@letta-ai/letta-code 0.34.23 → 0.34.25

package/npm-shrinkwrap.json

@@ -1,6 +1,6 @@
 {
   "name": "@letta-ai/letta-code",
-  "version": "0.34.23",
+  "version": "0.34.25",
   "lockfileVersion": 3,
   "packages": {
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -3047,9 +3047,9 @@
       }
     },
     "node_modules/es-toolkit": {
-      "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.52.0.tgz",
-      "integrity": "sha512-XTNEJQh1tY1ZJVcf6ayP/2n4ZPyaHlW2FWs7xvw5ddPuhUVjLD3olQVQS7kf58JbAB48iL0uL/jerTrjtV3lDA==",
+      "version": "1.53.0",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.53.0.tgz",
+      "integrity": "sha512-3+AYXp9fmJ/UhHBMYj2/U+RaUouMD90SzoItyDOB2Za7W6dB7fQApFGnZPl2MF6K8/Tv1koh1JyirSx/kju6Pw==",
       "license": "MIT",
       "workspaces": [
         "docs",
@@ -3519,9 +3519,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.13",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.13.tgz",
-      "integrity": "sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==",
+      "version": "4.13.14",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.14.tgz",
+      "integrity": "sha512-yhRLQ21U6qa9Hsu2N7Qcbh8tE+WKEcoErjIo56LeSGiGXGp9sA7UpE86Ui9uexb61KakiGwuHMn2QdV7w6i6kQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -3687,9 +3687,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.7.4",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz",
-      "integrity": "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==",
+      "version": "10.7.5",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.5.tgz",
+      "integrity": "sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -5248,14 +5248,14 @@
       }
     },
     "node_modules/unist-util-visit": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-5.1.0.tgz",
-      "integrity": "sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-5.2.0.tgz",
+      "integrity": "sha512-fpsYs/VVoZxfGY9/j3FQpZmN8wdLJaV1Pt38AaJNZu9uKIHcFU3halCdBveEq1HGKO1OEfJY65w1zvoFV1b3qQ==",
       "license": "MIT",
       "dependencies": {
         "@types/unist": "^3.0.0",
         "unist-util-is": "^6.0.0",
-        "unist-util-visit-parents": "^6.0.0"
+        "unist-util-visit-parents": "^6.1.0"
       },
       "funding": {
         "type": "opencollective",
@@ -5263,9 +5263,9 @@
       }
     },
     "node_modules/unist-util-visit-parents": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-6.0.2.tgz",
-      "integrity": "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-6.1.0.tgz",
+      "integrity": "sha512-vKXxz6O38sKDj1mtx/k2cWvkkFBuYGx6uGrlzBkVeWCRF/F8sdI0j3Wbkz/5rVNRRuVc8UrgRdbCxNhmYXgP3w==",
       "license": "MIT",
       "dependencies": {
         "@types/unist": "^3.0.0",
@@ -5456,7 +5456,7 @@
     },
     "": {
       "name": "@letta-ai/letta-code",
-      "version": "0.34.23",
+      "version": "0.34.25",
       "dependencies": {
         "@earendil-works/pi-ai": "^0.99.1",
         "@janhapke/sharp-electron": "0.35.3-electron.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@letta-ai/letta-code",
-  "version": "0.34.23",
+  "version": "0.34.25",
   "lettaStartupLogProtocol": 1,
   "description": "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
   "type": "module",
@@ -143,7 +143,7 @@
   "license": "Apache-2.0",
   "engines": {
     "bun": ">=1.3.2",
-    "node": ">=22.19.0"
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   },
   "publishConfig": {
     "access": "public"
@@ -220,7 +220,7 @@
     "prepublishOnly": "bun run runtime-graph:verify && bun run build",
     "postinstall": "node scripts/postinstall-patches.js || echo letta: vendor patches skipped && node -e \"try{require('fs').chmodSync(require('path').join(require.resolve('node-pty/package.json'),'../prebuilds/darwin-arm64/spawn-helper'),0o755)}catch(e){}\" || true",
     "mod-learning:memory-citations": "bun scripts/mod-learning/learn-mod.ts --env docs/examples/mods/learning/memory-citations.env.json",
-    "test:built-entrypoints": "LETTA_TEST_CLI_BUNDLE=\"$PWD/letta.js\" LETTA_TEST_BUILT_ARTIFACT=1 bun test src/cli/subcommands/lifecycle-output.test.ts src/websocket/app-server-dream.test.ts --timeout 60000"
+    "test:built-entrypoints": "LETTA_TEST_CLI_BUNDLE=\"$PWD/letta.js\" LETTA_TEST_BUILT_ARTIFACT=1 bun test src/subcommand-exit.test.ts src/cli/subcommands/lifecycle-output.test.ts src/websocket/app-server-dream.test.ts --timeout 60000"
   },
   "lint-staged": {
     "*.{ts,tsx,js,jsx,json}": [
@@ -275,5 +275,8 @@
   },
   "lettaLifecycleProtocol": 1,
   "lettaRuntimeGraphProtocol": 1,
-  "lettaRuntimeGraphSha512": "sha512-xHwgmxBsCCiYY3o9bJl2DPx84chNPq1OsLFGac23DBEoU+h6hGCcX7rZezQxutCYhG/yFzjQ65L3pZ5j6BzNbg=="
+  "lettaRuntimeGraphSha512": "sha512-75ArKlsNj6BLjfiYR7ejV9jl0U3L7r1mXtWLYoNBVFkpR+NgT29dy3I6c7xawN3klfWjTCPVa5kpHtS7gVbD0A==",
+  "patchedDependencies": {
+    "@earendil-works/pi-ai@0.99.1": "patches/@earendil-works%2Fpi-ai@0.99.1.patch"
+  }
 }

