letta-nightly 0.12.0.dev20251009104148__py3-none-any.whl → 0.12.1.dev20251009224219__py3-none-any.whl

letta/schemas/secret.py

@@ -2,6 +2,7 @@ import json
 from typing import Any, Dict, Optional
 
 from pydantic import BaseModel, ConfigDict, PrivateAttr
+from pydantic_core import core_schema
 
 from letta.helpers.crypto_utils import CryptoUtils
 from letta.log import get_logger
@@ -19,16 +20,16 @@ class Secret(BaseModel):
     TODO: Once we deprecate plaintext columns in the database:
     - Remove the dual-write logic in to_dict()
     - Remove the from_db() method's plaintext_value parameter
-    - Remove the _was_encrypted flag (no longer needed for migration)
+    - Remove the was_encrypted flag (no longer needed for migration)
     - Simplify get_plaintext() to only handle encrypted values
     """
 
-    # Store the encrypted value
-    _encrypted_value: Optional[str] = PrivateAttr(default=None)
-    # Cache the decrypted value to avoid repeated decryption
+    # Store the encrypted value as a regular field
+    encrypted_value: Optional[str] = None
+    # Cache the decrypted value to avoid repeated decryption (not serialized for security)
     _plaintext_cache: Optional[str] = PrivateAttr(default=None)
     # Flag to indicate if the value was originally encrypted
-    _was_encrypted: bool = PrivateAttr(default=False)
+    was_encrypted: bool = False
 
     model_config = ConfigDict(frozen=True)
 
@@ -44,18 +45,16 @@ class Secret(BaseModel):
             A Secret instance with the encrypted value, or plaintext if encryption unavailable
         """
         if value is None:
-            instance = cls()
-            instance._encrypted_value = None
-            instance._was_encrypted = False
-            return instance
+            return cls.model_construct(encrypted_value=None, was_encrypted=False)
+
+        # Guard against double encryption - check if value is already encrypted
+        if CryptoUtils.is_encrypted(value):
+            logger.warning("Creating Secret from already-encrypted value. This can be dangerous.")
 
         # Try to encrypt, but fall back to plaintext if no encryption key
         try:
             encrypted = CryptoUtils.encrypt(value)
-            instance = cls()
-            instance._encrypted_value = encrypted
-            instance._was_encrypted = False
-            return instance
+            return cls.model_construct(encrypted_value=encrypted, was_encrypted=False)
         except ValueError as e:
             # No encryption key available, store as plaintext
             if "No encryption key configured" in str(e):
@@ -63,10 +62,8 @@ class Secret(BaseModel):
                     "No encryption key configured. Storing Secret value as plaintext. "
                     "Set LETTA_ENCRYPTION_KEY environment variable to enable encryption."
                 )
-                instance = cls()
-                instance._encrypted_value = value  # Store plaintext
+                instance = cls.model_construct(encrypted_value=value, was_encrypted=False)
                 instance._plaintext_cache = value  # Cache it
-                instance._was_encrypted = False
                 return instance
             raise  # Re-raise if it's a different error
 
@@ -81,10 +78,7 @@ class Secret(BaseModel):
         Returns:
             A Secret instance
         """
-        instance = cls()
-        instance._encrypted_value = encrypted_value
-        instance._was_encrypted = True
-        return instance
+        return cls.model_construct(encrypted_value=encrypted_value, was_encrypted=True)
 
     @classmethod
     def from_db(cls, encrypted_value: Optional[str], plaintext_value: Optional[str]) -> "Secret":
@@ -114,7 +108,7 @@ class Secret(BaseModel):
         Returns:
             The encrypted value, or None if the secret is empty
         """
-        return self._encrypted_value
+        return self.encrypted_value
 
     def get_plaintext(self) -> Optional[str]:
         """
@@ -126,7 +120,7 @@ class Secret(BaseModel):
         Returns:
             The decrypted plaintext value
         """
-        if self._encrypted_value is None:
+        if self.encrypted_value is None:
             return None
 
