deepagents-cli 0.0.42__tar.gz → 0.0.44__tar.gz

{deepagents_cli-0.0.42 → deepagents_cli-0.0.44}/.gitignore

@@ -15,6 +15,7 @@ downloads/
 eggs/
 .eggs/
 lib/
+!libs/cli/frontend/src/lib/
 lib64/
 parts/
 sdist/
@@ -227,3 +228,8 @@ libs/cli/TEXTUAL_PROGRESS.md
 
 CLAUDE.md
 .worktrees/
+
+# Frontend build artifacts (source tree; package data under libs/cli/deepagents_cli/deploy/frontend_dist/ is tracked)
+libs/cli/frontend/node_modules/
+libs/cli/frontend/dist/
+node_modules/

{deepagents_cli-0.0.42 → deepagents_cli-0.0.44}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.0.44](https://github.com/langchain-ai/deepagents/compare/deepagents-cli==0.0.43...deepagents-cli==0.0.44) (2026-04-29)
+
+### Bug Fixes
+
+* Startup import deadlock ([#3017](https://github.com/langchain-ai/deepagents/issues/3017)) ([d40ab57](https://github.com/langchain-ai/deepagents/commit/d40ab57800a6ad12b0c9a5e249753702ec0832c8))
+
+## [0.0.43](https://github.com/langchain-ai/deepagents/compare/deepagents-cli==0.0.42...deepagents-cli==0.0.43) (2026-04-29)
+
+### Features
+
+* Bundled chat frontend for deepagent deploy ([#2940](https://github.com/langchain-ai/deepagents/issues/2940)) ([9bde0c7](https://github.com/langchain-ai/deepagents/commit/9bde0c7835ded20e80466d8361f40784141d68d8))
+
 ## [0.0.42](https://github.com/langchain-ai/deepagents/compare/deepagents-cli==0.0.41...deepagents-cli==0.0.42) (2026-04-29)
 
