deepagents-code 0.1.12__tar.gz → 0.1.13__tar.gz

{deepagents_code-0.1.12 → deepagents_code-0.1.13}/AGENTS.md

@@ -38,6 +38,13 @@ Textual's `App.notify(message)` parses the message string as Rich markup by defa
 
 `console.print()` defaults to `highlight=True`, which runs `ReprHighlighter` and auto-applies bold + cyan to any detected numbers. This visually overrides subtle styles like `dim` (bold cancels dim in most terminals). Pass `highlight=False` on any `console.print()` call where the content contains numbers and consistent dim/subtle styling matters.
 
+### Glyphs and spinners — reuse, don't redefine
+
+Charset-dependent characters and animations have **single sources of truth**. Reuse them instead of hand-rolling new ones — copies drift, and (more subtly) a hardcoded Unicode literal won't degrade to ASCII on terminals that need it.
+
+- **Glyphs** (checkmarks, arrows, ellipsis, cursor, box-drawing, branch icon, etc.): pull from `get_glyphs()` (`config.Glyphs`). Each glyph has a Unicode and an ASCII variant; `get_glyphs()` returns the right set for the active terminal. Never inline `"✓"`, `"…"`, `"›"`, and friends.
+- **Animated spinners**: reuse the `Spinner` class in `widgets/loading.py`, which wraps `get_glyphs().spinner_frames` (braille on Unicode, `(-) (\) (|) (/)` on ASCII) and exposes `next_frame()`/`current_frame()`. Do **not** define your own frame tuples or interval constants for a spinner — drive a `Spinner` on a `set_interval`. The status-bar reconnect indicator (`widgets/status.py`) is the reference example; it ticks at the same 0.1s cadence as `LoadingWidget`. All connection/queue progress lives in the status bar — the welcome banner deliberately stays out of it, so there are currently no bespoke spinners to carve an exception for.
+
 ### Textual patterns used in this codebase
 
 - **Workers** (`@work` decorator) for async operations - see [Workers guide](https://textual.textualize.io/guide/workers/)
@@ -140,7 +147,8 @@ To add a new slash command: (1) add a `SlashCommand` entry to `COMMANDS`, (2) se
 1. `deepagents_code/model_config.py` — add `"provider_name": "ENV_VAR_NAME"` to `PROVIDER_API_KEY_ENV`
 2. `deepagents_code/model_config.py` — if the provider reads a *dedicated* endpoint env var, add `"provider_name": ("CANONICAL_BASE_URL", "ALTERNATE", ...)` to `PROVIDER_BASE_URL_ENV` (see guidelines below); omit the provider entirely when it has no provider-specific endpoint variable
 3. `pyproject.toml` — add `provider = ["langchain-provider>=X.Y.Z,<N.0.0"]` to `[project.optional-dependencies]` and include it in the `all-providers` composite extra
-4. `tests/unit_tests/test_model_config.py` — add `assert PROVIDER_API_KEY_ENV["provider_name"] == "ENV_VAR_NAME"` to `TestProviderApiKeyEnv.test_contains_major_providers`, and pin any `PROVIDER_BASE_URL_ENV` entry with a matching assertion
+4. `deepagents_code/model_config.py` — add `"provider_name"` to `RETRY_PARAM_BY_PROVIDER` if the provider's chat model accepts `max_retries`
+5. `tests/unit_tests/test_model_config.py` — add `assert PROVIDER_API_KEY_ENV["provider_name"] == "ENV_VAR_NAME"` to `TestProviderApiKeyEnv.test_contains_major_providers`, and pin any `PROVIDER_BASE_URL_ENV` entry with a matching assertion
 
