deepagents-code 0.1.58__tar.gz → 0.1.59__tar.gz

{deepagents_code-0.1.58 → deepagents_code-0.1.59}/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.59](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.58...deepagents-code==0.1.59) (2026-08-20)
+
+### Features
+
+- Added support for `managed_config.toml` configuration ([#5604](https://github.com/langchain-ai/deepagents/issues/5604))
+- Multi-select `ask_user` answers are now encoded as JSON arrays ([#5660](https://github.com/langchain-ai/deepagents/issues/5660))
+- Made teardown usage stats configurable ([#5696](https://github.com/langchain-ai/deepagents/issues/5696))
+- Footer pickers now open on click ([#5674](https://github.com/langchain-ai/deepagents/issues/5674))
+- Replaced Gemini 3.6 Flash with Gemini 3.7 Flash ([#5681](https://github.com/langchain-ai/deepagents/issues/5681))
+
+### Bug fixes
+
+- Made tool argument validation errors recoverable ([#5659](https://github.com/langchain-ai/deepagents/issues/5659))
+- Improved streaming performance for tool-call arguments to run in linear time ([#5712](https://github.com/langchain-ai/deepagents/issues/5712))
+- Fixed durable-mask config resolution with ranked resolver behavior ([#5672](https://github.com/langchain-ai/deepagents/issues/5672))
+- Skipped background sync in Apple Terminal ([#5666](https://github.com/langchain-ai/deepagents/issues/5666))
+- Hid thread IDs when tracing is disabled ([#5692](https://github.com/langchain-ai/deepagents/issues/5692))
+- Kept installed providers visible in `/auth` ([#5689](https://github.com/langchain-ai/deepagents/issues/5689))
+- Preloaded the auth UI before notification handoff ([#5697](https://github.com/langchain-ai/deepagents/issues/5697))
+- Updated and clarified UI copy across Auto mode, YOLO hints, classifier notices, `/tokens`, line-number toggles, review failures, onboarding Tavily cancellation, and OpenAI subscription login labels ([#5685](https://github.com/langchain-ai/deepagents/issues/5685), [#5694](https://github.com/langchain-ai/deepagents/issues/5694), [#5684](https://github.com/langchain-ai/deepagents/issues/5684), [#5687](https://github.com/langchain-ai/deepagents/issues/5687), [#5680](https://github.com/langchain-ai/deepagents/issues/5680), [#5688](https://github.com/langchain-ai/deepagents/issues/5688), [#5686](https://github.com/langchain-ai/deepagents/issues/5686), [#5691](https://github.com/langchain-ai/deepagents/issues/5691), [#5693](https://github.com/langchain-ai/deepagents/issues/5693))
+- Removed the `Muse Spark 1.1` recommendation ([#5683](https://github.com/langchain-ai/deepagents/issues/5683))
+
 ## [0.1.58](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.57...deepagents-code==0.1.58) (2026-08-19)
 
 ### Breaking Changes

{deepagents_code-0.1.58 → deepagents_code-0.1.59}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: deepagents-code
-Version: 0.1.58
+Version: 0.1.59
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://www.langchain.com/dcode
 Project-URL: Documentation, https://docs.langchain.com/oss/deepagents/code/overview
@@ -30,16 +30,16 @@ Requires-Python: <4.0,>=3.12
 Requires-Dist: aiosqlite<1.0.0,>=0.22.1
 Requires-Dist: anyio<5.0.0,>=4.14.2
 Requires-Dist: deepagents-acp<1.0.0,>=0.0.10
-Requires-Dist: deepagents==0.7.7
+Requires-Dist: deepagents==0.7.8
 Requires-Dist: filelock<3.30,>=3.29.7
-Requires-Dist: genai-prices<0.2.0,>=0.1.3
+Requires-Dist: genai-prices<0.2.0,>=0.1.4
 Requires-Dist: httpx<1.0.0,>=0.28.1
-Requires-Dist: langchain-anthropic<2.0.0,>=1.6.0
+Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1
 Requires-Dist: langchain-google-genai<5.0.0,>=4.3.4
 Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.2
 Requires-Dist: langchain-openai<2.0.0,>=1.6.0
 Requires-Dist: langchain-quickjs<0.4.0,>=0.3.4
-Requires-Dist: langchain<2.0.0,>=1.3.15
+Requires-Dist: langchain<2.0.0,>=1.3.16
 Requires-Dist: langgraph-checkpoint-sqlite<4.0.0,>=3.1.1
 Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.31
 Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.32.6
@@ -66,7 +66,7 @@ Provides-Extra: agentcore
 Requires-Dist: langchain-agentcore-codeinterpreter<1.0.0,>=0.0.5; extra == 'agentcore'
 Provides-Extra: all-providers
 Requires-Dist: aiohttp<3.15.0,>=3.14.3; extra == 'all-providers'
-Requires-Dist: langchain-anthropic<2.0.0,>=1.6.0; extra == 'all-providers'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1; extra == 'all-providers'
 Requires-Dist: langchain-aws<2.0.0,>=1.7.2; extra == 'all-providers'
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.3; extra == 'all-providers'
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'all-providers'
@@ -94,7 +94,7 @@ Requires-Dist: langchain-modal>=0.0.5; extra == 'all-sandboxes'
 Requires-Dist: langchain-runloop>=0.0.6; extra == 'all-sandboxes'
 Requires-Dist: langchain-vercel-sandbox>=0.0.1; extra == 'all-sandboxes'
 Provides-Extra: anthropic
-Requires-Dist: langchain-anthropic<2.0.0,>=1.6.0; extra == 'anthropic'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1; extra == 'anthropic'
 Provides-Extra: baseten
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.3; extra == 'baseten'
 Provides-Extra: bedrock

