deepagents-code 0.1.32__tar.gz → 0.1.34__tar.gz

{deepagents_code-0.1.32 → deepagents_code-0.1.34}/AGENTS.md

@@ -43,7 +43,7 @@ Textual's `App.notify(message)` parses the message string as Rich markup by defa
 Charset-dependent characters and animations have **single sources of truth**. Reuse them instead of hand-rolling new ones — copies drift, and (more subtly) a hardcoded Unicode literal won't degrade to ASCII on terminals that need it.
 
 - **Glyphs** (checkmarks, arrows, ellipsis, cursor, box-drawing, branch icon, etc.): pull from `get_glyphs()` (`config.Glyphs`). Each glyph has a Unicode and an ASCII variant; `get_glyphs()` returns the right set for the active terminal. Never inline `"✓"`, `"…"`, `"›"`, and friends.
-- **Animated spinners**: reuse the `Spinner` class in `widgets/loading.py`, which wraps `get_glyphs().spinner_frames` (braille on Unicode, `(-) (\) (|) (/)` on ASCII) and exposes `next_frame()`/`current_frame()`. Do **not** define your own frame tuples or interval constants for a spinner — drive a `Spinner` on a `set_interval`. The status-bar reconnect indicator (`widgets/status.py`) is the reference example; it ticks at the same 0.1s cadence as `LoadingWidget`. All connection/queue progress lives in the status bar — the welcome banner deliberately stays out of it, so there are currently no bespoke spinners to carve an exception for.
+- **Animated spinners**: reuse the `Spinner` class in `tui/widgets/loading.py`, which wraps `get_glyphs().spinner_frames` (braille on Unicode, `(-) (\) (|) (/)` on ASCII) and exposes `next_frame()`/`current_frame()`. Do **not** define your own frame tuples or interval constants for a spinner — drive a `Spinner` on a `set_interval`. The status-bar reconnect indicator (`tui/widgets/status.py`) is the reference example; it ticks at the same 0.1s cadence as `LoadingWidget`. All connection/queue progress lives in the status bar — the welcome banner deliberately stays out of it, so there are currently no bespoke spinners to carve an exception for.
 
 ### Textual patterns used in this codebase
 
@@ -99,7 +99,7 @@ The `deepagents-code --help` screen is hand-maintained in `ui.show_help()`, sepa
 
 ## Splash screen tips
 
-When adding a user-facing CLI feature (new slash command, keybinding, workflow), add a corresponding tip to the `_TIPS` list in `deepagents_code/widgets/welcome.py`. Tips are shown randomly on startup to help users discover features. Keep tips short and action-oriented (e.g., `"Press ctrl+x to compose prompts in your external editor"`).
+When adding a user-facing CLI feature (new slash command, keybinding, workflow), add a corresponding tip to the `_TIPS` list in `deepagents_code/tui/widgets/welcome.py`. Tips are shown randomly on startup to help users discover features. Keep tips short and action-oriented (e.g., `"Press ctrl+x to compose prompts in your external editor"`).
 
 ## Slash commands
 
@@ -115,7 +115,7 @@ To add a new slash command: (1) add a `SlashCommand` entry to `COMMANDS`, (2) se
 2. `deepagents_code/model_config.py` — if the provider reads a *dedicated* endpoint env var, add `"provider_name": ("CANONICAL_BASE_URL", "ALTERNATE", ...)` to `PROVIDER_BASE_URL_ENV` (see guidelines below); omit the provider entirely when it has no provider-specific endpoint variable
 3. `pyproject.toml` — add `provider = ["langchain-provider>=X.Y.Z,<N.0.0"]` to `[project.optional-dependencies]` and include it in the `all-providers` composite extra
 4. `deepagents_code/model_config.py` — add `"provider_name"` to `RETRY_PARAM_BY_PROVIDER` if the provider's chat model accepts `max_retries`
-5. `deepagents_code/widgets/auth.py` — add `"provider_name": "Display Name"` to `PROVIDER_DISPLAY_NAMES` so the `/auth` UI shows a branded label instead of the title-cased key, and (if the provider issues API keys from a self-serve page) `"provider_name": "https://…"` to `PROVIDER_API_KEY_URLS` so the prompt links straight to the key page
+5. `deepagents_code/tui/widgets/auth.py` — add `"provider_name": "Display Name"` to `PROVIDER_DISPLAY_NAMES` so the `/auth` UI shows a branded label instead of the title-cased key, and (if the provider issues API keys from a self-serve page) `"provider_name": "https://…"` to `PROVIDER_API_KEY_URLS` so the prompt links straight to the key page
 6. `tests/unit_tests/test_model_config.py` — add `assert PROVIDER_API_KEY_ENV["provider_name"] == "ENV_VAR_NAME"` to `TestProviderApiKeyEnv.test_contains_major_providers`, and pin any `PROVIDER_BASE_URL_ENV` entry with a matching assertion
 
