@letta-ai/letta-code 0.30.31 → 0.30.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@letta-ai/letta-code",
-  "version": "0.30.31",
+  "version": "0.30.32",
   "description": "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
   "type": "module",
   "packageManager": "bun@1.3.10",
@@ -119,7 +119,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@earendil-works/pi-ai": "0.84.2",
+    "@earendil-works/pi-ai": "0.84.3",
     "@janhapke/sharp-electron": "0.35.3-electron.1",
     "@letta-ai/letta-client": "^1.10.2",
     "@letta-ai/trajectory": "0.2.0",

package/scripts/codex-watch/release-analysis.test.ts

@@ -23,25 +23,17 @@ const STABLES = [
 
 describe("Codex stable release backlog", () => {
   test("selects the first release after the durable cursor", () => {
-    expect(
-      findNextStableRelease(STABLES, "rust-v0.1.0")?.tag_name,
-    ).toBe("rust-v0.2.0");
+    expect(findNextStableRelease(STABLES, "rust-v0.1.0")?.tag_name).toBe(
+      "rust-v0.2.0",
+    );
   });
 
   test("identifies only adjacent stable release pairs", () => {
     expect(
-      areAdjacentStableReleases(
-        STABLES,
-        "rust-v0.1.0",
-        "rust-v0.2.0",
-      ),
+      areAdjacentStableReleases(STABLES, "rust-v0.1.0", "rust-v0.2.0"),
     ).toBe(true);
     expect(
-      areAdjacentStableReleases(
-        STABLES,
-        "rust-v0.1.0",
-        "rust-v0.3.0",
-      ),
+      areAdjacentStableReleases(STABLES, "rust-v0.1.0", "rust-v0.3.0"),
     ).toBe(false);
   });
 
@@ -50,8 +42,8 @@ describe("Codex stable release backlog", () => {
   });
 
   test("fails instead of skipping an unavailable cursor", () => {
-    expect(() =>
-      findNextStableRelease(STABLES, "rust-v0.0.9"),
-    ).toThrow("Could not find terminal release rust-v0.0.9");
+    expect(() => findNextStableRelease(STABLES, "rust-v0.0.9")).toThrow(
+      "Could not find terminal release rust-v0.0.9",
+    );
   });
 });

package/scripts/codex-watch/release-analysis.ts

@@ -212,9 +212,7 @@ export function areAdjacentStableReleases(
   previousTag: string,
   currentTag: string,
 ): boolean {
-  return (
-    findPreviousStable(stables, currentTag)?.tag_name === previousTag
-  );
+  return findPreviousStable(stables, currentTag)?.tag_name === previousTag;
 }
 
 export function findNextStableRelease(

package/scripts/codex-watch/tracker.test.ts

@@ -37,7 +37,7 @@ function analysis(
 
 function withoutAuditCursor(body: string): string {
   return body
-    .replace(/  "audit_cursor_tag": (?:null|"[^"]+"),\n/, "")
+    .replace(/ {2}"audit_cursor_tag": (?:null|"[^"]+"),\n/, "")
     .replace('  "audit_cursor_validated": true,\n', "");
 }
 
@@ -198,11 +198,7 @@ describe("tracker state", () => {
 
     const body = renderTrackerBody(state);
     expect(
-      hasProcessedRange(
-        parseTrackerState(body),
-        "rust-v0.1.0",
-        "rust-v0.2.0",
-      ),
+      hasProcessedRange(parseTrackerState(body), "rust-v0.1.0", "rust-v0.2.0"),
     ).toBe(true);
     expect(body).toContain("_No actionable releases recorded yet._");
     expect(body).toContain("no watched changes");
@@ -215,23 +211,16 @@ describe("tracker state", () => {
     );
     state = upsertTrackerEntry(state, entry(2, "error"));
 
-    expect(
-      hasProcessedRange(state, "rust-v0.1.0", "rust-v0.2.0"),
-    ).toBe(false);
+    expect(hasProcessedRange(state, "rust-v0.1.0", "rust-v0.2.0")).toBe(false);
     expect(getCodexAuditCursorTag(state)).toBe("rust-v0.1.0");
 
     state = upsertTrackerEntry(state, entry(2, "no_local_impact"));
-    expect(
-      hasProcessedRange(state, "rust-v0.1.0", "rust-v0.2.0"),
-    ).toBe(true);
+    expect(hasProcessedRange(state, "rust-v0.1.0", "rust-v0.2.0")).toBe(true);
     expect(getCodexAuditCursorTag(state)).toBe("rust-v0.2.0");
   });
 