{deepagents_code-0.1.58 → deepagents_code-0.1.59}/THREAT_MODEL.md

@@ -50,6 +50,7 @@
 6. The LangGraph dev server subprocess binds to `127.0.0.1` by default (`client/launch/server.py:_DEFAULT_HOST`) and is ephemeral — started and stopped per CLI session.
 7. `DA_SERVER_*` environment variables are readable only by the CLI process and its child server subprocess (OS process isolation assumption).
 8. Users who set `class_path` in `config.toml` accept the same trust model as `pyproject.toml` build scripts — they control their own machine.
+9. Administrators deploy and protect the fixed `managed_config.toml` path with operating-system controls; the CLI does not validate its owner or mode and never writes it.
 
 ---
 
@@ -129,7 +130,7 @@
 | C6  | Hook Runtime                | Fires subprocess commands on agent lifecycle events                                                                 | framework-controlled | No³      | `hooks.runtime.HooksRuntime`, `hooks.runner.run_command_handler`                                  |
 | C7  | Sandbox Integration         | Creates/destroys remote sandboxes (Daytona, LangSmith, Modal, Runloop, AgentCore)                                  | framework-controlled | No⁴      | `integrations.sandbox_factory.create_sandbox`                                                     |
 | C8  | Session Persistence         | SQLite checkpoint store for LangGraph thread state                                                                  | framework-controlled | Yes      | `sessions.get_db_path`, `sessions.generate_thread_id`                                             |
-| C9  | Configuration System        | TOML config, env vars, `AGENTS.md` system prompts, model config                                                    | user-controlled      | N/A      | `config.settings`, `model_config.ModelConfig`, `~/.deepagents/config.toml`                        |
+| C9  | Configuration System        | Managed/user TOML, env vars, `AGENTS.md` system prompts, model config                                               | administrator/user-controlled | N/A | `configuration`, `config.settings`, `model_config.ModelConfig`, fixed managed path, `~/.deepagents/config.toml` |
 | C10 | Unicode/URL Safety          | Detects hidden Unicode, checks URL domain spoofing for approval UI warnings                                         | framework-controlled | Yes      | `unicode_security.detect_dangerous_unicode`, `unicode_security.check_url_safety`                  |
 | C11 | LangGraph Dev Server        | Subprocess running `langgraph dev` with `LANGGRAPH_AUTH_TYPE=noop`; managed by `ServerProcess`                      | framework-controlled | Yes⁵     | `client.launch.server.ServerProcess.start`, `client.launch.server.generate_langgraph_json`, `client.launch.server_manager.start_server_and_get_agent` |
 | C12 | Remote Agent Client         | HTTP+SSE client wrapping `RemoteGraph`; connects to C11 on localhost                                                | framework-controlled | Yes⁵     | `client.remote_client.RemoteAgent.astream`, `client.remote_client.RemoteAgent.aget_state`         |
@@ -207,6 +208,7 @@
 | TB9  | LocalContextMiddleware → Host Env     | Bash detect script output (git info, project files, Makefile) injected into system prompt | Script is framework-generated static code; 30s timeout; exit-code check | Content of Makefile, pyproject.toml, git branch names, directory listing |
 | TB10 | RemoteAgent → LangGraph Dev Server    | CLI communicates with agent via HTTP+SSE on localhost                       | Server bound to `127.0.0.1` (`client/launch/server.py:_DEFAULT_HOST`); ephemeral per session | No authentication (`LANGGRAPH_AUTH_TYPE=noop`); any localhost process can reach the API |
 | TB11 | Config File → Code Execution          | `class_path` in `config.toml` triggers `importlib.import_module()`; project/global `.env` values are loaded into the process environment and can reach Bash startup hooks | Format validation (`module:ClassName`); `issubclass(BaseChatModel)` check; dotenv loading denies shell startup / environment-hijack keys (`BASH_ENV`, `ENV`) | Module-level side effects execute during import; user controls config file; project files in the working directory influence execution |
+| TB12 | Managed Config → Runtime              | A fixed administrator-deployed TOML file overrides CLI, environment, and user preferences | Fixed non-redirectable path; the CLI never writes the file; fail-closed startup for every command except diagnostics; typed resolution; diagnostics remain available | Filesystem ownership/mode and privileged deployment are outside the CLI; a host administrator can weaken or strengthen policy |
 