         # Use cached value if available, but only if it looks like plaintext
@@ -134,14 +128,14 @@ class Secret(BaseModel):
         if self._plaintext_cache is not None:
             # If we have a cache but the stored value looks encrypted and we have no key,
             # we should not use the cache
-            if CryptoUtils.is_encrypted(self._encrypted_value) and not CryptoUtils.is_encryption_available():
+            if CryptoUtils.is_encrypted(self.encrypted_value) and not CryptoUtils.is_encryption_available():
                 self._plaintext_cache = None  # Clear invalid cache
             else:
                 return self._plaintext_cache
 
         # Decrypt and cache
         try:
-            plaintext = CryptoUtils.decrypt(self._encrypted_value)
+            plaintext = CryptoUtils.decrypt(self.encrypted_value)
             # Cache the decrypted value (PrivateAttr fields can be mutated even with frozen=True)
             self._plaintext_cache = plaintext
             return plaintext
@@ -151,7 +145,7 @@ class Secret(BaseModel):
             # Handle missing encryption key
             if "No encryption key configured" in error_msg:
                 # Check if the value looks encrypted
-                if CryptoUtils.is_encrypted(self._encrypted_value):
+                if CryptoUtils.is_encrypted(self.encrypted_value):
                     # Value was encrypted, but now we have no key - can't decrypt
                     logger.warning(
                         "Cannot decrypt Secret value - no encryption key configured. "
@@ -162,26 +156,26 @@ class Secret(BaseModel):
                 else:
                     # Value is plaintext (stored when no key was available)
                     logger.debug("Secret value is plaintext (stored without encryption)")
-                    self._plaintext_cache = self._encrypted_value
-                    return self._encrypted_value
+                    self._plaintext_cache = self.encrypted_value
+                    return self.encrypted_value
 
             # Handle decryption failure (might be plaintext stored as such)
             elif "Failed to decrypt data" in error_msg:
                 # Check if it might be plaintext
-                if not CryptoUtils.is_encrypted(self._encrypted_value):
+                if not CryptoUtils.is_encrypted(self.encrypted_value):
                     # It's plaintext that was stored when no key was available
                     logger.debug("Secret value appears to be plaintext (stored without encryption)")
-                    self._plaintext_cache = self._encrypted_value
-                    return self._encrypted_value
+                    self._plaintext_cache = self.encrypted_value
+                    return self.encrypted_value
                 # Otherwise, it's corrupted or wrong key
                 logger.error("Failed to decrypt Secret value - data may be corrupted or wrong key")
                 raise
 
             # Migration case: handle legacy plaintext
-            elif not self._was_encrypted:
-                if self._encrypted_value and not CryptoUtils.is_encrypted(self._encrypted_value):
-                    self._plaintext_cache = self._encrypted_value
-                    return self._encrypted_value
+            elif not self.was_encrypted:
+                if self.encrypted_value and not CryptoUtils.is_encrypted(self.encrypted_value):
+                    self._plaintext_cache = self.encrypted_value
+                    return self.encrypted_value
                 return None
 
             # Re-raise for other errors
@@ -189,7 +183,7 @@ class Secret(BaseModel):
 
     def is_empty(self) -> bool:
         """Check if the secret is empty/None."""
-        return self._encrypted_value is None
+        return self.encrypted_value is None
 
     def __str__(self) -> str:
         """String representation that doesn't expose the actual value."""
@@ -207,7 +201,7 @@ class Secret(BaseModel):
 
         Returns both encrypted and plaintext values for dual-write during migration.
         """
-        return {"encrypted": self.get_encrypted(), "plaintext": self.get_plaintext() if not self._was_encrypted else None}
+        return {"encrypted": self.get_encrypted(), "plaintext": self.get_plaintext() if not self.was_encrypted else None}
 
     def __eq__(self, other: Any) -> bool:
         """
@@ -219,6 +213,79 @@ class Secret(BaseModel):
             return False
         return self.get_plaintext() == other.get_plaintext()
 