   test("uses an errored release baseline when no terminal entry exists", () => {
-    const state = upsertTrackerEntry(
-      emptyTrackerState(),
-      entry(2, "error"),
-    );
+    const state = upsertTrackerEntry(emptyTrackerState(), entry(2, "error"));
 
     expect(getCodexAuditCursorTag(state)).toBe("rust-v0.1.0");
   });
@@ -279,12 +268,7 @@ describe("tracker state", () => {
     expect(getCodexAuditCursorTag(state)).toBe("rust-v0.1.0");
     expect(
       getCodexAuditCursorTag(
-        advanceCodexAuditCursor(
-          state,
-          "rust-v0.1.0",
-          "rust-v0.5.0",
-          false,
-        ),
+        advanceCodexAuditCursor(state, "rust-v0.1.0", "rust-v0.5.0", false),
       ),
     ).toBe("rust-v0.1.0");
   });
@@ -298,12 +282,7 @@ describe("tracker state", () => {
     state = upsertTrackerEntry(state, entry(2, "no_local_impact"));
 
     expect(getCodexAuditCursorTag(state)).toBe("rust-v0.2.0");
-    state = advanceCodexAuditCursor(
-      state,
-      "rust-v0.2.0",
-      "rust-v0.3.0",
-      true,
-    );
+    state = advanceCodexAuditCursor(state, "rust-v0.2.0", "rust-v0.3.0", true);
     expect(getCodexAuditCursorTag(state)).toBe("rust-v0.3.0");
   });
 

package/scripts/codex-watch/tracker.ts

@@ -121,7 +121,8 @@ export function advanceCodexAuditCursor(
   currentTag: string,
   isAdjacentRelease: boolean,
 ): TrackerState {
-  if (!isAdjacentRelease || state.audit_cursor_tag !== previousTag) return state;
+  if (!isAdjacentRelease || state.audit_cursor_tag !== previousTag)
+    return state;
   if (!hasProcessedRange(state, previousTag, currentTag)) {
     throw new Error(
       `Cannot advance Codex audit cursor without terminal ${previousTag}...${currentTag}`,
@@ -135,17 +136,21 @@ export function recordAnalysis(
   options: RecordAnalysisOptions,
 ): TrackerState {
   const processedAt = options.processedAt ?? new Date().toISOString();
-  return upsertTrackerEntry(state, {
-    tag: options.analysis.current_tag,
-    previous_tag: options.analysis.previous_tag,
-    verdict: options.analysis.verdict,
-    outcome: options.outcome,
-    pr_url: options.prUrl ?? null,
-    notes: options.notes,
-    processed_at: processedAt,
-    compare_url: options.analysis.compare_url,
-    workflow_run_url: options.analysis.workflow_run_url,
-  }, options.analysis.is_adjacent_release);
+  return upsertTrackerEntry(
+    state,
+    {
+      tag: options.analysis.current_tag,
+      previous_tag: options.analysis.previous_tag,
+      verdict: options.analysis.verdict,
+      outcome: options.outcome,
+      pr_url: options.prUrl ?? null,
+      notes: options.notes,
+      processed_at: processedAt,
+      compare_url: options.analysis.compare_url,
+      workflow_run_url: options.analysis.workflow_run_url,
+    },
+    options.analysis.is_adjacent_release,
+  );
 }
 
 export function upsertTrackerEntry(
@@ -179,7 +184,10 @@ export function upsertTrackerEntry(
     ),
   ];
   let processed = candidates.slice(0, HIDDEN_STATE_LIMIT);
-  if (auditCursorTag !== null && !isSupportedAuditCursor(processed, auditCursorTag)) {
+  if (
+    auditCursorTag !== null &&
+    !isSupportedAuditCursor(processed, auditCursorTag)
+  ) {
     const support = candidates.find((candidate) =>
       isAuditCursorSupportEntry(candidate, auditCursorTag),
     );
@@ -276,7 +284,10 @@ function escapeTable(value: string): string {
 
 function normalizeState(value: unknown): TrackerState {
   if (!isRecord(value)) throw new TypeError("tracker state must be an object");
-  if (!Array.isArray(value.processed) || !value.processed.every(isTrackerEntry)) {
+  if (
+    !Array.isArray(value.processed) ||
+    !value.processed.every(isTrackerEntry)
+  ) {
     throw new TypeError("tracker processed entries are invalid");
   }
   if (
@@ -346,9 +357,7 @@ function isSupportedAuditCursor(
   processed: TrackerEntry[],
   cursorTag: string,
 ): boolean {
-  return processed.some((entry) =>
-    isAuditCursorSupportEntry(entry, cursorTag),
-  );
+  return processed.some((entry) => isAuditCursorSupportEntry(entry, cursorTag));
 }
 
