letta-nightly 0.11.7.dev20250916104104__py3-none-any.whl → 0.11.7.dev20250918104055__py3-none-any.whl

letta/services/job_manager.py

@@ -18,6 +18,7 @@ from letta.otel.tracing import log_event, trace_method
 from letta.schemas.enums import JobStatus, JobType, MessageRole
 from letta.schemas.job import BatchJob as PydanticBatchJob, Job as PydanticJob, JobUpdate, LettaRequestConfig
 from letta.schemas.letta_message import LettaMessage
+from letta.schemas.letta_stop_reason import StopReasonType
 from letta.schemas.message import Message as PydanticMessage
 from letta.schemas.run import Run as PydanticRun
 from letta.schemas.step import Step as PydanticStep
@@ -207,7 +208,12 @@ class JobManager:
     @enforce_types
     @trace_method
     async def safe_update_job_status_async(
-        self, job_id: str, new_status: JobStatus, actor: PydanticUser, metadata: Optional[dict] = None
+        self,
+        job_id: str,
+        new_status: JobStatus,
+        actor: PydanticUser,
+        stop_reason: Optional[StopReasonType] = None,
+        metadata: Optional[dict] = None,
     ) -> bool:
         """
         Safely update job status with state transition guards.
@@ -217,7 +223,7 @@ class JobManager:
             True if update was successful, False if update was skipped due to invalid transition
         """
         try:
-            job_update_builder = partial(JobUpdate, status=new_status)
+            job_update_builder = partial(JobUpdate, status=new_status, stop_reason=stop_reason)
 
             # If metadata is provided, merge it with existing metadata
             if metadata:
@@ -268,6 +274,7 @@ class JobManager:
         statuses: Optional[List[JobStatus]] = None,
         job_type: JobType = JobType.JOB,
         ascending: bool = True,
+        stop_reason: Optional[StopReasonType] = None,
     ) -> List[PydanticJob]:
         """List all jobs with optional pagination and status filter."""
         with db_registry.session() as session:
@@ -277,6 +284,10 @@ class JobManager:
             if statuses:
                 filter_kwargs["status"] = statuses
 
+            # Add stop_reason filter if provided
+            if stop_reason is not None:
+                filter_kwargs["stop_reason"] = stop_reason
+
             jobs = JobModel.list(
                 db_session=session,
                 before=before,
@@ -299,6 +310,7 @@ class JobManager:
         job_type: JobType = JobType.JOB,
         ascending: bool = True,
         source_id: Optional[str] = None,
+        stop_reason: Optional[StopReasonType] = None,
     ) -> List[PydanticJob]:
         """List all jobs with optional pagination and status filter."""
         from sqlalchemy import and_, or_, select
@@ -317,6 +329,10 @@ class JobManager:
                 column = column.op("->>")("source_id")
                 query = query.where(column == source_id)
 
+            # add stop_reason filter if provided
+            if stop_reason is not None:
+                query = query.where(JobModel.stop_reason == stop_reason)
+
             # handle cursor-based pagination
             if before or after:
                 # get cursor objects

letta/services/mcp_manager.py

@@ -35,6 +35,7 @@ from letta.schemas.mcp import (
     UpdateStdioMCPServer,
     UpdateStreamableHTTPMCPServer,
 )
+from letta.schemas.secret import Secret, SecretDict
 from letta.schemas.tool import Tool as PydanticTool, ToolCreate, ToolUpdate
 from letta.schemas.user import User as PydanticUser
 from letta.server.db import db_registry
@@ -354,6 +355,69 @@ class MCPManager:
                 logger.error(f"Failed to create MCP server: {e}")
                 raise
 
