@letta-ai/letta-code 0.34.25 → 0.34.26

package/scripts/agent-watch/verify-pr-identity.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import {
   enforceWatcherPrIdentity,
+  findWatcherPullRequests,
   parseArgs,
   type WatcherPullRequest,
 } from "./verify-pr-identity.ts";
@@ -20,6 +21,25 @@ function pullRequest(
   };
 }
 
+function apiPullRequest(
+  overrides: Partial<{
+    body: string | null;
+    draft: boolean;
+    html_url: string;
+    number: number;
+    user: { login: string } | null;
+  }> = {},
+) {
+  return {
+    body: marker,
+    draft: true,
+    html_url: "https://github.com/letta-ai/letta-code/pull/123",
+    number: 123,
+    user: { login: "amelia-letta" },
+    ...overrides,
+  };
+}
+
 function enforce(
   pullRequests: WatcherPullRequest[],
   closed: string[] = [],
@@ -35,6 +55,134 @@ function enforce(
   });
 }
 
+describe("findWatcherPullRequests", () => {
+  test("finds a marker PR omitted from every bounded search attempt", () => {
+    const calls: string[][] = [];
+    let waits = 0;
+    const result = findWatcherPullRequests(
+      { repo: "letta-ai/letta-code", marker },
+      (args) => {
+        calls.push(args);
+        return args[0] === "pr" ? "[]" : JSON.stringify([[apiPullRequest()]]);
+      },
+      () => {
+        waits += 1;
+      },
+    );
+
+    expect(result.map((candidate) => candidate.number)).toEqual([123]);
+    expect(calls.filter(([command]) => command === "pr")).toHaveLength(3);
+    expect(calls.at(-1)?.slice(0, 6)).toEqual([
+      "api",
+      "--method",
+      "GET",
+      "--paginate",
+      "--slurp",
+      "repos/letta-ai/letta-code/pulls",
+    ]);
+    expect(waits).toBe(2);
+  });
+
+  test("does not miss a duplicate omitted from server-side search", () => {
+    const duplicate = apiPullRequest({
+      html_url: "https://github.com/letta-ai/letta-code/pull/124",
+      number: 124,
+    });
+    const result = findWatcherPullRequests(
+      { repo: "letta-ai/letta-code", marker },
+      (args) =>
+        args[0] === "pr"
+          ? JSON.stringify([pullRequest()])
+          : JSON.stringify([[apiPullRequest(), duplicate]]),
+      () => {},
+    );
+
+    expect(result.map((candidate) => candidate.number)).toEqual([123, 124]);
+    expect(() => enforce(result)).toThrow("Multiple open watcher PRs");
+  });
+
+  test("proves persistent absence authoritatively and fails closed on API failure", () => {
+    const absent = findWatcherPullRequests(
+      { repo: "letta-ai/letta-code", marker },
+      (args) => (args[0] === "pr" ? "[]" : "[[]]"),
+      () => {},
+    );
+    expect(absent).toEqual([]);
+
+    expect(() =>
+      findWatcherPullRequests(
+        { repo: "letta-ai/letta-code", marker },
+        (args) => {
+          if (args[0] === "pr") throw new Error("search unavailable");
+          throw new Error("authoritative listing unavailable");
+        },
+        () => {},
+      ),
+    ).toThrow("authoritative listing unavailable");
+  });
+
+  test("checks every authoritative page beyond 1,000 open pull requests", () => {
+    const pages = Array.from({ length: 10 }, (_, page) =>
+      Array.from({ length: 100 }, (_, index) =>
+        apiPullRequest({
+          body: "unrelated",
+          number: page * 100 + index + 1,
+        }),
+      ),
+    );
+    pages.push([apiPullRequest({ number: 1_001 })]);
+    const result = findWatcherPullRequests(
+      { repo: "letta-ai/letta-code", marker },
+      (args) => (args[0] === "pr" ? "[]" : JSON.stringify(pages)),
+      () => {},
+    );
+
+    expect(result.map((candidate) => candidate.number)).toEqual([1_001]);
+  });
+
+  test("rejects fuzzy authoritative candidates and keeps every exact match", () => {
+    const result = findWatcherPullRequests(
+      { repo: "letta-ai/letta-code", marker },
+      (args) =>
+        args[0] === "pr"
+          ? JSON.stringify([pullRequest()])
+          : JSON.stringify([
+              [
+                apiPullRequest({
+                  body: "Pi ai watch 1.0.0 1.0.1",
+                  number: 999,
+                }),
+                apiPullRequest(),
+              ],
+            ]),
+      () => {},
+    );
+
+    expect(result.map((candidate) => candidate.number)).toEqual([123]);
+  });
+
+  test("passes shell metacharacters as one search argument", () => {
+    const unsafeMarker = 'Watcher: $(touch /tmp/pwned); "quoted"';
+    const calls: string[][] = [];
+    findWatcherPullRequests(
+      { repo: "letta-ai/letta-code", marker: unsafeMarker },
+      (args) => {
+        calls.push(args);
+        return args[0] === "pr" ? "[]" : "[[]]";
+      },
+      () => {},
+    );
+
+    for (const command of calls.filter(([name]) => name === "pr")) {
+      expect(command[command.indexOf("--search") + 1]).toBe(
+        `${unsafeMarker} in:body`,
+      );
+    }
+    expect(calls.at(-1)).toContain("state=open");
+    expect(calls.at(-1)).toContain("per_page=100");
+  });
+});
+
 describe("enforceWatcherPrIdentity", () => {
   test("returns the matching Amelia draft PR", () => {
     expect(enforce([pullRequest()])?.number).toBe(123);

