deepagents-code 0.1.63__tar.gz → 0.1.65__tar.gz

{deepagents_code-0.1.63 → deepagents_code-0.1.65}/AGENTS.md

@@ -126,7 +126,7 @@ Debug logging is configured **once**, on the `deepagents_code` package logger, b
 
 - Do **not** add per-module `configure_debug_logging(logger)` calls. They are redundant now that the package logger is configured at import, and they reintroduce the duplicate-handler problem the single-config approach solves.
 - Every module should create its logger with `logging.getLogger(__name__)` so it stays inside the `deepagents_code.*` hierarchy and inherits the package handler. Don't set `logger.propagate = False` or attach your own handlers.
-- The **file** handler only attaches when `DEEPAGENTS_CODE_DEBUG` is truthy; that path is a single env-var read, so it's safe on the startup hot path. See `DEVELOPMENT.md` for the `DEEPAGENTS_CODE_DEBUG` / `DEEPAGENTS_CODE_DEBUG_FILE` / `DEEPAGENTS_CODE_LOG_LEVEL` env vars.
+- The **file** handler only attaches when `DEEPAGENTS_CODE_DEBUG` is truthy and the active thread is known; that path is a small env-var read and filesystem operation, so it's safe on the startup hot path. See `DEVELOPMENT.md` for the `DEEPAGENTS_CODE_DEBUG` / `DEEPAGENTS_CODE_DEBUG_DIRECTORY` / `DEEPAGENTS_CODE_LOG_LEVEL` env vars.
 - Separately, an **always-on in-memory ring buffer** (`_debug_buffer.install_log_buffer`, called from `__init__.py` right before `configure_debug_logging`) attaches unconditionally at import so the in-app Debug Console (`Ctrl+\`) can tail recent `deepagents_code.*` records without file logging. It captures `INFO` and above by default (or `DEEPAGENTS_CODE_LOG_LEVEL`), and may lower the package logger to `INFO` for the process lifetime. It never spills to the terminal (a handler is always found, so `lastResort` is skipped) and is bounded (a `deque` of 1000 records *per log level*), so it's cheap enough to keep on. Because it installs *before* `configure_debug_logging`, warnings that helper emits at startup are captured and visible in the console.
 
 ## CLI help screen
@@ -139,7 +139,7 @@ Hints that tell the user to run something (for example the teardown `-r <thread>
 
 ## Splash screen tips
 
-When adding a user-facing CLI feature (new slash command, keybinding, workflow), add a corresponding entry to the `_TIPS` dict in `deepagents_code/tui/widgets/startup_tip.py`, mapping the tip text to a relative selection weight (higher = shown more often). One tip is chosen at random above the input on startup to help users discover features. Keep tips short and action-oriented (e.g., `"Press ctrl+x to compose prompts in your external editor"`).
+When adding a user-facing CLI feature (new slash command, keybinding, workflow), add a corresponding entry to the `_TIPS` dict in `deepagents_code/tui/widgets/startup_tip.py`, mapping the tip text to a relative selection weight (higher = shown more often). One tip is chosen at random above the input on startup to help users discover features. Keep tips short and action-oriented (e.g., `"Press ctrl+g to compose prompts in your external editor"`).
 
 ## Slash commands
 
@@ -170,6 +170,6 @@ To add a new slash command: (1) add a `SlashCommand` entry to `COMMANDS`, (2) se
 **Not required** unless the provider's models have a distinctive name prefix (like `gpt-*`, `claude*`, `gemini*`):
 
 - `detect_provider()` in `config.py` — only needed for auto-detection from bare model names
-- `Settings.has_*` property in `config.py` — only needed if referenced by `detect_provider()` fallback logic
+- `Credentials.has_*` property in `config.py` — only needed if referenced by `detect_provider()` fallback logic
 
 Model discovery, credential checking, and UI integration are automatic once `PROVIDER_API_KEY_ENV` is populated and the `langchain-*` package is installed.

