deepagents-code 0.1.60__tar.gz → 0.1.61__tar.gz

{deepagents_code-0.1.60 → deepagents_code-0.1.61}/ARCHITECTURE.md

@@ -41,6 +41,18 @@ Headless mode uses the same agent runtime as the interactive UI, but swaps the t
 
 Configuration is layered across user, project, session, and runtime scopes. That lets teams share project defaults while individual users keep their own credentials, preferences, skills, and local settings.
 
+Configuration files are read into a single process-wide generation, built on the first read and reused after that. Readers that resolve through the shared resolver all observe that one generation. They cannot disagree about a setting.
+
+An edit to `config.toml` while the app runs has no effect on those readers until the generation advances. This happens in two places: an in-app write to the default config path, which refreshes the generation itself, and `/reload`. Each source keeps its last usable snapshot, so a file that fails to parse leaves that tier unchanged instead of erasing it.
+
+The app does not watch files for edits. A partly applied configuration is a worse failure than a stale one.
+
+Some readers sit outside the shared generation. Callers that take their own snapshot inspect one file generation instead of process state, and report it next to its health: `get_config_sources`, the `dcode config` command, and the `dcode doctor` command, which reads the managed file against an empty user tier. A few readers parse a file on each call, because the shared generation cannot serve them: `resolve_read_project_dotenv` runs before the project `.env` is layered into the environment, `resolve_startup_mode_with_source` needs the raw user table, and `update_check` reports the value next to the file health it just read. The reload preview also reads the user file fresh, because a dry run must show the edit under review.
+
+The environment tier is always live. `EnvProvider` reads `os.environ` at resolution time, because the process changes it during dotenv bootstrap and on each cwd switch.
+
+These exceptions are per caller, not per setting. A caller decides to snapshot a file itself. No option is intended to be live for one reader and cached for another, which would make the effective configuration unpredictable per option.
+
 The main extension points are:
 
 - **Skills and subagents** for reusable agent workflows

{deepagents_code-0.1.60 → deepagents_code-0.1.61}/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.61](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.60...deepagents-code==0.1.61) (2026-08-24)
+
+### Features
+
+- Added `google_anthropic_vertex` provider support for Claude on Vertex AI ([#5760](https://github.com/langchain-ai/deepagents/issues/5760)).
+- Enforced configured model allowlists ([#5649](https://github.com/langchain-ai/deepagents/issues/5649)).
+- Injected goal and rubric context directly, replacing `get_goal` and `get_rubric` ([#5041](https://github.com/langchain-ai/deepagents/issues/5041)).
+- Made `/offload` server-owned ([#5261](https://github.com/langchain-ai/deepagents/issues/5261)).
+- Added prompt clipboard support ([#5733](https://github.com/langchain-ai/deepagents/issues/5733)).
+- Show Auto approval review progress ([#5729](https://github.com/langchain-ai/deepagents/issues/5729)).
+
+### Bug Fixes
+
+- Kept long thread resumes responsive ([#5772](https://github.com/langchain-ai/deepagents/issues/5772)).
+- Render first streamed text immediately ([#5761](https://github.com/langchain-ai/deepagents/issues/5761)).
+- Show the incognito shell command widget ([#5768](https://github.com/langchain-ai/deepagents/issues/5768)).
+- Only highlight actionable tool rows ([#5769](https://github.com/langchain-ai/deepagents/issues/5769)).
+- Warn and ignore `--auto-approve` and `--yolo` in headless mode ([#5750](https://github.com/langchain-ai/deepagents/issues/5750)).
+- Sweep expired history archives at startup ([#5751](https://github.com/langchain-ai/deepagents/issues/5751)).
+- Clarified auth environment setup ([#5767](https://github.com/langchain-ai/deepagents/issues/5767)).
+
 ## [0.1.60](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.59...deepagents-code==0.1.60) (2026-08-23)
 
 ### Features

{deepagents_code-0.1.60 → deepagents_code-0.1.61}/COMMANDS.md

@@ -8,7 +8,7 @@ Regenerate this file with `make commands-catalog` after changing command names,
 aliases, descriptions, visibility, or hidden-command metadata.
 