 ### `PROVIDER_BASE_URL_ENV` guidelines
 

{deepagents_code-0.1.12 → deepagents_code-0.1.13}/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.13](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.12...deepagents-code==0.1.13) (2026-06-11)
+
+### Features
+
+* Pluggable third-party sandbox backends ([#3842](https://github.com/langchain-ai/deepagents/issues/3842)) ([2b635a7](https://github.com/langchain-ai/deepagents/commit/2b635a7e6e6b50ca8ce783c2ac96ed8643ae0224))
+* Auto-install ripgrep on first run ([#3348](https://github.com/langchain-ai/deepagents/issues/3348)) ([fecf22b](https://github.com/langchain-ai/deepagents/commit/fecf22b0909e79ff7bdf180baf20abf5fdf1f390))
+* `config` command and canonical config manifest ([#3763](https://github.com/langchain-ai/deepagents/issues/3763)) ([79899a3](https://github.com/langchain-ai/deepagents/commit/79899a306d01de6217a1dfcc013ae92c808a47a0))
+* Confirm modal for `/install --package` ([#3840](https://github.com/langchain-ai/deepagents/issues/3840)) ([3d75026](https://github.com/langchain-ai/deepagents/commit/3d75026e2f241648fae78d9e1de2cbb4985f58ff))
+* Copy focused input selection on `Ctrl+C` ([#3841](https://github.com/langchain-ai/deepagents/issues/3841)) ([99f782c](https://github.com/langchain-ai/deepagents/commit/99f782cf08336c200d02a24ae4edaa650af67ed2))
+* `[retries]` config ([#3772](https://github.com/langchain-ai/deepagents/issues/3772)) ([9334d91](https://github.com/langchain-ai/deepagents/commit/9334d91ef94997e46d5373daca9c146fa9498763))
+* Show connection state in the status bar ([#3710](https://github.com/langchain-ai/deepagents/issues/3710)) ([3e3e8fe](https://github.com/langchain-ai/deepagents/commit/3e3e8feb0e6e1b77be75a7756fbf32e5c9497c28))
+* Surface LangSmith tracing projects in `LocalContextMiddleware` ([#3836](https://github.com/langchain-ai/deepagents/issues/3836)) ([676abec](https://github.com/langchain-ai/deepagents/commit/676abecf892ff537fcb1425ba5929cace3c5d503))
+
+### Bug Fixes
+
+* Add debug-log guidance for truncated startup errors ([#3849](https://github.com/langchain-ai/deepagents/issues/3849)) ([cd1ef30](https://github.com/langchain-ai/deepagents/commit/cd1ef303cf5d0e9d746c787eb09a4a89437e965a))
+* Drop lock-key events so Caps Lock in iTerm2 doesn't type ([#3855](https://github.com/langchain-ai/deepagents/issues/3855)) ([110f1a7](https://github.com/langchain-ai/deepagents/commit/110f1a7a975743efda12e181cb3afc8404202254))
+* Hand pointer over splash tracing project link ([#3858](https://github.com/langchain-ai/deepagents/issues/3858)) ([ea7dae5](https://github.com/langchain-ai/deepagents/commit/ea7dae58a37cfb1d2b96544eb7c941aad331b280))
+* Keep terminal-default theme on Esc in `/theme` selector ([#3854](https://github.com/langchain-ai/deepagents/issues/3854)) ([c3bc67b](https://github.com/langchain-ai/deepagents/commit/c3bc67b0cdeda6f4dbcc6360ddd72b455aec4fe7))
+* Preserve inherited `PYTHONPATH` for server subprocess ([#3833](https://github.com/langchain-ai/deepagents/issues/3833)) ([4689569](https://github.com/langchain-ai/deepagents/commit/4689569f94138987319cd9cbb45ce66a1f496934))
+* Resolve interpreter PTC allowlist against the runtime tool registry ([#3845](https://github.com/langchain-ai/deepagents/issues/3845)) ([c59a27e](https://github.com/langchain-ai/deepagents/commit/c59a27ef2405b8e04c4351ce7ffa53d8d16d519c))
+* Treat multi-line key-event pastes as one input ([#3856](https://github.com/langchain-ai/deepagents/issues/3856)) ([6bb15d4](https://github.com/langchain-ai/deepagents/commit/6bb15d4bd97bd16f47504f937c8458d1b53d9cc4))
+
 ## [0.1.12](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.11...deepagents-code==0.1.12) (2026-06-10)
 
 ### Features

{deepagents_code-0.1.12 → deepagents_code-0.1.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepagents-code
-Version: 0.1.12
+Version: 0.1.13
 Summary: Terminal interface for Deep Agents - interactive AI agent with file operations, shell access, and sub-agent capabilities.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/

{deepagents_code-0.1.12 → deepagents_code-0.1.13}/THREAT_MODEL.md

@@ -409,6 +409,13 @@
 - **Description**: The `"env"` field in stdio MCP server definitions (`.mcp.json`) accepts an arbitrary key-value dict. `mcp_tools._validate_server_config` only checks that the field is a dict — it does not filter key names or values. The dict is forwarded directly to `StdioConnection(env=...)` which passes it to the subprocess. An attacker who can modify a project-level `.mcp.json` could set `PATH` to redirect command resolution, `LD_PRELOAD` to inject shared libraries, or `PYTHONPATH` to hijack Python imports in the MCP subprocess.
 - **Preconditions**: (1) Attacker has write access to a project-level `.mcp.json`; (2) The project MCP config must be trusted by the user (fingerprint approval gate via `mcp_trust`). For user-level `~/.deepagents/.mcp.json`, the attacker already has home directory write access. Note: the `env` dict from MCP config is passed to `StdioConnection` — whether it replaces or merges with `os.environ` depends on the `langchain_mcp_adapters` library implementation.
 