 ### Features

{deepagents_cli-0.0.42 → deepagents_cli-0.0.44}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: deepagents-cli
-Version: 0.0.42
+Version: 0.0.44
 Summary: Terminal interface for Deep Agents - interactive AI agent with file operations, shell access, and sub-agent capabilities.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/
 Project-URL: Repository, https://github.com/langchain-ai/deepagents
 Project-URL: Issues, https://github.com/langchain-ai/deepagents/issues
 Project-URL: Changelog, https://github.com/langchain-ai/deepagents/blob/main/libs/cli/CHANGELOG.md
-Project-URL: Twitter, https://x.com/LangChain
+Project-URL: Twitter, https://x.com/langchain_oss
 Project-URL: Slack, https://www.langchain.com/join-community
 Project-URL: Reddit, https://www.reddit.com/r/LangChain/
 License: MIT
@@ -30,9 +30,9 @@ Requires-Dist: deepagents-acp>=0.0.4
 Requires-Dist: deepagents==0.5.4
 Requires-Dist: httpx<1.0.0,>=0.28.1
 Requires-Dist: langchain-anthropic<2.0.0,>=1.4.2
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.1
-Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.2.0
-Requires-Dist: langchain-openai<2.0.0,>=1.1.12
+Requires-Dist: langchain-google-genai<5.0.0,>=4.2.2
+Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.2.2
+Requires-Dist: langchain-openai<2.0.0,>=1.2.1
 Requires-Dist: langchain<2.0.0,>=1.2.15
 Requires-Dist: langgraph-checkpoint-sqlite<4.0.0,>=3.0.0
 Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.15
@@ -55,76 +55,76 @@ Requires-Dist: textual<9.0.0,>=8.0.0
 Requires-Dist: tomli-w<2.0.0,>=1.0.0
 Requires-Dist: uuid-utils<1.0.0,>=0.10.0
 Provides-Extra: agentcore
-Requires-Dist: langchain-agentcore-codeinterpreter>=0.0.1; extra == 'agentcore'
+Requires-Dist: langchain-agentcore-codeinterpreter>=0.0.2; extra == 'agentcore'
 Provides-Extra: all-providers
 Requires-Dist: langchain-anthropic<2.0.0,>=1.4.2; extra == 'all-providers'
-Requires-Dist: langchain-aws<2.0.0,>=1.0.0; extra == 'all-providers'
-Requires-Dist: langchain-baseten<1.0.0,>=0.1.9; extra == 'all-providers'
-Requires-Dist: langchain-cohere<1.0.0,>=0.5.0; extra == 'all-providers'
-Requires-Dist: langchain-deepseek<2.0.0,>=1.0.0; extra == 'all-providers'
-Requires-Dist: langchain-fireworks<2.0.0,>=1.0.0; extra == 'all-providers'
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.1; extra == 'all-providers'
-Requires-Dist: langchain-google-vertexai<4.0.0,>=3.0.0; extra == 'all-providers'
-Requires-Dist: langchain-groq<2.0.0,>=1.0.0; extra == 'all-providers'
-Requires-Dist: langchain-huggingface<2.0.0,>=1.0.0; extra == 'all-providers'
-Requires-Dist: langchain-ibm<2.0.0,>=1.0.0; extra == 'all-providers'
-Requires-Dist: langchain-litellm<2.0.0,>=0.6.1; extra == 'all-providers'
-Requires-Dist: langchain-mistralai<2.0.0,>=1.0.0; extra == 'all-providers'
-Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.0.0; extra == 'all-providers'
-Requires-Dist: langchain-ollama<2.0.0,>=1.0.0; extra == 'all-providers'
-Requires-Dist: langchain-openai<2.0.0,>=1.1.12; extra == 'all-providers'
-Requires-Dist: langchain-openrouter<2.0.0,>=0.2.0; extra == 'all-providers'
-Requires-Dist: langchain-perplexity<2.0.0,>=1.0.0; extra == 'all-providers'
-Requires-Dist: langchain-xai<2.0.0,>=1.0.0; extra == 'all-providers'
+Requires-Dist: langchain-aws<2.0.0,>=1.4.5; extra == 'all-providers'
+Requires-Dist: langchain-baseten<1.0.0,>=0.2.0; extra == 'all-providers'
+Requires-Dist: langchain-cohere<1.0.0,>=0.5.1; extra == 'all-providers'
+Requires-Dist: langchain-deepseek<2.0.0,>=1.0.1; extra == 'all-providers'
+Requires-Dist: langchain-fireworks<2.0.0,>=1.2.0; extra == 'all-providers'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.2.2; extra == 'all-providers'
+Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.2; extra == 'all-providers'
+Requires-Dist: langchain-groq<2.0.0,>=1.1.2; extra == 'all-providers'
+Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'all-providers'
+Requires-Dist: langchain-ibm<2.0.0,>=1.0.7; extra == 'all-providers'
+Requires-Dist: langchain-litellm<2.0.0,>=0.6.4; extra == 'all-providers'
+Requires-Dist: langchain-mistralai<2.0.0,>=1.1.2; extra == 'all-providers'
+Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.2.1; extra == 'all-providers'
+Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'all-providers'
+Requires-Dist: langchain-openai<2.0.0,>=1.2.1; extra == 'all-providers'
