deepagents-code 0.1.56__tar.gz → 0.1.57__tar.gz

{deepagents_code-0.1.56 → deepagents_code-0.1.57}/AGENTS.md

@@ -78,6 +78,7 @@ Apply these rules to new UI; do not treat them as a mandate to refactor existing
 - Use `textual.pilot` for async UI testing - see [Testing guide](https://textual.textualize.io/guide/testing/)
 - Snapshot testing available for visual regression - see repo `notes/snapshot_testing.md`
 - For modal flows, test the real interaction path with keypresses when possible. Unit tests that call action methods or resume handlers directly can miss focus and modal-stack bugs.
+- A modal test that pushes the screen onto a bare `App` host cannot catch app-level key interception. The app owns a priority `shift+tab -> toggle_auto_approve` binding (`app.py`) that wins dispatch over any screen binding; `action_toggle_auto_approve` routes the key to the active screen. Cursor-style modals (highlighted rows, no focusable children) just implement `action_move_up` — the router's `_SupportsReverseNav` protocol branch picks them up automatically. The protocol matches on method *presence*, so enrollment is opt-out, not opt-in: a screen that defines `action_move_up` for its own arrow keys gets `shift+tab` reverse-nav whether or not it was written with that key in mind. Screens needing different behavior (`focus_previous`, tab bars) — or none — need an explicit branch *above* the protocol check in `action_toggle_auto_approve`. Either way, add an app-level regression test in `test_app.py` that presses `shift+tab` through the real `DeepAgentsApp` dispatch, or the modal will silently swallow the key.
 - Do not open another modal or refocus the base chat input directly inside a modal dismiss callback. Preserve the non-blocking `push_screen(..., callback)` flow and schedule follow-up UI work with `call_after_refresh` so the dismissing modal fully unwinds first.
 - Be cautious replacing `push_screen(..., callback)` with an awaited modal result inside slash-command handlers; awaiting can block the Textual message pump and break keyboard navigation in the active modal. Slash commands are dispatched from `on_chat_input_submitted`, which is awaited inline on that pump, so a modal awaited anywhere in the call chain never receives the keys that would resolve it and looks frozen.
 - When a command genuinely needs an awaited modal result, hand the continuation to `_schedule_off_message_pump` so the handler returns first. A detached continuation runs outside the handler's `try/except` and is cancelled at app exit, so it must catch its own exceptions and mount its own failure message — otherwise the failure reaches only `_log_task_exception` and the user sees no outcome at all — and it must tolerate cancellation part-way through, including mid-subprocess. Anything that mutates the running tool environment must also take `_environment_mutation_lock`, since the handler no longer serializes commands by blocking.

{deepagents_code-0.1.56 → deepagents_code-0.1.57}/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.57](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.56...deepagents-code==0.1.57) (2026-08-18)
+
+### Features
+
+- Added warnings before expensive cold-cache turns and trust user-declared endpoints for cold-cache policies ([#5439](https://github.com/langchain-ai/deepagents/issues/5439), [#5462](https://github.com/langchain-ai/deepagents/issues/5462)).
+- Made the chat input resizable by dragging its top border ([#5524](https://github.com/langchain-ai/deepagents/issues/5524)).
+- Added a `multi_select` question type to `ask_user` ([#5097](https://github.com/langchain-ai/deepagents/issues/5097)).
+- Added support for ACP approval modes ([#5394](https://github.com/langchain-ai/deepagents/issues/5394)).
+- Added `DeepSeek-V4-Pro-0813` to the model picker ([#5512](https://github.com/langchain-ai/deepagents/issues/5512)).
+- Show conversation turns alongside message counts ([#5571](https://github.com/langchain-ai/deepagents/issues/5571)).
+- Include `TERM_PROGRAM` in the resume hint ([#5548](https://github.com/langchain-ai/deepagents/issues/5548)).
+
+### Bug Fixes
+
+- Report total context after `/offload` ([#5488](https://github.com/langchain-ai/deepagents/issues/5488)).
+- Fixed transcript and thread restoration issues, including hydration lag, scrolling resumed threads to the bottom, and hiding empty previous-thread hints ([#5479](https://github.com/langchain-ai/deepagents/issues/5479), [#5543](https://github.com/langchain-ai/deepagents/issues/5543), [#5552](https://github.com/langchain-ai/deepagents/issues/5552)).
+- Fixed Auto-mode approval handling by binding “yes” to the paired `ask_user` question and avoiding duplicate Auto denial notices ([#5038](https://github.com/langchain-ai/deepagents/issues/5038), [#5501](https://github.com/langchain-ai/deepagents/issues/5501)).
+- Improved reload behavior by keeping the chat input responsive during `/reload`, reporting MCP server changes, and avoiding plugin reload prompt flashes or startup hints ([#5529](https://github.com/langchain-ai/deepagents/issues/5529), [#5504](https://github.com/langchain-ai/deepagents/issues/5504), [#5500](https://github.com/langchain-ai/deepagents/issues/5500), [#5502](https://github.com/langchain-ai/deepagents/issues/5502)).
+- Improved dependency update UI by preserving editable fields and hiding dependency details after updates ([#5521](https://github.com/langchain-ai/deepagents/issues/5521), [#5519](https://github.com/langchain-ai/deepagents/issues/5519)).
+- Fixed chat UI polish issues, including detached spacer mount anchors, the unfocused input cursor, and relative timestamp toggle display ([#5516](https://github.com/langchain-ai/deepagents/issues/5516), [#5258](https://github.com/langchain-ai/deepagents/issues/5258), [#5503](https://github.com/langchain-ai/deepagents/issues/5503)).
+- Refresh the splash version after updates ([#5520](https://github.com/langchain-ai/deepagents/issues/5520)).
+
 ## [0.1.56](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.55...deepagents-code==0.1.56) (2026-08-14)
 
