deepagents-code 0.1.44__tar.gz → 0.1.45__tar.gz

{deepagents_code-0.1.44 → deepagents_code-0.1.45}/AGENTS.md

@@ -62,6 +62,7 @@ Apply these rules to new UI; do not treat them as a mandate to refactor existing
 - Co-locate a screen's `.tcss` file with its root component and set `CSS_PATH` relative to that module. Its styles may target sibling and small nested components, but a large nested component should generally own its own stylesheet.
 - Widgets cannot use `CSS_PATH`; put intrinsic, auto-scoped defaults in `DEFAULT_CSS`. The mounting screen owns the widget's sizing and placement.
 - Children must not import parent components. They may import shared utilities and data models; send events up and pass state/data down.
+- A `ModalScreen` root inherits Textual's default translucent backdrop (`background: $background 60%`, which degrades to transparent under ansi themes) so it dims and composites the content underneath. Don't override it with `background: transparent` unless the modal is deliberately a non-dimming popover (as some selector overlays are); doing so by accident removes the dim.
 
 ### Testing Textual apps
 

{deepagents_code-0.1.44 → deepagents_code-0.1.45}/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.45](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.44...deepagents-code==0.1.45) (2026-07-22)
+
+### Features
+
+- Added the Hooks v2 execution engine and typed hooks data models ([#4880](https://github.com/langchain-ai/deepagents/issues/4880), [#4870](https://github.com/langchain-ai/deepagents/issues/4870))
+- Added a filesystem tool allowlist for `dcode` with `--allow-fs-tools` ([#4635](https://github.com/langchain-ai/deepagents/issues/4635))
+- Added a GLM-5.2 harness profile ([#4710](https://github.com/langchain-ai/deepagents/issues/4710))
+- Added a built-in thread inspector skill ([#4769](https://github.com/langchain-ai/deepagents/issues/4769))
+- Replaced Gemini 3.5 Flash with Gemini 3.6 Flash in the model switcher ([#4890](https://github.com/langchain-ai/deepagents/issues/4890))
+- Show experimental mode in the splash screen and debug console ([#4863](https://github.com/langchain-ai/deepagents/issues/4863))
+- Gate debug console click-to-copy behind a checkbox ([#4810](https://github.com/langchain-ai/deepagents/issues/4810))
+
+### Bug Fixes
+
+- Improved scratch-file handling by allowing cleanup of agent-created scratch files and safe OS-temp scratch artifacts ([#4860](https://github.com/langchain-ai/deepagents/issues/4860), [#4869](https://github.com/langchain-ai/deepagents/issues/4869))
+- Skip grading during `/goal` proposals ([#4941](https://github.com/langchain-ai/deepagents/issues/4941))
+- Improved MCP approval handling: Esc now aborts project MCP approval, disabled MCP servers are honored for plugins, remembered approvals are preserved with the env allowlist, and approvals are shared across Git worktrees ([#4888](https://github.com/langchain-ai/deepagents/issues/4888), [#4848](https://github.com/langchain-ai/deepagents/issues/4848), [#4889](https://github.com/langchain-ai/deepagents/issues/4889), [#4939](https://github.com/langchain-ai/deepagents/issues/4939))
+- Hardened installer downloads and paths ([#4871](https://github.com/langchain-ai/deepagents/issues/4871))
+- Fixed forced `dcode update` checks to bust the CDN cache ([#4862](https://github.com/langchain-ai/deepagents/issues/4862))
+- Prevented failed exit setup from stranding the app ([#4913](https://github.com/langchain-ai/deepagents/issues/4913))
+- Fixed routing so `ctrl+x` goes to the focused `ask_user` input ([#4926](https://github.com/langchain-ai/deepagents/issues/4926))
+- Show `-m` prompts as queued immediately on startup ([#4861](https://github.com/langchain-ai/deepagents/issues/4861))
+- Kept harness-profile diagnostics out of terminal output ([#4943](https://github.com/langchain-ai/deepagents/issues/4943))
+- Avoid tracking inline restart callers ([#4894](https://github.com/langchain-ai/deepagents/issues/4894))
+- Fixed debug console thread ID copying on click ([#4945](https://github.com/langchain-ai/deepagents/issues/4945))
+
+### Performance Improvements
+
+- Reduced exit latency by coordinating async shutdown teardown ([#4831](https://github.com/langchain-ai/deepagents/issues/4831))
+- Sped up local context detection ([#4922](https://github.com/langchain-ai/deepagents/issues/4922))
+
 ## [0.1.44](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.43...deepagents-code==0.1.44) (2026-07-20)
 
