deepagents-code 0.1.23__tar.gz → 0.1.24__tar.gz

{deepagents_code-0.1.23 → deepagents_code-0.1.24}/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.24](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.23...deepagents-code==0.1.24) (2026-06-25)
+
+### Features
+
+* Enable `js_eval` by default ([#4245](https://github.com/langchain-ai/deepagents/issues/4245)) ([2e04ff3](https://github.com/langchain-ai/deepagents/commit/2e04ff397e60389c9a19c4a9b528e15602ad8338))
+* Dynamic subagents UI ([#4221](https://github.com/langchain-ai/deepagents/issues/4221)) ([10bcba2](https://github.com/langchain-ai/deepagents/commit/10bcba25600e51aba135f170b34aa6315c0f53d6))
+* Gate onboarding integrations modal behind opt-in flag ([#4227](https://github.com/langchain-ai/deepagents/issues/4227)) ([6c930c5](https://github.com/langchain-ai/deepagents/commit/6c930c5e4502f572be554acc896c5fb6d061e0e5))
+
+### Bug Fixes
+
+* Eager managed ripgrep install via `dcode tools install` ([#4199](https://github.com/langchain-ai/deepagents/issues/4199)) ([cf536f3](https://github.com/langchain-ai/deepagents/commit/cf536f339958d6726fa41f896c4a3e42df644c9f))
+* Interrupt remote runs on chat cancellation ([#4234](https://github.com/langchain-ai/deepagents/issues/4234)) ([37c5fa2](https://github.com/langchain-ai/deepagents/commit/37c5fa23e621616836694bc59c1b0c38def81604))
+* Sync approval toggles during active runs ([#4239](https://github.com/langchain-ai/deepagents/issues/4239)) ([4600365](https://github.com/langchain-ai/deepagents/commit/4600365ea0b60c3e9113ecf59b5336be37d03428))
+* Clear stale live approval mode keys ([#4242](https://github.com/langchain-ai/deepagents/issues/4242)) ([f11a769](https://github.com/langchain-ai/deepagents/commit/f11a76962c9d536a38e27ac05b32feca364b2424))
+
 ## [0.1.23](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.22...deepagents-code==0.1.23) (2026-06-25)
 
 ### Features

{deepagents_code-0.1.23 → deepagents_code-0.1.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepagents-code
-Version: 0.1.23
+Version: 0.1.24
 Summary: Terminal interface for Deep Agents - interactive AI agent with file operations, shell access, and sub-agent capabilities.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/
@@ -33,6 +33,7 @@ Requires-Dist: langchain-anthropic<2.0.0,>=1.4.7
 Requires-Dist: langchain-google-genai<5.0.0,>=4.2.5
 Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.0
 Requires-Dist: langchain-openai<2.0.0,>=1.3.3
+Requires-Dist: langchain-quickjs<0.4.0,>=0.3.2
 Requires-Dist: langchain<2.0.0,>=1.3.11
 Requires-Dist: langgraph-checkpoint-sqlite<4.0.0,>=3.1.0
 Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.30
@@ -123,7 +124,6 @@ Requires-Dist: langchain-openrouter<2.0.0,>=0.2.4; extra == 'openrouter'
 Provides-Extra: perplexity
 Requires-Dist: langchain-perplexity<2.0.0,>=1.4.0; extra == 'perplexity'
 Provides-Extra: quickjs
-Requires-Dist: langchain-quickjs<0.4.0,>=0.3.1; extra == 'quickjs'
 Provides-Extra: runloop
 Requires-Dist: langchain-runloop>=0.0.6; extra == 'runloop'
 Provides-Extra: together