+#### T11: Auto-Installed ripgrep Binary from Upstream Release
+
+- **Flow**: First-run download performed by `managed_tools.ensure_ripgrep` when `rg` is not on `PATH`.
+- **Description**: On first invocation without a system `rg`, Deep Agents Code fetches the pinned ripgrep release tarball from `github.com/BurntSushi/ripgrep/releases/...`, verifies it against an in-tree SHA-256 (`RIPGREP_ASSETS`), extracts it under a `TemporaryDirectory`, and atomically moves the binary into `~/.deepagents/bin/rg`. The binary then runs unsandboxed, inheriting the same trust as a user-installed `rg` (the SDK invokes it via `subprocess.run(["rg", ...])`).
+- **Mitigations**: (1) SHA-256 verified against the pinned hash table before move — a mismatch aborts the install and leaves `BIN_DIR` clean. (2) Network egress is limited to `github.com`. (3) Opt-out via `DEEPAGENTS_CODE_OFFLINE` for air-gapped environments. (4) Pinned version + checksums are bumped in-tree, so a compromised upstream release is detected on the next Deep Agents Code release rather than silently propagating. (5) Atomic move-into-place avoids partial installs when concurrent CLI invocations race.
+- **Preconditions**: User has not installed `rg` via their package manager, `DEEPAGENTS_CODE_OFFLINE` is unset, and the host can reach `github.com`. The pinned SHA-256 in `RIPGREP_ASSETS` would need to be incorrect (a supply-chain compromise of the deepagents-code release) for a tampered binary to be installed.
+
 ---
 
 ## Input Source Coverage

{deepagents_code-0.1.12 → deepagents_code-0.1.13}/deepagents_code/_debug.py

@@ -13,7 +13,12 @@ import os
 import sys
 from pathlib import Path
 
-from deepagents_code._env_vars import DEBUG, DEBUG_FILE, is_env_truthy
+from deepagents_code._env_vars import (
+    DEBUG,
+    DEBUG_FILE,
+    DEFAULT_DEBUG_FILE,
+    is_env_truthy,
+)
 
 _DEBUG_HANDLER_ATTR = "_deepagents_code_debug_handler"
 
@@ -25,8 +30,8 @@ def configure_debug_logging(target: logging.Logger) -> None:
     module loggers reach the same file via propagation, so individual modules do
     not configure logging themselves.
 
-    The log file defaults to `'/tmp/deepagents_debug.log'` but can be overridden
-    with `DEEPAGENTS_CODE_DEBUG_FILE`. The handler appends (`mode='a'`) so logs
+    The log file defaults to `DEFAULT_DEBUG_FILE` but can be overridden with
+    `DEEPAGENTS_CODE_DEBUG_FILE`. The handler appends (`mode='a'`) so logs
     are preserved across separate process runs. Calling this again with the same
     resolved path is a no-op: the existing tagged handler is reused rather than
     stacking duplicates. If the resolved path changes, the stale handler is
@@ -40,12 +45,7 @@ def configure_debug_logging(target: logging.Logger) -> None:
     if not is_env_truthy(DEBUG):
         return
 
-    debug_path = Path(
-        os.environ.get(
-            DEBUG_FILE,
-            "/tmp/deepagents_debug.log",  # noqa: S108
-        )
-    )
+    debug_path = Path(os.environ.get(DEBUG_FILE, DEFAULT_DEBUG_FILE))
     for existing in list(target.handlers):
         if not (
             isinstance(existing, logging.FileHandler)
@@ -74,3 +74,23 @@ def configure_debug_logging(target: logging.Logger) -> None:
     handler.setFormatter(logging.Formatter("%(asctime)s %(name)s %(message)s"))
     target.addHandler(handler)
     target.setLevel(logging.DEBUG)
+
+
+def installed_debug_log_path() -> Path | None:
+    """Return the path of the active debug log file, or `None` if not logging.
+
+    Reflects the file handler actually attached by `configure_debug_logging`,
+    not the current `DEEPAGENTS_CODE_DEBUG` env value. The two diverge when the
+    variable is set after import — e.g. via a project/global `.env` loaded during
+    settings bootstrap — in which case the variable reads truthy but no handler
+    was installed and no log file exists. Callers that surface "full error in
+    <path>" hints must use this rather than the env var to avoid pointing users
+    at a file that was never created.
+    """
+    package_logger = logging.getLogger(__package__ or "deepagents_code")
+    for handler in package_logger.handlers:
+        if isinstance(handler, logging.FileHandler) and getattr(
+            handler, _DEBUG_HANDLER_ATTR, False
+        ):
+            return Path(handler.baseFilename)
+    return None

