deepagents-code 0.1.59__tar.gz → 0.1.60__tar.gz

{deepagents_code-0.1.59 → deepagents_code-0.1.60}/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.60](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.59...deepagents-code==0.1.60) (2026-08-23)
+
+### Features
+
+- Added `editable` trace metadata ([#5737](https://github.com/langchain-ai/deepagents/issues/5737)) ([23b83ad](https://github.com/langchain-ai/deepagents/commit/23b83ad50f63d241d0069a3dc426d43b211adf2e)).
+- Added shell command highlighting in the chat input ([#5675](https://github.com/langchain-ai/deepagents/issues/5675)) ([d711bc6](https://github.com/langchain-ai/deepagents/commit/d711bc61300090181dc89e3e116e8b343fb65425)).
+- Made project `.env` loading configurable ([#5726](https://github.com/langchain-ai/deepagents/issues/5726)) ([995cad6](https://github.com/langchain-ai/deepagents/commit/995cad67519af294851282133f8c40f643807c88)).
+- Unified notification center and settings ([#5698](https://github.com/langchain-ai/deepagents/issues/5698)) ([9767f42](https://github.com/langchain-ai/deepagents/commit/9767f420c622a31a7511c4601739534ddc6062a7)).
+
+### Bug Fixes
+
+- Blocked dotenv git config injection keys ([#5723](https://github.com/langchain-ai/deepagents/issues/5723)) ([328f916](https://github.com/langchain-ai/deepagents/commit/328f9160e0f95a459be8ad57f76e7178b24a3ef8)).
+- Persisted Auto approval mode between sessions and simplified Auto fallback copy ([#5665](https://github.com/langchain-ai/deepagents/issues/5665)) ([3ac059e](https://github.com/langchain-ai/deepagents/commit/3ac059e1574963fe216692642aa1b1a4044daaa9)), ([#5670](https://github.com/langchain-ai/deepagents/issues/5670)) ([42afcde](https://github.com/langchain-ai/deepagents/commit/42afcded97029070f393232778c84aaf3b69fb1c)).
+- Fixed recognition of in-flight trace messages ([#5738](https://github.com/langchain-ai/deepagents/issues/5738)) ([f1d1f63](https://github.com/langchain-ai/deepagents/commit/f1d1f632812a85646d25ac2f3d2d7f39b65a0b49)).
+- Increased the warm limit to 800 ([#5728](https://github.com/langchain-ai/deepagents/issues/5728)) ([f954cde](https://github.com/langchain-ai/deepagents/commit/f954cde37f1171adc2ec3f1516a0393bded47e82)).
+- Improved text selection by supporting `Shift` + `click` to extend selections ([#5732](https://github.com/langchain-ai/deepagents/issues/5732)) ([e05931b](https://github.com/langchain-ai/deepagents/commit/e05931b3016ed3d1500df0c5b77402f457ee5686)).
+- Polished notification settings by removing expand flicker and the trailing disclosure glyph ([#5734](https://github.com/langchain-ai/deepagents/issues/5734)) ([5397812](https://github.com/langchain-ai/deepagents/commit/5397812ad5f217cd84f871f121cf9ea8f3d63f4f)).
+- Improved authentication footers with contextual actions ([#5690](https://github.com/langchain-ai/deepagents/issues/5690)) ([074a501](https://github.com/langchain-ai/deepagents/commit/074a5019e1f3edfd589614774958400d051e5fe1)).
+- Standardized modal navigation hints ([#5699](https://github.com/langchain-ai/deepagents/issues/5699)) ([85c6833](https://github.com/langchain-ai/deepagents/commit/85c6833734a547e968221c1199a769d7aac69430)).
+- Aligned wrapped debug snapshot values ([#5727](https://github.com/langchain-ai/deepagents/issues/5727)) ([1f74959](https://github.com/langchain-ai/deepagents/commit/1f7495949232fe2e3e3328b6ff9054c202002f95)).
+
 ## [0.1.59](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.58...deepagents-code==0.1.59) (2026-08-20)
 
