deepagents-code 0.1.55__tar.gz → 0.1.57__tar.gz

{deepagents_code-0.1.55 → deepagents_code-0.1.57}/AGENTS.md

@@ -78,6 +78,7 @@ Apply these rules to new UI; do not treat them as a mandate to refactor existing
 - Use `textual.pilot` for async UI testing - see [Testing guide](https://textual.textualize.io/guide/testing/)
 - Snapshot testing available for visual regression - see repo `notes/snapshot_testing.md`
 - For modal flows, test the real interaction path with keypresses when possible. Unit tests that call action methods or resume handlers directly can miss focus and modal-stack bugs.
+- A modal test that pushes the screen onto a bare `App` host cannot catch app-level key interception. The app owns a priority `shift+tab -> toggle_auto_approve` binding (`app.py`) that wins dispatch over any screen binding; `action_toggle_auto_approve` routes the key to the active screen. Cursor-style modals (highlighted rows, no focusable children) just implement `action_move_up` — the router's `_SupportsReverseNav` protocol branch picks them up automatically. The protocol matches on method *presence*, so enrollment is opt-out, not opt-in: a screen that defines `action_move_up` for its own arrow keys gets `shift+tab` reverse-nav whether or not it was written with that key in mind. Screens needing different behavior (`focus_previous`, tab bars) — or none — need an explicit branch *above* the protocol check in `action_toggle_auto_approve`. Either way, add an app-level regression test in `test_app.py` that presses `shift+tab` through the real `DeepAgentsApp` dispatch, or the modal will silently swallow the key.
 - Do not open another modal or refocus the base chat input directly inside a modal dismiss callback. Preserve the non-blocking `push_screen(..., callback)` flow and schedule follow-up UI work with `call_after_refresh` so the dismissing modal fully unwinds first.
 - Be cautious replacing `push_screen(..., callback)` with an awaited modal result inside slash-command handlers; awaiting can block the Textual message pump and break keyboard navigation in the active modal. Slash commands are dispatched from `on_chat_input_submitted`, which is awaited inline on that pump, so a modal awaited anywhere in the call chain never receives the keys that would resolve it and looks frozen.
 - When a command genuinely needs an awaited modal result, hand the continuation to `_schedule_off_message_pump` so the handler returns first. A detached continuation runs outside the handler's `try/except` and is cancelled at app exit, so it must catch its own exceptions and mount its own failure message — otherwise the failure reaches only `_log_task_exception` and the user sees no outcome at all — and it must tolerate cancellation part-way through, including mid-subprocess. Anything that mutates the running tool environment must also take `_environment_mutation_lock`, since the handler no longer serializes commands by blocking.