 ### `PROVIDER_BASE_URL_ENV` guidelines

{deepagents_code-0.1.32 → deepagents_code-0.1.34}/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.34](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.33...deepagents-code==0.1.34) (2026-07-07)
+
+
+### Bug Fixes
+
+* **code:** show `(local)` tag under ANSI themes ([#4534](https://github.com/langchain-ai/deepagents/issues/4534)) ([699e439](https://github.com/langchain-ai/deepagents/commit/699e439699723e477a621f95eef87a7d76aac5f5))
+
+## [0.1.33](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.32...deepagents-code==0.1.33) (2026-07-06)
+
+### Features
+
+* In-the-moment trust prompt for symlinked skills ([#4200](https://github.com/langchain-ai/deepagents/issues/4200)) ([a4431e4](https://github.com/langchain-ai/deepagents/commit/a4431e4339348431e91533cb2b177259ab94b083))
+* Selective per-server project MCP trust ([#4507](https://github.com/langchain-ai/deepagents/issues/4507)) ([aaa22a9](https://github.com/langchain-ai/deepagents/commit/aaa22a9340cb3d2c8e9ce1a921957d0a9121da20))
+* Add `dcode tools list` command ([#4461](https://github.com/langchain-ai/deepagents/issues/4461)) ([1402d0e](https://github.com/langchain-ai/deepagents/commit/1402d0e735a1580503f240457c77db76fcd779d7))
+
+### Bug Fixes
+
+* Strip media placeholders from model-facing message text ([#4462](https://github.com/langchain-ai/deepagents/issues/4462)) ([aa0ae36](https://github.com/langchain-ai/deepagents/commit/aa0ae36b00df6411a9200610a9075ef2dc28b1af))
+* Re-apply theme preference on `/reload` ([#4514](https://github.com/langchain-ai/deepagents/issues/4514)) ([5d1c392](https://github.com/langchain-ai/deepagents/commit/5d1c3928f7ca0ea97f28fd4d34ae1a4ee885e888))
+
 ## [0.1.32](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.31...deepagents-code==0.1.32) (2026-07-06)
 
 ### Features

{deepagents_code-0.1.32 → deepagents_code-0.1.34}/COMMANDS.md

@@ -29,7 +29,7 @@ aliases, descriptions, visibility, or hidden-command metadata.
 | `/mcp` |  | Manage MCP servers and authentication |
 | `/model` |  | Switch models or edit model settings |
 | `/notifications` |  | Configure startup warnings |
-| `/offload` | `/compact` | Offload older messages to free context |
+| `/offload` | `/compact` | Summarize and offload older messages to free context |
 | `/quit` | `/q` | Exit app |
 | `/reload` |  | Reload environment and config |
 | `/remember` |  | Save useful context to memory or skills |

{deepagents_code-0.1.32 → deepagents_code-0.1.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepagents-code
-Version: 0.1.32
+Version: 0.1.34
 Summary: Terminal interface for Deep Agents - interactive AI agent with file operations, shell access, and sub-agent capabilities.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/
@@ -27,10 +27,10 @@ Classifier: Topic :: Terminals
 Requires-Python: <4.0,>=3.11
 Requires-Dist: aiosqlite<1.0.0,>=0.22.1
 Requires-Dist: deepagents-acp<1.0.0,>=0.0.8
-Requires-Dist: deepagents==0.7.0a3
+Requires-Dist: deepagents==0.7.0a6
 Requires-Dist: httpx<1.0.0,>=0.28.1
 Requires-Dist: langchain-anthropic<2.0.0,>=1.4.7
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.6
+Requires-Dist: langchain-google-genai<5.0.0,>=4.2.7
 Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.0
 Requires-Dist: langchain-openai<2.0.0,>=1.3.3
 Requires-Dist: langchain-quickjs<0.4.0,>=0.3.2
@@ -67,7 +67,7 @@ Requires-Dist: langchain-baseten<1.0.0,>=0.2.1; extra == 'all-providers'
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'all-providers'
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'all-providers'
 Requires-Dist: langchain-fireworks<2.0.0,>=1.4.3; extra == 'all-providers'
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.6; extra == 'all-providers'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.2.7; extra == 'all-providers'
 Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.4; extra == 'all-providers'
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'all-providers'
 Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'all-providers'
@@ -102,7 +102,7 @@ Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'deepseek'
 Provides-Extra: fireworks
 Requires-Dist: langchain-fireworks<2.0.0,>=1.4.3; extra == 'fireworks'
 Provides-Extra: google-genai
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.6; extra == 'google-genai'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.2.7; extra == 'google-genai'
 Provides-Extra: groq
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'groq'
 Provides-Extra: huggingface

{deepagents_code-0.1.32 → deepagents_code-0.1.34}/THREAT_MODEL.md

@@ -12,8 +12,8 @@
 
 - `deepagents_code/` — all Python source modules shipped as the `deepagents-code` package
 - CLI entry point (`main.py`, `__init__.py`)
-- Interactive TUI (`app.py`, `textual_adapter.py`, `widgets/`)
-- Non-interactive pipeline runner (`non_interactive.py`)
+- Interactive TUI (`app.py`, `tui/textual_adapter.py`, `tui/widgets/`)
+- Non-interactive pipeline runner (`client/non_interactive.py`)
 - Agent creation (`agent.py`)
 - Built-in tools (`tools.py`: `http_request`, `web_search`, `fetch_url`)
 - MCP config loader and trust store (`mcp_tools.py`, `mcp_trust.py`)
@@ -22,8 +22,8 @@
 - Session persistence (`sessions.py`)
 - Configuration system (`config.py`, `model_config.py`)
 - Unicode/URL safety helpers (`unicode_security.py`)
-- LangGraph dev server subprocess management (`server.py`, `server_manager.py`, `server_graph.py`)
-- Remote agent client (`remote_client.py`)
+- LangGraph dev server subprocess management (`client/launch/server.py`, `client/launch/server_manager.py`, `server_graph.py`)
+- Remote agent client (`client/remote_client.py`)
 - Local context middleware (`local_context.py`)
 - Custom subagent loader (`subagents.py`, `agent.py:load_async_subagents`)
 - Conversation offload (`offload.py`)
@@ -47,7 +47,7 @@
 3. `~/.deepagents/` is only writable by the authenticated local user — no multi-user shared home directories.
 4. Sandbox backends are trusted third-party services. CLI responsibility ends at correctly constructing and dispatching requests to them.
 5. LangSmith tracing, if enabled, is user-opted-in via environment variables.
-6. The LangGraph dev server subprocess binds to `127.0.0.1` by default (`server.py:_DEFAULT_HOST`) and is ephemeral — started and stopped per CLI session.
+6. The LangGraph dev server subprocess binds to `127.0.0.1` by default (`client/launch/server.py:_DEFAULT_HOST`) and is ephemeral — started and stopped per CLI session.
 7. `DA_SERVER_*` environment variables are readable only by the CLI process and its child server subprocess (OS process isolation assumption).
 8. Users who set `class_path` in `config.toml` accept the same trust model as `pyproject.toml` build scripts — they control their own machine.
 
