@letta-ai/letta-code 0.34.13 → 0.34.14

package/letta.js

@@ -5913,7 +5913,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@letta-ai/letta-code",
-    version: "0.34.13",
+    version: "0.34.14",
     lettaStartupLogProtocol: 1,
     description: "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
     type: "module",
@@ -6188,7 +6188,7 @@ var init_package = __esm(() => {
     },
     lettaLifecycleProtocol: 1,
     lettaRuntimeGraphProtocol: 1,
-    lettaRuntimeGraphSha512: "sha512-e4G3j5ptNvvFrEnNOyxKkZ+xrND+PRBC8uUsUg6KH8ddii955bM5uckdtNUSiGvZARq83+ELyFlMMwh/Ek5UqA=="
+    lettaRuntimeGraphSha512: "sha512-ttHuf5WcGVfNYOggfqOqLRZnllxSSFje3ETZWA/cYFUEoMLz54/CApUxOjoR7xn7X6PbqVnZEzmUQnv+Ic3xzg=="
   };
 });
 
@@ -98826,8 +98826,10 @@ var init_backend_mode = __esm(() => {
 // src/agent/agent-tags.ts
 var exports_agent_tags = {};
 __export(exports_agent_tags, {
+  isMemfsOptOutCreateTags: () => isMemfsOptOutCreateTags,
   buildCreatedAgentTags: () => buildCreatedAgentTags,
   ONBOARDING_ORIGIN_TAG: () => ONBOARDING_ORIGIN_TAG,
+  MEMFS_DISABLED_TAG: () => MEMFS_DISABLED_TAG,
   LETTA_CODE_SUBAGENT_TAG: () => LETTA_CODE_SUBAGENT_TAG,
   LETTA_CODE_ORIGIN_TAG: () => LETTA_CODE_ORIGIN_TAG,
   GIT_MEMORY_ENABLED_TAG: () => GIT_MEMORY_ENABLED_TAG
@@ -98845,7 +98847,10 @@ function buildCreatedAgentTags(options = {}) {
   }
   return Array.from(new Set(tags));
 }
-var LETTA_CODE_ORIGIN_TAG = "origin:letta-code", ONBOARDING_ORIGIN_TAG = "origin:onboarding", LETTA_CODE_SUBAGENT_TAG = "role:subagent", GIT_MEMORY_ENABLED_TAG = "git-memory-enabled";
+function isMemfsOptOutCreateTags(tags) {
+  return Array.isArray(tags) && tags.includes(MEMFS_DISABLED_TAG);
+}
+var LETTA_CODE_ORIGIN_TAG = "origin:letta-code", ONBOARDING_ORIGIN_TAG = "origin:onboarding", LETTA_CODE_SUBAGENT_TAG = "role:subagent", GIT_MEMORY_ENABLED_TAG = "git-memory-enabled", MEMFS_DISABLED_TAG = "memfs:disabled";
 
 // src/utils/directory-limits.ts
 function parsePositiveIntEnv(value, fallback, min, max) {
@@ -110137,15 +110142,46 @@ function readJsonFile2(path8) {
 function readJsonlFile(path8) {
   if (!existsSync14(path8))
     return [];
-  return readFileSync8(path8, "utf8").split(`
-`).filter((line) => line.trim().length > 0).map((line) => JSON.parse(line));
+  const items3 = [];
+  const buffer = Buffer.alloc(64 * 1024);
+  const pending = [];
+  const fd = openSync2(path8, "r");
+  try {
+    let bytesRead = 0;
+    do {
+      bytesRead = readSync(fd, buffer, 0, buffer.length, null);
+      let lineStart = 0;
+      for (let index = 0;index < bytesRead; index += 1) {
+        if (buffer[index] !== 10)
+          continue;
+        const suffix = buffer.subarray(lineStart, index);
+        const line = pending.length ? Buffer.concat([...pending, suffix]) : suffix;
+        pending.length = 0;
+        const text = line.toString("utf8");
+        if (text.trim().length > 0)
+          items3.push(JSON.parse(text));
+        lineStart = index + 1;
+      }
+      if (lineStart < bytesRead) {
+        pending.push(Buffer.from(buffer.subarray(lineStart, bytesRead)));
+      }
+    } while (bytesRead > 0);
+  } finally {
+    closeSync2(fd);
+  }
+  if (pending.length > 0) {
+    const text = Buffer.concat(pending).toString("utf8");
+    if (text.trim().length > 0)
+      items3.push(JSON.parse(text));
+  }
+  return items3;
 }
 function readJsonlFileSuffix(path8, maxBytes) {
   if (!existsSync14(path8))
-    return { items: [], reachedStart: true, startOffset: 0 };
+    return { items: [], reachedStart: true, startOffset: 0, bytesRead: 0 };
   const size = statSync3(path8).size;
   if (size === 0)
-    return { items: [], reachedStart: true, startOffset: 0 };
+    return { items: [], reachedStart: true, startOffset: 0, bytesRead: 0 };
   const bytesToRead = Math.min(size, Math.max(1, maxBytes));
   const start = size - bytesToRead;
   const buffer = Buffer.alloc(bytesToRead);
@@ -110167,6 +110203,7 @@ function readJsonlFileSuffix(path8, maxBytes) {
     items: text.split(`
 `).filter((line) => line.trim().length > 0).map((line) => JSON.parse(line)),
     reachedStart,
+    bytesRead: bytesToRead,
     startOffset: reachedStart ? 0 : firstNewlineByte >= 0 ? start + firstNewlineByte + 1 : size
   };
 }
@@ -110283,29 +110320,46 @@ function repairSyntheticConversationTimestamps(conversation, messages, timing) {
 function normalizeLocalMessageForPi(message) {
   return message;
 }
+function localTranscriptTailByteBudget(conversation, agentSettings) {
+  const conversationRecord = isRecord2(conversation) ? conversation : {};
+  const conversationSettings = isRecord2(conversationRecord.model_settings) ? conversationRecord.model_settings : {};
+  const agentSettingsRecord = isRecord2(agentSettings) ? agentSettings : {};
+  const contextWindow = [
+    conversationRecord.context_window_limit,
+    conversationSettings.context_window_limit,
+    agentSettingsRecord.context_window_limit
+  ].find((value) => typeof value === "number" && Number.isFinite(value) && value > 0);
+  return (contextWindow ?? LEGACY_LOCAL_CONTEXT_WINDOW_LIMIT) * LOCAL_TRANSCRIPT_BYTES_PER_CONTEXT_TOKEN;
+}
 function localTranscriptTailMessages(rows, messageFormat, activeMessageIds, storageDir, conversationDir) {
   const transcript2 = localTranscriptRowsResult(rows, messageFormat, activeMessageIds);
   assertNoLegacyUiMessageRows(transcript2.messages, storageDir, conversationDir);