package/scripts/build-pypi.py

@@ -21,33 +21,33 @@ import zipfile
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
-NODE = "22.19.0"
+NODE = "22.23.4"
 # Official nodejs.org SHASUMS256.txt; pin the archive, not only the version.
 TARGETS = {
     ("Linux", "x86_64"): (
         "linux-x64",
         "manylinux_2_28_x86_64",
-        "d36e56998220085782c0ca965f9d51b7726335aed2f5fc7321c6c0ad233aa96d",
+        "b8492284c76a54baf58d61668dd0e41ee0fc98adabf9503d30f05d08f55b4406",
     ),
     ("Linux", "aarch64"): (
         "linux-arm64",
         "manylinux_2_28_aarch64",
-        "d32817b937219b8f131a28546035183d79e7fd17a86e38ccb8772901a7cd9009",
+        "f7a1e486dbc8b286847815b477d4fb5e9fb963ed4489c3e1588853d685f589f9",
     ),
     ("Darwin", "arm64"): (
         "darwin-arm64",
         "macosx_14_0_arm64",
-        "c59006db713c770d6ec63ae16cb3edc11f49ee093b5c415d667bb4f436c6526d",
+        "c9e1dbc748b33ed2d14f42445191ecaf14c56259c7a9a26d0042c49ec2b66428",
     ),
     ("Darwin", "x86_64"): (
         "darwin-x64",
         "macosx_14_0_x86_64",
-        "3cfed4795cd97277559763c5f56e711852d2cc2420bda1cea30c8aa9ac77ce0c",
+        "efcc2b0db6f94bf53eddb038fe2b370277a042bd29e4f19b8f8e23598795b819",
     ),
     ("Windows", "AMD64"): (
         "win-x64",
         "win_amd64",
-        "ea3fad0e67a991d8477d8c01344b56e69c676ccb733f065b22436994b1253f86",
+        "cbc74b5e0982c9dbb41525fd8fb5dcd32fbee237863f7829072f4639a1ce5f20",
     ),
 }
 

