deepagents-cli 0.0.44__tar.gz → 0.0.45__tar.gz

{deepagents_cli-0.0.44 → deepagents_cli-0.0.45}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.0.45](https://github.com/langchain-ai/deepagents/compare/deepagents-cli==0.0.44...deepagents-cli==0.0.45) (2026-04-30)
+
+### Bug Fixes
+
+* Reject out-of-tree symlinked project `AGENTS.md` ([#3039](https://github.com/langchain-ai/deepagents/issues/3039)) ([4618098](https://github.com/langchain-ai/deepagents/commit/4618098e59c8c8d1d3f91354e4f4163a9582f710))
+* Support modified backspace word deletion ([#3037](https://github.com/langchain-ai/deepagents/issues/3037)) ([bc3d019](https://github.com/langchain-ai/deepagents/commit/bc3d01916d2ba34be07d56c9eb9b813008c1584c))
+
 ## [0.0.44](https://github.com/langchain-ai/deepagents/compare/deepagents-cli==0.0.43...deepagents-cli==0.0.44) (2026-04-29)
 
 ### Bug Fixes

{deepagents_cli-0.0.44 → deepagents_cli-0.0.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepagents-cli
-Version: 0.0.44
+Version: 0.0.45
 Summary: Terminal interface for Deep Agents - interactive AI agent with file operations, shell access, and sub-agent capabilities.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/
@@ -27,7 +27,7 @@ Classifier: Topic :: Terminals
 Requires-Python: <4.0,>=3.11
 Requires-Dist: aiosqlite<1.0.0,>=0.19.0
 Requires-Dist: deepagents-acp>=0.0.4
-Requires-Dist: deepagents==0.5.4
+Requires-Dist: deepagents==0.5.5
 Requires-Dist: httpx<1.0.0,>=0.28.1
 Requires-Dist: langchain-anthropic<2.0.0,>=1.4.2
 Requires-Dist: langchain-google-genai<5.0.0,>=4.2.2

{deepagents_cli-0.0.44 → deepagents_cli-0.0.45}/deepagents_cli/_version.py

@@ -1,6 +1,6 @@
 """Version information and lightweight constants for `deepagents-cli`."""
 
-__version__ = "0.0.44"  # x-release-please-version
+__version__ = "0.0.45"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/cli"
 """URL for `deepagents-cli` documentation."""

{deepagents_cli-0.0.44 → deepagents_cli-0.0.45}/deepagents_cli/project_utils.py

@@ -156,24 +156,76 @@ def find_project_agent_md(project_root: Path) -> list[Path]:
 
     Both files will be loaded and combined if both exist.
 
+    Candidates with symlinked path components are followed only when the
+    resolved target stays inside `project_root`. The returned `Path` is the
+    resolved target when any symlink component was traversed, so
+    `FilesystemBackend.download_files` opens a regular file rather than
+    tripping `O_NOFOLLOW` on the link itself. Symlinks pointing outside the
+    project root, symlink loops, and unreadable parents are skipped with a
+    warning. Broken symlinks are treated as missing files (no warning),
+    matching the pre-existing behavior for absent candidates.
+
+    Why: project AGENTS.md is auto-discovered and loaded into the system
+    prompt before the first model call. Without the in-tree check, a
+    malicious clone could ship `AGENTS.md -> ~/.ssh/config` (or any other
+    locally-readable file) and have its contents injected as agent
+    instructions on first run.
+
     Args:
         project_root: Path to the project root directory.
 