{deepagents_code-0.1.12 → deepagents_code-0.1.13}/deepagents_code/_env_vars.py

@@ -46,7 +46,10 @@ as enabled, and `0`, `false`, `no`, `off`, empty string, or unset as disabled.
 """
 
 DEBUG_FILE = "DEEPAGENTS_CODE_DEBUG_FILE"
-"""Path for the debug log file (default: `/tmp/deepagents_debug.log`)."""
+"""Path for the debug log file (default: `DEFAULT_DEBUG_FILE`)."""
+
+DEFAULT_DEBUG_FILE = "/tmp/deepagents_debug.log"  # noqa: S108  # opt-in debug log
+"""Default path for the debug log when `DEBUG_FILE` is unset."""
 
 DEBUG_MCP_PROJECT_TRUST = "DEEPAGENTS_CODE_DEBUG_MCP_PROJECT_TRUST"
 """Force the project MCP approval prompt for manual UI testing.
@@ -124,6 +127,14 @@ NO_TERMINAL_ESCAPE = "DEEPAGENTS_CODE_NO_TERMINAL_ESCAPE"
 NO_UPDATE_CHECK = "DEEPAGENTS_CODE_NO_UPDATE_CHECK"
 """Disable automatic update checking when set."""
 
+OFFLINE = "DEEPAGENTS_CODE_OFFLINE"
+"""Disable network downloads of managed binaries (e.g. ripgrep).
+
+Parsed by `is_env_truthy`: accepts `1`, `true`, `yes`, `on` as enabled. When
+truthy, `managed_tools.ensure_ripgrep` will not attempt to download a binary
+and falls back to the existing missing-tool notification + slow Python regex
+path."""
+
 OLLAMA_DISCOVERY = "DEEPAGENTS_CODE_OLLAMA_DISCOVERY"
 """Toggle Ollama model and profile discovery probes.
 
@@ -164,6 +175,29 @@ _TRUTHY_VALUES = frozenset({"1", "true", "yes", "on"})
 _FALSY_VALUES = frozenset({"0", "false", "no", "off", ""})
 
 
+def classify_env_bool(raw: str) -> bool | None:
+    """Classify a raw env-var string as a truthy, falsy, or unrecognized token.
+
+    The single source of truth for which strings count as boolean on/off
+    values; `is_env_truthy` and the config resolver both build on it so they
+    agree on what "recognizably boolean" means.
+
+    Args:
+        raw: The raw (unstripped) environment-variable value.
+
+    Returns:
+        `True` for `1`/`true`/`yes`/`on`, `False` for `0`/`false`/`no`/`off`/
+            empty string (case-insensitive), or `None` when the value
+            is neither.
+    """
+    lowered = raw.strip().lower()
+    if lowered in _TRUTHY_VALUES:
+        return True
+    if lowered in _FALSY_VALUES:
+        return False
+    return None
+
+
 def is_env_truthy(name: str, *, default: bool = False) -> bool:
     """Return whether env var *name* is set to a recognizably truthy value.
 
@@ -184,9 +218,5 @@ def is_env_truthy(name: str, *, default: bool = False) -> bool:
     raw = os.environ.get(name)
     if raw is None:
         return default
-    lowered = raw.strip().lower()
-    if lowered in _TRUTHY_VALUES:
-        return True
-    if lowered in _FALSY_VALUES:
-        return False
-    return default
+    classified = classify_env_bool(raw)
+    return default if classified is None else classified

{deepagents_code-0.1.12 → deepagents_code-0.1.13}/deepagents_code/_server_config.py

@@ -164,7 +164,9 @@ class ServerConfig:
 
     `None` means "fall through to whatever `settings.interpreter_ptc` resolves
     to from `~/.deepagents/config.toml`". A string is one of `"safe"`/`"all"`;
-    a list is an explicit allowlist of tool names.
+    a list is an explicit allowlist of tool names that may also include the
+    `"safe"` preset (expanded at agent-build time); `"all"` is rejected inside
+    a list.
     """
 
     interpreter_ptc_acknowledge_unsafe: bool = False

{deepagents_code-0.1.12 → deepagents_code-0.1.13}/deepagents_code/_textual_patches.py

@@ -13,7 +13,30 @@ upstream.
     `alt+enter`. Tracked in Textualize/textual#6378. Remove this patch and
     the Textual pin comment in `pyproject.toml` when that lands.
 