package/scripts/claude-watch/runtime-probe.test.ts

@@ -140,7 +140,7 @@ describe("command planning", () => {
     const serialized = sandboxed.args.join(" ");
     expect(sandboxed.command).toBe("/usr/bin/docker");
     expect(serialized).toContain("/tmp/probe-root:/watch:rw");
-    expect(serialized).toContain("node:22.18.0-bookworm@sha256:");
+    expect(serialized).toContain("node:22.23.4-bookworm@sha256:");
     expect(serialized).toContain("--cap-drop ALL");
     expect(serialized).toContain("--read-only");
     expect(serialized).toContain("--env ANTHROPIC_API_KEY");

package/scripts/claude-watch/runtime-sandbox.ts

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 
 const RUNTIME_SANDBOX_IMAGE =
-  "node:22.18.0-bookworm@sha256:3266bc9e8bee1acc8a77386eefaf574987d2729b8c5ec35b0dbd6ddbc40b0ce2";
+  "node:22.23.4-bookworm@sha256:63538dfe497cc29dfafdda25ada09b46db68a3f4cc205abf1f5d6bf0913f3384";
 const AUTH_ENV_KEYS = ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"] as const;
 
 export interface CommandSpec {

package/scripts/codex-watch/release-analysis.test.ts

@@ -115,6 +115,76 @@ describe("Codex GitHub release fetch", () => {
     expect(sleeps).toEqual([1000, 2000]);
   });
 
+  test("retries a disconnected successful response body", async () => {
+    const sleeps: number[] = [];
+    let requests = 0;
+    const releases = await listStableReleases({
+      fetchImpl: (async () => {
+        requests++;
+        if (requests === 1) {
+          return new Response(
+            new ReadableStream({
+              pull(controller) {
+                controller.error(new TypeError("fetch failed: ECONNRESET"));
+              },
+            }),
+            { status: 200 },
+          );
+        }
+        return Response.json(STABLES);
+      }) as typeof fetch,
+      sleep: async (delayMs) => {
+        sleeps.push(delayMs);
+      },
+    });
+
+    expect(requests).toBe(2);
+    expect(sleeps).toEqual([1000]);
+    expect(releases).toEqual(STABLES);
+  });
+
+  test("stops retrying disconnected bodies at the existing budget", async () => {
+    const sleeps: number[] = [];
+    let requests = 0;
+    const result = listStableReleases({
+      fetchImpl: (async () => {
+        requests++;
+        return new Response(
+          new ReadableStream({
+            pull(controller) {
+              controller.error(new TypeError("fetch failed: ECONNRESET"));
+            },
+          }),
+        );
+      }) as typeof fetch,
+      sleep: async (delayMs) => {
+        sleeps.push(delayMs);
+      },
+    });
+
+    await expect(result).rejects.toThrow("after 3 attempts");
+    expect(requests).toBe(3);
+    expect(sleeps).toEqual([1000, 2000]);
+  });
+
+  test("does not retry malformed JSON", async () => {
+    const sleeps: number[] = [];
+    let requests = 0;
+    const result = listStableReleases({
+      fetchImpl: (async () => {
+        requests++;
+        return new Response("not JSON");
+      }) as typeof fetch,
+      sleep: async (delayMs) => {
+        sleeps.push(delayMs);
+      },
+    });
+
+    await expect(result).rejects.toBeInstanceOf(SyntaxError);
+    expect(requests).toBe(1);
+    expect(sleeps).toEqual([]);
+  });
+
   test("fails immediately on a client error", async () => {
     const sleeps: number[] = [];
     let requests = 0;