     Returns:
-        Existing AGENTS.md paths.
-
-            Empty if neither file exists, one entry if only one is present, or
-            two entries if both locations have the file.
+        Existing AGENTS.md paths, with in-tree symlinked path components
+            pre-resolved to their targets. Empty if neither file exists, one
+            entry if only one is present, or two entries if both locations
+            have the file.
     """
+    # Resolve the root once so the candidate-equality check below works even
+    # when the caller passes a non-canonical `project_root` (e.g., macOS
+    # `/var` -> `/private/var`, or a path with symlinked ancestors).
+    project_root_resolved = project_root.resolve()
     candidates = [
-        project_root / ".deepagents" / "AGENTS.md",
-        project_root / "AGENTS.md",
+        project_root_resolved / ".deepagents" / "AGENTS.md",
+        project_root_resolved / "AGENTS.md",
     ]
     paths: list[Path] = []
     for candidate in candidates:
         try:
-            if candidate.exists():
-                paths.append(candidate)
-        except OSError:
-            pass
+            # Single syscall handles existence, broken symlinks, loops, and
+            # canonicalization. `strict=True` raises rather than returning
+            # the unresolved path.
+            resolved = candidate.resolve(strict=True)
+        except FileNotFoundError:
+            # Absent file or broken symlink — matches the pre-existing
+            # silent-skip behavior for missing candidates. `Path.exists()`
+            # also returns False for symlink loops on some Python versions,
+            # so loops do NOT come through here; see the OSError branch.
+            continue
+        except (OSError, RuntimeError) as exc:
+            # `OSError(ELOOP)` on Python 3.13+, `RuntimeError("Symlink loop
+            # ...")` on 3.11-3.12; bare `OSError` for permission/unreadable
+            # parent. Security-relevant — warn and skip.
+            logger.warning(
+                "Skipping AGENTS.md candidate %s: %s",
+                candidate,
+                exc,
+            )
+            continue
+
+        try:
+            resolved.relative_to(project_root_resolved)
+        except ValueError:
+            logger.warning(
+                "Skipping AGENTS.md symlink %s: target %s is outside "
+                "the project root %s",
+                candidate,
+                resolved,
+                project_root_resolved,
+            )
+            continue
+
+        if candidate.absolute() == resolved:
+            paths.append(candidate)
+        else:
+            paths.append(resolved)
     return paths

{deepagents_cli-0.0.44 → deepagents_cli-0.0.45}/deepagents_cli/widgets/chat_input.py

@@ -332,6 +332,12 @@ class ChatTextArea(TextArea):
             show=False,
             priority=True,
         ),
+        Binding(
+            "ctrl+backspace,alt+backspace",
+            "delete_word_left",
+            "Delete left to start of word",
+            show=False,
+        ),
     ]
     """Key bindings for the chat text area.
 

{deepagents_cli-0.0.44 → deepagents_cli-0.0.45}/deepagents_cli/widgets/loading.py

@@ -60,7 +60,7 @@ class LoadingWidget(Static):
     LoadingWidget {
         height: auto;
         padding: 0 1;
-        margin-top: 1;
+        margin: 0 0 1 0;
     }
 
     LoadingWidget .loading-container {

{deepagents_cli-0.0.44 → deepagents_cli-0.0.45}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "deepagents-cli"
-version = "0.0.44"
+version = "0.0.45"
 description = "Terminal interface for Deep Agents - interactive AI agent with file operations, shell access, and sub-agent capabilities."
 readme = "README.md"
 license = { text = "MIT" }
@@ -26,7 +26,7 @@ classifiers = [
 ]
 dependencies = [
     # Framework
-    "deepagents==0.5.4",
+    "deepagents==0.5.5",
     "langchain>=1.2.15,<2.0.0",
     "langgraph>=1.1.6,<2.0.0",
     "langgraph-checkpoint-sqlite>=3.0.0,<4.0.0",

{deepagents_cli-0.0.44 → deepagents_cli-0.0.45}/tests/unit_tests/test_chat_input.py

@@ -25,7 +25,6 @@ from deepagents_cli.widgets.chat_input import (
 if TYPE_CHECKING:
     from pathlib import Path
 
-    import pytest
     from textual.pilot import Pilot
 
 
@@ -225,6 +224,34 @@ class _RecordingApp(App[None]):
         self.submitted.append(event)
 
 
+class TestChatTextAreaKeybindings:
+    """Regression tests for terminal key aliases in the chat input."""
+
+    def test_newline_bindings_do_not_shadow_enter_alias(self) -> None:
+        """`ctrl+m` is carriage return in terminals, so it must remain plain Enter."""
+        newline_keys = {
+            key.strip()
+            for binding in ChatTextArea.BINDINGS
+            if binding.action == "insert_newline"
+            for key in binding.key.split(",")
+        }
+
+        assert "ctrl+m" not in newline_keys
+        assert "ctrl+m" not in ChatTextArea._NEWLINE_KEYS
+
+    def test_modified_backspace_deletes_word_left(self) -> None:
+        """Modified Backspace aliases should delete the previous word."""
+        word_delete_keys = {
+            key.strip()
+            for binding in ChatTextArea.BINDINGS
+            if binding.action == "delete_word_left"
+            for key in binding.key.split(",")
+        }
+
+        assert "ctrl+backspace" in word_delete_keys
+        assert "alt+backspace" in word_delete_keys
+
+
 class _ImagePasteApp(App[None]):
     """App that wires a shared tracker into ChatInput for paste tests."""
 
