deepagents-code 0.1.57__tar.gz → 0.1.59__tar.gz

{deepagents_code-0.1.57 → deepagents_code-0.1.59}/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.59](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.58...deepagents-code==0.1.59) (2026-08-20)
+
+### Features
+
+- Added support for `managed_config.toml` configuration ([#5604](https://github.com/langchain-ai/deepagents/issues/5604))
+- Multi-select `ask_user` answers are now encoded as JSON arrays ([#5660](https://github.com/langchain-ai/deepagents/issues/5660))
+- Made teardown usage stats configurable ([#5696](https://github.com/langchain-ai/deepagents/issues/5696))
+- Footer pickers now open on click ([#5674](https://github.com/langchain-ai/deepagents/issues/5674))
+- Replaced Gemini 3.6 Flash with Gemini 3.7 Flash ([#5681](https://github.com/langchain-ai/deepagents/issues/5681))
+
+### Bug fixes
+
+- Made tool argument validation errors recoverable ([#5659](https://github.com/langchain-ai/deepagents/issues/5659))
+- Improved streaming performance for tool-call arguments to run in linear time ([#5712](https://github.com/langchain-ai/deepagents/issues/5712))
+- Fixed durable-mask config resolution with ranked resolver behavior ([#5672](https://github.com/langchain-ai/deepagents/issues/5672))
+- Skipped background sync in Apple Terminal ([#5666](https://github.com/langchain-ai/deepagents/issues/5666))
+- Hid thread IDs when tracing is disabled ([#5692](https://github.com/langchain-ai/deepagents/issues/5692))
+- Kept installed providers visible in `/auth` ([#5689](https://github.com/langchain-ai/deepagents/issues/5689))
+- Preloaded the auth UI before notification handoff ([#5697](https://github.com/langchain-ai/deepagents/issues/5697))
+- Updated and clarified UI copy across Auto mode, YOLO hints, classifier notices, `/tokens`, line-number toggles, review failures, onboarding Tavily cancellation, and OpenAI subscription login labels ([#5685](https://github.com/langchain-ai/deepagents/issues/5685), [#5694](https://github.com/langchain-ai/deepagents/issues/5694), [#5684](https://github.com/langchain-ai/deepagents/issues/5684), [#5687](https://github.com/langchain-ai/deepagents/issues/5687), [#5680](https://github.com/langchain-ai/deepagents/issues/5680), [#5688](https://github.com/langchain-ai/deepagents/issues/5688), [#5686](https://github.com/langchain-ai/deepagents/issues/5686), [#5691](https://github.com/langchain-ai/deepagents/issues/5691), [#5693](https://github.com/langchain-ai/deepagents/issues/5693))
+- Removed the `Muse Spark 1.1` recommendation ([#5683](https://github.com/langchain-ai/deepagents/issues/5683))
+
+## [0.1.58](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.57...deepagents-code==0.1.58) (2026-08-19)
+
+### Breaking Changes
+
+- `deepagents-code` now requires Python 3.12 or newer. ([#5603](https://github.com/langchain-ai/deepagents/issues/5603))
+
+### Features
+
+- Added OpenRouter `z-ai/glm-5.3` to the model switcher. ([#5641](https://github.com/langchain-ai/deepagents/issues/5641))
+- Added support for re-authenticating MCP servers from the viewer. ([#5637](https://github.com/langchain-ai/deepagents/issues/5637))
+- Footer pickers can now be opened with `ctrl+click`. ([#5611](https://github.com/langchain-ai/deepagents/issues/5611))
+- Resume hints now account for `TERM_PROGRAM` support before showing terminal-specific guidance. ([#5580](https://github.com/langchain-ai/deepagents/issues/5580))
+
+### Fixes
+
+- Completed the `dcode config` command surface. ([#5581](https://github.com/langchain-ai/deepagents/issues/5581))
+- Made `/offload` interruptible. ([#5590](https://github.com/langchain-ai/deepagents/issues/5590))
+- Improved chat and footer UI behavior: rapid typing stays visible, double-click collapses a resized chat input, and the MCP footer wraps on narrow windows. ([#5424](https://github.com/langchain-ai/deepagents/issues/5424), [#5578](https://github.com/langchain-ai/deepagents/issues/5578), [#5651](https://github.com/langchain-ai/deepagents/issues/5651))
+- Captured stdio MCP server stderr in the logger. ([#5610](https://github.com/langchain-ai/deepagents/issues/5610))
+- Drained hook pipes after timeout. ([#5606](https://github.com/langchain-ai/deepagents/issues/5606))
+- Grouped resume trace rounds. ([#5593](https://github.com/langchain-ai/deepagents/issues/5593))
+- Omitted web-search prompt guidance when web search is unavailable. ([#5602](https://github.com/langchain-ai/deepagents/issues/5602))
+- Resolved message pointer shapes per cell. ([#5592](https://github.com/langchain-ai/deepagents/issues/5592))
+
 ## [0.1.57](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.56...deepagents-code==0.1.57) (2026-08-18)
 
 ### Features

{deepagents_code-0.1.57 → deepagents_code-0.1.59}/DEVELOPMENT.md

@@ -138,6 +138,10 @@ tail -f /tmp/deepagents_debug.log
 
 To send it elsewhere, also `export DEEPAGENTS_CODE_DEBUG_FILE=<path>`. The handler appends across runs, so a single file accumulates every session.