   const messages = removeOrphanLocalToolResults(transcript2.messages.map(normalizeLocalMessageForPi)).messages;
   return { transcript: transcript2, messages };
 }
-function readLocalTranscriptTailWindow(messagesPath, messageFormat, activeMessageIds, minMessages, storageDir, conversationDir) {
+function readLocalTranscriptTailWindow(messagesPath, messageFormat, activeMessageIds, minMessages, storageDir, conversationDir, maxTailBytes = LOCAL_TRANSCRIPT_TAIL_MAX_BYTES) {
   const targetCount = activeMessageIds.length > 0 ? activeMessageIds.length : minMessages;
+  const byteBudget = Math.max(64 * 1024, Math.floor(maxTailBytes));
   let maxBytes = 64 * 1024;
   for (;; ) {
     const tail = readJsonlFileSuffix(messagesPath, maxBytes);
-    const result = localTranscriptTailMessages(tail.items, messageFormat, activeMessageIds, storageDir, conversationDir);
+    let result = localTranscriptTailMessages(tail.items, messageFormat, activeMessageIds, storageDir, conversationDir);
     const found = result.transcript.messages.length;
-    if (found >= targetCount || tail.reachedStart) {
+    if (found >= targetCount || tail.reachedStart || maxBytes >= byteBudget) {
+      if (activeMessageIds.length === 0 && result.messages.length > minMessages) {
+        const inferredIds = result.messages.slice(-minMessages).map((message) => message.id);
+        result = localTranscriptTailMessages(tail.items, messageFormat, inferredIds, storageDir, conversationDir);
+      }
       const returnedIds = new Set(result.messages.map((message) => message.id));
       return {
         ...result,
         reachedStart: tail.reachedStart,
+        bytesRead: tail.bytesRead,
         headBytes: tail.startOffset,
-        liveInContextIds: activeMessageIds.filter((id2) => returnedIds.has(id2))
+        liveInContextIds: activeMessageIds.length > 0 ? activeMessageIds.filter((id2) => returnedIds.has(id2)) : result.messages.map((message) => message.id)
       };
     }
-    maxBytes = Math.max(maxBytes * 2, found > 0 ? Math.ceil(maxBytes / found * targetCount * 1.25) : 0);
+    maxBytes = Math.min(byteBudget, Math.max(maxBytes * 2, found > 0 ? Math.ceil(maxBytes / found * targetCount * 1.25) : 0));
   }
 }
 function spliceOutOfContextMessages(messages, inContextIds, floor) {
@@ -110434,8 +110488,9 @@ function overlayResidentLocalMessageSuffix(diskSuffix, residentTail, isPersisted
   }
   return overlayResidentLocalMessageTail(diskSuffix, overlayTail);
 }
-var LOCAL_TRANSCRIPT_LEGACY_SCHEMA_VERSION = 1, LOCAL_TRANSCRIPT_SCHEMA_VERSION = 2, LOCAL_TRANSCRIPT_LEGACY_MESSAGE_FORMAT = "pi-ai-message-jsonl", LOCAL_TRANSCRIPT_MESSAGE_FORMAT = "pi-session-entry-jsonl", LOCAL_TRANSCRIPT_PROVIDER_STACK = "pi-ai", LocalTranscriptMigrationRequiredError, LocalTranscriptRepairRequiredError;
+var LOCAL_TRANSCRIPT_LEGACY_SCHEMA_VERSION = 1, LOCAL_TRANSCRIPT_SCHEMA_VERSION = 2, LOCAL_TRANSCRIPT_LEGACY_MESSAGE_FORMAT = "pi-ai-message-jsonl", LOCAL_TRANSCRIPT_MESSAGE_FORMAT = "pi-session-entry-jsonl", LOCAL_TRANSCRIPT_PROVIDER_STACK = "pi-ai", LOCAL_TRANSCRIPT_TAIL_MAX_BYTES, LOCAL_TRANSCRIPT_BYTES_PER_CONTEXT_TOKEN = 8, LEGACY_LOCAL_CONTEXT_WINDOW_LIMIT = 128000, LocalTranscriptMigrationRequiredError, LocalTranscriptRepairRequiredError;
 var init_local_transcript = __esm(() => {
+  LOCAL_TRANSCRIPT_TAIL_MAX_BYTES = 16 * 1024 * 1024;
   LocalTranscriptMigrationRequiredError = class LocalTranscriptMigrationRequiredError extends Error {
     constructor(storageDir) {
       const command = localTranscriptMigrationCommand(storageDir);
@@ -110808,7 +110863,7 @@ class LocalStore {
       return record4;
     const contextWindowLimit = record4.model_settings.context_window_limit;
     const defaultContextWindowLimit = defaults4.context_window_limit;
-    const shouldReplaceLegacyContextWindow = contextWindowLimit === LEGACY_LOCAL_CONTEXT_WINDOW_LIMIT && typeof defaultContextWindowLimit === "number" && defaultContextWindowLimit > LEGACY_LOCAL_CONTEXT_WINDOW_LIMIT;
+    const shouldReplaceLegacyContextWindow = contextWindowLimit === LEGACY_LOCAL_CONTEXT_WINDOW_LIMIT2 && typeof defaultContextWindowLimit === "number" && defaultContextWindowLimit > LEGACY_LOCAL_CONTEXT_WINDOW_LIMIT2;
     return {
       ...record4,
       model_settings: {
@@ -111746,12 +111801,13 @@ class LocalStore {
       return;
     }
     const conversation = this.conversations.get(key);
+    const activeMessageIds = conversation?.in_context_message_ids ?? [];
     const {
       transcript: transcript2,
       messages: tailMessages,
       headBytes,
       liveInContextIds
-    } = readLocalTranscriptTailWindow(metadata.messagesPath, metadata.messageFormat, conversation?.in_context_message_ids ?? [], this.residentMessageTailLimit, this.storageDir ?? "", metadata.conversationDir);
+    } = readLocalTranscriptTailWindow(metadata.messagesPath, metadata.messageFormat, activeMessageIds, this.residentMessageTailLimit, this.storageDir ?? "", metadata.conversationDir, localTranscriptTailByteBudget(conversation, this.agents.get(agentId)?.model_settings));
     const toolResultClip = clipOversizedLocalToolResults(tailMessages);
     const messages = toolResultClip.messages;
     if (toolResultClip.clippedToolResultIds.length > 0) {
@@ -111760,8 +111816,9 @@ class LocalStore {
     this.localMessagesByConversationKey.set(key, messages);
     if (conversation)
       conversation.in_context_message_ids = liveInContextIds;
