@letta-ai/letta-code 0.33.6 → 0.33.8

package/letta.js

@@ -4358,7 +4358,7 @@ function isDuplicateKeychainItemError(error) {
   return message.includes("already exists in the keychain") || message.includes("code: -25299");
 }
 async function getSecretValue(name, label) {
-  if (!secretsAvailable && !secretGetOverrideForTests) {
+  if (!secrets && !secretGetOverrideForTests) {
     return null;
   }
   try {
@@ -4381,7 +4381,7 @@ async function getSecretValue(name, label) {
   }
 }
 async function setSecretValue(name, value) {
-  if (!secretsAvailable) {
+  if (!secrets) {
     throw new Error("Secrets API unavailable");
   }
   try {
@@ -4409,7 +4409,7 @@ async function setSecretValue(name, value) {
   });
 }
 async function deleteSecretValue(name) {
-  if (!secretsAvailable) {
+  if (!secrets) {
     return false;
   }
   try {
@@ -4423,7 +4423,7 @@ async function deleteSecretValue(name) {
   }
 }
 async function setApiKey(apiKey) {
-  if (!secretsAvailable) {
+  if (!secrets) {
     throw new Error("Secrets API unavailable");
   }
   await setSecretValue(API_KEY_NAME, apiKey);
@@ -4432,7 +4432,7 @@ async function getApiKey() {
   return getSecretValue(API_KEY_NAME, "API key");
 }
 async function setRefreshToken(refreshToken2) {
-  if (!secretsAvailable) {
+  if (!secrets) {
     throw new Error("Secrets API unavailable");
   }
   await setSecretValue(REFRESH_TOKEN_NAME, refreshToken2);
@@ -4463,7 +4463,7 @@ async function setSecureTokens(tokens) {
   }
 }
 async function deleteApiKey() {
-  if (secretsAvailable) {
+  if (secrets) {
     try {
       await secrets.delete({
         service: SERVICE_NAME,
@@ -4476,7 +4476,7 @@ async function deleteApiKey() {
   }
 }
 async function deleteRefreshToken() {
-  if (secretsAvailable) {
+  if (secrets) {
     try {
       await secrets.delete({
         service: SERVICE_NAME,
@@ -4498,7 +4498,7 @@ async function isKeychainAvailable() {
   if (process.platform === "linux" && !process.env.DBUS_SESSION_BUS_ADDRESS?.trim()) {
     return false;
   }
-  if (!secretsAvailable) {
+  if (!secrets) {
     return false;
   }
   try {
@@ -4511,15 +4511,10 @@ async function isKeychainAvailable() {
     return false;
   }
 }
-var secrets, secretsAvailable = false, SERVICE_NAME, API_KEY_NAME = "letta-api-key", REFRESH_TOKEN_NAME = "letta-refresh-token", warnedSecretReadFailures, secretGetOverrideForTests = null;
+var secrets, SERVICE_NAME, API_KEY_NAME = "letta-api-key", REFRESH_TOKEN_NAME = "letta-refresh-token", warnedSecretReadFailures, secretGetOverrideForTests = null;
 var init_secrets = __esm(() => {
   init_debug();
-  try {
-    secrets = globalThis.Bun.secrets;
-    secretsAvailable = true;
-  } catch {
-    secretsAvailable = false;
-  }
+  secrets = globalThis.Bun?.secrets;
   SERVICE_NAME = scopeServiceName("letta-code");
   warnedSecretReadFailures = new Set;
 });
@@ -4771,8 +4766,8 @@ class SettingsManager {
     const baseSettings = this.getSettings();
     const secureTokens = { ...this.secureTokensCache };
     if (!getRuntimeContext()) {
-      const secretsAvailable2 = await this.isKeychainAvailable();
-      if (secretsAvailable2) {
+      const secretsAvailable = await this.isKeychainAvailable();
+      if (secretsAvailable) {
         const storedTokens = await this.getSecureTokens();
         secureTokens.apiKey = storedTokens.apiKey ?? secureTokens.apiKey;
         secureTokens.refreshToken = storedTokens.refreshToken ?? secureTokens.refreshToken;
@@ -4861,8 +4856,8 @@ class SettingsManager {
     this.pendingWrites.add(writePromise);
   }
   async persistSettingsAndTokens(secureTokens) {
-    const secretsAvailable2 = await this.isKeychainAvailable();
-    if (secretsAvailable2 && Object.keys(secureTokens).length > 0) {
+    const secretsAvailable = await this.isKeychainAvailable();
+    if (secretsAvailable && Object.keys(secureTokens).length > 0) {
       try {
         await Promise.all([
           this.persistSettings(),
@@ -5653,7 +5648,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@letta-ai/letta-code",
-    version: "0.33.6",
+    version: "0.33.8",
     lettaStartupLogProtocol: 1,
     description: "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
     type: "module",
@@ -5680,6 +5675,8 @@ var init_package = __esm(() => {
       "dist/memory-constraints.js.map",
       "dist/mcp-client.js",
       "dist/mcp-client.js.map",
+      "dist/mcp-oauth.js",
+      "dist/mcp-oauth.js.map",
       "dist/agent-presets.js",
       "dist/agent-presets.js.map",
       "dist/schedules.js",
@@ -5724,6 +5721,11 @@ var init_package = __esm(() => {
         import: "./dist/mcp-client.js",
         default: "./dist/mcp-client.js"
       },
+      "./mcp-oauth": {
+        types: "./dist/types/mcp-oauth-public.d.ts",
+        import: "./dist/mcp-oauth.js",
+        default: "./dist/mcp-oauth.js"
+      },
       "./protocol": {
         types: "./dist/types/types/protocol.d.ts"
       },
@@ -5881,6 +5883,9 @@ var init_package = __esm(() => {
         "mcp-client": [
           "./dist/types/mcp-client.d.ts"
         ],
+        "mcp-oauth": [
+          "./dist/types/mcp-oauth-public.d.ts"
+        ],
         channels: [
           "./dist/types/channels-public.d.ts"
         ],
@@ -90887,7 +90892,7 @@ var init_context = __esm(() => {
 });
 
 // src/constants.ts
-var DEFAULT_SUMMARIZATION_MODEL = "letta/auto", DEFAULT_TITLE_SUMMARIZATION_MODEL = "openai/gpt-5.6-luna", DEFAULT_AGENT_NAME = "Letta Code", INTERRUPTED_BY_USER = "Interrupted by user", TURN_DID_NOT_COMPLETE = "Turn did not complete", SYSTEM_REMINDER_TAG = "system-reminder", SYSTEM_REMINDER_OPEN, SYSTEM_REMINDER_CLOSE, SYSTEM_ALERT_TAG = "system-alert", SYSTEM_ALERT_OPEN, SYSTEM_ALERT_CLOSE, COMPACTION_SUMMARY_HEADER = "(Earlier messages in this conversation have been compacted to free up context, summarized below)", TOKEN_DISPLAY_THRESHOLD = 100, ELAPSED_DISPLAY_THRESHOLD_MS;
+var DEFAULT_SUMMARIZATION_MODEL = "letta/auto", DEFAULT_TITLE_SUMMARIZATION_MODEL = "openai/gpt-6-luna", DEFAULT_AGENT_NAME = "Letta Code", INTERRUPTED_BY_USER = "Interrupted by user", TURN_DID_NOT_COMPLETE = "Turn did not complete", SYSTEM_REMINDER_TAG = "system-reminder", SYSTEM_REMINDER_OPEN, SYSTEM_REMINDER_CLOSE, SYSTEM_ALERT_TAG = "system-alert", SYSTEM_ALERT_OPEN, SYSTEM_ALERT_CLOSE, COMPACTION_SUMMARY_HEADER = "(Earlier messages in this conversation have been compacted to free up context, summarized below)", TOKEN_DISPLAY_THRESHOLD = 100, ELAPSED_DISPLAY_THRESHOLD_MS;
 var init_constants2 = __esm(() => {
   SYSTEM_REMINDER_OPEN = `<${SYSTEM_REMINDER_TAG}>`;
   SYSTEM_REMINDER_CLOSE = `</${SYSTEM_REMINDER_TAG}>`;
@@ -106236,10 +106241,19 @@ class HeadlessBackend {
     if (!run || run.agent_id !== agentId || isTerminalRun(run)) {
       return { [runId]: "failed" };
     }
+    return this.cancelRunById(runId);
+  }
+  async cancelRunById(runId) {
+    const run = this.runs.get(runId);
+    if (!run || isTerminalRun(run)) {
+      return { [runId]: "failed" };
+    }
     if (run.conversation_id) {
-      this.store.settleInterruptedToolCalls(run.conversation_id, { agentId });
+      this.store.settleInterruptedToolCalls(run.conversation_id, {
+        agentId: run.agent_id
+      });
     } else {
-      this.store.settleInterruptedToolCalls(agentId);
+      this.store.settleInterruptedToolCalls(run.agent_id);
     }
     const controller = this.runControllerByRunId.get(runId);
     this.recordRunChunk(runId, {
@@ -106250,6 +106264,17 @@ class HeadlessBackend {
     controller?.abort();
     return { [runId]: "cancelled" };
   }
+  async cancelConversationRun(...args) {
+    const [conversationId, requestedRunId] = args;
+    const runId = requestedRunId ?? this.activeRunByConversation.get(conversationId);
+    if (!runId)
+      return {};
+    const run = this.runs.get(runId);
+    if (!run || run.conversation_id !== conversationId || isTerminalRun(run)) {
+      return { [runId]: "failed" };
+    }
+    return this.cancelRunById(runId);
+  }
   async retrieveRun(runId) {
     const run = this.runs.get(runId);
     if (!run)
@@ -107133,27 +107158,63 @@ function parseOllamaTags(data) {
     };
   }).filter((entry) => entry !== undefined);
 }
-function parseOllamaRunningContexts(data) {
-  const contexts = new Map;
+function ollamaIdentityKeys(id2) {
+  const normalized = normalizeOllamaModelId(id2);
+  return normalized === id2 ? [id2] : [id2, normalized];
+}
+function parseOllamaPsEntries(data) {
   if (!data || typeof data !== "object")