package/scripts/codex-watch/release-analysis.ts

@@ -190,8 +190,7 @@ export async function listStableReleases(
 
   for (let page = 1; page <= 10; page++) {
     const url = `https://api.github.com/repos/${CODEX_REPO}/releases?per_page=100&page=${page}`;
-    const res = await fetchGitHubReleasesPage(url, headers, fetchImpl, sleep);
-    const batch = (await res.json()) as Release[];
+    const batch = await fetchGitHubReleasesPage(url, headers, fetchImpl, sleep);
     releases.push(...batch);
     if (batch.length < 100) break;
   }
@@ -205,12 +204,15 @@ async function fetchGitHubReleasesPage(
   headers: Record<string, string>,
   fetchImpl: typeof fetch,
   sleep: (delayMs: number) => Promise<void>,
-): Promise<Response> {
+): Promise<Release[]> {
   for (let attempt = 1; ; attempt++) {
     let response: Response;
     try {
       response = await fetchImpl(url, { headers });
+      // A successful fetch can still lose its connection while reading the body.
+      if (response.ok) return (await response.json()) as Release[];
     } catch (error) {
+      if (error instanceof SyntaxError) throw error;
       if (attempt === GITHUB_RELEASES_FETCH_ATTEMPTS) {
         throw new Error(
           `GitHub releases API request failed after ${attempt} attempts: ${String(error)}`,
@@ -221,8 +223,6 @@ async function fetchGitHubReleasesPage(
       continue;
     }
 
-    if (response.ok) return response;
-
     const message = `GitHub releases API failed (${response.status}): ${await response.text()}`;
     if (response.status < 500 || attempt === GITHUB_RELEASES_FETCH_ATTEMPTS) {
       throw new Error(message);

package/scripts/source-file-size-baseline.json

@@ -2,13 +2,13 @@
   "src/agent/client-skills.test.ts": 1132,
   "src/agent/memory-git.ts": 2013,
   "src/backend/local-backend.test.ts": 2472,
-  "src/backend/local/local-store.ts": 3261,
+  "src/backend/local/local-store.ts": 3260,
   "src/backend/pi-stream-adapter.test.ts": 1255,
   "src/cli/app/AppCoordinator.tsx": 5131,
   "src/cli/app/AppView.tsx": 1732,
   "src/cli/app/use-approval-flow.ts": 1099,
   "src/cli/app/use-configuration-handlers.ts": 1417,
-  "src/cli/app/use-conversation-loop.ts": 2899,
+  "src/cli/app/use-conversation-loop.ts": 2878,
   "src/cli/app/use-submit-handler.ts": 3797,
   "src/cli/components/AgentSelector.tsx": 1104,
   "src/cli/components/InputRich.tsx": 2124,
@@ -34,7 +34,7 @@
   "src/settings-manager.ts": 2092,
   "src/tools/manager.ts": 2609,
   "src/tools/tool-execution-context.test.ts": 1092,
-  "src/types/protocol_v2.ts": 2411,
+  "src/types/protocol_v2.ts": 2409,
   "src/websocket/listen-client-concurrency.test.ts": 2554,
   "src/websocket/listen-client-protocol.test.ts": 5664,
   "src/websocket/listener/commands/memory.ts": 1114,

package/skills/maintaining-deferred-memory/SKILL.md

@@ -58,6 +58,8 @@ Discovery runs through the `MEMORY.md` chain, one level at a time:
 
 After adding or moving a file, trace the path a future request would take from root `MEMORY.md` to the file. If any step depends on knowing the file already exists, fix the index.
 
+Indexes are the only way the agent finds deferred memory: it opens a file only when every entry on the path from root names what it is looking for. Keep them accurate as memory changes. Whenever you add, move, or substantially change what a directory holds, reread its entry in each parent `MEMORY.md` up to root and rewrite it to name the topics the directory now covers, in the words a future request would use. An entry written when the directory was new goes stale as it fills, and a topic no entry mentions is effectively lost.
+
 ## Design for progressive disclosure
 
 Each level should give the agent enough to decide whether to go deeper, and nothing it would have to read past to decide.

package/skills/scheduling-tasks/SKILL.md

@@ -23,7 +23,7 @@ Execution determines schedule ownership; there is no runner selection flag:
 - In a managed Cloud sandbox, schedules are durable Cloud schedules and run in the agent's Cloud sandbox.
 - On a user-managed computer or self-hosted runtime, schedules are local and fire only while a Letta session is running there.
 