 ### Features

{deepagents_code-0.1.59 → deepagents_code-0.1.60}/COMMANDS.md

@@ -33,7 +33,7 @@ aliases, descriptions, visibility, or hidden-command metadata.
 | `/manual` |  | Switch to Manual approval mode |
 | `/mcp` |  | Manage MCP servers and authentication |
 | `/model` |  | Switch models or edit model settings |
-| `/notifications` |  | Configure warning notifications |
+| `/notifications` |  | Review notifications and configure warning settings |
 | `/offload` | `/compact` | Summarize and offload older messages to free context |
 | `/plugins` |  | Manage plugins |
 | `/quit` | `/q` | Exit app |

{deepagents_code-0.1.59 → deepagents_code-0.1.60}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: deepagents-code
-Version: 0.1.59
+Version: 0.1.60
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://www.langchain.com/dcode
 Project-URL: Documentation, https://docs.langchain.com/oss/deepagents/code/overview

{deepagents_code-0.1.59 → deepagents_code-0.1.60}/THREAT_MODEL.md

@@ -260,7 +260,7 @@
 - **Inside**: `config._create_model_from_class` validates `class_path` format (`module:ClassName`), imports the module via `importlib.import_module()`, and checks `issubclass(cls, BaseChatModel)` before instantiation.
 - **Outside**: Module-level code in the imported module executes unconditionally during `import_module()`. The `issubclass` check only runs after import. Any side effects (file I/O, network calls, subprocess spawning) in the module's top-level scope execute before the type check.
 - **Crossing mechanism**: `importlib.import_module(module_path)` in `config._create_model_from_class`.
-- **Inside (dotenv)**: `config._load_dotenv` loads project and global `.env` values with `override=False` and drops shell startup / environment-hijack keys (`BASH_ENV`, `ENV`, and related) so a project `.env` cannot register a script that Bash would source at startup. The preview path (`_preview_dotenv_environ`) applies the same denylist so a dry-run config change cannot report a value a real reload would reject.
+- **Inside (dotenv)**: `config._load_dotenv` loads project and global `.env` values with `override=False` and drops shell startup / environment-hijack keys (`BASH_ENV`, `ENV`, and related) so a project `.env` cannot register a script that Bash would source at startup. The denylist is best-effort: it enumerates environment variables known to reach a code-execution consumer (a shell's startup hook, the dynamic linker, an interpreter's startup path) and cannot claim completeness — any tool `dcode` spawns that honors an environment-driven execution hook not yet in the list remains a live vector until the key is added. The preview path (`_preview_dotenv_environ`) applies the same denylist so a dry-run config change cannot report a value a real reload would reject.
 - **Outside (dotenv)**: All other `.env` keys are applied to the process environment, and any project file in the working directory (`.env`, `Makefile`, build scripts) can still influence execution. See T12.
 
 #### TB12: Managed Config → Runtime
@@ -453,7 +453,7 @@
 #### T12: Project `.env` Injects Shell Interpreter Startup Hooks
 
 - **Flow**: DF10 (project `.env` → process environment) → bash subprocess startup (DF19)
-- **Description**: `config._load_dotenv` discovers the nearest project `.env` by walking up from the working directory and applies its values to the process environment (`override=False`, so shell-exported values still win). Bash treats several environment variables as startup hooks — `BASH_ENV` and `ENV` name a file that is sourced when a non-interactive shell starts. Because Deep Agents Code runs its own local-context detection through Bash at startup (`local_context.build_detect_script`) and spawns shells for the `execute` tool, a project `.env` that sets one of these keys could run attacker-controlled scripts inside the `dcode` process *before* any model-requested tool call or HITL approval prompt. The broader trust boundary is that running `dcode` in a project directory lets that project influence the process environment.
+- **Description**: `config._load_dotenv` discovers the nearest project `.env` by walking up from the working directory and applies its values to the process environment (`override=False`, so shell-exported values still win). Bash treats several environment variables as startup hooks — `BASH_ENV` and `ENV` name a file that is sourced when a non-interactive shell starts. Because Deep Agents Code runs its own local-context detection through Bash at startup (`local_context.build_detect_script`) and spawns shells for the `execute` tool, a project `.env` that sets one of these keys could run attacker-controlled scripts inside the `dcode` process *before* any model-requested tool call or HITL approval prompt. The broader trust boundary is that running `dcode` in a project directory lets that project influence the process environment. The mitigation is a key denylist (`config._DOTENV_DENIED_ENV_KEYS`) covering known execution-hook consumers (shell startup, dynamic linker, interpreter startup/paths, askpass hijack); it is a best-effort enumeration, not a closed set, so an execution hook consumed by some other spawned tool remains viable until its keys are added to the list.
 - **Preconditions**: (1) User launches `dcode` in a directory containing an attacker-controlled `.env` (for example, a freshly cloned untrusted repository); (2) the `.env` sets a shell startup-hook key that is not already exported in the user's shell (dotenv uses `override=False`).
 
