deepagents-code 0.1.51__tar.gz → 0.1.52__tar.gz

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.52](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.51...deepagents-code==0.1.52) (2026-08-04)
+
+### Features
+
+- Hooks v2 is now generally available, with support for loading hooks from installed plugins. ([#5307](https://github.com/langchain-ai/deepagents/issues/5307), [#5198](https://github.com/langchain-ai/deepagents/issues/5198))
+- Auto approval classifier configuration now supports selecting the classifier model and setting a review timeout. ([#5205](https://github.com/langchain-ai/deepagents/issues/5205), [#5302](https://github.com/langchain-ai/deepagents/issues/5302))
+- HITL rejection reasons are now framed for the model, and the approval menu makes reject-with-feedback easier to discover. ([#5259](https://github.com/langchain-ai/deepagents/issues/5259), [#5260](https://github.com/langchain-ai/deepagents/issues/5260))
+- Added a tri-state `DEEPAGENTS_CODE_ONBOARDING` environment variable. ([#5301](https://github.com/langchain-ai/deepagents/issues/5301))
+- The `/model` footer Ctrl+N hint now follows the current display mode. ([#5247](https://github.com/langchain-ai/deepagents/issues/5247))
+- The price catalog now refreshes hourly in the background. ([#5264](https://github.com/langchain-ai/deepagents/issues/5264))
+- Updated recommendations to include DeepSeek V4 Flash 0731. ([#5244](https://github.com/langchain-ai/deepagents/issues/5244))
+
+### Bug Fixes
+
+- Fixed several Hooks v2 lifecycle issues: session-end teardown is now bounded, hooks refresh after cwd switches, malformed hook resumes are handled, hook stops surface without agent errors, and unused `SessionEndCause` members were removed. ([#5248](https://github.com/langchain-ai/deepagents/issues/5248), [#5249](https://github.com/langchain-ai/deepagents/issues/5249), [#5233](https://github.com/langchain-ai/deepagents/issues/5233), [#5276](https://github.com/langchain-ai/deepagents/issues/5276), [#5240](https://github.com/langchain-ai/deepagents/issues/5240))
+- `PreCompact` now fires before auto-compaction. ([#5277](https://github.com/langchain-ai/deepagents/issues/5277))
+
 ## [0.1.51](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.50...deepagents-code==0.1.51) (2026-07-31)
 
 ### Features

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/COMMANDS.md

@@ -14,7 +14,7 @@ aliases, descriptions, visibility, or hidden-command metadata.
 | --- | --- | --- |
 | `/agents` |  | Browse and switch between available agents |
 | `/auth` | `/connect` | Connect and manage provider and service credentials |
-| `/auto` |  | Switch to Auto approval mode |
+| `/auto` |  | Switch to Auto approval mode, or pick its classifier model for this session |
 | `/auto-update` |  | Turn automatic updates on or off |
 | `/changelog` |  | Open the changelog in a browser |
 | `/clear` |  | Clear the chat and start a new thread |

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/HOOKS.md

@@ -10,8 +10,9 @@ Hooks are user-configured shell commands that run at agent lifecycle events. Eac
 | --- | --- | --- |
 | User | `~/.deepagents/hooks.json` | Always (when the file exists) |
 | Project | `{project_root}/.deepagents/hooks.json` | Only after workspace trust |
+| Plugin | `hooks/hooks.json` inside an installed plugin | Whenever the plugin is enabled |
 
-When both scopes load, project matcher groups are applied first, then user groups. A project handler that stops further processing therefore wins over lower-precedence user handlers for the same event.
+Matcher groups are applied project first, then user, then plugin. Precedence decides whose answer wins, not who runs: every matching handler for an event runs concurrently, and their results are then reduced in that order, so the first handler that stops processing decides the event. A plugin handler still executes even when a project or user handler stops the event, so treat a plugin's side effects as unconditional.
 
 ### Project workspace trust
 
@@ -23,6 +24,22 @@ Project-scoped hooks can execute arbitrary commands from the repository. Before
 - Denying skips project hooks for the session and continues with user hooks only.
 - Headless / CI runs do not prompt; pass `--trust-project-hooks` to opt in for that run.
 
+### Plugin hooks
+
+A plugin contributes hooks from `hooks/hooks.json` in its root, from a `hooks` path in its `plugin.json` manifest, or from an inline manifest `hooks` object. The document uses exactly the same shape as a user or project `hooks.json`.
+
+Installing and enabling the plugin is the consent gate — workspace trust governs project hooks only, so it neither grants nor withholds a plugin's hooks. Review a plugin before enabling it; the plugin manager lists the events each one hooks. Because the set of server-owned events is fixed when a session starts, newly enabled plugin hooks take effect after `/reload`.
+
+Plugin handlers receive their plugin's path variables in the environment. Shell-form `command` handlers expand those variables normally; direct-exec `argv` handlers resolve them before launch. Quote variables in shell commands because installation paths may contain spaces:
+
+| Variable | Value |
+| --- | --- |
+| `CLAUDE_PLUGIN_ROOT`, `PLUGIN_ROOT` | The plugin's root directory |
+| `CLAUDE_PLUGIN_DATA`, `PLUGIN_DATA` | The plugin's writable data directory |
+| `CLAUDE_PROJECT_DIR` | The project root |
+
+For example, use `"command": "\"${CLAUDE_PLUGIN_ROOT}/scripts/format.sh\""`. Setting `argv` instead avoids shell quoting entirely because those handlers execute directly.
+
 ## Events and matchers
 