+Requires-Dist: langchain-openrouter<2.0.0,>=0.2.1; extra == 'all-providers'
+Requires-Dist: langchain-perplexity<2.0.0,>=1.1.0; extra == 'all-providers'
+Requires-Dist: langchain-xai<2.0.0,>=1.2.2; extra == 'all-providers'
 Provides-Extra: all-sandboxes
-Requires-Dist: langchain-agentcore-codeinterpreter>=0.0.1; extra == 'all-sandboxes'
-Requires-Dist: langchain-daytona>=0.0.4; extra == 'all-sandboxes'
-Requires-Dist: langchain-modal>=0.0.2; extra == 'all-sandboxes'
-Requires-Dist: langchain-runloop>=0.0.3; extra == 'all-sandboxes'
+Requires-Dist: langchain-agentcore-codeinterpreter>=0.0.2; extra == 'all-sandboxes'
+Requires-Dist: langchain-daytona>=0.0.5; extra == 'all-sandboxes'
+Requires-Dist: langchain-modal>=0.0.3; extra == 'all-sandboxes'
+Requires-Dist: langchain-runloop>=0.0.4; extra == 'all-sandboxes'
 Provides-Extra: anthropic
 Requires-Dist: langchain-anthropic<2.0.0,>=1.4.2; extra == 'anthropic'
 Provides-Extra: baseten
-Requires-Dist: langchain-baseten<1.0.0,>=0.1.9; extra == 'baseten'
+Requires-Dist: langchain-baseten<1.0.0,>=0.2.0; extra == 'baseten'
 Provides-Extra: bedrock
-Requires-Dist: langchain-aws<2.0.0,>=1.0.0; extra == 'bedrock'
+Requires-Dist: langchain-aws<2.0.0,>=1.4.5; extra == 'bedrock'
 Provides-Extra: cohere
-Requires-Dist: langchain-cohere<1.0.0,>=0.5.0; extra == 'cohere'
+Requires-Dist: langchain-cohere<1.0.0,>=0.5.1; extra == 'cohere'
 Provides-Extra: daytona
-Requires-Dist: langchain-daytona>=0.0.4; extra == 'daytona'
+Requires-Dist: langchain-daytona>=0.0.5; extra == 'daytona'
 Provides-Extra: deepseek
-Requires-Dist: langchain-deepseek<2.0.0,>=1.0.0; extra == 'deepseek'
+Requires-Dist: langchain-deepseek<2.0.0,>=1.0.1; extra == 'deepseek'
 Provides-Extra: fireworks
-Requires-Dist: langchain-fireworks<2.0.0,>=1.0.0; extra == 'fireworks'
+Requires-Dist: langchain-fireworks<2.0.0,>=1.2.0; extra == 'fireworks'
 Provides-Extra: google-genai
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.1; extra == 'google-genai'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.2.2; extra == 'google-genai'
 Provides-Extra: groq
-Requires-Dist: langchain-groq<2.0.0,>=1.0.0; extra == 'groq'
+Requires-Dist: langchain-groq<2.0.0,>=1.1.2; extra == 'groq'
 Provides-Extra: huggingface
-Requires-Dist: langchain-huggingface<2.0.0,>=1.0.0; extra == 'huggingface'
+Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'huggingface'
 Provides-Extra: ibm
-Requires-Dist: langchain-ibm<2.0.0,>=1.0.0; extra == 'ibm'
+Requires-Dist: langchain-ibm<2.0.0,>=1.0.7; extra == 'ibm'
 Provides-Extra: litellm
-Requires-Dist: langchain-litellm<2.0.0,>=0.6.1; extra == 'litellm'
+Requires-Dist: langchain-litellm<2.0.0,>=0.6.4; extra == 'litellm'
 Provides-Extra: mistralai
-Requires-Dist: langchain-mistralai<2.0.0,>=1.0.0; extra == 'mistralai'
+Requires-Dist: langchain-mistralai<2.0.0,>=1.1.2; extra == 'mistralai'
 Provides-Extra: modal
-Requires-Dist: langchain-modal>=0.0.2; extra == 'modal'
+Requires-Dist: langchain-modal>=0.0.3; extra == 'modal'
 Provides-Extra: nvidia
-Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.0.0; extra == 'nvidia'
+Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.2.1; extra == 'nvidia'
 Provides-Extra: ollama
-Requires-Dist: langchain-ollama<2.0.0,>=1.0.0; extra == 'ollama'
+Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'ollama'
 Provides-Extra: openai
-Requires-Dist: langchain-openai<2.0.0,>=1.1.12; extra == 'openai'
+Requires-Dist: langchain-openai<2.0.0,>=1.2.1; extra == 'openai'
 Provides-Extra: openrouter
-Requires-Dist: langchain-openrouter<2.0.0,>=0.2.0; extra == 'openrouter'
+Requires-Dist: langchain-openrouter<2.0.0,>=0.2.1; extra == 'openrouter'
 Provides-Extra: perplexity
-Requires-Dist: langchain-perplexity<2.0.0,>=1.0.0; extra == 'perplexity'
+Requires-Dist: langchain-perplexity<2.0.0,>=1.1.0; extra == 'perplexity'
 Provides-Extra: runloop
-Requires-Dist: langchain-runloop>=0.0.3; extra == 'runloop'
+Requires-Dist: langchain-runloop>=0.0.4; extra == 'runloop'
 Provides-Extra: vertexai
-Requires-Dist: langchain-google-vertexai<4.0.0,>=3.0.0; extra == 'vertexai'
+Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.2; extra == 'vertexai'
 Provides-Extra: xai
-Requires-Dist: langchain-xai<2.0.0,>=1.0.0; extra == 'xai'
+Requires-Dist: langchain-xai<2.0.0,>=1.2.2; extra == 'xai'
 Description-Content-Type: text/markdown
 