 ### Boundary Details
 
@@ -261,6 +263,26 @@
 - **Inside (dotenv)**: `config._load_dotenv` loads project and global `.env` values with `override=False` and drops shell startup / environment-hijack keys (`BASH_ENV`, `ENV`, and related) so a project `.env` cannot register a script that Bash would source at startup. The preview path (`_preview_dotenv_environ`) applies the same denylist so a dry-run config change cannot report a value a real reload would reject.
 - **Outside (dotenv)**: All other `.env` keys are applied to the process environment, and any project file in the working directory (`.env`, `Makefile`, build scripts) can still influence execution. See T12.
 
+#### TB12: Managed Config → Runtime
+
+- **Inside**: The resolver reads one fixed OS path. The writer rejects that path, so the managed source is read-only by guard and not only by convention. Valid managed values take the highest precedence. The rules are:
+  - Tables deep-merge. Deny lists union. An explicit managed allow or trust list replaces lower-precedence grants.
+  - A managed scalar replaces a colliding user table at any depth, so a user cannot defeat policy by changing the shape of a key. This holds on the top-level merge and inside a structured table: both apply the manifest validator, so the effective value and the audited provenance agree.
+  - A wrong-typed managed scalar is skipped, and the lower-precedence value stays in effect.
+  - Inside a structured table (`[models.providers]`, `[themes]`, `[async_subagents]`, `[sandboxes.providers]`, `[ui.terminal_themes]`, `[threads.columns]`) the dedicated typed reader validates instead. A wrong-typed managed leaf there can displace a valid user leaf, after which the reader falls back to the built-in default.
+  - An enforced key whose managed value cannot be applied stops every command except the diagnostics listed below. It also blocks `/reload`. Skipping it would leave the user's CLI flag or environment variable in force. The enforced keys are `startup.mode`, `startup.yolo_switcher`, `shell.allow_list`, `skills.extra_allowed_dirs`, `interpreter.enable_interpreter`, `interpreter.ptc`, `interpreter.ptc_acknowledge_unsafe`, `models.auto_classifier`, `runtime.recursion_limit`, `sandboxes.default`, and `tracing.langsmith_redact`.
+  - Three conditions make an enforced key unapplicable: a wrong-typed value, a `runtime.recursion_limit` outside its bounds, and a key made unreachable by a scalar ancestor (`startup = "manual"` in place of `[startup]` and `mode`). A managed `[sandboxes].default` that names an unavailable backend stops a sandboxed launch.
+  - A scalar at a known section is rejected for the same reason, so it cannot replace the user's whole section. `[effort]` is included, although it has no manifest option.
+  - Any other rejected managed value is ignored, and `dcode doctor` and `dcode config` name it. An ignored key is never silent.
+  - A missing file is accepted and applies no policy.
+  - A present unreadable, undecodable, or syntactically corrupt file blocks every command except `--help`, `--version`, `help`, `config`, `doctor`, and `auth path`. It also blocks `/reload`.
+  - On Windows, a ProgramData directory that cannot be read from the registry blocks the same commands. The path would be a guess, and an empty read at a guessed path does not prove that no policy is deployed. Reporting it as a missing file made every managed setting silently inert on a host whose ProgramData is relocated.
+  - A failed `/reload` keeps the last snapshot that parsed cleanly, so policy is never dropped mid-session.
+  - An unusable user `config.toml` drops only the user layer, so managed policy still applies.
+  - A deny list that cannot be read is treated as denying everything, never as empty. This covers a managed `[mcp].disabled_servers` that is neither an array of names nor a comma-separated string, and a `[mcp]` section that is not a table. A managed `[mcp].enabled_project_server_approvals` that is not an array is treated the same way: the key is present, so policy means to narrow access, and reading its presence as absence would keep both the user's approvals and the `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` bypass in force.
+- **Outside**: Ownership, permission-mode validation, privileged installation, and `sudo` policy are deployment responsibilities. Anyone who can replace the administrator-managed file can control model, sandbox, interpreter, MCP trust, and other supported runtime settings. On macOS, note that stock `/Library/Application Support` is group-writable by `admin`, so any admin-group member can create the file and grant themselves policy. Deployments that rely on this boundary must tighten ownership and mode on the `dcode` directory.
+- **Crossing mechanism**: Synchronous local file read through `configuration.TomlFileProvider`, followed by typed resolution and CLI/server startup gates.
+
 ---
 