 Each top-level key under `"hooks"` is an event name. Values are lists of matcher groups. A group may omit `matcher` (or use `"*"`) to match all values for that event's matcher field. Events with no matcher field reject non-wildcard matchers at load time.
@@ -33,7 +50,7 @@ Native tools are matched by their wire names (for example `execute` → `Bash`,
 | --- | --- | --- | --- |
 | `SessionStart` | client | `cause` | A session starts (`startup`, `resume`, `clear`, `compact`) |
 | `UserPromptSubmit` | client | _(none)_ | The user submits a prompt |
-| `SessionEnd` | client | `cause` | A session ends |
+| `SessionEnd` | client | `cause` | A session ends (`clear`, `resume`, `prompt_input_exit`, `other`) |
 | `PermissionRequest` | client | `tool_name` | The client is about to ask for tool permission |
 | `Notification` | client | `notification_type` | A client lifecycle notification is emitted |
 | `PreToolUse` | server | `tool_name` | Before a tool call runs |

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepagents-code
-Version: 0.1.51
+Version: 0.1.52
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/
@@ -31,7 +31,7 @@ Requires-Dist: anyio<5.0.0,>=4.14.2
 Requires-Dist: deepagents-acp<1.0.0,>=0.0.9
 Requires-Dist: deepagents==0.7.1
 Requires-Dist: filelock<3.30,>=3.29.7
-Requires-Dist: genai-prices<0.2.0,>=0.1.0
+Requires-Dist: genai-prices<0.2.0,>=0.1.1
 Requires-Dist: httpx<1.0.0,>=0.28.1
 Requires-Dist: langchain-anthropic<2.0.0,>=1.5.3
 Requires-Dist: langchain-google-genai<5.0.0,>=4.3.2

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/THREAT_MODEL.md

@@ -349,6 +349,7 @@
 | T10 | DF24      | DC1            | MCP stdio subprocess env dict accepts arbitrary keys including `PATH`, `LD_PRELOAD`, `PYTHONPATH` without filtering | TB4 | Low | Verified | `mcp_tools._validate_server_config`, `mcp_tools._load_tools_from_config` |
 | T12 | DF10      | —              | Project `.env` sets shell startup-hook variables (`BASH_ENV`, `ENV`) that run attacker-controlled scripts when `dcode` spawns Bash, before any HITL approval | TB11 | High | Verified | `config._load_dotenv`, `local_context.build_detect_script` |
 | T13 | DF7       | —              | Configured shell allow-list checks only the first token, so an allow-listed interpreter/wrapper (`python3`, `bash`, `env`, `xargs`, …) runs arbitrary code via its arguments without approval in non-interactive mode | TB2 | Medium | Verified | `config.is_shell_command_allowed`, `config.contains_dangerous_patterns` |
+| T14 | DF7, DF9  | —              | A weaker model configured for the Auto approval classifier reviews gated actions less reliably, including untrusted text carried in tool arguments and file content | TB2 | Low | Verified | `auto_mode.AutoModeHITLMiddleware._classifier_model`, `config.resolve_auto_classifier_model`, `config_manifest.resolve_auto_classifier_timeout` |
 
 ### Threat Details
 
@@ -419,6 +420,13 @@
 - **Mitigations**: (1) SHA-256 verified against the pinned hash table before move — a mismatch aborts the install and leaves `BIN_DIR` clean. (2) Network egress is limited to `github.com`. (3) Opt-out via `DEEPAGENTS_CODE_OFFLINE` for air-gapped environments, or `DEEPAGENTS_CODE_RIPGREP_INSTALLER=system` to defer to the OS package manager instead of the managed binary. (4) Pinned version + checksums are bumped in-tree, so a compromised upstream release is detected on the next Deep Agents Code release rather than silently propagating. (5) Atomic move-into-place avoids partial installs when concurrent CLI invocations race. (6) The eager install-script path is non-`sudo` (no system package manager is invoked in the default `managed` mode).
 - **Preconditions**: User has not installed `rg` via their package manager, `DEEPAGENTS_CODE_OFFLINE` is unset, `DEEPAGENTS_CODE_RIPGREP_INSTALLER` is not `system`, and the host can reach `github.com`. The pinned SHA-256 in `RIPGREP_ASSETS` would need to be incorrect (a supply-chain compromise of the deepagents-code release) for a tampered binary to be installed.
 
+#### T11b: Unpinned Pricing Catalog Fetched Hourly from a Mutable Upstream Ref
+
+- **Flow**: Background daemon thread started by `cost_tracking._start_price_updater` on the first priced model request.
+- **Description**: Unless opted out, Deep Agents Code starts `genai_prices.UpdatePrices`, which fetches `raw.githubusercontent.com/pydantic/genai-prices/refs/heads/main/prices/new_data/v2/data.json` every hour and installs it via `set_custom_snapshot`. The fetched catalog wholesale-replaces the pricing data bundled with the installed package for the life of the process. Unlike the ripgrep download (T11), the payload is **not** checksummed and the URL names a mutable branch ref rather than a pinned release, so the content can change between any two fetches. The blast radius is confined to displayed cost estimates — the catalog is parsed as data by `genai-prices`, never executed — but corrupt, regressed, or hostile upstream data silently changes every cost figure the user sees, and a catalog that omits providers makes lookups fail in a way that reads as "this model has no published rates."
+- **Mitigations**: (1) Opt-out via `DEEPAGENTS_CODE_PRICES_AUTO_UPDATE=0` or `[update].prices_auto_update = false` in `config.toml`, or `DEEPAGENTS_CODE_OFFLINE` for air-gapped environments, all checked before the thread starts. (2) `cost_tracking._build_price_updater` refuses a fetched catalog listing fewer providers than the bundled one, so a truncated or mid-publish `data.json` cannot take effect. (3) A refused or failed fetch leaves the previously installed catalog in place rather than clearing it. (4) `genai-prices` rejects any payload that is not a JSON array of schema-valid providers. (5) Network egress is limited to `raw.githubusercontent.com`. (6) The updater is started lazily on first pricing, never at CLI startup, so a session that prices nothing makes no request.
+- **Preconditions**: `DEEPAGENTS_CODE_PRICES_AUTO_UPDATE` is not falsy, `DEEPAGENTS_CODE_OFFLINE` is unset, the host can reach `raw.githubusercontent.com`, and at least one model request is priced. For tampered data to be installed, the upstream repository or the CDN path would need to be compromised **and** the substituted catalog would need to list at least as many providers as the bundled data.
+
 #### T12: Project `.env` Injects Shell Interpreter Startup Hooks
 