+    const head = activeMessageIds.length === 0 ? -headBytes : headBytes;
     if (headBytes > 0)
-      this.unreadTranscriptHeadBytesByKey.set(key, headBytes);
+      this.unreadTranscriptHeadBytesByKey.set(key, head);
     else
       this.unreadTranscriptHeadBytesByKey.delete(key);
     this.loadedConversationKeys.delete(key);
@@ -111836,12 +111893,13 @@ class LocalStore {
     });
   }
   validateUnreadTranscriptHeadOnce(key) {
-    const headBytes = this.unreadTranscriptHeadBytesByKey.get(key);
-    if (headBytes === undefined)
+    const storedHeadBytes = this.unreadTranscriptHeadBytesByKey.get(key);
+    if (storedHeadBytes === undefined)
       return;
+    const headBytes = Math.abs(storedHeadBytes);
     const metadata = this.transcriptMetadataByConversationKey.get(key);
     if (metadata) {
-      validateUnreadTranscriptHead(metadata.messagesPath, headBytes, this.storageDir ?? "", metadata.conversationDir, this.conversations.get(key)?.in_context_message_ids ?? []);
+      validateUnreadTranscriptHead(metadata.messagesPath, headBytes, this.storageDir ?? "", metadata.conversationDir, storedHeadBytes < 0 ? [] : this.conversations.get(key)?.in_context_message_ids ?? []);
     }
     this.unreadTranscriptHeadBytesByKey.delete(key);
   }
@@ -112434,7 +112492,7 @@ class LocalStore {
     return conversationId === "default" ? `default:${agentId}` : `conversation:${conversationId}`;
   }
 }
-var DEFAULT_LOCAL_AGENT_NAME = "Letta Code", DEFAULT_LOCAL_MODEL = "local/default", LEGACY_LOCAL_CONTEXT_WINDOW_LIMIT = 128000, DEFAULT_LOCAL_CONVERSATION_ID_PREFIX = "local-conv-", DEFAULT_LOCAL_STORED_MESSAGE_ID_PREFIX = "letta-msg-", DEFAULT_LOCAL_UI_MESSAGE_ID_PREFIX = "ui-msg-", DEFAULT_RESIDENT_MESSAGE_TAIL_LIMIT = 100, LocalBackendNotFoundError;
+var DEFAULT_LOCAL_AGENT_NAME = "Letta Code", DEFAULT_LOCAL_MODEL = "local/default", LEGACY_LOCAL_CONTEXT_WINDOW_LIMIT2 = 128000, DEFAULT_LOCAL_CONVERSATION_ID_PREFIX = "local-conv-", DEFAULT_LOCAL_STORED_MESSAGE_ID_PREFIX = "letta-msg-", DEFAULT_LOCAL_UI_MESSAGE_ID_PREFIX = "ui-msg-", DEFAULT_RESIDENT_MESSAGE_TAIL_LIMIT = 100, LocalBackendNotFoundError;
 var init_local_store = __esm(() => {
   init_constants2();
   init_local_agent_record();
@@ -118372,6 +118430,7 @@ var init_local_backend = __esm(() => {
   init_memory_git();
   init_headless_backend();
   init_pi_models_runtime();
+  init_settings_manager();
   init_compaction();
   init_initial_memory();
   init_local_executor_factory();
@@ -118472,7 +118531,8 @@ var init_local_backend = __esm(() => {
     }
     async createAgent(...args) {
       let [body, ...restArgs] = args;
-      if (this.isLocalMemfsEnabled()) {
+      const memfsExplicitlyDisabled = isMemfsOptOutCreateTags(body.tags);
+      if (this.isLocalMemfsEnabled() && !memfsExplicitlyDisabled) {
         body = stampRootMemoryOnCreateBody(body);
         const bodyRecord = body;
         const existingTags = Array.isArray(bodyRecord.tags) ? bodyRecord.tags : [];
@@ -118489,10 +118549,13 @@ var init_local_backend = __esm(() => {
       }
       const compactionSettingsForStorage = localCompactionSettingsForStorage(requestedCompactionSettings);
       let agent = await super.createAgent(body, ...restArgs);
+      if (memfsExplicitlyDisabled) {
+        settingsManager.setMemfsEnabled(agent.id, false);
+      }
       if (compactionSettingsForStorage !== undefined) {
         agent = this.store.setAgentCompactionSettings(agent.id, compactionSettingsForStorage);
       }
-      if (this.isLocalMemfsEnabled()) {
+      if (this.isMemfsEnabledForAgent(agent.id)) {
         await this.ensureLocalMemoryRepo(agent.id, initialMemoryFilesFromCreateBody(body), agent.name ?? undefined);
       }
       await this.compileAndMaybePersistSystemPrompt("default", agent.id, {
@@ -118560,6 +118623,10 @@ var init_local_backend = __esm(() => {
     isLocalMemfsEnabled() {
       return this.memfsEnabledOverride ?? !isLocalBackendMemfsDisabledForProcess();
     }
+    isMemfsEnabledForAgent(agentId) {
+      const { tags } = this.store.retrieveAgentRecord(agentId);
+      return this.isLocalMemfsEnabled() && !isMemfsOptOutCreateTags(tags);
+    }
     async ensureLocalMemoryRepo(agentId, files = [], authorName) {
       await initializeLocalMemoryRepo({
         memoryDir: this.memoryDirForAgent(agentId),
@@ -118752,7 +118819,7 @@ var init_local_backend = __esm(() => {
     async getOrCompileSystemPrompt(conversationId, agentId, agent = this.store.retrieveAgentRecord(agentId), previousMessageCount = 0) {
       const existing = this.store.getCompiledSystemPrompt(conversationId, agentId);
       const rawSystemHash = hashRawSystemPrompt(agent.system);
-      const memfsRevision = this.isLocalMemfsEnabled() ? getCommittedMemfsRevision(this.memoryDirForAgent(agentId)) : undefined;
+      const memfsRevision = this.isMemfsEnabledForAgent(agentId) ? getCommittedMemfsRevision(this.memoryDirForAgent(agentId)) : undefined;
       if (existing?.rawSystemHash === rawSystemHash && existing.memfsRevision === memfsRevision) {
         return existing;
       }
@@ -118780,7 +118847,7 @@ var init_local_backend = __esm(() => {
     }
     async compileAndMaybePersistSystemPrompt(conversationId, agentId, options) {
       const agent = this.store.retrieveAgentRecord(agentId);
-      const memfsEnabled = this.isLocalMemfsEnabled();
+      const memfsEnabled = this.isMemfsEnabledForAgent(agentId);
       if (memfsEnabled) {