 # 🧠🤖 Deep Agents CLI
@@ -132,7 +132,7 @@ Description-Content-Type: text/markdown
 [![PyPI - Version](https://img.shields.io/pypi/v/deepagents-cli?label=%20)](https://pypi.org/project/deepagents-cli/#history)
 [![PyPI - License](https://img.shields.io/pypi/l/deepagents-cli)](https://opensource.org/licenses/MIT)
 [![PyPI - Downloads](https://img.shields.io/pepy/dt/deepagents-cli)](https://pypistats.org/packages/deepagents-cli)
-[![Twitter](https://img.shields.io/twitter/url/https/twitter.com/langchain.svg?style=social&label=Follow%20%40LangChain)](https://x.com/langchain)
+[![Twitter](https://img.shields.io/twitter/url/https/twitter.com/langchain_oss.svg?style=social&label=Follow%20%40LangChain)](https://x.com/langchain_oss)
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/langchain-ai/deepagents/main/libs/cli/images/cli.png" alt="Deep Agents CLI" width="600"/>

{deepagents_cli-0.0.42 → deepagents_cli-0.0.44}/README.md

@@ -3,7 +3,7 @@
 [![PyPI - Version](https://img.shields.io/pypi/v/deepagents-cli?label=%20)](https://pypi.org/project/deepagents-cli/#history)
 [![PyPI - License](https://img.shields.io/pypi/l/deepagents-cli)](https://opensource.org/licenses/MIT)
 [![PyPI - Downloads](https://img.shields.io/pepy/dt/deepagents-cli)](https://pypistats.org/packages/deepagents-cli)
-[![Twitter](https://img.shields.io/twitter/url/https/twitter.com/langchain.svg?style=social&label=Follow%20%40LangChain)](https://x.com/langchain)
+[![Twitter](https://img.shields.io/twitter/url/https/twitter.com/langchain_oss.svg?style=social&label=Follow%20%40LangChain)](https://x.com/langchain_oss)
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/langchain-ai/deepagents/main/libs/cli/images/cli.png" alt="Deep Agents CLI" width="600"/>

{deepagents_cli-0.0.42 → deepagents_cli-0.0.44}/deepagents_cli/_version.py

@@ -1,6 +1,6 @@
 """Version information and lightweight constants for `deepagents-cli`."""
 
-__version__ = "0.0.42"  # x-release-please-version
+__version__ = "0.0.44"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/cli"
 """URL for `deepagents-cli` documentation."""

{deepagents_cli-0.0.42 → deepagents_cli-0.0.44}/deepagents_cli/app.py

@@ -849,6 +849,13 @@ class DeepAgentsApp(App):
         self._shell_running = False
         """True while a `!` shell command is executing."""
 
+        self._prewarm_worker: Worker[None] | None = None
+        """Background worker that prewarms `deepagents`/LangChain imports.
+
+        Awaited via `_await_prewarm_imports` before any caller on the event
+        loop re-enters the same module graph (see that method for why).
+        """
+
         # Lifecycle flags & re-entry guards
         self._connecting = server_kwargs is not None
         """True while the backing server is being started or restarted.
@@ -1038,6 +1045,39 @@ class DeepAgentsApp(App):
         colors = theme.get_theme_colors(self)
         return theme.get_css_variable_defaults(colors=colors)
 
+    def _fatal_error(self) -> None:
+        """Render an unhandled-exception traceback without leaking secrets.
+
+        Textual's default `_fatal_error` renders with `show_locals=True`,
+        which prints local variables — including resolved API keys carried
+        in `kwargs` dicts on the call path through `create_model`. Locals
+        are only re-enabled when `DEEPAGENTS_CLI_DEBUG` matches a truthy
+        token (`"1"`, `"true"`, `"yes"`); any other value, including `"0"`
+        and `"false"`, leaves them disabled.
+        """
+        try:
+            import rich
+            from rich.segment import Segments
+            from rich.traceback import Traceback
+
+            from deepagents_cli._env_vars import DEBUG
+        except Exception:  # noqa: BLE001  # mid-teardown import errors fall through to Textual's default rather than double-fault and swallow the original crash
+            super()._fatal_error()
+            return
+
+        self.bell()
+        show_locals = os.environ.get(DEBUG, "").lower() in {"1", "true", "yes"}
+        traceback = Traceback(
+            show_locals=show_locals,
+            width=None,
+            locals_max_length=5,
+            suppress=[rich],
+        )
+        self._exit_renderables.append(
+            Segments(self.console.render(traceback, self.console.options))
+        )
+        self._close_messages_no_wait()
+
     def compose(self) -> ComposeResult:
         """Compose the application layout.
 