@@ -68,19 +68,19 @@
 │                 ┌────────────────┼─────────────────────┐             │
 │                 ▼                ▼                     ▼             │
 │        C2: TUI (app.py)  C2b: Non-interactive   C13: Config Channel  │
-│                 │         (non_interactive.py)  (DA_SERVER_* env vars)│
+│                 │      (client/non_interactive.py) (DA_SERVER_* vars) │
 │ - - - - - - - - - - TB8: CLI / Server IPC - - - - - │ - - - - - - - │
 │                 │                                     ▼              │
-│                 │               C11: Server Manager (server_manager) │
+│                 │        C11: Server Manager (client/launch)          │
 │                 │                      │ spawns                      │
 │                 │                      ▼                             │
 │                 │           C11b: LangGraph Dev Server               │
-│                 │           (server.py:ServerProcess)                │
+│                 │     (client/launch/server.py:ServerProcess)        │
 │                 │           LANGGRAPH_AUTH_TYPE=noop                 │
 │ - - - - - - - - │ - - - - - TB10: RemoteAgent / Dev Server - - - -  │
 │                 │                      ▲                             │
 │                 └─►C12: RemoteAgent────┘ (HTTP+SSE on 127.0.0.1)    │
-│                     (remote_client.py)                               │
+│                     (client/remote_client.py)                        │
 │                            │                                         │
 │                     C3: Agent Engine (server_graph.py)               │
 │                     (create_cli_agent, deepagents SDK)               │
@@ -122,7 +122,7 @@
 | ID  | Component                   | Description                                                                                                         | Trust Level          | Default? | Entry Points                                                                                      |
 |-----|-----------------------------|---------------------------------------------------------------------------------------------------------------------|----------------------|----------|---------------------------------------------------------------------------------------------------|
 | C1  | CLI Entry Point             | Parses argv, loads config/env, bootstraps session                                                                   | framework-controlled | Yes      | `main.cli_main`, `main.parse_args`                                                                |
-| C2  | TUI / Non-interactive       | Textual UI for interactive chat; `non_interactive.py` for headless pipelines (both use `RemoteAgent`)               | framework-controlled | Yes      | `app.DeepAgentsApp.run`, `non_interactive.run_non_interactive`                                    |
+| C2  | TUI / Non-interactive       | Textual UI for interactive chat; `client/non_interactive.py` for headless pipelines (both use `RemoteAgent`)        | framework-controlled | Yes      | `app.DeepAgentsApp.run`, `client.non_interactive.run_non_interactive`                             |
 | C3  | Agent Engine                | LangGraph agent graph running inside `langgraph dev` server, assembled by `create_cli_agent`                        | framework-controlled | Yes      | `agent.create_cli_agent`, `agent._add_interrupt_on`, `server_graph.make_graph`                    |
 | C4  | Built-in Tools              | `http_request`, `web_search` (Tavily), `fetch_url` (HTML→markdown)                                                 | framework-controlled | Partial¹ | `tools.http_request`, `tools.web_search`, `tools.fetch_url`                                       |
 | C5  | MCP Loader & Trust          | Discovers/loads `.mcp.json`, validates server configs, manages trust store                                          | framework-controlled | No²      | `mcp_tools.resolve_and_load_mcp_tools`, `mcp_trust.compute_config_fingerprint`                   |
@@ -131,8 +131,8 @@
 | C8  | Session Persistence         | SQLite checkpoint store for LangGraph thread state                                                                  | framework-controlled | Yes      | `sessions.get_db_path`, `sessions.generate_thread_id`                                             |
 | C9  | Configuration System        | TOML config, env vars, `AGENTS.md` system prompts, model config                                                    | user-controlled      | N/A      | `config.settings`, `model_config.ModelConfig`, `~/.deepagents/config.toml`                        |
 | C10 | Unicode/URL Safety          | Detects hidden Unicode, checks URL domain spoofing for approval UI warnings                                         | framework-controlled | Yes      | `unicode_security.detect_dangerous_unicode`, `unicode_security.check_url_safety`                  |
-| C11 | LangGraph Dev Server        | Subprocess running `langgraph dev` with `LANGGRAPH_AUTH_TYPE=noop`; managed by `ServerProcess`                      | framework-controlled | Yes⁵     | `server.ServerProcess.start`, `server.generate_langgraph_json`, `server_manager.start_server_and_get_agent` |
-| C12 | Remote Agent Client         | HTTP+SSE client wrapping `RemoteGraph`; connects to C11 on localhost                                                | framework-controlled | Yes⁵     | `remote_client.RemoteAgent.astream`, `remote_client.RemoteAgent.aget_state`                       |
+| C11 | LangGraph Dev Server        | Subprocess running `langgraph dev` with `LANGGRAPH_AUTH_TYPE=noop`; managed by `ServerProcess`                      | framework-controlled | Yes⁵     | `client.launch.server.ServerProcess.start`, `client.launch.server.generate_langgraph_json`, `client.launch.server_manager.start_server_and_get_agent` |
+| C12 | Remote Agent Client         | HTTP+SSE client wrapping `RemoteGraph`; connects to C11 on localhost                                                | framework-controlled | Yes⁵     | `client.remote_client.RemoteAgent.astream`, `client.remote_client.RemoteAgent.aget_state`         |
 | C13 | Server Config Channel       | Passes CLI config to server subprocess via `DA_SERVER_*` environment variables                                      | framework-controlled | Yes      | `_server_config.ServerConfig.to_env`, `_server_config.ServerConfig.from_env`                      |
 | C14 | Async Subagent Config       | Loads remote LangGraph deployment specs from `[async_subagents]` in `config.toml`                                  | user-controlled      | No       | `agent.load_async_subagents`                                                                      |
 | C15 | LocalContext Middleware      | Runs a bash detection script via backend; injects git/project/env context into system prompt each turn              | framework-controlled | Yes⁶     | `local_context.LocalContextMiddleware.before_agent`, `local_context.build_detect_script`          |
@@ -164,7 +164,7 @@
 #### DC1: API Keys / Credentials
 