-    return contexts;
+    return [];
   const models3 = data.models;
   if (!Array.isArray(models3))
-    return contexts;
+    return [];
+  const entries = [];
   for (const entry of models3) {
     if (!entry || typeof entry !== "object")
       continue;
     const record4 = entry;
-    const id2 = record4.name ?? record4.model;
-    const contextLength = record4.context_length;
-    if (typeof id2 !== "string" || id2.length === 0)
+    const rawIds = [record4.name, record4.model].filter((id2) => typeof id2 === "string" && id2.length > 0);
+    if (rawIds.length === 0)
       continue;
-    if (typeof contextLength !== "number" || contextLength <= 0)
+    const contextLength = record4.context_length;
+    entries.push({
+      ids: [...new Set(rawIds.flatMap(ollamaIdentityKeys))],
+      displayId: rawIds[0],
+      ...typeof contextLength === "number" && contextLength > 0 ? { contextLength } : {}
+    });
+  }
+  return entries;
+}
+function parseOllamaRunningContexts(data) {
+  const contexts = new Map;
+  for (const entry of parseOllamaPsEntries(data)) {
+    if (entry.contextLength === undefined)
       continue;
-    contexts.set(id2, contextLength);
+    for (const id2 of entry.ids)
+      contexts.set(id2, entry.contextLength);
   }
   return contexts;
 }
+function readOllamaServedContextOverride(env4) {
+  const raw = env4[OLLAMA_SERVED_CONTEXT_OVERRIDE_ENV];
+  if (raw === undefined || raw.trim() === "")
+    return;
+  const trimmed = raw.trim();
+  if (!/^[1-9]\d*$/.test(trimmed) || !Number.isSafeInteger(Number(trimmed))) {
+    throw new Error(`${OLLAMA_SERVED_CONTEXT_OVERRIDE_ENV}=${JSON.stringify(trimmed)} is not a positive integer token count. ` + `Set it to the context window your Ollama daemon actually serves.`);
+  }
+  return Number(trimmed);
+}
+function missingServedContextError(modelId, data) {
+  const entries = parseOllamaPsEntries(data);
+  const match2 = entries.find((entry) => entry.ids.includes(modelId));
+  if (match2) {
+    return `Ollama lists "${modelId}" in /api/ps but did not report context_length. ` + `Refusing to send the prompt because Ollama may silently truncate it. ` + `context_length requires Ollama 0.10.0 or newer. ` + `Upgrade Ollama, or set ${OLLAMA_SERVED_CONTEXT_OVERRIDE_ENV} to the window your daemon actually serves.`;
+  }
+  const running = entries.map((entry) => entry.displayId).filter((id2) => id2 !== undefined);
+  const runningNote = running.length > 0 ? ` Running models: ${running.join(", ")}.` : ` /api/ps lists no running models.`;
+  return `Ollama loaded "${modelId}", but /api/ps does not list it. ` + `Refusing to send the prompt because Ollama may silently truncate it. ` + `If OLLAMA_KEEP_ALIVE=0, the model unloaded before this check.` + runningNote + ` Set ${OLLAMA_SERVED_CONTEXT_OVERRIDE_ENV} to the window your daemon actually serves.`;
+}
 async function fetchOllamaNative(fetchImpl, url, options) {
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), options.timeoutMs);
@@ -107185,42 +107246,49 @@ async function fetchOllamaNative(fetchImpl, url, options) {
   }
 }
 async function resolveOllamaServedContext(options) {
+  const override = readOllamaServedContextOverride(options.env ?? process.env);
+  if (override !== undefined)
+    return override;
   const fetchImpl = options.fetchImpl ?? fetch;
   const modelId = normalizeOllamaModelId(options.modelId);
   const nativeBaseURL = localEndpointNativeBaseURL(options.baseURL);
   const psURL = `${nativeBaseURL}/api/ps`;
-  const runningContext = async () => {
-    const data = await fetchOllamaNative(fetchImpl, psURL, {
-      ...options.apiKey ? { apiKey: options.apiKey } : {},
-      ...options.signal ? { signal: options.signal } : {},
-      timeoutMs: OLLAMA_STATUS_TIMEOUT_MS,
-      consume: (response) => response.json()
-    });
-    return parseOllamaRunningContexts(data).get(modelId);
-  };
+  const overrideHint = `or set ${OLLAMA_SERVED_CONTEXT_OVERRIDE_ENV} to the window your daemon actually serves`;
   try {
     await fetchOllamaNative(fetchImpl, `${nativeBaseURL}/api/generate`, {
       ...options.apiKey ? { apiKey: options.apiKey } : {},
       ...options.signal ? { signal: options.signal } : {},
-      body: { model: modelId, prompt: "", stream: false },
+      body: {
+        model: modelId,
+        prompt: "",
+        stream: false,
+        keep_alive: OLLAMA_PREFLIGHT_KEEP_ALIVE
+      },
       timeoutMs: OLLAMA_MODEL_LOAD_TIMEOUT_MS,
       consume: (response) => response.text()
     });
   } catch (error4) {
     if (options.signal?.aborted)
       throw options.signal.reason ?? error4;
-    throw new Error(`Unable to load Ollama model "${modelId}" to determine its served context window. ` + `Refusing to send the prompt because Ollama may silently truncate it. ` + `Check the Ollama endpoint, model installation, and available memory. (${error4 instanceof Error ? error4.message : String(error4)})`);
+    throw new Error(`Unable to load Ollama model "${modelId}" to determine its served context window. ` + `Refusing to send the prompt because Ollama may silently truncate it. ` + `Check the Ollama endpoint, model installation, and available memory, ${overrideHint}. (${error4 instanceof Error ? error4.message : String(error4)})`);
   }
+  let running;
   try {
-    const loadedContext = await runningContext();
-    if (loadedContext !== undefined)
-      return loadedContext;
+    running = await fetchOllamaNative(fetchImpl, psURL, {
+      ...options.apiKey ? { apiKey: options.apiKey } : {},
+      ...options.signal ? { signal: options.signal } : {},
+      timeoutMs: OLLAMA_STATUS_TIMEOUT_MS,
+      consume: (response) => response.json()
+    });
   } catch (error4) {
     if (options.signal?.aborted)
       throw options.signal.reason ?? error4;
-    throw new Error(`Ollama loaded model "${modelId}", but /api/ps could not verify its served context window. ` + `Refusing to send the prompt because Ollama may silently truncate it. ` + `Check that the endpoint supports /api/ps. (${error4 instanceof Error ? error4.message : String(error4)})`);
+    throw new Error(`Ollama loaded model "${modelId}", but /api/ps could not verify its served context window. ` + `Refusing to send the prompt because Ollama may silently truncate it. ` + `Check that the endpoint supports /api/ps, ${overrideHint}. (${error4 instanceof Error ? error4.message : String(error4)})`);
   }
-  throw new Error(`Ollama did not report an exact served context window for loaded model "${modelId}" in /api/ps. ` + `Refusing to send the prompt because Ollama may silently truncate it. ` + `Check the model name and Ollama server logs.`);
+  const loadedContext = parseOllamaRunningContexts(running).get(modelId);
+  if (loadedContext !== undefined)
+    return loadedContext;
+  throw new Error(missingServedContextError(modelId, running));
 }
 function parseOllamaShow(modelId, data, runtimeContextLength) {
   if (!data || typeof data !== "object")
@@ -107250,7 +107318,7 @@ function createOllamaPiProvider(options) {
     discover: ollamaDiscover
   });
 }
-var OLLAMA_PI_PROVIDER_ID = "ollama", OLLAMA_CLOUD_PI_PROVIDER_ID = "ollama-cloud", OLLAMA_STATUS_TIMEOUT_MS = 2000, OLLAMA_MODEL_LOAD_TIMEOUT_MS = 120000, ollamaDiscover = async (context3) => {
+var OLLAMA_PI_PROVIDER_ID = "ollama", OLLAMA_CLOUD_PI_PROVIDER_ID = "ollama-cloud", OLLAMA_STATUS_TIMEOUT_MS = 2000, OLLAMA_MODEL_LOAD_TIMEOUT_MS = 120000, OLLAMA_PREFLIGHT_KEEP_ALIVE = "5m", OLLAMA_SERVED_CONTEXT_OVERRIDE_ENV = "LETTA_OLLAMA_CONTEXT_LENGTH", ollamaDiscover = async (context3) => {
   const tags = await context3.fetchJson(`${context3.nativeBaseURL}/api/tags`);
   const entries = parseOllamaTags(tags);
   const runtimeContexts = await context3.fetchJson(`${context3.nativeBaseURL}/api/ps`).then(parseOllamaRunningContexts).catch(() => new Map);
@@ -110931,6 +110999,9 @@ class APIBackend {
     const client = await this.getClient();
     return client.agents.messages.cancel(agentId, { run_ids: [runId] });
   }
+  async cancelConversationRun(_conversationId, _runId) {
+    throw new Error("API backend does not support exact cancellation for conversations with agent_id:null");
+  }
   async retrieveRun(runId, options) {
     const client = await this.getClient();
     return client.runs.retrieve(runId, options);
@@ -188489,6 +188560,12 @@ var init_manager = __esm(() => {
       label: "diffs",
       description: "Open browser-based worktree diff previews powered by Diffs from Pierre."