 #### T13: First-Token Shell Allow-List Bypass via Interpreters/Wrappers
@@ -478,7 +478,7 @@
 | LLM output            | DF6, DF7              | T1, T2, T3, T4, T13, T14| HITL gate; shell allow-list; Unicode/URL warnings on tool args; Auto classifier review | Project        | LLM-generated tool args not scanned for injection beyond Unicode/URL; shell allow-list matches only the command's first token, so allow-listed interpreters/wrappers bypass it (T13); Auto classifier review quality follows the user-selected classifier model, and the classifier reads untrusted tool arguments, prior output, and model-authored `ask_user` question text (T14)   |
 | Tool/function results | DF9, DF11             | T1            | Unicode warning on URL args; `markdownify` HTML conversion                 | Shared         | Tool *results* pass to context without prompt-injection scan                                 |
 | URL-fetched content   | DF8, DF9              | T1            | `check_url_safety` on URL arg; HTML→markdown conversion                    | Shared         | Markup-embedded instructions survive markdownify; no LLM-layer guardrail                    |
-| Configuration         | DF10, DF12, DF15, DF23| T9, T10, T12, T14  | Dotenv shell-env precedence; TOML schema; MCP schema + allow/deny lists; JSON structure check; `class_path` format check; project-`.env` denylist for the Auto classifier model | User | Project `.env` can set shell startup-hook vars; `class_path` executes module code before type check; MCP env dict unfiltered; Auto classifier strength is a user choice with no floor enforced (T14) |
+| Configuration         | DF10, DF12, DF15, DF23| T9, T10, T12, T14  | Dotenv shell-env precedence; TOML schema; MCP schema + allow/deny lists; JSON structure check; `class_path` format check; dotenv denylist for execution-hook env keys and project-`.env` trust vars | User | Dotenv denylist is best-effort — execution-hook env keys consumed by tools not yet enumerated still reach subprocesses; `class_path` executes module code before type check; MCP env dict unfiltered; Auto classifier strength is a user choice with no floor enforced (T14) |
 | Session restore       | DF14                  | T5            | OS file permissions; SQLite                                                | Project        | Unencrypted at rest                                                                           |
 | Server IPC (env vars) | DF18                  | T6            | `ServerConfig` serialization; parent env passed to child                   | Project        | Provider API keys flow to server subprocess; system prompt in env                            |
 | Host environment      | DF19, DF20            | T7            | Static script; exit code check; 30s timeout                                | Shared         | Makefile content injected into system prompt without sanitization                            |
@@ -545,3 +545,4 @@ Threats that appear valid in isolation but fall outside project responsibility b
 | 2026-08-03 | manual update                      | Added T14 (a weaker Auto classifier model weakens action review) under TB2, covering the selectable classifier (`--auto-classifier-model`, `DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL`, `[models].auto_classifier`, `/auto model`), its restriction to trusted config surfaces via `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, and its fail-closed construction behavior (deny, then latch to human approval; never fall back to the main model). Extended the "LLM output" and "Configuration" input-coverage rows with T14 |
 | 2026-08-04 | manual update                      | Extended T14 for the configurable Auto classifier review deadline (`DEEPAGENTS_CODE_AUTO_CLASSIFIER_TIMEOUT`, `[models].auto_classifier_timeout`): bounded by `config_manifest.resolve_auto_classifier_timeout` between a floor and ceiling so the deadline cannot be removed, denied from a project `.env` via `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, and fail-closed on expiry |
 | 2026-08-17 | manual update                      | Extended T14 for `ask_user` question text as a classifier injection source: the receipt attests display and answer, not content, so a question claiming prior or blanket authorization is untrusted content; recorded the `_CLASSIFIER_POLICY` clauses that keep a paired question to an action/target description matched against canonical arguments. Narrowed the T14 "deterministic allow/deny" guard wording, which overstated the deny side: deterministic denies do not cover the Deny categories, and an affirmative classifier allow is not re-checked downstream |
+| 2026-08-21 | manual update                      | Clarified that the dotenv execution-hook denylist (`config._DOTENV_DENIED_ENV_KEYS`) is a best-effort enumeration of known code-execution consumers, not a closed set: TB11's inside-detail and T12's description now state this explicitly, and the Configuration input-coverage gap was reworded from the stale "project `.env` can set shell startup-hook vars" (denylisted since #4288) to the actual residual — execution-hook keys consumed by not-yet-enumerated tools still reach subprocesses |