 - **Fields**: `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `TAVILY_API_KEY`, `LANGSMITH_API_KEY`, `LANGGRAPH_API_KEY`, and any provider-specific keys in the user's environment.
-- **Storage**: Loaded from environment at process start (`config.py`). The CLI explicitly strips `LANGGRAPH_CLOUD_LICENSE_KEY` and related auth vars from the server subprocess environment (`server.py:_build_server_env`) but passes the remaining env vars (including provider API keys) to the server subprocess via `os.environ.copy()`.
+- **Storage**: Loaded from environment at process start (`config.py`). The CLI explicitly strips `LANGGRAPH_CLOUD_LICENSE_KEY` and related auth vars from the server subprocess environment (`client/launch/server.py:_build_server_env`) but passes the remaining env vars (including provider API keys) to the server subprocess via `os.environ.copy()`.
 - **Access**: Available to both the CLI process and the server subprocess (which inherits the full environment minus stripped vars).
 - **Encryption**: Not encrypted — in-memory process environment only.
 - **Retention**: Process lifetime; cleared on CLI exit.
@@ -206,20 +206,20 @@
 | TB7  | External LLM API → Agent State        | LLM API responses drive tool call decisions                                | LLM client configuration, model selection, request params                       | LLM output content; provider-side safety                      |
 | TB8  | CLI → Server Subprocess IPC           | Config passed from CLI to `langgraph dev` subprocess via `DA_SERVER_*` env vars | `ServerConfig.to_env()` serialization; env var scoping to parent+child process | Subprocess environment post-fork; /proc visibility to same-uid processes |
 | TB9  | LocalContextMiddleware → Host Env     | Bash detect script output (git info, project files, Makefile) injected into system prompt | Script is framework-generated static code; 30s timeout; exit-code check | Content of Makefile, pyproject.toml, git branch names, directory listing |
-| TB10 | RemoteAgent → LangGraph Dev Server    | CLI communicates with agent via HTTP+SSE on localhost                       | Server bound to `127.0.0.1` (`server.py:_DEFAULT_HOST`); ephemeral per session | No authentication (`LANGGRAPH_AUTH_TYPE=noop`); any localhost process can reach the API |
+| TB10 | RemoteAgent → LangGraph Dev Server    | CLI communicates with agent via HTTP+SSE on localhost                       | Server bound to `127.0.0.1` (`client/launch/server.py:_DEFAULT_HOST`); ephemeral per session | No authentication (`LANGGRAPH_AUTH_TYPE=noop`); any localhost process can reach the API |
 | TB11 | Config File → Code Execution          | `class_path` in `config.toml` triggers `importlib.import_module()`; project/global `.env` values are loaded into the process environment and can reach Bash startup hooks | Format validation (`module:ClassName`); `issubclass(BaseChatModel)` check; dotenv loading denies shell startup / environment-hijack keys (`BASH_ENV`, `ENV`) | Module-level side effects execute during import; user controls config file; project files in the working directory influence execution |
 
 ### Boundary Details
 
 #### TB1: User Input → Agent Engine
 
-- **Inside**: `app.DeepAgentsApp` routes keystrokes to message queue; `non_interactive.run_non_interactive` reads from stdin/argv. Both paths now go through `RemoteAgent.astream` to the server. Session ID assigned per thread (`sessions.generate_thread_id`).
+- **Inside**: `app.DeepAgentsApp` routes keystrokes to message queue; `client.non_interactive.run_non_interactive` reads from stdin/argv. Both paths now go through `RemoteAgent.astream` to the server. Session ID assigned per thread (`sessions.generate_thread_id`).
 - **Outside**: Prompt content — the agent accepts any text the user types. No content filtering at this layer (HITL handles downstream tool calls, not prompt intent).
-- **Crossing mechanism**: HTTP POST to `127.0.0.1:{port}` via `remote_client.RemoteAgent.astream`.
+- **Crossing mechanism**: HTTP POST to `127.0.0.1:{port}` via `client.remote_client.RemoteAgent.astream`.
 
 #### TB2: LLM Decision → Tool Execution Gate (HITL)
 
-- **Inside**: `agent._add_interrupt_on` registers interrupt configs for `execute`, `write_file`, `edit_file`, `web_search`, `fetch_url`, `task`, `compact_conversation`, `launch_async_subagent`, `update_async_subagent`, `cancel_async_subagent`. In non-interactive mode, `non_interactive._handle_action_request` enforces the shell allow-list via `config.is_shell_command_allowed`.
+- **Inside**: `agent._add_interrupt_on` registers interrupt configs for `execute`, `write_file`, `edit_file`, `web_search`, `fetch_url`, `task`, `compact_conversation`, `launch_async_subagent`, `update_async_subagent`, `cancel_async_subagent`. In non-interactive mode, `client.non_interactive._handle_action_request` enforces the shell allow-list via `config.is_shell_command_allowed`.
 - **Outside**: Once the user clicks "approve" (interactive) or a command passes the allow-list check (non-interactive), the tool executes with no further framework-level gating.
 - **Crossing mechanism**: LangGraph HITL interrupt routed through `RemoteAgent` SSE stream.
 - **Key note**: `auto_approve` mode bypasses all HITL approval prompts while still displaying Unicode/URL warnings.
@@ -232,13 +232,13 @@
 