 - **Flow**: DF10 (project `.env` → process environment) → bash subprocess startup (DF19)
@@ -431,6 +439,12 @@
 - **Description**: `is_shell_command_allowed` splits a command on `|`, `;`, `&&`, and `||`, then validates only the *first token* (`tokens[0]`) of each segment against the configured allow-list, after rejecting a set of dangerous patterns (`contains_dangerous_patterns`: command substitution `$(`/backticks, redirects, `${`, bare `$VAR`, background `&`). Because only the executable name is checked, any allow-listed general-purpose interpreter or command wrapper carries arbitrary behavior in its arguments: `python3 -c '<code>'`, `bash script.sh`, `sh -c '<code>'`, `env <cmd>`, `xargs <cmd>`, `uv run <cmd>`, and similar. A user who allow-lists such a program — reasonably believing they have restricted the agent to a "safe" tool — has effectively allowed unrestricted execution, and in headless `-x`/Auto mode those commands run without an approval prompt. This is the same class of weakness as T2 but applies to *normal, non-`all`* allow-lists. The allow-list is an ergonomic auto-approve heuristic, not a security boundary; textual command classification cannot robustly constrain execution.
 - **Preconditions**: (1) User configures a shell allow-list (`--shell-allow-list` / `DEEPAGENTS_SHELL_ALLOW_LIST`) that includes an interpreter or wrapper; (2) non-interactive or Auto mode (interactive Manual mode still shows the human the literal command before it runs); (3) for the injected-command variant, successful prompt injection via DF8/DF9. The intended control is HITL approval; OS-native execution sandboxing would be the robust boundary the string allow-list cannot provide.
 
+#### T14: Weaker Auto Classifier Model Weakens Action Review
+
+- **Flow**: DF7 (LLM tool call) → Auto classifier review → C4 Tools
+- **Description**: In Auto approval mode, gated tool calls that deterministic policy cannot clear are reviewed by an LLM authorization classifier. That classifier can be pointed at a separate model (`--auto-classifier-model`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`, `[models].auto_classifier`, or `/auto model`) so reviews are cheaper and faster than the main agent model. Review quality then follows the chosen model: a weaker one is likelier to mis-authorize an action, and likelier to be steered by injected instructions in the untrusted material it reads (tool arguments, paths, prior tool output, remote metadata). Choosing the classifier is a user-level decision, so it is restricted to trusted surfaces: shell exports, the global `~/.deepagents/.env`, `~/.deepagents/config.toml`, the CLI flag, and `/auto model`. A *project* `.env` travels with a cloned repo, so `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL` is listed in `config._PROJECT_DOTENV_DENIED_ENV_KEYS` — the same mitigation TB4 applies to the project-MCP trust vars; without that entry a checked-in `.env` could silently downgrade the review on `dcode` startup. With it, this is a self-inflicted weakening of a control rather than an external attack path. Auto's model-independent guards are unchanged by the setting: deterministic allow/deny, the consecutive/total denial counters, batch-replay detection, control-state availability, and the human-fallback thresholds. A classifier model that cannot be constructed (bad spec, missing credentials, uninstalled provider package) never falls back to the main model — the first such batch is marked `classifier_unavailable`, so those calls are denied and do not execute, and the failing spec is latched so every subsequent batch escalates straight to human approval until a review succeeds. A transient failure instead escalates once `_CONSECUTIVE_UNAVAILABLE_FALLBACK` consecutive batches have failed, or immediately when Auto's control state cannot be persisted. The review deadline is tunable through a subset of the same trusted surfaces — shell exports, the global `~/.deepagents/.env`, and `[models].auto_classifier_timeout` in `~/.deepagents/config.toml` (there is no CLI flag and no `/auto` subcommand for it) — and `DEEPAGENTS_CODE_AUTO_CLASSIFIER_TIMEOUT` is denied from a project `.env` for the same reason, so a cloned repo cannot stall gated batches or squeeze the budget until reviews time out. `config_manifest.resolve_auto_classifier_timeout` rejects any resolved value outside `[AUTO_CLASSIFIER_TIMEOUT_FLOOR, AUTO_CLASSIFIER_TIMEOUT_CEILING]` — out-of-range and malformed values are discarded in favor of the next config source rather than clamped — so the deadline itself cannot be removed; a timed-out batch remains fail-closed (`classifier_unavailable`).
+- **Preconditions**: (1) Auto approval mode is active (interactive TUI only, and not under a sandbox); (2) a classifier model is configured through one of the trusted surfaces above — the default reuses the main agent model; (3) for the injected-review variant, untrusted content reaches the classifier through DF8/DF9 and the chosen model follows it. The intended control is that the human remains the fallback for anything the classifier does not affirmatively allow.
+
 ---
 