 
+The file is created or tightened to user-only access. A symlink at the path is refused. If the file cannot be secured, no file handler is attached and a warning goes to stderr. Use the in-app Debug Console in that case.
+
+Stdio MCP server stderr is captured here at `DEBUG`. This keeps server-side failures visible when the TUI cannot show process stderr. Each record is one line, capped at 4096 characters. Characters in the Unicode `C` categories are removed, which includes control and format characters. The ESC byte of an ANSI sequence is removed but the rest stays as literal text, so the log is not free of escape-sequence residue. The text comes from the server. It can contain credentials or other sensitive values. Enable `DEBUG` logging only if you accept that risk, and do not share the log file.
+
 ### In-app Debug Console (`Ctrl+\`)
 
 Press `Ctrl+\` (or run the hidden `/debug` command) inside a session to toggle a read-only Debug Console overlay. It shows a point-in-time session/runtime snapshot (version, model, thread, cwd, auto-approve, sandbox, MCP servers, token usage, debug-log path) plus a live tail of recent `deepagents_code.*` log records.
@@ -168,7 +172,7 @@ uv pip install --python ~/.local/share/dcode-dev/bin/python -e <repo>/libs/code
 ln -sf ~/.local/share/dcode-dev/bin/dcode ~/.local/bin/dcode-dev
 ```
 
-The `--python 3.13` is illustrative — any interpreter satisfying the package's `requires-python` (currently `>=3.11`) works; omit the flag to let `uv` pick.
+The `--python 3.13` is illustrative — any interpreter satisfying the package's `requires-python` (currently `>=3.12`) works; omit the flag to let `uv` pick.
 
 > **Why `uv venv` + `uv pip install -e` rather than `uv sync` or `uv tool install --editable`?** This builds an isolated venv *outside* the workspace's locked environment, so the dev binary can be re-resolved on demand without disturbing the released tool or the repo's `uv.lock`. (`uv pip` and `uv venv` are first-class `uv` subcommands here, not bare `pip`.)
 

{deepagents_code-0.1.57 → deepagents_code-0.1.59}/PKG-INFO

@@ -1,15 +1,17 @@
 Metadata-Version: 2.5
 Name: deepagents-code
-Version: 0.1.57
+Version: 0.1.59
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
-Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
-Project-URL: Documentation, https://reference.langchain.com/python/deepagents/
+Project-URL: Homepage, https://www.langchain.com/dcode
+Project-URL: Documentation, https://docs.langchain.com/oss/deepagents/code/overview
 Project-URL: Repository, https://github.com/langchain-ai/deepagents
 Project-URL: Issues, https://github.com/langchain-ai/deepagents/issues
 Project-URL: Changelog, https://github.com/langchain-ai/deepagents/blob/main/libs/code/CHANGELOG.md
 Project-URL: Twitter, https://x.com/langchain_oss
 Project-URL: Slack, https://www.langchain.com/join-community
 Project-URL: Reddit, https://www.reddit.com/r/LangChain/
+Author: LangChain
+Maintainer: LangChain
 License: MIT
 License-File: LICENSE
 Keywords: agents,ai,cli,deep-agent,langchain,langgraph,llm,terminal
@@ -18,32 +20,31 @@ Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Terminals
-Requires-Python: <4.0,>=3.11
+Requires-Python: <4.0,>=3.12
 Requires-Dist: aiosqlite<1.0.0,>=0.22.1
 Requires-Dist: anyio<5.0.0,>=4.14.2
 Requires-Dist: deepagents-acp<1.0.0,>=0.0.10
-Requires-Dist: deepagents==0.7.6
+Requires-Dist: deepagents==0.7.8
 Requires-Dist: filelock<3.30,>=3.29.7
-Requires-Dist: genai-prices<0.2.0,>=0.1.3
+Requires-Dist: genai-prices<0.2.0,>=0.1.4
 Requires-Dist: httpx<1.0.0,>=0.28.1
-Requires-Dist: langchain-anthropic<2.0.0,>=1.5.6
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.3
+Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.4
 Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.2
-Requires-Dist: langchain-openai<2.0.0,>=1.5.0
+Requires-Dist: langchain-openai<2.0.0,>=1.6.0
 Requires-Dist: langchain-quickjs<0.4.0,>=0.3.4
-Requires-Dist: langchain<2.0.0,>=1.3.15
+Requires-Dist: langchain<2.0.0,>=1.3.16
 Requires-Dist: langgraph-checkpoint-sqlite<4.0.0,>=3.1.1
 Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.31
-Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.32.4
-Requires-Dist: langgraph-sdk<1.0.0,>=0.4.2
-Requires-Dist: langsmith[sandbox]>=0.10.18
+Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.32.6
+Requires-Dist: langgraph-sdk<1.0.0,>=0.4.3