{deepagents_code-0.1.59 → deepagents_code-0.1.60}/deepagents_code/_ask_user_types.py

@@ -14,7 +14,7 @@ from __future__ import annotations
 import json
 from typing import Annotated, Literal, NotRequired, assert_never, get_args
 
-from pydantic import Field
+from pydantic import AfterValidator, Field
 from typing_extensions import TypedDict
 
 QuestionType = Literal["text", "multiple_choice", "multi_select"]
@@ -155,6 +155,65 @@ def ask_user_answer_is_empty(answer: str, question_type: object) -> bool:
     return not answer.strip()
 
 
+def _validate_question_text(text: str) -> str:
+    """Reject a `question` that is empty or all whitespace.
+
+    This is the only rule that *rejects* blank question text.
+    `messages._ask_user_question_count` also tests it, but degrades to a count
+    of zero instead of rejecting.
+
+    Do not reorder this annotation and the `Field` beside it. As the inner
+    annotation it runs before `min_length=1`, which therefore never rejects
+    anything — that constraint is kept only because it is what puts
+    `minLength: 1` in the JSON schema the model reads. Swapping the two moves
+    the empty-string rejection onto `min_length` and changes the error the
+    model sees from this function's message to `string_too_short`. A string
+    like `"   "` would render as a visually blank prompt.
+
+    Args:
+        text: The parsed `question` text to check.
+
+    Returns:
+        The same `text`, unchanged.
+
+    Raises:
+        ValueError: If `text` has no non-whitespace character.
+    """
+    if not text.strip():
+        msg = "question text must not be blank"
+        raise ValueError(msg)
+    return text
+
+
+def _validate_choice(choice: Choice) -> Choice:
+    """Reject a choice whose `value` is blank.
+
+    A blank value would render as an unlabelled option the user can select but
+    whose answer reads as "no answer".
+
+    Attached to the item annotation inside `Question.choices`, not to `Choice`
+    itself, so `TypeAdapter(Choice)` does not apply it.
+
+    Callers must pass a parsed `Choice`. A missing `value` never reaches here —
+    it is a required key, so pydantic rejects it as `choices.N.value: Field
+    required` before the choice-level validators run. On a raw dict this would
+    raise `KeyError`, which is not a `ValidationError` and would halt the run.
+
+    Args:
+        choice: The parsed `Choice` to check.
+
+    Returns:
+        The same `choice`, unchanged.
+
+    Raises:
+        ValueError: If `value` is blank or whitespace-only.
+    """
+    if not choice["value"].strip():
+        msg = f"choice has a blank 'value': {choice!r}"
+        raise ValueError(msg)
+    return choice
+
+
 class Choice(TypedDict):
     """A single choice option for a multiple choice or multi-select question."""
 
@@ -173,10 +232,48 @@ class Choice(TypedDict):
     ]
 
 
+def _validate_question(question: Question) -> Question:
+    """Apply the cross-field rules of a single question.
+
+    These are the rules no single field type can express: choice questions need
+    a non-empty `choices` list, and non-choice questions must not define one.
+
+    `Literal` already rejects an unknown `type` and `strict=True` a non-boolean
+    `required` before this runs, so they are not re-checked here.
+
+    Args:
+        question: The parsed `Question` to check.
+
+    Returns:
+        The same `question`, unchanged.
+
+    Raises:
+        ValueError: If the question violates one of the rules above.
+    """
+    question_type = question["type"]
+    question_text = question["question"]
+    choices = question.get("choices")
+    if question_type in CHOICE_QUESTION_TYPES:
+        if not choices:
+            msg = (
+                f"{question_type} question {question_text!r} requires a "
+                f"non-empty 'choices' list"
+            )
+            raise ValueError(msg)
+    elif choices:
+        msg = f"{question_type} question {question_text!r} must not define 'choices'"
+        raise ValueError(msg)
+    return question
+
+
 class Question(TypedDict):
     """A question to ask the user."""
 