{deepagents_code-0.1.23 → deepagents_code-0.1.24}/THREAT_MODEL.md

@@ -411,10 +411,10 @@
 
 #### T11: Auto-Installed ripgrep Binary from Upstream Release
 
-- **Flow**: First-run download performed by `managed_tools.ensure_ripgrep` when `rg` is not on `PATH`.
-- **Description**: On first invocation without a system `rg`, Deep Agents Code fetches the pinned ripgrep release tarball from `github.com/BurntSushi/ripgrep/releases/...`, verifies it against an in-tree SHA-256 (`RIPGREP_ASSETS`), extracts it under a `TemporaryDirectory`, and atomically moves the binary into `~/.deepagents/bin/rg`. The binary then runs unsandboxed, inheriting the same trust as a user-installed `rg` (the SDK invokes it via `subprocess.run(["rg", ...])`).
-- **Mitigations**: (1) SHA-256 verified against the pinned hash table before move — a mismatch aborts the install and leaves `BIN_DIR` clean. (2) Network egress is limited to `github.com`. (3) Opt-out via `DEEPAGENTS_CODE_OFFLINE` for air-gapped environments. (4) Pinned version + checksums are bumped in-tree, so a compromised upstream release is detected on the next Deep Agents Code release rather than silently propagating. (5) Atomic move-into-place avoids partial installs when concurrent CLI invocations race.
-- **Preconditions**: User has not installed `rg` via their package manager, `DEEPAGENTS_CODE_OFFLINE` is unset, and the host can reach `github.com`. The pinned SHA-256 in `RIPGREP_ASSETS` would need to be incorrect (a supply-chain compromise of the deepagents-code release) for a tampered binary to be installed.
+- **Flow**: Download performed by `managed_tools.ensure_ripgrep` when `rg` is not on `PATH` — either on first run, or eagerly at install time via `dcode tools install` (invoked by `scripts/install.sh`).
+- **Description**: Without a system `rg`, Deep Agents Code fetches the pinned ripgrep release tarball from `github.com/BurntSushi/ripgrep/releases/...`, verifies it against an in-tree SHA-256 (`RIPGREP_ASSETS`), extracts it under a `TemporaryDirectory`, and atomically moves the binary into `~/.deepagents/bin/rg`. The binary then runs unsandboxed, inheriting the same trust as a user-installed `rg` (the SDK invokes it via `subprocess.run(["rg", ...])`). The same verified path backs the `dcode tools install` verb, so the install script reuses it rather than re-encoding the version + checksum table in bash.
+- **Mitigations**: (1) SHA-256 verified against the pinned hash table before move — a mismatch aborts the install and leaves `BIN_DIR` clean. (2) Network egress is limited to `github.com`. (3) Opt-out via `DEEPAGENTS_CODE_OFFLINE` for air-gapped environments, or `DEEPAGENTS_CODE_RIPGREP_INSTALLER=system` to defer to the OS package manager instead of the managed binary. (4) Pinned version + checksums are bumped in-tree, so a compromised upstream release is detected on the next Deep Agents Code release rather than silently propagating. (5) Atomic move-into-place avoids partial installs when concurrent CLI invocations race. (6) The eager install-script path is non-`sudo` (no system package manager is invoked in the default `managed` mode).
+- **Preconditions**: User has not installed `rg` via their package manager, `DEEPAGENTS_CODE_OFFLINE` is unset, `DEEPAGENTS_CODE_RIPGREP_INSTALLER` is not `system`, and the host can reach `github.com`. The pinned SHA-256 in `RIPGREP_ASSETS` would need to be incorrect (a supply-chain compromise of the deepagents-code release) for a tampered binary to be installed.
 
 ---
 

{deepagents_code-0.1.23 → deepagents_code-0.1.24}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "649443a"
+BUILD_COMMIT = "96caad4"

{deepagents_code-0.1.23 → deepagents_code-0.1.24}/deepagents_code/_cli_context.py

@@ -39,6 +39,8 @@ class CLIContextSchema:
 
     auto_approve: bool = False
 
+    approval_mode_key: str | None = None
+
 
 class CLIContext(TypedDict, total=False):
     """Client-facing builder for the per-run graph context payload.
@@ -76,3 +78,12 @@ class CLIContext(TypedDict, total=False):
     this to suppress interrupts at the source when "approve always" is on,
     avoiding the interrupt-then-auto-resolve round-trip.
     """
+
+    approval_mode_key: str | None
+    """Store key for the live approval-mode control record.
+
+    The TUI updates this record when the user toggles approval mode mid-run.
+    The server-side interrupt predicate reads it from the LangGraph Store on
+    each gated tool call so auto-to-manual changes can take effect before the
+    current stream returns.
+    """

{deepagents_code-0.1.23 → deepagents_code-0.1.24}/deepagents_code/_env_vars.py

@@ -158,6 +158,15 @@ and `/api/show`. See `_ollama_discovery_enabled` for accepted truthy/falsy
 values.
 """
 
+ONBOARDING_INTEGRATIONS_SCREEN = "DEEPAGENTS_CODE_ONBOARDING_INTEGRATIONS_SCREEN"
+"""Show the "Installed Integrations" summary screen during first-run onboarding.
+
+Off by default: onboarding goes straight from the name prompt to the model
+selector, which already surfaces (and installs) uninstalled model providers.
+Set to a truthy value to bring the standalone integrations screen back into the
+flow. Parsed by `is_env_truthy`: accepts `1`, `true`, `yes`, `on` as enabled.
+"""
+
 RESTARTED_AFTER_UPDATE = "DEEPAGENTS_CODE_RESTARTED_AFTER_UPDATE"
 """Internal sentinel recording the target version immediately before the
 startup auto-update re-execs the process.
@@ -168,6 +177,16 @@ version), skips auto-updating to break out of an otherwise endless
 upgrade/restart loop. Set and read internally across `os.execv`.
 """
 
