await readFile28(afPath, "utf-8");
   const afData = JSON.parse(content);
   if (!afData.skills || !Array.isArray(afData.skills)) {
     return [];
@@ -539105,7 +539770,7 @@ async function writeSkillFiles2(skillDir, files) {
 async function writeSkillFile2(skillDir, filePath, content) {
   const fullPath = resolveImportedSkillFilePath2(skillDir, filePath);
   await mkdir20(dirname38(fullPath), { recursive: true });
-  await writeFile22(fullPath, content, "utf-8");
+  await writeFile21(fullPath, content, "utf-8");
   const isScript = filePath.startsWith("scripts/") || content.trimStart().startsWith("#!");
   if (isScript) {
     try {
@@ -539158,7 +539823,7 @@ function parseRegistryHandle2(handle2) {
 async function importAgentFromRegistry2(options3) {
   const { tmpdir: tmpdir12 } = await import("node:os");
   const { join: join84 } = await import("node:path");
-  const { writeFile: writeFile23, unlink: unlink5 } = await import("node:fs/promises");
+  const { writeFile: writeFile22, unlink: unlink5 } = await import("node:fs/promises");
   const { author, name } = parseRegistryHandle2(options3.handle);
   const rawUrl = `https://raw.githubusercontent.com/${AGENT_REGISTRY_OWNER2}/${AGENT_REGISTRY_REPO2}/refs/heads/${AGENT_REGISTRY_BRANCH2}/agents/@${author}/${name}/${name}.af`;
   const response = await fetch(rawUrl);
@@ -539170,7 +539835,7 @@ async function importAgentFromRegistry2(options3) {
   }
   const afContent = await response.text();
   const tempPath = join84(tmpdir12(), `letta-import-${author}-${name}-${Date.now()}.af`);
-  await writeFile23(tempPath, afContent, "utf-8");
+  await writeFile22(tempPath, afContent, "utf-8");
   try {
     const result = await importAgentFromFile2({
       filePath: tempPath,
@@ -542506,14 +543171,18 @@ function resolveImportFlagAlias(options3) {
   return options3.importFlagValue ?? options3.fromAfFlagValue;
 }
 
+// src/cli/helpers/app-urls.ts
+var CHAT_BASE2 = "https://chat.letta.com";
+var LETTA_CHAT_API_KEYS_URL2 = `${CHAT_BASE2}/preferences/api-keys`;
+
 // src/cli/helpers/error-formatter.ts
 init_error();
 init_conversation_busy_error();
 init_app_urls();
 init_error_context();
 init_zai_errors();
-var LETTA_USAGE_URL2 = buildAppUrl("/settings/organization/usage");
-var LETTA_AGENTS_URL2 = buildAppUrl("/projects/default-project/agents");
+var LETTA_USAGE_URL2 = buildChatWebUrl("/preferences/usage");
+var LETTA_AGENTS_URL2 = buildPlatformUrl("/projects/default-project/agents");
 function formatConversationBusyErrorForDisplay2(errorText, runId, options3) {
   if (!isConversationBusyErrorText(errorText))
     return null;
@@ -544256,7 +544925,7 @@ import WebSocket7, { WebSocketServer } from "ws";
 
 // src/websocket/app-server-auth.ts
 import { createHash as createHash5, createHmac, timingSafeEqual } from "node:crypto";
-import { readFile as readFile13 } from "node:fs/promises";
+import { readFile as readFile12 } from "node:fs/promises";
 import { isIP as isIP2 } from "node:net";
 import { isAbsolute as isAbsolute22 } from "node:path";
 var INVALID_AUTHORIZATION_HEADER_MESSAGE = "invalid authorization header";
@@ -544500,7 +545169,7 @@ function bearerTokenFromHeaders(headers) {
 async function readTrimmedSecret(path31) {
   let raw2;
   try {
-    raw2 = await readFile13(path31, "utf8");
+    raw2 = await readFile12(path31, "utf8");
   } catch (error54) {
     const message = error54 instanceof Error ? error54.message : String(error54);
     throw new Error(`failed to read websocket auth secret ${path31}: ${message}`);
@@ -546350,10 +547019,10 @@ import { parseArgs as parseArgs7 } from "node:util";
 