 
-## Public (40)
+## Public (41)
 
 | Command | Aliases | Description |
 | --- | --- | --- |
@@ -36,6 +36,7 @@ aliases, descriptions, visibility, or hidden-command metadata.
 | `/notifications` |  | Review notifications and configure warning settings |
 | `/offload` | `/compact` | Summarize and offload older messages to free context |
 | `/plugins` |  | Manage plugins |
+| `/prompts` |  | Search and reuse a previous prompt |
 | `/quit` | `/q` | Exit app |
 | `/reload` |  | Reload environment and config |
 | `/remember` |  | Save useful context to memory or skills |

{deepagents_code-0.1.60 → deepagents_code-0.1.61}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: deepagents-code
-Version: 0.1.60
+Version: 0.1.61
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://www.langchain.com/dcode
 Project-URL: Documentation, https://docs.langchain.com/oss/deepagents/code/overview
@@ -35,14 +35,14 @@ Requires-Dist: filelock<3.30,>=3.29.7
 Requires-Dist: genai-prices<0.2.0,>=0.1.4
 Requires-Dist: httpx<1.0.0,>=0.28.1
 Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.4
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.5
 Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.2
 Requires-Dist: langchain-openai<2.0.0,>=1.6.0
 Requires-Dist: langchain-quickjs<0.4.0,>=0.3.4
 Requires-Dist: langchain<2.0.0,>=1.3.16
 Requires-Dist: langgraph-checkpoint-sqlite<4.0.0,>=3.1.1
 Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.31
-Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.32.6
+Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.33.0
 Requires-Dist: langgraph-sdk<1.0.0,>=0.4.3
 Requires-Dist: langsmith[sandbox]>=0.11.1
 Requires-Dist: markdownify<2.0.0,>=1.2.3
@@ -67,12 +67,12 @@ Requires-Dist: langchain-agentcore-codeinterpreter<1.0.0,>=0.0.5; extra == 'agen
 Provides-Extra: all-providers
 Requires-Dist: aiohttp<3.15.0,>=3.14.3; extra == 'all-providers'
 Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1; extra == 'all-providers'
-Requires-Dist: langchain-aws<2.0.0,>=1.7.2; extra == 'all-providers'
+Requires-Dist: langchain-aws<2.0.0,>=1.7.3; extra == 'all-providers'
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.3; extra == 'all-providers'
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'all-providers'
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'all-providers'
-Requires-Dist: langchain-fireworks<2.0.0,>=1.5.2; extra == 'all-providers'
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.4; extra == 'all-providers'
+Requires-Dist: langchain-fireworks<2.0.0,>=1.6.0; extra == 'all-providers'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.5; extra == 'all-providers'
 Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.4; extra == 'all-providers'
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'all-providers'
 Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'all-providers'
@@ -84,7 +84,7 @@ Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.4.3; extra == 'all-provid
 Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'all-providers'
 Requires-Dist: langchain-openai<2.0.0,>=1.6.0; extra == 'all-providers'
 Requires-Dist: langchain-openrouter<2.0.0,>=0.2.8; extra == 'all-providers'
-Requires-Dist: langchain-perplexity<2.0.0,>=1.4.0; extra == 'all-providers'
+Requires-Dist: langchain-perplexity<2.0.0,>=1.4.1; extra == 'all-providers'
 Requires-Dist: langchain-together<2.0.0,>=0.4.0; extra == 'all-providers'
 Requires-Dist: langchain-xai<2.0.0,>=1.3.0; extra == 'all-providers'
 Provides-Extra: all-sandboxes
@@ -98,7 +98,7 @@ Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1; extra == 'anthropic'
 Provides-Extra: baseten
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.3; extra == 'baseten'
 Provides-Extra: bedrock
-Requires-Dist: langchain-aws<2.0.0,>=1.7.2; extra == 'bedrock'
+Requires-Dist: langchain-aws<2.0.0,>=1.7.3; extra == 'bedrock'
 Provides-Extra: cohere
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'cohere'
 Provides-Extra: daytona
@@ -106,9 +106,9 @@ Requires-Dist: langchain-daytona>=0.0.7; extra == 'daytona'
 Provides-Extra: deepseek
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'deepseek'
 Provides-Extra: fireworks
-Requires-Dist: langchain-fireworks<2.0.0,>=1.5.2; extra == 'fireworks'
+Requires-Dist: langchain-fireworks<2.0.0,>=1.6.0; extra == 'fireworks'
 Provides-Extra: google-genai
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.4; extra == 'google-genai'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.5; extra == 'google-genai'
 Provides-Extra: groq
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'groq'
 Provides-Extra: huggingface
@@ -136,7 +136,7 @@ Requires-Dist: langchain-openai<2.0.0,>=1.6.0; extra == 'openai'
 Provides-Extra: openrouter
 Requires-Dist: langchain-openrouter<2.0.0,>=0.2.8; extra == 'openrouter'
 Provides-Extra: perplexity
-Requires-Dist: langchain-perplexity<2.0.0,>=1.4.0; extra == 'perplexity'
+Requires-Dist: langchain-perplexity<2.0.0,>=1.4.1; extra == 'perplexity'
 Provides-Extra: quickjs
 Provides-Extra: runloop
 Requires-Dist: langchain-runloop>=0.0.6; extra == 'runloop'
@@ -200,6 +200,128 @@ By default, `dcode` trusts the directory you run it in. Human-in-the-loop approv
 