     },
+    {
+      id: "memory_palace",
+      label: "memory palace",
+      description: "Opt-in memory palace experiment flag for disposable local listener runs. Disabled by default; no behavior changes unless consumers gate on it.",
+      envVar: "LETTA_MEMORY_PALACE"
+    },
     {
       id: "reflection_arena",
       label: "reflection arena",
@@ -198022,6 +198099,7 @@ var init_protocol_inbound = __esm(() => {
   EXPERIMENT_IDS = new Set([
     "conversation_titles",
     "desktop_conversation_bootstrap",
+    "memory_palace",
     "tui_cron"
   ]);
 });
@@ -213117,7 +213195,7 @@ class CodexAppServerClient {
     await this.request("initialize", {
       clientInfo: {
         name: "letta-code",
-        version: "0.33.6"
+        version: "0.33.8"
       },
       capabilities: null
     });
@@ -218276,6 +218354,7 @@ __export(exports_skills2, {
   getBundledSkills: () => getBundledSkills,
   getAgentSkillsDir: () => getAgentSkillsDir,
   formatSkillsAsSystemReminder: () => formatSkillsAsSystemReminder,
+  enabledSkillExperiments: () => enabledSkillExperiments,
   discoverSkills: () => discoverSkills,
   compareSkills: () => compareSkills,
   SKILLS_DIR: () => SKILLS_DIR,
@@ -218331,7 +218410,14 @@ function isModelInvocableSkill(skill) {
 function isUserInvocableSkill(skill) {
   return skill.userInvocable !== false;
 }
+function enabledSkillExperiments() {
+  return [...new Set(EXPERIMENT_BUNDLED_SKILLS.values())].filter((id2) => experimentManager.isEnabled(id2)).sort().join(",");
+}
 function isSkillAvailableForAgent(skill, agentId) {
+  const experiment = skill.source === "bundled" ? EXPERIMENT_BUNDLED_SKILLS.get(skill.id) : undefined;
+  if (experiment && !experimentManager.isEnabled(experiment)) {
+    return false;
+  }
   if (skill.source === "bundled" && agentId && isLocalAgentId(agentId) && LOCAL_AGENT_EXCLUDED_BUNDLED_SKILLS.has(skill.id)) {
     return false;
   }
@@ -218395,7 +218481,7 @@ async function discoverSkills(projectSkillsPath = join61(process.cwd(), SKILLS_D
     }
   }
   return {
-    skills: Array.from(skillsById.values()).sort(compareSkills),
+    skills: Array.from(skillsById.values()).filter((skill) => isSkillAvailableForAgent(skill, agentId)).sort(compareSkills),
     errors: allErrors
   };
 }
@@ -218503,14 +218589,18 @@ ${lines.join(`
 `)}
 </system-reminder>`;
 }
-var LOCAL_AGENT_EXCLUDED_BUNDLED_SKILLS, PROJECT_SKILLS_DIR, SKILLS_DIR = ".skills", GLOBAL_SKILLS_DIR;
+var LOCAL_AGENT_EXCLUDED_BUNDLED_SKILLS, EXPERIMENT_BUNDLED_SKILLS, PROJECT_SKILLS_DIR, SKILLS_DIR = ".skills", GLOBAL_SKILLS_DIR;
 var init_skills5 = __esm(() => {
+  init_manager();
   init_skill_sources();
   LOCAL_AGENT_EXCLUDED_BUNDLED_SKILLS = new Set([
     "image-generation",
     "managing-shared-memory",
     "working-across-computers"
   ]);
+  EXPERIMENT_BUNDLED_SKILLS = new Map([
+    ["curating-memory-palace", "memory_palace"]
+  ]);
   PROJECT_SKILLS_DIR = join61(".agents", "skills");
   GLOBAL_SKILLS_DIR = join61(process.env.HOME || process.env.USERPROFILE || "~", ".letta/skills");
 });
@@ -228020,7 +228110,8 @@ function computeCacheKey(components) {
     components.primaryProjectSkillsDirectory,
     [...components.memorySkillsDirs].sort().join(","),
     [...components.sharedMemorySkillsDirs].sort().join(","),
-    components.sharedMemoryErrors.map((error4) => `${error4.path}:${error4.message}`).sort().join(",")
+    components.sharedMemoryErrors.map((error4) => `${error4.path}:${error4.message}`).sort().join(","),
+    components.skillExperiments
   ].join("|");
 }
 function getSkillRoots(components) {
@@ -228313,7 +228404,8 @@ async function buildClientSkillsPayload(options = {}) {
     primaryProjectSkillsDirectory,
     memorySkillsDirs,
     sharedMemorySkillsDirs: sharedMemoryContext.skillsDirs,
-    sharedMemoryErrors: sharedMemoryContext.errors
+    sharedMemoryErrors: sharedMemoryContext.errors,
+    skillExperiments: enabledSkillExperiments()
   };
   const cacheKey = computeCacheKey(cacheComponents);
   if (useCache) {
@@ -412450,12 +412542,12 @@ function rowToolCalls(row, index, diagnostics2) {
   }
   return calls;
 }
-function contentText3(content) {
+function contentText2(content) {
   if (typeof content === "string") {
     if (content.startsWith(CONTENT_JSON_PREFIX)) {
       const encoded = content.slice(CONTENT_JSON_PREFIX.length);
       try {
-        return contentText3(JSON.parse(encoded));
+        return contentText2(JSON.parse(encoded));
       } catch {
         return encoded;
       }
@@ -412541,7 +412633,7 @@ var init_hermes = __esm(() => {
           });
         };
         if (row.role === "user") {
-          const content = contentText3(row.content);
+          const content = contentText2(row.content);
           if (content) {
             emit({
               type: "message",
@@ -412561,7 +412653,7 @@ var init_hermes = __esm(() => {
               ...timestamp ? { timestamp } : {}
             });
           }
-          const content = contentText3(row.content);
+          const content = contentText2(row.content);
           if (content) {
             emit({
               type: "message",
@@ -412584,7 +412676,7 @@ var init_hermes = __esm(() => {
         if (row.role === "tool") {
           emit({
             type: "tool_result",
-            content: contentText3(row.content),
+            content: contentText2(row.content),
             ...typeof row.tool_call_id === "string" && row.tool_call_id ? { callId: row.tool_call_id } : {},
             ...timestamp ? { timestamp } : {}
           });
@@ -418452,6 +418544,15 @@ async function handleAbortMessageInput(listener, params, deps = {}) {
         throw new Error(`Backend did not cancel run ${runId}`);
       }
     },
+    cancelConversationRun: async (conversationId, runId) => {
+      const result3 = await getBackend().cancelConversationRun(conversationId, runId);
+      if (runId && result3[runId] !== "cancelled") {
+        throw new Error(`Backend did not cancel run ${runId}`);
+      }
+      if (!runId && !Object.values(result3).includes("cancelled")) {
+        throw new Error(`Backend did not cancel the active run for ${conversationId}`);
+      }
+    },
     ...deps
   };
   if (listener !== resolvedDeps.getActiveRuntime() || listener.intentionallyClosed) {
@@ -418471,7 +418572,7 @@ async function handleAbortMessageInput(listener, params, deps = {}) {
     return false;
   }
   const cancellation = scopedRuntime.turnLifecycle.requestCancellation({
-    waitForExternalSettlement: hasActiveTurn && Boolean(scopedRuntime.agentId)
+    waitForExternalSettlement: hasActiveTurn
   });
   scopedRuntime.queueRuntime.pause();
   const interruptedRunId = cancellation.runId;
@@ -418535,19 +418636,17 @@ async function handleAbortMessageInput(listener, params, deps = {}) {
   }
   const cancelConversationId = scopedRuntime.conversationId;
   const cancelAgentId = scopedRuntime.agentId;
-  if (cancelAgentId) {
-    const cancelRunId = interruptedRunId ?? params.command.run_id ?? null;
-    const backendCancellation = cancelRunId ? resolvedDeps.cancelRun(cancelAgentId, cancelRunId).catch(() => resolvedDeps.cancelConversation(cancelAgentId, cancelConversationId)) : resolvedDeps.cancelConversation(cancelAgentId, cancelConversationId);
-    backendCancellation.catch(() => {}).finally(() => {
-      if (!cancellation.lease) {
-        return;
-      }
-      const settlement = scopedRuntime.turnLifecycle.settleCancellation(cancellation.lease);
-      if (settlement.released) {
-        resolvedDeps.scheduleQueuePump(scopedRuntime, params.socket, params.opts, params.processQueuedTurn);
-      }
-    });
-  }
+  const cancelRunId = interruptedRunId ?? params.command.run_id ?? null;
+  const backendCancellation = cancelAgentId && cancelRunId ? resolvedDeps.cancelRun(cancelAgentId, cancelRunId).catch(() => resolvedDeps.cancelConversation(cancelAgentId, cancelConversationId)) : cancelAgentId ? resolvedDeps.cancelConversation(cancelAgentId, cancelConversationId) : resolvedDeps.cancelConversationRun(cancelConversationId, cancelRunId);
+  backendCancellation.catch(() => {}).finally(() => {
+    if (!cancellation.lease) {
+      return;
+    }
+    const settlement = scopedRuntime.turnLifecycle.settleCancellation(cancellation.lease);
+    if (settlement.released) {
+      resolvedDeps.scheduleQueuePump(scopedRuntime, params.socket, params.opts, params.processQueuedTurn);
