{"as_of":"2026-10-27","identity_and_version":{"name":"Letta Code","repository":"https://github.com/letta-ai/letta-code","cli_package":"@letta-ai/letta-code","executable":"letta","newest_npm":{"version":"0.34.25","channel":"npm registry publication time","published_at":"2026-10-26T23:12:49.187Z","supporting_url":"https://registry.npmjs.org/@letta-ai%2fletta-code"},"newest_github_release":{"version":"v0.34.24","channel":"GitHub Release published_at","published_at":"2026-10-25T05:39:26Z","supporting_url":"https://api.github.com/repos/letta-ai/letta-code/releases/latest","release_url":"https://github.com/letta-ai/letta-code/releases/tag/v0.34.24"},"audited_source_commit":"920f9e584e2ee9a2d412eedf9173a9d2b2418118","source_version":"npm 0.34.25; provenance and artifact checked, not default branch","license":{"spdx":"Apache-2.0","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/LICENSE"},"method":"Official public pages/APIs/registries and static inspection of mapped source/artifacts only. No CLI/model execution. Current documentation is not a versioned release specification.","evidence_reference_convention":"E references resolve to exact URLs in evidence_index. GitHub URLs use the first 12 characters of the full audited commit above. Tarball member names specify inspected files."},"corrections":[{"question":"Newest npm and GitHub releases and publication dates?","finding":"npm latest is 0.34.25: npm time[\"0.34.25\"] = 2026-10-26T23:12:49.187Z. npm 0.34.24 publication = 2026-10-25T05:12:04.427Z. GitHub releases/latest instead returns v0.34.24, published_at 2026-10-25T05:39:26Z (not draft/prerelease). Report both channels, using publication timestamps rather than commit dates or GitHub created_at.","supporting_url":"https://registry.npmjs.org/@letta-ai%2fletta-code","evidence_kind":"publisher registry and release API","version_scope":"Publication channels observed at cutoff 2026-10-27","additional_evidence":["E1","E2"]},{"question":"Does npm map to the cited source?","finding":"Registry gitHead and npm provenance resolvedDependencies.gitCommit both identify 920f9e584e2ee9a2d412eedf9173a9d2b2418118. That commit and the published tarball declare 0.34.25. Tarball SHA-512 matches the attestation subject digest: 3abb5ca286c85948a458e47a709190819eee99af5f378923b7c33e3b112da0c04891a295e042fb9d0d83595e81af5aecf8f1fbbd4a46727fd79743caac303257. Source/tarball npm-shrinkwrap.json are byte-identical. Artifact correspondence only; signatures/build reproducibility not verified.","supporting_url":"https://registry.npmjs.org/@letta-ai%2fletta-code","evidence_kind":"publisher metadata, inspected provenance and package artifact","version_scope":"npm 0.34.25","additional_evidence":["E3","E4","E5","E6"]},{"question":"Are npm and GitHub release sources identical?","finding":"GitHub v0.34.24 resolves to 6f4e4886caa0934341eea75c306fc0364509218e, also npm 0.34.24 gitHead. npm 0.34.25 maps to a different commit. Findings are not automatically attributed to v0.34.24 or main.","supporting_url":"https://api.github.com/repos/letta-ai/letta-code/git/ref/tags/v0.34.24","evidence_kind":"release API and publisher registry","version_scope":"GitHub v0.34.24 versus npm 0.34.25","additional_evidence":["E7"]},{"question":"CLI identity and license?","finding":"The package exposes bin.letta = letta.js and declares Apache-2.0, corroborated by LICENSE. It is a local CLI harness; Cloud/browser, remote computers and Agent SDK are other interfaces/deployments. Depending on @letta-ai/letta-agent-sdk does not make its CLI capabilities SDK-only.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/package.json","evidence_kind":"versioned package metadata and license","version_scope":"npm 0.34.25","additional_evidence":["E8","E9"]},{"question":"Headless prompt, directory and completion?","finding":"Yes, documented and source-supported, not executed here: -p/--prompt selects headless mode with prompt text or stdin. One-shot completion emits a result and calls exitHeadless(0); errors use nonzero exits. Set the process cwd (or cd) to the job directory; no ordinary --cwd option appears in the argument catalog. Runtime fallback checks USER_CWD before process.cwd(), so avoid an inherited USER_CWD selecting a different directory.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/headless.ts","evidence_kind":"documented and source-inferred","version_scope":"npm 0.34.25","additional_evidence":["E10","E11","E12"]},{"question":"File-writing invocation and finite-task limits?","finding":"Write resolves file_path against runtime cwd, creates directories and writes UTF-8 host files. Source-supported recipe after provisioning: cd \"$WORKDIR\" && letta --backend local --ephemeral -p \"Create worker-output.txt containing done, then stop.