@@ -2206,6 +2233,28 @@ class TestCtrlUDeleteToLineStart:
             assert ta.cursor_location == (1, 0)
 
 
+class TestModifiedBackspaceDeleteWordLeft:
+    """Test modified Backspace aliases for word deletion."""
+
+    @pytest.mark.parametrize("key", ["ctrl+backspace", "alt+backspace"])
+    async def test_modified_backspace_deletes_previous_word(self, key: str) -> None:
+        """Modified Backspace should delete the word before the cursor."""
+        app = _ChatInputTestApp()
+        async with app.run_test() as pilot:
+            chat = app.query_one(ChatInput)
+            ta = chat._text_area
+            assert ta is not None
+
+            ta.insert("hello world")
+            await pilot.pause()
+
+            await pilot.press(key)
+            await pilot.pause()
+
+            assert ta.text == "hello "
+            assert ta.cursor_location == (0, 6)
+
+
 class _TextAreaTypingApp(App[None]):
     """Minimal app that captures ChatTextArea.Typing and ChatInput.Typing events."""
 

{deepagents_cli-0.0.44 → deepagents_cli-0.0.45}/tests/unit_tests/test_config.py

@@ -222,26 +222,159 @@ class TestProjectAgentMdFinding:
         assert result == []
 
     def test_skips_paths_with_permission_errors(self, tmp_path: Path) -> None:
-        """Test that OSError from Path.exists() is caught gracefully."""
+        """`OSError` from `Path.resolve()` is caught and the candidate is skipped."""
         project_root = tmp_path / "project"
         project_root.mkdir()
 
         real_md = project_root / "AGENTS.md"
         real_md.write_text("root instructions")
 
-        original_exists = Path.exists
+        original_resolve = Path.resolve
 
-        def patched_exists(self: Path) -> bool:
+        def patched_resolve(self: Path, *args: object, **kwargs: object) -> Path:
             if self.name == "AGENTS.md" and ".deepagents" in str(self):
                 msg = "Permission denied"
                 raise PermissionError(msg)
-            return original_exists(self)
+            return original_resolve(self, *args, **kwargs)  # type: ignore[arg-type]
 
-        with patch.object(Path, "exists", patched_exists):
+        with patch.object(Path, "resolve", patched_resolve):
             result = _find_project_agent_md(project_root)
 