 ## Data Flows
@@ -292,6 +314,7 @@
 | DF23 | C9 Config    | C17 Model Config | `class_path` string from `config.toml` | —              | TB11             | TOML parse → importlib |
 | DF24 | C5 MCP Config | MCP Subprocess | `env` dict from `.mcp.json` forwarded to stdio subprocess | DC1 | TB4 | subprocess environment |
 | DF25 | C3 Agent     | C7 Sandbox   | Conversation messages for offload             | DC5            | TB6              | `backend.awrite()`     |
+| DF26 | Administrator | C9 Config   | Managed TOML policy                            | DC1            | TB12             | Fixed local file read |
 
 ### Flow Details
 

{deepagents_code-0.1.58 → deepagents_code-0.1.59}/deepagents_code/_ask_user_types.py

@@ -11,6 +11,7 @@ side produces it and which reads it.
 
 from __future__ import annotations
 
+import json
 from typing import Annotated, Literal, NotRequired, assert_never, get_args
 
 from pydantic import Field
@@ -61,23 +62,97 @@ same as being *rendered* as a choice list: the TUI has its own exhaustive
 dispatch in `_QuestionWidget.compose`.
 """
 
-MULTI_SELECT_ANSWER_SEPARATOR = ", "
-"""Separator joining the selected values of a `multi_select` answer."""
 
-MULTI_SELECT_FORBIDDEN_IN_VALUE = ","
-"""Substring a `multi_select` choice value must not contain.
+def encode_multi_select_answer(values: list[str]) -> str:
+    """Encode the selected values of a `multi_select` answer for the wire.
 
-Deliberately stated outright rather than derived from
-`MULTI_SELECT_ANSWER_SEPARATOR`, so the two can evolve independently: a separator
-of `" and "` would, if the forbidden text were derived from it, reject every value
-containing "and".
+    The answer stays one string so `answers: list[str]` keeps one slot per
+    question, positionally matched. JSON is self-delimiting, so values carrying
+    commas, quotes, or newlines round-trip exactly.
+
+    The encoding is opaque to a consumer that only moves the answer around. A
+    consumer that tests whether the user answered at all must go through
+    `ask_user_answer_is_empty`: an unselected `multi_select` encodes as the
+    *truthy* string `[]`, so a bare `.strip()` reads it as answered.
+
+    Args:
+        values: Selected values — toggled predefined choices in choice-list
+            order, then custom Other values in slot order.
+
+    Returns:
+        The values as a JSON array, e.g. `["a", "b"]`. An empty selection
+        encodes as `[]`. The result never contains a line feed or carriage
+        return, so it cannot split a blank-line-separated transcript block.
+        `ensure_ascii=False` does pass U+2028 and U+2029 through literally, so
+        do not read this as "the result is a single line to every consumer" —
+        the guarantee is about the block separator only.
+    """
+    return json.dumps(values, ensure_ascii=False)
+
+
+def decode_multi_select_answer(raw: str) -> list[str] | None:
+    """Decode a `multi_select` answer produced by `encode_multi_select_answer`.
+
+    Args:
+        raw: The raw answer string for a `multi_select` question. Must already
+            be a `str`: a non-string raises `TypeError` out of `json.loads`
+            rather than returning `None`. Every call site establishes that
+            first — `_parse_answers` coerces non-string answers,
+            `_validated_ask_user_answers` checks `isinstance(answer, str)`, and
+            the display path passes a slice of the transcript.
+
+    Returns:
+        The selected values, or `None` when `raw` is not a JSON array of
+            strings. Callers choose the policy for `None`; the one thing none of
+            them may do is fall back to splitting on `", "`, which mis-splits a
+            value that contains a comma.
+    """
+    try:
+        decoded = json.loads(raw)
+    except (json.JSONDecodeError, RecursionError):
+        return None
+    if not isinstance(decoded, list) or not all(
+        isinstance(value, str) for value in decoded
+    ):
+        return None
+    return decoded
 