\" --model \"$MODEL_HANDLE\" --toolset letta --tools \"Read,Write\" --permission-mode acceptEdits --max-turns 8 --output-format stream-json . Caller supplies WORKDIR/MODEL_HANDLE; source recipe only, not observed success. --max-turns is passed to execution and checked against accumulated step_count; limit exhaustion exits 1. Add an external deadline and independently verify the file: this flag is not a wall-clock limit.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/tools/impl/write.ts","evidence_kind":"source-inferred invocation recipe; no execution claim","version_scope":"npm 0.34.25","additional_evidence":["E13","E11","E14"]},{"question":"Unattended approvals?","finding":"One-shot headless executes auto-allowed approvals and denies those needing user input; it does not wait for keyboard approval. Shipped default is unrestricted unless overridden by CLI/settings. --yolo selects unrestricted, still subject to deny rules/guards. acceptEdits allows edits; standard/strict require approval for some/all calls, which one-shot denies unless preapproved. In contrast, bidirectional --input-format stream-json emits can_use_tool control requests for a host to answer and stays alive until stdin closes. Docs say AskUserQuestion is excluded from one-shot tools.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/headless.ts","evidence_kind":"documented and source-inferred","version_scope":"npm 0.34.25","additional_evidence":["E15","E16","E17","E10","E18"]},{"question":"Shell/file tool limits?","finding":"--tools filters loaded tools (empty string removes tools); allowedTools/disallowedTools and persistent permissions.allow/deny match tools, paths and shell patterns while keeping tools in context. Guards/deny rules precede ordinary allowances. Examples: Read(src/**), Bash(pnpm test), deny Read(.env). These are application checks, not an OS jail. Read,Write removes shell from the example task; arbitrary Bash can otherwise bypass the direct file-tool surface through programs that write files or use network.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/permissions/checker.ts","evidence_kind":"documented and source-inferred; final sentence is security inference","version_scope":"npm 0.34.25","additional_evidence":["E18","E13","E19"]},{"question":"Local filesystem sandbox boundaries?","finding":"Local OS filesystem sandbox code ships, but ordinary shell wrapping is opt-in via LETTA_FS_SANDBOX=1/true. Memory-profile subagents default on unless 0/false. macOS uses sandbox-exec; Linux requires bwrap and usable user namespaces. Missing/unsupported backends warn and continue without isolation. Normal shell policy blocks other agents' memory, but restrictWrites=false leaves other host writes allowed. Memory-profile children instead scope writes to harness/self-memory roots, with broad reads except denied trees. Neither is a default job-directory boundary.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/sandbox/availability.ts","evidence_kind":"source-inferred","version_scope":"npm 0.34.25","additional_evidence":["E20","E21","E22"]},{"question":"Standalone workspace jail?","finding":"RuntimeWorkspaceSandbox separately requires a working kernel backend and existing absolute root/isolationRoot, with root nested inside isolationRoot. Its policy scopes writes to workspace and masks the enclosing isolation tree; file tools have path guards and shells get wrapped. The inspected activation is the listener runtime-start workspace_sandbox protocol. No equivalent ordinary one-shot CLI flag was found. Do not treat this server/runtime protocol feature as automatic letta -p confinement.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/permissions/workspace-sandbox.ts","evidence_kind":"source-inferred; standalone CLI exposure not found","version_scope":"npm 0.34.25","additional_evidence":["E23","E20","E11","E13"]},{"question":"Local network limits?","finding":"Linux sandbox arguments omit --unshare-net; macOS starts with allow default and adds filesystem rules. Network remains available even when those filesystem policies run. No ordinary CLI egress allowlist/network-off flag was found in the inspected arguments/backends. A worker needing network confinement requires an external policy, separately allowing its inference endpoint.