@letta-ai/letta-code 0.34.27 → 0.34.28

package/letta.js

@@ -6044,7 +6044,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@letta-ai/letta-code",
-    version: "0.34.27",
+    version: "0.34.28",
     lettaStartupLogProtocol: 1,
     lettaConfigDirProtocol: 1,
     description: "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
@@ -168979,7 +168979,7 @@ async function resolveSlackMessageFiles(params) {
       oldest: params.messageTs,
       latest: params.messageTs,
       inclusive: true,
-      limit: 1
+      limit: 2
     }));
     const message2 = messages2.find((entry) => entry.ts === params.messageTs);
     return message2 ? collectSlackFiles(message2) : null;
@@ -211476,7 +211476,7 @@ var init_mcp_client = __esm(() => {
   init_streamableHttp();
   DEFAULT_CLIENT_INFO = {
     name: "letta-code",
-    version: "0.34.27"
+    version: "0.34.28"
   };
 });
 
@@ -215530,7 +215530,7 @@ Important:
 var init_Bash = () => {};
 
 // src/tools/descriptions/CodeMode.md
-var CodeMode_default = "Run a JavaScript async function body that calls tools and returns only the results you need.\n\nCall built-in tools with `await tools.<name>(args)` and MCP tools with `await tools.mcp__server__tool(args)`; `listTools()` and `describeTool(name)` list tools and their schemas. Failed calls throw. `args` holds optional input, and `console.log()` output is captured.\n\nReturns `{ result, output }`. Like Bash, a script still running after a brief wait continues in the background and its result arrives as a task notification; `run_in_background: true` returns the task ID immediately. TaskStop aborts it.\n\nNested calls follow permission rules; calls that need approval fail, so call those tools directly. This is not a security sandbox.\n\nExample:\n\n    const texts = await Promise.all(args.paths.map(file_path => tools.Read({ file_path })));\n    return texts.map((text, i) => ({ path: args.paths[i], lines: text.split('\\n').length }));\n";
+var CodeMode_default = "Run a JavaScript async function body that calls tools and returns only the results you need.\n\nCall built-in and server-side tools with `await tools.<name>(args)` and MCP tools with `await tools.mcp__server__tool(args)`; `listTools()` and `describeTool(name)` list tools and their schemas. Failed calls throw. `args` holds optional input, and `console.log()` output is captured.\n\nReturns `{ result, output }`. Like Bash, a script still running after a brief wait continues in the background and its result arrives as a task notification; `run_in_background: true` returns the task ID immediately. TaskStop aborts it.\n\nNested calls follow permission rules; calls that need approval fail, so call those tools directly. This is not a security sandbox.\n\nExample:\n\n    const texts = await Promise.all(args.paths.map(file_path => tools.Read({ file_path })));\n    return texts.map((text, i) => ({ path: args.paths[i], lines: text.split('\\n').length }));\n";
 var init_CodeMode = () => {};
 
 // src/tools/descriptions/Edit.md
@@ -215634,7 +215634,7 @@ Do not use this tool for root memory files (already loaded) or skills/ (use Skil
 var init_Memory = () => {};
 
 // src/tools/descriptions/Monitor.md
-var Monitor_default = 'Start a background monitor that streams events from a long-running script. Each stdout line is an event — you keep working and notifications arrive in the chat. Events arrive on their own schedule and are not replies from the user, even if one lands while you\'re waiting for the user to answer a question.\n\nPick by how many notifications you need:\n- **One** ("tell me when the server is ready / the build finishes") → use **Bash with `run_in_background`** and a command that exits when the condition is true, e.g. `until grep -q "Ready in" dev.log; do sleep 0.5; done`. You get a single completion notification when it exits.\n- **One per occurrence, indefinitely** ("tell me every time an ERROR line appears") → Monitor with an unbounded command (`tail -f`, `inotifywait -m`, `while true`).\n- **One per occurrence, until a known end** ("emit each CI step result, stop when the run completes") → Monitor with a command that emits lines and then exits.\n\nYour script\'s stdout is the event stream. Each line becomes a notification. Exit ends the watch.\n  # Each matching log line is an event\n  tail -f /var/log/app.log | grep --line-buffered "ERROR"\n  # Each file change is an event\n  inotifywait -m --format \'%e %f\' /watched/dir\n  # Node script that emits events as they arrive (e.g. WebSocket listener)\n  node watch-for-events.js\n\nFor open github.com pull requests, use WatchPR instead. It covers the whole PR surface and keeps watching after CI finishes. Use Monitor only when WatchPR does not apply.\n\n**Don\'t use an unbounded command for a single notification.** `tail -f`, `inotifywait -m`, and `while true` never exit on their own, so the monitor stays armed until timeout even after the event has fired. For "tell me when X is ready," use Bash `run_in_background` with an `until` loop instead (one notification, ends in seconds). Note that `tail -f log | grep -m 1 ...` does *not* fix this: if the log goes quiet after the match, `tail` never receives SIGPIPE and the pipeline hangs anyway.\n\n- Every pipe stage must flush per line or matches sit in its buffer unseen: `grep` needs `--line-buffered`, `awk` needs `fflush()`. `head` cannot flush at all — `| head -N` delivers nothing until N matches accumulate, then ends the stream.\n- In poll loops, handle transient failures (`curl ... || true`) — one failed request shouldn\'t kill the monitor.\n- Poll intervals: 30s+ for remote APIs (rate limits), 0.5–1s for local checks.\n- Write a specific `description` — it appears in every notification ("errors in deploy.log" not "watching logs").