deepagents-cli 0.0.42__tar.gz → 0.0.43__tar.gz

{deepagents_cli-0.0.42 → deepagents_cli-0.0.43}/.gitignore

@@ -15,6 +15,7 @@ downloads/
 eggs/
 .eggs/
 lib/
+!libs/cli/frontend/src/lib/
 lib64/
 parts/
 sdist/
@@ -227,3 +228,8 @@ libs/cli/TEXTUAL_PROGRESS.md
 
 CLAUDE.md
 .worktrees/
+
+# Frontend build artifacts (source tree; package data under libs/cli/deepagents_cli/deploy/frontend_dist/ is tracked)
+libs/cli/frontend/node_modules/
+libs/cli/frontend/dist/
+node_modules/

{deepagents_cli-0.0.42 → deepagents_cli-0.0.43}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.0.43](https://github.com/langchain-ai/deepagents/compare/deepagents-cli==0.0.42...deepagents-cli==0.0.43) (2026-04-29)
+
+
+### Features
+
+* **cli:** bundled chat frontend for deepagent deploy ([#2940](https://github.com/langchain-ai/deepagents/issues/2940)) ([9bde0c7](https://github.com/langchain-ai/deepagents/commit/9bde0c7835ded20e80466d8361f40784141d68d8))
+
 ## [0.0.42](https://github.com/langchain-ai/deepagents/compare/deepagents-cli==0.0.41...deepagents-cli==0.0.42) (2026-04-29)
 
 ### Features

{deepagents_cli-0.0.42 → deepagents_cli-0.0.43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepagents-cli
-Version: 0.0.42
+Version: 0.0.43
 Summary: Terminal interface for Deep Agents - interactive AI agent with file operations, shell access, and sub-agent capabilities.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/

{deepagents_cli-0.0.42 → deepagents_cli-0.0.43}/deepagents_cli/_version.py

@@ -1,6 +1,6 @@
 """Version information and lightweight constants for `deepagents-cli`."""
 
-__version__ = "0.0.42"  # x-release-please-version
+__version__ = "0.0.43"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/cli"
 """URL for `deepagents-cli` documentation."""

{deepagents_cli-0.0.42 → deepagents_cli-0.0.43}/deepagents_cli/deploy/bundler.py

@@ -25,6 +25,8 @@ from __future__ import annotations
 
 import json
 import logging
+import os
+import re
 import shutil
 from pathlib import Path
 from typing import Any
@@ -39,6 +41,7 @@ from deepagents_cli.deploy.config import (
     load_subagents,
 )
 from deepagents_cli.deploy.templates import (
+    APP_PY_TEMPLATE,
     AUTH_BLOCKS,
     AUTH_ON_HANDLER,
     DEPLOY_GRAPH_TEMPLATE,
@@ -69,6 +72,97 @@ _MODEL_PROVIDER_DEPS: dict[str, str] = {
 }
 """Dependencies inferred from a provider: prefix on the model string."""
 