 // src/cli/subcommands/dream-sources/index.ts
 init_reflection_transcript();
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 
 // src/cli/subcommands/dream-sources/openhands.ts
-import { readdir as readdir12, readFile as readFile19, stat as stat14 } from "node:fs/promises";
+import { readdir as readdir12, readFile as readFile18, stat as stat14 } from "node:fs/promises";
 import { join as join52 } from "node:path";
 var RESULT_TEXT_TRUNCATE_LIMIT = 4000;
 function joinTextContent(content) {
@@ -546480,7 +547149,7 @@ async function readOpenHandsEventDir(dir) {
   }
   const events = [];
   for (const name of fileNames) {
-    const raw2 = await readFile19(join52(eventsDir, name), "utf-8");
+    const raw2 = await readFile18(join52(eventsDir, name), "utf-8");
     const event2 = safeJsonParseOr(raw2, null);
     if (event2 && typeof event2 === "object") {
       events.push(event2);
@@ -546495,17 +547164,17 @@ var openHandsAdapter = {
     if (info?.isDirectory()) {
       return convertOpenHandsEvents(await readOpenHandsEventDir(locator));
     }
-    const raw2 = await readFile19(locator, "utf-8");
+    const raw2 = await readFile18(locator, "utf-8");
     return convertOpenHandsEvents(parseOpenHandsEventsFile(raw2, locator));
   }
 };
 
 // src/cli/subcommands/dream-sources/transcript.ts
-import { readFile as readFile20 } from "node:fs/promises";
+import { readFile as readFile19 } from "node:fs/promises";
 var transcriptAdapter = {
   type: "transcript",
   async convert(locator) {
-    const raw2 = await readFile20(locator, "utf-8");
+    const raw2 = await readFile19(locator, "utf-8");
     const entries = [];
     for (const line of raw2.split(`
 `)) {
@@ -546543,7 +547212,7 @@ function parseFromSource(spec) {
   return { adapter, locator };
 }
 function conversationIdForSource(parsed) {
-  const hash4 = createHash6("sha1").update(`${parsed.adapter.type}:${parsed.locator}`).digest("hex").slice(0, 12);
+  const hash4 = createHash7("sha1").update(`${parsed.adapter.type}:${parsed.locator}`).digest("hex").slice(0, 12);
   return `from-${parsed.adapter.type}-${hash4}`;
 }
 async function stageFromSource(agentId, parsed) {
@@ -546557,7 +547226,7 @@ async function stageFromSource(agentId, parsed) {
 init_memory_filesystem2();
 init_memory_git();
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { mkdir as mkdir13, readFile as readFile21, rm as rm5, writeFile as writeFile15 } from "node:fs/promises";
+import { mkdir as mkdir13, readFile as readFile20, rm as rm6, writeFile as writeFile14 } from "node:fs/promises";
 import { basename as basename25, dirname as dirname27, join as join53 } from "node:path";
 function resolveDreamTarget(spec) {
   const fileName = basename25(spec);
@@ -546633,7 +547302,7 @@ function buildTargetInstruction(target2) {
 }
 async function readExistingTarget(target2) {
   try {
-    return await readFile21(target2.path, "utf-8");
+    return await readFile20(target2.path, "utf-8");
   } catch {
     return null;
   }
@@ -546661,7 +547330,7 @@ async function syncTargetIntoMemory(agentId, target2, content) {
   }
   const absPath = join53(memoryDir, relPath);
   await mkdir13(dirname27(absPath), { recursive: true });
-  await writeFile15(absPath, addManagedFrontmatter(content, target2.kind), "utf-8");
+  await writeFile14(absPath, addManagedFrontmatter(content, target2.kind), "utf-8");
   try {
     const { getBackend: getBackend2 } = await Promise.resolve().then(() => (init_backend2(), exports_backend));
     const syncMode = getBackend2().capabilities.localMemfs ? "local" : "remote";
@@ -546678,7 +547347,7 @@ async function syncTargetIntoMemory(agentId, target2, content) {
     });
     return { synced: result.committed };
   } catch (error54) {
-    await rm5(absPath, { force: true });
+    await rm6(absPath, { force: true });
     throw error54;
   }
 }
@@ -546694,7 +547363,7 @@ function readTargetFromMemory(agentId, target2) {
 }
 async function writeTarget(target2, content) {
   await mkdir13(dirname27(target2.path), { recursive: true });
-  await writeFile15(target2.path, content, "utf-8");
+  await writeFile14(target2.path, content, "utf-8");
 }
 
 // src/cli/subcommands/dream.ts
@@ -546721,6 +547390,11 @@ Options:
   --timeout <seconds>         Fail if the reflection pass has not completed
                               in this many seconds (default: 1500)
   -i, --instruction <text>    Additional instruction for the reflection pass
+  --prompt <text>             Advanced: replace the reflection task prompt
+                              entirely (you supply the transcript/memory
+                              mechanics via $TRANSCRIPT_PATH and $MEMORY_DIR)
+  --system <text>             Advanced: replace the reflection subagent's
+                              system prompt
   --json                      Emit machine-readable JSON output
   -h, --help                  Show this help
 