+    @classmethod
+    def __get_pydantic_core_schema__(cls, source_type: Any, handler) -> core_schema.CoreSchema:
+        """
+        Customize Pydantic's validation and serialization behavior for Secret fields.
+
+        This allows Secret fields to automatically:
+        - Deserialize: Convert encrypted strings from DB → Secret objects
+        - Serialize: Convert Secret objects → encrypted strings for DB
+        """
+
+        def validate_secret(value: Any) -> "Secret":
+            """Convert various input types to Secret objects."""
+            if isinstance(value, Secret):
+                return value
+            elif isinstance(value, str):
+                # String from DB is assumed to be encrypted
+                return Secret.from_encrypted(value)
+            elif isinstance(value, dict):
+                # Dict might be from Pydantic serialization - check for encrypted_value key
+                if "encrypted_value" in value:
+                    # This is a serialized Secret being deserialized
+                    return cls(**value)
+                elif not value or value == {}:
+                    # Empty dict means None
+                    return Secret.from_plaintext(None)
+                else:
+                    raise ValueError(f"Cannot convert dict to Secret: {value}")
+            elif value is None:
+                return Secret.from_plaintext(None)
+            else:
+                raise ValueError(f"Cannot convert {type(value)} to Secret")
+
+        def serialize_secret(secret: "Secret") -> Optional[str]:
+            """Serialize Secret to encrypted string."""
+            if secret is None:
+                return None
+            return secret.get_encrypted()
+
+        python_schema = core_schema.chain_schema(
+            [
+                core_schema.no_info_plain_validator_function(validate_secret),
+                core_schema.is_instance_schema(cls),
+            ]
+        )
+
+        return core_schema.json_or_python_schema(
+            json_schema=python_schema,
+            python_schema=python_schema,
+            serialization=core_schema.plain_serializer_function_ser_schema(
+                serialize_secret,
+                when_used="always",
+            ),
+        )
+
+    @classmethod
+    def __get_pydantic_json_schema__(cls, core_schema: core_schema.CoreSchema, handler) -> Dict[str, Any]:
+        """
+        Define JSON schema representation for Secret fields.
+        In JSON schema (OpenAPI docs), Secret fields appear as nullable strings.
+        The actual encryption/decryption happens at runtime via __get_pydantic_core_schema__.
+        Args:
+            core_schema: The core schema for this type
+            handler: Handler for generating JSON schema
+        Returns:
+            A JSON schema dict representing this type as a nullable string
+        """
+        # Return a simple string schema for JSON schema generation
+        return {
+            "type": "string",
+            "nullable": True,
+            "description": "Encrypted secret value (stored as encrypted string)",
+        }
+
 
 class SecretDict(BaseModel):
     """

letta/server/rest_api/interface.py

@@ -562,14 +562,16 @@ class StreamingServerInterface(AgentChunkStreamingInterface):
 