+    @enforce_types
+    async def create_mcp_server_from_config(
+        self, server_config: Union[StdioServerConfig, SSEServerConfig, StreamableHTTPServerConfig], actor: PydanticUser
+    ) -> MCPServer:
+        """
+        Create an MCP server from a config object, handling encryption of sensitive fields.
+
+        This method converts the server config to an MCPServer model and encrypts
+        sensitive fields like tokens and custom headers.
+        """
+        # Create base MCPServer object
+        if isinstance(server_config, StdioServerConfig):
+            mcp_server = MCPServer(server_name=server_config.server_name, server_type=server_config.type, stdio_config=server_config)
+        elif isinstance(server_config, SSEServerConfig):
+            mcp_server = MCPServer(
+                server_name=server_config.server_name,
+                server_type=server_config.type,
+                server_url=server_config.server_url,
+            )
+            # Encrypt sensitive fields
+            token = server_config.resolve_token()
+            if token:
+                token_secret = Secret.from_plaintext(token)
+                mcp_server.set_token_secret(token_secret)
+            if server_config.custom_headers:
+                headers_secret = SecretDict.from_plaintext(server_config.custom_headers)
+                mcp_server.set_custom_headers_secret(headers_secret)
+
+        elif isinstance(server_config, StreamableHTTPServerConfig):
+            mcp_server = MCPServer(
+                server_name=server_config.server_name,
+                server_type=server_config.type,
+                server_url=server_config.server_url,
+            )
+            # Encrypt sensitive fields
+            token = server_config.resolve_token()
+            if token:
+                token_secret = Secret.from_plaintext(token)
+                mcp_server.set_token_secret(token_secret)
+            if server_config.custom_headers:
+                headers_secret = SecretDict.from_plaintext(server_config.custom_headers)
+                mcp_server.set_custom_headers_secret(headers_secret)
+        else:
+            raise ValueError(f"Unsupported server config type: {type(server_config)}")
+
+        return mcp_server
+
+    @enforce_types
+    async def create_mcp_server_from_config_with_tools(
+        self, server_config: Union[StdioServerConfig, SSEServerConfig, StreamableHTTPServerConfig], actor: PydanticUser
+    ) -> MCPServer:
+        """
+        Create an MCP server from a config object and optimistically sync its tools.
+
+        This method handles encryption of sensitive fields and then creates the server
+        with automatic tool synchronization.
+        """
+        # Convert config to MCPServer with encryption
+        mcp_server = await self.create_mcp_server_from_config(server_config, actor)
+
+        # Create the server with tools
+        return await self.create_mcp_server_with_tools(mcp_server, actor)
+
     @enforce_types
     async def create_mcp_server_with_tools(self, pydantic_mcp_server: MCPServer, actor: PydanticUser) -> MCPServer:
         """
@@ -420,10 +484,33 @@ class MCPManager:
             # Update tool attributes with only the fields that were explicitly set
             update_data = mcp_server_update.model_dump(to_orm=True, exclude_unset=True)
 
-            # Ensure custom_headers None is stored as SQL NULL, not JSON null
-            if update_data.get("custom_headers") is None:
-                update_data.pop("custom_headers", None)
-                setattr(mcp_server, "custom_headers", null())
+            # Handle encryption for token if provided
+            if "token" in update_data and update_data["token"] is not None:
+                token_secret = Secret.from_plaintext(update_data["token"])
+                secret_dict = token_secret.to_dict()
+                update_data["token_enc"] = secret_dict["encrypted"]
+                # During migration phase, also update plaintext
+                if not token_secret._was_encrypted:
+                    update_data["token"] = secret_dict["plaintext"]
+                else:
+                    update_data["token"] = None
+
+            # Handle encryption for custom_headers if provided
+            if "custom_headers" in update_data:
+                if update_data["custom_headers"] is not None:
+                    headers_secret = SecretDict.from_plaintext(update_data["custom_headers"])
+                    secret_dict = headers_secret.to_dict()
+                    update_data["custom_headers_enc"] = secret_dict["encrypted"]
+                    # During migration phase, also update plaintext
+                    if not headers_secret._was_encrypted:
+                        update_data["custom_headers"] = secret_dict["plaintext"]
+                    else:
+                        update_data["custom_headers"] = None
+                else:
+                    # Ensure custom_headers None is stored as SQL NULL, not JSON null
+                    update_data.pop("custom_headers", None)
+                    setattr(mcp_server, "custom_headers", null())
+                    setattr(mcp_server, "custom_headers_enc", None)
 
             for key, value in update_data.items():
                 setattr(mcp_server, key, value)
@@ -664,6 +751,64 @@ class MCPManager:
             raise ValueError(f"Unsupported server config type: {type(server_config)}")
 