+    }
+  });
   resolvedDeps.scheduleQueuePump(scopedRuntime, params.socket, params.opts, params.processQueuedTurn);
   return true;
 }
@@ -445147,23 +445246,24 @@ var init_streamableHttp = __esm(() => {
 async function connectMcpServer(config2, options = {}) {
   let client = new Client(options.clientInfo ?? DEFAULT_CLIENT_INFO);
   try {
+    options.signal?.throwIfAborted();
     const transport = createTransport2(config2, options);
     try {
-      await client.connect(transport);
+      await client.connect(transport, options.signal ? { signal: options.signal } : undefined);
     } catch (error5) {
       if (!(error5 instanceof UnauthorizedError) || !options.oauth?.waitForAuthorizationCode || !supportsOAuthCompletion(transport)) {
         throw error5;
       }
-      const authorizationCode = await options.oauth.waitForAuthorizationCode();
-      await transport.finishAuth(authorizationCode);
+      const authorizationCode = await withAbort(options.oauth.waitForAuthorizationCode(), options.signal, () => options.oauth?.close());
+      await withAbort(transport.finishAuth(authorizationCode), options.signal, () => transport.close());
       await client.close().catch(() => transport.close().catch(() => {
         return;
       }));
       client = new Client(options.clientInfo ?? DEFAULT_CLIENT_INFO);
-      await client.connect(createTransport2(config2, options));
+      await client.connect(createTransport2(config2, options), options.signal ? { signal: options.signal } : undefined);
     }
-    await options.oauth?.close();
-    const response = await client.listTools();
+    await (options.oauth?.closeCallback?.() ?? options.oauth?.close() ?? Promise.resolve());
+    const response = await client.listTools(undefined, options.signal ? { signal: options.signal } : undefined);
     const tools = response.tools.map((tool) => ({
       ...tool,
       inputSchema: normalizeInputSchema(tool.inputSchema),
@@ -445186,7 +445286,13 @@ async function connectMcpServer(config2, options = {}) {
         if (closed)
           return;
         closed = true;
-        await client.close();
+        const results = await Promise.allSettled([
+          client.close(),
+          options.oauth?.close()
+        ]);
+        const failure2 = results.find((result3) => result3.status === "rejected");
+        if (failure2)
+          throw failure2.reason;
       }
     };
   } catch (error5) {
@@ -445197,12 +445303,34 @@ async function connectMcpServer(config2, options = {}) {
     throw error5;
   }
 }
+async function withAbort(operation, signal, onAbort) {
+  if (!signal)
+    return operation;
+  signal.throwIfAborted();
+  let abort;
+  const cancellation = new Promise((_resolve, reject2) => {
+    abort = () => {
+      Promise.resolve(onAbort?.()).catch(() => {
+        return;
+      });
+      reject2(signal.reason ?? new DOMException("Operation aborted", "AbortError"));
+    };
+    signal.addEventListener("abort", abort, { once: true });
+  });
+  try {
+    return await Promise.race([operation, cancellation]);
+  } finally {
+    if (abort)
+      signal.removeEventListener("abort", abort);
+  }
+}
 function createTransport2(config2, options) {
   if (config2.transport === "http") {
     const headers = resolveHeaderEnvironment(config2.headers);
     return new StreamableHTTPClientTransport(new URL(config2.url), {
       requestInit: headersRequestInit(headers),
-      authProvider: options.oauth?.authProvider
+      authProvider: options.oauth?.authProvider,
+      fetch: abortAwareFetch(options.signal, undefined, options.fetch)
     });
   }
   if (config2.transport === "sse") {
@@ -445211,7 +445339,7 @@ function createTransport2(config2, options) {
     return new SSEClientTransport(new URL(config2.url), {
       requestInit,
       authProvider: options.oauth?.authProvider,
-      fetch: headers ? (url2, init) => fetch(url2, mergeHeaders4(init, headers)) : undefined
+      fetch: abortAwareFetch(options.signal, headers, options.fetch)
     });
   }
   return new StdioClientTransport({
@@ -445222,6 +445350,19 @@ function createTransport2(config2, options) {
     stderr: options.stderr ?? "inherit"
   });
 }
+function abortAwareFetch(operationSignal2, headers, fetchFn) {
+  if (!operationSignal2 && !headers)
+    return fetchFn;
+  const request = fetchFn ?? fetch;
+  return (url2, init) => {
+    const requestInit = headers ? mergeHeaders4(init, headers) : { ...init };
+    const requestSignal3 = requestInit.signal ?? undefined;
+    return request(url2, {
+      ...requestInit,
+      signal: operationSignal2 && requestSignal3 ? AbortSignal.any([operationSignal2, requestSignal3]) : operationSignal2 ?? requestSignal3
+    });
+  };
+}
 function supportsOAuthCompletion(transport) {
   return "finishAuth" in transport && typeof transport.finishAuth === "function";
 }
@@ -445268,60 +445409,281 @@ var init_mcp_client = __esm(() => {
   init_streamableHttp();
   DEFAULT_CLIENT_INFO = {
     name: "letta-code",
-    version: "0.33.6"
+    version: "0.33.8"
+  };
+});
+
+// src/mcp-oauth-callback.ts
+import { createServer as createServer3 } from "node:http";
+async function startOAuthCallbackServer2(preferredPort) {
+  try {
+    return await startOAuthCallbackServerOnPort(preferredPort ?? 0);
+  } catch (error5) {
+    if (!preferredPort)
+      throw error5;
+    return startOAuthCallbackServerOnPort(0);
+  }
+}
+function callbackPort(redirectUrl) {
+  if (!redirectUrl)
+    return;
+  try {
+    const parsed = new URL(redirectUrl);
+    return parsed.hostname === "127.0.0.1" && parsed.port ? Number(parsed.port) : undefined;
+  } catch {
+    return;
+  }
+}
+async function startOAuthCallbackServerOnPort(port) {
+  const expectedState = {};
+  let server2;
+  let completed = false;
+  let settle3;
+  let reject2;
+  const codePromise = new Promise((resolve39, rejectPromise) => {
+    settle3 = (code2) => {
+      completed = true;
+      resolve39(code2);
+    };
+    reject2 = (error5) => {
+      completed = true;
+      rejectPromise(error5);
+    };
+  });
+  codePromise.catch(() => {
+    return;
+  });
+  server2 = createServer3((request, response) => {
+    if (request.method !== "GET" || !request.url?.startsWith("/") || request.url.startsWith("//") || request.url.includes("\\")) {
+      response.writeHead(400, { "Content-Type": "text/plain" });
+      response.end("Invalid request target");
+      return;
+    }
+    const address2 = server2.address();
+    const expectedHost = address2 && typeof address2 !== "string" ? `127.0.0.1:${address2.port}` : undefined;
+    if (!expectedHost || request.headers.host !== expectedHost) {
+      response.writeHead(400, { "Content-Type": "text/plain" });
+      response.end("Invalid callback host");
+      return;
+    }
+    let url2;
+    try {
+      url2 = new URL(request.url, `http://${expectedHost}`);
+    } catch {
+      response.writeHead(400, { "Content-Type": "text/plain" });
+      response.end("Invalid request target");
+      return;
+    }
+    if (url2.origin !== `http://${expectedHost}` || url2.pathname !== "/callback") {
+      response.writeHead(404).end("Not found");
+      return;
+    }
+    const error5 = url2.searchParams.get("error");
+    const code2 = url2.searchParams.get("code");
+    const state = url2.searchParams.get("state");
+    if (!state || state !== expectedState.value) {
+      response.writeHead(400, { "Content-Type": "text/html" });
+      response.end(callbackPage("Authorization failed", "Invalid OAuth callback"));
+      return;
+    }
+    if (error5) {
+      response.writeHead(400, { "Content-Type": "text/html" });
+      reject2?.(new Error(`MCP OAuth authorization failed: ${error5}`));
+      response.end(callbackPage("Authorization failed", error5), () => {
+        closeServer(true);
+      });
+      return;
+    }
+    if (!code2) {
+      response.writeHead(400, { "Content-Type": "text/html" });
+      response.end(callbackPage("Authorization failed", "Missing authorization code"));
+      return;
+    }
+    response.writeHead(200, { "Content-Type": "text/html" });
+    settle3?.(code2);
+    response.end(callbackPage("Authorization complete", "You can close this tab and return to Letta Code."), () => {
+      closeServer(true);
+    });
+  });
+  server2.on("clientError", (_error, socket) => {