+Requires-Dist: langsmith[sandbox]>=0.11.1
 Requires-Dist: markdownify<2.0.0,>=1.2.3
 Requires-Dist: mcp<2.0.0,>=1.28.1
 Requires-Dist: packaging>=26.2
@@ -65,13 +66,13 @@ Provides-Extra: agentcore
 Requires-Dist: langchain-agentcore-codeinterpreter<1.0.0,>=0.0.5; extra == 'agentcore'
 Provides-Extra: all-providers
 Requires-Dist: aiohttp<3.15.0,>=3.14.3; extra == 'all-providers'
-Requires-Dist: langchain-anthropic<2.0.0,>=1.5.6; extra == 'all-providers'
-Requires-Dist: langchain-aws<2.0.0,>=1.7.0; extra == 'all-providers'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1; extra == 'all-providers'
+Requires-Dist: langchain-aws<2.0.0,>=1.7.2; extra == 'all-providers'
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.3; extra == 'all-providers'
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'all-providers'
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'all-providers'
 Requires-Dist: langchain-fireworks<2.0.0,>=1.5.2; extra == 'all-providers'
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.3; extra == 'all-providers'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.4; extra == 'all-providers'
 Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.4; extra == 'all-providers'
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'all-providers'
 Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'all-providers'
@@ -81,8 +82,8 @@ Requires-Dist: langchain-meta<2.0.0,>=0.5.0; extra == 'all-providers'
 Requires-Dist: langchain-mistralai<2.0.0,>=1.1.6; extra == 'all-providers'
 Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.4.3; extra == 'all-providers'
 Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'all-providers'
-Requires-Dist: langchain-openai<2.0.0,>=1.5.0; extra == 'all-providers'
-Requires-Dist: langchain-openrouter<2.0.0,>=0.2.7; extra == 'all-providers'
+Requires-Dist: langchain-openai<2.0.0,>=1.6.0; extra == 'all-providers'
+Requires-Dist: langchain-openrouter<2.0.0,>=0.2.8; extra == 'all-providers'
 Requires-Dist: langchain-perplexity<2.0.0,>=1.4.0; extra == 'all-providers'
 Requires-Dist: langchain-together<2.0.0,>=0.4.0; extra == 'all-providers'
 Requires-Dist: langchain-xai<2.0.0,>=1.3.0; extra == 'all-providers'
@@ -93,11 +94,11 @@ Requires-Dist: langchain-modal>=0.0.5; extra == 'all-sandboxes'
 Requires-Dist: langchain-runloop>=0.0.6; extra == 'all-sandboxes'
 Requires-Dist: langchain-vercel-sandbox>=0.0.1; extra == 'all-sandboxes'
 Provides-Extra: anthropic
-Requires-Dist: langchain-anthropic<2.0.0,>=1.5.6; extra == 'anthropic'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1; extra == 'anthropic'
 Provides-Extra: baseten
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.3; extra == 'baseten'
 Provides-Extra: bedrock
-Requires-Dist: langchain-aws<2.0.0,>=1.7.0; extra == 'bedrock'
+Requires-Dist: langchain-aws<2.0.0,>=1.7.2; extra == 'bedrock'
 Provides-Extra: cohere
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'cohere'
 Provides-Extra: daytona
@@ -107,7 +108,7 @@ Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'deepseek'
 Provides-Extra: fireworks
 Requires-Dist: langchain-fireworks<2.0.0,>=1.5.2; extra == 'fireworks'
 Provides-Extra: google-genai
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.3; extra == 'google-genai'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.4; extra == 'google-genai'
 Provides-Extra: groq
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'groq'
 Provides-Extra: huggingface
@@ -131,9 +132,9 @@ Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.4.3; extra == 'nvidia'
 Provides-Extra: ollama
 Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'ollama'
 Provides-Extra: openai
-Requires-Dist: langchain-openai<2.0.0,>=1.5.0; extra == 'openai'
+Requires-Dist: langchain-openai<2.0.0,>=1.6.0; extra == 'openai'
 Provides-Extra: openrouter
-Requires-Dist: langchain-openrouter<2.0.0,>=0.2.7; extra == 'openrouter'
+Requires-Dist: langchain-openrouter<2.0.0,>=0.2.8; extra == 'openrouter'
 Provides-Extra: perplexity
 Requires-Dist: langchain-perplexity<2.0.0,>=1.4.0; extra == 'perplexity'
 Provides-Extra: quickjs

{deepagents_code-0.1.57 → deepagents_code-0.1.59}/THREAT_MODEL.md

@@ -50,6 +50,7 @@
 6. The LangGraph dev server subprocess binds to `127.0.0.1` by default (`client/launch/server.py:_DEFAULT_HOST`) and is ephemeral — started and stopped per CLI session.