 Do not run `dcode` in a directory you do not trust without a sandbox backend. For untrusted repositories, use a [remote sandbox](https://docs.langchain.com/oss/python/deepagents/code/remote-sandboxes) so execution is isolated from your machine. Running `dcode` in a directory lets that directory's files shape execution. See [`THREAT_MODEL.md`](https://github.com/langchain-ai/deepagents/blob/main/libs/code/THREAT_MODEL.md) for details.
 
+## Managed configuration
+
+Administrators can enforce any supported `config.toml` setting with a read-only
+`managed_config.toml` using the same TOML schema:
+
+- macOS: `/Library/Application Support/dcode/managed_config.toml`
+- Windows: the `ProgramData` directory reported by the registry, usually
+  `C:\ProgramData\dcode\managed_config.toml`. The `%ProgramData%` environment
+  variable is ignored, because any user can change it.
+- Linux and other supported POSIX systems: `/etc/dcode/managed_config.toml`
+
+Managed values override two lower layers: the `DEEPAGENTS_CODE_` and
+compatibility environment variables, and `~/.deepagents/config.toml`.
+
+For an agent launch, managed values also override these CLI flags: the model,
+the auto-classifier model, the interpreter toggle, the programmatic tool-calling
+list, the recursion limit, the shell allow list, and the startup mode. A managed
+`[sandboxes].default` names the backend of a launch that is already sandboxed;
+it does not sandbox a launch that asked for no sandbox. A managed startup mode
+only revokes `--auto-approve` and `--yolo`; the mode itself reaches the runtime
+through the merged configuration, so a headless launch still works. Subcommand
+display flags such as `dcode threads --relative` are not overridden.
+
+Tables merge recursively. Deny lists are unioned. An explicitly managed allow or
+trust list replaces lower-precedence grants. An empty managed list removes every
+lower-precedence grant.
+
+A managed value whose type contradicts the manifest is ignored, and the
+lower-precedence value stays in effect. Two exceptions:
+
+- The enforced keys (`startup.mode`, `startup.yolo_switcher`,
+  `shell.allow_list`, `skills.extra_allowed_dirs`,
+  `interpreter.enable_interpreter`, `interpreter.ptc`,
+  `interpreter.ptc_acknowledge_unsafe`, `models.allowed`,
+  `models.auto_classifier`, `runtime.recursion_limit`, `sandboxes.default`,
+  `tracing.langsmith_redact`)
+  stop every command except `config`, `doctor`, `auth path`, and the help
+  screens. If one is ignored, the user's flag or environment variable stays in
+  force. This grants the escalation, or it removes the boundary that the policy
+  declared. Three
+  cases stop the launch and block `/reload`: a value the manifest rejects, a
+  `runtime.recursion_limit` outside its bounds, and a key shadowed by a scalar
+  ancestor (`startup = "manual"` in place of `[startup]` and `mode`). A managed
+  `[sandboxes].default` that names an unavailable backend stops a sandboxed
+  launch; a launch that asked for no sandbox is unaffected. A scalar at any
+  known configuration section (for example, `threads = "bad"` instead of
+  `[threads]`) also stops launch and reload rather than replacing the user's
+  whole section.
+- Inside structured tables (`[models.providers]`, `[themes]`,
+  `[async_subagents]`, `[sandboxes.providers]`) the dedicated typed reader
+  validates instead, so a wrong-typed managed leaf can displace a valid user
+  leaf. The reader then falls back to the built-in default. A managed scalar
+  still replaces a colliding user table there, the same as on the top-level
+  merge.
+
+`[shell].allow_list` is read from `~/.deepagents/config.toml` and from