+    if (!socket.writable)
+      return;
+    socket.end(`HTTP/1.1 400 Bad Request\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+  });
+  let serverClosing = false;
+  const closeServer = (force = false) => {
+    if (serverClosing)
+      return;
+    serverClosing = true;
+    server2.close();
+    if (force)
+      server2.closeAllConnections();
+  };
+  await new Promise((resolve39, rejectListen) => {
+    server2.once("error", rejectListen);
+    server2.listen(port, "127.0.0.1", resolve39);
+  });
+  server2.unref();
+  const address = server2.address();
+  if (!address || typeof address === "string") {
+    server2.close();
+    throw new Error("Could not start MCP OAuth callback server");
+  }
+  const timeout = setTimeout(() => {
+    reject2?.(new Error("Timed out waiting for MCP OAuth authorization"));
+    closeServer(true);
+  }, CALLBACK_TIMEOUT_MS);
+  timeout.unref();
+  return {
+    redirectUrl: `http://127.0.0.1:${address.port}/callback`,
+    expectedState,
+    waitForCode: () => codePromise.finally(() => clearTimeout(timeout)),
+    close: () => {
+      clearTimeout(timeout);
+      if (!completed)
+        reject2?.(new Error("MCP OAuth flow was cancelled"));
+      closeServer(true);
+    }
   };
+}
+function callbackPage(title, message) {
+  return `<!doctype html><html><body style="font-family:system-ui;padding:2rem"><h1>${escapeHtml2(title)}</h1><p>${escapeHtml2(message)}</p></body></html>`;
+}
+function escapeHtml2(value) {
+  return value.replace(/[&<>"']/g, (character) => {
+    const entities = {
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
+      "'": "&#39;"
+    };
+    return entities[character] ?? character;
+  });
+}
+var CALLBACK_TIMEOUT_MS;
+var init_mcp_oauth_callback = __esm(() => {
+  CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
 });
 
 // src/mcp-oauth.ts
 import { createHash as createHash11, randomBytes as randomBytes2 } from "node:crypto";
-import { createServer as createServer3 } from "node:http";
 async function clearMcpOAuthCredentials(agentId, serverName, serverUrl) {
-  return deleteSecretValue(oauthSecretName(agentId, serverName, serverUrl));
+  const credentialKey = mcpOAuthCredentialKey(agentId, serverName, serverUrl);
+  const coordinationKey = storageCoordinationKey(bunSecretStorage, credentialKey, "bun-secrets");
+  const { result: result3 } = await clearStoredCredentials(bunSecretStorage, credentialKey, coordinationKey);
+  return result3 === true;
 }
 async function createMcpOAuthSession(agentId, serverName, serverUrl, options) {
-  const secretName = oauthSecretName(agentId, serverName, serverUrl);
-  const persisted = await loadState(secretName);
-  if (!options.interactive && !persisted)
-    return;
-  const callback = options.interactive ? await startOAuthCallbackServer2(callbackPort(persisted?.redirectUrl)) : undefined;
-  const redirectUrl = callback?.redirectUrl ?? persisted?.redirectUrl;
-  if (!redirectUrl)
-    return;
-  const provider = new PersistentMcpOAuthProvider({
-    secretName,
-    redirectUrl,
-    persisted,
+  const credentialKey = mcpOAuthCredentialKey(agentId, serverName, serverUrl);
+  return createMcpOAuthSessionWithStorage({
+    credentialKey,
+    storageNamespace: "bun-secrets",
+    storage: bunSecretStorage,
     interactive: options.interactive,
     onStatus: options.onStatus,
-    openBrowser: options.openBrowser ?? openSystemBrowser,
-    expectedState: callback?.expectedState
+    openBrowser: options.openBrowser ?? openSystemBrowser
   });
-  return {
-    authProvider: provider,
-    ...callback ? { waitForAuthorizationCode: () => callback.waitForCode() } : {},
-    close: async () => callback?.close()
-  };
+}
+async function createMcpOAuthSessionWithStorage(options) {
+  const coordinationKey = storageCoordinationKey(options.storage, options.credentialKey, options.storageNamespace);
+  retainCredentialCoordinator(coordinationKey);
+  let provider;
+  let callback;
+  try {
+    const loaded = await loadState(options.storage, options.credentialKey, coordinationKey);
+    const persisted = loaded.state;
+    if (!options.interactive && !persisted) {
+      await releaseCredentialCoordinator(coordinationKey);
+      return;
+    }
+    callback = options.interactive ? await startOAuthCallbackServer2(callbackPort(persisted?.redirectUrl)) : undefined;
+    const redirectUrl = callback?.redirectUrl ?? persisted?.redirectUrl;
+    if (!redirectUrl) {
+      await releaseCredentialCoordinator(coordinationKey);
+      return;
+    }
+    provider = new PersistentMcpOAuthProvider({
+      credentialKey: options.credentialKey,
+      coordinationKey,
+      storage: options.storage,
+      redirectUrl,
+      persisted,
+      interactive: options.interactive,
+      onStatus: options.onStatus,
+      openBrowser: options.openBrowser ?? openSystemBrowser,
+      expectedState: callback?.expectedState,
+      generation: loaded.generation
+    });
+    const activeProvider = provider;
+    const activeCallback = callback;
+    return {
+      authProvider: activeProvider,
+      ...activeCallback ? { waitForAuthorizationCode: () => activeCallback.waitForCode() } : {},
+      exportCredentials: () => activeProvider.exportCredentials(),
+      closeCallback: async () => activeCallback?.close(),
+      close: async () => {
+        activeCallback?.close();
+        await activeProvider.dispose();
+      }
+    };
+  } catch (error5) {
+    callback?.close();
+    if (provider)
+      await provider.dispose();
+    else
+      await releaseCredentialCoordinator(coordinationKey);
+    throw error5;
+  }
 }
 
 class PersistentMcpOAuthProvider {
   stateData;
-  secretName;
+  pendingClientInformation;
+  pendingDiscoveryState;
+  codeVerifierValue;
+  generation;
+  observedClientVersion;
+  observedTokenVersion;
+  observedDiscoveryVersion;
+  tokenOperationGeneration;
+  tokenOperationVersion;
+  coordinatorValue;
+  credentialKey;
+  coordinationKey;
+  storage;
   interactive;
   onStatus;
   openBrowser;
   expectedState;
+  closed = false;
   constructor(options) {
-    this.secretName = options.secretName;
+    this.credentialKey = options.credentialKey;
+    this.coordinationKey = options.coordinationKey;
+    this.storage = options.storage;
     this.interactive = options.interactive;
     this.onStatus = options.onStatus;
     this.openBrowser = options.openBrowser;
     this.expectedState = options.expectedState;
+    this.generation = options.generation;
+    const coordinator = getCredentialCoordinator(options.coordinationKey);
+    this.coordinatorValue = coordinator;
+    this.observedClientVersion = coordinator.clientVersion;
+    this.observedTokenVersion = coordinator.tokenVersion;
+    this.observedDiscoveryVersion = coordinator.discoveryVersion;
+    this.tokenOperationGeneration = coordinator.generation;
+    this.tokenOperationVersion = coordinator.tokenVersion;
     this.stateData = {
       ...options.persisted,
       redirectUrl: options.redirectUrl
     };
   }
   get redirectUrl() {
+    this.assertOpen();
     return this.stateData.redirectUrl;
   }
   get clientMetadata() {
@@ -445334,27 +445696,127 @@ class PersistentMcpOAuthProvider {
     };
   }
   state() {
+    this.assertOpen();
     const state = randomBytes2(24).toString("base64url");
     if (this.expectedState)
       this.expectedState.value = state;
     return state;
   }
   clientInformation() {
-    const client = this.stateData.clientInformation;
-    return client && "redirect_uris" in client && client.redirect_uris.includes(this.redirectUrl) ? client : undefined;
+    this.assertOpen();
+    if (this.generation !== this.coordinator.generation)
+      return;
+    if (this.pendingClientInformation && this.pendingClientInformation.baseVersion !== this.coordinator.clientVersion) {
+      this.pendingClientInformation = undefined;
+    }
+    const client = this.pendingClientInformation?.value ?? this.coordinator.state?.clientInformation;
+    this.observedClientVersion = this.coordinator.clientVersion;
+    return client && "redirect_uris" in client && Array.isArray(client.redirect_uris) && client.redirect_uris.includes(this.redirectUrl) ? client : undefined;
   }
   saveClientInformation(clientInformation) {
+    this.assertOpen();
+    assertCurrentGeneration(this.coordinationKey, this.generation);