 ### Bug Fixes

{deepagents_code-0.1.44 → deepagents_code-0.1.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepagents-code
-Version: 0.1.44
+Version: 0.1.45
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/
@@ -26,26 +26,26 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Terminals
 Requires-Python: <4.0,>=3.11
 Requires-Dist: aiosqlite<1.0.0,>=0.22.1
-Requires-Dist: anyio<5.0.0,>=4.0.0
-Requires-Dist: deepagents-acp<1.0.0,>=0.0.8
-Requires-Dist: deepagents==0.7.0a7
-Requires-Dist: filelock<3.30,>=3.12
+Requires-Dist: anyio<5.0.0,>=4.14.2
+Requires-Dist: deepagents-acp<1.0.0,>=0.0.9
+Requires-Dist: deepagents==0.7.0a8
+Requires-Dist: filelock<3.30,>=3.29.7
 Requires-Dist: httpx<1.0.0,>=0.28.1
-Requires-Dist: langchain-anthropic<2.0.0,>=1.4.8
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.7
+Requires-Dist: langchain-anthropic<2.0.0,>=1.5.0
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.1
 Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.0
-Requires-Dist: langchain-openai<2.0.0,>=1.3.5
+Requires-Dist: langchain-openai<2.0.0,>=1.4.0
 Requires-Dist: langchain-quickjs<0.4.0,>=0.3.3
-Requires-Dist: langchain<2.0.0,>=1.3.13
+Requires-Dist: langchain<2.0.0,>=1.3.14
 Requires-Dist: langgraph-checkpoint-sqlite<4.0.0,>=3.1.0
-Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.30
-Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.31.0
+Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.31
+Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.31.1
 Requires-Dist: langgraph-sdk<1.0.0,>=0.4.2
-Requires-Dist: langsmith[sandbox]>=0.9.3
-Requires-Dist: markdownify<2.0.0,>=1.2.2
+Requires-Dist: langsmith[sandbox]>=0.10.9
+Requires-Dist: markdownify<2.0.0,>=1.2.3
 Requires-Dist: mcp<2.0.0,>=1.28.1
 Requires-Dist: packaging>=26.2
-Requires-Dist: pillow<13.0.0,>=12.2.0
+Requires-Dist: pillow<13.0.0,>=12.3.0
 Requires-Dist: prompt-toolkit<4.0.0,>=3.0.52
 Requires-Dist: pydantic<2.14.0a0,>=2.12.5
 Requires-Dist: pyperclip<2.0.0,>=1.11.0
@@ -56,20 +56,20 @@ Requires-Dist: rich<16.0.0,>=15.0.0
 Requires-Dist: tavily-python<1.0.0,>=0.7.26
 Requires-Dist: textual-autocomplete<5.0.0,>=4.0.6
 Requires-Dist: textual-speedups<1.0.0,>=0.2.1
-Requires-Dist: textual<9.0.0,>=8.2.7
+Requires-Dist: textual<9.0.0,>=8.2.8
 Requires-Dist: tomli-w<2.0.0,>=1.2.0
-Requires-Dist: uuid-utils<1.0.0,>=0.16.2
+Requires-Dist: uuid-utils<1.0.0,>=0.17.0
 Provides-Extra: agentcore
 Requires-Dist: langchain-agentcore-codeinterpreter<1.0.0,>=0.0.5; extra == 'agentcore'
 Provides-Extra: all-providers
-Requires-Dist: aiohttp<3.15.0,>=3.14.1; extra == 'all-providers'
-Requires-Dist: langchain-anthropic<2.0.0,>=1.4.8; extra == 'all-providers'
+Requires-Dist: aiohttp<3.15.0,>=3.14.2; extra == 'all-providers'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.5.0; extra == 'all-providers'
 Requires-Dist: langchain-aws<2.0.0,>=1.6.2; extra == 'all-providers'
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.1; extra == 'all-providers'
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'all-providers'
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'all-providers'
-Requires-Dist: langchain-fireworks<2.0.0,>=1.4.4; extra == 'all-providers'
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.7; extra == 'all-providers'
+Requires-Dist: langchain-fireworks<2.0.0,>=1.5.0; extra == 'all-providers'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.1; extra == 'all-providers'
 Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.4; extra == 'all-providers'
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'all-providers'
 Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'all-providers'
@@ -79,11 +79,11 @@ Requires-Dist: langchain-meta<2.0.0,>=0.5.0; extra == 'all-providers'