-From a managed Cloud sandbox, `--computer <deviceId>` can run the scheduled work on a specific connected computer. Get the device ID from `letta computers list`. If that computer is offline at fire time, execution falls back to the Cloud sandbox. Local execution cannot target another computer.
+From a managed Cloud sandbox, `--computer <deviceId>` can run the scheduled work on a specific connected computer. Get the device ID from `letta computers list`. If that computer is offline at fire time, that occurrence fails (`TARGET_DEVICE_UNAVAILABLE`) and does not run; omit `--computer` to run in the Cloud sandbox. Local execution cannot target another computer.
 
 Creation and execution follow those rules, while management commands still show and cancel both local and Cloud inventory. This keeps schedules created by older CLI versions visible without changing where new schedules run.
 

package/skills/working-across-computers/references/connect-a-computer-for-remote-access.md

@@ -18,7 +18,7 @@ curl -sS -X POST "$LETTA_BASE_URL/v1/environments/connect-token" \
 
 The response is `{ "deviceCode": "...", "organizationId": "...", "expiresIn": 900 }`. A 403 means this sandbox key does not resolve to an owner; tell the user and fall back to Option 2.
 
-Ask the user to install [Node.js 22.19 or newer](https://nodejs.org/en/download) if they do not have it, then run this **on the computer they want to connect**, filling in both values from the response:
+Ask the user to install [Node.js ^22.23.4, ^24.22.1, or ^26.12.1](https://nodejs.org/en/download) if they do not have it, then run this **on the computer they want to connect**, filling in both values from the response:
 
 ```bash
 npm install -g @letta-ai/letta-code
@@ -31,7 +31,7 @@ The command signs in as the owner. Send it only to that person: a DM, or the thr
 
 ## Option 2: CLI server (browser sign-in)
 
-Ask the user to install [Node.js 22.19 or newer](https://nodejs.org/en/download), then run these commands in a terminal **on the target computer**:
+Ask the user to install [Node.js ^22.23.4, ^24.22.1, or ^26.12.1](https://nodejs.org/en/download), then run these commands in a terminal **on the target computer**:
 
 ```bash
 npm install -g @letta-ai/letta-code

package/dist/types/websocket/listener/mcp-originator-scope.d.ts

@@ -1,9 +0,0 @@
-import type { IncomingMessage } from "./types";
-export type McpOriginatorScope = {
-    superRunId: string;
-    tokenPresent: boolean;
-} | null;
-export declare function getMcpOriginatorScope(message?: Pick<IncomingMessage, "mcpOriginatorSuperRunId" | "mcpOriginatorTokenPresent">): McpOriginatorScope;
-export declare function sameMcpOriginatorScope(a: McpOriginatorScope, b: McpOriginatorScope): boolean;
-export declare function getEffectiveMcpOriginatorId(message: Pick<IncomingMessage, "mcpOriginatorSuperRunId" | "mcpOriginatorTokenPresent">): string | undefined;
-//# sourceMappingURL=mcp-originator-scope.d.ts.map

package/dist/types/websocket/listener/mcp-originator-scope.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-originator-scope.d.ts","sourceRoot":"","sources":["../../../../src/websocket/listener/mcp-originator-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB,GAAG,IAAI,CAAC;AAET,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,IAAI,CACZ,eAAe,EACf,yBAAyB,GAAG,2BAA2B,CACxD,GACA,kBAAkB,CAOpB;AAED,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,kBAAkB,EACrB,CAAC,EAAE,kBAAkB,GACpB,OAAO,CAIT;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,IAAI,CACX,eAAe,EACf,yBAAyB,GAAG,2BAA2B,CACxD,GACA,MAAM,GAAG,SAAS,CAIpB"}