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/sandbox/bwrap.ts","evidence_kind":"source-inferred absence within inspected code, with worker recommendation","version_scope":"npm 0.34.25","additional_evidence":["E24","E11"]},{"question":"Remote Managed Sandbox versus local confinement?","finding":"Cloud/Managed Sandbox means a remote isolated computer managed by Letta with its own shell/filesystem; laptop paths are not automatically mounted. That page covers web/SDK deployment. Pinned CLI README also supports --computer cloud for a target agent's cloud sandbox. These are remote files, not confinement of a normal local -p worker in a contributor checkout.","supporting_url":"https://docs.letta.com/platform/computers/cloud-sandboxes","evidence_kind":"documented; distinction inferred from deployment locations","version_scope":"Current official docs at cutoff, corroborated by npm 0.34.25 README","additional_evidence":["E9"]},{"question":"Mandatory server/cloud dependencies?","finding":"--backend local does not require a Letta account or separate Letta server. README defaults to Cloud but offers local mode. Self-hosting docs distinguish in-process local CLI state from App Server deployment; createBackendForMode constructs LocalBackend versus APIBackend. Inference may still use a remote provider. --ephemeral uses temporary local state, not a no-file-write environment. Cloud/API mode depends on its service for agent state. Agent SDK local mode starts an App Server subprocess; that separate SDK design is not a prerequisite for direct CLI -p.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/backend/backend.ts","evidence_kind":"documented and source-inferred","version_scope":"npm 0.34.25","additional_evidence":["E9","E25","E14"]},{"question":"Actual token JSON/events?","finding":"Successful one-shot json emits type=result, subtype=success, is_error=false, result, agent_id, conversation_id, duration_ms, duration_api_ms, num_turns and usage. usage fields: prompt_tokens, completion_tokens, total_tokens, step_count, cached_input_tokens, cache_write_tokens, reasoning_tokens, optional context_tokens. stream-json final result also has usage and run_ids. Normal usage chunks are type=message/message_type=usage_statistics; --include-partial-messages wraps chunks as type=stream_event/event instead. Docs' two-field usage example is abbreviated.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/headless.ts","evidence_kind":"source-inferred schema; documentation comparison","version_scope":"npm 0.34.25","additional_evidence":["E13","E10"]},{"question":"Token semantics and failure accounting?","finding":"Accumulator sums supplied usage_statistics token/cache/reasoning/step fields; context_tokens is a latest snapshot. SessionStats copies buffer totals. Local execution maps provider Usage.input/output/totalTokens/cacheRead/cacheWrite/reasoning to events. Missing fields can leave initialized zeros, not proven measured zero usage. Some errors/cancellations/bidirectional results have usage:null; max-turn exits need not emit normal final usage. Capture events and final result without summing both copies; mark incomplete accounting. These are provider-reported tokens, not invoices or hard token budgets.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/cli/helpers/accumulator.ts","evidence_kind":"source-inferred; metering recommendations","version_scope":"npm 0.34.25","additional_evidence":["E26","E27","E13"]},{"question":"Inclusive child token totals?","finding":"Child parsing stores result.usage.total_tokens (missing defaults to 0), step_count and duration separately. Task completion notifications encode child totals in a <usage> block with total_tokens, tool_uses and duration_ms. Parent final usage comes from its own SessionStats/buffers; no addition of child counters was found. An inclusive recursive total is not established. Collect/deduplicate child results or notifications separately and handle missing results, nested children and background work explicitly.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/agent/subagents/subagent-stream.ts","evidence_kind":"source-inferred separation; recursive aggregation not found","version_scope":"npm 0.34.25","additional_evidence":["E28","E29","E26","E13"]},{"question":"Parallel agents?","finding":"Yes. Docs describe autonomous subprocess subagents with separate prompt/tools/model and background execution. Pinned approval executor treats Task as parallel-safe and runs independent requests concurrently; Task spawns background subagents and queues completion notifications. Child spawning accepts cwd/env and supports process-group cancellation. This is CLI harness code, not only SDK capability. Docs show --new for parallel conversations; conversation separation does not isolate filesystem writes.