+_FRONTEND_DIST_SRC = Path(__file__).parent / "frontend_dist"
+"""Location of the shipped pre-built frontend, inside this Python package."""
+
+_FRONTEND_PLACEHOLDER_RE = re.compile(
+    r"window\.__DEEPAGENTS_CONFIG__\s*=\s*\{[^<]*?\};",
+    re.DOTALL,
+)
+"""Matches the placeholder script we injected into index.html at build time."""
+
+
+def _build_runtime_config_json(config: DeployConfig) -> str:
+    """Build the JSON value injected into `window.__DEEPAGENTS_CONFIG__`.
+
+    Only reached when `[frontend].enabled` and `[auth]` is set —
+    validation guarantees both. The `is None` guards below exist so
+    the optional fields narrow for type-checkers.
+    """
+    if config.frontend is None:
+        msg = "runtime config requires [frontend] to be configured"
+        raise ValueError(msg)
+    if config.auth is None:
+        msg = "runtime config requires [auth] to be configured"
+        raise ValueError(msg)
+
+    app_name = config.frontend.app_name or config.agent.name
+    payload: dict[str, Any] = {
+        "appName": app_name,
+        "assistantId": "agent",
+    }
+    # Optional UI-customization fields — only injected when the user
+    # set them, so the default-bundle case stays small.
+    if config.frontend.subtitle is not None:
+        payload["subtitle"] = config.frontend.subtitle
+    if config.frontend.prompts is not None:
+        payload["prompts"] = list(config.frontend.prompts)
+
+    provider = config.auth.provider
+    payload["auth"] = provider
+    if provider == "supabase":
+        payload["supabaseUrl"] = os.environ["SUPABASE_URL"]
+        payload["supabaseAnonKey"] = os.environ["SUPABASE_PUBLISHABLE_DEFAULT_KEY"]
+    elif provider == "clerk":
+        payload["clerkPublishableKey"] = os.environ["CLERK_PUBLISHABLE_KEY"]
+    elif provider == "anonymous":
+        # No env vars; payload["auth"] = "anonymous" is enough.
+        pass
+    else:
+        msg = f"Unknown auth provider for frontend: {provider}"
+        raise ValueError(msg)
+
+    # Escape `<` so a hostile or accidental `</script>` inside a string value
+    # can't break out of the inline <script> tag.
+    return json.dumps(payload, separators=(",", ":")).replace("<", "\\u003c")
+
+
+def _copy_frontend_dist(config: DeployConfig, build_dir: Path) -> None:
+    """Copy the pre-built bundle into build_dir and rewrite the config placeholder."""
+    if not _FRONTEND_DIST_SRC.is_dir():
+        msg = (
+            f"Shipped frontend bundle not found at {_FRONTEND_DIST_SRC}. "
+            "Did you run `make build-frontends`?"
+        )
+        raise RuntimeError(msg)
+
+    dest = build_dir / "frontend_dist"
+    if dest.exists():
+        shutil.rmtree(dest)
+    shutil.copytree(_FRONTEND_DIST_SRC, dest)
+
+    index_html = dest / "index.html"
+    if not index_html.is_file():
+        msg = f"expected index.html inside {_FRONTEND_DIST_SRC}"
+        raise RuntimeError(msg)
+
+    html = index_html.read_text(encoding="utf-8")
+    payload = _build_runtime_config_json(config)
+    replacement = f"window.__DEEPAGENTS_CONFIG__ = {payload};"
+    new_html, count = _FRONTEND_PLACEHOLDER_RE.subn(
+        lambda _m: replacement,
+        html,
+        count=1,
+    )
+    if count == 0:
+        msg = (
+            "Could not find window.__DEEPAGENTS_CONFIG__ placeholder in the "
+            "shipped index.html. The frontend bundle is out of sync with the "
+            "bundler — rebuild with `make build-frontends`."
+        )
+        raise RuntimeError(msg)
+    index_html.write_text(new_html, encoding="utf-8")
+
 
 def bundle(
     config: DeployConfig,
@@ -127,18 +221,38 @@ def bundle(
     )
     logger.info("Generated deploy_graph.py")
 
-    # 6. Generate auth.py if [auth] is configured.
-    auth_present = config.auth is not None
-    if config.auth is not None:
+    # 6. Generate auth.py from the [auth] provider, if any. Skipped
+    # entirely when [auth] is omitted — in that case LangSmith Cloud's
+    # default x-api-key auth applies. Validation guarantees [auth] is
+    # set whenever [frontend].enabled, so auth.py is always present
+    # for frontend deploys (including the "anonymous" provider, whose
+    # permissive handler lets the bundled UI reach /threads).
+    frontend_enabled = config.frontend is not None and config.frontend.enabled
+    auth_provider: str | None = (
+        config.auth.provider if config.auth is not None else None
+    )
+
+    auth_present = auth_provider is not None
+    if auth_provider is not None:
         (build_dir / "auth.py").write_text(
-            _render_auth_py(config.auth.provider),
+            _render_auth_py(auth_provider),
             encoding="utf-8",
         )
-        logger.info("Generated auth.py (%s)", config.auth.provider)
+        logger.info("Generated auth.py (%s)", auth_provider)
+
+    # 6b. Copy frontend bundle when enabled.
+    if frontend_enabled:
+        _copy_frontend_dist(config, build_dir)
+        (build_dir / "app.py").write_text(APP_PY_TEMPLATE, encoding="utf-8")
+        logger.info("Copied frontend bundle and wrote app.py (%s)", auth_provider)
 
     # 7. Render langgraph.json.
     (build_dir / "langgraph.json").write_text(
-        _render_langgraph_json(env_present=env_present, auth_present=auth_present),
+        _render_langgraph_json(
+            env_present=env_present,
+            auth_present=auth_present,
+            frontend_present=frontend_enabled,
+        ),
         encoding="utf-8",
     )
 
@@ -312,8 +426,13 @@ def _render_auth_py(provider: str) -> str:
     return auth_block + AUTH_ON_HANDLER
 