 ### Features

{deepagents_code-0.1.56 → deepagents_code-0.1.57}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: deepagents-code
-Version: 0.1.56
+Version: 0.1.57
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/
@@ -31,7 +31,7 @@ Requires-Dist: anyio<5.0.0,>=4.14.2
 Requires-Dist: deepagents-acp<1.0.0,>=0.0.10
 Requires-Dist: deepagents==0.7.6
 Requires-Dist: filelock<3.30,>=3.29.7
-Requires-Dist: genai-prices<0.2.0,>=0.1.1
+Requires-Dist: genai-prices<0.2.0,>=0.1.3
 Requires-Dist: httpx<1.0.0,>=0.28.1
 Requires-Dist: langchain-anthropic<2.0.0,>=1.5.6
 Requires-Dist: langchain-google-genai<5.0.0,>=4.3.3

{deepagents_code-0.1.56 → deepagents_code-0.1.57}/THREAT_MODEL.md

@@ -442,7 +442,7 @@
 #### T14: Weaker Auto Classifier Model Weakens Action Review
 
 - **Flow**: DF7 (LLM tool call) → Auto classifier review → C4 Tools
-- **Description**: In Auto approval mode, gated tool calls that deterministic policy cannot clear are reviewed by an LLM authorization classifier. That classifier can be pointed at a separate model (`--auto-classifier-model`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`, `[models].auto_classifier`, or `/auto model`) so reviews are cheaper and faster than the main agent model. Review quality then follows the chosen model: a weaker one is likelier to mis-authorize an action, and likelier to be steered by injected instructions in the untrusted material it reads (tool arguments, paths, prior tool output, remote metadata). Choosing the classifier is a user-level decision, so it is restricted to trusted surfaces: shell exports, the global `~/.deepagents/.env`, `~/.deepagents/config.toml`, the CLI flag, and `/auto model`. A *project* `.env` travels with a cloned repo, so `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL` is listed in `config._PROJECT_DOTENV_DENIED_ENV_KEYS` — the same mitigation TB4 applies to the project-MCP trust vars; without that entry a checked-in `.env` could silently downgrade the review on `dcode` startup. With it, this is a self-inflicted weakening of a control rather than an external attack path. Auto's model-independent guards are unchanged by the setting: deterministic allow/deny, the consecutive/total denial counters, batch-replay detection, control-state availability, and the human-fallback thresholds. A classifier model that cannot be constructed (bad spec, missing credentials, uninstalled provider package) never falls back to the main model — the first such batch is marked `classifier_unavailable`, so those calls are denied and do not execute, and the failing spec is latched so every subsequent batch escalates straight to human approval until a review succeeds. A transient failure instead escalates once `_CONSECUTIVE_UNAVAILABLE_FALLBACK` consecutive batches have failed, or immediately when Auto's control state cannot be persisted. The review deadline is tunable through a subset of the same trusted surfaces — shell exports, the global `~/.deepagents/.env`, and `[models].auto_classifier_timeout` in `~/.deepagents/config.toml` (there is no CLI flag and no `/auto` subcommand for it) — and `DEEPAGENTS_CODE_AUTO_CLASSIFIER_TIMEOUT` is denied from a project `.env` for the same reason, so a cloned repo cannot stall gated batches or squeeze the budget until reviews time out. `config_manifest.resolve_auto_classifier_timeout` rejects any resolved value outside `[AUTO_CLASSIFIER_TIMEOUT_FLOOR, AUTO_CLASSIFIER_TIMEOUT_CEILING]` — out-of-range and malformed values are discarded in favor of the next config source rather than clamped — so the deadline itself cannot be removed; a timed-out batch remains fail-closed (`classifier_unavailable`).