{deepagents_code-0.1.55 → deepagents_code-0.1.57}/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.57](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.56...deepagents-code==0.1.57) (2026-08-18)
+
+### Features
+
+- Added warnings before expensive cold-cache turns and trust user-declared endpoints for cold-cache policies ([#5439](https://github.com/langchain-ai/deepagents/issues/5439), [#5462](https://github.com/langchain-ai/deepagents/issues/5462)).
+- Made the chat input resizable by dragging its top border ([#5524](https://github.com/langchain-ai/deepagents/issues/5524)).
+- Added a `multi_select` question type to `ask_user` ([#5097](https://github.com/langchain-ai/deepagents/issues/5097)).
+- Added support for ACP approval modes ([#5394](https://github.com/langchain-ai/deepagents/issues/5394)).
+- Added `DeepSeek-V4-Pro-0813` to the model picker ([#5512](https://github.com/langchain-ai/deepagents/issues/5512)).
+- Show conversation turns alongside message counts ([#5571](https://github.com/langchain-ai/deepagents/issues/5571)).
+- Include `TERM_PROGRAM` in the resume hint ([#5548](https://github.com/langchain-ai/deepagents/issues/5548)).
+
+### Bug Fixes
+
+- Report total context after `/offload` ([#5488](https://github.com/langchain-ai/deepagents/issues/5488)).
+- Fixed transcript and thread restoration issues, including hydration lag, scrolling resumed threads to the bottom, and hiding empty previous-thread hints ([#5479](https://github.com/langchain-ai/deepagents/issues/5479), [#5543](https://github.com/langchain-ai/deepagents/issues/5543), [#5552](https://github.com/langchain-ai/deepagents/issues/5552)).
+- Fixed Auto-mode approval handling by binding “yes” to the paired `ask_user` question and avoiding duplicate Auto denial notices ([#5038](https://github.com/langchain-ai/deepagents/issues/5038), [#5501](https://github.com/langchain-ai/deepagents/issues/5501)).
+- Improved reload behavior by keeping the chat input responsive during `/reload`, reporting MCP server changes, and avoiding plugin reload prompt flashes or startup hints ([#5529](https://github.com/langchain-ai/deepagents/issues/5529), [#5504](https://github.com/langchain-ai/deepagents/issues/5504), [#5500](https://github.com/langchain-ai/deepagents/issues/5500), [#5502](https://github.com/langchain-ai/deepagents/issues/5502)).
+- Improved dependency update UI by preserving editable fields and hiding dependency details after updates ([#5521](https://github.com/langchain-ai/deepagents/issues/5521), [#5519](https://github.com/langchain-ai/deepagents/issues/5519)).
+- Fixed chat UI polish issues, including detached spacer mount anchors, the unfocused input cursor, and relative timestamp toggle display ([#5516](https://github.com/langchain-ai/deepagents/issues/5516), [#5258](https://github.com/langchain-ai/deepagents/issues/5258), [#5503](https://github.com/langchain-ai/deepagents/issues/5503)).
+- Refresh the splash version after updates ([#5520](https://github.com/langchain-ai/deepagents/issues/5520)).
+
+## [0.1.56](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.55...deepagents-code==0.1.56) (2026-08-14)
+
+### Features
+
+- Personalized external editor hints to better match your setup ([#5445](https://github.com/langchain-ai/deepagents/issues/5445))
+
+### Bug Fixes
+
+- Improved dependency warning, Auto classifier, and paste expansion messages for clearer, more concise prompts and toasts ([#5489](https://github.com/langchain-ai/deepagents/issues/5489), [#5446](https://github.com/langchain-ai/deepagents/issues/5446), [#5443](https://github.com/langchain-ai/deepagents/issues/5443))
+- Queued `/copy` commands while generation is active so they run at the right time ([#5447](https://github.com/langchain-ai/deepagents/issues/5447))
+- Hid invalid cache metrics from the UI ([#5475](https://github.com/langchain-ai/deepagents/issues/5475))
+- Fixed forced-compaction forks by preserving the `session_id` ([#5492](https://github.com/langchain-ai/deepagents/issues/5492))
+- Stopped passing the removed `checkpoint_metadata` field ([#5473](https://github.com/langchain-ai/deepagents/issues/5473))
+
 ## [0.1.55](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.54...deepagents-code==0.1.55) (2026-08-12)
 