         await this.ensureLocalMemoryRepo(agentId, [], agent.name);
       }
@@ -210764,7 +210831,7 @@ var init_mcp_client = __esm(() => {
   init_streamableHttp();
   DEFAULT_CLIENT_INFO = {
     name: "letta-code",
-    version: "0.34.13"
+    version: "0.34.14"
   };
 });
 
@@ -210795,17 +210862,17 @@ async function startOAuthCallbackServerOnPort(port) {
   let completed = false;
   let settle;
   let reject2;
-  const codePromise = new Promise((resolve13, rejectPromise) => {
-    settle = (code2) => {
+  const callbackPromise = new Promise((resolve13, rejectPromise) => {
+    settle = (result2) => {
       completed = true;
-      resolve13(code2);
+      resolve13(result2);
     };
     reject2 = (error5) => {
       completed = true;
       rejectPromise(error5);
     };
   });
-  codePromise.catch(() => {
+  callbackPromise.catch(() => {
     return;
   });
   server2 = createServer4((request, response) => {
@@ -210836,6 +210903,7 @@ async function startOAuthCallbackServerOnPort(port) {
     const error5 = url2.searchParams.get("error");
     const code2 = url2.searchParams.get("code");
     const state2 = url2.searchParams.get("state");
+    const domain = url2.searchParams.get("domain");
     if (!state2 || state2 !== expectedState.value) {
       response.writeHead(400, { "Content-Type": "text/html" });
       response.end(callbackPage("Authorization failed", "Invalid OAuth callback"));
@@ -210855,7 +210923,7 @@ async function startOAuthCallbackServerOnPort(port) {
       return;
     }
     response.writeHead(200, { "Content-Type": "text/html" });
-    settle?.(code2);
+    settle?.(domain ? { code: code2, domain } : { code: code2 });
     response.end(callbackPage("Authorization complete", "You can close this tab and return to Letta Code."), () => {
       closeServer2(true);
     });
@@ -210896,7 +210964,7 @@ Content-Length: 0\r
   return {
     redirectUrl: `http://127.0.0.1:${address.port}/callback`,
     expectedState,
-    waitForCode: () => codePromise.finally(() => clearTimeout(timeout)),
+    waitForCallback: () => callbackPromise.finally(() => clearTimeout(timeout)),
     close: () => {
       clearTimeout(timeout);
       if (!completed)
@@ -210925,6 +210993,20 @@ var init_mcp_oauth_callback = __esm(() => {
   CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
 });
 
+// src/mcp-oauth-client-name.ts
+function resolveMcpOAuthClientName(clientName) {
+  if (clientName === undefined)
+    return DEFAULT_MCP_OAUTH_CLIENT_NAME;
+  const trimmed = clientName.trim();
+  if (!trimmed)
+    throw new Error("MCP OAuth client name must not be empty");
+  if (trimmed.length > MAX_MCP_OAUTH_CLIENT_NAME_LENGTH) {
+    throw new Error(`MCP OAuth client name must be at most ${MAX_MCP_OAUTH_CLIENT_NAME_LENGTH} characters`);
+  }
+  return trimmed;
+}
+var DEFAULT_MCP_OAUTH_CLIENT_NAME = "Letta Code", MAX_MCP_OAUTH_CLIENT_NAME_LENGTH = 64;
+
 // src/mcp-oauth-identity.ts
 import { createHash as createHash4 } from "node:crypto";
 function mcpOAuthCredentialKey(agentId, serverName, serverUrl) {
@@ -210999,10 +211081,12 @@ async function createMcpOAuthSession(agentId, serverName, serverUrl, options) {
     storage: bunSecretStorage,
     interactive: options.interactive,
     onStatus: options.onStatus,
-    openBrowser: options.openBrowser ?? openSystemBrowser
+    openBrowser: options.openBrowser ?? openSystemBrowser,
+    clientName: options.clientName
   });
 }
 async function createMcpOAuthSessionWithStorage(options) {
+  const clientName = resolveMcpOAuthClientName(options.clientName);
   const coordinationKey = storageCoordinationKey(options.storage, options.credentialKey, options.storageNamespace);
   retainCredentialCoordinator(coordinationKey);
   let provider;
@@ -211030,13 +211114,20 @@ async function createMcpOAuthSessionWithStorage(options) {
       onStatus: options.onStatus,
       openBrowser: options.openBrowser ?? openSystemBrowser,
       expectedState: callback?.expectedState,
-      generation: loaded.generation
+      generation: loaded.generation,
+      clientName
     });
     const activeProvider = provider;
     const activeCallback = callback;
     return {
       authProvider: activeProvider,
-      ...activeCallback ? { waitForAuthorizationCode: () => activeCallback.waitForCode() } : {},
+      ...activeCallback ? {
+        waitForAuthorizationCode: async () => {
+          const { code: code2, domain } = await activeCallback.waitForCallback();
+          options.onAuthorizationCallback?.({ domain });
+          return code2;
+        }
+      } : {},
       exportCredentials: () => activeProvider.exportCredentials(),
       closeCallback: async () => activeCallback?.close(),
       close: async () => {
@@ -211073,6 +211164,7 @@ class PersistentMcpOAuthProvider {
   onStatus;
   openBrowser;
   expectedState;
+  clientName;
   closed = false;
   constructor(options) {
     this.credentialKey = options.credentialKey;
@@ -211082,6 +211174,7 @@ class PersistentMcpOAuthProvider {
     this.onStatus = options.onStatus;
     this.openBrowser = options.openBrowser;
     this.expectedState = options.expectedState;
+    this.clientName = options.clientName;
     this.generation = options.generation;
     const coordinator = getCredentialCoordinator(options.coordinationKey);
     this.coordinatorValue = coordinator;
@@ -211101,7 +211194,7 @@ class PersistentMcpOAuthProvider {
   }
   get clientMetadata() {