+- **Description**: In Auto approval mode, gated tool calls that deterministic policy cannot clear are reviewed by an LLM authorization classifier. That classifier can be pointed at a separate model (`--auto-classifier-model`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`, `[models].auto_classifier`, or `/auto model`) so reviews are cheaper and faster than the main agent model. Review quality then follows the chosen model: a weaker one is likelier to mis-authorize an action, and likelier to be steered by injected instructions in the untrusted material it reads (tool arguments, paths, prior tool output, remote metadata, and the model-authored `ask_user` question text paired with a same-turn answer). Question text is a distinct case: the `ask_user` receipt attests only that this exact text was displayed to the user and answered, never that its content is true, so a question asserting prior or blanket authorization is untrusted content rather than evidence. `_CLASSIFIER_POLICY` instructs the classifier to read a paired question strictly as a description of a proposed action and target, to disregard directives embedded in it, and to allow an action only where that description matches the action's canonical arguments. Choosing the classifier is a user-level decision, so it is restricted to trusted surfaces: shell exports, the global `~/.deepagents/.env`, `~/.deepagents/config.toml`, the CLI flag, and `/auto model`. A *project* `.env` travels with a cloned repo, so `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL` is listed in `config._PROJECT_DOTENV_DENIED_ENV_KEYS` — the same mitigation TB4 applies to the project-MCP trust vars; without that entry a checked-in `.env` could silently downgrade the review on `dcode` startup. With it, this is a self-inflicted weakening of a control rather than an external attack path. Auto's model-independent guards are unchanged by the setting: deterministic allow (the deterministic deny rules are narrow and do not cover the Deny categories, so an action the classifier affirmatively allows is not re-checked downstream), the consecutive/total denial counters, batch-replay detection, control-state availability, and the human-fallback thresholds. A classifier model that cannot be constructed (bad spec, missing credentials, uninstalled provider package) never falls back to the main model — the first such batch is marked `classifier_unavailable`, so those calls are denied and do not execute, and the failing spec is latched so every subsequent batch escalates straight to human approval until a review succeeds. A transient failure instead escalates once `_CONSECUTIVE_UNAVAILABLE_FALLBACK` consecutive batches have failed, or immediately when Auto's control state cannot be persisted. The review deadline is tunable through a subset of the same trusted surfaces — shell exports, the global `~/.deepagents/.env`, and `[models].auto_classifier_timeout` in `~/.deepagents/config.toml` (there is no CLI flag and no `/auto` subcommand for it) — and `DEEPAGENTS_CODE_AUTO_CLASSIFIER_TIMEOUT` is denied from a project `.env` for the same reason, so a cloned repo cannot stall gated batches or squeeze the budget until reviews time out. `config_manifest.resolve_auto_classifier_timeout` rejects any resolved value outside `[AUTO_CLASSIFIER_TIMEOUT_FLOOR, AUTO_CLASSIFIER_TIMEOUT_CEILING]` — out-of-range and malformed values are discarded in favor of the next config source rather than clamped — so the deadline itself cannot be removed; a timed-out batch remains fail-closed (`classifier_unavailable`).
 - **Preconditions**: (1) Auto approval mode is active (interactive TUI only, and not under a sandbox); (2) a classifier model is configured through one of the trusted surfaces above — the default reuses the main agent model; (3) for the injected-review variant, untrusted content reaches the classifier through DF8/DF9 and the chosen model follows it. The intended control is that the human remains the fallback for anything the classifier does not affirmatively allow.
 