 ### Features

{deepagents_code-0.1.55 → deepagents_code-0.1.57}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: deepagents-code
-Version: 0.1.55
+Version: 0.1.57
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/
@@ -29,21 +29,21 @@ Requires-Python: <4.0,>=3.11
 Requires-Dist: aiosqlite<1.0.0,>=0.22.1
 Requires-Dist: anyio<5.0.0,>=4.14.2
 Requires-Dist: deepagents-acp<1.0.0,>=0.0.10
-Requires-Dist: deepagents==0.7.5
+Requires-Dist: deepagents==0.7.6
 Requires-Dist: filelock<3.30,>=3.29.7
-Requires-Dist: genai-prices<0.2.0,>=0.1.1
+Requires-Dist: genai-prices<0.2.0,>=0.1.3
 Requires-Dist: httpx<1.0.0,>=0.28.1
-Requires-Dist: langchain-anthropic<2.0.0,>=1.5.4
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.2
-Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.0
-Requires-Dist: langchain-openai<2.0.0,>=1.4.1
+Requires-Dist: langchain-anthropic<2.0.0,>=1.5.6
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.3
+Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.2
+Requires-Dist: langchain-openai<2.0.0,>=1.5.0
 Requires-Dist: langchain-quickjs<0.4.0,>=0.3.4
-Requires-Dist: langchain<2.0.0,>=1.3.14
+Requires-Dist: langchain<2.0.0,>=1.3.15
 Requires-Dist: langgraph-checkpoint-sqlite<4.0.0,>=3.1.1
 Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.31
-Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.31.1
+Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.32.4
 Requires-Dist: langgraph-sdk<1.0.0,>=0.4.2
-Requires-Dist: langsmith[sandbox]>=0.10.10
+Requires-Dist: langsmith[sandbox]>=0.10.18
 Requires-Dist: markdownify<2.0.0,>=1.2.3
 Requires-Dist: mcp<2.0.0,>=1.28.1
 Requires-Dist: packaging>=26.2
@@ -65,13 +65,13 @@ Provides-Extra: agentcore
 Requires-Dist: langchain-agentcore-codeinterpreter<1.0.0,>=0.0.5; extra == 'agentcore'
 Provides-Extra: all-providers
 Requires-Dist: aiohttp<3.15.0,>=3.14.3; extra == 'all-providers'
-Requires-Dist: langchain-anthropic<2.0.0,>=1.5.4; extra == 'all-providers'
-Requires-Dist: langchain-aws<2.0.0,>=1.6.3; extra == 'all-providers'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.5.6; extra == 'all-providers'
+Requires-Dist: langchain-aws<2.0.0,>=1.7.0; extra == 'all-providers'
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.3; extra == 'all-providers'
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'all-providers'
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'all-providers'
 Requires-Dist: langchain-fireworks<2.0.0,>=1.5.2; extra == 'all-providers'
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.2; extra == 'all-providers'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.3; extra == 'all-providers'
 Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.4; extra == 'all-providers'
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'all-providers'
 Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'all-providers'
@@ -81,7 +81,7 @@ Requires-Dist: langchain-meta<2.0.0,>=0.5.0; extra == 'all-providers'
 Requires-Dist: langchain-mistralai<2.0.0,>=1.1.6; extra == 'all-providers'
 Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.4.3; extra == 'all-providers'
 Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'all-providers'
-Requires-Dist: langchain-openai<2.0.0,>=1.4.1; extra == 'all-providers'
+Requires-Dist: langchain-openai<2.0.0,>=1.5.0; extra == 'all-providers'
 Requires-Dist: langchain-openrouter<2.0.0,>=0.2.7; extra == 'all-providers'
 Requires-Dist: langchain-perplexity<2.0.0,>=1.4.0; extra == 'all-providers'
 Requires-Dist: langchain-together<2.0.0,>=0.4.0; extra == 'all-providers'
@@ -93,11 +93,11 @@ Requires-Dist: langchain-modal>=0.0.5; extra == 'all-sandboxes'
 Requires-Dist: langchain-runloop>=0.0.6; extra == 'all-sandboxes'
 Requires-Dist: langchain-vercel-sandbox>=0.0.1; extra == 'all-sandboxes'
 Provides-Extra: anthropic
-Requires-Dist: langchain-anthropic<2.0.0,>=1.5.4; extra == 'anthropic'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.5.6; extra == 'anthropic'
 Provides-Extra: baseten
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.3; extra == 'baseten'
 Provides-Extra: bedrock
-Requires-Dist: langchain-aws<2.0.0,>=1.6.3; extra == 'bedrock'
+Requires-Dist: langchain-aws<2.0.0,>=1.7.0; extra == 'bedrock'
 Provides-Extra: cohere
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'cohere'
 Provides-Extra: daytona
@@ -107,7 +107,7 @@ Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'deepseek'
 Provides-Extra: fireworks
 Requires-Dist: langchain-fireworks<2.0.0,>=1.5.2; extra == 'fireworks'
 Provides-Extra: google-genai
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.2; extra == 'google-genai'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.3; extra == 'google-genai'
 Provides-Extra: groq
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'groq'
 Provides-Extra: huggingface
@@ -131,7 +131,7 @@ Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.4.3; extra == 'nvidia'
 Provides-Extra: ollama
 Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'ollama'
 Provides-Extra: openai
-Requires-Dist: langchain-openai<2.0.0,>=1.4.1; extra == 'openai'
+Requires-Dist: langchain-openai<2.0.0,>=1.5.0; extra == 'openai'
 Provides-Extra: openrouter
 Requires-Dist: langchain-openrouter<2.0.0,>=0.2.7; extra == 'openrouter'
 Provides-Extra: perplexity