@@ -546739,6 +547413,8 @@ var DREAM_OPTIONS = {
   effort: { type: "string" },
   timeout: { type: "string" },
   instruction: { type: "string", short: "i" },
+  prompt: { type: "string" },
+  system: { type: "string" },
   json: { type: "boolean" }
 };
 var DEFAULT_TIMEOUT_SECONDS = 1500;
@@ -546871,6 +547547,8 @@ ${targetInstruction}` : targetInstruction;
     description: "Reflect on recent conversations",
     model: parsed.values.model,
     instruction,
+    reflectionPromptOverride: parsed.values.prompt,
+    reflectionSystemPromptOverride: parsed.values.system,
     recompileByConversation: new Map,
     recompileQueuedByConversation: new Set,
     onCompletionMessage: (message, completionResult) => {
@@ -547125,7 +547803,6 @@ async function runEnvironmentsSubcommand(argv, deps = {}) {
 }
 
 // src/cli/subcommands/listen.tsx
-init_oauth();
 init_paths();
 init_restore_scope();
 await __promiseAll([
@@ -547298,26 +547975,9 @@ class RemoteSessionLog {
 
 // src/cli/subcommands/listen.tsx
 init_listen_register();
+init_auth();
 var jsx_dev_runtime12 = __toESM(require_jsx_dev_runtime(), 1);
-var LISTENER_TOKEN_REFRESH_WINDOW_MS = 5 * 60 * 1000;
 var activeListenerProcessAnchors = new Set;
-var defaultListenerOAuthDeps = {
-  LETTA_CLOUD_API_URL,
-  pollForToken,
-  refreshAccessToken,
-  requestDeviceCode
-};
-var listenerOAuthDepsOverride = null;
-function getListenerOAuthDeps() {
-  return listenerOAuthDepsOverride ?? defaultListenerOAuthDeps;
-}
-
-class MissingListenerApiKeyError extends Error {
-  constructor() {
-    super("LETTA_API_KEY not found");
-    this.name = "MissingListenerApiKeyError";
-  }
-}
 function PromptEnvName(props) {
   const [value, setValue] = import_react33.useState("");
   return /* @__PURE__ */ jsx_dev_runtime12.jsxDEV(Box_default, {
@@ -547367,16 +548027,6 @@ async function flushListenerTelemetryEnd(exitReason) {
     await telemetry.flush();
   } catch {}
 }
-function getListenerServerUrl(settings3) {
-  const oauthDeps = getListenerOAuthDeps();
-  return process.env.LETTA_BASE_URL || settings3.env?.LETTA_BASE_URL || oauthDeps.LETTA_CLOUD_API_URL;
-}
-function normalizeListenerBaseUrl(url2) {
-  return url2.trim().replace(/\/+$/, "");
-}
-function isCloudListenerServerUrl(serverUrl) {
-  return normalizeListenerBaseUrl(serverUrl) === normalizeListenerBaseUrl(getListenerOAuthDeps().LETTA_CLOUD_API_URL);
-}
 async function resolveListenerStartupMode(channelNames) {
   const settings3 = await settingsManager.getSettingsWithSecureTokens();
   const serverUrl = getListenerServerUrl(settings3);
@@ -547404,84 +548054,6 @@ function getScopedChannelRestoreAgentScope() {
 function resolveChannelRestoreAgentScope(scopedRestoreAgentScope) {
   return scopedRestoreAgentScope ?? parseChannelRestoreAgentScope(process.env[RESTORE_CHANNEL_AGENT_SCOPE_ENV]) ?? (isLocalBackendEnvEnabled() ? "local" : "cloud");
 }
-async function refreshListenerAccessToken(settings3, deviceId, connectionName) {
-  const oauthDeps = getListenerOAuthDeps();
-  const now = Date.now();
-  console.log("Access token expired, refreshing...");
-  const tokens = await oauthDeps.refreshAccessToken(settings3.refreshToken, deviceId, connectionName);
-  settingsManager.updateSettings({
-    env: { LETTA_API_KEY: tokens.access_token },
-    tokenExpiresAt: now + tokens.expires_in * 1000,
-    ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {}
-  });
-  await settingsManager.flush();
-  console.log("Token refreshed successfully.");
-  return tokens.access_token;
-}
-async function runListenerOAuthLogin(deviceId, connectionName) {
-  const oauthDeps = getListenerOAuthDeps();
-  console.log(`No API key found. Starting OAuth login...
-`);
-  const deviceData = await oauthDeps.requestDeviceCode();
-  console.log(`To authenticate, visit: ${deviceData.verification_uri_complete}`);
-  console.log(`Your code: ${deviceData.user_code}
-`);
-  console.log(`Waiting for authorization...
-`);
-  const tokens = await oauthDeps.pollForToken(deviceData.device_code, deviceData.interval, deviceData.expires_in, deviceId, connectionName);
-  const now = Date.now();
-  settingsManager.updateSettings({
-    env: { LETTA_API_KEY: tokens.access_token },
-    tokenExpiresAt: now + tokens.expires_in * 1000,