@@ -1108,7 +1148,8 @@ class DeepAgentsApp(App):
         # Prewarm heavy imports in a thread while the first frame renders.
         # The user can't type yet, so GIL contention is harmless.  By the
         # time _post_paint_init fires its inline imports are dict lookups.
-        self.run_worker(
+        # Handle is captured so `_await_prewarm_imports` can block on it.
+        self._prewarm_worker = self.run_worker(
             asyncio.to_thread(self._prewarm_deferred_imports),
             exclusive=True,
             group="startup-import-prewarm",
@@ -1580,6 +1621,10 @@ class DeepAgentsApp(App):
         # does the heavy langchain import + SDK init and may refine them
         # (e.g., context_limit from the model profile).
         if self._model_kwargs is not None:
+            # Block on prewarm before re-entering the import graph; see
+            # `_await_prewarm_imports` for the deadlock rationale.
+            await self._await_prewarm_imports()
+
             from deepagents_cli.config import create_model
             from deepagents_cli.model_config import ModelConfigError, save_recent_model
 
@@ -1719,6 +1764,30 @@ class DeepAgentsApp(App):
             self._queued_widgets.clear()
         self._deferred_actions.clear()
 
+    async def _await_prewarm_imports(self) -> None:
+        """Wait for prewarm imports before re-entering their module graph.
+
+        Prevents a multi-threaded import deadlock: the prewarm worker runs in
+        `asyncio.to_thread`, and any caller that imports `deepagents` or
+        LangChain from the event-loop thread while it's still running can
+        race on partially-initialized module locks.
+
+        `CancelledError` propagates so app shutdown isn't silently absorbed.
+        """
+        from textual.worker import WorkerFailed
+
+        worker = self._prewarm_worker
+        if worker is None:
+            return
+        try:
+            await worker.wait()
+        except WorkerFailed:
+            # Prewarm body best-efforts third-party imports and already
+            # warns; logging at WARNING here surfaces unexpected failures
+            # (e.g. a regression that breaks a non-optional import) that
+            # the body itself didn't catch.
+            logger.warning("Import prewarm worker failed", exc_info=True)
+
     @staticmethod
     def _prewarm_deferred_imports() -> None:
         """Background-load modules deferred from the startup path.

{deepagents_cli-0.0.42 → deepagents_cli-0.0.44}/deepagents_cli/deploy/bundler.py

@@ -25,6 +25,8 @@ from __future__ import annotations
 
 import json
 import logging
+import os
+import re
 import shutil
 from pathlib import Path
 from typing import Any
@@ -39,6 +41,7 @@ from deepagents_cli.deploy.config import (
     load_subagents,
 )
 from deepagents_cli.deploy.templates import (
+    APP_PY_TEMPLATE,
     AUTH_BLOCKS,
     AUTH_ON_HANDLER,
     DEPLOY_GRAPH_TEMPLATE,
@@ -69,6 +72,97 @@ _MODEL_PROVIDER_DEPS: dict[str, str] = {
 }
 """Dependencies inferred from a provider: prefix on the model string."""
 