 #### TB4: MCP Config → Process / Network
 
-- **Inside**: `mcp_tools._validate_server_config` validates JSON structure and field types. `mcp_trust.compute_config_fingerprint` computes SHA-256 over config file contents. Project-level stdio servers require trust approval (fingerprint prompt) unless `--trust-project-mcp` is set.
+- **Inside**: `mcp_tools._validate_server_config` validates JSON structure and field types. `mcp_trust.compute_config_fingerprint` computes SHA-256 over config file contents. Project-level stdio servers require trust approval (fingerprint prompt) unless `--trust-project-mcp` is set. A user can selectively pre-approve or reject individual project servers by name via `[mcp].enabled_project_servers` / `disabled_project_servers` (or the `DEEPAGENTS_CODE_ENABLED_PROJECT_MCP_SERVERS` / `..._DISABLED_...` env vars); reject wins over approval and over full trust. These lists are read by `model_config.load_mcp_server_trust_lists` only from user-controlled sources — the user-level `~/.deepagents/config.toml`, the global `~/.deepagents/.env`, and shell-exported env — never from `.mcp.json` or any repo-committed file, so a committed config cannot self-approve its own servers. In particular, the env forms (`DEEPAGENTS_CODE_ENABLED_PROJECT_MCP_SERVERS` / `..._DISABLED_...`) are added to `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, so a committed *project* `.env` cannot inject them into `os.environ` even though it is loaded at bootstrap. Enabled resolves env-over-TOML, but disabled *unions* TOML and env so a deny can never be silently emptied by the other source. If the user's `config.toml` exists but cannot be read or parsed, the loader fails closed (project configs are treated as untrusted and the error is surfaced) rather than proceeding with an empty deny list. Only allowlisted (or fully trusted) names survive into the merged config, so a non-allowlisted remote entry is never preflighted and its interpolated headers are never resolved. Note that the allow list binds by server *name*, not by fingerprint: an allowlisted name is loaded whatever definition the repo currently gives it, bypassing the fingerprint change-detection that re-prompts on full-config trust — so users should only allowlist names in repos they would otherwise trust.
 - **Outside**: Stdio server `command`, `args`, and `env` fields are user-controlled strings passed directly to `StdioConnection`. The `env` dict from MCP config is forwarded without filtering — users can set arbitrary environment variables (including `PATH`, `LD_PRELOAD`, `PYTHONPATH`) for the MCP subprocess.
 - **Crossing mechanism**: `subprocess.Popen` (via `langchain_mcp_adapters`) for stdio; HTTP/SSE for remote servers.
 
 #### TB8: CLI → Server Subprocess IPC
 
-- **Inside**: `ServerConfig.to_env()` serializes all config (model, assistant_id, system_prompt, sandbox settings, cwd, MCP config path, shell-enable flags) to `DA_SERVER_*` env vars. `server_manager._apply_server_config` writes these to `os.environ` before `subprocess.Popen`. `server.py:_build_server_env` strips cloud auth vars (`LANGGRAPH_CLOUD_LICENSE_KEY`, `LANGSMITH_CONTROL_PLANE_API_KEY`, `LANGSMITH_TENANT_ID`, `LANGGRAPH_AUTH`).
+- **Inside**: `ServerConfig.to_env()` serializes all config (model, assistant_id, system_prompt, sandbox settings, cwd, MCP config path, shell-enable flags) to `DA_SERVER_*` env vars. `client.launch.server_manager._apply_server_config` writes these to `os.environ` before `subprocess.Popen`. `client/launch/server.py:_build_server_env` strips cloud auth vars (`LANGGRAPH_CLOUD_LICENSE_KEY`, `LANGSMITH_CONTROL_PLANE_API_KEY`, `LANGSMITH_TENANT_ID`, `LANGGRAPH_AUTH`).
 - **Outside**: The full parent environment including provider API keys flows to the child via `os.environ.copy()`. The system prompt string becomes `DA_SERVER_SYSTEM_PROMPT`. After process start, the env is fixed — no runtime mutation across processes.
 - **Crossing mechanism**: `subprocess.Popen` env kwarg; subsequent `os.environ` reads in `_server_config.ServerConfig.from_env`.
 
@@ -250,7 +250,7 @@
 
 #### TB10: RemoteAgent → LangGraph Dev Server
 
-- **Inside**: Server bound to `127.0.0.1` by default; `server.py:_DEFAULT_HOST = "127.0.0.1"`. `RemoteAgent` only connects to the URL returned by `ServerProcess.url`. Server is ephemeral — started at session start, stopped at session end. Binds a free ephemeral port by default (`server.py:_EPHEMERAL_PORT`); an explicit port is honored but still falls back to a free port if occupied.
+- **Inside**: Server bound to `127.0.0.1` by default; `client/launch/server.py:_DEFAULT_HOST = "127.0.0.1"`. `RemoteAgent` only connects to the URL returned by `ServerProcess.url`. Server is ephemeral — started at session start, stopped at session end. Binds a free ephemeral port by default (`client/launch/server.py:_EPHEMERAL_PORT`); an explicit port is honored but still falls back to a free port if occupied.
 - **Outside**: `LANGGRAPH_AUTH_TYPE=noop` disables all LangGraph server authentication. Any process on localhost that discovers the port can submit requests, read thread state, or inject messages.
 - **Crossing mechanism**: HTTP POST/GET to `http://127.0.0.1:{port}` using `langgraph.pregel.remote.RemoteGraph`.
 