-2. Double-click word selection. Stock Textual selects the entire widget on
+2. Kitty lock-key and sub-field handling. Two related problems with the
+    pinned Textual parser:
+
+    a. Lock keys (Caps Lock / Num Lock / Scroll Lock) must never produce
+        text, but terminals encode them inconsistently. kitty/Ghostty/VS Code
+        send the functional key code (`CSI 57358 ... u`) with associated text
+        set to the letter the *next* key would have produced. iTerm2 instead
+        reports the Caps Lock toggle as a bare upper-case ASCII letter (`CSI
+        65 u` → 'A') with no modifier or associated-text field — not a valid
+        encoding for a real key press per the kitty spec. Either way the chat
+        input would type a stray capital. The patch collapses both forms to a
+        single character-less `caps_lock` event, regardless of the modifier,
+        associated-text, or event-type sub-fields the terminal includes.
+
+    b. `_re_extended_key` only accepts `;`-separated numeric fields, so any
+        *non-lock* kitty sequence carrying `:`-separated sub-fields — alternate
+        keys (`unicode:shifted:base`) or an event-type (`modifiers:event`) —
+        fails to match and is re-emitted one byte at a time as literal text.
+        The patch strips the `:` sub-fields before Textual parses the sequence
+        so it resolves to a single key event.
+
+    Remove when the pinned Textual neutralizes lock keys and widens its parser.
+
+3. Double-click word selection. Stock Textual selects the entire widget on
     a click chain; these patches narrow a double-click (and double-click
     drag) to word boundaries. No upstream issue tracks this yet, so it has
     no removal criterion — it stays until Textual grows native word select.
@@ -24,6 +47,7 @@ Imported for side effect from `app.py` before any `App()` is created.
 from __future__ import annotations
 
 import logging
+import re
 from inspect import isawaitable
 from typing import TYPE_CHECKING
 