package/scripts/agent-watch/verify-pr-identity.ts

@@ -95,22 +95,80 @@ function runGh(args: string[]): string {
   return result.stdout;
 }
 
+interface GitHubPullRequest {
+  body: string | null;
+  draft: boolean;
+  html_url: string;
+  number: number;
+  user: { login: string } | null;
+}
+
+const SEARCH_ATTEMPTS = 3;
+
+export function findWatcherPullRequests(
+  args: Pick<Args, "repo" | "marker">,
+  executeGh: (command: string[]) => string = runGh,
+  waitForSearchIndex: () => void = () => Bun.sleepSync(1_000),
+): WatcherPullRequest[] {
+  for (let attempt = 0; attempt < SEARCH_ATTEMPTS; attempt += 1) {
+    let foundExactHint = false;
+    try {
+      const candidates = JSON.parse(
+        executeGh([
+          "pr",
+          "list",
+          "--repo",
+          args.repo,
+          "--state",
+          "open",
+          "--search",
+          `${args.marker} in:body`,
+          "--limit",
+          "1000",
+          "--json",
+          "author,body,isDraft,number,url",
+        ]),
+      ) as WatcherPullRequest[];
+      foundExactHint = candidates.some((pullRequest) =>
+        pullRequest.body?.includes(args.marker),
+      );
+    } catch {
+      // Search is only an acceleration hint. The authoritative list below must
+      // still prove presence, absence, and uniqueness.
+    }
+    if (foundExactHint) break;
+    if (attempt + 1 < SEARCH_ATTEMPTS) waitForSearchIndex();
+  }
+
+  const pages = JSON.parse(
+    executeGh([
+      "api",
+      "--method",
+      "GET",
+      "--paginate",
+      "--slurp",
+      `repos/${args.repo}/pulls`,
+      "-f",
+      "state=open",
+      "-f",
+      "per_page=100",
+    ]),
+  ) as GitHubPullRequest[][];
+  return pages
+    .flatMap((page) => page)
+    .filter((pullRequest) => pullRequest.body?.includes(args.marker))
+    .map((pullRequest) => ({
+      author: pullRequest.user,
+      body: pullRequest.body,
+      isDraft: pullRequest.draft,
+      number: pullRequest.number,
+      url: pullRequest.html_url,
+    }));
+}
+
 function main(): void {
   const args = parseArgs(process.argv.slice(2));
-  const pullRequests = JSON.parse(
-    runGh([
-      "pr",
-      "list",
-      "--repo",
-      args.repo,
-      "--state",
-      "open",
-      "--limit",
-      "1000",
-      "--json",
-      "author,body,isDraft,number,url",
-    ]),
-  ) as WatcherPullRequest[];
+  const pullRequests = findWatcherPullRequests(args);
   const verified = enforceWatcherPrIdentity({
     ...args,
     pullRequests,