                 if prev_message_type and prev_message_type != "tool_call_message":
                     message_index += 1
+                tool_call_delta = ToolCallDelta(
+                    name=json_reasoning_content.get("name"),
+                    arguments=json.dumps(json_reasoning_content.get("arguments")),
+                    tool_call_id=None,
+                )
                 processed_chunk = ToolCallMessage(
                     id=message_id,
                     date=message_date,
-                    tool_call=ToolCallDelta(
-                        name=json_reasoning_content.get("name"),
-                        arguments=json.dumps(json_reasoning_content.get("arguments")),
-                        tool_call_id=None,
-                    ),
+                    tool_call=tool_call_delta,
+                    tool_calls=tool_call_delta,
                     name=name,
                     otid=Message.generate_otid_from_id(message_id, message_index),
                 )
@@ -703,14 +705,16 @@ class StreamingServerInterface(AgentChunkStreamingInterface):
                     else:
                         if prev_message_type and prev_message_type != "tool_call_message":
                             message_index += 1
+                        tc_delta = ToolCallDelta(
+                            name=tool_call_delta.get("name"),
+                            arguments=tool_call_delta.get("arguments"),
+                            tool_call_id=tool_call_delta.get("id"),
+                        )
                         processed_chunk = ToolCallMessage(
                             id=message_id,
                             date=message_date,
-                            tool_call=ToolCallDelta(
-                                name=tool_call_delta.get("name"),
-                                arguments=tool_call_delta.get("arguments"),
-                                tool_call_id=tool_call_delta.get("id"),
-                            ),
+                            tool_call=tc_delta,
+                            tool_calls=tc_delta,
                             name=name,
                             otid=Message.generate_otid_from_id(message_id, message_index),
                         )
@@ -779,14 +783,16 @@ class StreamingServerInterface(AgentChunkStreamingInterface):
                             else:
                                 if prev_message_type and prev_message_type != "tool_call_message":
                                     message_index += 1
+                                tc_delta = ToolCallDelta(
+                                    name=self.function_name_buffer,
+                                    arguments=None,
+                                    tool_call_id=self.function_id_buffer,
+                                )
                                 processed_chunk = ToolCallMessage(
                                     id=message_id,
                                     date=message_date,
-                                    tool_call=ToolCallDelta(
-                                        name=self.function_name_buffer,
-                                        arguments=None,
-                                        tool_call_id=self.function_id_buffer,
-                                    ),
+                                    tool_call=tc_delta,
+                                    tool_calls=tc_delta,
                                     name=name,
                                     otid=Message.generate_otid_from_id(message_id, message_index),
                                 )
@@ -843,14 +849,16 @@ class StreamingServerInterface(AgentChunkStreamingInterface):
                                     combined_chunk = self.function_args_buffer + updates_main_json
                                     if prev_message_type and prev_message_type != "tool_call_message":
                                         message_index += 1
+                                    tc_delta = ToolCallDelta(
+                                        name=None,
+                                        arguments=combined_chunk,
+                                        tool_call_id=self.function_id_buffer,
+                                    )
                                     processed_chunk = ToolCallMessage(
                                         id=message_id,
                                         date=message_date,
-                                        tool_call=ToolCallDelta(
-                                            name=None,
-                                            arguments=combined_chunk,
-                                            tool_call_id=self.function_id_buffer,
-                                        ),
+                                        tool_call=tc_delta,
+                                        tool_calls=tc_delta,
                                         name=name,
                                         otid=Message.generate_otid_from_id(message_id, message_index),
                                     )
@@ -861,14 +869,16 @@ class StreamingServerInterface(AgentChunkStreamingInterface):
                                     # If there's no buffer to clear, just output a new chunk with new data
                                     if prev_message_type and prev_message_type != "tool_call_message":
                                         message_index += 1
+                                    tc_delta = ToolCallDelta(
+                                        name=None,
+                                        arguments=updates_main_json,
+                                        tool_call_id=self.function_id_buffer,
+                                    )
                                     processed_chunk = ToolCallMessage(
                                         id=message_id,
                                         date=message_date,
-                                        tool_call=ToolCallDelta(
-                                            name=None,
-                                            arguments=updates_main_json,
-                                            tool_call_id=self.function_id_buffer,