 7. `DA_SERVER_*` environment variables are readable only by the CLI process and its child server subprocess (OS process isolation assumption).
 8. Users who set `class_path` in `config.toml` accept the same trust model as `pyproject.toml` build scripts — they control their own machine.
+9. Administrators deploy and protect the fixed `managed_config.toml` path with operating-system controls; the CLI does not validate its owner or mode and never writes it.
 
 ---
 
@@ -129,7 +130,7 @@
 | C6  | Hook Runtime                | Fires subprocess commands on agent lifecycle events                                                                 | framework-controlled | No³      | `hooks.runtime.HooksRuntime`, `hooks.runner.run_command_handler`                                  |
 | C7  | Sandbox Integration         | Creates/destroys remote sandboxes (Daytona, LangSmith, Modal, Runloop, AgentCore)                                  | framework-controlled | No⁴      | `integrations.sandbox_factory.create_sandbox`                                                     |
 | C8  | Session Persistence         | SQLite checkpoint store for LangGraph thread state                                                                  | framework-controlled | Yes      | `sessions.get_db_path`, `sessions.generate_thread_id`                                             |
-| C9  | Configuration System        | TOML config, env vars, `AGENTS.md` system prompts, model config                                                    | user-controlled      | N/A      | `config.settings`, `model_config.ModelConfig`, `~/.deepagents/config.toml`                        |
+| C9  | Configuration System        | Managed/user TOML, env vars, `AGENTS.md` system prompts, model config                                               | administrator/user-controlled | N/A | `configuration`, `config.settings`, `model_config.ModelConfig`, fixed managed path, `~/.deepagents/config.toml` |
 | C10 | Unicode/URL Safety          | Detects hidden Unicode, checks URL domain spoofing for approval UI warnings                                         | framework-controlled | Yes      | `unicode_security.detect_dangerous_unicode`, `unicode_security.check_url_safety`                  |
 | C11 | LangGraph Dev Server        | Subprocess running `langgraph dev` with `LANGGRAPH_AUTH_TYPE=noop`; managed by `ServerProcess`                      | framework-controlled | Yes⁵     | `client.launch.server.ServerProcess.start`, `client.launch.server.generate_langgraph_json`, `client.launch.server_manager.start_server_and_get_agent` |
 | C12 | Remote Agent Client         | HTTP+SSE client wrapping `RemoteGraph`; connects to C11 on localhost                                                | framework-controlled | Yes⁵     | `client.remote_client.RemoteAgent.astream`, `client.remote_client.RemoteAgent.aget_state`         |
@@ -207,6 +208,7 @@
 | TB9  | LocalContextMiddleware → Host Env     | Bash detect script output (git info, project files, Makefile) injected into system prompt | Script is framework-generated static code; 30s timeout; exit-code check | Content of Makefile, pyproject.toml, git branch names, directory listing |
 | TB10 | RemoteAgent → LangGraph Dev Server    | CLI communicates with agent via HTTP+SSE on localhost                       | Server bound to `127.0.0.1` (`client/launch/server.py:_DEFAULT_HOST`); ephemeral per session | No authentication (`LANGGRAPH_AUTH_TYPE=noop`); any localhost process can reach the API |
 | TB11 | Config File → Code Execution          | `class_path` in `config.toml` triggers `importlib.import_module()`; project/global `.env` values are loaded into the process environment and can reach Bash startup hooks | Format validation (`module:ClassName`); `issubclass(BaseChatModel)` check; dotenv loading denies shell startup / environment-hijack keys (`BASH_ENV`, `ENV`) | Module-level side effects execute during import; user controls config file; project files in the working directory influence execution |
+| TB12 | Managed Config → Runtime              | A fixed administrator-deployed TOML file overrides CLI, environment, and user preferences | Fixed non-redirectable path; the CLI never writes the file; fail-closed startup for every command except diagnostics; typed resolution; diagnostics remain available | Filesystem ownership/mode and privileged deployment are outside the CLI; a host administrator can weaken or strengthen policy |
 
 ### Boundary Details
 
@@ -261,6 +263,26 @@
 - **Inside (dotenv)**: `config._load_dotenv` loads project and global `.env` values with `override=False` and drops shell startup / environment-hijack keys (`BASH_ENV`, `ENV`, and related) so a project `.env` cannot register a script that Bash would source at startup. The preview path (`_preview_dotenv_environ`) applies the same denylist so a dry-run config change cannot report a value a real reload would reject.
 - **Outside (dotenv)**: All other `.env` keys are applied to the process environment, and any project file in the working directory (`.env`, `Makefile`, build scripts) can still influence execution. See T12.