+`DEEPAGENTS_CODE_SHELL_ALLOW_LIST`, so a managed file can enforce it. A user can
+also grant themselves shell auto-approval from their own config file. An empty
+managed list removes every lower-precedence grant.
+
+`[models].allowed` narrows dcode to exact `provider:model` specifications:
+
+```toml
+[models]
+allowed = ["acme:production", "acme:production-fast"]
+```
+
+The rules:
+
+- A missing key preserves unrestricted model selection.
+- An empty list blocks all local model use.
+- A list that dcode cannot parse also blocks all local model use. A typo must not
+  silently remove the restriction the user asked for. Fix or remove the key.
+- Matching is exact and splits only the first colon, so model identifiers may
+  contain additional colons. Matching is also case-sensitive.
+- Entries must be fully qualified. A bare model name that you type at a prompt
+  is first resolved to `provider:model`, the same as at construction, so
+  `gpt-5.6-terra` matches an `openai:gpt-5.6-terra` entry. A bare name whose
+  provider dcode cannot infer never matches.
+- Write a Bedrock model as `bedrock:<id>`. A bare Bedrock ID is rejected,
+  because its version colon would make it a specification that nothing matches.
+- The list filters model discovery and the selector. Construction-time checks
+  are authoritative for CLI flags, runtime switches, Auto classifiers, rubric
+  graders, and explicit local subagent models.
+- A managed list replaces a user list. Managed default, recent, and
+  Auto-classifier models must also appear in it.
+- `[models.providers.<name>].models` registers models additively. It does not
+  grant permission, so a custom model may need both registration and an
+  allowlist entry.
+
+`dcode` never writes the managed file. Users can still save a preference. The
+theme, terminal-mapping, UI-toggle, and MCP-server screens, and the
+`--auto-update` flag, report when a managed value keeps a saved preference from
+taking effect. The model-default, recent-model, and Auto-classifier writers
+refuse a value outside the effective allowlist, and report the policy as the
+reason. Other save paths do not check the allowlist.
+
+A missing managed file applies no policy. If one exists but is unreadable, not
+UTF-8, or invalid TOML, every command fails closed except the ones needed to
+diagnose it: `--help`, `--version`, `help`, `config`, `doctor`, and
+`auth path`. A managed file that becomes unusable later also blocks `/reload`:
+the session keeps the policy that was in force, and the reload reports that it
+kept it. Use `dcode config path` and `dcode doctor` to inspect its
+fixed path and parse health; `dcode config` also warns when the file exists but
+could not be parsed, or parses and declares a value that cannot be enforced.
+
+A deny list that cannot be read denies everything rather than nothing. This
+covers a managed `[mcp].disabled_servers` that is neither an array of names nor
+a comma-separated string, and a `[mcp]` section that is not a table. A managed
+`[mcp].enabled_project_server_approvals` that is not an array is treated the
+same way: the key is present, so policy means to narrow access, and reading its
+presence as absence would leave both the user's approvals and the
+`DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` bypass in force.
+
+A corrupt `~/.deepagents/config.toml` does not disable managed policy: the user
+file is ignored and managed values still apply.
+
+Deployment tooling must create and protect this file with administrator or root
+permissions. `dcode` does not validate the file owner or mode. `dcode` provides
+no privileged writer. Deployment and `sudo` policy are the administrator's
+responsibility.
+
 ## 📖 Resources
 