     this.stateData.clientInformation = clientInformation;
+    this.pendingClientInformation = {
+      value: clientInformation,
+      baseVersion: this.coordinator.clientVersion
+    };
+    if (!this.coordinator.state?.tokens) {
+      this.tokenOperationGeneration = this.coordinator.generation;
+      this.tokenOperationVersion = this.coordinator.tokenVersion;
+    }
   }
   tokens() {
-    return this.stateData.tokens;
+    this.assertOpen();
+    if (this.generation !== this.coordinator.generation)
+      return;
+    this.observedTokenVersion = this.coordinator.tokenVersion;
+    this.tokenOperationGeneration = this.coordinator.generation;
+    this.tokenOperationVersion = this.coordinator.tokenVersion;
+    return this.coordinator.state?.tokens;
+  }
+  async exportCredentials() {
+    this.assertOpen();
+    const expectedGeneration = this.generation;
+    return enqueueStorageMutation(this.coordinationKey, async () => {
+      this.assertOpen();
+      assertCurrentGeneration(this.coordinationKey, expectedGeneration);
+      const latest = await readStoredState(this.storage, this.credentialKey);
+      if (!latest) {
+        throw new Error("MCP OAuth authorization is not complete");
+      }
+      this.assertOpen();
+      this.coordinator.state = latest;
+      this.stateData = latest;
+      return exportCredentialSnapshot(latest);
+    });
   }
   async saveTokens(tokens) {
-    this.stateData.tokens = tokens;
-    delete this.stateData.codeVerifier;
-    await this.persist();
+    this.assertOpen();
+    const expectedGeneration = this.tokenOperationGeneration;
+    const expectedTokenVersion = this.tokenOperationVersion;
+    const tokenExpiresAt = tokens.expires_in === undefined ? undefined : Date.now() + tokens.expires_in * 1000;
+    const pendingClientInformation = this.pendingClientInformation;
+    const pendingDiscoveryState = this.pendingDiscoveryState;
+    const result3 = await enqueueStorageMutation(this.coordinationKey, async () => {
+      this.assertOpen();
+      assertCurrentGeneration(this.coordinationKey, expectedGeneration);
+      if (this.coordinator.tokenVersion !== expectedTokenVersion) {
+        throw new Error("MCP OAuth token response is stale because credentials changed");
+      }
+      if (pendingClientInformation && this.coordinator.clientVersion !== pendingClientInformation.baseVersion || pendingDiscoveryState && this.coordinator.discoveryVersion !== pendingDiscoveryState.baseVersion) {
+        throw new Error("MCP OAuth token response is stale because protocol state changed");
+      }
+      const state = await readStoredState(this.storage, this.credentialKey) ?? { redirectUrl: this.redirectUrl };
+      let clientMerged = false;
+      let discoveryMerged = false;
+      if (pendingClientInformation && this.coordinator.clientVersion === pendingClientInformation.baseVersion) {
+        state.redirectUrl = this.redirectUrl;
+        state.clientInformation = pendingClientInformation.value;
+        clientMerged = true;
+      }
+      if (pendingDiscoveryState && this.coordinator.discoveryVersion === pendingDiscoveryState.baseVersion) {
+        state.discoveryState = pendingDiscoveryState.value;
+        discoveryMerged = true;
+      }
+      state.tokens = {
+        ...tokens,
+        refresh_token: tokens.refresh_token ?? state.tokens?.refresh_token
+      };
+      state.tokenExpiresAt = tokenExpiresAt;
+      await this.storage.set(this.credentialKey, JSON.stringify(state));
+      this.coordinator.state = state;
+      this.coordinator.tokenVersion += 1;
+      if (clientMerged)
+        this.coordinator.clientVersion += 1;
+      if (discoveryMerged)
+        this.coordinator.discoveryVersion += 1;
+      return { state, clientMerged, discoveryMerged };
+    });
+    this.codeVerifierValue = undefined;
+    if (this.closed) {
+      this.scrubLocalState();
+      return;
+    }
+    this.stateData = result3.state;
+    this.observedTokenVersion = this.coordinator.tokenVersion;
+    this.tokenOperationGeneration = this.coordinator.generation;
+    this.tokenOperationVersion = this.coordinator.tokenVersion;
+    this.observedClientVersion = this.coordinator.clientVersion;
+    this.observedDiscoveryVersion = this.coordinator.discoveryVersion;
+    if (this.pendingClientInformation === pendingClientInformation) {
+      this.pendingClientInformation = undefined;
+    } else if (this.pendingClientInformation) {
+      this.pendingClientInformation.baseVersion = this.coordinator.clientVersion;
+    }
+    if (this.pendingDiscoveryState === pendingDiscoveryState) {
+      this.pendingDiscoveryState = undefined;
+    } else if (this.pendingDiscoveryState) {
+      this.pendingDiscoveryState.baseVersion = this.coordinator.discoveryVersion;
+    }
   }
   async redirectToAuthorization(authorizationUrl) {
+    this.assertOpen();
     if (!this.interactive) {
       throw new Error("MCP authentication requires user authorization. Open /mcp and press R to sign in.");
     }
@@ -445364,147 +445826,268 @@ ${authorizationUrl.toString()}`);
     await this.openBrowser(authorizationUrl.toString());
   }
   saveCodeVerifier(codeVerifier) {
-    this.stateData.codeVerifier = codeVerifier;
+    this.assertOpen();
+    this.codeVerifierValue = codeVerifier;
   }
   codeVerifier() {
-    if (!this.stateData.codeVerifier) {
+    this.assertOpen();
+    if (!this.codeVerifierValue) {
       throw new Error("No MCP OAuth PKCE verifier is available");
     }
-    return this.stateData.codeVerifier;
+    return this.codeVerifierValue;
   }
   saveDiscoveryState(state) {
+    this.assertOpen();
+    assertCurrentGeneration(this.coordinationKey, this.generation);
     this.stateData.discoveryState = state;
+    this.pendingDiscoveryState = {
+      value: state,
+      baseVersion: this.coordinator.discoveryVersion
+    };
+    if (!this.coordinator.state?.tokens) {
+      this.tokenOperationGeneration = this.coordinator.generation;
+      this.tokenOperationVersion = this.coordinator.tokenVersion;
+    }
   }
   discoveryState() {
-    return this.stateData.discoveryState;
-  }
-  async invalidateCredentials(scope) {
-    if (scope === "all") {
-      this.stateData = { redirectUrl: this.redirectUrl };
-      await deleteSecretValue(this.secretName);
+    this.assertOpen();
+    if (this.generation !== this.coordinator.generation)
       return;
+    if (this.pendingDiscoveryState && this.pendingDiscoveryState.baseVersion !== this.coordinator.discoveryVersion) {
+      this.pendingDiscoveryState = undefined;
     }
-    if (scope === "client")
-      delete this.stateData.clientInformation;
-    if (scope === "tokens")
-      delete this.stateData.tokens;
-    if (scope === "verifier")
-      delete this.stateData.codeVerifier;
-    if (scope === "discovery")
-      delete this.stateData.discoveryState;
-    await this.persist();
-  }
-  async persist() {
-    await setSecretValue(this.secretName, JSON.stringify(this.stateData));
-  }
-}
-async function startOAuthCallbackServer2(preferredPort) {
-  try {
-    return await startOAuthCallbackServerOnPort(preferredPort ?? 0);
-  } catch (error5) {
-    if (!preferredPort)
-      throw error5;
-    return startOAuthCallbackServerOnPort(0);
+    this.observedDiscoveryVersion = this.coordinator.discoveryVersion;
+    return this.pendingDiscoveryState?.value ?? this.coordinator.state?.discoveryState;
   }
-}
-async function startOAuthCallbackServerOnPort(port) {
-  const expectedState = {};
-  let server2;
-  let completed = false;
-  let settle3;
-  let reject2;
-  const codePromise = new Promise((resolve39, rejectPromise) => {
-    settle3 = (code2) => {
-      completed = true;
-      resolve39(code2);
-    };
-    reject2 = (error5) => {
-      completed = true;
-      rejectPromise(error5);
-    };
-  });
-  codePromise.catch(() => {
-    return;
-  });
-  server2 = createServer3((request, response) => {
-    const url2 = new URL(request.url ?? "/", "http://127.0.0.1");
-    if (url2.pathname !== "/callback") {
-      response.writeHead(404).end("Not found");
+  async invalidateCredentials(scope) {
+    this.assertOpen();
+    if (scope === "verifier") {
+      this.codeVerifierValue = undefined;
       return;
     }
-    const error5 = url2.searchParams.get("error");
-    const code2 = url2.searchParams.get("code");
-    const state = url2.searchParams.get("state");