-    question: Annotated[str, Field(description="The question text to display.")]
+    question: Annotated[
+        str,
+        AfterValidator(_validate_question_text),
+        Field(description="The question text to display.", min_length=1),
+    ]
 
     type: Annotated[
         QuestionType,
@@ -196,7 +293,7 @@ class Question(TypedDict):
 
     choices: NotRequired[
         Annotated[
-            list[Choice],
+            list[Annotated[Choice, AfterValidator(_validate_choice)]],
             Field(
                 description=(
                     "Options for 'multiple_choice' and 'multi_select' questions. "
@@ -231,14 +328,62 @@ class Question(TypedDict):
     ]
 
 
+ValidatedQuestion = Annotated[Question, AfterValidator(_validate_question)]
+"""A `Question` with its cross-field rules applied during pydantic parsing.
+
+Only the cross-field `choices` rules are scoped to this alias. The field-level
+rules on `Question.question` and on `Question.choices` are unconditional, so
+they also apply wherever `Question` itself is pydantic-parsed — notably
+`TypeAdapter(AskUserRequest)` in `tui.textual_adapter`, which re-validates the
+interrupt payload client-side and re-raises on failure. Keep that in mind
+before adding another field-level rule here.
+
+Where a `ValueError` from one of these validators ends up depends on the path.
+On the tool path it becomes a tool-call `ValidationError`, which `ToolNode`
+turns into an error `ToolMessage` the model can correct and retry from. On the
+client re-validation path there is no tool call and `textual_adapter` logs and
+re-raises instead."""
+
+
+def _validate_questions(questions: list[ValidatedQuestion]) -> list[ValidatedQuestion]:
+    """Reject an empty `questions` list.
+
+    Per-question rules live on `ValidatedQuestion`; this covers the one rule
+    about the list itself. Attached both to the tool's `questions` parameter
+    and to `AskUserRequest.questions`, so the client re-validation boundary
+    rejects an empty list too — `AskUserMenu([])` would otherwise build a
+    titled prompt with no question widgets and nothing focusable.
+
+    Args:
+        questions: The parsed `questions` argument to check.
+
+    Returns:
+        The same `questions`, unchanged.
+
+    Raises:
+        ValueError: If the list is empty.
+    """
+    if not questions:
+        msg = "ask_user requires at least one question"
+        raise ValueError(msg)
+    return questions
+
+
 class AskUserRequest(TypedDict):
     """Request payload sent via interrupt when asking the user questions."""
 
     type: Literal["ask_user"]
     """Discriminator tag, always `'ask_user'`."""
 
-    questions: list[Question]
-    """Questions to present to the user."""
+    questions: Annotated[list[ValidatedQuestion], AfterValidator(_validate_questions)]
+    """Questions to present to the user.
+
+    `ValidatedQuestion` rather than `Question`, and carrying
+    `_validate_questions`, so every rule the tool applies also applies where
+    `tui.textual_adapter` re-validates this payload. A choice question with no
+    `choices` would otherwise reach the client and degrade to a text box, and
+    an empty list would render a prompt with no questions in it.
+    """
 
     tool_call_id: str
     """ID of the originating tool call, used to route the response back."""
@@ -446,9 +591,10 @@ def format_ask_user_transcript(questions: list[Question], answers: list[str]) ->
 
     Args:
         questions: Questions that were asked. Callers must pass questions whose
-            `question` text is a non-empty string; `ask_user._validate_questions`
-            enforces that before interrupting. The empty default below only
-            keeps a caller that skips validation from raising `KeyError`.
+            `question` text is a non-empty string; `_validate_question_text`,
+            attached to `Question.question`, enforces that before interrupting.
+            The empty default below only keeps a caller that skips validation
+            from raising `KeyError`.
         answers: Answers, positionally matched to `questions`. A missing entry
             falls back to `ASK_USER_NO_ANSWER`; extra entries are dropped.
 