+_FRONTEND_DIST_SRC = Path(__file__).parent / "frontend_dist"
+"""Location of the shipped pre-built frontend, inside this Python package."""
+
+_FRONTEND_PLACEHOLDER_RE = re.compile(
+    r"window\.__DEEPAGENTS_CONFIG__\s*=\s*\{[^<]*?\};",
+    re.DOTALL,
+)
+"""Matches the placeholder script we injected into index.html at build time."""
+
+
+def _build_runtime_config_json(config: DeployConfig) -> str:
+    """Build the JSON value injected into `window.__DEEPAGENTS_CONFIG__`.
+
+    Only reached when `[frontend].enabled` and `[auth]` is set —
+    validation guarantees both. The `is None` guards below exist so
+    the optional fields narrow for type-checkers.
+    """
+    if config.frontend is None:
+        msg = "runtime config requires [frontend] to be configured"
+        raise ValueError(msg)
+    if config.auth is None:
+        msg = "runtime config requires [auth] to be configured"
+        raise ValueError(msg)
+
+    app_name = config.frontend.app_name or config.agent.name
+    payload: dict[str, Any] = {
+        "appName": app_name,
+        "assistantId": "agent",
+    }
+    # Optional UI-customization fields — only injected when the user
+    # set them, so the default-bundle case stays small.
+    if config.frontend.subtitle is not None:
+        payload["subtitle"] = config.frontend.subtitle
+    if config.frontend.prompts is not None:
+        payload["prompts"] = list(config.frontend.prompts)
+
+    provider = config.auth.provider
+    payload["auth"] = provider
+    if provider == "supabase":
+        payload["supabaseUrl"] = os.environ["SUPABASE_URL"]
+        payload["supabaseAnonKey"] = os.environ["SUPABASE_PUBLISHABLE_DEFAULT_KEY"]
+    elif provider == "clerk":
+        payload["clerkPublishableKey"] = os.environ["CLERK_PUBLISHABLE_KEY"]
+    elif provider == "anonymous":
+        # No env vars; payload["auth"] = "anonymous" is enough.
+        pass
+    else:
+        msg = f"Unknown auth provider for frontend: {provider}"
+        raise ValueError(msg)
+
+    # Escape `<` so a hostile or accidental `</script>` inside a string value
+    # can't break out of the inline <script> tag.
+    return json.dumps(payload, separators=(",", ":")).replace("<", "\\u003c")
+
+
+def _copy_frontend_dist(config: DeployConfig, build_dir: Path) -> None:
+    """Copy the pre-built bundle into build_dir and rewrite the config placeholder."""
+    if not _FRONTEND_DIST_SRC.is_dir():
+        msg = (
+            f"Shipped frontend bundle not found at {_FRONTEND_DIST_SRC}. "
+            "Did you run `make build-frontends`?"
+        )
+        raise RuntimeError(msg)
+
+    dest = build_dir / "frontend_dist"
+    if dest.exists():
+        shutil.rmtree(dest)
+    shutil.copytree(_FRONTEND_DIST_SRC, dest)
+
+    index_html = dest / "index.html"
+    if not index_html.is_file():
+        msg = f"expected index.html inside {_FRONTEND_DIST_SRC}"
+        raise RuntimeError(msg)
+
+    html = index_html.read_text(encoding="utf-8")
+    payload = _build_runtime_config_json(config)
+    replacement = f"window.__DEEPAGENTS_CONFIG__ = {payload};"
+    new_html, count = _FRONTEND_PLACEHOLDER_RE.subn(
+        lambda _m: replacement,
+        html,
+        count=1,
+    )
+    if count == 0:
+        msg = (
+            "Could not find window.__DEEPAGENTS_CONFIG__ placeholder in the "
+            "shipped index.html. The frontend bundle is out of sync with the "
+            "bundler — rebuild with `make build-frontends`."
+        )
+        raise RuntimeError(msg)
+    index_html.write_text(new_html, encoding="utf-8")
+
 
 def bundle(
     config: DeployConfig,
@@ -127,18 +221,38 @@ def bundle(
     )
     logger.info("Generated deploy_graph.py")
 
-    # 6. Generate auth.py if [auth] is configured.
-    auth_present = config.auth is not None
-    if config.auth is not None:
+    # 6. Generate auth.py from the [auth] provider, if any. Skipped
+    # entirely when [auth] is omitted — in that case LangSmith Cloud's
+    # default x-api-key auth applies. Validation guarantees [auth] is
+    # set whenever [frontend].enabled, so auth.py is always present
+    # for frontend deploys (including the "anonymous" provider, whose
+    # permissive handler lets the bundled UI reach /threads).
+    frontend_enabled = config.frontend is not None and config.frontend.enabled
+    auth_provider: str | None = (
+        config.auth.provider if config.auth is not None else None
+    )
+
+    auth_present = auth_provider is not None
+    if auth_provider is not None:
         (build_dir / "auth.py").write_text(
-            _render_auth_py(config.auth.provider),
+            _render_auth_py(auth_provider),
             encoding="utf-8",
         )
-        logger.info("Generated auth.py (%s)", config.auth.provider)
+        logger.info("Generated auth.py (%s)", auth_provider)
+
+    # 6b. Copy frontend bundle when enabled.
+    if frontend_enabled:
+        _copy_frontend_dist(config, build_dir)
+        (build_dir / "app.py").write_text(APP_PY_TEMPLATE, encoding="utf-8")
+        logger.info("Copied frontend bundle and wrote app.py (%s)", auth_provider)
 