@@ -339,7 +339,7 @@
 | ID  | Data Flow | Classification | Threat                                                                                      | Boundary | Severity | Validation | Code Reference                                                         |
 |-----|-----------|----------------|---------------------------------------------------------------------------------------------|----------|----------|------------|------------------------------------------------------------------------|
 | T1  | DF8, DF9  | —              | Prompt injection via fetched web content causes LLM to request harmful actions              | TB3      | Medium   | Likely     | `tools.fetch_url`, `agent._add_interrupt_on`                          |
-| T2  | DF7       | —              | `--shell-allow-list all` removes pattern checks; LLM-injected shell commands execute without approval in non-interactive mode | TB2 | Medium | Verified | `config.is_shell_command_allowed`, `non_interactive._handle_action_request` |
+| T2  | DF7       | —              | `--shell-allow-list all` removes pattern checks; LLM-injected shell commands execute without approval in non-interactive mode | TB2 | Medium | Verified | `config.is_shell_command_allowed`, `client.non_interactive._handle_action_request` |
 | T3  | DF7       | —              | Unicode-homoglyph URL in LLM-generated tool args deceives user during approval              | TB2      | Low      | Disproven  | `unicode_security.check_url_safety`, `agent._format_fetch_url_description` |
 | T4  | DF5, DF9  | —              | Auto-approve mode bypasses all HITL gates; any LLM-initiated tool call executes             | TB2      | Low      | Verified   | `agent.create_cli_agent` (`auto_approve` param), `agent._add_interrupt_on` |
 | T5  | DF13, DF14| DC2            | Local SQLite checkpoint file tampered with to inject adversarial content into future LLM context | None | Low   | Unverified | `sessions.get_db_path`                                                 |
@@ -385,7 +385,7 @@
 #### T6: Unauthenticated LangGraph Dev Server on Localhost
 
 - **Flow**: DF3/DF4 (CLI ↔ LangGraph dev server)
-- **Description**: The CLI spawns a `langgraph dev` server subprocess with `LANGGRAPH_AUTH_TYPE=noop` (`server.py:_build_server_env`). This disables all server-side authentication. The server binds to `127.0.0.1:{port}` (a free ephemeral port by default, so it no longer squats the well-known `langgraph dev` port 2024). Any local process that discovers the port can: send arbitrary inputs to the running agent thread, read the agent's conversation state (including tool results that may contain file contents or secrets), inject messages into the conversation history, or trigger state updates. The server is ephemeral — it lives only for the duration of the CLI session — but this is the entire attack window. Port discovery is feasible via localhost port scanning or by reading `/proc/{pid}/cmdline` which contains the `--port` argument.
+- **Description**: The CLI spawns a `langgraph dev` server subprocess with `LANGGRAPH_AUTH_TYPE=noop` (`client/launch/server.py:_build_server_env`). This disables all server-side authentication. The server binds to `127.0.0.1:{port}` (a free ephemeral port by default, so it no longer squats the well-known `langgraph dev` port 2024). Any local process that discovers the port can: send arbitrary inputs to the running agent thread, read the agent's conversation state (including tool results that may contain file contents or secrets), inject messages into the conversation history, or trigger state updates. The server is ephemeral — it lives only for the duration of the CLI session — but this is the entire attack window. Port discovery is feasible via localhost port scanning or by reading `/proc/{pid}/cmdline` which contains the `--port` argument.
 - **Preconditions**: (1) Attacker has a local process running as the same user (or as root); (2) Attacker discovers the server port (port scan on localhost, or reads process arguments).
 
 #### T7: LocalContextMiddleware Injects Host File Contents into System Prompt

{deepagents_code-0.1.32 → deepagents_code-0.1.34}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "9d4d7ba"
+BUILD_COMMIT = "bd9bafa"

{deepagents_code-0.1.32 → deepagents_code-0.1.34}/deepagents_code/_env_vars.py

@@ -93,6 +93,42 @@ real PyPI release.
 Any non-empty value enables the flag (including `"0"` or `"false"`).
 """
 
+DISABLED_PROJECT_MCP_SERVERS = "DEEPAGENTS_CODE_DISABLED_PROJECT_MCP_SERVERS"
+"""Comma-separated project MCP server names to always reject by name.
+
+A user-level equivalent of `[mcp].disabled_project_servers`.
+
+Rejection wins over approval: a name listed here is dropped even when it also
+appears in `ENABLED_PROJECT_MCP_SERVERS` (or `[mcp].enabled_project_servers`)
+and even when the project config is otherwise trusted. Unlike the enabled list,
+this env var *unions* with (rather than replaces)
+`[mcp].disabled_project_servers` — denies accumulate across sources, so neither
+can silently empty a deny set in the other. This is process env the user
+controls, not a repo file, so it does not weaken the user-level-only
+trust boundary: a committed *project* `.env` is blocked from setting it
+(see `config._PROJECT_DOTENV_DENIED_ENV_KEYS`); only the user's shell,
+launch env, or global `~/.deepagents/.env` can.
+"""
+
+ENABLED_PROJECT_MCP_SERVERS = "DEEPAGENTS_CODE_ENABLED_PROJECT_MCP_SERVERS"
+"""Comma-separated project MCP server names to pre-approve by name.
+
+A user-level equivalent of `[mcp].enabled_project_servers`.
+
+Servers named here load from an otherwise-untrusted project `.mcp.json` without
+prompting (they are omitted from the interactive approval prompt), while
+non-listed servers stay dropped. Like `DISABLED_PROJECT_MCP_SERVERS`, this is
+user-controlled process env, not a repo file, so it does not weaken
+the user-level-only trust boundary (a committed *project* `.env` cannot set it;
+see `config._PROJECT_DOTENV_DENIED_ENV_KEYS`). This contract is name-based:
+a project command or URL change under the same server name still matches.
+
+When set, this replaces (takes precedence over) the
+`[mcp].enabled_project_servers` TOML list.
+(`DISABLED_PROJECT_MCP_SERVERS` instead *unions* with its TOML list, so a deny
+is never silently emptied.)
+"""
+
 EXTERNAL_EVENT_SOCKET = "DEEPAGENTS_CODE_EXTERNAL_EVENT_SOCKET"
 """Enable the local Unix-socket external event listener.
 