 Requires-Dist: langchain-mistralai<2.0.0,>=1.1.6; extra == 'all-providers'
 Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.4.3; extra == 'all-providers'
 Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'all-providers'
-Requires-Dist: langchain-openai<2.0.0,>=1.3.5; extra == 'all-providers'
+Requires-Dist: langchain-openai<2.0.0,>=1.4.0; extra == 'all-providers'
 Requires-Dist: langchain-openrouter<2.0.0,>=0.2.6; extra == 'all-providers'
 Requires-Dist: langchain-perplexity<2.0.0,>=1.4.0; extra == 'all-providers'
 Requires-Dist: langchain-together<2.0.0,>=0.4.0; extra == 'all-providers'
-Requires-Dist: langchain-xai<2.0.0,>=1.2.2; extra == 'all-providers'
+Requires-Dist: langchain-xai<2.0.0,>=1.3.0; extra == 'all-providers'
 Provides-Extra: all-sandboxes
 Requires-Dist: langchain-agentcore-codeinterpreter<1.0.0,>=0.0.5; extra == 'all-sandboxes'
 Requires-Dist: langchain-daytona>=0.0.7; extra == 'all-sandboxes'
@@ -91,7 +91,7 @@ Requires-Dist: langchain-modal>=0.0.5; extra == 'all-sandboxes'
 Requires-Dist: langchain-runloop>=0.0.6; extra == 'all-sandboxes'
 Requires-Dist: langchain-vercel-sandbox>=0.0.1; extra == 'all-sandboxes'
 Provides-Extra: anthropic
-Requires-Dist: langchain-anthropic<2.0.0,>=1.4.8; extra == 'anthropic'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.5.0; extra == 'anthropic'
 Provides-Extra: baseten
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.1; extra == 'baseten'
 Provides-Extra: bedrock
@@ -103,9 +103,9 @@ Requires-Dist: langchain-daytona>=0.0.7; extra == 'daytona'
 Provides-Extra: deepseek
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'deepseek'
 Provides-Extra: fireworks
-Requires-Dist: langchain-fireworks<2.0.0,>=1.4.4; extra == 'fireworks'
+Requires-Dist: langchain-fireworks<2.0.0,>=1.5.0; extra == 'fireworks'
 Provides-Extra: google-genai
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.7; extra == 'google-genai'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.1; extra == 'google-genai'
 Provides-Extra: groq
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'groq'
 Provides-Extra: huggingface
@@ -115,8 +115,8 @@ Requires-Dist: langchain-ibm<2.0.0,>=1.1.0; extra == 'ibm'
 Provides-Extra: litellm
 Requires-Dist: langchain-litellm<2.0.0,>=0.7.0; extra == 'litellm'
 Provides-Extra: media
-Requires-Dist: av<18.0.0,>=17.0.0; extra == 'media'
-Requires-Dist: pillow<13.0.0,>=12.2.0; extra == 'media'
+Requires-Dist: av<18.0.0,>=17.1.0; extra == 'media'
+Requires-Dist: pillow<13.0.0,>=12.3.0; extra == 'media'
 Provides-Extra: meta
 Requires-Dist: langchain-meta<2.0.0,>=0.5.0; extra == 'meta'
 Provides-Extra: mistralai
@@ -124,12 +124,12 @@ Requires-Dist: langchain-mistralai<2.0.0,>=1.1.6; extra == 'mistralai'
 Provides-Extra: modal
 Requires-Dist: langchain-modal>=0.0.5; extra == 'modal'
 Provides-Extra: nvidia
-Requires-Dist: aiohttp<3.15.0,>=3.14.1; extra == 'nvidia'
+Requires-Dist: aiohttp<3.15.0,>=3.14.2; extra == 'nvidia'
 Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.4.3; extra == 'nvidia'
 Provides-Extra: ollama
 Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'ollama'
 Provides-Extra: openai
-Requires-Dist: langchain-openai<2.0.0,>=1.3.5; extra == 'openai'
+Requires-Dist: langchain-openai<2.0.0,>=1.4.0; extra == 'openai'
 Provides-Extra: openrouter
 Requires-Dist: langchain-openrouter<2.0.0,>=0.2.6; extra == 'openrouter'
 Provides-Extra: perplexity
@@ -144,7 +144,7 @@ Requires-Dist: langchain-vercel-sandbox>=0.0.1; extra == 'vercel'
 Provides-Extra: vertex
 Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.4; extra == 'vertex'
 Provides-Extra: xai
-Requires-Dist: langchain-xai<2.0.0,>=1.2.2; extra == 'xai'
+Requires-Dist: langchain-xai<2.0.0,>=1.3.0; extra == 'xai'
 Description-Content-Type: text/markdown
 