 function isAuditCursorSupportEntry(

package/scripts/source-file-size-baseline.json

@@ -37,13 +37,13 @@
   "src/settings-manager.ts": 2102,
   "src/tools/manager.ts": 2993,
   "src/tools/tool-execution-context.test.ts": 1138,
-  "src/types/protocol_v2.ts": 2848,
+  "src/types/protocol_v2.ts": 2834,
   "src/websocket/listen-client-concurrency.test.ts": 2686,
   "src/websocket/listen-client-protocol.test.ts": 5819,
   "src/websocket/listener/commands/memory.ts": 1114,
   "src/websocket/listener/file-commands.ts": 1053,
   "src/websocket/listener/lifecycle.ts": 1048,
-  "src/websocket/listener/protocol-inbound.ts": 2242,
+  "src/websocket/listener/protocol-inbound.ts": 2237,
   "src/websocket/listener/protocol-outbound.ts": 1047,
-  "src/websocket/listener/turn.ts": 1070
+  "src/websocket/listener/turn.ts": 1058
 }

package/skills/self-configuration/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: self-configuration
-description: Inspect or modify Letta Code's own memory, model, context window, system prompt, compaction, permissions, toolsets, mods, skills, channels, schedules, and local runtime settings. Use when the user asks how this agent or conversation is configured, or asks you to change how you behave or how the harness runs you.
+description: Inspect or modify Letta Code's own memory, model, context window, system prompt, compaction, permissions, toolsets, mods, skills, channels, schedules, agent secrets, and local runtime settings. Use when the user asks how this agent or conversation is configured, or asks you to change how you behave or how the harness runs you.
 license: MIT
 ---
 
@@ -22,6 +22,7 @@ The important part is choosing the right layer. Do not smear a preference into d
 | Skills | Reusable procedural knowledge or bundled scripts | Load `creating-skills` or `acquiring-skills` |
 | Channels | Slack/Discord/Telegram/WhatsApp/Signal accounts, pairing, routing, listener state | Use `letta channels` or channel commands |
 | Schedules | Reminders and recurring prompts | Load `scheduling-tasks` and use `letta cron` |
+| Agent secrets | Per-agent `$NAME` credential values for shell commands | Use `letta secret` (or `/secret` in a session) |
 
 Decision rule: if the model should remember and reason about it, use memory. If the runtime must enforce it or route it before the model decides anything, use settings, API fields, mods, channels, or schedules.
 
@@ -370,6 +371,24 @@ Never print provider keys. Shell expansion such as `--api-key "$OPENAI_API_KEY"`
 
 After connecting, verify the provider/model from the same backend and process that will run the agent. Do not infer success from a saved credential alone.
 
+## Agent secrets
+
+Agent-scoped secrets hold credential values that are referenced as `$NAME` in shell commands. Cloud agents store them server-side on the agent; local agents use OS secure storage. The harness substitutes `$NAME` at exec time and scrubs values from tool output, so values never enter agent context.
+
+```bash
+letta secret list                                   # names only, never values
+letta secret set GITHUB_TOKEN --env GITHUB_TOKEN    # ingest from the environment
+openssl rand -hex 32 | letta secret set WEBHOOK_TOKEN --stdin   # generate without seeing the value
+letta secret unset GITHUB_TOKEN                     # aliases: delete | remove | rm
+```
+
+Rules:
+
+- Pass the source variable *name* to `--env`, not `$NAME`. `--env $GITHUB_TOKEN` triggers harness substitution and places the resolved value in process arguments; `--env GITHUB_TOKEN` reads it from the CLI process environment without exposure.
+- Never echo secret values into tool output. Pipe generated credentials straight into `--stdin`.
+- Inside a session, `AGENT_ID`/`LETTA_AGENT_ID` resolves the target automatically; pass `--agent <agent-id>` otherwise.
+- A running session loads its secret cache at startup; CLI-side changes apply to new sessions. The `/secret` slash command manages the same store interactively and refreshes the live cache.
+
 ## Channels
 
 Use channels when the user wants to talk through Slack, Discord, Telegram, WhatsApp, or Signal.