     return {
-      client_name: "Letta Code",
+      client_name: this.clientName,
       redirect_uris: [this.redirectUrl],
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
@@ -211596,7 +211689,7 @@ async function authorizeMcpServerWithStorage(options) {
     throw new Error("MCP OAuth storage namespace must be non-empty and contain no NUL bytes");
   }
   const credentialKey = mcpOAuthCredentialKey(options.agentId, options.serverName, options.serverUrl);
-  const flightKey = `${options.storageNamespace}\x00${credentialKey}\x00${fetchIdentity(options.fetch)}`;
+  const flightKey = `${options.storageNamespace}\x00${credentialKey}\x00${fetchIdentity(options.fetch)}\x00${options.clientName ?? ""}`;
   let flight = inFlightAuthorizations.get(flightKey);
   if (!flight) {
     const controller = new AbortController;
@@ -211626,7 +211719,9 @@ async function runAuthorization(options, credentialKey, signal) {
     storage,
     interactive: true,
     openBrowser: options.openBrowser,
-    onStatus: options.onStatus
+    onStatus: options.onStatus,
+    onAuthorizationCallback: options.onAuthorizationCallback,
+    clientName: options.clientName
   });
   let oauth;
   try {
@@ -211763,11 +211858,18 @@ async function connectBrowserDeviceMcpOAuth(request, dependencies4 = {
   try {
     const credentials = await dependencies4.authorize({
       agentId: handoffNamespace(request.handoffKey),
+      clientName: request.clientName,
       openBrowser: async (value) => {
         const url2 = allowedAuthorizationUrl(value, definition.authorizationOrigins);
         await dependencies4.openBrowser(url2.href);
       },
       fetch: createProviderFetch(definition, dependencies4.providerFetch ?? globalThis.fetch),
+      onAuthorizationCallback: ({ domain }) => {
+        const reported = definitionForCallbackDomain(request.service, domain);
+        if (reported?.site && reported !== definition) {
+          throw new BrowserDeviceMcpOAuthSiteMismatchError(reported.site, reported.serverUrl);
+        }
+      },
       serverName: definition.serverName,
       serverUrl: definition.serverUrl,
       signal: authorizationSignal,
@@ -211852,6 +211954,13 @@ function findDefinition(service, normalizedServerUrl) {
   }
   return BROWSER_DEVICE_MCP_OAUTH_SERVICES[service]?.find((candidate) => normalizeServerUrl(candidate.serverUrl) === normalizedServerUrl);
 }
+function definitionForCallbackDomain(service, domain) {
+  if (!domain || !Object.hasOwn(BROWSER_DEVICE_MCP_OAUTH_SERVICES, service)) {
+    return;
+  }
+  const site = domain.trim().toLowerCase().replace(/^https:\/\//, "").replace(/\/+$/, "").replace(/^(?:app|api)\./, "");
+  return BROWSER_DEVICE_MCP_OAUTH_SERVICES[service]?.find((candidate) => candidate.site !== undefined && candidate.site === site);
+}
 function browserDeviceMcpOAuthServerUrls() {
   return Object.fromEntries(Object.entries(BROWSER_DEVICE_MCP_OAUTH_SERVICES).map(([service, definitions]) => [
     service,
@@ -212004,7 +212113,8 @@ function datadogDefinition(mcpHost, appHost) {
   return {
     authorizationOrigins: [`https://${appHost}`],
     serverName: "Datadog",
-    serverUrl: `https://mcp.${mcpHost}/v1/mcp`
+    serverUrl: `https://mcp.${mcpHost}/v1/mcp`,
+    site: mcpHost
   };
 }
 function handoffNamespace(handoffKey) {
@@ -212018,7 +212128,7 @@ async function openSystemBrowser2(url2) {
     return;
   });
 }
-var HANDOFF_KEY_PATTERN, BROWSER_DEVICE_HANDOFF_SUBMIT_TIMEOUT_MS = 90000, HANDOFF_ATTEMPT_TIMEOUT_MS = 1e4, PROVIDER_AUTHORIZATION_TIMEOUT_MS = 190000, HANDOFF_RETRY_BASE_DELAY_MS = 1000, HANDOFF_RETRY_MAX_DELAY_MS = 1e4, HANDOFF_RETRY_AFTER_MAX_DELAY_MS = 60000, BROWSER_DEVICE_MCP_OAUTH_SERVICES, BrowserDeviceMcpOAuthRequestError;
+var HANDOFF_KEY_PATTERN, BROWSER_DEVICE_HANDOFF_SUBMIT_TIMEOUT_MS = 90000, HANDOFF_ATTEMPT_TIMEOUT_MS = 1e4, PROVIDER_AUTHORIZATION_TIMEOUT_MS = 190000, HANDOFF_RETRY_BASE_DELAY_MS = 1000, HANDOFF_RETRY_MAX_DELAY_MS = 1e4, HANDOFF_RETRY_AFTER_MAX_DELAY_MS = 60000, BROWSER_DEVICE_MCP_OAUTH_SERVICES, BrowserDeviceMcpOAuthRequestError, BrowserDeviceMcpOAuthSiteMismatchError;
 var init_browser_device_mcp_oauth = __esm(() => {
   init_oauth();
   init_request();
@@ -212048,6 +212158,16 @@ var init_browser_device_mcp_oauth = __esm(() => {
       this.name = "BrowserDeviceMcpOAuthRequestError";
     }
   };
+  BrowserDeviceMcpOAuthSiteMismatchError = class BrowserDeviceMcpOAuthSiteMismatchError extends Error {
+    site;
+    serverUrl;
+    constructor(site, serverUrl) {
+      super(`OAuth provider authorized on ${site}; use ${serverUrl}`);
+      this.site = site;
+      this.serverUrl = serverUrl;
+      this.name = "BrowserDeviceMcpOAuthSiteMismatchError";
+    }
+  };
 });
 
 // src/websocket/listener/commands/browser-device-mcp-oauth.ts
@@ -218150,6 +218270,7 @@ function wrapManagedWorkloadLauncher(launcher, options = {}) {
     "--quiet",
     "--collect",
     "--property=TimeoutStopSec=5s",
+    "--property=OOMPolicy=continue",
     `--slice=${slice2}`,
     "--",
     ...launcher
@@ -239425,9 +239546,7 @@ function buildClaudeStreamArgs(options) {
     "stream-json",
     "--include-partial-messages",
     "--permission-mode",
-    "acceptEdits",
-    "--allowed-tools",
-    "Bash,Edit,Write,Read,Glob,Grep,WebFetch,WebSearch"
+    "bypassPermissions"
   ];
   if (options.model)
     args.push("--model", options.model);
@@ -239625,7 +239744,8 @@ async function launchSession(options, deps) {