 # 🧠🤖 Deep Agents Code

{deepagents_code-0.1.44 → deepagents_code-0.1.45}/THREAT_MODEL.md

@@ -231,7 +231,7 @@
 
 #### TB4: MCP Config → Process / Network
 
-- **Inside**: `mcp_tools._validate_server_config` validates JSON structure and field types. Project-level servers (stdio and remote) require approval: an interactive prompt (`main._check_mcp_project_trust`) that offers allow-for-this-session ("y"), remember a chosen subset of servers ("r"), or deny ("N") — unless `--trust-project-mcp` is set, which trusts the whole config for the run. Whole-config trust is never persisted; it exists only as in-memory run state, set by `--trust-project-mcp` or by an interactive allow-once/remember decision. The remembered subset governs only what is persisted for future runs — both allow-once and remember load every prompted server for the current session. Persistent "remember" (a.k.a. "always allow") decisions are stored in `[mcp].enabled_project_server_approvals` with project root, server name, and server definition fingerprint, so a different project or changed command/URL under the same name requires re-approval. Users can reject individual project server names via `[mcp].disabled_project_servers` (or `DEEPAGENTS_CODE_DISABLED_PROJECT_MCP_SERVERS`). There is also an explicit process-wide escape hatch, `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS`, that approves matching names globally and intentionally bypasses the project/fingerprint binding. Reject wins over approval and over full trust, with one documented exception: if the user's `config.toml` is unreadable (see below), any deny defined *only* there is lost, so a name that is both TOML-`disabled` and exported in `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` survives — an accepted footgun (`load_mcp_server_trust_lists` documents it inline) that requires a self-contradicting config plus the explicit dangerous opt-in, and the read error is surfaced to the user. These policies are read by `model_config.load_mcp_server_trust_lists` only from user-controlled sources — the user-level `~/.deepagents/config.toml`, the global `~/.deepagents/.env`, and shell-exported env — never from `.mcp.json` or any repo-committed file, so a committed config cannot self-approve its own servers. In particular, the env forms (`DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` / `..._DISABLED_...`) are added to `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, so a committed *project* `.env` cannot inject them into `os.environ` even though it is loaded at bootstrap. The dangerous enable env var replaces TOML approvals when set, while disabled *unions* TOML and env so a deny can never be silently emptied by the other source. If the user's `config.toml` exists but cannot be read or parsed, the loader fails closed (project configs are treated as untrusted and the error is surfaced) rather than proceeding with an empty deny list. Only scoped-approved, dangerously env-enabled, or fully trusted names survive into the merged config, so a non-approved remote entry is never preflighted and its interpolated headers are never resolved.