deepagents_code-0.1.34/deepagents_code/_fake_models.py

@@ -0,0 +1,66 @@
+"""Fake chat model base shared by integration tests and tool enumeration.
+
+Holds the tool-binding base that both the local integration-test fakes
+(`_testing_models`) and the `dcode tools list` tool-enumeration path
+(`tool_catalog._CatalogModel`) build on. It lives in a use-neutral module — not
+under a `_testing_`-prefixed name — so a production import path never depends on
+something that reads as test-only and might be pruned or excluded from the wheel.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from langchain_core.language_models.fake_chat_models import GenericFakeChatModel
+from pydantic import Field
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Sequence
+
+    from langchain_core.language_models import LanguageModelInput
+    from langchain_core.messages import AIMessage
+    from langchain_core.runnables import Runnable
+    from langchain_core.tools import BaseTool
+
+
+_TOOL_BINDING_MODEL_PROFILE: dict[str, Any] = {
+    "tool_calling": True,
+    "max_input_tokens": 8000,
+}
+"""Minimal capability profile the agent runtime reads while compiling a model.
+
+Only `tool_calling` is load-bearing — the agent negotiates tool support at
+setup. `max_input_tokens` is part of the profile surface but inert here: these
+models are compiled to bind tools and are never invoked, so no token budget ever
+applies. Defined once so both the integration-test fakes and
+`tool_catalog._CatalogModel` share a single source of truth.
+"""
+
+
+class _ToolBindingFakeModel(GenericFakeChatModel):
+    """Base for fake chat models that must bind tools but are never invoked.
+
+    The agent runtime calls `model.bind_tools(schemas)` and reads `model.profile`
+    while compiling the graph, and a bare `GenericFakeChatModel` cannot be
+    compiled into an agent graph: it inherits `BaseChatModel.bind_tools`, which
+    raises `NotImplementedError`, and its `profile` is `None`, which breaks
+    capability negotiation. This base supplies a no-op `bind_tools` passthrough
+    and a minimal `profile`, leaving subclasses to add generation behavior
+    (tests) or nothing at all (tool enumeration).
+    """
+
+    # Required by `GenericFakeChatModel`, but subclasses never consume it.
+    messages: object = Field(default_factory=lambda: iter(()))
+    profile: dict[str, Any] | None = Field(
+        default_factory=lambda: dict(_TOOL_BINDING_MODEL_PROFILE)
+    )
+
+    def bind_tools(
+        self,
+        tools: Sequence[dict[str, Any] | type | Callable | BaseTool],  # noqa: ARG002
+        *,
+        tool_choice: str | None = None,  # noqa: ARG002
+        **kwargs: Any,  # noqa: ARG002
+    ) -> Runnable[LanguageModelInput, AIMessage]:
+        """Return self so the agent can bind tool schemas without a real model."""
+        return self

{deepagents_code-0.1.32 → deepagents_code-0.1.34}/deepagents_code/_session_stats.py

@@ -1,6 +1,8 @@
-"""Lightweight session statistics and token formatting utilities.
+"""Lightweight session statistics, token formatting, and usage-table rendering.
 
-This module is intentionally kept free of heavy dependencies (no pydantic, no
+Holds `SessionStats`/`ModelStats`, the `format_token_count` formatter, and
+`print_usage_table` (which imports `rich.table` lazily). The module is
+intentionally kept free of heavy top-level dependencies (no pydantic, no
 config, no widget imports) so that `app.py` can import `SessionStats` and
 `format_token_count` at module level without pulling in the full
 `textual_adapter` dependency tree.
@@ -9,7 +11,12 @@ config, no widget imports) so that `app.py` can import `SessionStats` and
 from __future__ import annotations
 
 from dataclasses import dataclass, field
-from typing import Literal
+from typing import TYPE_CHECKING, Literal
+
+from deepagents_code.formatting import format_duration
+
+if TYPE_CHECKING:
+    from rich.console import Console
 