 
+#### TB12: Managed Config → Runtime
+
+- **Inside**: The resolver reads one fixed OS path. The writer rejects that path, so the managed source is read-only by guard and not only by convention. Valid managed values take the highest precedence. The rules are:
+  - Tables deep-merge. Deny lists union. An explicit managed allow or trust list replaces lower-precedence grants.
+  - A managed scalar replaces a colliding user table at any depth, so a user cannot defeat policy by changing the shape of a key. This holds on the top-level merge and inside a structured table: both apply the manifest validator, so the effective value and the audited provenance agree.
+  - A wrong-typed managed scalar is skipped, and the lower-precedence value stays in effect.
+  - Inside a structured table (`[models.providers]`, `[themes]`, `[async_subagents]`, `[sandboxes.providers]`, `[ui.terminal_themes]`, `[threads.columns]`) the dedicated typed reader validates instead. A wrong-typed managed leaf there can displace a valid user leaf, after which the reader falls back to the built-in default.
+  - An enforced key whose managed value cannot be applied stops every command except the diagnostics listed below. It also blocks `/reload`. Skipping it would leave the user's CLI flag or environment variable in force. The enforced keys are `startup.mode`, `startup.yolo_switcher`, `shell.allow_list`, `skills.extra_allowed_dirs`, `interpreter.enable_interpreter`, `interpreter.ptc`, `interpreter.ptc_acknowledge_unsafe`, `models.auto_classifier`, `runtime.recursion_limit`, `sandboxes.default`, and `tracing.langsmith_redact`.
+  - Three conditions make an enforced key unapplicable: a wrong-typed value, a `runtime.recursion_limit` outside its bounds, and a key made unreachable by a scalar ancestor (`startup = "manual"` in place of `[startup]` and `mode`). A managed `[sandboxes].default` that names an unavailable backend stops a sandboxed launch.
+  - A scalar at a known section is rejected for the same reason, so it cannot replace the user's whole section. `[effort]` is included, although it has no manifest option.
+  - Any other rejected managed value is ignored, and `dcode doctor` and `dcode config` name it. An ignored key is never silent.
+  - A missing file is accepted and applies no policy.
+  - A present unreadable, undecodable, or syntactically corrupt file blocks every command except `--help`, `--version`, `help`, `config`, `doctor`, and `auth path`. It also blocks `/reload`.
+  - On Windows, a ProgramData directory that cannot be read from the registry blocks the same commands. The path would be a guess, and an empty read at a guessed path does not prove that no policy is deployed. Reporting it as a missing file made every managed setting silently inert on a host whose ProgramData is relocated.
+  - A failed `/reload` keeps the last snapshot that parsed cleanly, so policy is never dropped mid-session.
+  - An unusable user `config.toml` drops only the user layer, so managed policy still applies.
+  - A deny list that cannot be read is treated as denying everything, never as empty. This covers a managed `[mcp].disabled_servers` that is neither an array of names nor a comma-separated string, and a `[mcp]` section that is not a table. A managed `[mcp].enabled_project_server_approvals` that is not an array is treated the same way: the key is present, so policy means to narrow access, and reading its presence as absence would keep both the user's approvals and the `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` bypass in force.
+- **Outside**: Ownership, permission-mode validation, privileged installation, and `sudo` policy are deployment responsibilities. Anyone who can replace the administrator-managed file can control model, sandbox, interpreter, MCP trust, and other supported runtime settings. On macOS, note that stock `/Library/Application Support` is group-writable by `admin`, so any admin-group member can create the file and grant themselves policy. Deployments that rely on this boundary must tighten ownership and mode on the `dcode` directory.
+- **Crossing mechanism**: Synchronous local file read through `configuration.TomlFileProvider`, followed by typed resolution and CLI/server startup gates.
+
 ---
 
 ## Data Flows
@@ -292,6 +314,7 @@
 | DF23 | C9 Config    | C17 Model Config | `class_path` string from `config.toml` | —              | TB11             | TOML parse → importlib |
 | DF24 | C5 MCP Config | MCP Subprocess | `env` dict from `.mcp.json` forwarded to stdio subprocess | DC1 | TB4 | subprocess environment |
 | DF25 | C3 Agent     | C7 Sandbox   | Conversation messages for offload             | DC5            | TB6              | `backend.awrite()`     |
+| DF26 | Administrator | C9 Config   | Managed TOML policy                            | DC1            | TB12             | Fixed local file read |
 
 ### Flow Details
 

{deepagents_code-0.1.57 → deepagents_code-0.1.59}/deepagents_code/_ask_user_types.py

@@ -11,6 +11,7 @@ side produces it and which reads it.
 
 from __future__ import annotations
 
+import json
 from typing import Annotated, Literal, NotRequired, assert_never, get_args
 
 from pydantic import Field
@@ -61,23 +62,97 @@ same as being *rendered* as a choice list: the TUI has its own exhaustive
 dispatch in `_QuestionWidget.compose`.