+- **Inside**: `mcp_tools._validate_server_config` validates JSON structure and field types. Project-level servers (stdio and remote) require approval: an interactive prompt (`main._check_mcp_project_trust`) that offers allow-for-this-session ("y"), remember a chosen subset of servers ("r"), or deny ("N") — unless `--trust-project-mcp` is set, which trusts the whole config for the run. Whole-config trust is never persisted; it exists only as in-memory run state, set by `--trust-project-mcp` or by an interactive allow-once/remember decision. The remembered subset governs only what is persisted for future runs — both allow-once and remember load every prompted server for the current session. Persistent "remember" (a.k.a. "always allow") decisions are stored in `[mcp].enabled_project_server_approvals` with a local-project identity, server name, and server definition fingerprint. Remote server approvals with fixed URLs are shared by main checkouts and linked worktrees only through validated reciprocal Git common-directory metadata; independent clones remain separate, and non-Git or malformed/forged metadata falls back to the exact resolved root. Remote definitions with interpolated URLs remain exact-worktree scoped because project `.env` files can resolve the same template to different endpoints. Local stdio server approvals always use the exact resolved worktree root because the same command can execute different files in another checkout. A changed command, URL, or transport under the same name requires re-approval. Users can reject individual project server names via `[mcp].disabled_project_servers` (or `DEEPAGENTS_CODE_DISABLED_PROJECT_MCP_SERVERS`). There is also an explicit process-wide escape hatch, `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS`, that approves matching names globally and intentionally bypasses the project/fingerprint binding. Reject wins over approval and over full trust, with one documented exception: if the user's `config.toml` is unreadable (see below), any deny defined *only* there is lost, so a name that is both TOML-`disabled` and exported in `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` survives — an accepted footgun (`load_mcp_server_trust_lists` documents it inline) that requires a self-contradicting config plus the explicit dangerous opt-in, and the read error is surfaced to the user. These policies are read by `model_config.load_mcp_server_trust_lists` only from user-controlled sources — the user-level `~/.deepagents/config.toml`, the global `~/.deepagents/.env`, and shell-exported env — never from `.mcp.json` or any repo-committed file, so a committed config cannot self-approve its own servers. In particular, the env forms (`DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` / `..._DISABLED_...`) are added to `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, so a committed *project* `.env` cannot inject them into `os.environ` even though it is loaded at bootstrap. The dangerous enable env var and scoped TOML approvals are independent grants: setting the env var, including to an empty value, does not suppress remembered approvals. Disabled *unions* TOML and env so a deny can never be silently emptied by the other source. If the user's `config.toml` exists but cannot be read or parsed, the loader fails closed (project configs are treated as untrusted and the error is surfaced) rather than proceeding with an empty deny list. Only scoped-approved, dangerously env-enabled, or fully trusted names survive into the merged config, so a non-approved remote entry is never preflighted and its interpolated headers are never resolved.
 - **Outside**: Stdio server `command`, `args`, and `env` fields are user-controlled strings passed directly to `StdioConnection`. The `env` dict from MCP config is forwarded without filtering — users can set arbitrary environment variables (including `PATH`, `LD_PRELOAD`, `PYTHONPATH`) for the MCP subprocess.
 - **Crossing mechanism**: `subprocess.Popen` (via `langchain_mcp_adapters`) for stdio; HTTP/SSE for remote servers.
 