     # 7. Render langgraph.json.
     (build_dir / "langgraph.json").write_text(
-        _render_langgraph_json(env_present=env_present, auth_present=auth_present),
+        _render_langgraph_json(
+            env_present=env_present,
+            auth_present=auth_present,
+            frontend_present=frontend_enabled,
+        ),
         encoding="utf-8",
     )
 
@@ -312,8 +426,13 @@ def _render_auth_py(provider: str) -> str:
     return auth_block + AUTH_ON_HANDLER
 
 
-def _render_langgraph_json(*, env_present: bool, auth_present: bool = False) -> str:
-    """Render `langgraph.json` — adds `"env"` and `"auth"` when applicable."""
+def _render_langgraph_json(
+    *,
+    env_present: bool,
+    auth_present: bool = False,
+    frontend_present: bool = False,
+) -> str:
+    """Render `langgraph.json` — adds `"env"`, `"auth"`, `"http"` when applicable."""
     data: dict = {
         "dependencies": ["."],
         "graphs": {"agent": "./deploy_graph.py:make_graph"},
@@ -323,6 +442,8 @@ def _render_langgraph_json(*, env_present: bool, auth_present: bool = False) ->
         data["env"] = ".env"
     if auth_present:
         data["auth"] = {"path": "./auth.py:auth"}
+    if frontend_present:
+        data["http"] = {"app": "./app.py:app"}
     return json.dumps(data, indent=2) + "\n"
 
 
@@ -392,7 +513,12 @@ def print_bundle_summary(config: DeployConfig, build_dir: Path) -> None:
     print(f"\n  Agent: {config.agent.name}")
     print(f"  Model: {config.agent.model}")
     if config.auth is not None:
-        print(f"  Auth: {config.auth.provider}")
+        if config.auth.provider == "anonymous":
+            print("  Auth: anonymous (API open to anyone)")
+        else:
+            print(f"  Auth: {config.auth.provider}")
+    else:
+        print("  Auth: none (LangSmith API key required to call the API)")
 
     memory_files = sorted(seed.get("memories", {}).keys())
     if memory_files:

{deepagents_cli-0.0.42 → deepagents_cli-0.0.44}/deepagents_cli/deploy/commands.py

@@ -265,6 +265,51 @@ def _deploy(
             print(f"  - {err}")
         raise SystemExit(1)
 
+    # Warn + confirm if the frontend was set to anonymous mode. The
+    # generated auth.py for this case is permissive (overrides the
+    # LangSmith default x-api-key requirement) so the API is reachable
+    # by anyone with the deploy URL.
+    is_anonymous = (
+        config.frontend is not None
+        and config.frontend.enabled
+        and config.auth is not None
+        and config.auth.provider == "anonymous"
+    )
+    if is_anonymous:
+        # ANSI bold-red header + red bullets so this warning is visually
+        # distinct from the yellow beta-warning that prints above it
+        # (otherwise the "Continue? [y/N]" prompt looks like it's
+        # confirming the beta line rather than the anonymous-auth line).
+        print(
+            "\033[1;31m⚠ This deploy will use ANONYMOUS auth. "
+            "The API is open to anyone with the deploy URL.\033[0m"
+        )
+        print(
+            "\033[31m  • Browser UI shows per-browser threads "
+            "(cookie-scoped UX, not security).\033[0m"
+        )
+        print(
+            "\033[31m  • Anyone with the URL can call the API directly "
+            "(curl /threads, /runs, etc.) — no auth.\033[0m"
+        )
+        print(
+            "\033[31m  • For real per-user auth, add an [auth] section "
+            '(provider = "supabase" or "clerk").\033[0m'
+        )
+        # Skip the interactive confirm on dry-run (no real push happens).
+        if not dry_run:
+            try:
+                answer = (
+                    input("Continue with anonymous deploy? [y/N]: ").strip().lower()
+                )
+            except (EOFError, KeyboardInterrupt):
+                print()
+                print("Aborted.")
+                raise SystemExit(1) from None
+            if answer not in {"y", "yes"}:
+                print("Aborted.")
+                raise SystemExit(1)
+
     # Bundle
     build_dir = Path(tempfile.mkdtemp(prefix="deepagents-deploy-"))