+RIPGREP_INSTALLER = "DEEPAGENTS_CODE_RIPGREP_INSTALLER"
+"""Select how ripgrep is provisioned: `managed` (default) or `system`.
+
+`managed` downloads the pinned, SHA-256-verified upstream binary into
+`~/.deepagents/bin` (no sudo). `system` skips that download so power users can
+rely on their distro package / existing toolchain instead; the install script's
+`system` mode keeps the brew/apt/cargo path. A system `rg` already on `PATH` is
+reused under either setting. Unrecognized values fall back to `managed`. See
+`managed_tools.ripgrep_installer`."""
+
 SERVER_ENV_PREFIX = "DEEPAGENTS_CODE_SERVER_"
 """Environment variable prefix used to pass CLI config to the server subprocess."""
 

{deepagents_code-0.1.23 → deepagents_code-0.1.24}/deepagents_code/_server_config.py

@@ -101,6 +101,67 @@ def _read_env_optional_bool(suffix: str) -> bool | None:
     return raw.lower() == "true"
 
 
+def _resolve_enable_interpreter(
+    enable_interpreter: bool | None, sandbox_type: str | None
+) -> bool:
+    """Resolve the interpreter's tri-state caller option to a concrete boolean.
+
+    Args:
+        enable_interpreter: Explicit caller preference, or `None` to use the
+            sandbox-aware default.
+        sandbox_type: Sandbox backend identifier. Any falsy value (`None`, `""`)
+            or `"none"` is treated as local execution.
+
+    Returns:
+        The explicit `enable_interpreter` value when not `None`; `False` for
+            remote-sandbox defaults; otherwise the configured local default
+            (`settings.enable_interpreter`).
+    """
+    if enable_interpreter is not None:
+        return enable_interpreter
+    if sandbox_type and sandbox_type != "none":
+        return False
+
+    from deepagents_code.config import settings
+
+    return settings.enable_interpreter
+
+
+def _interpreter_suppressed_by_sandbox(
+    *, enable_interpreter: bool | None, sandbox_type: str | None, local_default: bool
+) -> bool:
+    """Whether a remote sandbox suppressed the otherwise-default interpreter.
+
+    Used to decide whether to surface an advisory: returns `True` only when the
+    user made no explicit choice, a remote sandbox is active, and the local
+    default would have enabled it — i.e. the sandbox (not an explicit
+    `--no-interpreter` opt-out, nor a disabled `[interpreter]` config) is why
+    `js_eval` is unavailable.
+
+    Takes the *raw* tri-state caller intent rather than the resolved boolean: a
+    sandbox-suppressed default and an explicit `--no-interpreter` both resolve to
+    `False`, so the resolved value cannot distinguish them. Any explicit choice
+    (`not None`) is the user's own decision and is left unannounced.
+
+    Args:
+        enable_interpreter: The raw tri-state caller intent (`--interpreter` →
+            `True`, `--no-interpreter` → `False`, unset → `None`).
+        sandbox_type: Sandbox backend identifier. Any falsy value (`None`, `""`)
+            or `"none"` is treated as local execution.
+        local_default: The local-mode default (`settings.enable_interpreter`);
+            gating on it keeps the advisory quiet for users who disabled the
+            interpreter in config.
+
+    Returns:
+        `True` when the advisory should be shown, otherwise `False`.
+    """
+    if enable_interpreter is not None:
+        return False
+    if not (sandbox_type and sandbox_type != "none"):
+        return False
+    return local_default
+
+
 @dataclass(frozen=True)
 class ServerConfig:
     """Full configuration payload passed from the app to the server subprocess.
@@ -155,6 +216,13 @@ class ServerConfig:
     enable_interpreter: bool = False
     """Enable `CodeInterpreterMiddleware` (`js_eval` REPL) on the main agent.
 
+    Always the resolved concrete value: `from_cli_args` collapses the tri-state
+    caller option via `_resolve_enable_interpreter` before constructing the
+    config, so the `bool | None` "defer to default" sentinel never reaches this
+    field. The `False` default here is only the bare-constructor/`from_env`
+    fallback; the user-facing default (on in local mode) lives in
+    `settings.enable_interpreter`.
+
     Local-mode only; the server graph raises if a sandbox is configured and
     this flag is `True`.
     """
@@ -341,7 +409,7 @@ class ServerConfig:
         sandbox_setup: str | None,
         enable_shell: bool,
         enable_ask_user: bool,
-        enable_interpreter: bool = False,
+        enable_interpreter: bool | None = None,
         interpreter_ptc: str | list[str] | None = None,
         interpreter_ptc_acknowledge_unsafe: bool = False,
         mcp_config_path: str | None,
@@ -373,7 +441,7 @@ class ServerConfig:
             enable_shell: Enable shell execution tools.
             enable_ask_user: Enable ask_user tool.
             enable_interpreter: Enable `CodeInterpreterMiddleware` on the main
-                agent.
+                agent. `None` uses the sandbox-aware default.
             interpreter_ptc: Override for `settings.interpreter_ptc`.
             interpreter_ptc_acknowledge_unsafe: Mirror of
                 `settings.interpreter_ptc_acknowledge_unsafe`.
@@ -387,6 +455,10 @@ class ServerConfig:
         """
         normalized_mcp = _normalize_path(mcp_config_path, project_context, "MCP config")
 