\n- Only stdout is the event stream. Stderr goes to the output file (readable via Read) but does not trigger notifications — for a command you run directly (e.g. `python train.py 2>&1 | grep --line-buffered ...`), merge stderr with `2>&1` so its failures reach your filter. (No effect on `tail -f` of an existing log — that file only contains what its writer redirected.)\n\n**Coverage — silence is not success.** When watching a job or process for an outcome, your filter must match every terminal state, not just the happy path. A monitor that greps only for the success marker stays silent through a crashloop, a hung process, or an unexpected exit — and silence looks identical to "still running." Before arming, ask: *if this process crashed right now, would my filter emit anything?* If not, widen it.\n  # Wrong — silent on crash, hang, or any non-success exit\n  tail -f run.log | grep --line-buffered "elapsed_steps="\n  # Right — one alternation covering progress + the failure signatures you\'d act on\n  tail -f run.log | grep -E --line-buffered "elapsed_steps=|Traceback|Error|FAILED|assert|Killed|OOM"\n\nFor poll loops checking job state, emit on every terminal status (`succeeded|failed|cancelled|timeout`), not just success. If you cannot confidently enumerate the failure signatures, broaden the grep alternation rather than narrow it — some extra noise is better than missing a crashloop.\n\n**Output volume**: Every stdout line is a conversation message, so the filter should be selective — but selective means "the lines you\'d act on," not "only good news." Never pipe raw logs; filter to exactly the success and failure signals you care about. Monitors that produce too many events are automatically stopped; restart with a tighter filter if this happens.\n\nStdout lines within 200ms are batched into a single notification, so multiline output from a single event groups naturally.\n\nThe script runs in the same shell environment as Bash. Exit ends the watch (exit code is reported). Timeout → killed. Set `persistent: true` for session-length watches (log tails, long-lived event streams). In managed Cloud sandboxes, every monitor stops after at most 1 hour, including persistent monitors; elsewhere persistent monitors run until TaskStop or session end. For longer Cloud waits, schedule a Wake or cron (which does not keep the sandbox running between turns) and combine it with shorter monitors. Use TaskStop to cancel early.\n\nWhen someone is waiting on the result, set `backup_after_seconds` (e.g. 900). If the monitor goes that long without an event, a durable Wake brings you back to check the real state, so a queued, hung, or dead watch can\'t leave them waiting in silence.\n\n**ws source** — open a WebSocket and stream each incoming text frame as an event. No shell, no polling: the server pushes, you get notified.\n    ws: {url: \'wss://events.example.com/stream\', protocols: [\'v1\']},\n    description: \'deploy events\',\n\nEach text frame becomes one notification (multiline frames stay as one event). Binary frames are reported as `[binary frame, N bytes]` rather than passed through. Socket close ends the watch with the close code surfaced; errors are surfaced before close. Same rate limiting as bash — a firehose will be suppressed and eventually stopped, so subscribe to a filtered feed where one exists.\n\nPrefer this over `command: \'websocat wss://…\'` — it avoids the extra process and line-buffering pitfalls. Use bash when you need to transform or filter frames with shell tools before they become events.\n';
+var Monitor_default = 'Start a background monitor that streams events from a long-running script. Each stdout line is an event — you keep working and notifications arrive in the chat. Events arrive on their own schedule and are not replies from the user, even if one lands while you\'re waiting for the user to answer a question.\n\nPick by how many notifications you need:\n- **One** ("tell me when the server is ready / the build finishes") → use **Bash with `run_in_background`** and a command that exits when the condition is true, e.g. `until grep -q "Ready in" dev.log; do sleep 0.5; done`. You get a single completion notification when it exits.\n- **One per occurrence, indefinitely** ("tell me every time an ERROR line appears") → Monitor with an unbounded command (`tail -f`, `inotifywait -m`, `while true`).\n- **One per occurrence, until a known end** ("emit each CI step result, stop when the run completes") → Monitor with a command that emits lines and then exits.\n\nYour script\'s stdout is the event stream. Each line becomes a notification. Exit ends the watch.\n  # Each matching log line is an event\n  tail -f /var/log/app.log | grep --line-buffered "ERROR"\n  # Each file change is an event\n  inotifywait -m --format \'%e %f\' /watched/dir\n  # Node script that emits events as they arrive (e.g. WebSocket listener)\n  node watch-for-events.js\n\nFor open github.com pull requests, use WatchPR instead. It covers the whole PR surface and keeps watching after CI finishes. Use Monitor only when WatchPR does not apply.\n\n**Don\'t use an unbounded command for a single notification.** `tail -f`, `inotifywait -m`, and `while true` never exit on their own, so the monitor stays armed until timeout even after the event has fired. For "tell me when X is ready," use Bash `run_in_background` with an `until` loop instead (one notification, ends in seconds). Note that `tail -f log | grep -m 1 ...` does *not* fix this: if the log goes quiet after the match, `tail` never receives SIGPIPE and the pipeline hangs anyway.\n\n- Every pipe stage must flush per line or matches sit in its buffer unseen: `grep` needs `--line-buffered`, `awk` needs `fflush()`. `head` cannot flush at all — `| head -N` delivers nothing until N matches accumulate, then ends the stream.