 ---
@@ -452,7 +452,7 @@
 | Input Source          | Data Flows            | Threats       | Validation Points                                                          | Responsibility | Gaps                                                                                         |
 |-----------------------|-----------------------|---------------|----------------------------------------------------------------------------|----------------|----------------------------------------------------------------------------------------------|
 | User direct input     | DF1, DF2              | None (TB1)    | None — prompts accepted verbatim                                           | User           | No content filtering — intentional; HITL gates downstream tool calls                        |
-| LLM output            | DF6, DF7              | T1, T2, T3, T4, T13, T14| HITL gate; shell allow-list; Unicode/URL warnings on tool args; Auto classifier review | Project        | LLM-generated tool args not scanned for injection beyond Unicode/URL; shell allow-list matches only the command's first token, so allow-listed interpreters/wrappers bypass it (T13); Auto classifier review quality follows the user-selected classifier model, and the classifier reads untrusted tool arguments and prior output (T14)   |
+| LLM output            | DF6, DF7              | T1, T2, T3, T4, T13, T14| HITL gate; shell allow-list; Unicode/URL warnings on tool args; Auto classifier review | Project        | LLM-generated tool args not scanned for injection beyond Unicode/URL; shell allow-list matches only the command's first token, so allow-listed interpreters/wrappers bypass it (T13); Auto classifier review quality follows the user-selected classifier model, and the classifier reads untrusted tool arguments, prior output, and model-authored `ask_user` question text (T14)   |
 | Tool/function results | DF9, DF11             | T1            | Unicode warning on URL args; `markdownify` HTML conversion                 | Shared         | Tool *results* pass to context without prompt-injection scan                                 |
 | URL-fetched content   | DF8, DF9              | T1            | `check_url_safety` on URL arg; HTML→markdown conversion                    | Shared         | Markup-embedded instructions survive markdownify; no LLM-layer guardrail                    |
 | Configuration         | DF10, DF12, DF15, DF23| T9, T10, T12, T14  | Dotenv shell-env precedence; TOML schema; MCP schema + allow/deny lists; JSON structure check; `class_path` format check; project-`.env` denylist for the Auto classifier model | User | Project `.env` can set shell startup-hook vars; `class_path` executes module code before type check; MCP env dict unfiltered; Auto classifier strength is a user choice with no floor enforced (T14) |
@@ -521,3 +521,4 @@ Threats that appear valid in isolation but fall outside project responsibility b
 | 2026-07-28 | manual update                      | Extended the out-of-scope hooks row for plugin-contributed hooks: enabled plugins may supply `hooks/hooks.json`, gated by install plus enablement rather than workspace trust, with each handler's environment overlaid only by its own plugin path variables |
 | 2026-08-03 | manual update                      | Added T14 (a weaker Auto classifier model weakens action review) under TB2, covering the selectable classifier (`--auto-classifier-model`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`, `[models].auto_classifier`, `/auto model`), its restriction to trusted config surfaces via `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, and its fail-closed construction behavior (deny, then latch to human approval; never fall back to the main model). Extended the "LLM output" and "Configuration" input-coverage rows with T14 |
 | 2026-08-04 | manual update                      | Extended T14 for the configurable Auto classifier review deadline (`DEEPAGENTS_CODE_AUTO_CLASSIFIER_TIMEOUT`, `[models].auto_classifier_timeout`): bounded by `config_manifest.resolve_auto_classifier_timeout` between a floor and ceiling so the deadline cannot be removed, denied from a project `.env` via `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, and fail-closed on expiry |
+| 2026-08-17 | manual update                      | Extended T14 for `ask_user` question text as a classifier injection source: the receipt attests display and answer, not content, so a question claiming prior or blanket authorization is untrusted content; recorded the `_CLASSIFIER_POLICY` clauses that keep a paired question to an action/target description matched against canonical arguments. Narrowed the T14 "deterministic allow/deny" guard wording, which overstated the deny side: deterministic denies do not cover the Deny categories, and an affirmative classifier allow is not re-checked downstream |

{deepagents_code-0.1.56 → deepagents_code-0.1.57}/deepagents_code/_ask_user_types.py

@@ -11,16 +11,87 @@ side produces it and which reads it.
 
 from __future__ import annotations
 
-from typing import Annotated, Literal, NotRequired
+from typing import Annotated, Literal, NotRequired, assert_never, get_args
 
 from pydantic import Field
 from typing_extensions import TypedDict
 
+QuestionType = Literal["text", "multiple_choice", "multi_select"]
+"""Supported `ask_user` question types."""
+
+QUESTION_TYPES: frozenset[str] = frozenset(get_args(QuestionType))
+"""Runtime membership view of `QuestionType`.
+
+Derived via `get_args` so the membership checks in `ask_user` and `auto_mode`
+cannot drift from the alias when a new question type is added. That drift would
+be silent: an unrecognized type makes `_ask_user_question_count` return `None`,
+which drops the user's answers as same-turn authorization without any error.
+"""
+
+
+def _requires_choices(question_type: QuestionType) -> bool:
+    """Return whether `question_type` needs a non-empty `choices` list.
+
+    Args:
+        question_type: A member of `QuestionType`.
+
+    Returns:
+        True if questions of this type must define `choices`.
+    """
+    if question_type == "text":
+        return False
+    if question_type in {"multiple_choice", "multi_select"}:
+        return True
+    # Exhaustiveness guard: adding a `QuestionType` member without deciding here
+    # whether it needs choices fails type checking rather than silently landing
+    # on the wrong side of `CHOICE_QUESTION_TYPES`.
+    assert_never(question_type)
+
+
+CHOICE_QUESTION_TYPES: frozenset[str] = frozenset(
+    question_type
+    for question_type in get_args(QuestionType)
+    if _requires_choices(question_type)
+)
+"""Question types that require a non-empty `choices` list.
+
+Derived from `_requires_choices` rather than written out, so it cannot omit a
+new choice-based `QuestionType` member. Note that requiring `choices` is not the
+same as being *rendered* as a choice list: the TUI has its own exhaustive
+dispatch in `_QuestionWidget.compose`.
+"""
+
+MULTI_SELECT_ANSWER_SEPARATOR = ", "
+"""Separator joining the selected values of a `multi_select` answer."""
+
+MULTI_SELECT_FORBIDDEN_IN_VALUE = ","
+"""Substring a `multi_select` choice value must not contain.
+
+Deliberately stated outright rather than derived from
+`MULTI_SELECT_ANSWER_SEPARATOR`, so the two can evolve independently: a separator
+of `" and "` would, if the forbidden text were derived from it, reject every value
+containing "and".
+
+This buys *legibility* of the joined answer, not invertibility. Nothing decodes a
+multi-select answer back into its components, and per
+`format_ask_user_transcript` the transcript is not unambiguously decodable
+anyway. If one is ever written, that is the moment to introduce a structured
+answer type instead of leaning on this ban.
+"""
+
 
 class Choice(TypedDict):
-    """A single choice option for a multiple choice question."""
+    """A single choice option for a multiple choice or multi-select question."""
 