-                                        ),
+                                        tool_call=tc_delta,
+                                        tool_calls=tc_delta,
                                         name=name,
                                         otid=Message.generate_otid_from_id(message_id, message_index),
                                     )
@@ -992,14 +1002,16 @@ class StreamingServerInterface(AgentChunkStreamingInterface):
                 else:
                     if prev_message_type and prev_message_type != "tool_call_message":
                         message_index += 1
+                    tc_delta = ToolCallDelta(
+                        name=tool_call_delta.get("name"),
+                        arguments=tool_call_delta.get("arguments"),
+                        tool_call_id=tool_call_delta.get("id"),
+                    )
                     processed_chunk = ToolCallMessage(
                         id=message_id,
                         date=message_date,
-                        tool_call=ToolCallDelta(
-                            name=tool_call_delta.get("name"),
-                            arguments=tool_call_delta.get("arguments"),
-                            tool_call_id=tool_call_delta.get("id"),
-                        ),
+                        tool_call=tc_delta,
+                        tool_calls=tc_delta,
                         name=name,
                         otid=Message.generate_otid_from_id(message_id, message_index),
                     )
@@ -1262,14 +1274,16 @@ class StreamingServerInterface(AgentChunkStreamingInterface):
                         # Store the ID of the tool call so allow skipping the corresponding response
                         self.prev_assistant_message_id = function_call.id
                     else:
+                        tool_call_obj = ToolCall(
+                            name=function_call.function.name,
+                            arguments=function_call.function.arguments,
+                            tool_call_id=function_call.id,
+                        )
                         processed_chunk = ToolCallMessage(
                             id=msg_obj.id,
                             date=msg_obj.created_at,
-                            tool_call=ToolCall(
-                                name=function_call.function.name,
-                                arguments=function_call.function.arguments,
-                                tool_call_id=function_call.id,
-                            ),
+                            tool_call=tool_call_obj,
+                            tool_calls=tool_call_obj,
                             name=msg_obj.name,
                             otid=Message.generate_otid_from_id(msg_obj.id, chunk_index) if chunk_index is not None else None,
                         )
@@ -1303,14 +1317,29 @@ class StreamingServerInterface(AgentChunkStreamingInterface):
                 # Skip this tool call receipt
                 return
             else:
+                from letta.schemas.letta_message import ToolReturn as ToolReturnSchema
+
+                status = msg_obj.tool_returns[0].status if msg_obj.tool_returns else "success"
+                stdout = msg_obj.tool_returns[0].stdout if msg_obj.tool_returns else []
+                stderr = msg_obj.tool_returns[0].stderr if msg_obj.tool_returns else []
+
+                tool_return_obj = ToolReturnSchema(
+                    tool_return=msg,
+                    status=status,
+                    tool_call_id=msg_obj.tool_call_id,
+                    stdout=stdout,
+                    stderr=stderr,
+                )
+
                 new_message = ToolReturnMessage(
                     id=msg_obj.id,
                     date=msg_obj.created_at,
                     tool_return=msg,
-                    status=msg_obj.tool_returns[0].status if msg_obj.tool_returns else "success",
+                    status=status,
                     tool_call_id=msg_obj.tool_call_id,
-                    stdout=msg_obj.tool_returns[0].stdout if msg_obj.tool_returns else [],
-                    stderr=msg_obj.tool_returns[0].stderr if msg_obj.tool_returns else [],
+                    stdout=stdout,
+                    stderr=stderr,
+                    tool_returns=[tool_return_obj],
                     name=msg_obj.name,
                     otid=Message.generate_otid_from_id(msg_obj.id, chunk_index) if chunk_index is not None else None,
                 )
@@ -1319,14 +1348,29 @@ class StreamingServerInterface(AgentChunkStreamingInterface):
             msg = msg.replace("Error: ", "", 1)
             # new_message = {"function_return": msg, "status": "error"}
             assert msg_obj.tool_call_id is not None
+            from letta.schemas.letta_message import ToolReturn as ToolReturnSchema
+
+            status = msg_obj.tool_returns[0].status if msg_obj.tool_returns else "error"
+            stdout = msg_obj.tool_returns[0].stdout if msg_obj.tool_returns else []
+            stderr = msg_obj.tool_returns[0].stderr if msg_obj.tool_returns else []
+
+            tool_return_obj = ToolReturnSchema(
+                tool_return=msg,
+                status=status,
+                tool_call_id=msg_obj.tool_call_id,
+                stdout=stdout,
+                stderr=stderr,
+            )
+
             new_message = ToolReturnMessage(
                 id=msg_obj.id,
                 date=msg_obj.created_at,
                 tool_return=msg,
-                status=msg_obj.tool_returns[0].status if msg_obj.tool_returns else "error",
+                status=status,
                 tool_call_id=msg_obj.tool_call_id,
-                stdout=msg_obj.tool_returns[0].stdout if msg_obj.tool_returns else [],
-                stderr=msg_obj.tool_returns[0].stderr if msg_obj.tool_returns else [],
+                stdout=stdout,
+                stderr=stderr,
+                tool_returns=[tool_return_obj],
                 name=msg_obj.name,
                 otid=Message.generate_otid_from_id(msg_obj.id, chunk_index) if chunk_index is not None else None,
             )