{deepagents_code-0.1.59 → deepagents_code-0.1.60}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "b650b41"
+BUILD_COMMIT = "1aa14cc"

{deepagents_code-0.1.59 → deepagents_code-0.1.60}/deepagents_code/_env_vars.py

@@ -444,6 +444,19 @@ request. Also the escape hatch for hosts embedding this package that manage
 process, so an embedder that starts its own would otherwise race this one.
 """
 
+READ_PROJECT_DOTENV = "DEEPAGENTS_CODE_READ_PROJECT_DOTENV"
+"""Toggle loading the *project* `.env` (the one found walking up from cwd).
+
+Enabled by default, preserving the historical behavior of applying the nearest
+project `.env` to the process environment (`override=False`, shell exports
+win). Set to a falsy value (`0`, `false`, `no`, `off`) — or `[startup]`
+`read_project_dotenv = false` in config.toml — to skip the project file
+entirely, as defense-in-depth against a cloned repo whose `.env` carries
+hostile values the dotenv denylist does not yet enumerate. The global
+`~/.deepagents/.env` is unaffected. This is user-controlled process env, not a
+repo file, so a project `.env` cannot disable itself.
+"""
+
 RECURSION_LIMIT = "DEEPAGENTS_CODE_RECURSION_LIMIT"
 """Override the main agent's LangGraph `recursion_limit` (graph step budget).
 

{deepagents_code-0.1.59 → deepagents_code-0.1.60}/deepagents_code/_textual_patches.py

@@ -1,6 +1,6 @@
 r"""Runtime patches over Textual internals, imported for side effect.
 
-This module hosts five independent best-effort patches over private Textual
+This module hosts six independent best-effort patches over private Textual
 APIs. Each guards its own import/assignment and degrades to stock Textual
 behavior (logging a warning) if the targeted internals move, so they have
 separate lifecycles — do not delete the whole file when only one lands
@@ -42,7 +42,23 @@ upstream.
     drag) to word boundaries. No upstream issue tracks this yet, so it has
     no removal criterion — it stays until Textual grows native word select.
 
-4. Detached-widget hit filtering. The compositor keeps reporting a widget as
+4. Shift-click selection extension. Stock Textual replaces an existing text
+    selection on every mouse press, so Shift+click cannot move the active end
+    of a drag-selected range. The patch preserves the original selection anchor
+    and applies the click as its new end. No upstream issue tracks this yet.
+
+    Known terminal limitation: this only works when the terminal delivers the
+    modified click to the app. Ghostty binds Shift+click to its own selection
+    and never forwards the event while mouse reporting is active, so
+    Shift+click is a no-op there (users can `keybind = shift+click=unbind` to
+    opt out). iTerm2, kitty, and WezTerm forward it with the shift modifier
+    bit set, which is what the patch keys on. If Shift+click "does nothing"
+    for a user, check terminal delivery first — e.g. run
+    `printf '\e[?1003h\e[?1006h'; cat -v` and confirm Shift+click prints a
+    `^[[<;...;4M`-style sequence (the `4` is the shift bit) — before digging
+    into this patch.
+
+5. Detached-widget hit filtering. The compositor keeps reporting a widget as
     visible for a few event-loop iterations after it leaves the DOM, which
     `Markdown.update` (and therefore the `MarkdownStream` that drives every
     streaming assistant message) does constantly. `Screen._forward_event`
@@ -51,7 +67,7 @@ upstream.
     crashes the app with `AttributeError: 'NoneType' object has no attribute
     'region'`. Tracked in Textualize/textual#6643; remove when that lands.
 