-    value: Annotated[str, Field(description="The display label for this choice.")]
+    value: Annotated[
+        str,
+        Field(
+            description=(
+                "The display label for this choice. Also the text returned as "
+                "the answer when this choice is selected."
+            )
+        ),
+    ]
 
 
 class Question(TypedDict):
@@ -29,11 +100,18 @@ class Question(TypedDict):
     question: Annotated[str, Field(description="The question text to display.")]
 
     type: Annotated[
-        Literal["text", "multiple_choice"],
+        QuestionType,
         Field(
             description=(
                 "Question type. 'text' for free-form input, 'multiple_choice' for "
-                "predefined options."
+                "picking exactly one predefined option, 'multi_select' for picking "
+                "one or more predefined options. Both choice types always append an "
+                "'Other' free-form option automatically; multi-select can accept "
+                "multiple custom Other values (filling one reveals another). A "
+                "'multi_select' answer comes back as the selected values "
+                "(including any custom Other text) joined with ', '; if nothing "
+                "is selected on an optional question the answer is an empty "
+                "string."
             )
         ),
     ]
@@ -43,8 +121,12 @@ class Question(TypedDict):
             list[Choice],
             Field(
                 description=(
-                    "Options for multiple_choice questions. An 'Other' free-form "
-                    "option is always appended automatically."
+                    "Options for 'multiple_choice' and 'multi_select' questions. "
+                    "Every choice needs a non-empty 'value'. An 'Other' free-form "
+                    "option is always appended automatically for both types; "
+                    "multi-select may collect multiple custom Other values. "
+                    "'multi_select' values (including custom Other text) must not "
+                    "contain ',' because the answer joins them with ', '."
                 )
             ),
         ]
@@ -53,8 +135,18 @@ class Question(TypedDict):
     required: NotRequired[
         Annotated[
             bool,
+            # `strict=True` so a stringly-typed `"false"` is rejected at the tool
+            # boundary rather than coerced. Without it pydantic accepts the string,
+            # the prompt renders, and then `_ask_user_question_count` — which reads
+            # the *raw* tool args and requires a real bool — returns `None`, which
+            # drops every answer in the call as same-turn authorization with no
+            # error. Strict here keeps the two boundaries agreeing, and makes the
+            # coercion loud instead of silently expensive.
             Field(
-                description="Whether the user must answer. Defaults to true if omitted."
+                description=(
+                    "Whether the user must answer. Defaults to true if omitted."
+                ),
+                strict=True,
             ),
         ]
     ]
@@ -75,6 +167,11 @@ class AskUserRequest(TypedDict):
 
 ASK_USER_AUTHORIZATION_METADATA_KEY = "deepagents_code_ask_user_authorization"
 MAX_ASK_USER_AUTHORIZATION_ANSWER_CHARS = 4000
+# These limits bound the receipt-anchored question/answer evidence copied into
+# Auto's classifier prompt. Questions are model-generated and otherwise have no
+# schema length constraint, so they must not be able to exhaust that context.
+MAX_ASK_USER_AUTHORIZATION_QUESTION_CHARS = 4000
+MAX_ASK_USER_AUTHORIZATION_QUESTION_TOTAL_CHARS = 8000
 
 
 class AskUserAuthorizationReceipt(TypedDict):

{deepagents_code-0.1.56 → deepagents_code-0.1.57}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "fbd5ac3"
+BUILD_COMMIT = "57e15ea"

{deepagents_code-0.1.56 → deepagents_code-0.1.57}/deepagents_code/_dep_floor_check.py

@@ -10,7 +10,7 @@ editable `direct_url.json` record and skip the check entirely, so end
 users pay no startup cost here.
 