@@ -494,3 +494,4 @@ Threats that appear valid in isolation but fall outside project responsibility b
 | 2026-06-25 | manual update                      | Added T12 (project `.env` injects shell interpreter startup hooks) under TB11; extended the TB11 boundary controls and details with the dotenv shell-startup-hook denylist (`BASH_ENV`, `ENV`); clarified the `.env` out-of-scope row to separate ordinary config discovery from the in-scope code-execution implication |
 | 2026-06-25 | manual update                      | Updated T6 and TB10 to reflect the dev server binding an OS-assigned ephemeral port by default (`server._EPHEMERAL_PORT`) instead of squatting the well-known `langgraph dev` port 2024; noted unpredictable-port-across-runs as added defense-in-depth in the port-discovery dismissal row |
 | 2026-07-08 | manual update                      | Removed the SHA-256 config fingerprint trust store (`mcp_trust.py`, `~/.deepagents/.state/mcp_trust.json`, DC4). Project MCP trust is now the interactive approval prompt (allow-for-session / always-allow scoped to project root + server-definition fingerprint / deny), the `--trust-project-mcp` run flag, the `[mcp].enabled_project_server_approvals` and `[mcp].disabled_project_servers` lists, and the process-wide `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` name-based escape hatch. The legacy flat `[mcp].enabled_project_servers` key is ignored. Persisted approvals bind to a server definition's fingerprint rather than a whole-config fingerprint. Updated C5, TB4, T10, the configuration input-coverage row, and the malicious-MCP-server dismissal accordingly |
+| 2026-07-21 | manual update                      | Clarified TB4 after process-wide MCP names and scoped remembered approvals changed from replacement semantics to independent grants. An empty process-wide allowlist no longer suppresses remembered approvals; disabled-server precedence is unchanged. |

{deepagents_code-0.1.44 → deepagents_code-0.1.45}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "2b9cd08"
+BUILD_COMMIT = "7794b61"

{deepagents_code-0.1.44 → deepagents_code-0.1.45}/deepagents_code/_constants.py

@@ -13,6 +13,20 @@ from typing import Final
 DEFAULT_AGENT_NAME: Final[str] = "agent"
 """Default agent / assistant identifier when no `-a` flag is given."""
 
+FS_TOOL_NAMES: Final[frozenset[str]] = frozenset(
+    {"ls", "read_file", "write_file", "edit_file", "delete", "glob", "grep", "execute"}
+)
+"""Mirror of the SDK's `FsToolName` literal members.
+
+Hardcoded here rather than derived from `deepagents.FsToolName` because
+`deepagents` must not be imported on the arg-parsing hot path (see AGENTS.md
+"Startup performance"); this module is dependency-free and safe for `main.py` to
+import. Consumers (`main._parse_allow_fs_tools_flag`,
+`tool_catalog.collect_built_in_tools`) alias this set, and `get_args(FsToolName)`
+drift guards in `test_main_args` and `test_tool_catalog` pin it so a new or
+renamed SDK filesystem tool fails a test instead of silently diverging.
+"""
+
 FIREWORKS_PROVIDER_ID_PREFIX: Final[str] = "accounts/fireworks/"
 """Prefix used to infer Fireworks from fully-qualified IDs."""
 

{deepagents_code-0.1.44 → deepagents_code-0.1.45}/deepagents_code/_env_vars.py

@@ -67,10 +67,11 @@ file, so it does not weaken the user-level-only trust boundary (a committed
 This dangerous contract is name-based: a different project, command change, or
 URL change under the same server name still matches.
 