-This buys *legibility* of the joined answer, not invertibility. Nothing decodes a
-multi-select answer back into its components, and per
-`format_ask_user_transcript` the transcript is not unambiguously decodable
-anyway. If one is ever written, that is the moment to introduce a structured
-answer type instead of leaning on this ban.
-"""
+
+def ask_user_answer_is_empty(answer: str, question_type: object) -> bool:
+    """Return whether an `ask_user` answer counts as "no answer".
+
+    The single definition of emptiness for an answer, shared by the TUI (which
+    blocks submitting a required question) and by the Auto authorization path
+    (which keeps unanswered questions out of the consent evidence). Both sides
+    must agree: an answer the TUI accepts as empty must not read as consent
+    evidence downstream.
+
+    A bare `.strip()` is wrong for `multi_select`, whose empty encoding is the
+    truthy string `[]`. Every other type is empty when it is blank.
+
+    Args:
+        answer: The raw answer string for the question.
+        question_type: The paired question's `type`. Anything other than
+            `'multi_select'` — including a malformed or missing type — takes the
+            blank test.
+
+    Returns:
+        `True` when the question has no substantive answer.
+    """
+    if question_type == "multi_select":
+        # A malformed encoding counts as empty, which is the fail-closed side of
+        # both call sites: the TUI re-prompts a *required* question (an optional
+        # one submits unchanged), and Auto withholds the answer from the consent
+        # evidence rather than passing an undecodable string to the classifier.
+        #
+        # This makes emptiness asymmetric across types for the `(cancelled)` and
+        # `(error: ...)` placeholders, which are not JSON: on a `multi_select`
+        # they read as empty and are withheld from the evidence, while the same
+        # placeholder on a `text` question becomes a row. Withholding is the
+        # safe direction, so the asymmetry is acceptable — but it is real, and a
+        # future caller counting answered questions across types will see it.
+        return not decode_multi_select_answer(answer)
+    return not answer.strip()
 
 
 class Choice(TypedDict):
@@ -88,7 +163,11 @@ class Choice(TypedDict):
         Field(
             description=(
                 "The display label for this choice. Also the text returned as "
-                "the answer when this choice is selected."
+                "the answer when this choice is selected. A 'multi_select' answer "
+                "is a JSON array, so a value may contain commas, quotes, and "
+                "newlines; JSON escaping keeps it exact. A 'multiple_choice' "
+                "value is returned on its own with no escaping, so keep that "
+                "one to a single line."
             )
         ),
     ]
@@ -108,10 +187,9 @@ class Question(TypedDict):
                 "one or more predefined options. Both choice types always append an "
                 "'Other' free-form option automatically; multi-select can accept "
                 "multiple custom Other values (filling one reveals another). A "
-                "'multi_select' answer comes back as the selected values "
-                "(including any custom Other text) joined with ', '; if nothing "
-                "is selected on an optional question the answer is an empty "
-                "string."
+                "'multi_select' answer comes back as a JSON array of the selected "
+                'values (including any custom Other text), e.g. ["a", "b"]; if '
+                "nothing is selected on an optional question the answer is []."
             )
         ),
     ]
@@ -124,9 +202,10 @@ class Question(TypedDict):
                     "Options for 'multiple_choice' and 'multi_select' questions. "
                     "Every choice needs a non-empty 'value'. An 'Other' free-form "
                     "option is always appended automatically for both types; "
-                    "multi-select may collect multiple custom Other values. "
-                    "'multi_select' values (including custom Other text) must not "
-                    "contain ',' because the answer joins them with ', '."
+                    "multi-select may collect multiple custom Other values. A "
+                    "'multi_select' answer is a JSON array of the selected "
+                    "values, so values (including custom Other text) may "
+                    "contain commas, quotes, and newlines."
                 )
             ),
         ]
@@ -170,6 +249,10 @@ MAX_ASK_USER_AUTHORIZATION_ANSWER_CHARS = 4000
 # These limits bound the receipt-anchored question/answer evidence copied into
 # Auto's classifier prompt. Questions are model-generated and otherwise have no
 # schema length constraint, so they must not be able to exhaust that context.
+# The answer budget is measured on the answer as it travels the wire, which for
+# `multi_select` is the JSON encoding: escaping and quoting count toward the
+# limit, so a selection can cross it while its decoded values would not.
+# Crossing it withholds the receipt, which is the fail-closed direction.
 MAX_ASK_USER_AUTHORIZATION_QUESTION_CHARS = 4000
 MAX_ASK_USER_AUTHORIZATION_QUESTION_TOTAL_CHARS = 8000
 
@@ -205,6 +288,20 @@ AskUserWidgetResult = AskUserAnswered | AskUserCancelled
 """Discriminated union for the ask_user widget Future result."""
 