 - **[Documentation](https://docs.langchain.com/deepagents-code)**

deepagents_code-0.1.61/README.md

@@ -0,0 +1,194 @@
+# 🧠🤖 Deep Agents Code
+
+[![PyPI - Version](https://img.shields.io/pypi/v/deepagents-code?label=%20)](https://pypi.org/project/deepagents-code/#history)
+[![PyPI - License](https://img.shields.io/pypi/l/deepagents-code)](https://opensource.org/licenses/MIT)
+[![PyPI - Downloads](https://img.shields.io/pepy/dt/deepagents-code)](https://pypistats.org/packages/deepagents-code)
+[![Twitter](https://img.shields.io/twitter/url/https/twitter.com/langchain_oss.svg?style=social&label=Follow%20%40LangChain)](https://x.com/langchain_oss)
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/langchain-ai/deepagents/main/libs/code/images/tui.png" alt="Deep Agents Code" width="600"/>
+</p>
+
+## Quick Install
+
+```bash
+curl -LsSf https://langch.in/dcode | bash
+```
+
+```bash
+# With model provider extras
+# OpenAI, Anthropic, and Gemini are included by default
+DEEPAGENTS_CODE_EXTRAS="nvidia,ollama" curl -LsSf https://langch.in/dcode | bash
+```
+
+Run:
+
+```bash
+dcode
+```
+
+## 🤔 What is this?
+
+The fastest way to start using Deep Agents. `deepagents-code` is a pre-built coding agent in your terminal — similar to Claude Code or Cursor — powered by any LLM that supports tool calling. One install command and you're up and running, no code required.
+
+**What `deepagents-code` adds on top of the SDK:**
+
+- **Interactive TUI** — rich terminal interface with streaming responses
+- **Conversation resume** — pick up where you left off across sessions
+- **Web search** — ground responses in live information
+- **Remote sandboxes** — run code in isolated environments (LangSmith, AgentCore, Daytona, Modal, Runloop, & more)
+- **Persistent memory** — agent remembers context across conversations
+- **Custom skills** — extend the agent with your own slash commands
+- **Headless mode** — run non-interactively for scripting and CI
+- **Human-in-the-loop** — approve or reject tool calls before execution
+
+## 🔒 Security model
+
+By default, `dcode` trusts the directory you run it in. Human-in-the-loop approval gates model-requested tool calls, but project artifacts are read before any approval prompt.
+
+Do not run `dcode` in a directory you do not trust without a sandbox backend. For untrusted repositories, use a [remote sandbox](https://docs.langchain.com/oss/python/deepagents/code/remote-sandboxes) so execution is isolated from your machine. Running `dcode` in a directory lets that directory's files shape execution. See [`THREAT_MODEL.md`](https://github.com/langchain-ai/deepagents/blob/main/libs/code/THREAT_MODEL.md) for details.
+
+## Managed configuration
+
+Administrators can enforce any supported `config.toml` setting with a read-only
+`managed_config.toml` using the same TOML schema:
+
+- macOS: `/Library/Application Support/dcode/managed_config.toml`
+- Windows: the `ProgramData` directory reported by the registry, usually
+  `C:\ProgramData\dcode\managed_config.toml`. The `%ProgramData%` environment
+  variable is ignored, because any user can change it.
+- Linux and other supported POSIX systems: `/etc/dcode/managed_config.toml`
+
+Managed values override two lower layers: the `DEEPAGENTS_CODE_` and
+compatibility environment variables, and `~/.deepagents/config.toml`.
+
+For an agent launch, managed values also override these CLI flags: the model,
+the auto-classifier model, the interpreter toggle, the programmatic tool-calling
+list, the recursion limit, the shell allow list, and the startup mode. A managed
+`[sandboxes].default` names the backend of a launch that is already sandboxed;