letta/server/rest_api/routers/v1/providers.py

@@ -120,6 +120,40 @@ async def check_provider(
         raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail=f"{e}")
 
 
+@router.post("/{provider_id}/check", response_model=None, operation_id="check_existing_provider")
+async def check_existing_provider(
+    provider_id: str,
+    headers: HeaderParams = Depends(get_headers),
+    server: "SyncServer" = Depends(get_letta_server),
+):
+    """
+    Verify the API key and additional parameters for an existing provider.
+    """
+    try:
+        actor = await server.user_manager.get_actor_or_default_async(actor_id=headers.actor_id)
+        provider = await server.provider_manager.get_provider_async(provider_id=provider_id, actor=actor)
+
+        # Create a ProviderCheck from the existing provider
+        provider_check = ProviderCheck(
+            provider_type=provider.provider_type,
+            api_key=provider.api_key,
+            base_url=provider.base_url,
+        )
+
+        await server.provider_manager.check_provider_api_key(provider_check=provider_check)
+        return JSONResponse(
+            status_code=status.HTTP_200_OK, content={"message": f"Valid api key for provider_type={provider.provider_type.value}"}
+        )
+    except LLMAuthenticationError as e:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=f"{e.message}")
+    except NoResultFound:
+        raise HTTPException(status_code=404, detail=f"Provider provider_id={provider_id} not found for user_id={actor.id}.")
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail=f"{e}")
+
+
 @router.delete("/{provider_id}", response_model=None, operation_id="delete_provider")
 async def delete_provider(
     provider_id: str,

letta/server/rest_api/routers/v1/runs.py

@@ -286,7 +286,7 @@ async def delete_run(
     """
     actor = await server.user_manager.get_actor_or_default_async(actor_id=headers.actor_id)
     runs_manager = RunManager()
-    return await runs_manager.delete_run_by_id(run_id=run_id, actor=actor)
+    return await runs_manager.delete_run(run_id=run_id, actor=actor)
 
 
 @router.post(

letta/server/server.py

@@ -1239,6 +1239,16 @@ class SyncServer(object):
                 function_args=tool_args,
                 tool=tool,
             )
+            from letta.schemas.letta_message import ToolReturn as ToolReturnSchema
+
+            tool_return_obj = ToolReturnSchema(
+                tool_return=str(tool_execution_result.func_return),
+                status=tool_execution_result.status,
+                tool_call_id="null",
+                stdout=tool_execution_result.stdout,
+                stderr=tool_execution_result.stderr,
+            )
+
             return ToolReturnMessage(
                 id="null",
                 tool_call_id="null",
@@ -1247,10 +1257,21 @@ class SyncServer(object):
                 tool_return=str(tool_execution_result.func_return),
                 stdout=tool_execution_result.stdout,
                 stderr=tool_execution_result.stderr,
+                tool_returns=[tool_return_obj],
             )
 
         except Exception as e:
             func_return = get_friendly_error_msg(function_name=tool.name, exception_name=type(e).__name__, exception_message=str(e))
+            from letta.schemas.letta_message import ToolReturn as ToolReturnSchema
+
+            tool_return_obj = ToolReturnSchema(
+                tool_return=func_return,
+                status="error",
+                tool_call_id="null",
+                stdout=[],
+                stderr=[traceback.format_exc()],
+            )
+
             return ToolReturnMessage(
                 id="null",
                 tool_call_id="null",
@@ -1259,6 +1280,7 @@ class SyncServer(object):
                 tool_return=func_return,
                 stdout=[],
                 stderr=[traceback.format_exc()],
+                tool_returns=[tool_return_obj],
             )
 
     # MCP wrappers

letta/settings.py

@@ -329,6 +329,9 @@ class Settings(BaseSettings):
     file_processing_timeout_minutes: int = 30
     file_processing_timeout_error_message: str = "File processing timed out after {} minutes. Please try again."
 
+    # enabling letta_agent_v1 architecture
+    use_letta_v1_agent: bool = False
+
     @property
     def letta_pg_uri(self) -> str:
         if self.pg_uri:

{letta_nightly-0.12.0.dev20251009104148.dist-info → letta_nightly-0.12.1.dev20251009224219.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: letta-nightly
-Version: 0.12.0.dev20251009104148
+Version: 0.12.1.dev20251009224219
 Summary: Create LLM agents with long-term memory and custom tools
 Author-email: Letta Team <contact@letta.com>
 License: Apache License