\n- In poll loops, handle transient failures (`curl ... || true`) — one failed request shouldn\'t kill the monitor.\n- Poll intervals: 30s+ for remote APIs (rate limits), 0.5–1s for local checks.\n- Write a specific `description` — it appears in every notification ("errors in deploy.log" not "watching logs").\n- Only stdout is the event stream. Stderr goes to the output file (readable via Read) but does not trigger notifications — for a command you run directly (e.g. `python train.py 2>&1 | grep --line-buffered ...`), merge stderr with `2>&1` so its failures reach your filter. (No effect on `tail -f` of an existing log — that file only contains what its writer redirected.)\n\n**Coverage — silence is not success.** When watching a job or process for an outcome, your filter must match every terminal state, not just the happy path. A monitor that greps only for the success marker stays silent through a crashloop, a hung process, or an unexpected exit — and silence looks identical to "still running." Before arming, ask: *if this process crashed right now, would my filter emit anything?* If not, widen it.\n  # Wrong — silent on crash, hang, or any non-success exit\n  tail -f run.log | grep --line-buffered "elapsed_steps="\n  # Right — one alternation covering progress + the failure signatures you\'d act on\n  tail -f run.log | grep -E --line-buffered "elapsed_steps=|Traceback|Error|FAILED|assert|Killed|OOM"\n\nFor poll loops checking job state, emit on every terminal status (`succeeded|failed|cancelled|timeout`), not just success. If you cannot confidently enumerate the failure signatures, broaden the grep alternation rather than narrow it — some extra noise is better than missing a crashloop.\n\n**Output volume**: Every stdout line is a conversation message, so the filter should be selective — but selective means "the lines you\'d act on," not "only good news." Never pipe raw logs; filter to exactly the success and failure signals you care about. Monitors that produce too many events are automatically stopped; restart with a tighter filter if this happens.\n\nStdout lines within 200ms are batched into a single notification, so multiline output from a single event groups naturally.\n\nThe script runs in the same shell environment as Bash. Exit ends the watch (exit code is reported). Timeout → killed. Set `persistent: true` for session-length watches (log tails, long-lived event streams). In managed Cloud sandboxes, every monitor stops after at most 1 hour, including persistent monitors; elsewhere persistent monitors run until TaskStop or session end. For longer Cloud waits, schedule a Wake or cron (which does not keep the sandbox running between turns) and combine it with shorter monitors. Use TaskStop to cancel early.\n\nWhen someone is waiting on the result, set `backup_after_seconds` (e.g. 900). If the monitor goes that long without an event, a durable Wake brings you back to check the real state, so a queued, hung, or dead watch can\'t leave them waiting in silence.\n\n**ws source** — open a WebSocket and stream each incoming text frame as an event. No shell, no polling: the server pushes, you get notified.\n    ws: {url: \'wss://events.example.com/stream\', protocols: [\'v1\']},\n    description: \'deploy events\',\n\nEach text frame becomes one notification (multiline frames stay as one event). Binary frames are reported as `[binary frame, N bytes]` rather than passed through. Socket close ends the watch with the close code surfaced; errors are surfaced before close. Same rate limiting as bash — a firehose will be suppressed and eventually stopped, so subscribe to a filtered feed where one exists.\n\nPrefer this over `command: \'websocat wss://…\'` — it avoids the extra process and line-buffering pitfalls. Use bash when you need to transform or filter frames with shell tools before they become events.\n\n**script source** — a JavaScript watch loop with the same globals as CodeMode, plus `emit(text)` (one event) and `sleep(ms)`. Returning or throwing ends the watch.\n';
 var init_Monitor = () => {};
 
 // src/tools/descriptions/Read.md
@@ -224201,6 +224201,34 @@ var init_external_tool_background_eligibility = __esm(() => {
   listenerRegistrations = new WeakMap;
 });
 
+// src/tools/tool-context-retention.ts
+function retainToolContext(contextId) {
+  holders.set(contextId, (holders.get(contextId) ?? 0) + 1);
+}
+function releaseRetainedToolContext(contextId) {
+  const count = (holders.get(contextId) ?? 0) - 1;
+  if (count > 0) {
+    holders.set(contextId, count);
+    return false;
+  }
+  holders.delete(contextId);
+  return deferredReleases.delete(contextId);
+}
+function isToolContextRetained(contextId) {
+  return holders.has(contextId);
+}
+function deferToolContextRelease(contextId) {
+  if (!holders.has(contextId))
+    return false;
+  deferredReleases.add(contextId);
+  return true;
+}
+var holders, deferredReleases;
+var init_tool_context_retention = __esm(() => {
+  holders = new Map;
+  deferredReleases = new Set;
+});
+
 // src/tools/external-tool-content.ts
 function normalizeExternalToolResultContent(content) {
   const normalized = content.flatMap((part) => {
@@ -231005,12 +231033,11 @@ function saveExecutionContext(snapshot) {
   const contexts = getExecutionContexts();
   const contextId = `ctx-${Date.now()}-${toolExecutionContextCounter++}`;
   contexts.set(contextId, snapshot);
-  const MAX_CONTEXTS = 4096;
-  if (contexts.size > MAX_CONTEXTS) {
-    const oldestContextId = contexts.keys().next().value;
-    if (oldestContextId) {
-      contexts.delete(oldestContextId);
-    }
+  for (const id2 of contexts.keys()) {