+        resolved_enable_interpreter = _resolve_enable_interpreter(
+            enable_interpreter, sandbox_type
+        )
+
         return cls(
             model=model_name,
             model_params=model_params,
@@ -397,7 +469,7 @@ class ServerConfig:
             interactive=interactive,
             enable_shell=enable_shell,
             enable_ask_user=enable_ask_user,
-            enable_interpreter=enable_interpreter,
+            enable_interpreter=resolved_enable_interpreter,
             interpreter_ptc=interpreter_ptc,
             interpreter_ptc_acknowledge_unsafe=interpreter_ptc_acknowledge_unsafe,
             sandbox_type=sandbox_type,

{deepagents_code-0.1.23 → deepagents_code-0.1.24}/deepagents_code/_version.py

@@ -2,7 +2,7 @@
 
 # Keep the `x-release-please-version` annotation — release-please uses it to
 # bump `__version__` in sync with `pyproject.toml` on every release PR.
-__version__ = "0.1.23"  # x-release-please-version
+__version__ = "0.1.24"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/code"
 """URL for `deepagents-code` documentation."""

{deepagents_code-0.1.23 → deepagents_code-0.1.24}/deepagents_code/agent.py

@@ -1030,6 +1030,38 @@ def _is_auto_approve_enabled(value: object) -> bool:
     return isinstance(value, bool) and value
 
 
+def _read_live_auto_approve(store: object, key: str | None) -> bool | None:
+    """Return live approval mode from the LangGraph Store when configured.
+
+    Args:
+        store: `request.runtime.store` from the graph server.
+        key: Live approval-mode store key, or `None` when this run has no live
+            control record.
+
+    Returns:
+        `None` when no live key is configured for this run — the caller should
+            fall back to the static `auto_approve` context snapshot.
+        `True` or `False` when a live key is configured: these reflect
+            the stored mode, and `False` is also returned when the key
+            is configured but the store is unreadable (missing item,
+            malformed value, read error), so an unreadable live mode fails
+            closed and interrupts.
+        `None` therefore means "feature not in play," the opposite of the store
+            reader's `None` ("unreadable, be careful").
+    """
+    if not key:
+        return None
+    from deepagents_code.approval_mode import read_approval_mode_from_store
+
+    value = read_approval_mode_from_store(store, key)
+    if value is None:
+        logger.warning(
+            "Approval-mode store item is unavailable; interrupting for safety"
+        )
+        return False
+    return value
+
+
 def _should_interrupt_tool_call(request: ToolCallRequest) -> bool:
     """Decide whether a gated tool call should pause for human approval.
 
@@ -1052,9 +1084,16 @@ def _should_interrupt_tool_call(request: ToolCallRequest) -> bool:
     """
     runtime = getattr(request, "runtime", None)
     ctx = getattr(runtime, "context", None)
+    store = getattr(runtime, "store", None)
     if isinstance(ctx, CLIContextSchema):
+        if (live := _read_live_auto_approve(store, ctx.approval_mode_key)) is not None:
+            return not live
         return not _is_auto_approve_enabled(ctx.auto_approve)
     if isinstance(ctx, dict):
+        raw_key = ctx.get("approval_mode_key")
+        key = raw_key if isinstance(raw_key, str) else None
+        if (live := _read_live_auto_approve(store, key)) is not None:
+            return not live
         # Type-checked (not truthiness) check: over the JSON/RemoteGraph boundary a
         # malformed payload (e.g. "yes", 1) must fail closed and interrupt, not
         # silently auto-approve. Only a genuine boolean `True` suppresses.
@@ -1267,8 +1306,7 @@ def create_cli_agent(
             list or `interpreter_ptc="all"` with
             `interpreter_ptc_acknowledge_unsafe=True`.
 
-            Requires the `quickjs` optional extra
-            (`langchain-quickjs>=0.3.1,<0.4.0`).
+            Requires the core `langchain-quickjs` dependency.
         checkpointer: Optional checkpointer for session persistence.
             When `None`, the graph is compiled without a checkpointer.
         mcp_server_info: MCP server metadata to surface in the system prompt.