{deepagents_code-0.1.55 → deepagents_code-0.1.57}/THREAT_MODEL.md

@@ -442,7 +442,7 @@
 #### T14: Weaker Auto Classifier Model Weakens Action Review
 
 - **Flow**: DF7 (LLM tool call) → Auto classifier review → C4 Tools
-- **Description**: In Auto approval mode, gated tool calls that deterministic policy cannot clear are reviewed by an LLM authorization classifier. That classifier can be pointed at a separate model (`--auto-classifier-model`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`, `[models].auto_classifier`, or `/auto model`) so reviews are cheaper and faster than the main agent model. Review quality then follows the chosen model: a weaker one is likelier to mis-authorize an action, and likelier to be steered by injected instructions in the untrusted material it reads (tool arguments, paths, prior tool output, remote metadata). Choosing the classifier is a user-level decision, so it is restricted to trusted surfaces: shell exports, the global `~/.deepagents/.env`, `~/.deepagents/config.toml`, the CLI flag, and `/auto model`. A *project* `.env` travels with a cloned repo, so `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL` is listed in `config._PROJECT_DOTENV_DENIED_ENV_KEYS` — the same mitigation TB4 applies to the project-MCP trust vars; without that entry a checked-in `.env` could silently downgrade the review on `dcode` startup. With it, this is a self-inflicted weakening of a control rather than an external attack path. Auto's model-independent guards are unchanged by the setting: deterministic allow/deny, the consecutive/total denial counters, batch-replay detection, control-state availability, and the human-fallback thresholds. A classifier model that cannot be constructed (bad spec, missing credentials, uninstalled provider package) never falls back to the main model — the first such batch is marked `classifier_unavailable`, so those calls are denied and do not execute, and the failing spec is latched so every subsequent batch escalates straight to human approval until a review succeeds. A transient failure instead escalates once `_CONSECUTIVE_UNAVAILABLE_FALLBACK` consecutive batches have failed, or immediately when Auto's control state cannot be persisted. The review deadline is tunable through a subset of the same trusted surfaces — shell exports, the global `~/.deepagents/.env`, and `[models].auto_classifier_timeout` in `~/.deepagents/config.toml` (there is no CLI flag and no `/auto` subcommand for it) — and `DEEPAGENTS_CODE_AUTO_CLASSIFIER_TIMEOUT` is denied from a project `.env` for the same reason, so a cloned repo cannot stall gated batches or squeeze the budget until reviews time out. `config_manifest.resolve_auto_classifier_timeout` rejects any resolved value outside `[AUTO_CLASSIFIER_TIMEOUT_FLOOR, AUTO_CLASSIFIER_TIMEOUT_CEILING]` — out-of-range and malformed values are discarded in favor of the next config source rather than clamped — so the deadline itself cannot be removed; a timed-out batch remains fail-closed (`classifier_unavailable`).
+- **Description**: In Auto approval mode, gated tool calls that deterministic policy cannot clear are reviewed by an LLM authorization classifier. That classifier can be pointed at a separate model (`--auto-classifier-model`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`, `[models].auto_classifier`, or `/auto model`) so reviews are cheaper and faster than the main agent model. Review quality then follows the chosen model: a weaker one is likelier to mis-authorize an action, and likelier to be steered by injected instructions in the untrusted material it reads (tool arguments, paths, prior tool output, remote metadata, and the model-authored `ask_user` question text paired with a same-turn answer). Question text is a distinct case: the `ask_user` receipt attests only that this exact text was displayed to the user and answered, never that its content is true, so a question asserting prior or blanket authorization is untrusted content rather than evidence. `_CLASSIFIER_POLICY` instructs the classifier to read a paired question strictly as a description of a proposed action and target, to disregard directives embedded in it, and to allow an action only where that description matches the action's canonical arguments. Choosing the classifier is a user-level decision, so it is restricted to trusted surfaces: shell exports, the global `~/.deepagents/.env`, `~/.deepagents/config.toml`, the CLI flag, and `/auto model`. A *project* `.env` travels with a cloned repo, so `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL` is listed in `config._PROJECT_DOTENV_DENIED_ENV_KEYS` — the same mitigation TB4 applies to the project-MCP trust vars; without that entry a checked-in `.env` could silently downgrade the review on `dcode` startup. With it, this is a self-inflicted weakening of a control rather than an external attack path. Auto's model-independent guards are unchanged by the setting: deterministic allow (the deterministic deny rules are narrow and do not cover the Deny categories, so an action the classifier affirmatively allows is not re-checked downstream), the consecutive/total denial counters, batch-replay detection, control-state availability, and the human-fallback thresholds. A classifier model that cannot be constructed (bad spec, missing credentials, uninstalled provider package) never falls back to the main model — the first such batch is marked `classifier_unavailable`, so those calls are denied and do not execute, and the failing spec is latched so every subsequent batch escalates straight to human approval until a review succeeds. A transient failure instead escalates once `_CONSECUTIVE_UNAVAILABLE_FALLBACK` consecutive batches have failed, or immediately when Auto's control state cannot be persisted. The review deadline is tunable through a subset of the same trusted surfaces — shell exports, the global `~/.deepagents/.env`, and `[models].auto_classifier_timeout` in `~/.deepagents/config.toml` (there is no CLI flag and no `/auto` subcommand for it) — and `DEEPAGENTS_CODE_AUTO_CLASSIFIER_TIMEOUT` is denied from a project `.env` for the same reason, so a cloned repo cannot stall gated batches or squeeze the budget until reviews time out. `config_manifest.resolve_auto_classifier_timeout` rejects any resolved value outside `[AUTO_CLASSIFIER_TIMEOUT_FLOOR, AUTO_CLASSIFIER_TIMEOUT_CEILING]` — out-of-range and malformed values are discarded in favor of the next config source rather than clamped — so the deadline itself cannot be removed; a timed-out batch remains fail-closed (`classifier_unavailable`).
 - **Preconditions**: (1) Auto approval mode is active (interactive TUI only, and not under a sandbox); (2) a classifier model is configured through one of the trusted surfaces above — the default reuses the main agent model; (3) for the injected-review variant, untrusted content reaches the classifier through DF8/DF9 and the chosen model follows it. The intended control is that the human remains the fallback for anything the classifier does not affirmatively allow.
 