   const env6 = {
     ...deps.env ?? process.env,
     AGENT_ID: options.parentAgentId,
-    LETTA_AGENT_ID: options.parentAgentId
+    LETTA_AGENT_ID: options.parentAgentId,
+    IS_SANDBOX: "1"
   };
   const abortController = new AbortController;
   const abortFromUpstream = () => abortController.abort(options.signal?.reason ?? "Claude Code turn cancelled");
@@ -239707,7 +239827,8 @@ async function launchSession(options, deps) {
       return;
     const detail = session3.stderr.trim();
     const protocolDetail = session3.protocolError ? `; protocol error: ${session3.protocolError}` : "";
-    const error5 = transport3.wasAborted() ? abortController.signal.reason ?? "Claude Code turn cancelled" : `Claude Code exited before a final result with ${exitCode ?? exitSignal ?? "unknown status"}${detail ? `: ${detail}` : ""}${protocolDetail}`;
+    const oomDetail = exitCode === 143 || exitSignal === "SIGTERM" || exitSignal === "SIGKILL" ? "; possibly out of memory" : "";
+    const error5 = transport3.wasAborted() ? abortController.signal.reason ?? "Claude Code turn cancelled" : `Claude Code exited before a final result with ${exitCode ?? exitSignal ?? "unknown status"}${oomDetail}${detail ? `: ${detail}` : ""}${protocolDetail}`;
     rejectControls(session3, new Error(errorMessage(error5)));
     settle(session3, failResult(session3, error5));
   }).catch((error5) => {
@@ -239860,7 +239981,10 @@ function spawnTransport(options) {
     stdin: child.stdin,
     stdout: child.stdout,
     stderr: child.stderr,
-    kill: () => child.kill()
+    kill: () => child.kill(),
+    exited: new Promise((resolve35) => {
+      child.once("close", (code2, signal) => resolve35({ code: code2, signal }));
+    })
   };
 }
 function asRecord9(value) {
@@ -239900,6 +240024,7 @@ class CodexAppServerClient {
     this.onNotification = onNotification;
     this.onClose = onClose;
     const stdout = createInterface9({ input: transport3.stdout });
+    stdout.once("error", () => void this.close());
     stdout.on("line", (line) => {
       if (!line.trim())
         return;
@@ -239928,7 +240053,7 @@ class CodexAppServerClient {
     transport3.stderr?.on("data", (chunk2) => {
       this.stderr += chunk2;
     });
-    const close = () => this.close();
+    const close = () => void this.close();
     transport3.stdout.once("close", close);
     transport3.stdout.once("error", close);
   }
@@ -239936,7 +240061,7 @@ class CodexAppServerClient {
     await this.request("initialize", {
       clientInfo: {
         name: "letta-code",
-        version: "0.34.13"
+        version: "0.34.14"
       },
       capabilities: null
     });
@@ -239967,12 +240092,20 @@ class CodexAppServerClient {
     this.transport.kill?.();
     this.close();
   }
-  close() {
+  async close() {
     if (this.closed)
       return;
     this.closed = true;
-    const detail = this.stderr.trim();
-    const error5 = new Error(`Codex app-server closed${detail ? `: ${detail}` : ""}`);
+    let exitTimeout;
+    const exit = this.transport.exited ? await Promise.race([
+      this.transport.exited,
+      new Promise((resolve35) => {
+        exitTimeout = setTimeout(() => resolve35(undefined), 2000);
+      })
+    ]).finally(() => clearTimeout(exitTimeout)) : undefined;
+    const detail = this.stderr.trim().slice(-300);
+    const exitDetail = exit?.signal ? ` (signal ${exit.signal}${exit.signal === "SIGKILL" || exit.signal === "SIGTERM" ? "; possibly out of memory" : ""})` : exit?.code != null ? ` (exit code ${exit.code}${exit.code === 143 ? "; possibly out of memory" : ""})` : "";
+    const error5 = new Error(`Codex app-server closed${exitDetail}${detail ? `: ${detail}` : ""}`);
     for (const pending2 of this.pending.values())
       pending2.reject(error5);
     this.pending.clear();
@@ -240164,7 +240297,7 @@ async function createSession(options, deps) {
       cwd: options.cwd,
       model: options.model,
       approvalPolicy: "never",
-      sandbox: "workspace-write",
+      sandbox: "danger-full-access",
       developerInstructions: options.mcpReminder
     };
     response = await client.request(method2, params);
@@ -240215,11 +240348,7 @@ async function startTurnUnlocked(session3, prompt, signal, onStarted, onToolCall
     cwd: session3.cwd,
     model: session3.model,
     approvalPolicy: "never",
-    sandboxPolicy: {
-      type: "workspaceWrite",
-      writableRoots: [session3.cwd],
-      networkAccess: true
-    }
+    sandboxPolicy: { type: "dangerFullAccess" }
   });
   const turn = asRecord9(response.turn);
   const turnId = readString3(turn, "id");
@@ -246106,9 +246235,14 @@ function formatOutdatedComputerError(type3, computer) {
   return `${computer} is running an older Letta Code that can't run ${DISPLAY_NAMES[type3]} subagents remotely. Update Letta Code on ${computer}.`;
 }
 async function defaultResolveComputer(computer, scope) {
-  return isCloudEnvironmentSelector(computer) ? resolveAgentSandboxConnectionId(scope.agentId, {
-    conversationId: scope.conversationId
-  }) : resolveEnvironmentConnectionId(computer);
+  if (!isCloudEnvironmentSelector(computer))
+    return resolveEnvironmentConnectionId(computer);
+  const client = await getClient();
+  const createParams = { agent_id: scope.agentId, hidden: true };
+  const conversation = await client.conversations.create(createParams);