 
-def _render_langgraph_json(*, env_present: bool, auth_present: bool = False) -> str:
-    """Render `langgraph.json` — adds `"env"` and `"auth"` when applicable."""
+def _render_langgraph_json(
+    *,
+    env_present: bool,
+    auth_present: bool = False,
+    frontend_present: bool = False,
+) -> str:
+    """Render `langgraph.json` — adds `"env"`, `"auth"`, `"http"` when applicable."""
     data: dict = {
         "dependencies": ["."],
         "graphs": {"agent": "./deploy_graph.py:make_graph"},
@@ -323,6 +442,8 @@ def _render_langgraph_json(*, env_present: bool, auth_present: bool = False) ->
         data["env"] = ".env"
     if auth_present:
         data["auth"] = {"path": "./auth.py:auth"}
+    if frontend_present:
+        data["http"] = {"app": "./app.py:app"}
     return json.dumps(data, indent=2) + "\n"
 
 
@@ -392,7 +513,12 @@ def print_bundle_summary(config: DeployConfig, build_dir: Path) -> None:
     print(f"\n  Agent: {config.agent.name}")
     print(f"  Model: {config.agent.model}")
     if config.auth is not None:
-        print(f"  Auth: {config.auth.provider}")
+        if config.auth.provider == "anonymous":
+            print("  Auth: anonymous (API open to anyone)")
+        else:
+            print(f"  Auth: {config.auth.provider}")
+    else:
+        print("  Auth: none (LangSmith API key required to call the API)")
 
     memory_files = sorted(seed.get("memories", {}).keys())
     if memory_files:

{deepagents_cli-0.0.42 → deepagents_cli-0.0.43}/deepagents_cli/deploy/commands.py

@@ -265,6 +265,51 @@ def _deploy(
             print(f"  - {err}")
         raise SystemExit(1)
 
+    # Warn + confirm if the frontend was set to anonymous mode. The
+    # generated auth.py for this case is permissive (overrides the
+    # LangSmith default x-api-key requirement) so the API is reachable
+    # by anyone with the deploy URL.
+    is_anonymous = (
+        config.frontend is not None
+        and config.frontend.enabled
+        and config.auth is not None
+        and config.auth.provider == "anonymous"
+    )
+    if is_anonymous:
+        # ANSI bold-red header + red bullets so this warning is visually
+        # distinct from the yellow beta-warning that prints above it
+        # (otherwise the "Continue? [y/N]" prompt looks like it's
+        # confirming the beta line rather than the anonymous-auth line).
+        print(
+            "\033[1;31m⚠ This deploy will use ANONYMOUS auth. "
+            "The API is open to anyone with the deploy URL.\033[0m"
+        )
+        print(
+            "\033[31m  • Browser UI shows per-browser threads "
+            "(cookie-scoped UX, not security).\033[0m"
+        )
+        print(
+            "\033[31m  • Anyone with the URL can call the API directly "
+            "(curl /threads, /runs, etc.) — no auth.\033[0m"
+        )
+        print(
+            "\033[31m  • For real per-user auth, add an [auth] section "
+            '(provider = "supabase" or "clerk").\033[0m'
+        )
+        # Skip the interactive confirm on dry-run (no real push happens).
+        if not dry_run:
+            try:
+                answer = (
+                    input("Continue with anonymous deploy? [y/N]: ").strip().lower()
+                )
+            except (EOFError, KeyboardInterrupt):
+                print()
+                print("Aborted.")
+                raise SystemExit(1) from None
+            if answer not in {"y", "yes"}:
+                print("Aborted.")
+                raise SystemExit(1)
+
     # Bundle
     build_dir = Path(tempfile.mkdtemp(prefix="deepagents-deploy-"))
 

{deepagents_cli-0.0.42 → deepagents_cli-0.0.43}/deepagents_cli/deploy/config.py

@@ -36,8 +36,14 @@ VALID_SANDBOX_PROVIDERS: frozenset[str] = frozenset(get_args(SandboxProvider))
 
 VALID_SANDBOX_SCOPES: frozenset[str] = frozenset(get_args(SandboxScope))
 
-AuthProvider = Literal["supabase", "clerk"]
-"""Valid auth provider identifiers."""
+AuthProvider = Literal["supabase", "clerk", "anonymous"]
+"""Valid auth provider identifiers.
+
+`"anonymous"` ships a permissive auth handler that overrides LangSmith
+Cloud's default `x-api-key` requirement so the bundled frontend can
+reach `/threads`. The API is open to anyone with the deploy URL —
+per-browser thread scoping is enforced client-side via a UUID cookie.
+"""
 
 VALID_AUTH_PROVIDERS: frozenset[str] = frozenset(get_args(AuthProvider))
 """Valid auth providers for deploy."""
@@ -121,13 +127,38 @@ class SandboxConfig:
 class AuthConfig:
     """`[auth]` section — authentication provider settings.
 