         assert len(result) == 1
-        assert result[0] == real_md
+        assert result[0].samefile(real_md)
+        assert not result[0].is_symlink()
+
+    def test_in_tree_symlink_resolves_to_target(self, tmp_path: Path) -> None:
+        """`AGENTS.md -> CLAUDE.md` returns a non-symlink path same-file as target."""
+        project_root = tmp_path / "project"
+        project_root.mkdir()
+
+        target = project_root / "CLAUDE.md"
+        target.write_text("real instructions")
+
+        link = project_root / "AGENTS.md"
+        link.symlink_to(target)
+
+        result = _find_project_agent_md(project_root)
+
+        assert len(result) == 1
+        # Returned path must be the resolved target — not the symlink — so
+        # `FilesystemBackend.download_files` opens the regular file rather
+        # than tripping `O_NOFOLLOW` on the link itself.
+        assert not result[0].is_symlink()
+        assert result[0].samefile(target)
+        assert result[0].is_relative_to(project_root.resolve())
+
+    def test_out_of_tree_symlink_skipped(
+        self, tmp_path: Path, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Symlink pointing outside project root is skipped with a warning."""
+        project_root = tmp_path / "project"
+        project_root.mkdir()
+        outside_target = tmp_path / "outside.md"
+        outside_target.write_text("attacker-controlled")
+
+        link = project_root / "AGENTS.md"
+        link.symlink_to(outside_target)
+
+        with caplog.at_level(logging.WARNING, logger="deepagents_cli.project_utils"):
+            result = _find_project_agent_md(project_root)
+
+        assert result == []
+        assert any("outside the project root" in r.getMessage() for r in caplog.records)
+
+    def test_out_of_tree_parent_symlink_skipped(
+        self, tmp_path: Path, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Parent directory symlink cannot bypass project-root containment."""
+        project_root = tmp_path / "project"
+        project_root.mkdir()
+        outside = tmp_path / "outside"
+        outside.mkdir()
+        outside_agent_md = outside / "AGENTS.md"
+        outside_agent_md.write_text("attacker-controlled")
+
+        (project_root / ".deepagents").symlink_to(outside, target_is_directory=True)
+
+        with caplog.at_level(logging.WARNING, logger="deepagents_cli.project_utils"):
+            result = _find_project_agent_md(project_root)
+
+        assert result == []
+        assert any("outside the project root" in r.getMessage() for r in caplog.records)
+
+    def test_broken_symlink_skipped(self, tmp_path: Path) -> None:
+        """Symlink whose target does not exist is skipped without crashing."""
+        project_root = tmp_path / "project"
+        project_root.mkdir()
+
+        link = project_root / "AGENTS.md"
+        link.symlink_to(project_root / "missing.md")
+
+        result = _find_project_agent_md(project_root)
+
+        # `Path.exists()` returns False for broken symlinks, so the candidate
+        # is silently skipped — matches pre-existing behavior for absent files.
+        assert result == []
+
+    def test_symlink_loop_skipped(
+        self, tmp_path: Path, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Symlink loop is skipped with a warning instead of crashing the agent."""
+        project_root = tmp_path / "project"
+        project_root.mkdir()
+
+        a = project_root / "AGENTS.md"
+        b = project_root / "loop.md"
+        a.symlink_to(b)
+        b.symlink_to(a)
+
+        with caplog.at_level(logging.WARNING, logger="deepagents_cli.project_utils"):
+            result = _find_project_agent_md(project_root)
+
+        assert result == []
+        assert any(
+            "Skipping AGENTS.md candidate" in r.getMessage() for r in caplog.records
+        )
+
+    def test_regular_file_unchanged_by_resolution(self, tmp_path: Path) -> None:
+        """Regular (non-symlink) AGENTS.md returns a non-symlink, in-tree path."""
+        project_root = tmp_path / "project"
+        project_root.mkdir()
+
+        agent_md = project_root / "AGENTS.md"
+        agent_md.write_text("plain file")
+
+        result = _find_project_agent_md(project_root)
+
+        assert len(result) == 1
+        assert not result[0].is_symlink()
+        assert result[0].samefile(agent_md)
+        assert result[0].is_relative_to(project_root.resolve())
+
+    def test_non_canonical_project_root_handled(self, tmp_path: Path) -> None:
+        """Non-canonical `project_root` (symlinked ancestor) still locates AGENTS.md.
+
+        Regression test: a symlinked `project_root` previously caused the
+        regular-file candidate to fail the absolute-vs-resolved equality check
+        and be returned as the canonical target rather than reported as missing.
+        Pin behavior so that callers passing an uncanonicalized root (common
+        when `Settings.project_root` originates from an unresolved cwd) still
+        find a regular AGENTS.md.
+        """
+        real_root = tmp_path / "real"
+        real_root.mkdir()
+        agent_md = real_root / "AGENTS.md"
+        agent_md.write_text("instructions")
+
+        link_root = tmp_path / "link"
+        link_root.symlink_to(real_root, target_is_directory=True)
+
+        result = _find_project_agent_md(link_root)
+
+        assert len(result) == 1
+        assert not result[0].is_symlink()
+        assert result[0].samefile(agent_md)
+        assert result[0].is_relative_to(link_root.resolve())
 
 
 class TestSettingsGetProjectAgentMdPath:

{deepagents_cli-0.0.44 → deepagents_cli-0.0.45}/uv.lock

@@ -967,7 +967,7 @@ wheels = [
 
 [[package]]
 name = "deepagents"
-version = "0.5.4"
+version = "0.5.5"
 source = { editable = "../deepagents" }
 dependencies = [
     { name = "langchain" },
@@ -1023,7 +1023,7 @@ wheels = [
 
 [[package]]
 name = "deepagents-cli"
-version = "0.0.44"
+version = "0.0.45"
 source = { editable = "." }
 dependencies = [
     { name = "aiosqlite" },