 """
 
-MULTI_SELECT_ANSWER_SEPARATOR = ", "
-"""Separator joining the selected values of a `multi_select` answer."""
 
-MULTI_SELECT_FORBIDDEN_IN_VALUE = ","
-"""Substring a `multi_select` choice value must not contain.
+def encode_multi_select_answer(values: list[str]) -> str:
+    """Encode the selected values of a `multi_select` answer for the wire.
 
-Deliberately stated outright rather than derived from
-`MULTI_SELECT_ANSWER_SEPARATOR`, so the two can evolve independently: a separator
-of `" and "` would, if the forbidden text were derived from it, reject every value
-containing "and".
+    The answer stays one string so `answers: list[str]` keeps one slot per
+    question, positionally matched. JSON is self-delimiting, so values carrying
+    commas, quotes, or newlines round-trip exactly.
+
+    The encoding is opaque to a consumer that only moves the answer around. A
+    consumer that tests whether the user answered at all must go through
+    `ask_user_answer_is_empty`: an unselected `multi_select` encodes as the
+    *truthy* string `[]`, so a bare `.strip()` reads it as answered.
+
+    Args:
+        values: Selected values — toggled predefined choices in choice-list
+            order, then custom Other values in slot order.
+
+    Returns:
+        The values as a JSON array, e.g. `["a", "b"]`. An empty selection
+        encodes as `[]`. The result never contains a line feed or carriage
+        return, so it cannot split a blank-line-separated transcript block.
+        `ensure_ascii=False` does pass U+2028 and U+2029 through literally, so
+        do not read this as "the result is a single line to every consumer" —
+        the guarantee is about the block separator only.
+    """
+    return json.dumps(values, ensure_ascii=False)
+
+
+def decode_multi_select_answer(raw: str) -> list[str] | None:
+    """Decode a `multi_select` answer produced by `encode_multi_select_answer`.
+
+    Args:
+        raw: The raw answer string for a `multi_select` question. Must already
+            be a `str`: a non-string raises `TypeError` out of `json.loads`
+            rather than returning `None`. Every call site establishes that
+            first — `_parse_answers` coerces non-string answers,
+            `_validated_ask_user_answers` checks `isinstance(answer, str)`, and
+            the display path passes a slice of the transcript.
+
+    Returns:
+        The selected values, or `None` when `raw` is not a JSON array of
+            strings. Callers choose the policy for `None`; the one thing none of
+            them may do is fall back to splitting on `", "`, which mis-splits a
+            value that contains a comma.
+    """
+    try:
+        decoded = json.loads(raw)
+    except (json.JSONDecodeError, RecursionError):
+        return None
+    if not isinstance(decoded, list) or not all(
+        isinstance(value, str) for value in decoded
+    ):
+        return None
+    return decoded
 
-This buys *legibility* of the joined answer, not invertibility. Nothing decodes a
-multi-select answer back into its components, and per
-`format_ask_user_transcript` the transcript is not unambiguously decodable
-anyway. If one is ever written, that is the moment to introduce a structured
-answer type instead of leaning on this ban.
-"""
+
+def ask_user_answer_is_empty(answer: str, question_type: object) -> bool:
+    """Return whether an `ask_user` answer counts as "no answer".
+
+    The single definition of emptiness for an answer, shared by the TUI (which
+    blocks submitting a required question) and by the Auto authorization path
+    (which keeps unanswered questions out of the consent evidence). Both sides
+    must agree: an answer the TUI accepts as empty must not read as consent
+    evidence downstream.
+
+    A bare `.strip()` is wrong for `multi_select`, whose empty encoding is the
+    truthy string `[]`. Every other type is empty when it is blank.
+
+    Args:
+        answer: The raw answer string for the question.
+        question_type: The paired question's `type`. Anything other than
+            `'multi_select'` — including a malformed or missing type — takes the
+            blank test.
+
+    Returns:
+        `True` when the question has no substantive answer.
+    """
+    if question_type == "multi_select":
+        # A malformed encoding counts as empty, which is the fail-closed side of
+        # both call sites: the TUI re-prompts a *required* question (an optional
+        # one submits unchanged), and Auto withholds the answer from the consent
+        # evidence rather than passing an undecodable string to the classifier.
+        #
+        # This makes emptiness asymmetric across types for the `(cancelled)` and
+        # `(error: ...)` placeholders, which are not JSON: on a `multi_select`
+        # they read as empty and are withheld from the evidence, while the same
+        # placeholder on a `text` question becomes a row. Withholding is the
+        # safe direction, so the asymmetry is acceptable — but it is real, and a
+        # future caller counting answered questions across types will see it.