@@ -60,6 +84,99 @@ try:
 except (ImportError, AttributeError) as exc:  # pragma: no cover - defensive
     logger.warning("Textual keyboard parser patch skipped: %s", exc)
 else:
+    # Kitty functional key codes for the lock keys (Caps Lock, Scroll Lock,
+    # Num Lock). The kitty protocol assigns these Private Use Area codepoints;
+    # they appear as the leading key-code field of a `CSI ... u` sequence.
+    _KITTY_LOCK_KEY_CODES = frozenset({"57358", "57359", "57360"})
+    _KITTY_LOCK_KEY_NAMES = {
+        "57358": "caps_lock",
+        "57359": "scroll_lock",
+        "57360": "num_lock",
+    }
+
+    # Any `CSI <code>[:...][;...] u` sequence. Group 1 is the leading key-code
+    # field (before any `:` alternate-key sub-field); `_lock_key_event` checks
+    # it against the lock-key set. The match is deliberately broad so the code
+    # is extracted regardless of the modifier / associated-text / event-type
+    # sub-fields that follow, which iTerm2 and other terminals encode in
+    # varying shapes.
+    _KITTY_KEY_SEQUENCE = re.compile(r"\x1b\[(\d+)[\d;:]*u")
+
+    # Kitty extended-key sequence carrying `:` sub-fields (alternate keys or an
+    # event-type sub-field). The pinned Textual's `_re_extended_key` rejects the
+    # colons, so non-lock keys with these sub-fields would otherwise leak as
+    # literal text — strip the sub-fields so they parse to a single key event.
+    _KITTY_SUBFIELD_KEY = re.compile(r"\x1b\[[\d;:]*:[\d;:]*[u~ABCDEFHPQRS]")
+
+    # iTerm2 reports the Caps Lock toggle as a `CSI u` sequence whose primary
+    # key code is the *uppercase* ASCII letter that would be produced next
+    # (e.g. `CSI 65 u` → 'A'), with no real modifier bits and no associated
+    # text. The kitty spec requires the primary code to be the unshifted
+    # (lower-case) code point, so a bare upper-case letter here is iTerm2's
+    # Caps Lock artifact rather than a real key press. Group 1 is the code
+    # point; group 2 the optional modifier field; group 3 the optional text.
+    _KITTY_CSI_U = re.compile(
+        r"\x1b\[(\d+)(?::\d+)*(?:;(\d+)[\d:]*)?(?:;(\d+)[\d:]*)?u"
+    )
+    _ASCII_UPPER_A = 65
+    _ASCII_UPPER_Z = 90
+    # Modifier mask for the "real" modifiers (shift|alt|ctrl|super|hyper|meta);
+    # excludes the caps_lock (64) and num_lock (128) lock bits.
+    _REAL_MODIFIER_MASK = 0b111111
+
+    def _spurious_caps_lock(sequence: str) -> bool:
+        """Whether `sequence` is iTerm2's bare Caps Lock toggle report.
+
+        Matches a `CSI u` key whose primary code point is an upper-case ASCII
+        letter with no real modifiers and no associated-text field — which the
+        kitty spec never produces for a genuine key press.
+
+        Returns:
+            `True` if `sequence` is the spurious Caps Lock toggle report.
+        """
+        match = _KITTY_CSI_U.fullmatch(sequence)
+        if match is None:
+            return False
+        code = int(match.group(1))
+        if not _ASCII_UPPER_A <= code <= _ASCII_UPPER_Z:
+            return False
+        modifier_bits = (int(match.group(2)) - 1) if match.group(2) else 0
+        has_text = match.group(3) is not None
+        return modifier_bits & _REAL_MODIFIER_MASK == 0 and not has_text
+
+    def _strip_kitty_subfields(sequence: str) -> str:
+        """Drop `:` sub-fields from a kitty extended-key sequence.
+
+        Keeps the primary value of each `;`-separated field (the unicode key
+        code, modifier mask, and associated text), which is all Textual reads.
+
+        Returns:
+            The sequence with every `:` sub-field removed.
+        """
+        body, terminator = sequence[2:-1], sequence[-1]
+        primary = ";".join(field.split(":", 1)[0] for field in body.split(";"))
+        return f"\x1b[{primary}{terminator}"
+
+    def _lock_key_event(sequence: str) -> events.Key | None:
+        """Return a text-free lock-key event for a kitty lock-key sequence.
+
+        Lock keys must never produce text. Under the kitty protocol with
+        associated-text reporting, terminals (notably iTerm2) encode Caps
+        Lock as a `CSI 57358 ... u` sequence whose associated-text field is
+        the letter the *next* key would have produced — Textual then either
+        types that letter or, when `:` sub-fields are present, leaks the raw
+        sequence byte by byte. Collapsing any lock-key sequence to a single
+        character-less event stops both failure modes at the source, for
+        every widget.
+
+        Returns:
+            A `Key` event for the lock key, or `None` if `sequence` is not a
+            kitty lock-key sequence.
+        """
+        match = _KITTY_KEY_SEQUENCE.fullmatch(sequence)
+        if match is None or match.group(1) not in _KITTY_LOCK_KEY_CODES:
+            return None
+        return events.Key(_KITTY_LOCK_KEY_NAMES[match.group(1)], None)
 
     def _emit_alt(keys: tuple, character: str | None) -> Iterable[events.Key]:
         for key in keys:
@@ -68,6 +185,22 @@ else:
     def _sequence_to_key_events_with_alt(
         self: XTermParser, sequence: str, alt: bool = False
     ) -> Iterable[events.Key]:
+        # Lock keys (Caps Lock / Num Lock / Scroll Lock) must never type. Emit
+        # a single character-less event regardless of how the terminal encoded
+        # the modifiers, associated text, or event-type sub-fields.
+        if (lock_event := _lock_key_event(sequence)) is not None:
+            yield lock_event
+            return
+        # iTerm2 reports the Caps Lock toggle as a bare upper-case letter (e.g.
+        # `CSI 65 u` → 'A') rather than the kitty `57358` functional code. Drop
+        # it so the toggle never types a stray capital into the input.
+        if _spurious_caps_lock(sequence):
+            yield events.Key("caps_lock", None)
+            return
+        # Normalize any other kitty sequence with `:` sub-fields so it resolves
+        # to a single key event instead of leaking raw bytes.
+        if _KITTY_SUBFIELD_KEY.fullmatch(sequence):
+            sequence = _strip_kitty_subfields(sequence)
         # Fast path: \x1b<byte> on first pass. Short-circuits the ~100 ms
         # escape-delay wait when both bytes arrive together. Semantic side
         # effect: \x1b\x1b dispatches as `alt+escape` with no delay, matching

{deepagents_code-0.1.12 → deepagents_code-0.1.13}/deepagents_code/_version.py

@@ -2,7 +2,7 @@
 
 # Keep the `x-release-please-version` annotation — release-please uses it to
 # bump `__version__` in sync with `pyproject.toml` on every release PR.
-__version__ = "0.1.12"  # x-release-please-version
+__version__ = "0.1.13"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/code"
 """URL for `deepagents-code` documentation."""