-When set, this replaces (takes precedence over) the scoped
-`[mcp].enabled_project_server_approvals` TOML approvals.
-(`DISABLED_PROJECT_MCP_SERVERS` instead *unions* with its TOML list, so a deny
-is never silently emptied.)
+This process-wide allowlist and the scoped
+`[mcp].enabled_project_server_approvals` TOML approvals are independent grants.
+Setting this variable, including to an empty value, does not suppress remembered
+project approvals. (`DISABLED_PROJECT_MCP_SERVERS` instead *unions* with its
+TOML list, so a deny is never silently emptied.)
 """
 
 DEBUG = "DEEPAGENTS_CODE_DEBUG"
@@ -80,6 +81,21 @@ Parsed by `is_env_truthy`: accepts `1`, `true`, `yes`, `on` (case-insensitive)
 as enabled, and `0`, `false`, `no`, `off`, empty string, or unset as disabled.
 """
 
+DEBUG_CONSOLE_CLICK_TO_COPY = "DEEPAGENTS_CODE_DEBUG_CONSOLE_CLICK_TO_COPY"
+r"""Enable click-to-copy in the `Ctrl+\` Debug Console when enabled.
+
+Off by default; toggle the "Click to copy" checkbox in the console or set
+`[ui].debug_console_click_to_copy` in config.toml. A recognized value is parsed
+by `classify_env_bool`; an unrecognized value falls through to the config value.
+An empty/whitespace value is ignored before parsing (rather than being treated
+as falsy) and also falls through, so it never masks the saved preference.
+
+When set, this env var takes precedence over the persisted
+`[ui].debug_console_click_to_copy` config value on launch, so toggling the
+checkbox will not appear to "stick" across restarts while the env var remains
+set.
+"""
+
 DEBUG_FILE = "DEEPAGENTS_CODE_DEBUG_FILE"
 """Path for the debug log file (default: `DEFAULT_DEBUG_FILE`)."""
 

{deepagents_code-0.1.44 → deepagents_code-0.1.45}/deepagents_code/_git.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import logging
+import os
 import re
 from pathlib import Path
 from typing import NamedTuple
@@ -159,6 +160,182 @@ def find_git_root(path: str | Path) -> Path | None:
     return None
 