+        return not decode_multi_select_answer(answer)
+    return not answer.strip()
 
 
 class Choice(TypedDict):
@@ -88,7 +163,11 @@ class Choice(TypedDict):
         Field(
             description=(
                 "The display label for this choice. Also the text returned as "
-                "the answer when this choice is selected."
+                "the answer when this choice is selected. A 'multi_select' answer "
+                "is a JSON array, so a value may contain commas, quotes, and "
+                "newlines; JSON escaping keeps it exact. A 'multiple_choice' "
+                "value is returned on its own with no escaping, so keep that "
+                "one to a single line."
             )
         ),
     ]
@@ -108,10 +187,9 @@ class Question(TypedDict):
                 "one or more predefined options. Both choice types always append an "
                 "'Other' free-form option automatically; multi-select can accept "
                 "multiple custom Other values (filling one reveals another). A "
-                "'multi_select' answer comes back as the selected values "
-                "(including any custom Other text) joined with ', '; if nothing "
-                "is selected on an optional question the answer is an empty "
-                "string."
+                "'multi_select' answer comes back as a JSON array of the selected "
+                'values (including any custom Other text), e.g. ["a", "b"]; if '
+                "nothing is selected on an optional question the answer is []."
             )
         ),
     ]
@@ -124,9 +202,10 @@ class Question(TypedDict):
                     "Options for 'multiple_choice' and 'multi_select' questions. "
                     "Every choice needs a non-empty 'value'. An 'Other' free-form "
                     "option is always appended automatically for both types; "
-                    "multi-select may collect multiple custom Other values. "
-                    "'multi_select' values (including custom Other text) must not "
-                    "contain ',' because the answer joins them with ', '."
+                    "multi-select may collect multiple custom Other values. A "
+                    "'multi_select' answer is a JSON array of the selected "
+                    "values, so values (including custom Other text) may "
+                    "contain commas, quotes, and newlines."
                 )
             ),
         ]
@@ -170,6 +249,10 @@ MAX_ASK_USER_AUTHORIZATION_ANSWER_CHARS = 4000
 # These limits bound the receipt-anchored question/answer evidence copied into
 # Auto's classifier prompt. Questions are model-generated and otherwise have no
 # schema length constraint, so they must not be able to exhaust that context.
+# The answer budget is measured on the answer as it travels the wire, which for
+# `multi_select` is the JSON encoding: escaping and quoting count toward the
+# limit, so a selection can cross it while its decoded values would not.
+# Crossing it withholds the receipt, which is the fail-closed direction.
 MAX_ASK_USER_AUTHORIZATION_QUESTION_CHARS = 4000
 MAX_ASK_USER_AUTHORIZATION_QUESTION_TOTAL_CHARS = 8000
 
@@ -205,6 +288,20 @@ AskUserWidgetResult = AskUserAnswered | AskUserCancelled
 """Discriminated union for the ask_user widget Future result."""
 
 
+ASK_USER_NOTHING_SELECTED = "(nothing selected)"
+"""Display-only placeholder for a `multi_select` the user left unselected.
+
+Distinct from `ASK_USER_NO_ANSWER`, which marks a *missing* answer: this one
+marks an answer that arrived and selected nothing. Only
+`render_ask_user_transcript_for_display` produces it, and only for a human — the
+transcript the model reads keeps the `[]` encoding.
+
+In-band like the other placeholders, so a `multi_select` value spelled
+`(nothing selected)` renders indistinguishably from an empty selection. The
+result feeds no trust decision, so this costs legibility in a corner case
+rather than correctness.
+"""
+
 ASK_USER_NO_ANSWER = "(no answer)"
 """Placeholder for a question with no positionally matching answer.
 
@@ -327,15 +424,25 @@ def format_ask_user_transcript(questions: list[Question], answers: list[str]) ->
     r"""Render questions and answers as the `Q:`/`A:` transcript.
 
     This is the text the `ask_user` tool returns to the model and persists in the
-    thread. The TUI renders that authoritative text literally rather than trying
-    to parse the unrestricted answer content back into structured data.
-
-    Answers are interpolated unescaped, so the encoding is not unambiguously
-    decodable: an answer containing a blank line followed by a literal
-    `Q: <text>\nA:` header is indistinguishable from a real block boundary. Only
-    the model reads it that way today. Any future decoder must anchor on the known
-    question text rather than on a generic `Q: ` pattern, or a crafted answer can
-    fabricate an extra question/answer pair.
+    thread. The TUI renders that authoritative text literally, except for the
+    display-only re-render in `render_ask_user_transcript_for_display`, which
+    anchors on the known question text and gives up rather than guess.
+
+    Answers of every type are interpolated unescaped, so the encoding is not
+    unambiguously decodable: an answer containing a blank line followed by a
+    literal `Q: <text>\nA:` header is indistinguishable from a real block
+    boundary. Only the model reads it that way today. Any future decoder must
+    anchor on the known question text rather than on a generic `Q: ` pattern,
+    or a crafted answer can fabricate an extra question/answer pair.