 ## Input Source Coverage
@@ -438,10 +452,10 @@
 | Input Source          | Data Flows            | Threats       | Validation Points                                                          | Responsibility | Gaps                                                                                         |
 |-----------------------|-----------------------|---------------|----------------------------------------------------------------------------|----------------|----------------------------------------------------------------------------------------------|
 | User direct input     | DF1, DF2              | None (TB1)    | None — prompts accepted verbatim                                           | User           | No content filtering — intentional; HITL gates downstream tool calls                        |
-| LLM output            | DF6, DF7              | T1, T2, T3, T4, T13| HITL gate; shell allow-list; Unicode/URL warnings on tool args        | Project        | LLM-generated tool args not scanned for injection beyond Unicode/URL; shell allow-list matches only the command's first token, so allow-listed interpreters/wrappers bypass it (T13)   |
+| LLM output            | DF6, DF7              | T1, T2, T3, T4, T13, T14| HITL gate; shell allow-list; Unicode/URL warnings on tool args; Auto classifier review | Project        | LLM-generated tool args not scanned for injection beyond Unicode/URL; shell allow-list matches only the command's first token, so allow-listed interpreters/wrappers bypass it (T13); Auto classifier review quality follows the user-selected classifier model, and the classifier reads untrusted tool arguments and prior output (T14)   |
 | Tool/function results | DF9, DF11             | T1            | Unicode warning on URL args; `markdownify` HTML conversion                 | Shared         | Tool *results* pass to context without prompt-injection scan                                 |
 | URL-fetched content   | DF8, DF9              | T1            | `check_url_safety` on URL arg; HTML→markdown conversion                    | Shared         | Markup-embedded instructions survive markdownify; no LLM-layer guardrail                    |
-| Configuration         | DF10, DF12, DF15, DF23| T9, T10, T12  | Dotenv shell-env precedence; TOML schema; MCP schema + allow/deny lists; JSON structure check; `class_path` format check | User | Project `.env` can set shell startup-hook vars; `class_path` executes module code before type check; MCP env dict unfiltered |
+| Configuration         | DF10, DF12, DF15, DF23| T9, T10, T12, T14  | Dotenv shell-env precedence; TOML schema; MCP schema + allow/deny lists; JSON structure check; `class_path` format check; project-`.env` denylist for the Auto classifier model | User | Project `.env` can set shell startup-hook vars; `class_path` executes module code before type check; MCP env dict unfiltered; Auto classifier strength is a user choice with no floor enforced (T14) |
 | Session restore       | DF14                  | T5            | OS file permissions; SQLite                                                | Project        | Unencrypted at rest                                                                           |
 | Server IPC (env vars) | DF18                  | T6            | `ServerConfig` serialization; parent env passed to child                   | Project        | Provider API keys flow to server subprocess; system prompt in env                            |
 | Host environment      | DF19, DF20            | T7            | Static script; exit code check; 30s timeout                                | Shared         | Makefile content injected into system prompt without sanitization                            |
@@ -463,7 +477,7 @@ Threats that appear valid in isolation but fall outside project responsibility b
 | Malicious MCP server injecting prompt instructions                     | Users configure MCP servers and explicitly trust project-level configs. Once trusted, MCP tool outputs are data from a system the user controls.                                     | Interactive approval prompt + per-server allow/deny lists for project-level configs (`main._check_mcp_project_trust`, `model_config.load_mcp_server_trust_lists`). |
 | LLM jailbreak / safety bypass                                          | Model selection and safety configuration are user-controlled. The project routes prompts to the configured LLM but cannot guarantee model behavior.                                   | Correctly routing prompts to the configured LLM; applying the system prompt from `agent.get_system_prompt`.         |
 | Sandbox provider security vulnerabilities                              | Daytona, LangSmith, Modal, Runloop, and AgentCore are third-party services. Their internal security is not this project's responsibility.                                            | Correctly initializing sandbox sessions via `integrations.sandbox_factory.create_sandbox`.                          |
-| Hook commands doing harmful things                                     | User-scoped hooks (`~/.deepagents/hooks.json`) and project-scoped hooks (`.deepagents/hooks.json`, only after interactive workspace trust or `--trust-project-hooks`) are intentionally configured commands. The payload is data-only (JSON on stdin). | Schema validation (`hooks.loading.load_hooks_config`); workspace trust for project hooks (versioned store under `~/.deepagents/.state/hooks_trust.json`; cancelling the trust prompt aborts startup); bounded execution with per-event default timeouts (600s for most events, 30s for `UserPromptSubmit`); sanitized subprocess environment. |
+| Hook commands doing harmful things                                     | User-scoped hooks (`~/.deepagents/hooks.json`), project-scoped hooks (`.deepagents/hooks.json`, only after interactive workspace trust or `--trust-project-hooks`), and plugin-scoped hooks (`hooks/hooks.json` in a plugin the user installed and enabled) are intentionally configured commands. The payload is data-only (JSON on stdin). | Schema validation (`hooks.loading.load_hooks_config`); workspace trust for project hooks (versioned store under `~/.deepagents/.state/hooks_trust.json`; cancelling the trust prompt aborts startup); install plus enablement for plugin hooks, with declared events listed in the plugin manager; bounded execution with per-event default timeouts (600s for most events, 30s for `UserPromptSubmit`); sanitized subprocess environment with only the plugin's own path variables overlaid. |
 | Async subagent traffic interception / MitM                             | Async subagents connect to user-configured LangGraph deployment URLs. The project does not control those endpoints or their TLS certificates.                                        | Accepting URL/headers from user config and passing them to the LangGraph SDK (`agent.load_async_subagents`).        |
 | LangGraph dev server port enumeration / discovery                     | Discovering the local dev server port requires local access. Port scanning localhost is a general OS security concern, not a framework vulnerability.                                 | Binding to `127.0.0.1` by default (`server._DEFAULT_HOST`); ephemeral server lifetime; OS-assigned ephemeral port (`server._EPHEMERAL_PORT`) is not predictable across runs. |
 | `.env` file from parent directory changes app/API configuration        | `config._find_dotenv_from_start_path` walks up the directory tree to find `.env` files. Discovering ordinary configuration values (API keys, `DEEPAGENTS_CODE_*` settings) this way is standard `python-dotenv` behavior, and the user controls their filesystem. The *code-execution* implication of a project `.env` (shell startup hooks) is tracked in-scope as T12. | Finding `.env` from the project root (`config._find_dotenv_from_start_path`); `override=False` by default (existing env vars preserved); shell startup / environment-hijack keys (`BASH_ENV`, `ENV`) denied during dotenv loading. |
@@ -504,3 +518,6 @@ Threats that appear valid in isolation but fall outside project responsibility b
 | 2026-07-21 | manual update                      | Clarified TB4 after process-wide MCP names and scoped remembered approvals changed from replacement semantics to independent grants. An empty process-wide allowlist no longer suppresses remembered approvals; disabled-server precedence is unchanged. |
 | 2026-07-22 | manual update                      | Added T13 (first-token shell allow-list bypass via allow-listed interpreters/wrappers) under TB2, distinguishing it from T2's `--shell-allow-list all` sentinel; cross-referenced it from T2 and extended the "LLM output" input-coverage gap to note that allow-list matching only inspects the command's first token |
 | 2026-07-24 | manual update                      | Corrected the out-of-scope hooks row: Hooks v2 defaults are 600s (30s for `UserPromptSubmit`), not a global 5-second timeout; loading is `hooks.loading.load_hooks_config`; project hooks require workspace trust or `--trust-project-hooks` |
+| 2026-07-28 | manual update                      | Extended the out-of-scope hooks row for plugin-contributed hooks: enabled plugins may supply `hooks/hooks.json`, gated by install plus enablement rather than workspace trust, with each handler's environment overlaid only by its own plugin path variables |
+| 2026-08-03 | manual update                      | Added T14 (a weaker Auto classifier model weakens action review) under TB2, covering the selectable classifier (`--auto-classifier-model`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`, `[models].auto_classifier`, `/auto model`), its restriction to trusted config surfaces via `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, and its fail-closed construction behavior (deny, then latch to human approval; never fall back to the main model). Extended the "LLM output" and "Configuration" input-coverage rows with T14 |
+| 2026-08-04 | manual update                      | Extended T14 for the configurable Auto classifier review deadline (`DEEPAGENTS_CODE_AUTO_CLASSIFIER_TIMEOUT`, `[models].auto_classifier_timeout`): bounded by `config_manifest.resolve_auto_classifier_timeout` between a floor and ceiling so the deadline cannot be removed, denied from a project `.env` via `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, and fail-closed on expiry |