 
+def _read_single_git_metadata_line(path: Path) -> str | None:
+    """Read one non-empty line from a regular Git metadata file.
+
+    Args:
+        path: Metadata file to read.
+
+    Returns:
+        The stripped line, or `None` when the file is unsafe or malformed.
+    """
+    if path.is_symlink() or not path.is_file():
+        return None
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeError):
+        logger.debug("Failed to read Git metadata from %s", path, exc_info=True)
+        return None
+
+    lines = raw.splitlines()
+    if len(lines) != 1:
+        return None
+    value = lines[0].strip()
+    if not value or "\x00" in value:
+        return None
+    return value
+
+
+def _resolve_git_metadata_path(path: Path, *, relative_to: Path) -> Path | None:
+    """Resolve a path stored in a single-line Git metadata file.
+
+    Args:
+        path: Metadata file containing the path.
+        relative_to: Base directory for a relative stored path.
+
+    Returns:
+        The strictly resolved path, or `None` when it cannot be trusted.
+    """
+    value = _read_single_git_metadata_line(path)
+    if value is None:
+        return None
+    candidate = Path(value)
+    if not candidate.is_absolute():
+        candidate = relative_to / candidate
+    try:
+        return candidate.resolve(strict=True)
+    except (OSError, RuntimeError, ValueError):
+        logger.debug("Failed to resolve Git metadata path from %s", path, exc_info=True)
+        return None
+
+
+def _normalize_git_metadata_path(path: Path, *, relative_to: Path) -> Path | None:
+    """Normalize a stored path without following its target.
+
+    Args:
+        path: Metadata file containing the path.
+        relative_to: Base directory for a relative stored path.
+
+    Returns:
+        The absolute lexical path, or `None` when the metadata is malformed.
+    """
+    value = _read_single_git_metadata_line(path)
+    if value is None:
+        return None
+    candidate = Path(value)
+    if not candidate.is_absolute():
+        candidate = relative_to / candidate
+    try:
+        return Path(os.path.abspath(candidate))  # noqa: PTH100  # do not follow links
+    except (OSError, RuntimeError, ValueError):
+        logger.debug(
+            "Failed to normalize Git metadata path from %s", path, exc_info=True
+        )
+        return None
+
+
+def _parse_trusted_git_dir_pointer(git_entry: Path) -> Path | None:
+    """Resolve a strict worktree `.git` pointer for a trust decision.
+
+    Args:
+        git_entry: Regular `.git` file to parse.
+
+    Returns:
+        The canonical administration directory, or `None` for an invalid pointer.
+    """
+    value = _read_single_git_metadata_line(git_entry)
+    if value is None or not value.startswith(_GIT_DIR_POINTER_PREFIX):
+        return None
+    pointer = value.removeprefix(_GIT_DIR_POINTER_PREFIX).strip()
+    if not pointer:
+        return None
+    candidate = Path(pointer)
+    if not candidate.is_absolute():
+        candidate = git_entry.parent / candidate
+    try:
+        git_dir = candidate.resolve(strict=True)
+    except (OSError, RuntimeError, ValueError):
+        logger.debug(
+            "Failed to resolve trusted gitdir pointer %s", git_entry, exc_info=True
+        )
+        return None
+    return git_dir if git_dir.is_dir() else None
+
+
+def _is_valid_git_common_dir(path: Path) -> bool:
+    """Return whether `path` has the required shared-repository metadata."""
+    return (
+        path.is_dir()
+        and (path / "HEAD").is_file()
+        and (path / "config").is_file()
+        and (path / "objects").is_dir()
+        and (path / "refs").is_dir()
+    )
+
+
+def find_git_common_dir(path: str | Path) -> Path | None:
+    """Resolve a validated identity shared by one repository's Git worktrees.
+
+    A normal checkout uses its in-tree `.git` directory. A linked worktree is
+    accepted only when its administration directory lives directly under the
+    common repository's `worktrees` directory and its `gitdir` file points back
+    to the current worktree's `.git` file, and both the shared common directory
+    and the worktree's own administration directory carry valid repository
+    metadata (`_is_valid_git_common_dir` plus the worktree's own `HEAD`). These
+    checks prevent a forged pointer or directory link from borrowing another
+    repository's identity.
+
+    Args:
+        path: Exact working-tree root or persisted common-directory path.
+
+    Returns:
+        The canonical Git common directory, or `None` when the metadata cannot
+        be validated confidently.
+    """
+    try:
+        root = _normalize_lookup_path(path)
+        if not root.is_dir():
+            return None
+        if _is_valid_git_common_dir(root):
+            return root
+        root = root.resolve(strict=True)
+        git_entry = root / ".git"
+        if git_entry.is_symlink():
+            return None
+
+        if git_entry.is_dir():
+            common_dir = git_entry.resolve(strict=True)
+            if common_dir != git_entry or not _is_valid_git_common_dir(common_dir):
+                return None
+            return common_dir
+        if not git_entry.is_file():
+            return None
+
+        git_dir = _parse_trusted_git_dir_pointer(git_entry)
+        if git_dir is None:
+            return None
+
+        common_dir = _resolve_git_metadata_path(
+            git_dir / "commondir", relative_to=git_dir
+        )
+        if common_dir is None or git_dir.parent != common_dir / "worktrees":
+            return None
+        if not _is_valid_git_common_dir(common_dir):
+            return None
+        if not (git_dir / "HEAD").is_file():
+            return None
+
+        backlink = _normalize_git_metadata_path(git_dir / "gitdir", relative_to=git_dir)
+        if backlink is None or backlink != git_entry:
+            return None
+    except (OSError, RuntimeError, ValueError):
+        logger.debug(
+            "Failed to validate Git common directory for %s", path, exc_info=True
+        )
+        return None
+    return common_dir
+
+
 def read_git_branch_from_filesystem(path: str | Path) -> str | None:
     """Read the current git branch from repository metadata.