 ---
@@ -452,7 +452,7 @@
 | Input Source          | Data Flows            | Threats       | Validation Points                                                          | Responsibility | Gaps                                                                                         |
 |-----------------------|-----------------------|---------------|----------------------------------------------------------------------------|----------------|----------------------------------------------------------------------------------------------|
 | User direct input     | DF1, DF2              | None (TB1)    | None — prompts accepted verbatim                                           | User           | No content filtering — intentional; HITL gates downstream tool calls                        |
-| LLM output            | DF6, DF7              | T1, T2, T3, T4, T13, T14| HITL gate; shell allow-list; Unicode/URL warnings on tool args; Auto classifier review | Project        | LLM-generated tool args not scanned for injection beyond Unicode/URL; shell allow-list matches only the command's first token, so allow-listed interpreters/wrappers bypass it (T13); Auto classifier review quality follows the user-selected classifier model, and the classifier reads untrusted tool arguments and prior output (T14)   |
+| LLM output            | DF6, DF7              | T1, T2, T3, T4, T13, T14| HITL gate; shell allow-list; Unicode/URL warnings on tool args; Auto classifier review | Project        | LLM-generated tool args not scanned for injection beyond Unicode/URL; shell allow-list matches only the command's first token, so allow-listed interpreters/wrappers bypass it (T13); Auto classifier review quality follows the user-selected classifier model, and the classifier reads untrusted tool arguments, prior output, and model-authored `ask_user` question text (T14)   |
 | Tool/function results | DF9, DF11             | T1            | Unicode warning on URL args; `markdownify` HTML conversion                 | Shared         | Tool *results* pass to context without prompt-injection scan                                 |
 | URL-fetched content   | DF8, DF9              | T1            | `check_url_safety` on URL arg; HTML→markdown conversion                    | Shared         | Markup-embedded instructions survive markdownify; no LLM-layer guardrail                    |
 | Configuration         | DF10, DF12, DF15, DF23| T9, T10, T12, T14  | Dotenv shell-env precedence; TOML schema; MCP schema + allow/deny lists; JSON structure check; `class_path` format check; project-`.env` denylist for the Auto classifier model | User | Project `.env` can set shell startup-hook vars; `class_path` executes module code before type check; MCP env dict unfiltered; Auto classifier strength is a user choice with no floor enforced (T14) |
@@ -521,3 +521,4 @@ Threats that appear valid in isolation but fall outside project responsibility b
 | 2026-07-28 | manual update                      | Extended the out-of-scope hooks row for plugin-contributed hooks: enabled plugins may supply `hooks/hooks.json`, gated by install plus enablement rather than workspace trust, with each handler's environment overlaid only by its own plugin path variables |
 | 2026-08-03 | manual update                      | Added T14 (a weaker Auto classifier model weakens action review) under TB2, covering the selectable classifier (`--auto-classifier-model`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`, `[models].auto_classifier`, `/auto model`), its restriction to trusted config surfaces via `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, and its fail-closed construction behavior (deny, then latch to human approval; never fall back to the main model). Extended the "LLM output" and "Configuration" input-coverage rows with T14 |
 | 2026-08-04 | manual update                      | Extended T14 for the configurable Auto classifier review deadline (`DEEPAGENTS_CODE_AUTO_CLASSIFIER_TIMEOUT`, `[models].auto_classifier_timeout`): bounded by `config_manifest.resolve_auto_classifier_timeout` between a floor and ceiling so the deadline cannot be removed, denied from a project `.env` via `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, and fail-closed on expiry |
+| 2026-08-17 | manual update                      | Extended T14 for `ask_user` question text as a classifier injection source: the receipt attests display and answer, not content, so a question claiming prior or blanket authorization is untrusted content; recorded the `_CLASSIFIER_POLICY` clauses that keep a paired question to an action/target description matched against canonical arguments. Narrowed the T14 "deterministic allow/deny" guard wording, which overstated the deny side: deterministic denies do not cover the Deny categories, and an affirmative classifier allow is not re-checked downstream |