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "d2b663f"
+BUILD_COMMIT = "b428644"

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/deepagents_code/_cli_context.py

@@ -11,6 +11,25 @@ from __future__ import annotations
 from dataclasses import dataclass, field
 from typing import Any, TypedDict
 
+INHERIT_CLASSIFIER_MODEL = "__dcode_inherit_classifier__"
+"""Per-run `classifier_model` value meaning "review with the main agent model".
+
+An absent (or `None`) `classifier_model` only says the run carries no
+preference, so the classifier keeps whatever the server resolved at startup
+(`--auto-classifier-model`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`,
+`[models].auto_classifier`). `/auto model clear` needs the stronger statement
+that reviews go back to the main agent model, which this sentinel carries.
+
+It cannot collide with a real spec: `create_model` resolves `provider:model`
+(or a bare model name) and has no provider or model named `__dcode_...`. A
+control character such as a leading NUL would also be collision-proof, but this
+value has to survive the trip to a remote deployment intact — the context is
+serialized to JSON and may be persisted, and Postgres `text`/`jsonb` rejects NUL
+outright. A stripped sentinel would silently read as "no preference" and leave a
+startup classifier authorizing actions after the UI reported the clear, so the
+sentinel stays plain ASCII.
+"""
+
 
 @dataclass
 class CLIContextSchema:
@@ -39,6 +58,8 @@ class CLIContextSchema:
 
     model_context_limit: int | None = None
 
+    classifier_model: str | None = None
+
     approval_mode: str = "manual"
 
     auto_approve: bool = False
@@ -81,6 +102,17 @@ class CLIContext(TypedDict, total=False):
     model_context_limit: int | None
     """Effective context-window limit for profile-aware middleware."""
 
+    classifier_model: str | None
+    """Model spec the Auto approval classifier should use for this run.
+
+    `None` (or absent) expresses no per-run preference, so the classifier keeps
+    whatever the graph was built with — normally the main agent model, but a
+    separate model when the session was launched with one.
+    `INHERIT_CLASSIFIER_MODEL` overrides that startup value back to the main
+    agent model. Set by `/auto model` so the switch takes effect without
+    restarting the agent server.
+    """
+
     approval_mode: str
     """`manual`, classifier-backed `auto`, or unrestricted `yolo`."""
 