-5. Diff-gutter exclusion from selections. Textual paints the selection
+6. Diff-gutter exclusion from selections. Textual paints the selection
     highlight from the geometry stored in `Screen.selections`, so excluding
     a diff row's decorative gutter (line number, `+`/`-` marker) only in
     `Widget.get_selection` would copy the right text while still highlighting
@@ -447,6 +463,97 @@ else:
         )
 
 
+try:
+    from textual import events as _shift_events
+    from textual.screen import Screen as _ShiftScreen
+    from textual.selection import SelectEnd, SelectStart, SelectState
+
+    _original_forward_event_with_shift = _ShiftScreen._forward_event
+except (ImportError, AttributeError) as exc:  # pragma: no cover - defensive
+    logger.warning(
+        "Textual Shift+click selection patch skipped (textual %s): %s",
+        _textual_version,
+        exc,
+    )
+else:
+
+    def _shift_click_anchor(screen: Screen, event: Event) -> SelectState | None:
+        # When this returns None the press falls through to stock Textual,
+        # which starts a fresh selection — indistinguishable from the event
+        # never arriving. Before debugging the branches below, confirm the
+        # terminal forwarded a shift-modified click at all (see the module
+        # docstring's patch 4 note); terminals like Ghostty consume Shift+click
+        # locally, so `event.shift` never becomes True here.
+        if (
+            not isinstance(event, _shift_events.MouseDown)
+            or not event.shift
+            or screen.app.mouse_captured
+            or not screen.selections
+        ):
+            return None
+        select_state = screen._select_state
+        if select_state is None or select_state.end is None:
+            return None
+        content_widget = select_state.start.content_widget
+        if content_widget is not None and not content_widget.is_attached:
+            return None
+        return select_state if select_state.is_attached_to_dom() else None
+
+    def _rebase_anchor_scroll(anchor_start: SelectStart) -> SelectStart:
+        # `SelectStart.pointer_start_offset` adds the scroll travelled since
+        # the drag began, which tracks the viewport rather than the anchored
+        # text. That is harmless mid-drag, but a Shift+click can arrive many
+        # rows after the container scrolled — the transcript auto-scrolls while
+        # a message streams — leaving the anchor pointing at whatever text now
+        # occupies its old screen row. Fold the drift into the pointer delta
+        # and re-base against the current scroll offset, so the anchor stays on
+        # its original text.
+        container = anchor_start.container
+        drift = container.scroll_offset - anchor_start.container_initial_scroll_offset
+        return SelectStart(
+            container,
+            anchor_start.container_pointer_delta - drift,
+            anchor_start.container_initial_offset,
+            container.scroll_offset,
+            content_widget=anchor_start.content_widget,
+            content_offset=anchor_start.content_offset,
+        )
+
+    def _extend_selection_to_click(
+        screen: Screen,
+        anchor: SelectState | None,
+        event: _shift_events.MouseDown,
+    ) -> None:
+        click_state = screen._select_state
+        if anchor is None or click_state is None:
+            return
+        click = click_state.start
+        # Stock Textual clears the selection when a MouseUp lands on the
+        # offset of its MouseDown. Forget the offset so the Shift+click's own
+        # MouseUp leaves the extension we install below alone.
+        screen._mouse_down_offset = None
+        screen._select_state = SelectState(
+            event.screen_offset,
+            _rebase_anchor_scroll(anchor.start),
+            SelectEnd(click.container, click.content_widget, click.content_offset),
+        )
+
+    def _forward_event_with_shift_select(self: Screen, event: Event) -> None:
+        shift_anchor = _shift_click_anchor(self, event)
+        _original_forward_event_with_shift(self, event)
+        if isinstance(event, _shift_events.MouseDown):
+            _extend_selection_to_click(self, shift_anchor, event)
+
+    try:
+        _ShiftScreen._forward_event = _forward_event_with_shift_select  # ty: ignore[invalid-assignment]
+    except (AttributeError, TypeError) as exc:  # pragma: no cover - defensive
+        logger.warning(
+            "Textual Shift+click selection patch assignment rejected (textual %s): %s",
+            _textual_version,
+            exc,
+        )
+
+
 try:
     from textual.screen import Screen as _HitScreen
 

{deepagents_code-0.1.59 → deepagents_code-0.1.60}/deepagents_code/_version.py

@@ -2,7 +2,7 @@
 
 # Keep the `x-release-please-version` annotation — release-please uses it to
 # bump `__version__` in sync with `pyproject.toml` on every release PR.
-__version__ = "0.1.59"  # x-release-please-version
+__version__ = "0.1.60"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/code"
 """URL for `deepagents-code` documentation."""