+    if (contexts.size <= 4096)
+      break;
+    if (!isToolContextRetained(id2))
+      contexts.delete(id2);
   }
   return contextId;
 }
@@ -231056,7 +231083,8 @@ function clearCapturedToolExecutionContexts() {
   getExecutionContexts().clear();
 }
 function releaseToolExecutionContext(contextId) {
-  getExecutionContexts().delete(contextId);
+  if (!deferToolContextRelease(contextId))
+    getExecutionContexts().delete(contextId);
 }
 function acquireSwitchLock() {
   const lock = getSwitchLock();
@@ -232208,6 +232236,7 @@ var init_manager2 = __esm(async () => {
   init_telemetry();
   init_external_tool_background();
   init_external_tool_background_eligibility();
+  init_tool_context_retention();
   init_checkout_readiness();
   init_debug();
   init_secrets_store();
@@ -234219,6 +234248,51 @@ var init_mcp = __esm(() => {
 
 // src/tools/script-tool-scope.ts
 import { randomUUID as randomUUID33 } from "node:crypto";
+async function loadServerTools(agentId, builtins) {
+  const tools = new Map;
+  if (!agentId || !getBackend().capabilities.serverSideToolManagement) {
+    return tools;
+  }
+  try {
+    const agent = await (await getClient()).agents.retrieve(agentId, {
+      include: ["agent.tools"]
+    });
+    const approvalRules = new Set((agent.tool_rules ?? []).filter((rule) => rule.type === "requires_approval").map((rule) => rule.tool_name));
+    for (const tool of agent.tools ?? []) {
+      const name = tool.name;
+      if (!name || tool.tool_type === "external_mcp")
+        continue;
+      if (builtins.has(name) || SCRIPT_EXCLUDED_TOOLS.has(name))
+        continue;
+      tools.set(name, {
+        name,
+        description: tool.description ?? "",
+        inputSchema: tool.json_schema?.parameters ?? {},
+        requiresApproval: tool.default_requires_approval === true || approvalRules.has(name)
+      });
+    }
+  } catch {}
+  return tools;
+}
+async function callServerTool(agentId, tool, args, signal) {
+  if (!agentId)
+    throw new Error(`${tool.name} requires an invoking agent.`);
+  if (tool.requiresApproval) {
+    throw new Error(`${tool.name} needs approval, which a script cannot request; call it directly.`);
+  }
+  const result2 = await (await getClient()).agents.tools.run(tool.name, { agent_id: agentId, args }, signal ? { signal } : {});
+  const value = result2.status === "success" ? result2.func_return : result2.stderr?.join(`
+`) ?? result2.func_return;
+  return {
+    content: [
+      {
+        type: "text",
+        text: typeof value === "string" ? value : JSON.stringify(value ?? null)
+      }
+    ],
+    isError: result2.status !== "success"
+  };
+}
 function isOwningAgentId(value) {
   return value?.startsWith("agent-") === true && !value.startsWith("agent-free:");
 }
@@ -234245,8 +234319,9 @@ async function createScriptToolScope(parentAgentId, signal) {
   const permissionCwd = getCurrentWorkingDirectory();
   const context3 = toolContextId ? manager.getExecutionContextById(toolContextId) : undefined;
   const builtinSchemas = (context3 ? serializeClientTools(context3.toolRegistry, context3.externalTools, context3.modTools, manager.getServerToolName) : []).filter((schema5) => !SCRIPT_EXCLUDED_TOOLS.has(schema5.name));
-  const builtinToolNames = builtinSchemas.map((schema5) => schema5.name);
-  const builtins = new Set(builtinToolNames);
+  const builtins = new Set(builtinSchemas.map((schema5) => schema5.name));
+  const serverTools = await loadServerTools(parentAgentId, builtins);
+  const builtinToolNames = [...builtins, ...serverTools.keys()];
   let mcpSession;
   const mcp = () => {
     if (!parentAgentId)
@@ -234264,6 +234339,7 @@ async function createScriptToolScope(parentAgentId, signal) {
           description: schema5.description,
           inputSchema: schema5.parameters
         })),
+        ...serverTools.values(),
         ...mcpTools.map((tool) => ({
           name: tool.name,
           description: tool.description ?? "",
@@ -234273,6 +234349,10 @@ async function createScriptToolScope(parentAgentId, signal) {
     },
     callTool: async (toolName2, toolArgs) => {
       signal?.throwIfAborted();
+      const serverTool = serverTools.get(toolName2);
+      if (serverTool) {
+        return callServerTool(parentAgentId, serverTool, toolArgs, signal);
+      }
       const toolCallId = `script-${randomUUID33()}`;
       const { decision } = await manager.checkToolPermission(toolName2, toolArgs, permissionCwd, permissionModeState && { ...permissionModeState }, parentAgentId ?? undefined, toolContextId, toolCallId);
       if (decision !== "allow") {
@@ -234303,12 +234383,14 @@ var SCRIPT_EXCLUDED_TOOLS;
 var init_script_tool_scope = __esm(() => {
   init_context();
   init_backend2();
+  init_client4();
   init_runtime_context();
   init_client_tool_serialization();
   SCRIPT_EXCLUDED_TOOLS = new Set([
     "AskUserQuestion",
     "Workflow",
-    "CodeMode"
+    "CodeMode",
+    "Monitor"
   ]);
 });
 
@@ -234670,13 +234752,10 @@ async function executeWorkflow(spawner, options) {
   return executeScript(spawner, options, meta2);
 }
 async function executeToolScript(options) {
-  const run = await executeScript(undefined, options, {
-    name: "code-mode",
-    description: "Combine tools with JavaScript"
-  });
+  const run = await executeScript(undefined, options, { name: "code-mode", description: "Combine tools with JavaScript" }, options.globals);
   return run.result;
 }
-async function executeScript(spawner, options, meta2) {
+async function executeScript(spawner, options, meta2, extraGlobals) {
   const signal = options.signal ?? new AbortController().signal;
   let settled = false;
   const emit = (event) => {
@@ -234952,7 +235031,8 @@ async function executeScript(spawner, options, meta2) {