 
+ASK_USER_NOTHING_SELECTED = "(nothing selected)"
+"""Display-only placeholder for a `multi_select` the user left unselected.
+
+Distinct from `ASK_USER_NO_ANSWER`, which marks a *missing* answer: this one
+marks an answer that arrived and selected nothing. Only
+`render_ask_user_transcript_for_display` produces it, and only for a human — the
+transcript the model reads keeps the `[]` encoding.
+
+In-band like the other placeholders, so a `multi_select` value spelled
+`(nothing selected)` renders indistinguishably from an empty selection. The
+result feeds no trust decision, so this costs legibility in a corner case
+rather than correctness.
+"""
+
 ASK_USER_NO_ANSWER = "(no answer)"
 """Placeholder for a question with no positionally matching answer.
 
@@ -327,15 +424,25 @@ def format_ask_user_transcript(questions: list[Question], answers: list[str]) ->
     r"""Render questions and answers as the `Q:`/`A:` transcript.
 
     This is the text the `ask_user` tool returns to the model and persists in the
-    thread. The TUI renders that authoritative text literally rather than trying
-    to parse the unrestricted answer content back into structured data.
-
-    Answers are interpolated unescaped, so the encoding is not unambiguously
-    decodable: an answer containing a blank line followed by a literal
-    `Q: <text>\nA:` header is indistinguishable from a real block boundary. Only
-    the model reads it that way today. Any future decoder must anchor on the known
-    question text rather than on a generic `Q: ` pattern, or a crafted answer can
-    fabricate an extra question/answer pair.
+    thread. The TUI renders that authoritative text literally, except for the
+    display-only re-render in `render_ask_user_transcript_for_display`, which
+    anchors on the known question text and gives up rather than guess.
+
+    Answers of every type are interpolated unescaped, so the encoding is not
+    unambiguously decodable: an answer containing a blank line followed by a
+    literal `Q: <text>\nA:` header is indistinguishable from a real block
+    boundary. Only the model reads it that way today. Any future decoder must
+    anchor on the known question text rather than on a generic `Q: ` pattern,
+    or a crafted answer can fabricate an extra question/answer pair.
+
+    For an answer `encode_multi_select_answer` produced, the JSON encoding does
+    close the hazard above: no encoded value can carry a raw line feed, so it
+    cannot fabricate a block boundary. This function cannot *rely* on that,
+    because it does not validate answers and not every answer is encoded — the
+    cancel and error paths in `_parse_answers` substitute `(cancelled)` and
+    `(error: ...)` placeholders for every question whatever its type, and a
+    non-TUI client resuming the interrupt can put arbitrary text in a
+    `multi_select` slot.
 