-    if (error5) {
-      response.writeHead(400, { "Content-Type": "text/html" });
-      response.end(callbackPage("Authorization failed", error5));
-      reject2?.(new Error(`MCP OAuth authorization failed: ${error5}`));
-      server2.close();
+    if (scope === "all") {
+      const redirectUrl = this.redirectUrl;
+      const { generation: generation3, cleared } = await clearStoredCredentials(this.storage, this.credentialKey, this.coordinationKey, {
+        generation: this.generation,
+        clientVersion: this.observedClientVersion,
+        tokenVersion: this.observedTokenVersion,
+        discoveryVersion: this.observedDiscoveryVersion
+      });
+      if (this.closed)
+        return;
+      if (!cleared) {
+        this.stateData = this.coordinator.state ?? { redirectUrl };
+        this.pendingClientInformation = undefined;
+        this.pendingDiscoveryState = undefined;
+        this.codeVerifierValue = undefined;
+        this.observedClientVersion = this.coordinator.clientVersion;
+        this.observedTokenVersion = this.coordinator.tokenVersion;
+        this.observedDiscoveryVersion = this.coordinator.discoveryVersion;
+        return;
+      }
+      this.generation = generation3;
+      this.stateData = { redirectUrl };
+      this.pendingClientInformation = undefined;
+      this.pendingDiscoveryState = undefined;
+      this.codeVerifierValue = undefined;
+      this.observedClientVersion = this.coordinator.clientVersion;
+      this.observedTokenVersion = this.coordinator.tokenVersion;
+      this.observedDiscoveryVersion = this.coordinator.discoveryVersion;
+      return;
+    }
+    const expectedGeneration = this.generation;
+    const pendingClientInformation = this.pendingClientInformation;
+    const pendingDiscoveryState = this.pendingDiscoveryState;
+    const expectedVersion = scope === "client" ? this.observedClientVersion : scope === "tokens" ? this.observedTokenVersion : this.observedDiscoveryVersion;
+    const result3 = await enqueueStorageMutation(this.coordinationKey, async () => {
+      this.assertOpen();
+      assertCurrentGeneration(this.coordinationKey, expectedGeneration);
+      const currentVersion = scope === "client" ? this.coordinator.clientVersion : scope === "tokens" ? this.coordinator.tokenVersion : this.coordinator.discoveryVersion;
+      if (currentVersion !== expectedVersion) {
+        return this.coordinator.state;
+      }
+      const state = await readStoredState(this.storage, this.credentialKey);
+      if (state) {
+        if (scope === "client")
+          delete state.clientInformation;
+        if (scope === "tokens") {
+          delete state.tokens;
+          delete state.tokenExpiresAt;
+        }
+        if (scope === "discovery")
+          delete state.discoveryState;
+        await this.storage.set(this.credentialKey, JSON.stringify(state));
+      }
+      this.coordinator.state = state;
+      if (scope === "client")
+        this.coordinator.clientVersion += 1;
+      if (scope === "tokens")
+        this.coordinator.tokenVersion += 1;
+      if (scope === "discovery")
+        this.coordinator.discoveryVersion += 1;
+      return state;
+    });
+    if (this.closed)
       return;
+    this.stateData = result3 ?? { redirectUrl: this.redirectUrl };
+    if (scope === "client") {
+      this.observedClientVersion = this.coordinator.clientVersion;
+      if (this.pendingClientInformation === pendingClientInformation) {
+        this.pendingClientInformation = undefined;
+      } else if (this.pendingClientInformation) {
+        this.pendingClientInformation.baseVersion = this.coordinator.clientVersion;
+      }
     }
-    if (!code2 || !state || state !== expectedState.value) {
-      response.writeHead(400, { "Content-Type": "text/html" });
-      response.end(callbackPage("Authorization failed", "Invalid OAuth callback"));
-      reject2?.(new Error("Invalid MCP OAuth callback state"));
-      server2.close();
+    if (scope === "tokens") {
+      this.observedTokenVersion = this.coordinator.tokenVersion;
+    }
+    if (scope === "discovery") {
+      this.observedDiscoveryVersion = this.coordinator.discoveryVersion;
+      if (this.pendingDiscoveryState === pendingDiscoveryState) {
+        this.pendingDiscoveryState = undefined;
+      } else if (this.pendingDiscoveryState) {
+        this.pendingDiscoveryState.baseVersion = this.coordinator.discoveryVersion;
+      }
+    }
+  }
+  async dispose() {
+    if (this.closed)
       return;
+    this.closed = true;
+    this.scrubLocalState();
+    try {
+      await releaseCredentialCoordinator(this.coordinationKey);
+    } finally {
+      this.coordinatorValue = undefined;
+      this.scrubLocalState();
     }
-    response.writeHead(200, { "Content-Type": "text/html" });
-    response.end(callbackPage("Authorization complete", "You can close this tab and return to Letta Code."));
-    settle3?.(code2);
-    server2.close();
-  });
-  await new Promise((resolve39, rejectListen) => {
-    server2.once("error", rejectListen);
-    server2.listen(port, "127.0.0.1", resolve39);
-  });
-  server2.unref();
-  const address = server2.address();
-  if (!address || typeof address === "string") {
-    server2.close();
-    throw new Error("Could not start MCP OAuth callback server");
   }
-  const timeout = setTimeout(() => {
-    reject2?.(new Error("Timed out waiting for MCP OAuth authorization"));
-    server2.close();
-  }, CALLBACK_TIMEOUT_MS);
-  timeout.unref();
+  get coordinator() {
+    if (!this.coordinatorValue)
+      throw new Error("MCP OAuth session is closed");
+    return this.coordinatorValue;
+  }
+  scrubLocalState() {
+    this.codeVerifierValue = undefined;
+    this.pendingClientInformation = undefined;
+    this.pendingDiscoveryState = undefined;
+    this.stateData = { redirectUrl: this.stateData.redirectUrl };
+  }
+  assertOpen() {
+    if (this.closed)
+      throw new Error("MCP OAuth session is closed");
+  }
+}
+function exportCredentialSnapshot(state) {
+  const clientInformation = state.clientInformation;
+  const tokens = state.tokens;
+  const validClient = clientInformation && "redirect_uris" in clientInformation && clientInformation.redirect_uris.includes(state.redirectUrl) ? clientInformation : undefined;
+  if (!validClient?.client_id || !tokens?.access_token) {
+    throw new Error("MCP OAuth authorization is not complete");
+  }
   return {
-    redirectUrl: `http://127.0.0.1:${address.port}/callback`,
-    expectedState,
-    waitForCode: () => codePromise.finally(() => clearTimeout(timeout)),
-    close: () => {
-      clearTimeout(timeout);
-      if (!completed)
-        reject2?.(new Error("MCP OAuth flow was cancelled"));
-      server2.close();
-    }
+    access_token: tokens.access_token,
+    ...tokens.refresh_token ? { refresh_token: tokens.refresh_token } : {},
+    client_id: validClient.client_id,
+    ...validClient.client_secret ? { client_secret: validClient.client_secret } : {},
+    redirect_uri: state.redirectUrl,
+    ...tokens.token_type ? { token_type: tokens.token_type } : {},
+    ...state.tokenExpiresAt !== undefined ? {
+      expires_in: Math.max(0, Math.ceil((state.tokenExpiresAt - Date.now()) / 1000))
+    } : {},
+    ...tokens.scope ? { scope: tokens.scope } : {}
   };
 }
-function callbackPort(redirectUrl) {
-  if (!redirectUrl)
+function enqueueStorageMutation(coordinationKey, mutation) {
+  const coordinator = getCredentialCoordinator(coordinationKey);
+  const pending = coordinator.queue.then(mutation, mutation);
+  coordinator.queue = pending.then(() => {
     return;
-  try {
-    const parsed = new URL(redirectUrl);
-    return parsed.hostname === "127.0.0.1" && parsed.port ? Number(parsed.port) : undefined;
-  } catch {
+  }, () => {
     return;
+  });
+  return pending;
+}
+function getCredentialCoordinator(coordinationKey) {
+  const existing = credentialCoordinators.get(coordinationKey);
+  if (existing)
+    return existing;
+  const coordinator = {
+    queue: Promise.resolve(),
+    generation: 0,
+    activeProviders: 0,
+    clientVersion: 0,
+    tokenVersion: 0,
+    discoveryVersion: 0
+  };
+  credentialCoordinators.set(coordinationKey, coordinator);
+  return coordinator;
+}
+function storageCoordinationKey(storage, credentialKey, storageNamespace) {
+  const namespace = storageNamespace;