-    The whole section is optional. When omitted, the deployed agent has
-    no authentication and all requests are anonymous.
+    The whole section is optional. When omitted, no `auth.py` is
+    generated and LangSmith Cloud's default `x-api-key` auth applies
+    (callers still need a LangSmith API key to reach the deployment).
+    To make the API genuinely open — e.g., to expose the bundled
+    `[frontend]` without sign-in — set `provider = "anonymous"`
+    explicitly.
     """
 
     provider: AuthProvider
 
 
+@dataclass(frozen=True)
+class FrontendConfig:
+    """`[frontend]` section — bundled default frontend settings.
+
+    When `enabled = True`, `deepagent deploy` copies a pre-built React
+    chat UI into the deployment alongside the agent. An `[auth]`
+    section is required in this case — pick `"supabase"` or `"clerk"`
+    for real per-user auth, or set `provider = "anonymous"` explicitly
+    to ship the UI with an open API.
+    """
+
+    enabled: bool = False
+    app_name: str | None = None
+    subtitle: str | None = None
+    """Subtitle shown under the app name in the header and on the
+    empty-state hero. Falls back to a generic default when unset."""
+    prompts: tuple[str, ...] | None = None
+    """Suggestion chips shown on the empty-state. Falls back to the
+    bundled defaults when unset."""
+
+
 @dataclass(frozen=True)
 class DeployConfig:
     """Top-level deploy configuration parsed from `deepagents.toml`."""
@@ -138,6 +169,7 @@ class DeployConfig:
     sandbox: SandboxConfig = field(default_factory=SandboxConfig)
     """Parsed `[sandbox]` section — provider, snapshot name, image, scope."""
     auth: AuthConfig | None = None
+    frontend: FrontendConfig | None = None
 
     def validate(self, project_root: Path) -> list[str]:
         """Validate config against the filesystem.
@@ -194,6 +226,16 @@ class DeployConfig:
         if self.auth is not None:
             errors.extend(_validate_auth_credentials(self.auth.provider))
 
+        if self.frontend is not None and self.frontend.enabled:
+            if self.auth is None:
+                errors.append(
+                    "[frontend].enabled requires [auth] to be configured. "
+                    'Add an [auth] section with provider = "supabase", '
+                    '"clerk", or "anonymous".'
+                )
+            else:
+                errors.extend(_validate_frontend_credentials(self.auth.provider))
+
         return errors
 
 
@@ -363,10 +405,11 @@ def load_config(config_path: Path) -> DeployConfig:
     return _parse_config(data)
 
 
-_ALLOWED_SECTIONS = frozenset({"agent", "sandbox", "auth"})
+_ALLOWED_SECTIONS = frozenset({"agent", "sandbox", "auth", "frontend"})
 _ALLOWED_AGENT_KEYS = frozenset({"name", "description", "model"})
 _ALLOWED_SANDBOX_KEYS = frozenset({"provider", "template", "image", "scope"})
 _ALLOWED_AUTH_KEYS = frozenset({"provider"})
+_ALLOWED_FRONTEND_KEYS = frozenset({"enabled", "app_name", "subtitle", "prompts"})
 
 
 def _parse_config(data: dict[str, Any]) -> DeployConfig:
@@ -442,7 +485,33 @@ def _parse_config(data: dict[str, Any]) -> DeployConfig:
 
         auth = AuthConfig(provider=auth_provider)
 
-    return DeployConfig(agent=agent, sandbox=sandbox, auth=auth)
+    frontend: FrontendConfig | None = None
+    frontend_data = data.get("frontend")
+    if frontend_data is not None:
+        unknown_frontend = set(frontend_data.keys()) - _ALLOWED_FRONTEND_KEYS
+        if unknown_frontend:
+            msg = (
+                f"Unknown key(s) in [frontend]: {sorted(unknown_frontend)}. "
+                f"Allowed: {sorted(_ALLOWED_FRONTEND_KEYS)}"
+            )
+            raise ValueError(msg)
+
+        frontend_kwargs: dict[str, Any] = {
+            k: frontend_data[k] for k in _ALLOWED_FRONTEND_KEYS if k in frontend_data
+        }
+        # FrontendConfig is frozen=True; coerce list -> tuple so the
+        # dataclass stays hashable.
+        if "prompts" in frontend_kwargs:
+            prompts_raw = frontend_kwargs["prompts"]
+            if not isinstance(prompts_raw, list) or not all(
+                isinstance(p, str) for p in prompts_raw
+            ):
+                msg = "[frontend].prompts must be a list of strings"
+                raise ValueError(msg)
+            frontend_kwargs["prompts"] = tuple(prompts_raw)
+        frontend = FrontendConfig(**frontend_kwargs)
+
+    return DeployConfig(agent=agent, sandbox=sandbox, auth=auth, frontend=frontend)
 