     describeTool,
     ...spawner ? { agent, decide, parallel, pipeline: pipeline7, phase, log: log3 } : {},
     args: options.args,
-    console: { log: log3, warn: log3, error: log3, info: log3 }
+    console: { log: log3, warn: log3, error: log3, info: log3 },
+    ...extraGlobals
   });
   const wrapped = `(async () => { "use strict";
 ${spawner ? stripMetaExport(options.script) : options.script}
@@ -241570,6 +241650,223 @@ var init_monitor_event_stream = __esm(() => {
   MONITOR_EVENT_BUFFER_CHARS = 1024 * 1024;
 });
 
+// src/tools/impl/monitor-script.ts
+function rateLimitToolCalls(call2, signal) {
+  let tokens = TOOL_CALL_BURST;
+  let refilledAt = Date.now();
+  return (toolName2, toolArgs) => {
+    if (signal.aborted)
+      return new Promise(() => {});
+    const now2 = Date.now();
+    const refill = Math.floor((now2 - refilledAt) / TOOL_CALL_REFILL_MS);
+    if (refill > 0) {
+      tokens = Math.min(TOOL_CALL_BURST, tokens + refill);
+      refilledAt += refill * TOOL_CALL_REFILL_MS;
+    }
+    if (tokens === 0) {
+      throw new Error(`Monitor script exceeded ${1000 / TOOL_CALL_REFILL_MS} tool calls per second; add sleep() between polls.`);
+    }
+    tokens -= 1;
+    return call2(toolName2, toolArgs);
+  };
+}
+function abortableSleep3(ms, signal) {
+  const delay3 = Number(ms);
+  if (!Number.isFinite(delay3) || delay3 < 0) {
+    return Promise.reject(new Error("sleep(ms) needs a non-negative number."));
+  }
+  return new Promise((resolve34) => {
+    if (signal.aborted)
+      return;
+    const onAbort = () => clearTimeout(timer);
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve34();
+    }, delay3);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function formatReturnValue(value) {
+  if (value === undefined)
+    return "The script returned without a value.";
+  let text2;
+  try {
+    text2 = typeof value === "string" ? value : JSON.stringify(value);
+  } catch (error5) {
+    return `The script returned a value that is not JSON-serializable: ${String(error5)}`;
+  }
+  return text2.length <= MAX_RESULT_CHARS ? text2 : `${text2.slice(0, MAX_RESULT_CHARS)}
+[truncated; see the output file]`;
+}
+async function releaseToolContext(contextId) {
+  if (!contextId || !releaseRetainedToolContext(contextId))
+    return;
+  const manager = await init_manager2().then(() => exports_manager);
+  manager.releaseToolExecutionContext(contextId);
+}
+async function startScriptMonitor(args, hooks) {
+  assertBackgroundProcessCapacity();
+  const toolContextId = getRuntimeContext()?.toolContextId ?? null;
+  if (toolContextId)
+    retainToolContext(toolContextId);
+  const controller = new AbortController;
+  const parentAgentId = await resolveScriptParentAgentId(args).catch(async (error5) => {
+    await releaseToolContext(toolContextId);
+    throw error5;
+  });
+  const toolScope = await createScriptToolScope(parentAgentId, controller.signal).catch(async (error5) => {
+    await releaseToolContext(toolContextId);
+    throw error5;
+  });
+  const taskId = getNextMonitorId();
+  const outputFile = createBackgroundOutputFile(taskId);
+  const output = hooks.createOutput(outputFile);
+  const scope = resolveNotificationScope(args.parentScope);
+  const actingUserId = getRuntimeActingUserAttribution();
+  const secrets2 = captureSecretRedactions(parentAgentId ?? undefined);
+  const scrub = (text2) => scrubSecretsFromString(text2, secrets2);
+  let timeout;
+  const stop = (reason, note) => {
+    if (processState.status !== "running")
+      return;
+    processState.completionNotificationSuppressed = true;
+    if (note)
+      output.append(note);
+    hooks.markFinished(taskId, processState, "failed", null);
+    controller.abort(new Error(reason));
+  };
+  const events = createMonitorEventStream({
+    emit(event) {
+      hooks.queueEvent({ taskId, event, scope, actingUserId, secrets: secrets2 });
+    },
+    stopSource() {
+      stop("output rate too high", `
+[stopped: output rate too high]
+`);
+    }
+  });
+  const firstLine = args.script.trim().split(`
+`)[0] ?? "";
+  const processState = {
+    process: {
+      kill() {
+        events.cancel();
+        controller.abort(new Error("Monitor stopped via TaskStop"));
+      }
+    },
+    command: `script: ${firstLine.slice(0, 80)}`,
+    status: "running",
+    exitCode: null,
+    startTime: new Date,
+    outputFile,
+    runtimeScope: scope,
+    actingUserId,
+    kind: "monitor",
+    description: args.description,
+    monitorSource: "script",
+    persistent: args.persistent,
+    secrets: secrets2
+  };
+  backgroundProcesses.set(taskId, processState);
+  notifyBackgroundProcessStateChanged(scope);
+  const emit = (value) => {
+    if (processState.status !== "running")
+      return;
+    const text2 = scrub(typeof value === "string" ? value : String(value));
+    if (!text2.trim())
+      return;
+    const line = text2.endsWith(`
+`) ? text2 : `${text2}
+`;
+    if (!output.append(line)) {
+      stop("output file write failed");
+      return;
+    }
+    events.onData(line);
+  };
+  const finish = (status, detail) => {
+    events.finish();
+    output.append(`
+[${status === "completed" ? "result" : "error"}] ${detail}
+`);
+    if (processState.status !== "running")
+      return;
+    hooks.markFinished(taskId, processState, status, status === "completed" ? 0 : 1);
+    const durationMs = Date.now() - (processState.startTime?.getTime() ?? 0);
+    addToMessageQueue({
+      kind: "task_notification",
+      text: formatTaskNotification({
+        taskId,
+        status,
+        summary: status === "completed" ? `Monitor "${args.description}" script returned` : `Monitor "${args.description}" script failed`,
+        result: detail,
+        outputFile,