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/agent/approval-execution.ts","evidence_kind":"documented and source-inferred","version_scope":"npm 0.34.25","additional_evidence":["E30","E31","E28","E32","E10"]},{"question":"Local versus Cloud providers?","finding":"Local configs derive from bundled pi catalog plus Letta extras, not Cloud's narrower list. Locked pi 0.99.2 catalog IDs: amazon-bedrock, ant-ling, anthropic, azure-openai-responses, baseten, cerebras, cloudflare-ai-gateway, cloudflare-workers-ai, deepseek, fireworks, github-copilot, google, google-vertex, groq, huggingface, kimi-coding, meta, minimax, minimax-cn, mistral, moonshotai, moonshotai-cn, nvidia, openai, openai-codex, opencode, opencode-go, openrouter, qwen-token-plan, qwen-token-plan-cn, qwen-token-plan-individual, radius, together, typesafe, vercel-ai-gateway, xai, xiaomi, xiaomi-token-plan-ams/cn/sgp, zai, zai-coding-cn. Letta extras include zai-coding, Ollama/Cloud, LM Studio, llama.cpp, OpenAI-compatible endpoints. Cloud BYOK source lists ChatGPT/Codex, xAI subscription, Anthropic, OpenAI, OpenAI-compatible, zAI API/plan, MiniMax, Gemini, Moonshot/Kimi Code, OpenRouter key/OAuth and Bedrock. Catalog support is not live-provider verification.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/providers/byok-providers.ts","evidence_kind":"source-inferred provider catalog; documented backend distinction","version_scope":"npm 0.34.25","additional_evidence":["E33","E5","E34","E35"]},{"question":"Subscription versus account OAuth or plan keys?","finding":"Subscription login exists after provisioning. Docs list ChatGPT Plus/Pro and Copilot subscriptions. Pinned Letta discovers built-in OAuth and separates Anthropic/OpenAI/OpenRouter key versus OAuth entries. Locked/bundled pi 0.99.2 marks Anthropic Claude Pro/Max, OpenAI ChatGPT, legacy openai-codex ChatGPT Plus/Pro, Copilot and xAI Grok/X as isSubscription:true. This proves implemented login routes, not live eligibility or provider policy. OpenRouter OAuth is ordinary account authorization creating a user-controlled API key, not subscription inference. zAI Coding Plan uses a plan key; MiniMax accepts key/plan. Letta /login is Letta account authentication, not third-party subscription login.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/providers/byok-providers.ts","evidence_kind":"documented and source-inferred; subscription/account/key distinction","version_scope":"npm 0.34.25","artifact_members_checked":["pi tarball: dist/providers/{anthropic,openai,openai-codex,github-copilot,xai,openrouter}.js; CLI tarball: letta.js (all under package/)"],"additional_evidence":["E36","E34","E6","E35","E9"]},{"question":"Documentation/source conflicts?","finding":"Conflicts: current Models table shows Anthropic API-key-only and no signed-in xAI, while the shipped local provider dependency exposes Claude Pro/Max OAuth and pinned CLOUD_BYOK_PROVIDERS includes xAI OAuth. Service availability remains unverified. Headless docs still illustrate --import AgentFile, but pinned README says it was removed. Self-hosting docs say Node 22.19+, but 0.34.25 engines.node is ^22.23.4 || ^24.22.1 || ^26.12.1 (bun >=1.3.2). Provision by package engines; moving docs are not versioned proof.","supporting_url":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/README.md","evidence_kind":"conflicting documentation versus pinned package/source","version_scope":"npm 0.34.25","additional_evidence":["E35","E10","E25","E4","E37","E34"]}],"confirmed_capabilities":{"headless_local_files":{"corrections":[4,5,6],"indexing":"zero-based corrections array"},"local_state_without_mandatory_cloud":{"correction":12},"token_output_and_parallel_subagents":{"corrections":[13,14,15,16]},"providers_and_subscription_routes":{"corrections":[17,18],"qualification":"Implementation support; no live-provider verification"}},"unresolved":[{"question":"Observed successful finite file-writing run?","finding":"Not performed: static verification only, as requested. No elapsed-time/model-success guarantee.","pages_checked":["E10","E13","E38"]},{"question":"Inclusive child totals and complete failure billing?","finding":"Not established; separate child counters, missing fields and absent final error usage require incomplete-accounting handling.","pages_checked":["E26","E42","E41"]},{"question":"Ordinary CLI network-off or automatic workspace jail?","finding":"Not found; filesystem backends retain network. Workspace sandbox activation found only in a separate runtime protocol.","pages_checked":["E11","E43","E24","E23"]},{"question":"Provider eligibility, refresh reliability and service availability?","finding":"Not tested; implemented OAuth is not proof of entitlement, policy permission, quotas or future unattended refresh. Anthropic/xAI