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/deepagents_code/_constants.py

@@ -27,6 +27,9 @@ drift guards in `test_main_args` and `test_tool_catalog` pin it so a new or
 renamed SDK filesystem tool fails a test instead of silently diverging.
 """
 
+SESSION_END_DRAIN_TIMEOUT_SECONDS: Final[float] = 2.0
+"""Maximum time to drain Hooks v2 `SessionEnd` during session teardown."""
+
 SDK_DEFAULT_RUBRIC_MAX_ITERATIONS: Final[int] = 3
 """Default `RubricMiddleware.max_iterations`, shown without importing the SDK.
 

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/deepagents_code/_env_vars.py

@@ -30,6 +30,42 @@ import os
 # Keep alphabetically sorted by constant name.
 # ---------------------------------------------------------------------------
 
+AUTO_CLASSIFIER_MODEL = "DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL"
+"""Model spec (`provider:model`) used by the Auto approval-mode classifier.
+
+Unset (the default) reuses the main agent model, preserving the historical
+behavior. A `provider:model` value points the authorization classifier at a
+separate — typically faster and cheaper — model without changing the model that
+writes code. The classifier is a security control: a model that cannot be
+resolved (bad spec, missing credentials, uninstalled provider package) never
+falls back to the main model — reviewed actions are denied, and repeated
+failures escalate to your approval. Also settable via `[models].auto_classifier`
+in config.toml and `--auto-classifier-model`.
+
+This is user-controlled process env, not a repo file: a committed *project*
+`.env` cannot set it (see `config._PROJECT_DOTENV_DENIED_ENV_KEYS`), so a cloned
+repository cannot point the review that authorizes its own tool calls at a weaker
+model. Only the shell, the launch environment, or the global `~/.deepagents/.env`
+can.
+"""
+
+AUTO_CLASSIFIER_TIMEOUT = "DEEPAGENTS_CODE_AUTO_CLASSIFIER_TIMEOUT"
+"""Seconds the Auto approval-mode classifier may take to review one batch.
+
+Raise this when reviews time out on a slow or heavily loaded classifier model:
+a batch that misses the deadline is denied as `classifier_unavailable`, so the
+tool call does not run and repeated misses escalate to your approval. This
+covers the wait for a verdict only — the separate budget for *building* the
+classifier model (cold provider import, credential bootstrap), which denies with
+"could not be built within 30s", is fixed. Values outside 1-300 seconds are
+ignored in favor of the next config source, so the deadline can never be
+removed. Also settable via `[models].auto_classifier_timeout` in config.toml.
+Resolved once per `dcode` start, so a change takes effect on the next launch.
+
+Like `AUTO_CLASSIFIER_MODEL`, a committed *project* `.env` cannot set it (see
+`config._PROJECT_DOTENV_DENIED_ENV_KEYS`).
+"""
+
 AUTO_UPDATE = "DEEPAGENTS_CODE_AUTO_UPDATE"
 """Toggle automatic app updates. Enabled by default; set to a falsy value
 ('0', 'false', 'no', 'off', or empty) to opt out."""
@@ -124,12 +160,6 @@ Does not auto-open the update modal (use `DEEPAGENTS_CODE_DEBUG_UPDATE` for that
 Any non-empty value enables the flag (including `"0"` or `"false"`).
 """
 
-DEBUG_ONBOARDING = "DEEPAGENTS_CODE_DEBUG_ONBOARDING"
-"""Force the onboarding flow to open on every interactive startup.
-
-Parsed by `is_env_truthy`: accepts `1`, `true`, `yes`, `on` as enabled.
-"""
-
 DEBUG_UPDATE = "DEEPAGENTS_CODE_DEBUG_UPDATE"
 """Inject a sample update-available notification and auto-open the update modal
 at launch so the update-available flow can be exercised without waiting for a
@@ -284,6 +314,22 @@ and `/api/show`. See `_ollama_discovery_enabled` for accepted truthy/falsy
 values.
 """
 
+ONBOARDING = "DEEPAGENTS_CODE_ONBOARDING"
+"""Override whether the first-run onboarding flow opens at interactive startup.
+
+Three-state, parsed by `classify_env_bool`:
+
+- Unset (or an unrecognized token): keep the default first-run behavior, i.e.
+  run onboarding until the completion marker exists.
+- Falsy (`0`, `false`, `no`, `off`, or empty): never open onboarding, even on a
+  fresh install with no completion marker.
+- Truthy (`1`, `true`, `yes`, `on`): force onboarding to open on every
+  interactive startup, ignoring the completion marker.
+
+Read by `should_run_onboarding`; skipping the flow this way does not write the
+completion marker, so unsetting the variable restores first-run behavior.
+"""
+
 ONBOARDING_INTEGRATIONS_SCREEN = "DEEPAGENTS_CODE_ONBOARDING_INTEGRATIONS_SCREEN"
 """Show the "Installed Integrations" summary screen during first-run onboarding.
 