+        usage: { durationMs }
+      }),
+      ...scope,
+      ...actingUserId !== undefined ? { actingUserId } : {}
+    });
+  };
+  const stopped = new Promise((_resolve, reject2) => {
+    controller.signal.addEventListener("abort", () => reject2(controller.signal.reason), { once: true });
+  });
+  const run = executeToolScript({
+    ...toolScope,
+    callTool: rateLimitToolCalls(toolScope.callTool, controller.signal),
+    maxTotalToolCalls: Number.POSITIVE_INFINITY,
+    script: args.script,
+    args: args.args,
+    signal: new AbortController().signal,
+    globals: {
+      emit,
+      sleep: (ms) => abortableSleep3(ms, controller.signal)
+    },
+    onProgress: (event) => {
+      if (event.kind === "log")
+        output.append(`${scrub(event.message)}
+`);
+    }
+  });
+  run.catch(() => {});
+  Promise.race([run, stopped]).then((value) => finish("completed", scrub(formatReturnValue(value))), (error5) => finish("failed", scrub(error5 instanceof Error ? error5.message : String(error5)))).finally(async () => {
+    if (timeout)
+      clearTimeout(timeout);
+    await toolScope.cleanup();
+    await releaseToolContext(toolContextId);
+  });
+  if (!args.persistent) {
+    timeout = setTimeout(() => {
+      if (processState.status !== "running")
+        return;
+      events.finish();
+      hooks.queueEvent({
+        taskId,
+        event: hooks.timeoutEvent(args.timeout_ms),
+        scope,
+        actingUserId,
+        secrets: secrets2
+      });
+      stop("timeout", `
+[timeout after ${args.timeout_ms}ms]
+`);
+    }, args.timeout_ms);
+    unrefTimer(timeout);
+  }
+  return { taskId, outputFile };
+}
+var TOOL_CALL_BURST = 120, TOOL_CALL_REFILL_MS = 500, MAX_RESULT_CHARS = 30000;
+var init_monitor_script = __esm(() => {
+  init_runtime_context();
+  init_script_tool_scope();
+  init_secret_substitution();
+  init_tool_context_retention();
+  init_workflow_engine();
+  init_message_queue_bridge();
+  init_task_notifications();
+  init_monitor_event_stream();
+  init_process_manager();
+});
+
 // src/tools/impl/monitor.ts
 import { appendFileSync as appendFileSync7, readFileSync as readFileSync37, writeFileSync as writeFileSync28 } from "node:fs";
 import { WebSocket as WebSocket4 } from "ws";
@@ -241698,10 +241995,18 @@ function normalizeMonitorArgs(args) {
   if (normalized.command !== undefined && typeof normalized.command !== "string") {
     throw new Error("Monitor command must be a string");
   }
+  if (normalized.script !== undefined && typeof normalized.script !== "string") {
+    throw new Error("Monitor script must be a string");
+  }
+  const hasScript = typeof normalized.script === "string" && normalized.script.trim() !== "";
   const hasCommand = typeof normalized.command === "string" && normalized.command.length > 0;
   const hasWebSocket = normalized.ws !== undefined && !(typeof normalized.ws === "object" && normalized.ws !== null && normalized.ws.url === "");
-  if (Number(hasCommand) + Number(hasWebSocket) !== 1) {
-    throw new Error("Monitor requires exactly one of command or ws");
+  if (Number(hasCommand) + Number(hasWebSocket) + Number(hasScript) !== 1) {
+    throw new Error("Monitor requires exactly one of command, ws, or script");
+  }
+  if (!hasScript) {
+    delete normalized.script;
+    delete normalized.args;
   }
   if (!hasCommand) {
     delete normalized.command;
@@ -242152,6 +242457,22 @@ function startWebSocketMonitor(args) {
   }
   return buildMonitorResult(taskId, args.persistent ? 0 : args.timeout_ms, args.persistent, outputFile);
 }
+async function startScriptSource(args) {
+  const { taskId, outputFile } = await startScriptMonitor({
+    description: args.description,
+    script: args.script,
+    args: args.args,
+    timeout_ms: args.timeout_ms,
+    persistent: args.persistent,
+    parentScope: args.parentScope
+  }, {
+    createOutput: (path27) => new MonitorOutputWriter(path27),
+    queueEvent: queueMonitorEvent,
+    markFinished: markMonitorFinished,
+    timeoutEvent: getMonitorTimeoutEvent
+  });
+  return buildMonitorResult(taskId, args.persistent ? 0 : args.timeout_ms, args.persistent, outputFile);
+}
 function backupScopeFor(taskId) {
   const processState = backgroundProcesses.get(taskId);
   const runtimeScope = processState?.runtimeScope;
@@ -242163,7 +242484,7 @@ async function monitor(args) {
   args.signal?.throwIfAborted();
   const normalized = normalizeMonitorArgs(args);
   installMonitorProcessExitCleanup();
-  const result3 = normalized.command !== undefined ? startCommandMonitor(normalized) : startWebSocketMonitor(normalized);
+  const result3 = normalized.script !== undefined ? await startScriptSource(normalized) : normalized.command !== undefined ? startCommandMonitor(normalized) : startWebSocketMonitor(normalized);
   if (normalized.backup_after_seconds === undefined)
     return result3;
   const note = await armMonitorBackup({
@@ -242207,6 +242528,7 @@ var init_monitor = __esm(async () => {
   init_message_queue_bridge();
   init_task_notifications();
   init_monitor_event_stream();
+  init_monitor_script();
   init_process_manager();
   init_shell_env();
   init_shell_launchers();
@@ -244042,7 +244364,7 @@ class CodexAppServerClient {
     await this.request("initialize", {
       clientInfo: {
         name: "letta-code",
-        version: "0.34.27"
+        version: "0.34.28"
       },
       capabilities: null
     });
@@ -254891,7 +255213,14 @@ var init_Monitor2 = __esm(() => {
         },
         required: ["url"],
         additionalProperties: false,
-        description: "WebSocket to open. Each text frame is an event; binary frames are reported as a placeholder line. Socket close ends the watch. Cannot be combined with command."