{deepagents_code-0.1.55 → deepagents_code-0.1.57}/deepagents_code/_ask_user_types.py

@@ -11,16 +11,87 @@ side produces it and which reads it.
 
 from __future__ import annotations
 
-from typing import Annotated, Literal, NotRequired
+from typing import Annotated, Literal, NotRequired, assert_never, get_args
 
 from pydantic import Field
 from typing_extensions import TypedDict
 
+QuestionType = Literal["text", "multiple_choice", "multi_select"]
+"""Supported `ask_user` question types."""
+
+QUESTION_TYPES: frozenset[str] = frozenset(get_args(QuestionType))
+"""Runtime membership view of `QuestionType`.
+
+Derived via `get_args` so the membership checks in `ask_user` and `auto_mode`
+cannot drift from the alias when a new question type is added. That drift would
+be silent: an unrecognized type makes `_ask_user_question_count` return `None`,
+which drops the user's answers as same-turn authorization without any error.
+"""
+
+
+def _requires_choices(question_type: QuestionType) -> bool:
+    """Return whether `question_type` needs a non-empty `choices` list.
+
+    Args:
+        question_type: A member of `QuestionType`.
+
+    Returns:
+        True if questions of this type must define `choices`.
+    """
+    if question_type == "text":
+        return False
+    if question_type in {"multiple_choice", "multi_select"}:
+        return True
+    # Exhaustiveness guard: adding a `QuestionType` member without deciding here
+    # whether it needs choices fails type checking rather than silently landing
+    # on the wrong side of `CHOICE_QUESTION_TYPES`.
+    assert_never(question_type)
+
+
+CHOICE_QUESTION_TYPES: frozenset[str] = frozenset(
+    question_type
+    for question_type in get_args(QuestionType)
+    if _requires_choices(question_type)
+)
+"""Question types that require a non-empty `choices` list.
+
+Derived from `_requires_choices` rather than written out, so it cannot omit a
+new choice-based `QuestionType` member. Note that requiring `choices` is not the
+same as being *rendered* as a choice list: the TUI has its own exhaustive
+dispatch in `_QuestionWidget.compose`.
+"""
+
+MULTI_SELECT_ANSWER_SEPARATOR = ", "
+"""Separator joining the selected values of a `multi_select` answer."""
+
+MULTI_SELECT_FORBIDDEN_IN_VALUE = ","
+"""Substring a `multi_select` choice value must not contain.
+
+Deliberately stated outright rather than derived from
+`MULTI_SELECT_ANSWER_SEPARATOR`, so the two can evolve independently: a separator
+of `" and "` would, if the forbidden text were derived from it, reject every value
+containing "and".
+
+This buys *legibility* of the joined answer, not invertibility. Nothing decodes a
+multi-select answer back into its components, and per
+`format_ask_user_transcript` the transcript is not unambiguously decodable
+anyway. If one is ever written, that is the moment to introduce a structured
+answer type instead of leaning on this ban.
+"""
+
 