+  if (namespace !== undefined && (!namespace.trim() || namespace.includes("\x00"))) {
+    throw new Error("MCP OAuth storage namespace must be non-empty and contain no NUL bytes");
+  }
+  let identity2;
+  if (!namespace) {
+    let objectId = storageObjectIds.get(storage);
+    if (!objectId) {
+      objectId = nextStorageObjectId;
+      nextStorageObjectId += 1;
+      storageObjectIds.set(storage, objectId);
+    }
+    identity2 = `object:${objectId}`;
+  } else {
+    identity2 = `namespace:${namespace}`;
   }
+  return `${identity2}\x00${credentialKey}`;
 }
-function callbackPage(title, message) {
-  return `<!doctype html><html><body style="font-family:system-ui;padding:2rem"><h1>${escapeHtml2(title)}</h1><p>${escapeHtml2(message)}</p></body></html>`;
+function retainCredentialCoordinator(coordinationKey) {
+  getCredentialCoordinator(coordinationKey).activeProviders += 1;
 }
-function escapeHtml2(value) {
-  return value.replace(/[&<>"']/g, (character) => {
-    const entities = {
-      "&": "&amp;",
-      "<": "&lt;",
-      ">": "&gt;",
-      '"': "&quot;",
-      "'": "&#39;"
-    };
-    return entities[character] ?? character;
+async function releaseCredentialCoordinator(coordinationKey) {
+  const coordinator = getCredentialCoordinator(coordinationKey);
+  await enqueueStorageMutation(coordinationKey, async () => {
+    coordinator.activeProviders = Math.max(0, coordinator.activeProviders - 1);
+    if (coordinator.activeProviders === 0)
+      coordinator.state = undefined;
   });
+  await coordinator.queue;
+  if (coordinator.activeProviders === 0 && credentialCoordinators.get(coordinationKey) === coordinator) {
+    credentialCoordinators.delete(coordinationKey);
+  }
+}
+function assertCurrentGeneration(coordinationKey, expectedGeneration) {
+  if (getCredentialCoordinator(coordinationKey).generation !== expectedGeneration) {
+    throw new Error("MCP OAuth session is stale because credentials were cleared");
+  }
+}
+async function clearStoredCredentials(storage, credentialKey, coordinationKey, expected) {
+  const coordinator = getCredentialCoordinator(coordinationKey);
+  const outcome = await enqueueStorageMutation(coordinationKey, async () => {
+    if (expected) {
+      assertCurrentGeneration(coordinationKey, expected.generation);
+      if (coordinator.clientVersion !== expected.clientVersion || coordinator.tokenVersion !== expected.tokenVersion || coordinator.discoveryVersion !== expected.discoveryVersion) {
+        return {
+          result: false,
+          generation: coordinator.generation,
+          cleared: false
+        };
+      }
+    }
+    const result3 = await storage.delete(credentialKey);
+    coordinator.generation += 1;
+    coordinator.clientVersion += 1;
+    coordinator.tokenVersion += 1;
+    coordinator.discoveryVersion += 1;
+    coordinator.state = undefined;
+    return { result: result3, generation: coordinator.generation, cleared: true };
+  });
+  await coordinator.queue;
+  if (coordinator.activeProviders === 0 && credentialCoordinators.get(coordinationKey) === coordinator) {
+    credentialCoordinators.delete(coordinationKey);
+  }
+  return outcome;
 }
 async function openSystemBrowser(url2) {
   try {
@@ -445513,25 +446096,73 @@ async function openSystemBrowser(url2) {
     subprocess.on("error", () => {});
   } catch {}
 }
-function oauthSecretName(agentId, serverName, serverUrl) {
+function mcpOAuthCredentialKey(agentId, serverName, serverUrl) {
   const digest = createHash11("sha256").update(`${agentId}\x00${serverName}\x00${serverUrl}`).digest("hex").slice(0, 32);
   return `mcp-oauth-${digest}`;
 }
-async function loadState(secretName) {
-  const value = await getSecretValue(secretName, "MCP OAuth credentials");
+async function loadState(storage, credentialKey, coordinationKey) {
+  return enqueueStorageMutation(coordinationKey, async () => {
+    const coordinator = getCredentialCoordinator(coordinationKey);
+    const state = await readStoredState(storage, credentialKey);
+    coordinator.state = state;
+    return { state, generation: coordinator.generation };
+  });
+}
+async function readStoredState(storage, credentialKey) {
+  const value = await storage.get(credentialKey);
   if (!value)
     return;
   try {
-    return JSON.parse(value);
+    const parsed = JSON.parse(value);
+    if (!isPersistedMcpOAuthState(parsed)) {
+      await storage.delete(credentialKey);
+      return;
+    }
+    return parsed;
   } catch {
-    await deleteSecretValue(secretName);
+    await storage.delete(credentialKey);
     return;
   }
 }
-var CALLBACK_TIMEOUT_MS;
+function isPersistedMcpOAuthState(value) {
+  if (!isRecord17(value) || !SafeUrlSchema.safeParse(value.redirectUrl).success || "codeVerifier" in value) {
+    return false;
+  }
+  if (value.clientInformation !== undefined) {
+    if (!isRecord17(value.clientInformation))
+      return false;
+    const schema5 = "redirect_uris" in value.clientInformation ? OAuthClientInformationFullSchema : OAuthClientInformationSchema;
+    if (!schema5.safeParse(value.clientInformation).success)
+      return false;
+  }
+  if (value.tokens !== undefined && !OAuthTokensSchema.safeParse(value.tokens).success) {
+    return false;
+  }
+  if (value.tokenExpiresAt !== undefined && (typeof value.tokenExpiresAt !== "number" || !Number.isFinite(value.tokenExpiresAt))) {
+    return false;
+  }
+  if (value.discoveryState !== undefined) {
+    if (!isRecord17(value.discoveryState) || !SafeUrlSchema.safeParse(value.discoveryState.authorizationServerUrl).success || value.discoveryState.resourceMetadataUrl !== undefined && !SafeUrlSchema.safeParse(value.discoveryState.resourceMetadataUrl).success || value.discoveryState.authorizationServerMetadata !== undefined && !OAuthMetadataSchema.safeParse(value.discoveryState.authorizationServerMetadata).success && !OpenIdProviderDiscoveryMetadataSchema.safeParse(value.discoveryState.authorizationServerMetadata).success || value.discoveryState.resourceMetadata !== undefined && !OAuthProtectedResourceMetadataSchema.safeParse(value.discoveryState.resourceMetadata).success) {
+      return false;
+    }
+  }
+  return true;
+}
+function isRecord17(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var credentialCoordinators, storageObjectIds, nextStorageObjectId = 1, bunSecretStorage;
 var init_mcp_oauth = __esm(() => {
+  init_auth2();
+  init_mcp_oauth_callback();
   init_secrets();
-  CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
+  credentialCoordinators = new Map;
+  storageObjectIds = new WeakMap;
+  bunSecretStorage = {
+    get: (credentialKey) => getSecretValue(credentialKey, "MCP OAuth credentials"),
+    set: setSecretValue,
+    delete: deleteSecretValue
+  };
 });
 
 // src/mcp-runtime.ts
@@ -447936,7 +448567,7 @@ import {
 } from "node:fs";
 import { tmpdir as tmpdir12 } from "node:os";
 import path45 from "node:path";
-function isRecord17(value) {
+function isRecord18(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isPathInsideOrEqual2(childPath, parentPath) {
@@ -447952,7 +448583,7 @@ function readPackageJson(packageJsonPath) {
   } catch (error5) {
     throw new Error(`Could not read package.json: ${error5 instanceof Error ? error5.message : String(error5)}`);
   }
-  if (!isRecord17(parsed)) {
+  if (!isRecord18(parsed)) {
     throw new Error("package.json must be an object");
   }
   return parsed;
@@ -447962,7 +448593,7 @@ function formatRepository(repository) {
     const trimmed2 = repository.trim();
     return trimmed2 || undefined;
   }
-  if (!isRecord17(repository))
+  if (!isRecord18(repository))
     return;
   const url2 = repository.url;
   if (typeof url2 !== "string")
@@ -448492,7 +449123,7 @@ function hasRuntimeDependencies(packageJson) {
   if (!packageJson)
     return false;
   const dependencies4 = packageJson.dependencies;
-  return isRecord17(dependencies4) && Object.keys(dependencies4).length > 0;
+  return isRecord18(dependencies4) && Object.keys(dependencies4).length > 0;
 }
 function readPackageJsonIfExists(packageDirectory) {
   const packageJsonPath = path45.join(packageDirectory, "package.json");
@@ -512630,4 +513261,4 @@ function registerBunOAuthFlows() {
 registerBunOAuthFlows();
 await init_src5().then(() => exports_src2);
 
-//# debugId=8FBCBEB92238D00764756E2164756E21
+//# debugId=7B5F416253AF257964756E2164756E21