+it does not sandbox a launch that asked for no sandbox. A managed startup mode
+only revokes `--auto-approve` and `--yolo`; the mode itself reaches the runtime
+through the merged configuration, so a headless launch still works. Subcommand
+display flags such as `dcode threads --relative` are not overridden.
+
+Tables merge recursively. Deny lists are unioned. An explicitly managed allow or
+trust list replaces lower-precedence grants. An empty managed list removes every
+lower-precedence grant.
+
+A managed value whose type contradicts the manifest is ignored, and the
+lower-precedence value stays in effect. Two exceptions:
+
+- The enforced keys (`startup.mode`, `startup.yolo_switcher`,
+  `shell.allow_list`, `skills.extra_allowed_dirs`,
+  `interpreter.enable_interpreter`, `interpreter.ptc`,
+  `interpreter.ptc_acknowledge_unsafe`, `models.allowed`,
+  `models.auto_classifier`, `runtime.recursion_limit`, `sandboxes.default`,
+  `tracing.langsmith_redact`)
+  stop every command except `config`, `doctor`, `auth path`, and the help
+  screens. If one is ignored, the user's flag or environment variable stays in
+  force. This grants the escalation, or it removes the boundary that the policy
+  declared. Three
+  cases stop the launch and block `/reload`: a value the manifest rejects, a
+  `runtime.recursion_limit` outside its bounds, and a key shadowed by a scalar
+  ancestor (`startup = "manual"` in place of `[startup]` and `mode`). A managed
+  `[sandboxes].default` that names an unavailable backend stops a sandboxed
+  launch; a launch that asked for no sandbox is unaffected. A scalar at any
+  known configuration section (for example, `threads = "bad"` instead of
+  `[threads]`) also stops launch and reload rather than replacing the user's
+  whole section.
+- Inside structured tables (`[models.providers]`, `[themes]`,
+  `[async_subagents]`, `[sandboxes.providers]`) the dedicated typed reader
+  validates instead, so a wrong-typed managed leaf can displace a valid user
+  leaf. The reader then falls back to the built-in default. A managed scalar
+  still replaces a colliding user table there, the same as on the top-level
+  merge.
+
+`[shell].allow_list` is read from `~/.deepagents/config.toml` and from
+`DEEPAGENTS_CODE_SHELL_ALLOW_LIST`, so a managed file can enforce it. A user can
+also grant themselves shell auto-approval from their own config file. An empty
+managed list removes every lower-precedence grant.
+
+`[models].allowed` narrows dcode to exact `provider:model` specifications:
+
+```toml
+[models]
+allowed = ["acme:production", "acme:production-fast"]
+```
+
+The rules:
+
+- A missing key preserves unrestricted model selection.
+- An empty list blocks all local model use.
+- A list that dcode cannot parse also blocks all local model use. A typo must not
+  silently remove the restriction the user asked for. Fix or remove the key.
+- Matching is exact and splits only the first colon, so model identifiers may
+  contain additional colons. Matching is also case-sensitive.
+- Entries must be fully qualified. A bare model name that you type at a prompt
+  is first resolved to `provider:model`, the same as at construction, so
+  `gpt-5.6-terra` matches an `openai:gpt-5.6-terra` entry. A bare name whose
+  provider dcode cannot infer never matches.
+- Write a Bedrock model as `bedrock:<id>`. A bare Bedrock ID is rejected,
+  because its version colon would make it a specification that nothing matches.
+- The list filters model discovery and the selector. Construction-time checks
+  are authoritative for CLI flags, runtime switches, Auto classifiers, rubric