@@ -315,6 +361,22 @@ PLUGIN_CACHE_DIR = "DEEPAGENTS_CODE_PLUGIN_CACHE_DIR"
 When unset, plugins are stored under `DEFAULT_CONFIG_DIR / "plugins"`.
 """
 
+PRICES_AUTO_UPDATE = "DEEPAGENTS_CODE_PRICES_AUTO_UPDATE"
+"""Toggle hourly background refresh of the `genai-prices` pricing catalog.
+
+Enabled by default; set to a falsy value (`0`, `false`, `no`, `off`, or empty)
+to keep using only the pricing data bundled with the installed `genai-prices`
+package. `DEEPAGENTS_CODE_OFFLINE` suppresses the refresh too, along with
+every other network fetch.
+
+Parsed by `is_env_truthy` on each pricing call until the updater starts, and
+never read again after that -- so disabling it mid-process has no effect on a
+running updater, while enabling it mid-process starts one on the next priced
+request. Also the escape hatch for hosts embedding this package that manage
+`genai_prices.UpdatePrices` themselves: genai-prices permits one updater per
+process, so an embedder that starts its own would otherwise race this one.
+"""
+
 RECURSION_LIMIT = "DEEPAGENTS_CODE_RECURSION_LIMIT"
 """Override the main agent's LangGraph `recursion_limit` (graph step budget).
 

deepagents_code-0.1.52/deepagents_code/_markdown.py

@@ -0,0 +1,26 @@
+"""Escaping for external text that reaches Rich/Textual markdown source."""
+
+from __future__ import annotations
+
+MARKDOWN_ESCAPES = str.maketrans({char: f"\\{char}" for char in "\\&`*_[]<>|~"})
+"""Translation table backing `escape_markdown`.
+
+Covers the inline constructs Rich's markdown parser acts on (emphasis, code
+spans, links, autolinks/HTML, HTML entities, strikethrough) plus the `|`
+table-cell separator. Block-level punctuation (`#`, `-`, `>`) only has meaning
+at the start of a line; line breaks are normalized before translation, and `>`
+is escaped anyway because it is cheap.
+"""
+
+
+def escape_markdown(text: str) -> str:
+    """Normalize line breaks and escape markdown syntax in external text.
+
+    Args:
+        text: Display string that may contain markdown punctuation.
+
+    Returns:
+        `text` on one line with markdown-significant characters escaped.
+    """
+    normalized = text.replace("\r\n", " ").replace("\r", " ").replace("\n", " ")
+    return normalized.translate(MARKDOWN_ESCAPES)

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/deepagents_code/_server_config.py

@@ -340,6 +340,14 @@ class ServerConfig:
     rubric_max_iterations: int | None = None
     """Explicit grader iterations per rubric attempt; `None` uses the SDK default."""
 
+    auto_classifier_model: str | None = None
+    """Classifier model spec for Auto mode (e.g. `'anthropic:claude-haiku-4-5'`).
+
+    `None` falls through to `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`, then
+    `[models].auto_classifier`, and then to the main agent model. An empty value
+    round-trips to `None`, so it means "inherit", never "empty spec".
+    """
+
     recursion_limit: int | None = None
     """Explicit main-agent LangGraph `recursion_limit` (graph step budget).
 
@@ -477,6 +485,7 @@ class ServerConfig:
                 else None
             ),
             "RUBRIC_MODEL": self.rubric_model,
+            "AUTO_CLASSIFIER_MODEL": self.auto_classifier_model,
             "RUBRIC_MAX_ITERATIONS": (
                 str(self.rubric_max_iterations)
                 if self.rubric_max_iterations is not None
@@ -536,6 +545,7 @@ class ServerConfig:
             ),
             allow_fs_tools=_read_env_allow_fs_tools(),
             rubric_model=_read_env_str("RUBRIC_MODEL") or None,
+            auto_classifier_model=_read_env_str("AUTO_CLASSIFIER_MODEL") or None,
             rubric_max_iterations=_read_env_int("RUBRIC_MAX_ITERATIONS", default=None),
             recursion_limit=_read_env_int("RECURSION_LIMIT", default=None),
             sandbox_type=_read_env_str("SANDBOX_TYPE"),
@@ -577,6 +587,7 @@ class ServerConfig:
         allow_fs_tools: list[FsToolName] | None = None,
         rubric_model: str | None = None,
         rubric_max_iterations: int | None = None,
+        auto_classifier_model: str | None = None,
         recursion_limit: int | None = None,
         mcp_config_path: str | None,
         no_mcp: bool,
@@ -618,6 +629,8 @@ class ServerConfig:
             rubric_model: Grader model spec; `None` reuses the main model.
             rubric_max_iterations: Explicit grader iterations per rubric attempt;
                 `None` uses the SDK default.
+            auto_classifier_model: Auto classifier model spec; `None` resolves from
+                env / `config.toml` and then reuses the main model.
             recursion_limit: Explicit main-agent `recursion_limit`; `None` resolves
                 from env / `config.toml` / default at agent-build time.
             mcp_config_path: Path to MCP config.
@@ -651,6 +664,7 @@ class ServerConfig:
             allow_fs_tools=allow_fs_tools,
             rubric_model=rubric_model,
             rubric_max_iterations=rubric_max_iterations,
+            auto_classifier_model=auto_classifier_model,
             recursion_limit=recursion_limit,
             sandbox_type=sandbox_type,
             sandbox_id=sandbox_id,

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/deepagents_code/_version.py

@@ -2,7 +2,7 @@
 
 # Keep the `x-release-please-version` annotation — release-please uses it to
 # bump `__version__` in sync with `pyproject.toml` on every release PR.
-__version__ = "0.1.51"  # x-release-please-version
+__version__ = "0.1.52"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/code"
 """URL for `deepagents-code` documentation."""