     # OAuth-related methods
+    def _oauth_orm_to_pydantic(self, oauth_session: MCPOAuth) -> MCPOAuthSession:
+        """
+        Convert OAuth ORM model to Pydantic model, handling decryption of sensitive fields.
+        """
+        from letta.settings import settings
+
+        # Get decrypted values using the dual-read approach
+        # Secret.from_db() will automatically use settings.encryption_key if available
+        access_token = None
+        if oauth_session.access_token_enc or oauth_session.access_token:
+            if settings.encryption_key:
+                secret = Secret.from_db(oauth_session.access_token_enc, oauth_session.access_token)
+                access_token = secret.get_plaintext()
+            else:
+                # No encryption key, use plaintext if available
+                access_token = oauth_session.access_token
+
+        refresh_token = None
+        if oauth_session.refresh_token_enc or oauth_session.refresh_token:
+            if settings.encryption_key:
+                secret = Secret.from_db(oauth_session.refresh_token_enc, oauth_session.refresh_token)
+                refresh_token = secret.get_plaintext()
+            else:
+                # No encryption key, use plaintext if available
+                refresh_token = oauth_session.refresh_token
+
+        client_secret = None
+        if oauth_session.client_secret_enc or oauth_session.client_secret:
+            if settings.encryption_key:
+                secret = Secret.from_db(oauth_session.client_secret_enc, oauth_session.client_secret)
+                client_secret = secret.get_plaintext()
+            else:
+                # No encryption key, use plaintext if available
+                client_secret = oauth_session.client_secret
+
+        return MCPOAuthSession(
+            id=oauth_session.id,
+            state=oauth_session.state,
+            server_id=oauth_session.server_id,
+            server_url=oauth_session.server_url,
+            server_name=oauth_session.server_name,
+            user_id=oauth_session.user_id,
+            organization_id=oauth_session.organization_id,
+            authorization_url=oauth_session.authorization_url,
+            authorization_code=oauth_session.authorization_code,
+            access_token=access_token,
+            refresh_token=refresh_token,
+            token_type=oauth_session.token_type,
+            expires_at=oauth_session.expires_at,
+            scope=oauth_session.scope,
+            client_id=oauth_session.client_id,
+            client_secret=client_secret,
+            redirect_uri=oauth_session.redirect_uri,
+            status=oauth_session.status,
+            created_at=oauth_session.created_at,
+            updated_at=oauth_session.updated_at,
+        )
+
     @enforce_types
     async def create_oauth_session(self, session_create: MCPOAuthSessionCreate, actor: PydanticUser) -> MCPOAuthSession:
         """Create a new OAuth session for MCP server authentication."""
@@ -682,18 +827,8 @@ class MCPManager:
             )
             oauth_session = await oauth_session.create_async(session, actor=actor)
 
-            # Convert to Pydantic model
-            return MCPOAuthSession(
-                id=oauth_session.id,
-                state=oauth_session.state,
-                server_url=oauth_session.server_url,
-                server_name=oauth_session.server_name,
-                user_id=oauth_session.user_id,
-                organization_id=oauth_session.organization_id,
-                status=oauth_session.status,
-                created_at=oauth_session.created_at,
-                updated_at=oauth_session.updated_at,
-            )
+            # Convert to Pydantic model - note: new sessions won't have tokens yet
+            return self._oauth_orm_to_pydantic(oauth_session)
 
     @enforce_types
     async def get_oauth_session_by_id(self, session_id: str, actor: PydanticUser) -> Optional[MCPOAuthSession]:
@@ -701,27 +836,7 @@ class MCPManager:
         async with db_registry.async_session() as session:
             try:
                 oauth_session = await MCPOAuth.read_async(db_session=session, identifier=session_id, actor=actor)
-                return MCPOAuthSession(
-                    id=oauth_session.id,
-                    state=oauth_session.state,
-                    server_url=oauth_session.server_url,
-                    server_name=oauth_session.server_name,
-                    user_id=oauth_session.user_id,
-                    organization_id=oauth_session.organization_id,
-                    authorization_url=oauth_session.authorization_url,
-                    authorization_code=oauth_session.authorization_code,
-                    access_token=oauth_session.access_token,
-                    refresh_token=oauth_session.refresh_token,
-                    token_type=oauth_session.token_type,
-                    expires_at=oauth_session.expires_at,
-                    scope=oauth_session.scope,
-                    client_id=oauth_session.client_id,
-                    client_secret=oauth_session.client_secret,
-                    redirect_uri=oauth_session.redirect_uri,
-                    status=oauth_session.status,
-                    created_at=oauth_session.created_at,
-                    updated_at=oauth_session.updated_at,
-                )
+                return self._oauth_orm_to_pydantic(oauth_session)
             except NoResultFound:
                 return None
 