+        description: "WebSocket to open. Each text frame is an event; binary frames are reported as a placeholder line. Socket close ends the watch. Cannot be combined with command or script."
+      },
+      script: {
+        type: "string",
+        description: "JavaScript watch loop with CodeMode's globals plus emit(text) and sleep(ms). Cannot be combined with command or ws."
+      },
+      args: {
+        description: "Optional input exposed to script as args."
       }
     },
     required: ["description"],
@@ -443833,6 +444162,19 @@ function getInterruptApprovalsForEmission(runtime, params) {
   }
   return runtime.pendingInterruptedResults;
 }
+function emitInterruptApprovals(socket, runtime, params) {
+  const approvals = getInterruptApprovalsForEmission(runtime, params);
+  if (!approvals)
+    return;
+  const { runId, agentId, conversationId } = params;
+  emitToolExecutionFinishedEvents(socket, runtime, {
+    approvals,
+    runId,
+    agentId,
+    conversationId
+  });
+  emitInterruptToolReturnMessage(socket, runtime, approvals, runId || undefined);
+}
 function populateInterruptQueue(runtime, input) {
   const shouldPopulate = !runtime.pendingInterruptedResults || runtime.pendingInterruptedResults.length === 0 || !runtime.pendingInterruptedContext;
   if (!shouldPopulate)
@@ -449194,7 +449536,8 @@ async function resolveStaleApprovals(runtime, socket, turnLease, deps = {}) {
   runtime.currentToolset = preparedToolContext.toolset;
   runtime.currentToolsetPreference = preparedToolContext.toolsetPreference;
   runtime.currentLoadedTools = preparedToolContext.preparedToolContext.loadedToolNames;
-  const recoveryActingUserId = readInterruptedTurn(runtime)?.actingUserId;
+  const recoveryRecord = (deps.readInterruptedTurn ?? readInterruptedTurn)(runtime);
+  const recoveryActingUserId = recoveryRecord?.actingUserId;
   pendingApprovals = await filterStillPending(pendingApprovals);
   while (pendingApprovals.length > 0) {
     assertCurrentTurnLease();
@@ -449203,10 +449546,16 @@ async function resolveStaleApprovals(runtime, socket, turnLease, deps = {}) {
       throw new Error("Ambiguous pending approval batch mapping during recovery");
     }
     rememberPendingApprovalBatchIds(runtime, pendingApprovals, recoveryBatchId);
-    const approvalResults = buildFreshDenialApprovals(pendingApprovals, STALE_APPROVAL_RECOVERY_DENIAL_REASON);
+    const pendingToolCallIds = pendingApprovals.map((approval) => approval.toolCallId);
+    const approvalResults = recoveryRecord ? recordedToolResults(recoveryRecord, pendingToolCallIds) : buildFreshDenialApprovals(pendingApprovals, STALE_APPROVAL_RECOVERY_DENIAL_REASON);
     if (approvalResults.length === 0) {
       return null;
     }
+    if (recoveryRecord && allRecordedResults(recoveryRecord).some((result3) => pendingToolCallIds.includes(result3.tool_call_id))) {
+      runtime.pendingInterruptedResults = null;
+      runtime.pendingInterruptedContext = null;
+      runtime.pendingInterruptedToolCallIds = null;
+    }
     try {
       const continuationInput = createTurnInputState([
         {
@@ -449591,6 +449940,7 @@ var init_send = __esm(async () => {
   init_constants3();
   init_cwd();
   init_permission_mode();
+  init_recorded_tool_results();
   init_turn_input_state();
   await __promiseAll([
     init_message(),
@@ -452448,6 +452798,7 @@ async function handleApprovalStop(params) {
     if (shouldInterrupt()) {
       return interruptTermination(nextTurnInput, continuationBatchId);
     }
+    params.onContinuationSendError?.(interruptTermination());
     throw error5;
   }
   if (sendResult.kind === "terminal") {
@@ -459384,7 +459735,7 @@ async function handleIncomingMessageInner(msg, socket, runtime, onStatusChange,
   const conversationId = requestedConversationId ?? "default";
   const turnWorkingDirectory = getConversationWorkingDirectory(runtime.listener, agentId, conversationId);
   const turnPermissionModeState = getOrCreateConversationPermissionModeStateRef(runtime.listener, agentId, conversationId);
-  let postStopApprovalRecoveryRetries = 0, deploymentRecoveryAttempts = 0, llmApiErrorRetries = 0, emptyResponseRetries = 0, chatgptPlanSwaps = 0, lastApprovalContinuationAccepted = false, activeDequeuedBatchId = dequeuedBatchId;