{deepagents_code-0.1.59 → deepagents_code-0.1.60}/deepagents_code/agent.py

@@ -48,7 +48,6 @@ if TYPE_CHECKING:
 from langchain.agents.middleware import (
     HumanInTheLoopMiddleware,
     InterruptOnConfig,
-    ToolErrorMiddleware,
 )
 from langchain.agents.middleware.types import AgentMiddleware, ToolCallRequest
 from langchain.tools import (
@@ -70,7 +69,6 @@ from deepagents_code._repository_bounds import (
     REPOSITORY_TOOL_NAMES,
     RepositoryBounds,
 )
-from deepagents_code._tool_errors import ToolArgumentError
 from deepagents_code.approval_mode import (
     ApprovalMode,
     aread_approval_mode_from_store,
@@ -178,47 +176,6 @@ def _get_harness_tool_descriptions(
     return dict(_harness_profile_for_model(model, None).tool_description_overrides)
 
 
-# Tools that raise `ToolArgumentError` on model-authored arguments. The name
-# filter is a second gate only: recovery keys off the exception type, so a
-# different error from one of these tools still halts the run.
-#
-# `read_file` is deliberately absent. It catches its own argument errors and
-# returns an error `ToolMessage` already. The only `ValueError`s that escape it
-# come from backend invariants the model cannot fix, and the SDK raises those
-# on purpose to stop a backend from silently skipping unshown source lines.
-_TOOL_ARG_VALIDATION_TOOLS: tuple[str, ...] = ("ask_user",)
-
-
-def _tool_arg_validation_on_error(
-    exc: Exception, request: ToolCallRequest
-) -> str | None:
-    """Convert a `ToolArgumentError` into a model-correctable message.
-
-    `ToolErrorMiddleware` re-raises `GraphBubbleUp` before it calls this, so
-    interrupts and parent commands never arrive here.
-
-    Args:
-        exc: Exception raised during tool execution.
-        request: The tool call request that failed.
-
-    Returns:
-        A message naming the tool and the validation detail, so the model can
-            fix its input and retry. `None` for any other exception, so
-            unexpected errors propagate and halt the run.
-    """
-    if isinstance(exc, ToolArgumentError):
-        # The run no longer fails, so this is the only record that the model
-        # sent bad arguments. `exc_info` keeps the raise site for debugging.
-        logger.warning(
-            "Recovered tool argument error from %s: %s",
-            request.tool_call["name"],
-            exc,
-            exc_info=exc,
-        )
-        return f"`{request.tool_call['name']}` failed: {exc}. Fix the input and retry."
-    return None
-
-
 def _inject_fs_tools_into_subagents(
     custom_subagents: list[SubAgent | CompiledSubAgent],
     *,
@@ -2554,9 +2511,6 @@ def create_cli_agent(
         from deepagents_code.hooks.server_middleware import ServerHooksMiddleware
 
         hooks_cwd = Path(effective_cwd) if effective_cwd is not None else Path.cwd()
-        # No `ToolErrorMiddleware` here. `_TOOL_ARG_VALIDATION_TOOLS` covers
-        # `ask_user` only, and subagents never get `AskUserMiddleware`, so an
-        # instance on this stack could never fire.
         middleware.append(
             ServerHooksMiddleware(
                 cwd=hooks_cwd,
@@ -3130,20 +3084,6 @@ def create_cli_agent(
             rubric_kwargs["max_iterations"] = rubric_max_iterations
         agent_middleware.append(ReliableRubricMiddleware(**rubric_kwargs))
 
-    # Turn a `ToolArgumentError` into a recoverable error `ToolMessage` instead
-    # of a fatal run error. Any other exception propagates and halts the run.
-    #
-    # This must stay last. `_chain_tool_call_wrappers` composes the list first
-    # to outermost, so anything appended after this would run inside the
-    # handler. `ServerHooksMiddleware` keeps a plain `ValueError` fatal on
-    # purpose: it means the client answered a different request. Catching that
-    # here would report a hook fault to the model as its own bad tool input.
-    agent_middleware.append(
-        ToolErrorMiddleware(
-            _tool_arg_validation_on_error, tools=list(_TOOL_ARG_VALIDATION_TOOLS)
-        )
-    )
-
     # Create the agent
     all_subagents: list[SubAgent | CompiledSubAgent | AsyncSubAgent] = [
         *custom_subagents,