+  return resolveAgentSandboxConnectionId(scope.agentId, {
+    conversationId: conversation.id
+  });
 }
 async function defaultConnect(connectionId, scope) {
   const auth2 = await getApiRequestConfig();
@@ -246345,6 +246479,7 @@ var DISPLAY_NAMES, RemoteWorkerLostError;
 var init_remote_external_coding_agent = __esm(() => {
   init_subagent_state();
   init_app_server_client();
+  init_client4();
   init_environments3();
   init_request();
   init_headless_environment_response();
@@ -250461,7 +250596,7 @@ Usage:
   letta mcp schema <tool-name> [--agent <id>]
   letta mcp search <query> [--mode <hybrid|vector|fts>] [--limit <n>] [--agent <id>]
   letta mcp call <tool-name> [--args '<json>' | --args-file <path|->] [--agent <id>]
-  letta mcp connect <service> [--server-url <url>] [--agent <id>]
+  letta mcp connect <service> [--server-url <url>] [--client-name <name>] [--agent <id>]
 
 Commands:
   list      List MCP servers available to the agent
@@ -250482,7 +250617,11 @@ Options:
   --args <json>      JSON object passed to a tool
   --args-file <path> Read tool arguments from a file; use - for stdin
   --server-url <url> MCP server for connect, e.g. a Datadog site's URL
-                     (default: the service's first supported URL)
+                     (default: the service's first supported URL; non-US1
+                     Datadog orgs can pass https://mcp.<site>/v1/mcp)
+  --client-name <name>
+                     Application name shown on the provider's consent screen
+                     during connect, 1 to 64 characters (default: Letta Code)
   -h, --help         Show this help
 
 Output is JSON. Server placement and agent/server/tool IDs are internal.
@@ -250563,11 +250702,19 @@ function resolveConnectServer(service, serverUrl) {
   }
   return { service, serverUrl: matched };
 }
+function resolveConnectClientName(clientName) {
+  if (clientName === undefined)
+    return;
+  try {
+    return resolveMcpOAuthClientName(clientName);
+  } catch (error5) {
+    throw new McpCliError("invalid_client_name", error5 instanceof Error ? error5.message : String(error5), "Pass --client-name with 1 to 64 non-blank characters.");
+  }
+}
 function isTimeout(error5) {
   return error5 instanceof Error && (error5.name === "TimeoutError" || error5.name === "AbortError");
 }
-async function runMcpConnect(deps, agentId, serviceArg, serverUrlArg, stdout) {
-  const { service, serverUrl } = resolveConnectServer(serviceArg, serverUrlArg);
+async function authorizeAndSubmit(deps, agentId, service, serverUrl, clientName) {
   let handoff;
   try {
     handoff = await (deps.mintMcpOAuthHandoff ?? defaultMintMcpOAuthHandoff)(agentId, service, serverUrl);
@@ -250586,10 +250733,18 @@ async function runMcpConnect(deps, agentId, serviceArg, serverUrlArg, stdout) {
     return;
   }, 60000);
   try {
-    await (deps.connectMcpOAuth ?? defaultConnectMcpOAuth)({ handoffKey: handoff.handoff_key, service, serverUrl }, () => {
+    await (deps.connectMcpOAuth ?? defaultConnectMcpOAuth)({
+      handoffKey: handoff.handoff_key,
+      service,
+      serverUrl,
+      ...clientName === undefined ? {} : { clientName }
+    }, () => {
       submitting = true;
     });
   } catch (error5) {
+    if (error5 instanceof BrowserDeviceMcpOAuthSiteMismatchError && !submitting) {
+      throw error5;
+    }
     const message2 = error5 instanceof Error ? error5.message : String(error5);
     if (submitting) {
       throw new McpCliError("handoff_submit_failed", `Authorization succeeded but saving the connection to the agent failed: ${message2}`, `Re-run \`letta mcp connect ${service}\` to try again.`);
@@ -250601,10 +250756,31 @@ async function runMcpConnect(deps, agentId, serviceArg, serverUrlArg, stdout) {
   } finally {
     clearInterval(keepAlive);
   }
+}
+async function runMcpConnect(deps, agentId, serviceArg, serverUrlArg, clientNameArg, stdout) {
+  const resolved2 = resolveConnectServer(serviceArg, serverUrlArg);
+  const clientName = resolveConnectClientName(clientNameArg);
+  const { service } = resolved2;
+  let { serverUrl } = resolved2;
+  for (let attempt2 = 0;; attempt2 += 1) {
+    try {
+      await authorizeAndSubmit(deps, agentId, service, serverUrl, clientName);
+      break;
+    } catch (error5) {
+      if (!(error5 instanceof BrowserDeviceMcpOAuthSiteMismatchError)) {
+        throw error5;
+      }
+      if (attempt2 > 0) {
+        throw new McpCliError("datadog_site_mismatch", `Your Datadog org is on ${error5.site}. Re-run: letta mcp connect ${service} --server-url ${error5.serverUrl}`);
+      }
+      serverUrl = error5.serverUrl;
+      await deps.stderr(`Your Datadog org is on ${error5.site}. Restarting authorization against ${serverUrl}; approve the second browser prompt.`);
+    }
+  }
   await stdout(JSON.stringify({ connected: true, service, server_url: serverUrl }, null, 2));
   return 0;
 }
-var CONNECT_USAGE = "Usage: letta mcp connect <service> [--server-url <url>] [--agent <id>]";
+var CONNECT_USAGE = "Usage: letta mcp connect <service> [--server-url <url>] [--client-name <name>] [--agent <id>]";
 var init_mcp_connect = __esm(() => {
   init_request();
   init_browser_device_mcp_oauth();
@@ -250786,7 +250962,8 @@ function parseMcpArgs(argv) {
       full: { type: "boolean" },
       args: { type: "string" },
       "args-file": { type: "string" },
-      "server-url": { type: "string" }
+      "server-url": { type: "string" },