 class Choice(TypedDict):
-    """A single choice option for a multiple choice question."""
+    """A single choice option for a multiple choice or multi-select question."""
 
-    value: Annotated[str, Field(description="The display label for this choice.")]
+    value: Annotated[
+        str,
+        Field(
+            description=(
+                "The display label for this choice. Also the text returned as "
+                "the answer when this choice is selected."
+            )
+        ),
+    ]
 
 
 class Question(TypedDict):
@@ -29,11 +100,18 @@ class Question(TypedDict):
     question: Annotated[str, Field(description="The question text to display.")]
 
     type: Annotated[
-        Literal["text", "multiple_choice"],
+        QuestionType,
         Field(
             description=(
                 "Question type. 'text' for free-form input, 'multiple_choice' for "
-                "predefined options."
+                "picking exactly one predefined option, 'multi_select' for picking "
+                "one or more predefined options. Both choice types always append an "
+                "'Other' free-form option automatically; multi-select can accept "
+                "multiple custom Other values (filling one reveals another). A "
+                "'multi_select' answer comes back as the selected values "
+                "(including any custom Other text) joined with ', '; if nothing "
+                "is selected on an optional question the answer is an empty "
+                "string."
             )
         ),
     ]
@@ -43,8 +121,12 @@ class Question(TypedDict):
             list[Choice],
             Field(
                 description=(
-                    "Options for multiple_choice questions. An 'Other' free-form "
-                    "option is always appended automatically."
+                    "Options for 'multiple_choice' and 'multi_select' questions. "
+                    "Every choice needs a non-empty 'value'. An 'Other' free-form "
+                    "option is always appended automatically for both types; "
+                    "multi-select may collect multiple custom Other values. "
+                    "'multi_select' values (including custom Other text) must not "
+                    "contain ',' because the answer joins them with ', '."
                 )
             ),
         ]
@@ -53,8 +135,18 @@ class Question(TypedDict):
     required: NotRequired[
         Annotated[
             bool,
+            # `strict=True` so a stringly-typed `"false"` is rejected at the tool
+            # boundary rather than coerced. Without it pydantic accepts the string,
+            # the prompt renders, and then `_ask_user_question_count` — which reads
+            # the *raw* tool args and requires a real bool — returns `None`, which
+            # drops every answer in the call as same-turn authorization with no
+            # error. Strict here keeps the two boundaries agreeing, and makes the
+            # coercion loud instead of silently expensive.
             Field(
-                description="Whether the user must answer. Defaults to true if omitted."
+                description=(
+                    "Whether the user must answer. Defaults to true if omitted."
+                ),
+                strict=True,
             ),
         ]
     ]
@@ -75,6 +167,11 @@ class AskUserRequest(TypedDict):
 
 ASK_USER_AUTHORIZATION_METADATA_KEY = "deepagents_code_ask_user_authorization"
 MAX_ASK_USER_AUTHORIZATION_ANSWER_CHARS = 4000
+# These limits bound the receipt-anchored question/answer evidence copied into
+# Auto's classifier prompt. Questions are model-generated and otherwise have no
+# schema length constraint, so they must not be able to exhaust that context.
+MAX_ASK_USER_AUTHORIZATION_QUESTION_CHARS = 4000
+MAX_ASK_USER_AUTHORIZATION_QUESTION_TOTAL_CHARS = 8000
 
 
 class AskUserAuthorizationReceipt(TypedDict):

{deepagents_code-0.1.55 → deepagents_code-0.1.57}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "80fe3d3"
+BUILD_COMMIT = "57e15ea"