@@ -747,27 +862,7 @@ class MCPManager:
             if not oauth_session:
                 return None
 
-            return MCPOAuthSession(
-                id=oauth_session.id,
-                state=oauth_session.state,
-                server_url=oauth_session.server_url,
-                server_name=oauth_session.server_name,
-                user_id=oauth_session.user_id,
-                organization_id=oauth_session.organization_id,
-                authorization_url=oauth_session.authorization_url,
-                authorization_code=oauth_session.authorization_code,
-                access_token=oauth_session.access_token,
-                refresh_token=oauth_session.refresh_token,
-                token_type=oauth_session.token_type,
-                expires_at=oauth_session.expires_at,
-                scope=oauth_session.scope,
-                client_id=oauth_session.client_id,
-                client_secret=oauth_session.client_secret,
-                redirect_uri=oauth_session.redirect_uri,
-                status=oauth_session.status,
-                created_at=oauth_session.created_at,
-                updated_at=oauth_session.updated_at,
-            )
+            return self._oauth_orm_to_pydantic(oauth_session)
 
     @enforce_types
     async def update_oauth_session(self, session_id: str, session_update: MCPOAuthSessionUpdate, actor: PydanticUser) -> MCPOAuthSession:
@@ -780,10 +875,37 @@ class MCPManager:
                 oauth_session.authorization_url = session_update.authorization_url
             if session_update.authorization_code is not None:
                 oauth_session.authorization_code = session_update.authorization_code
+
+            # Handle encryption for access_token
             if session_update.access_token is not None:
-                oauth_session.access_token = session_update.access_token
+                from letta.settings import settings
+
+                if settings.encryption_key:
+                    token_secret = Secret.from_plaintext(session_update.access_token)
+                    secret_dict = token_secret.to_dict()
+                    oauth_session.access_token_enc = secret_dict["encrypted"]
+                    # During migration phase, also update plaintext
+                    oauth_session.access_token = secret_dict["plaintext"] if not token_secret._was_encrypted else None
+                else:
+                    # No encryption, store plaintext
+                    oauth_session.access_token = session_update.access_token
+                    oauth_session.access_token_enc = None
+
+            # Handle encryption for refresh_token
             if session_update.refresh_token is not None:
-                oauth_session.refresh_token = session_update.refresh_token
+                from letta.settings import settings
+
+                if settings.encryption_key:
+                    token_secret = Secret.from_plaintext(session_update.refresh_token)
+                    secret_dict = token_secret.to_dict()
+                    oauth_session.refresh_token_enc = secret_dict["encrypted"]
+                    # During migration phase, also update plaintext
+                    oauth_session.refresh_token = secret_dict["plaintext"] if not token_secret._was_encrypted else None
+                else:
+                    # No encryption, store plaintext
+                    oauth_session.refresh_token = session_update.refresh_token
+                    oauth_session.refresh_token_enc = None
+
             if session_update.token_type is not None:
                 oauth_session.token_type = session_update.token_type
             if session_update.expires_at is not None:
@@ -792,8 +914,22 @@ class MCPManager:
                 oauth_session.scope = session_update.scope
             if session_update.client_id is not None:
                 oauth_session.client_id = session_update.client_id
+
+            # Handle encryption for client_secret
             if session_update.client_secret is not None:
-                oauth_session.client_secret = session_update.client_secret
+                from letta.settings import settings
+
+                if settings.encryption_key:
+                    secret_secret = Secret.from_plaintext(session_update.client_secret)
+                    secret_dict = secret_secret.to_dict()
+                    oauth_session.client_secret_enc = secret_dict["encrypted"]
+                    # During migration phase, also update plaintext
+                    oauth_session.client_secret = secret_dict["plaintext"] if not secret_secret._was_encrypted else None
+                else:
+                    # No encryption, store plaintext
+                    oauth_session.client_secret = session_update.client_secret
+                    oauth_session.client_secret_enc = None
+
             if session_update.redirect_uri is not None:
                 oauth_session.redirect_uri = session_update.redirect_uri
             if session_update.status is not None:
@@ -804,27 +940,7 @@ class MCPManager:
 
             oauth_session = await oauth_session.update_async(db_session=session, actor=actor)
 