     Args:
         questions: Questions that were asked. Callers must pass questions whose
@@ -354,3 +461,90 @@ def format_ask_user_transcript(questions: list[Question], answers: list[str]) ->
         for i, question in enumerate(questions)
     ]
     return "\n\n".join(blocks)
+
+
+def render_ask_user_transcript_for_display(
+    questions: list[Question], transcript: str
+) -> str | None:
+    r"""Re-render a transcript with `multi_select` answers unpacked for a human.
+
+    The transcript is built for the model, where a `multi_select` answer is a
+    JSON array. A person reading the same text sees the quoting and, worse, sees
+    a multi-line custom answer flattened to a literal `\n`. This unpacks those
+    answers back to one value per line, leaving every other answer untouched.
+
+    Recovering the answers means splitting the transcript, which
+    `format_ask_user_transcript` warns is not unambiguously decodable. So this
+    anchors on the known question text, the mitigation that docstring
+    prescribes, and gives up rather than guessing: a transcript that does not
+    match the questions exactly returns `None` and must be rendered literally.
+    An answer may itself contain a later `Q: ...` block verbatim (pasting
+    transcript-like text into a text answer is legitimate), so a separator must
+    be unique to be trusted — with duplicates, the first occurrence would
+    swallow the real blocks into the wrong answer and misattribute the rest.
+    The result is display-only and feeds no trust decision.
+
+    Two things this deliberately does not do. It does not reject trailing
+    content: the last answer runs to the end of the transcript, so junk appended
+    after the final block is indistinguishable from answer text and is
+    re-emitted verbatim. And it does not handle three or more identically worded
+    questions — their shared anchor makes the separator non-unique, so a
+    perfectly well-formed transcript falls back to literal rendering. Both are
+    display-only outcomes.
+
+    Args:
+        questions: The questions that produced `transcript`, in order.
+        transcript: Output of `format_ask_user_transcript` for those questions.
+
+    Returns:
+        The re-rendered transcript, or `None` when `transcript` does not parse
+            as exactly these questions — including when no answer needed
+            unpacking, so the caller keeps its literal rendering. The two
+            cases share one sentinel because the caller wants the same literal
+            rendering either way. A caller that wants to report an unexpected
+            `None` should first check that a `multi_select` is present at all,
+            which is what the TUI row does.
+    """
+    if not questions:
+        return None
+    anchors = [f"Q: {question.get('question', '')}\nA: " for question in questions]
+    answers: list[str] = []
+    position = 0
+    for index, anchor in enumerate(anchors):
+        if not transcript.startswith(anchor, position):
+            return None
+        position += len(anchor)
+        if index + 1 == len(anchors):
+            # The final answer runs to the end, so there is nothing left to
+            # check: trailing junk cannot be told apart from answer text.
+            answers.append(transcript[position:])
+            break
+        separator = f"\n\n{anchors[index + 1]}"
+        end = transcript.find(separator, position)
+        # `end` indexes the first of the two newlines, so `end + 2` is the `Q`
+        # of the next anchor. Re-searching from there cannot re-find this match,
+        # and cannot miss one that overlaps it: an occurrence starting at
+        # `end + 1` would need `transcript[end + 2]` to be a newline, and it is
+        # the `Q`. So the check establishes exactly one separator ahead.
+        if end == -1 or transcript.find(separator, end + 2) != -1:
+            return None
+        answers.append(transcript[position:end])
+        position = end + 2
+
+    changed = False
+    blocks: list[str] = []
+    for question, answer in zip(questions, answers, strict=True):
+        rendered = answer
+        if question.get("type") == "multi_select":
+            values = decode_multi_select_answer(answer)
+            if values is not None:
+                # One per line, so a value that itself spans lines stays
+                # legible. This trades away distinguishability: `["a", "b"]` and
+                # `["a\nb"]` render identically. Legibility is the point here and
+                # nothing downstream parses the result, so the trade is fine.
+                rendered = "\n".join(values) if values else ASK_USER_NOTHING_SELECTED
+                changed = changed or rendered != answer
+        blocks.append(f"Q: {question.get('question', '')}\nA: {rendered}")
+    if not changed:
+        return None
+    return "\n\n".join(blocks)

{deepagents_code-0.1.58 → deepagents_code-0.1.59}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "863c615"
+BUILD_COMMIT = "b650b41"

{deepagents_code-0.1.58 → deepagents_code-0.1.59}/deepagents_code/_env_vars.py

@@ -528,6 +528,18 @@ Defaults to enabled; set to a falsy value (`0`, `false`, `no`, `off`, or empty)
 to suppress the success toast while still opening URLs normally.
 """
 
+SHOW_USAGE_STATS = "DEEPAGENTS_CODE_SHOW_USAGE_STATS"
+"""Print the session usage-statistics table when a session ends.
+
+Defaults to enabled; set to a falsy value (`0`, `false`, `no`, `off`, or empty)
+to suppress the table. Applies to both the TUI teardown and the headless
+`-x`/`--execute` run, which is why the option carries an env var at all: a CI
+runner can set one, but rarely has a `~/.deepagents/config.toml` to edit.
+
+Suppressing only the table is narrower than `--quiet`, which silences the rest
+of the headless teardown output too.
+"""
+
 SPLASH_SHOW_CWD = "DEEPAGENTS_CODE_SPLASH_SHOW_CWD"
 """Show the working-directory row in the startup welcome banner when enabled.
 

{deepagents_code-0.1.58 → deepagents_code-0.1.59}/deepagents_code/_session_stats.py

@@ -1,17 +1,20 @@
 """Lightweight session statistics, token formatting, and usage-table rendering.
 
-Holds `SessionStats`/`ModelStats`, the `format_token_count` formatter, and
-`print_usage_table` (which imports `rich.table` lazily). The module is
-intentionally kept free of heavy top-level dependencies (no pydantic, no
-config, no widget imports) so that `app.py` can import `SessionStats` and
-`format_token_count` at module level without pulling in the full
-`textual_adapter` dependency tree.
+Holds `SessionStats`/`ModelStats`, the `format_token_count` formatter,
+`print_usage_table` (which imports `rich.table` lazily), and
+`usage_table_enabled`, which decides whether that table is rendered at all.
+The module is intentionally kept free of heavy top-level dependencies (no
+pydantic, no config, no widget imports) so that `app.py` can import
+`SessionStats` and `format_token_count` at module level without pulling in the
+full `textual_adapter` dependency tree — hence the deferred `config_manifest`
+import inside `usage_table_enabled` rather than at the top.
 """
 
 from __future__ import annotations
 
 import logging
 import math
+import sys
 from collections.abc import Mapping
 from dataclasses import dataclass, field, replace
 from decimal import ROUND_CEILING, Decimal
@@ -24,6 +27,9 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
+_warned_usage_stats_rejections: set[str] = set()
+"""Rejection reasons already reported by `_warn_rejected_usage_stats_value`."""
+
 SpinnerStatus = (
     Literal[
         "Thinking",
@@ -969,6 +975,84 @@ def _recorded_cost(cost_usd: float, priced_request_count: int) -> str:
     return format_cost(cost_usd) if priced_request_count else "—"
 