 Interactive launches on a terminal stop on a blocking pre-TUI prompt
-(continue / mute / abort); headless launches, subcommands, and interactive
+(refresh / continue / mute / abort); headless launches, subcommands, and interactive
 launches whose stdin is piped get a single stderr warning per launch instead,
 since they have no answerable prompt and must never block. A dismissed
 (muted) mismatch is remembered per checkout as a fingerprint of the offending
@@ -25,7 +25,8 @@ import json
 import logging
 import os
 import shlex
-import subprocess  # noqa: S404  # only `list2cmdline` string quoting, never executed
+import shutil
+import subprocess  # noqa: S404  # fixed-argv environment refresh and Windows quoting
 import sys
 import tempfile
 import threading
@@ -40,6 +41,8 @@ from deepagents_code.config import _is_editable_install
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
+    from rich.console import Console
+
     from deepagents_code.main import _TrustPromptOutcome
 
 logger = logging.getLogger(__name__)
@@ -259,17 +262,177 @@ def _checkout_root() -> Path:
     return Path(__file__).resolve().parent.parent
 
 
+def _is_editable_dist(dist_name: str, path: Path) -> bool:
+    """Check whether an installed distribution is an editable install of `path`.
+
+    Reads the distribution's own PEP 610 `direct_url.json` rather than the
+    directory's existence: most `[tool.uv.sources]` entries back optional
+    extras, so a source directory that merely exists in a full monorepo
+    checkout must not be reinstalled as an editable over an environment that
+    deliberately tracks the released wheel.
+
+    Args:
+        dist_name: Distribution name as passed to `importlib.metadata`.
+        path: The source checkout the `[tool.uv.sources]` entry points at.
+
+    Returns:
+        `True` when the distribution is installed editable with a `file://`
+        URL resolving to `path`; `False` for wheel installs, missing
+        distributions, and unreadable or mismatched metadata.
+    """
+    try:
+        raw = importlib.metadata.distribution(dist_name).read_text("direct_url.json")
+        if not raw:
+            return False
+        data = json.loads(raw)
+    except (
+        importlib.metadata.PackageNotFoundError,
+        json.JSONDecodeError,
+        TypeError,
+    ):
+        return False
+    if not isinstance(data, dict):
+        return False
+    dir_info = data.get("dir_info")
+    if not isinstance(dir_info, dict) or dir_info.get("editable") is not True:
+        return False
+    url = data.get("url", "")
+    if not isinstance(url, str) or not url.startswith("file://"):
+        return False
+    from deepagents_code.extras_info import _file_url_to_path
+
+    recorded = _file_url_to_path(url)
+    # `_file_url_to_path` preserves the `netloc` host, so UNC installs such as
+    # `file://server/share/repo` compare equal to the same UNC checkout here;
+    # parsing only `urlparse(url).path` would drop the server and omit the
+    # editable from the refresh, replacing it with a PyPI wheel.
+    return recorded is not None and recorded.resolve() == path
+
+
+def _workspace_editable_paths() -> list[Path]:
+    """List the workspace sources this environment actually installed editable.
+
+    Reads the checkout's own `[tool.uv.sources]`, then keeps only the entries
+    whose distribution is currently installed as an editable pointing at that
+    same path. Directory existence alone is not enough: partner packages
+    (`langchain-daytona`, `langchain-modal`, ...) are optional extras whose
+    checkouts always exist in a full monorepo clone, and re-passing them as
+    `-e` would replace their released wheels with editables and pull in their
+    transitive dependencies.
+
+    Returns:
+        Absolute paths of `editable = true` path sources whose distribution is
+        installed editable from that path, in `pyproject.toml` declaration
+        order. Empty when the checkout's `pyproject.toml` cannot be read or no
+        source qualifies.
+    """
+    pyproject = _checkout_root() / "pyproject.toml"
+    try:
+        data = tomllib.loads(pyproject.read_text(encoding="utf-8"))
+        sources = data["tool"]["uv"]["sources"]
+    except (OSError, KeyError, TypeError, tomllib.TOMLDecodeError):
+        logger.debug(
+            "Could not read workspace sources from the source checkout",
+            exc_info=True,
+        )
+        return []
+    if not isinstance(sources, dict):
+        return []
+    checkout = _checkout_root()
+    paths: list[Path] = []
+    for dist_name, source in sources.items():
+        if not isinstance(source, dict):
+            continue
+        if source.get("editable") is not True or not isinstance(
+            source.get("path"), str
+        ):
+            continue
+        path = (checkout / source["path"]).resolve()
+        if path.is_dir() and _is_editable_dist(dist_name, path):
+            paths.append(path)
+    return paths
+
+
+def _refresh_args(uv_path: str) -> list[str]:
+    """Build the fixed argv used to refresh this editable environment.
+
+    Args:
+        uv_path: Absolute path to the resolved `uv` binary. Bare names are
+            never used: on Windows `subprocess` searches the current working
+            directory before `%PATH%`, so a planted `uv.exe` at the project
+            root would execute instead of the legitimate binary.
+
+    Returns:
+        Arguments for the user-approved `uv pip install` process.
+    """
+    checkout = _checkout_root()
+    args = [
+        uv_path,
+        "pip",
+        "install",
+        "--python",
+        sys.executable,
+        "-e",
+        str(checkout),
+    ]
+    for path in _workspace_editable_paths():
+        args.extend(["-e", str(path)])
+    args.append("--upgrade")
+    return args
+
+
 def refresh_command() -> str:
     """Return the shell command that refreshes this editable environment.
 