 SpinnerStatus = (
     Literal[
@@ -150,3 +157,79 @@ def format_token_count(count: int) -> str:
     if count >= 1000:  # noqa: PLR2004
         return f"{count / 1000:.1f}K"
     return str(count)
+
+
+def print_usage_table(
+    stats: SessionStats,
+    wall_time: float,
+    console: Console,
+) -> None:
+    """Print a model-usage stats table to a Rich console.
+
+    Each row shows the serving provider alongside the model name. When the
+    session spans multiple models each gets its own row with a totals row
+    appended; single-model sessions show one row.
+
+    Args:
+        stats: Cumulative session stats.
+        wall_time: Total wall-clock time in seconds.
+        console: Rich console for output.
+    """
+    from rich.table import Table
+
+    has_time = wall_time >= 0.1  # noqa: PLR2004
+    if not (stats.request_count or stats.input_tokens or has_time):
+        return
+
+    if stats.per_model:
+        multi_model = len(stats.per_model) > 1
+
+        table = Table(
+            show_header=True,
+            header_style="bold",
+            box=None,
+            padding=(0, 2, 0, 0),
+            show_edge=False,
+        )
+        table.add_column("Provider", style="dim")
+        table.add_column("Model", style="dim")
+        table.add_column("Reqs", justify="right", style="dim")
+        table.add_column("InputTok", justify="right", style="dim")
+        table.add_column("OutputTok", justify="right", style="dim")
+
+        if multi_model:
+            for ms in stats.per_model.values():
+                table.add_row(
+                    ms.provider,
+                    ms.model_name,
+                    str(ms.request_count),
+                    format_token_count(ms.input_tokens),
+                    format_token_count(ms.output_tokens),
+                )
+            table.add_row(
+                "",
+                "Total",
+                str(stats.request_count),
+                format_token_count(stats.input_tokens),
+                format_token_count(stats.output_tokens),
+            )
+        else:
+            ms = next(iter(stats.per_model.values()))
+            table.add_row(
+                ms.provider,
+                ms.model_name,
+                str(stats.request_count),
+                format_token_count(stats.input_tokens),
+                format_token_count(stats.output_tokens),
+            )
+
+        console.print()
+        console.print("[bold]Usage Stats[/bold]")
+        console.print(table)
+    if has_time:
+        console.print()
+        console.print(
+            f"Agent active  {format_duration(wall_time)}",
+            style="dim",
+            highlight=False,
+        )

{deepagents_code-0.1.32 → deepagents_code-0.1.34}/deepagents_code/_testing_models.py

@@ -1,21 +1,23 @@
-"""Internal chat models used by local integration tests."""
+"""Internal fake chat models for local integration tests.
+
+The tool-binding base these build on (`_fake_models._ToolBindingFakeModel`) is
+factored out into a use-neutral module so the `dcode tools list` enumeration
+path can reuse it without importing this test-named module.
+"""
 
 from __future__ import annotations
 
 from typing import TYPE_CHECKING, Any
 
-from langchain_core.language_models.fake_chat_models import GenericFakeChatModel
 from langchain_core.messages import AIMessage, BaseMessage
 from langchain_core.outputs import ChatGeneration, ChatResult
-from pydantic import Field
+
+from deepagents_code._fake_models import _ToolBindingFakeModel
 
 if TYPE_CHECKING:
-    from collections.abc import Callable, Sequence
+    from collections.abc import Callable
 
     from langchain_core.callbacks import CallbackManagerForLLMRun
-    from langchain_core.language_models import LanguageModelInput
-    from langchain_core.runnables import Runnable
-    from langchain_core.tools import BaseTool
 
 
 # Prompt markers that drive `ToolCallingIntegrationChatModel`. Each marker is the
@@ -33,13 +35,13 @@ TOP_LEVEL_WRITE_CONTENT = "auto-approved"
 SUBAGENT_WRITE_CONTENT = "auto-approved-subagent"
 
 
-class DeterministicIntegrationChatModel(GenericFakeChatModel):
+class DeterministicIntegrationChatModel(_ToolBindingFakeModel):
     """Deterministic chat model for integration tests.
 
-    This subclasses LangChain's `GenericFakeChatModel` so the implementation
-    stays aligned with the core fake-chat-model test surface, while overriding
-    generation to remain prompt-driven and restart-safe for real CLI server
-    integration tests.
+    This subclasses `_ToolBindingFakeModel` (itself a `GenericFakeChatModel`) so
+    the implementation stays aligned with the core fake-chat-model test surface,
+    while overriding generation to remain prompt-driven and restart-safe for real
+    CLI server integration tests.
 
     Why the existing `langchain_core` fakes cannot be reused here:
 
@@ -53,13 +55,15 @@ class DeterministicIntegrationChatModel(GenericFakeChatModel):
         identical output regardless of process lifecycle.
 
     2. The agent runtime calls `model.bind_tools(schemas)` during
-        initialization. None of the core fakes implement `bind_tools`, so they
-        raise `AttributeError` in any agent-loop context. This model provides a
+        initialization. A bare `GenericFakeChatModel` inherits
+        `BaseChatModel.bind_tools`, which raises `NotImplementedError` in any
+        agent-loop context. The inherited `_ToolBindingFakeModel` supplies a
         no-op passthrough.
 
     3. The app server reads `model.profile` for capability negotiation (e.g.
-        `tool_calling`, `max_input_tokens`). Core fakes have no such attribute,
-        causing `AttributeError` or silent misconfiguration at runtime.
+        `tool_calling`, `max_input_tokens`). A bare fake's `profile` is `None`,
+        causing silent misconfiguration at runtime. The inherited
+        `_ToolBindingFakeModel` supplies a minimal profile.
 
     Additionally, the compact middleware issues summarization prompts mid-
     conversation. A list-based model cannot distinguish these from normal user
@@ -68,24 +72,8 @@ class DeterministicIntegrationChatModel(GenericFakeChatModel):
     """
 
     model: str = "fake"
-    # Required by `GenericFakeChatModel`, but our override does not consume it.
-    messages: object = Field(default_factory=lambda: iter(()))
-    profile: dict[str, Any] | None = Field(
-        default_factory=lambda: {
-            "tool_calling": True,
-            "max_input_tokens": 8000,
-        }
-    )
-
-    def bind_tools(
-        self,
-        tools: Sequence[dict[str, Any] | type | Callable | BaseTool],  # noqa: ARG002
-        *,
-        tool_choice: str | None = None,  # noqa: ARG002
-        **kwargs: Any,  # noqa: ARG002
-    ) -> Runnable[LanguageModelInput, AIMessage]:
-        """Return self so the agent can bind tool schemas during tests."""
-        return self
+    # `messages`, `profile`, and the `bind_tools` passthrough are inherited from
+    # `_ToolBindingFakeModel`; this model adds only prompt-driven generation.
 
     def _generate(
         self,