+
+    For an answer `encode_multi_select_answer` produced, the JSON encoding does
+    close the hazard above: no encoded value can carry a raw line feed, so it
+    cannot fabricate a block boundary. This function cannot *rely* on that,
+    because it does not validate answers and not every answer is encoded — the
+    cancel and error paths in `_parse_answers` substitute `(cancelled)` and
+    `(error: ...)` placeholders for every question whatever its type, and a
+    non-TUI client resuming the interrupt can put arbitrary text in a
+    `multi_select` slot.
 
     Args:
         questions: Questions that were asked. Callers must pass questions whose
@@ -354,3 +461,90 @@ def format_ask_user_transcript(questions: list[Question], answers: list[str]) ->
         for i, question in enumerate(questions)
     ]
     return "\n\n".join(blocks)
+
+
+def render_ask_user_transcript_for_display(
+    questions: list[Question], transcript: str
+) -> str | None:
+    r"""Re-render a transcript with `multi_select` answers unpacked for a human.
+
+    The transcript is built for the model, where a `multi_select` answer is a
+    JSON array. A person reading the same text sees the quoting and, worse, sees
+    a multi-line custom answer flattened to a literal `\n`. This unpacks those
+    answers back to one value per line, leaving every other answer untouched.
+
+    Recovering the answers means splitting the transcript, which
+    `format_ask_user_transcript` warns is not unambiguously decodable. So this
+    anchors on the known question text, the mitigation that docstring
+    prescribes, and gives up rather than guessing: a transcript that does not
+    match the questions exactly returns `None` and must be rendered literally.
+    An answer may itself contain a later `Q: ...` block verbatim (pasting
+    transcript-like text into a text answer is legitimate), so a separator must
+    be unique to be trusted — with duplicates, the first occurrence would
+    swallow the real blocks into the wrong answer and misattribute the rest.
+    The result is display-only and feeds no trust decision.
+
+    Two things this deliberately does not do. It does not reject trailing
+    content: the last answer runs to the end of the transcript, so junk appended
+    after the final block is indistinguishable from answer text and is
+    re-emitted verbatim. And it does not handle three or more identically worded
+    questions — their shared anchor makes the separator non-unique, so a
+    perfectly well-formed transcript falls back to literal rendering. Both are
+    display-only outcomes.
+
+    Args:
+        questions: The questions that produced `transcript`, in order.
+        transcript: Output of `format_ask_user_transcript` for those questions.
+
+    Returns:
+        The re-rendered transcript, or `None` when `transcript` does not parse
+            as exactly these questions — including when no answer needed
+            unpacking, so the caller keeps its literal rendering. The two
+            cases share one sentinel because the caller wants the same literal
+            rendering either way. A caller that wants to report an unexpected
+            `None` should first check that a `multi_select` is present at all,
+            which is what the TUI row does.
+    """
+    if not questions:
+        return None
+    anchors = [f"Q: {question.get('question', '')}\nA: " for question in questions]
+    answers: list[str] = []
+    position = 0
+    for index, anchor in enumerate(anchors):
+        if not transcript.startswith(anchor, position):
+            return None
+        position += len(anchor)
+        if index + 1 == len(anchors):
+            # The final answer runs to the end, so there is nothing left to
+            # check: trailing junk cannot be told apart from answer text.
+            answers.append(transcript[position:])
+            break
+        separator = f"\n\n{anchors[index + 1]}"
+        end = transcript.find(separator, position)
+        # `end` indexes the first of the two newlines, so `end + 2` is the `Q`
+        # of the next anchor. Re-searching from there cannot re-find this match,
+        # and cannot miss one that overlaps it: an occurrence starting at
+        # `end + 1` would need `transcript[end + 2]` to be a newline, and it is
+        # the `Q`. So the check establishes exactly one separator ahead.
+        if end == -1 or transcript.find(separator, end + 2) != -1:
+            return None
+        answers.append(transcript[position:end])
+        position = end + 2
+
+    changed = False
+    blocks: list[str] = []
+    for question, answer in zip(questions, answers, strict=True):
+        rendered = answer
+        if question.get("type") == "multi_select":
+            values = decode_multi_select_answer(answer)
+            if values is not None:
+                # One per line, so a value that itself spans lines stays
+                # legible. This trades away distinguishability: `["a", "b"]` and
+                # `["a\nb"]` render identically. Legibility is the point here and
+                # nothing downstream parses the result, so the trade is fine.
+                rendered = "\n".join(values) if values else ASK_USER_NOTHING_SELECTED
+                changed = changed or rendered != answer
+        blocks.append(f"Q: {question.get('question', '')}\nA: {rendered}")
+    if not changed:
+        return None
+    return "\n\n".join(blocks)

{deepagents_code-0.1.57 → deepagents_code-0.1.59}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "57e15ea"
+BUILD_COMMIT = "b650b41"