 
+def _warn_rejected_usage_stats_value(reason: str) -> None:
+    """Report a rejected `show_usage_stats` value on stderr.
+
+    Every other rejection in this codebase is logged and left there, which is
+    right for an option that falls through to a cosmetic default. This one can
+    fall through to *showing the table* — the single outcome the user was
+    trying to prevent — and the log has no reader outside the TUI Debug
+    Console, so a quoted `"false"` or a bare `no` would otherwise look exactly
+    like never having set the option. `dcode config set` does not exist, so
+    hand-edited TOML is the only input path and typos are the expected case.
+
+    Both call sites are at teardown, where stderr is a plain stream rather than
+    a live interface, so this cannot land on top of the TUI.
+
+    The line states only the rejection, not the outcome: the resolver reports
+    rejections at or above the winning tier, so when a stronger source cleanly
+    disables the table the outcome half would contradict what the user sees.
+
+    Deduped per reason rather than per process: resolving once per session is
+    the norm, but `dcode config` walks the whole manifest, and a line repeated
+    verbatim reads as two separate problems. Two *different* reasons — managed
+    config and the user file both rejected — really are two problems and both
+    print.
+
+    Args:
+        reason: Rejection text from the resolver.
+    """
+    if reason in _warned_usage_stats_rejections:
+        return
+    _warned_usage_stats_rejections.add(reason)
+    print(f"Warning: {reason}", file=sys.stderr)  # noqa: T201
+    logger.warning("%s", reason)
+
+
+def usage_table_enabled() -> bool:
+    """Return whether the session usage table should be rendered.
+
+    Controlled by `[ui].show_usage_stats` or `DEEPAGENTS_CODE_SHOW_USAGE_STATS`.
+    Both the TUI teardown and the headless run call this rather than resolving
+    the option themselves, so the key and its fallback pair are written once
+    and the two surfaces cannot disagree about the default.
+
+    Fails open: both callers are at teardown, where an exception would cost far
+    more than the table is worth, so a broad catch is warranted for a leaf,
+    cosmetic decision with a safe default — provided it is logged rather than
+    swallowed. The call sites document what an escape would actually break.
+
+    `BlockingError` is excluded from that fail-open, matching
+    `configurable_model._resolve_openai_prompt_cache_key_enabled`: it signals
+    blocking I/O on the event loop, which is a real regression rather than a
+    config hiccup, and this is called directly from the async headless
+    teardown. It is matched by class name because `blockbuster` is not a
+    runtime dependency of this package.
+
+    The `config_manifest` import is deliberately outside the `try`, so an
+    `ImportError` propagates instead of being reported as a config failure.
+
+    Returns:
+        Whether to render the table.
+    """
+    from deepagents_code.config_manifest import load_bool_display_preference
+
+    try:
+        return load_bool_display_preference(
+            "display.show_usage_stats",
+            fallback=True,
+            on_rejected=_warn_rejected_usage_stats_value,
+        )
+    except Exception as exc:
+        if any(cls.__name__ == "BlockingError" for cls in type(exc).__mro__):
+            raise
+        logger.warning(
+            "Could not resolve display.show_usage_stats; showing the table",
+            exc_info=True,
+        )
+        return True
+
+
 def print_usage_table(
     stats: SessionStats,
     wall_time: float,

deepagents_code-0.1.59/deepagents_code/_tool_errors.py

@@ -0,0 +1,20 @@
+"""Exception type for tool arguments the model authored incorrectly.
+
+Lives in its own module so both the tools that raise it and the agent wiring
+that recovers from it can import it without a circular import.
+"""
+
+from __future__ import annotations
+
+
+class ToolArgumentError(ValueError):
+    """A tool rejected arguments the model authored.
+
+    Raise this only when the model can fix the call by rewriting its arguments.
+    `create_cli_agent` wires a `ToolErrorMiddleware` that turns this into an
+    error `ToolMessage` the model can retry from. Every other exception, plain
+    `ValueError` included, stays fatal.
+
+    Subclasses `ValueError` so existing callers that catch `ValueError` around
+    tool argument validation keep working.
+    """