{deepagents_code-0.1.51 → deepagents_code-0.1.52}/deepagents_code/agent.py

@@ -2200,6 +2200,7 @@ def create_cli_agent(
     enable_interpreter: bool = False,
     rubric_model: str | BaseChatModel | None = None,
     rubric_max_iterations: int | None = None,
+    auto_classifier_model: str | BaseChatModel | None = None,
     recursion_limit: int | None = None,
     checkpointer: BaseCheckpointSaver | None = None,
     mcp_server_info: list[MCPServerInfo] | None = None,
@@ -2325,6 +2326,16 @@ def create_cli_agent(
         rubric_max_iterations: Explicit grader iterations per rubric attempt
             before the agent terminates with `'max_iterations_reached'`; `None`
             uses the SDK default.
+        auto_classifier_model: Model the Auto approval classifier reviews with.
+
+            A `'provider:model'` string or `BaseChatModel`.
+
+            When `None`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL` is consulted,
+            then `[models].auto_classifier`, and the main `model` is reused when
+            both are unset. A blank string is *not* the same as `None`: it means
+            "inherit the main model" directly and, unlike `None`, does not
+            consult the env var or `config.toml`. Only meaningful when
+            `auto_mode_enabled` is `True`.
         recursion_limit: Explicit LangGraph `recursion_limit` (graph step budget)
             for the main agent. When `None`, it is resolved from the
             `DEEPAGENTS_CODE_RECURSION_LIMIT` env var, `[runtime].recursion_limit`
@@ -2463,21 +2474,17 @@ def create_cli_agent(
         # Server-owned hooks must wrap subagent tools too; otherwise Pre/Post
         # ToolUse only fire on the parent graph. Disable Stop so finishing a
         # subagent does not emit the main-agent Stop event (SubagentStop still
-        # fires from the parent wrap around `task`). Hooks v2 stays off unless
-        # experimental mode is on.
-        from deepagents_code._env_vars import EXPERIMENTAL, is_env_truthy
-
-        if is_env_truthy(EXPERIMENTAL):
-            from deepagents_code.hooks.server_middleware import ServerHooksMiddleware
+        # fires from the parent wrap around `task`).
+        from deepagents_code.hooks.server_middleware import ServerHooksMiddleware
 
-            hooks_cwd = Path(effective_cwd) if effective_cwd is not None else Path.cwd()
-            middleware.append(
-                ServerHooksMiddleware(
-                    cwd=hooks_cwd,
-                    emit_stop=False,
-                    mcp_tools=mcp_tools,
-                )
+        hooks_cwd = Path(effective_cwd) if effective_cwd is not None else Path.cwd()
+        middleware.append(
+            ServerHooksMiddleware(
+                cwd=hooks_cwd,
+                emit_stop=False,
+                mcp_tools=mcp_tools,
             )
+        )
         # Subagents share the on-disk filesystem backend and can edit the user
         # AGENTS.md, so they get the same managed onboarding-name block guard as
         # the main agent. Gated on memory because the block only exists when
@@ -2844,13 +2851,25 @@ def create_cli_agent(
     compaction_middleware = _create_cli_compaction_middleware(model, composite_backend)
     if auto_mode_config is not None and resolved_interrupt_on is not None:
         from deepagents_code.auto_mode import AutoModeHITLMiddleware
+        from deepagents_code.config import resolve_auto_classifier_model
+        from deepagents_code.config_manifest import resolve_auto_classifier_timeout
 
         trusted_root, narrow_allow_list = auto_mode_config
+        # An explicit argument wins; otherwise the env var / `config.toml`
+        # preference is read here, where agent construction already runs off the
+        # blockbuster-guarded server loop (see `server_graph._make_graph`).
+        classifier_model = (
+            auto_classifier_model
+            if auto_classifier_model is not None
+            else resolve_auto_classifier_model()
+        )
         agent_middleware.append(
             AutoModeHITLMiddleware(
                 resolved_interrupt_on,
                 worktree_root=trusted_root,
                 shell_allow_list=narrow_allow_list,
+                classifier_model=classifier_model,
+                classifier_timeout_seconds=resolve_auto_classifier_timeout(),
                 trusted_ask_user_tool=trusted_ask_user_tool,
                 trusted_compaction_tool=compaction_middleware.tools[0],
             )
@@ -2862,19 +2881,13 @@ def create_cli_agent(
         agent_middleware.append(AsyncApprovalHITLMiddleware(resolved_interrupt_on))
 
     # Server-owned Hooks v2 lifecycle events (Pre/Post tool, Stop, subagent).
-    # Mounted only in experimental mode; when mounted, also gated at runtime by
-    # `hooks_server_events` on the per-run context so idle sessions without
-    # configured handlers pay no interrupt round-trip. Appended after the HITL
-    # middleware so `PreToolUse` resolves before approval routing.
-    from deepagents_code._env_vars import EXPERIMENTAL, is_env_truthy
-
-    if is_env_truthy(EXPERIMENTAL):
-        from deepagents_code.hooks.server_middleware import ServerHooksMiddleware
+    # Gated at runtime by `hooks_server_events` on the per-run context so idle
+    # sessions without configured handlers pay no interrupt round-trip. Appended
+    # after the HITL middleware so `PreToolUse` resolves before approval routing.
+    from deepagents_code.hooks.server_middleware import ServerHooksMiddleware
 
-        hooks_cwd = Path(effective_cwd) if effective_cwd is not None else Path.cwd()
-        agent_middleware.append(
-            ServerHooksMiddleware(cwd=hooks_cwd, mcp_tools=mcp_tools)
-        )
+    hooks_cwd = Path(effective_cwd) if effective_cwd is not None else Path.cwd()
+    agent_middleware.append(ServerHooksMiddleware(cwd=hooks_cwd, mcp_tools=mcp_tools))
 
     if fs_tools is not None:
         # `fs_tools` is an explicit allowlist here (`--allow-fs-tools all` and an