+  let postStopApprovalRecoveryRetries = 0, deploymentRecoveryAttempts = 0, llmApiErrorRetries = 0, emptyResponseRetries = 0, chatgptPlanSwaps = 0, lastApprovalContinuationAccepted = false, continuationSendFailed = false, activeDequeuedBatchId = dequeuedBatchId;
   const chatgptExhaustedProviders = new Set;
   const turnCorrelation = existingTurnCorrelation ?? createTurnCorrelation(runtime, msg, activeDequeuedBatchId);
   const msgRunIds = [];
@@ -459392,6 +459743,13 @@ async function handleIncomingMessageInner(msg, socket, runtime, onStatusChange,
   let lastExecutingToolCallIds = [];
   let lastNeedsUserInputToolCallIds = [];
   const durabilityOwnership = createTurnDurabilityOwnership();
+  const recordApprovalProgress = (progress) => {
+    ({
+      lastExecutionResults,
+      lastExecutingToolCallIds,
+      lastNeedsUserInputToolCallIds
+    } = durabilityOwnership.record(progress));
+  };
   const interruptedRevisionRef = { current: initialInterruptedRevision };
   durabilityOwnership.recordInput(msg);
   const turnLease = existingTurnLease ?? runtime.turnLifecycle.begin({
@@ -459891,6 +460249,10 @@ async function handleIncomingMessageInner(msg, socket, runtime, onStatusChange,
         recoveryLineageId,
         recoveryAuthorityStore,
         buildSendOptions,
+        onContinuationSendError: (progress) => {
+          continuationSendFailed = true;
+          recordApprovalProgress(progress);
+        },
         dependencies: recoveryEvidenceWriter ? { recordListenerWork: recoveryEvidenceWriter } : undefined
       });
       if (approvalResult.kind === "error") {
@@ -459911,11 +460273,7 @@ async function handleIncomingMessageInner(msg, socket, runtime, onStatusChange,
       activeDequeuedBatchId = approvalResult.dequeuedBatchId;
       pendingNormalizationInterruptedToolCallIds = approvalResult.pendingNormalizationInterruptedToolCallIds;
       turnToolContextId = approvalResult.turnToolContextId;
-      ({
-        lastExecutionResults,
-        lastExecutingToolCallIds,
-        lastNeedsUserInputToolCallIds
-      } = durabilityOwnership.record(approvalResult));
+      recordApprovalProgress(approvalResult);
       lastApprovalContinuationAccepted = approvalResult.lastApprovalContinuationAccepted;
       if (approvalResult.kind === "teleport") {
         const pending2 = approvalResult.pendingTeleport;
@@ -459963,29 +460321,24 @@ async function handleIncomingMessageInner(msg, socket, runtime, onStatusChange,
       context: "listener_turn_processing",
       runId: runtime.activeRunId || msgRunIds[msgRunIds.length - 1]
     });
+    const canParkUnsentResults = runtime.turnLifecycle.isCurrent(turnLease) && !lastApprovalContinuationAccepted;
+    if (canParkUnsentResults && (turnAbortSignal.aborted || continuationSendFailed)) {
+      populateInterruptQueue(runtime, {
+        lastExecutionResults,
+        lastExecutingToolCallIds,
+        lastNeedsUserInputToolCallIds,
+        agentId,
+        conversationId
+      });
+    }
     if (turnAbortSignal.aborted) {
-      if (runtime.turnLifecycle.isCurrent(turnLease) && !lastApprovalContinuationAccepted) {
-        populateInterruptQueue(runtime, {
+      if (canParkUnsentResults) {
+        emitInterruptApprovals(socket, runtime, {
           lastExecutionResults,
-          lastExecutingToolCallIds,
-          lastNeedsUserInputToolCallIds,
+          runId: runtime.activeRunId || msgRunIds[msgRunIds.length - 1],
           agentId,
           conversationId
         });
-        const approvalsForEmission = getInterruptApprovalsForEmission(runtime, {
-          lastExecutionResults,
-          agentId,
-          conversationId
-        });
-        if (approvalsForEmission) {
-          emitToolExecutionFinishedEvents(socket, runtime, {
-            approvals: approvalsForEmission,
-            runId: runtime.activeRunId || msgRunIds[msgRunIds.length - 1],
-            agentId,
-            conversationId
-          });
-          emitInterruptToolReturnMessage(socket, runtime, approvalsForEmission, runtime.activeRunId || msgRunIds[msgRunIds.length - 1] || undefined);
-        }
       }
       finishTurn({
         stopReason: "cancelled",
@@ -538684,4 +539037,4 @@ function registerBunOAuthFlows() {
 registerBunOAuthFlows();
 await init_src5().then(() => exports_src2);
 
-//# debugId=B77AE6C44CFEB3F664756E2164756E21
+//# debugId=5934D32E04CC3ADA64756E2164756E21