 
 _MODEL_PROVIDER_ENV: dict[str, str] = {
@@ -480,6 +549,16 @@ _AUTH_PROVIDER_ENV: dict[str, list[str]] = {
     "clerk": ["CLERK_SECRET_KEY"],
 }
 
+_FRONTEND_EXTRA_ENV: dict[str, list[str]] = {
+    # Supabase reuses `SUPABASE_URL` + `SUPABASE_PUBLISHABLE_DEFAULT_KEY`
+    # from [auth] — no extra browser-facing env vars needed.
+    "supabase": [],
+    # Clerk's browser-facing publishable key is distinct from
+    # `CLERK_SECRET_KEY` (which [auth] uses for JWKS validation).
+    "clerk": ["CLERK_PUBLISHABLE_KEY"],
+}
+"""Additional env vars the frontend bundle needs beyond what `[auth]` requires."""
+
 
 def _validate_model_credentials(model: str) -> list[str]:
     """Check that the API key env var is set for the model provider."""
@@ -530,6 +609,23 @@ def _validate_auth_credentials(provider: str) -> list[str]:
     ]
 
 
+def _validate_frontend_credentials(provider: str) -> list[str]:
+    """Check that all extra env vars are set for the frontend bundle."""
+    required = _FRONTEND_EXTRA_ENV.get(provider)
+    if required is None:
+        return []
+    missing = [v for v in required if not os.environ.get(v)]
+    if not missing:
+        return []
+    return [
+        (
+            f"Frontend for '{provider}' requires {' and '.join(missing)}. "
+            f"Add it to your .env file so the bundler can write it "
+            f"into index.html at deploy time."
+        ),
+    ]
+
+
 def find_config(start_path: Path | None = None) -> Path | None:
     """Find `deepagents.toml` in *start_path* (or cwd if not given).
 
@@ -558,7 +654,16 @@ model = "anthropic:claude-sonnet-4-6"
 
 # [auth] is optional. Add to enable user authentication.
 # [auth]
-# provider = "supabase"   # supabase | clerk
+# provider = "supabase"   # supabase | clerk | anonymous
+
+# [frontend] is optional. Add to ship a bundled chat UI on the same
+# deployment as the agent. Requires [auth] — pick "supabase" or
+# "clerk" for real per-user auth, or set provider = "anonymous" to
+# leave the API open to anyone with the deploy URL (private/dev
+# deploys only).
+# [frontend]
+# enabled = true
+# app_name = "My Agent"
 """
 
 
@@ -589,6 +694,10 @@ LANGSMITH_API_KEY=
 # SUPABASE_URL=
 # SUPABASE_PUBLISHABLE_DEFAULT_KEY=
 # CLERK_SECRET_KEY=
+
+# Frontend (optional, uncomment for [frontend] + matching [auth])
+# Clerk only — browser-facing publishable key. Supabase reuses the keys above.
+# CLERK_PUBLISHABLE_KEY=
 """
 
 

deepagents_cli-0.0.43/deepagents_cli/deploy/frontend_dist/assets/anonymous-B9UzAXQd.js

@@ -0,0 +1 @@
+import{j as o}from"./index-DM3gptpu.js";const i="dap_anon_id";function s(n){if(typeof document>"u")return null;const e=n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),t=document.cookie.match(new RegExp(`(?:^|; )${e}=([^;]*)`));return t?decodeURIComponent(t[1]):null}function r(n,e){typeof document>"u"||(document.cookie=`${n}=${encodeURIComponent(e)}; max-age=31536000; path=/; SameSite=Lax`)}function u(){if(typeof crypto>"u")return"anon";const n=s(i);if(n)return n;const e=crypto.randomUUID();return r(i,e),e}const c={status:"signed-in",accessToken:"",userIdentity:u(),userEmail:null,isAnonymous:!0,signOut:async()=>{}},a={Provider:({children:n})=>o.jsx(o.Fragment,{children:n}),useSession:()=>c,AuthUI:()=>null};export{a as default};