package/scripts/claude-watch/agent-watch.ts

@@ -212,14 +212,20 @@ async function selectCandidate(
   state: ClaudeWatchStateSnapshot | null,
   args: Args,
 ): Promise<ClaudeReleaseCandidate> {
+  const previousVersion =
+    args.previousVersion ?? state?.package_version ?? null;
   const [githubReleases, npmMetadata] = await Promise.all([
-    fetchClaudeGitHubReleases(),
+    fetchClaudeGitHubReleases({
+      currentVersion: args.currentVersion,
+      previousVersion,
+      allowNpmOnlyExactVersions: args.validationOnly,
+    }),
     fetchClaudeNpmMetadata(),
   ]);
   const selected = selectClaudeReleaseCandidate({
     githubReleases,
     npmMetadata,
-    previousVersion: args.previousVersion ?? state?.package_version ?? null,
+    previousVersion,
     currentVersion: args.currentVersion,
     allowNpmOnlyExactVersions: args.validationOnly,
   });

package/scripts/claude-watch/release-source.test.ts

@@ -1,5 +1,6 @@
 import {
   ClaudeReleaseSourceDisagreementError,
+  fetchClaudeGitHubReleases,
   parseClaudeGitHubReleases,
   parseClaudeNpmMetadata,
   releaseNotesForRange,
@@ -45,6 +46,125 @@ describe("parseClaudeGitHubReleases", () => {
   });
 });
 