{deepagents_code-0.1.12 → deepagents_code-0.1.13}/deepagents_code/agent.py

@@ -54,11 +54,13 @@ from langchain.agents.middleware.types import AgentMiddleware
 from deepagents_code import theme
 from deepagents_code._constants import DEFAULT_AGENT_NAME
 from deepagents_code.config import (
+    _INHERITED_PYTHONPATH_ENV,
     _ShellAllowAll,
     config,
     console,
     get_default_coding_instructions,
     get_glyphs,
+    get_langsmith_project_name,
     settings,
 )
 from deepagents_code.configurable_model import ConfigurableModelMiddleware
@@ -219,12 +221,23 @@ def _resolve_ptc_option(
 ) -> list[str] | None:
     """Resolve the configured PTC allowlist to a concrete list of tool names.
 
+    Names are *not* validated against `tools`. The Deep Agents SDK injects the
+    filesystem, `task`, `write_todos`, and `execute` tools via middleware in
+    `create_deep_agent` — *after* this point — so they are absent from `tools`
+    here, and the SDK exposes no importable list of them. `CodeInterpreterMiddleware`
+    matches the resolved names against the live runtime registry and silently
+    ignores any that are absent, so resolution passes names through and lets
+    runtime decide. (Names that match nothing at runtime are dropped, so a typo
+    silently exposes no tool rather than raising.)
+
     Args:
         ptc: Raw `interpreter_ptc` value from settings or CLI. Accepts
-            `False`/`[]`, `"safe"`, `"all"`, or a list of names.
-        tools: Live tool list given to `create_cli_agent`. Used to validate
-            explicit names, intersect the `"safe"` preset, and enumerate
-            `"all"`.
+            `False`/`[]`, `"safe"`, `"all"`, or a list of names. A list may
+            include `"safe"`, which expands to `INTERPRETER_PTC_SAFE_PRESET`;
+            `"all"` is rejected inside a list.
+        tools: Tools passed to `create_cli_agent`. Used only to enumerate
+            `"all"`, which is therefore limited to these explicitly-passed
+            tools (the SDK runtime built-ins cannot be enumerated here).
         acknowledge_unsafe: Mirrors `settings.interpreter_ptc_acknowledge_unsafe`;
             required when `ptc="all"` and `auto_approve` is `False`.
         auto_approve: Whether HITL approval is globally disabled. When `True`,
@@ -236,8 +249,9 @@ def _resolve_ptc_option(
         suitable for `CodeInterpreterMiddleware(ptc=...)`.
 
     Raises:
-        ValueError: For unknown names in an explicit list, or for `"all"`
-            without `acknowledge_unsafe` outside of `auto_approve`.
+        ValueError: For `"all"` inside a list, for `"all"` without
+            `acknowledge_unsafe` outside of `auto_approve`, or for an invalid
+            `ptc` type or string.
     """
     from langchain.tools import BaseTool as _BaseTool
 
@@ -265,14 +279,10 @@ def _resolve_ptc_option(
         if normalized == "safe":
             from deepagents_code.config import INTERPRETER_PTC_SAFE_PRESET
 
-            selected = sorted(INTERPRETER_PTC_SAFE_PRESET & live_set)
-            dropped = sorted(INTERPRETER_PTC_SAFE_PRESET - live_set)
-            if dropped:
-                logger.debug(
-                    "interpreter_ptc='safe' preset members not present in toolset: %s",
-                    dropped,
-                )
-            return selected
+            # Return the preset as-is; the middleware exposes whichever members
+            # exist in the live registry at runtime (they are SDK built-ins not
+            # present in `tools` here).
+            return sorted(INTERPRETER_PTC_SAFE_PRESET)
         if normalized == "all":
             if not auto_approve and not acknowledge_unsafe:
                 msg = (
@@ -282,6 +292,11 @@ def _resolve_ptc_option(
                     "auto_approve=True) to opt in."
                 )
                 raise ValueError(msg)
+            # `all` can only enumerate the tools passed to `create_cli_agent`;
+            # SDK runtime built-ins (filesystem, `task`, …) are injected later
+            # and are not enumerable here. Exposing them under `all` needs an
+            # "expose everything" sentinel in `CodeInterpreterMiddleware`
+            # (tracked in langchain-ai/deepagents#3847).
             included = sorted(live_set)
             write_included = sorted(_INTERPRETER_WRITE_TOOLS & live_set)
             if write_included:
@@ -297,15 +312,42 @@ def _resolve_ptc_option(
         raise ValueError(msg)
 