+  graders, and explicit local subagent models.
+- A managed list replaces a user list. Managed default, recent, and
+  Auto-classifier models must also appear in it.
+- `[models.providers.<name>].models` registers models additively. It does not
+  grant permission, so a custom model may need both registration and an
+  allowlist entry.
+
+`dcode` never writes the managed file. Users can still save a preference. The
+theme, terminal-mapping, UI-toggle, and MCP-server screens, and the
+`--auto-update` flag, report when a managed value keeps a saved preference from
+taking effect. The model-default, recent-model, and Auto-classifier writers
+refuse a value outside the effective allowlist, and report the policy as the
+reason. Other save paths do not check the allowlist.
+
+A missing managed file applies no policy. If one exists but is unreadable, not
+UTF-8, or invalid TOML, every command fails closed except the ones needed to
+diagnose it: `--help`, `--version`, `help`, `config`, `doctor`, and
+`auth path`. A managed file that becomes unusable later also blocks `/reload`:
+the session keeps the policy that was in force, and the reload reports that it
+kept it. Use `dcode config path` and `dcode doctor` to inspect its
+fixed path and parse health; `dcode config` also warns when the file exists but
+could not be parsed, or parses and declares a value that cannot be enforced.
+
+A deny list that cannot be read denies everything rather than nothing. This
+covers a managed `[mcp].disabled_servers` that is neither an array of names nor
+a comma-separated string, and a `[mcp]` section that is not a table. A managed
+`[mcp].enabled_project_server_approvals` that is not an array is treated the
+same way: the key is present, so policy means to narrow access, and reading its
+presence as absence would leave both the user's approvals and the
+`DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` bypass in force.
+
+A corrupt `~/.deepagents/config.toml` does not disable managed policy: the user
+file is ignored and managed values still apply.
+
+Deployment tooling must create and protect this file with administrator or root
+permissions. `dcode` does not validate the file owner or mode. `dcode` provides
+no privileged writer. Deployment and `sudo` policy are the administrator's
+responsibility.
+
+## 📖 Resources
+
+- **[Documentation](https://docs.langchain.com/deepagents-code)**
+- **[Changelog](https://github.com/langchain-ai/deepagents/blob/main/libs/code/CHANGELOG.md)**
+- **[Source code](https://github.com/langchain-ai/deepagents/tree/main/libs/code)**
+- **[Deep Agents SDK](https://github.com/langchain-ai/deepagents)** — underlying agent harness
+- [LangChain Academy](https://academy.langchain.com/) — Comprehensive, free courses on LangChain libraries and products, made by the LangChain team.
+- [Code of Conduct](https://github.com/langchain-ai/langchain/?tab=coc-ov-file) — community guidelines and standards
+
+## 📕 Releases & Versioning
+
+See our [Releases](https://docs.langchain.com/oss/python/release-policy) and [Versioning](https://docs.langchain.com/oss/python/versioning) policies.
+
+## 💁 Contributing
+
+As an open-source project in a rapidly developing field, we are extremely open to contributions, whether it be in the form of a new feature, improved infrastructure, or better documentation.
+
+For detailed information on how to contribute, see the [Contributing Guide](https://docs.langchain.com/oss/python/contributing/overview).
+
+## 🤝 Acknowledgements
+
+This project was primarily inspired by Claude Code, and initially was largely an attempt to see what made Claude Code general purpose, and make it even more so.