+describe("fetchClaudeGitHubReleases", () => {
+  test("resolves the latest release without fetching a list page", async () => {
+    const urls: string[] = [];
+    const fetched = await fetchClaudeGitHubReleases({
+      previousVersion: "1.2.0",
+      retries: 0,
+      fetch: (async (input) => {
+        urls.push(String(input));
+        return Response.json(github("1.2.0", 2));
+      }) as typeof fetch,
+    });
+
+    expect(fetched).toEqual([github("1.2.0", 2)]);
+    expect(urls).toEqual([
+      "https://api.github.com/repos/anthropics/claude-code/releases/latest",
+    ]);
+  });
+
+  test("resolves an explicit release without fetching a list page", async () => {
+    const urls: string[] = [];
+    const fetched = await fetchClaudeGitHubReleases({
+      currentVersion: "1.1.0",
+      previousVersion: "1.1.0",
+      retries: 0,
+      fetch: (async (input) => {
+        const url = String(input);
+        urls.push(url);
+        return Response.json(
+          url.endsWith("/latest") ? github("1.2.0", 2) : github("1.1.0", 1),
+        );
+      }) as typeof fetch,
+    });
+
+    expect(fetched).toEqual([github("1.1.0", 1), github("1.2.0", 2)]);
+    expect(urls).toEqual([
+      "https://api.github.com/repos/anthropics/claude-code/releases/latest",
+      "https://api.github.com/repos/anthropics/claude-code/releases/tags/v1.1.0",
+    ]);
+  });
+
+  test("pages only until the previous release needed for a range", async () => {
+    const urls: string[] = [];
+    const filler = Array.from({ length: 100 }, (_, index) => ({
+      ...github(`2.0.${index}`, 3),
+      published_at: `2026-08-02T${String(Math.floor(index / 60)).padStart(2, "0")}:${String(index % 60).padStart(2, "0")}:00Z`,
+    }));
+    const fetched = await fetchClaudeGitHubReleases({
+      currentVersion: "1.2.0",
+      previousVersion: "1.0.0",
+      retries: 0,
+      fetch: (async (input) => {
+        const url = String(input);
+        urls.push(url);
+        if (url.endsWith("/latest")) return Response.json(github("1.2.0", 2));
+        if (url.endsWith("/tags/v1.2.0"))
+          return Response.json(github("1.2.0", 2));
+        if (url.endsWith("/tags/v1.0.0"))
+          return Response.json(github("1.0.0", 0));
+        if (url.endsWith("page=1")) return Response.json(filler);
+        if (url.endsWith("page=2"))
+          return Response.json([github("1.1.0", 1), github("1.0.0", 0)]);
+        throw new Error(`Unexpected request ${url}`);
+      }) as typeof fetch,
+    });
+
+    expect(fetched.map(({ tag_name }) => tag_name)).toContain("1.1.0");
+    expect(urls.filter((url) => url.includes("?per_page=100"))).toEqual([
+      "https://api.github.com/repos/anthropics/claude-code/releases?per_page=100&page=1",
+      "https://api.github.com/repos/anthropics/claude-code/releases?per_page=100&page=2",
+    ]);
+  });
+
+  test("keeps validation-only npm replays off list pages", async () => {
+    const urls: string[] = [];
+    const fetched = await fetchClaudeGitHubReleases({
+      currentVersion: "1.1.0",
+      previousVersion: "1.0.0",
+      allowNpmOnlyExactVersions: true,
+      retries: 0,
+      fetch: (async (input) => {
+        const url = String(input);
+        urls.push(url);
+        if (url.endsWith("/latest")) return Response.json(github("1.2.0", 2));
+        return new Response("Not Found", {
+          status: 404,
+          statusText: "Not Found",
+        });
+      }) as typeof fetch,
+    });
+
+    expect(fetched).toEqual([github("1.2.0", 2)]);
+    expect(urls.some((url) => url.includes("?per_page=100"))).toBe(false);
+  });
+
+  test("preserves point-endpoint retry errors for a missing explicit tag", async () => {
+    let requests = 0;
+    const result = fetchClaudeGitHubReleases({
+      currentVersion: "9.9.9",
+      retries: 1,
+      backoffMs: 0,
+      sleep: async () => {},
+      fetch: (async (input) => {
+        requests++;
+        if (String(input).endsWith("/latest"))
+          return Response.json(github("1.2.0", 2));
+        return new Response("Not Found", {
+          status: 404,
+          statusText: "Not Found",
+        });
+      }) as typeof fetch,
+    });
+
+    await expect(result).rejects.toThrow(
+      "Failed to fetch https://api.github.com/repos/anthropics/claude-code/releases/tags/v9.9.9 after 2 attempts",
+    );
+    expect(requests).toBe(3);
+  });
+});
+
 describe("parseClaudeNpmMetadata", () => {
   test("includes channels, all publish times, integrity, and tarballs", () => {
     const parsed = parseClaudeNpmMetadata({

package/scripts/claude-watch/release-source.ts

@@ -18,6 +18,9 @@ export interface ReleaseSourceFetchOptions {
   retries?: number;
   backoffMs?: number;
   sleep?: (milliseconds: number) => Promise<void>;
+  currentVersion?: string | null;
+  previousVersion?: string | null;
+  allowNpmOnlyExactVersions?: boolean;
 }
 
 export interface ReleaseSelectionOptions {
@@ -373,27 +376,94 @@ async function fetchJson(
   });
 }
 