+      "client-name": { type: "string" }
     },
     strict: true,
     allowPositionals: true
@@ -251316,7 +251493,7 @@ async function runMcpSubcommand(argv, deps = {}) {
       case "run_tool":
         return await runCall(parsed, deps, agentId, stdout);
       case "connect":
-        return await runMcpConnect({ ...deps, stderr }, agentId, parsed.target, stringValue3(parsed.values["server-url"]), stdout);
+        return await runMcpConnect({ ...deps, stderr }, agentId, parsed.target, stringValue3(parsed.values["server-url"]), stringValue3(parsed.values["client-name"]), stdout);
       default:
         throw new McpCliError("unknown_command", `Unknown mcp command '${parsed.action}'`);
     }
@@ -440147,8 +440324,18 @@ async function resolveRuntimeStartAgent(parsed, created) {
     const withMemfs = parsed.create_agent.memfs !== false;
     const { prepareRawCreateAgentBodyForMemfs: prepareRawCreateAgentBodyForMemfs2, enableMemfsIfCloud: enableMemfsIfCloud2 } = await Promise.resolve().then(() => (init_memory_filesystem2(), exports_memory_filesystem));
     const requestedBody = applyCreatedAgentServerToolDefaults(parsed.create_agent.body);
+    const createBody = withMemfs ? requestedBody : {
+      ...requestedBody,
+      tags: buildCreatedAgentTags({
+        enableMemfs: false,
+        tags: [
+          ...Array.isArray(requestedBody.tags) ? requestedBody.tags : [],
+          MEMFS_DISABLED_TAG
+        ]
+      })
+    };
     const appliedHarnessToolDefaults = requestedBody !== parsed.create_agent.body;
-    const body3 = withMemfs ? await prepareRawCreateAgentBodyForMemfs2(requestedBody) : requestedBody;
+    const body3 = withMemfs ? await prepareRawCreateAgentBodyForMemfs2(createBody) : createBody;
     const agent = appliedHarnessToolDefaults ? await createAgentWithBaseToolsRecovery((tools) => backend3.createAgent({ ...body3, tools }), [...DEFAULT_CREATED_AGENT_BASE_TOOLS]) : await backend3.createAgent(body3);
     if (withMemfs) {
       enableMemfsIfCloud2(agent.id);
@@ -450819,12 +451006,12 @@ function rowToolCalls(row, index, diagnostics2) {
   }
   return calls;
 }
-function contentText3(content) {
+function contentText2(content) {
   if (typeof content === "string") {
     if (content.startsWith(CONTENT_JSON_PREFIX)) {
       const encoded = content.slice(CONTENT_JSON_PREFIX.length);
       try {
-        return contentText3(JSON.parse(encoded));
+        return contentText2(JSON.parse(encoded));
       } catch {
         return encoded;
       }
@@ -450910,7 +451097,7 @@ var init_hermes = __esm(() => {
           });
         };
         if (row.role === "user") {
-          const content = contentText3(row.content);
+          const content = contentText2(row.content);
           if (content) {
             emit({
               type: "message",
@@ -450930,7 +451117,7 @@ var init_hermes = __esm(() => {
               ...timestamp ? { timestamp } : {}
             });
           }
-          const content = contentText3(row.content);
+          const content = contentText2(row.content);
           if (content) {
             emit({
               type: "message",
@@ -450953,7 +451140,7 @@ var init_hermes = __esm(() => {
         if (row.role === "tool") {
           emit({
             type: "tool_result",
-            content: contentText3(row.content),
+            content: contentText2(row.content),
             ...typeof row.tool_call_id === "string" && row.tool_call_id ? { callId: row.tool_call_id } : {},
             ...timestamp ? { timestamp } : {}
           });
@@ -467915,16 +468102,6 @@ function readJsonFile3(path46) {
     return;
   }
 }
-function readJsonlFile2(path46) {
-  if (!existsSync65(path46))
-    return [];
-  try {
-    return readFileSync48(path46, "utf8").split(`
-`).filter((line) => line.trim().length > 0).map((line) => JSON.parse(line));
-  } catch {
-    return [];
-  }
-}
 function conversationSearchRecord(value) {
   if (!isRecord2(value))
     return;
@@ -468161,7 +468338,12 @@ function collectConversationMessages(input) {
   if (input.conversationId && conversation.id !== input.conversationId)
     return [];
   const messagesPath = join94(conversationDir, "messages.jsonl");
-  const rows = readJsonlFile2(messagesPath);
+  let rows;
+  try {
+    rows = readJsonlFile(messagesPath);
+  } catch {
+    rows = [];
+  }
   if (rows.length === 0)
     return [];
   const manifest2 = readJsonFile3(join94(conversationDir, "manifest.json"));
@@ -474333,7 +474515,7 @@ Read step metadata and an available provider trace with CLI authentication. Loca
       throw new Error("Step does not belong to the requested agent.");
     }
     const trace = await (deps.retrieveTrace ?? (async (id2) => (await getClient()).steps.trace.retrieve(id2)))(values4.step);
-    if (trace && (trace.agent_id !== values4.agent || trace.step_id !== step.id)) {
+    if (trace && (trace.agent_id != null && trace.agent_id !== values4.agent || trace.step_id != null && trace.step_id !== step.id)) {
       throw new Error("Provider trace does not match the requested agent and step.");
     }
     console.log(JSON.stringify({ status: trace ? "available" : "unavailable", step, trace }, null, 2));
@@ -533726,4 +533908,4 @@ function registerBunOAuthFlows() {
 registerBunOAuthFlows();
 await init_src5().then(() => exports_src2);
 
-//# debugId=88DB99A4B02E499164756E2164756E21
+//# debugId=10AC316A829B737364756E2164756E21