-            return MCPOAuthSession(
-                id=oauth_session.id,
-                state=oauth_session.state,
-                server_url=oauth_session.server_url,
-                server_name=oauth_session.server_name,
-                user_id=oauth_session.user_id,
-                organization_id=oauth_session.organization_id,
-                authorization_url=oauth_session.authorization_url,
-                authorization_code=oauth_session.authorization_code,
-                access_token=oauth_session.access_token,
-                refresh_token=oauth_session.refresh_token,
-                token_type=oauth_session.token_type,
-                expires_at=oauth_session.expires_at,
-                scope=oauth_session.scope,
-                client_id=oauth_session.client_id,
-                client_secret=oauth_session.client_secret,
-                redirect_uri=oauth_session.redirect_uri,
-                status=oauth_session.status,
-                created_at=oauth_session.created_at,
-                updated_at=oauth_session.updated_at,
-            )
+            return self._oauth_orm_to_pydantic(oauth_session)
 
     @enforce_types
     async def delete_oauth_session(self, session_id: str, actor: PydanticUser) -> None:

letta/services/step_manager.py

@@ -9,12 +9,14 @@ from sqlalchemy.orm import Session
 from letta.helpers.singleton import singleton
 from letta.orm.errors import NoResultFound
 from letta.orm.job import Job as JobModel
+from letta.orm.message import Message as MessageModel
 from letta.orm.sqlalchemy_base import AccessType
 from letta.orm.step import Step as StepModel
 from letta.orm.step_metrics import StepMetrics as StepMetricsModel
 from letta.otel.tracing import get_trace_id, trace_method
 from letta.schemas.enums import StepStatus
 from letta.schemas.letta_stop_reason import LettaStopReason, StopReasonType
+from letta.schemas.message import Message as PydanticMessage
 from letta.schemas.openai.chat_completion_response import UsageStatistics
 from letta.schemas.step import Step as PydanticStep
 from letta.schemas.step_metrics import StepMetrics as PydanticStepMetrics
@@ -237,6 +239,30 @@ class StepManager:
             await session.commit()
             return step.to_pydantic()
 
+    @enforce_types
+    @trace_method
+    async def list_step_messages_async(
+        self,
+        step_id: str,
+        actor: PydanticUser,
+        before: str | None = None,
+        after: str | None = None,
+        limit: int = 100,
+        ascending: bool = False,
+    ) -> List[PydanticMessage]:
+        async with db_registry.async_session() as session:
+            messages = MessageModel.list(
+                db_session=session,
+                before=before,
+                after=after,
+                ascending=ascending,
+                limit=limit,
+                actor=actor,
+                join_model=StepModel,
+                join_conditions=[MessageModel.step.id == step_id],
+            )
+            return [message.to_pydantic() for message in messages]
+
     @enforce_types
     @trace_method
     async def update_step_stop_reason(self, actor: PydanticUser, step_id: str, stop_reason: StopReasonType) -> PydanticStep:

letta/services/summarizer/summarizer.py

@@ -19,7 +19,6 @@ from letta.services.agent_manager import AgentManager
 from letta.services.message_manager import MessageManager
 from letta.services.summarizer.enums import SummarizationMode
 from letta.system import package_summarize_message_no_counts
-from letta.templates.template_helper import render_template
 from letta.utils import safe_create_task
 
 logger = get_logger(__name__)
@@ -280,8 +279,7 @@ class Summarizer:
             formatted_evicted_messages = [f"{i}. {msg}" for (i, msg) in enumerate(formatted_evicted_messages)]
             formatted_in_context_messages = [f"{i + offset}. {msg}" for (i, msg) in enumerate(formatted_in_context_messages)]
 