+function isNotFoundFetchError(error: unknown): boolean {
+  return (
+    error instanceof Error &&
+    error.cause instanceof Error &&
+    error.cause.message.startsWith("404 ")
+  );
+}
+
 export async function fetchClaudeGitHubReleases(
   options: ReleaseSourceFetchOptions = {},
 ): Promise<ClaudeGitHubRelease[]> {
-  const rawReleases: unknown[] = [];
+  const headers = {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "letta-claude-watch",
+    ...(process.env.GH_TOKEN
+      ? { Authorization: `Bearer ${process.env.GH_TOKEN}` }
+      : {}),
+  };
+  const currentVersion = options.currentVersion
+    ? normalizeGitHubReleaseTag(options.currentVersion)
+    : null;
+  const previousVersion = options.previousVersion
+    ? normalizeGitHubReleaseTag(options.previousVersion)
+    : null;
+  const rawReleases: unknown[] = [
+    await fetchJson(`${GITHUB_RELEASES_URL}/latest`, options, headers),
+  ];
+  let foundCurrent = true;
+  if (currentVersion) {
+    try {
+      rawReleases.push(
+        await fetchJson(
+          `${GITHUB_RELEASES_URL}/tags/${encodeURIComponent(`v${currentVersion}`)}`,
+          options,
+          headers,
+        ),
+      );
+    } catch (error) {
+      if (!options.allowNpmOnlyExactVersions || !isNotFoundFetchError(error)) {
+        throw error;
+      }
+      foundCurrent = false;
+    }
+  }
+
+  const pointReleases = parseClaudeGitHubReleases(rawReleases);
+  const resolvedCurrentVersion =
+    currentVersion ?? pointReleases.at(-1)?.tag_name;
+  if (
+    !previousVersion ||
+    previousVersion === resolvedCurrentVersion ||
+    !foundCurrent
+  ) {
+    return pointReleases;
+  }
+
+  try {
+    rawReleases.push(
+      await fetchJson(
+        `${GITHUB_RELEASES_URL}/tags/${encodeURIComponent(`v${previousVersion}`)}`,
+        options,
+        headers,
+      ),
+    );
+  } catch (error) {
+    if (!options.allowNpmOnlyExactVersions || !isNotFoundFetchError(error)) {
+      throw error;
+    }
+    return parseClaudeGitHubReleases(rawReleases);
+  }
+
   for (let page = 1; ; page += 1) {
     const payload = await fetchJson(
       `${GITHUB_RELEASES_URL}?per_page=100&page=${page}`,
       options,
-      {
-        Accept: "application/vnd.github+json",
-        "User-Agent": "letta-claude-watch",
-        ...(process.env.GH_TOKEN
-          ? { Authorization: `Bearer ${process.env.GH_TOKEN}` }
-          : {}),
-      },
+      headers,
     );
     if (!Array.isArray(payload)) {
       throw new TypeError("GitHub releases response must be an array");
     }
     rawReleases.push(...payload);
-    if (payload.length < 100) break;
+    const parsedPage = parseClaudeGitHubReleases(payload);
+    if (
+      parsedPage.some(({ tag_name }) => tag_name === previousVersion) ||
+      payload.length < 100
+    ) {
+      break;
+    }
   }
   return parseClaudeGitHubReleases(rawReleases);
 }

package/scripts/codex-watch/agent-watch.ts

@@ -90,7 +90,7 @@ async function main() {
   let stableReleases: Release[] | undefined;
 
   if (!state.audit_cursor_validated) {
-    stableReleases = await listStableReleases();
+    stableReleases = await listStableReleases({ fullHistory: true });
     state = validateLegacyCodexAuditCursor(
       state,
       stableReleases.map((release) => release.tag_name),
@@ -103,7 +103,7 @@ async function main() {
   if (!sinceTag && !currentTag) {
     const cursorTag = getCodexAuditCursorTag(state);
     if (cursorTag) {
-      stableReleases ??= await listStableReleases();
+      stableReleases ??= await listStableReleases({ sinceTag: cursorTag });
       const latestRelease = findLatestStableReleaseAfter(
         stableReleases,
         cursorTag,