-    ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {}
-  });
-  await settingsManager.flush();
-  console.log(`Authenticated successfully.
-`);
-  return tokens.access_token;
-}
-async function resolveListenerRegistrationOptions(deviceId, connectionName) {
-  const settings3 = await settingsManager.getSettingsWithSecureTokens();
-  const serverUrl = getListenerServerUrl(settings3);
-  const envApiKey = process.env.LETTA_API_KEY;
-  if (envApiKey) {
-    return {
-      serverUrl,
-      apiKey: envApiKey,
-      deviceId,
-      connectionName,
-      listenerInstanceId: deriveListenerInstanceId("server", connectionName)
-    };
-  }
-  let apiKey = settings3.env?.LETTA_API_KEY;
-  if (isCloudListenerServerUrl(serverUrl)) {
-    const expiresAt = settings3.tokenExpiresAt;
-    if (settings3.refreshToken && expiresAt) {
-      const now = Date.now();
-      if (!apiKey || now >= expiresAt - LISTENER_TOKEN_REFRESH_WINDOW_MS) {
-        try {
-          apiKey = await refreshListenerAccessToken(settings3, deviceId, connectionName);
-        } catch (refreshErr) {
-          console.warn("Token refresh failed:", refreshErr instanceof Error ? refreshErr.message : String(refreshErr));
-          apiKey = undefined;
-        }
-      }
-    }
-    if (!apiKey) {
-      apiKey = await runListenerOAuthLogin(deviceId, connectionName);
-    }
-  }
-  if (!apiKey) {
-    throw new MissingListenerApiKeyError;
-  }
-  return {
-    serverUrl,
-    apiKey,
-    deviceId,
-    connectionName,
-    listenerInstanceId: deriveListenerInstanceId("server", connectionName)
-  };
-}
 var LISTEN_OPTIONS = {
   "env-name": { type: "string" },
   channels: { type: "string" },
@@ -548686,7 +549258,7 @@ async function runMemorySubcommand(argv) {
 init_backend2();
 init_message_search();
 init_settings_manager();
-import { writeFile as writeFile16 } from "node:fs/promises";
+import { writeFile as writeFile15 } from "node:fs/promises";
 import { resolve as resolve31 } from "node:path";
 import { parseArgs as parseArgs12 } from "node:util";
 function printUsage9() {
@@ -549031,7 +549603,7 @@ async function runMessagesSubcommand(argv, deps = {}) {
 `).trim();
       if (outputPathRaw && typeof outputPathRaw === "string") {
         const outputPath = resolve31(process.cwd(), outputPathRaw);
-        await writeFile16(outputPath, `${transcript}
+        await writeFile15(outputPath, `${transcript}
 `, "utf-8");
         console.log(JSON.stringify({
           conversation_id: conversationId,
@@ -551719,14 +552291,13 @@ class SettingsManager2 {
   }
   async getSettingsWithSecureTokens() {
     const baseSettings = this.getSettings();
-    let secureTokens = { ...this.secureTokensCache };
+    const secureTokens = { ...this.secureTokensCache };
     if (!getRuntimeContext()) {
       const secretsAvailable2 = await this.isKeychainAvailable();
       if (secretsAvailable2) {
-        secureTokens = {
-          ...secureTokens,
-          ...await this.getSecureTokens()
-        };
+        const storedTokens = await this.getSecureTokens();
+        secureTokens.apiKey = storedTokens.apiKey ?? secureTokens.apiKey;
+        secureTokens.refreshToken = storedTokens.refreshToken ?? secureTokens.refreshToken;
       }
     }
     const fallbackRefreshToken = !secureTokens.refreshToken && baseSettings.refreshToken ? baseSettings.refreshToken : secureTokens.refreshToken;
@@ -553786,7 +554357,7 @@ Note: Flags should use double dashes for full names (e.g., --yolo, not -yolo)`);
     if (isHeadless && baseURL === LETTA_CLOUD_API_URL2 && !process.env.LETTA_API_KEY) {
       console.error("Missing LETTA_API_KEY");
       console.error("Headless mode requires an API key set via the LETTA_API_KEY environment variable.");
-      console.error("Get an API key at https://app.letta.com/api-keys");
+      console.error(`Get an API key at ${LETTA_CHAT_API_KEYS_URL2}`);
       process.exit(1);
     }
     if (!isHeadless && baseURL === LETTA_CLOUD_API_URL2 && !settings3.refreshToken && !apiKey) {
@@ -554793,4 +555364,4 @@ Error during initialization: ${message}`);
 }
 main2();
 
-//# debugId=EA7311931B35FB9664756E2164756E21
+//# debugId=8DBFF6903CD7B1D064756E2164756E21