     if isinstance(ptc, list):
-        unknown = [name for name in ptc if name not in live_set]
-        if unknown:
-            available = ", ".join(sorted(live_set)) or "<none>"
+        from deepagents_code.config import INTERPRETER_PTC_SAFE_PRESET
+
+        if any(name.strip().lower() == "all" for name in ptc):
             msg = (
-                "Unknown tool names in interpreter_ptc: "
-                f"{sorted(set(unknown))}. Available tools: {available}."
+                "interpreter_ptc list entries cannot include 'all'; use 'all' "
+                "as a standalone value or list explicit tool names (optionally "
+                "with the 'safe' preset)."
             )
             raise ValueError(msg)
-        return list(ptc)
+
+        resolved: list[str] = []
+        seen: set[str] = set()
+
+        def _add(name: str) -> None:
+            if name not in seen:
+                seen.add(name)
+                resolved.append(name)
+
+        for name in ptc:
+            if name.strip().lower() == "safe":
+                for member in sorted(INTERPRETER_PTC_SAFE_PRESET):
+                    _add(member)
+                continue
+            _add(name)
+
+        # Explicit names are passed through unvalidated: the middleware resolves
+        # them against the live runtime registry (which includes the SDK
+        # built-ins absent from `tools`) and drops any that match nothing.
+        absent = sorted(n for n in resolved if n not in live_set)
+        if absent:
+            logger.debug(
+                "interpreter_ptc names not in the build-time toolset (resolved "
+                "at runtime if present): %s",
+                absent,
+            )
+        return resolved
 
     msg = (
         "interpreter_ptc must be False, 'safe', 'all', or a list of tool names; "
@@ -1024,6 +1066,23 @@ def _add_interrupt_on() -> dict[str, InterruptOnConfig]:
     return interrupt_map
 
 
+def _apply_inherited_pythonpath(env: dict[str, str]) -> None:
+    """Re-apply a relayed launch-time `PYTHONPATH` to a shell-command env.
+
+    `server._build_server_env` strips `PYTHONPATH` from the server interpreter
+    and relays the launch value via `config._INHERITED_PYTHONPATH_ENV`. This
+    restores it as `PYTHONPATH` for the approval-gated `execute` subprocesses,
+    which run in the user's working directory and need the import path. Mutates
+    `env` in place; a no-op when no value was relayed.
+
+    Args:
+        env: Environment mapping for the shell backend, modified in place.
+    """
+    inherited = env.pop(_INHERITED_PYTHONPATH_ENV, None)
+    if inherited is not None:
+        env["PYTHONPATH"] = inherited
+
+
 def create_cli_agent(
     model: str | BaseChatModel,
     assistant_id: str,
@@ -1367,13 +1426,19 @@ def create_cli_agent(
             shell_env = os.environ.copy()
             if settings.user_langchain_project:
                 shell_env["LANGSMITH_PROJECT"] = settings.user_langchain_project
+            # Re-apply a launch-time PYTHONPATH that was stripped from the server
+            # interpreter but relayed for approval-gated `execute` commands.
+            _apply_inherited_pythonpath(shell_env)
 
             # Use LocalShellBackend for filesystem + shell execution.
             # The SDK's FilesystemMiddleware exposes per-command timeout
             # on the execute tool natively.
+            # `inherit_env=False`: `shell_env` is already a complete, curated
+            # copy of `os.environ`. Inheriting again would re-copy `os.environ`
+            # and resurrect the popped carrier var, leaking it into `execute`.
             backend = LocalShellBackend(
                 root_dir=root_dir,
-                inherit_env=True,
+                inherit_env=False,
                 env=shell_env,
             )
         else:
@@ -1419,7 +1484,12 @@ def create_cli_agent(
     # Local context middleware (git info, directory tree, etc.).
     if isinstance(backend, (_ExecutableBackend, _AsyncExecutableBackend)):
         agent_middleware.append(
-            LocalContextMiddleware(backend=backend, mcp_server_info=mcp_server_info)
+            LocalContextMiddleware(
+                backend=backend,
+                mcp_server_info=mcp_server_info,
+                tracing_project=get_langsmith_project_name(),
+                user_tracing_project=settings.user_langchain_project,
+            )
         )
 
     # Add shell allow-list middleware when interrupt_shell_only is active.