-            summary_request_text = render_template(
-                "summary_request_text.j2",
+            summary_request_text = build_summary_request_text(
                 retain_count=retain_count,
                 evicted_messages=formatted_evicted_messages,
                 in_context_messages=formatted_in_context_messages,
@@ -304,6 +302,30 @@ def simple_formatter(messages: List[Message], include_system: bool = False) -> s
     return "\n".join(json.dumps(msg) for msg in parsed_messages)
 
 
+def build_summary_request_text(retain_count: int, evicted_messages: List[str], in_context_messages: List[str]) -> str:
+    parts: List[str] = []
+    if retain_count == 0:
+        parts.append(
+            "You’re a memory-recall helper for an AI that is about to forget all prior messages. Scan the conversation history and write crisp notes that capture any important facts or insights about the conversation history."
+        )
+    else:
+        parts.append(
+            f"You’re a memory-recall helper for an AI that can only keep the last {retain_count} messages. Scan the conversation history, focusing on messages about to drop out of that window, and write crisp notes that capture any important facts or insights about the human so they aren’t lost."
+        )
+
+    if evicted_messages:
+        parts.append("\n(Older) Evicted Messages:")
+        for item in evicted_messages:
+            parts.append(f"    {item}")
+
+    if retain_count > 0 and in_context_messages:
+        parts.append("\n(Newer) In-Context Messages:")
+        for item in in_context_messages:
+            parts.append(f"    {item}")
+
+    return "\n".join(parts) + "\n"
+
+
 def simple_message_wrapper(openai_msg: dict) -> Message:
     """Extremely simple way to map from role/content to Message object w/ throwaway dummy fields"""
 

letta/services/telemetry_manager.py

@@ -26,6 +26,7 @@ class TelemetryManager:
     async def create_provider_trace_async(self, actor: PydanticUser, provider_trace_create: ProviderTraceCreate) -> PydanticProviderTrace:
         async with db_registry.async_session() as session:
             provider_trace = ProviderTraceModel(**provider_trace_create.model_dump())
+            provider_trace.organization_id = actor.organization_id
             if provider_trace_create.request_json:
                 request_json_str = json_dumps(provider_trace_create.request_json)
                 provider_trace.request_json = json_loads(request_json_str)
@@ -43,6 +44,7 @@ class TelemetryManager:
     def create_provider_trace(self, actor: PydanticUser, provider_trace_create: ProviderTraceCreate) -> PydanticProviderTrace:
         with db_registry.session() as session:
             provider_trace = ProviderTraceModel(**provider_trace_create.model_dump())
+            provider_trace.organization_id = actor.organization_id
             if provider_trace_create.request_json:
                 request_json_str = json_dumps(provider_trace_create.request_json)
                 provider_trace.request_json = json_loads(request_json_str)

letta/services/tool_executor/composio_tool_executor.py

@@ -51,7 +51,7 @@ class ExternalComposioToolExecutor(ToolExecutor):
 
     def _get_entity_id(self, agent_state: AgentState) -> Optional[str]:
         """Extract the entity ID from environment variables."""
-        for env_var in agent_state.tool_exec_environment_variables:
+        for env_var in agent_state.secrets:
             if env_var.key == COMPOSIO_ENTITY_ENV_VAR_KEY:
                 return env_var.value
         return None

letta/services/tool_executor/sandbox_tool_executor.py

@@ -36,7 +36,7 @@ class SandboxToolExecutor(ToolExecutor):
     ) -> ToolExecutionResult:
         # Store original memory state
         if agent_state:
-            orig_memory_str = await agent_state.memory.compile_in_thread_async()
+            orig_memory_str = agent_state.memory.compile()
         else:
             orig_memory_str = None
 
@@ -89,7 +89,7 @@ class SandboxToolExecutor(ToolExecutor):
 
             # Verify memory integrity
             if agent_state:
-                new_memory_str = await agent_state.memory.compile_in_thread_async()
+                new_memory_str = agent_state.memory.compile()
                 assert orig_memory_str == new_memory_str, "Memory should not be modified in a sandbox tool"
 
             # Update agent memory if needed