-    Shared by the stderr warning and the interactive prompt so the two
-    channels cannot drift apart.
+    Workspace sibling editables are included explicitly because resolving only
+    `libs/code` would let `--upgrade` replace them with PyPI wheels. The
+    warning and interactive refresh share this argv so they cannot drift.
     """
-    return (
-        "uv pip install --python "
-        f"{_quote_arg(sys.executable)} -e {_quote_arg(str(_checkout_root()))} "
-        "--upgrade"
-    )
+    uv_path = shutil.which("uv")
+    if uv_path is None:
+        return "uv pip install --python <python> -e <checkout> --upgrade"
+    return " ".join(_quote_arg(arg) for arg in _refresh_args(uv_path))
+
+
+def _refresh_environment(console: Console) -> bool:
+    """Refresh the active environment after the user explicitly requests it.
+
+    Args:
+        console: Console used for progress and failure messages.
+
+    Returns:
+        `True` when `uv` exits successfully, otherwise `False`.
+    """
+    uv_path = shutil.which("uv")
+    if uv_path is None:
+        console.print(
+            "[yellow]Environment refresh failed: `uv` not found on PATH.[/yellow]",
+            highlight=False,
+        )
+        return False
+    console.print("[dim]Refreshing environment...[/dim]", highlight=False)
+    try:
+        result = subprocess.run(  # noqa: S603  # fixed uv argv, never a shell command
+            _refresh_args(uv_path),
+            check=False,
+            shell=False,
+        )
+    except OSError as exc:
+        from rich.markup import escape
+
+        console.print(
+            f"[yellow]Environment refresh failed: {escape(str(exc))}[/yellow]",
+            highlight=False,
+        )
+        return False
+    if result.returncode != 0:
+        console.print(
+            "[yellow]Environment refresh failed with exit code "
+            f"{result.returncode}; choose another action or try again.[/yellow]",
+            highlight=False,
+        )
+        return False
+    return True
 
 
 def _collect_violations() -> list[_FloorViolation]:
@@ -516,7 +679,7 @@ def warn_if_editable_deps_stale() -> None:
 
 
 def prompt_if_editable_deps_stale() -> _TrustPromptOutcome | None:
-    """Block on a continue/mute/abort prompt when an interactive launch is stale.
+    """Block on a refresh/continue/mute/abort prompt for a stale interactive launch.
 
     Prompts only when violations exist and the exact mismatch was not muted
     for this checkout. The prompt itself is implemented in `main` next to the
@@ -544,6 +707,7 @@ def _prompt_if_editable_deps_stale() -> _TrustPromptOutcome | None:
     from rich.console import Console
 
     from deepagents_code.main import (
+        _restart_current_process,
         _TrustAction,
         _TrustPromptOutcome,
         prompt_for_dep_floor_mismatch,
@@ -552,36 +716,65 @@ def _prompt_if_editable_deps_stale() -> _TrustPromptOutcome | None:
     violations = _collect_violations()
     if not violations:
         return None
-    fingerprint = _mismatch_fingerprint(violations)
-    if is_dep_floor_mismatch_muted(fingerprint):
+    if is_dep_floor_mismatch_muted(_mismatch_fingerprint(violations)):
         return None
 