documentation discrepancies remain.","pages_checked":["E35","E37","E34"]},{"question":"All audited behavior shipped in GitHub v0.34.24?","finding":"Not claimed. Source scope is npm 0.34.25; moving docs do not establish backports.","pages_checked":["E1","E44"]}],"ranking_implications":{"assessment_only":true,"assessment":"Keep in contention: local headless files, provider flexibility and parallel agents are strong fits. Remove a mandatory-Cloud penalty. Weaker fit for out-of-box hostile-workspace confinement or recursive billing. This audit cannot rank four other unaudited candidates.","worker_additions":["Pin package/runtime and pre-provision credentials; select backend, explicit cwd and disposable/isolated state.","Use one-shot -p, an external deadline and independent output validation.","Externally confine the entire process tree and network; memory isolation and --yolo do not provide that boundary.","Minimize --tools and configure approval rules; host bidirectional approvals only when needed.","Capture usage events/final result without double counting; meter children separately or disable delegation; preserve incomplete usage."]},"evidence_index":{"E1":"https://api.github.com/repos/letta-ai/letta-code/releases/latest","E2":"https://github.com/letta-ai/letta-code/releases/tag/v0.34.24","E3":"https://registry.npmjs.org/-/npm/v1/attestations/@letta-ai%2fletta-code@0.34.25","E4":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/package.json","E5":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/npm-shrinkwrap.json","E6":"https://registry.npmjs.org/@letta-ai/letta-code/-/letta-code-0.34.25.tgz","E7":"https://registry.npmjs.org/@letta-ai%2fletta-code","E8":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/LICENSE","E9":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/README.md","E10":"https://docs.letta.com/platform/cli/headless","E11":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/cli/args.ts","E12":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/runtime-context.ts","E13":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/headless.ts","E14":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/headless-ephemeral-startup.ts","E15":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/permissions/mode.ts","E16":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/permissions/startup.ts","E17":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/headless-permission.ts","E18":"https://docs.letta.com/configuration/permissions","E19":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/permissions/matcher.ts","E20":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/tools/impl/shell-sandbox.ts","E21":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/permissions/sandbox-policy.ts","E22":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/agent/subagents/sandbox.ts","E23":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/websocket/listener/commands/runtime-start.ts","E24":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/sandbox/seatbelt.ts","E25":"https://docs.letta.com/self-hosting","E26":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/agent/stats.ts","E27":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/backend/dev/provider-turn-executor.ts","E28":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/tools/impl/task.ts","E29":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/utils/task-notifications.ts","E30":"https://docs.letta.com/configuration/subagents","E31":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/agent/approval-execution.ts","E32":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/agent/subagents/subagent-process.ts","E33":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/backend/dev/pi-provider-registry.ts","E34":"https://registry.npmjs.org/@earendil-works/pi-ai/-/pi-ai-0.99.2.tgz","E35":"https://docs.letta.com/configuration/models","E36":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/backend/dev/pi-oauth.ts","E37":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/providers/byok-providers.ts","E38":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/tools/impl/write.ts","E39":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/backend/backend.ts","E40":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/permissions/checker.ts","E41":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/cli/helpers/accumulator.ts","E42":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/agent/subagents/subagent-stream.ts","E43":"https://github.com/letta-ai/letta-code/blob/920f9e584e2e/src/sandbox/bwrap.ts","E44":"https://api.github.com/repos/letta-ai/letta-code/git/ref/tags/v0.34.24"}}