     console = Console(stderr=True)
-    action = prompt_for_dep_floor_mismatch(console, violations)
-    if action in {_TrustPromptOutcome.INTERRUPTED, _TrustPromptOutcome.CANCELLED}:
-        return action
-    if action is _TrustAction.REMEMBER:
-        if mute_dep_floor_mismatch(fingerprint):
+    while True:
+        fingerprint = _mismatch_fingerprint(violations)
+        action = prompt_for_dep_floor_mismatch(console, violations)
+        if action in {
+            _TrustPromptOutcome.INTERRUPTED,
+            _TrustPromptOutcome.CANCELLED,
+        }:
+            return action
+        if action is _TrustAction.REFRESH:
+            if not _refresh_environment(console):
+                continue
+            violations = _collect_violations()
+            if violations:
+                continue
             console.print(
-                "[dim]Muted until the dependency mismatch changes.[/dim]",
+                "[dim]Environment refreshed; relaunching.[/dim]",
                 highlight=False,
             )
-        else:
+            # Re-exec rather than continuing in-process: dependencies imported
+            # before this prompt (`rich`, `python-dotenv`, ...) keep their
+            # stale module objects in memory even after `uv` swaps the dists
+            # on disk, so only a fresh interpreter runs the refreshed code.
+            # The relaunched process re-runs this check, finds no violations
+            # (the precondition for reaching here), and never re-prompts — a
+            # refresh that silently no-ops fails the re-check above instead,
+            # so this cannot loop. `OSError` from a failed exec propagates to
+            # the best-effort boundary in `prompt_if_editable_deps_stale`,
+            # which continues this (stale but user-approved) launch.
+            _restart_current_process()
+            return None  # unreachable; exec failure raises, per its contract
+        if action is _TrustAction.REMEMBER:
+            if mute_dep_floor_mismatch(fingerprint):
+                console.print(
+                    "[dim]Muted until the dependency mismatch changes.[/dim]",
+                    highlight=False,
+                )
+            else:
+                console.print(
+                    "[yellow]The dismissal could not be saved; you will be asked "
+                    "again next launch.[/yellow]",
+                    highlight=False,
+                )
+        elif action is _TrustAction.ALLOW_ONCE:
             console.print(
-                "[yellow]The dismissal could not be saved; you will be asked "
-                "again next launch.[/yellow]",
+                "[dim]Continuing this session; you will be asked again next "
+                "launch.[/dim]",
                 highlight=False,
             )
-    elif action is _TrustAction.ALLOW_ONCE:
-        console.print(
-            "[dim]Continuing this session; you will be asked again next launch.[/dim]",
-            highlight=False,
-        )
-    else:
-        # `abort_on_deny` should have collapsed a refusal into `CANCELLED`
-        # already, so `DENY` (or any future outcome) only lands here if that
-        # mapping regresses. Refuse rather than continuing: matching "continue"
-        # by default is what previously turned "Abort launch" into a launch.
-        logger.debug("Unexpected dependency floor prompt outcome %r; aborting", action)
-        return _TrustPromptOutcome.CANCELLED
-    return None
+        else:
+            # `abort_on_deny` should have collapsed a refusal into `CANCELLED`
+            # already, so `DENY` (or any future outcome) only lands here if that
+            # mapping regresses. Refuse rather than continuing: matching "continue"
+            # by default is what previously turned "Abort launch" into a launch.
+            logger.debug(
+                "Unexpected dependency floor prompt outcome %r; aborting", action
+            )
+            return _TrustPromptOutcome.CANCELLED
+        return None

{deepagents_code-0.1.56 → deepagents_code-0.1.57}/deepagents_code/_env_vars.py

@@ -117,6 +117,27 @@ Parsed by `is_env_truthy`: accepts `1`, `true`, `yes`, `on` (case-insensitive)
 as enabled, and `0`, `false`, `no`, `off`, empty string, or unset as disabled.
 """
 
+DEBUG_COLD_CACHE = "DEEPAGENTS_CODE_DEBUG_COLD_CACHE"
+"""Force the cold prompt-cache warning modal on every interactive send.
+
+Set to a truthy value when launching the interactive TUI to make
+`_cold_cache_warning_for` synthesize a warning from the current model and
+context, bypassing the provider-policy, token-floor, cache-window, and
+cost-threshold gates as well as both session and persisted suppression. Lets
+the modal be exercised without waiting out a provider cache window.
+
+The flag is re-read on every send and nothing clears it, so the modal fires
+for the life of the process, not just once.
+
+When the active model has no documented cache policy, `debug_stand_in_policy`
+supplies an Anthropic-shaped placeholder. On a non-Anthropic model the modal
+will therefore cite Anthropic's retention window, and the dollar figures are
+illustrative rather than real estimates.
+
+Parsed by `is_env_truthy`: accepts `1`, `true`, `yes`, `on` (case-insensitive)
+as enabled, and `0`, `false`, `no`, `off`, empty string, or unset as disabled.
+"""
+
 DEBUG_CONSOLE_CLICK_TO_COPY = "DEEPAGENTS_CODE_DEBUG_CONSOLE_CLICK_TO_COPY"
 r"""Enable click-to-copy in the `Ctrl+\` Debug Console when enabled.
 
@@ -284,6 +305,18 @@ The value is comma-separated for forward-compatibility, not because multiple
 destinations are written today.
 """
 
+LAUNCH_TERM_PROGRAM = "DEEPAGENTS_CODE_LAUNCH_TERM_PROGRAM"
+"""Internal sentinel recording the `TERM_PROGRAM` present when `dcode` started.
+
+Not user-facing. The resume hint echoes `TERM_PROGRAM` only when the launch
+environment supplied it (an inline `TERM_PROGRAM=x dcode`, a terminal's own
+export, or a shell alias), so the value set by a project or global `.env` file
+*after* launch must not leak in. The app itself never sets `TERM_PROGRAM`, so
+`cli_main` snapshotting the variable here at entry means a set sentinel always
+marks an explicit launch value; the update re-exec inherits it unchanged,
+which is correct because the relaunch runs the command the user typed.
+"""
+
 LEGACY_ENABLED_PROJECT_MCP_SERVERS = "DEEPAGENTS_CODE_ENABLED_PROJECT_MCP_SERVERS"
 """Removed project MCP allowlist env var retained for migration detection only.