{deepagents_code-0.1.63 → deepagents_code-0.1.65}/ARCHITECTURE.md

@@ -59,6 +59,8 @@ The main extension points are:
 - **Tools and MCP servers** for external capabilities
 - **Sandboxes** for changing where tool execution happens
 - **Hooks and commands** for integrating with local workflows
+- **Python extensions** for middleware, tools, and virtual storage routes,
+  loaded from user-authorized sources or a trusted project
 
 These pieces are designed to compose. A project can provide shared defaults and integrations, while each user can layer personal configuration on top.
 
@@ -79,7 +81,10 @@ The main cost is the client/server boundary. When debugging, first decide which
 - For local setup and debugging, see [`DEVELOPMENT.md`](./DEVELOPMENT.md).
 - For command behavior, see [`COMMANDS.md`](./COMMANDS.md).
 - For lifecycle hooks (`hooks.json`), see [`HOOKS.md`](./HOOKS.md).
+- For server-side Python extensions, see [`EXTENSIONS.md`](./EXTENSIONS.md).
 - For cost estimates and local pricing overrides (`prices.json`), see
   [`PRICING.md`](./PRICING.md).
 - For security boundaries, see [`THREAT_MODEL.md`](./THREAT_MODEL.md).
+- For how a transient model failure is retried after output has already streamed,
+  see [`STREAMING_RETRY_DESIGN.md`](./STREAMING_RETRY_DESIGN.md).
 - For package-specific coding conventions, see [`AGENTS.md`](./AGENTS.md).

{deepagents_code-0.1.63 → deepagents_code-0.1.65}/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.65](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.64...deepagents-code==0.1.65) (2026-08-28)
+
+### Features
+
+- Added Python extension support, including discovery, configuration and loading, runtime hosting, and trust and inspection UX ([#5631](https://github.com/langchain-ai/deepagents/issues/5631), [#5632](https://github.com/langchain-ai/deepagents/issues/5632), [#5633](https://github.com/langchain-ai/deepagents/issues/5633), [#5634](https://github.com/langchain-ai/deepagents/issues/5634))
+- Added a `/summarization-model` command and model picker for configuring the summarization model ([#5884](https://github.com/langchain-ai/deepagents/issues/5884), [#5932](https://github.com/langchain-ai/deepagents/issues/5932))
+- Added support for optional extra uninstall commands ([#5875](https://github.com/langchain-ai/deepagents/issues/5875))
+- Added an option to show visible reasoning ([#5887](https://github.com/langchain-ai/deepagents/issues/5887))
+
+### Bug Fixes
+
+- Improved model and task reliability by retrying interrupted model streams, recovering stale pending work before compaction, and isolating parallel `task` failures ([#5905](https://github.com/langchain-ai/deepagents/issues/5905), [#5909](https://github.com/langchain-ai/deepagents/issues/5909), [#5954](https://github.com/langchain-ai/deepagents/issues/5954))
+- Improved server restart handling by waiting for graph readiness before continuing ([#5947](https://github.com/langchain-ai/deepagents/issues/5947))
+- Capped MCP tool names for provider compatibility ([#5953](https://github.com/langchain-ai/deepagents/issues/5953))
+- Fixed Auto approval gate path expansion handling and now records Auto classifier deadline misses as traced errors ([#5941](https://github.com/langchain-ai/deepagents/issues/5941), [#5944](https://github.com/langchain-ai/deepagents/issues/5944))
+- Completed ASCII UI fallbacks and hid inactive F2 tool hints ([#5930](https://github.com/langchain-ai/deepagents/issues/5930), [#5939](https://github.com/langchain-ai/deepagents/issues/5939))
+- Isolated debug logs by thread ([#5921](https://github.com/langchain-ai/deepagents/issues/5921))
+- Updated rubric grader model changes to apply without a restart ([#5885](https://github.com/langchain-ai/deepagents/issues/5885))
+
+## [0.1.64](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.63...deepagents-code==0.1.64) (2026-08-28)
+
+### Features
+
+- Added trace metadata attribution for skill invocations ([#5925](https://github.com/langchain-ai/deepagents/issues/5925)).
+- Added a list of MCP servers that require login ([#5867](https://github.com/langchain-ai/deepagents/issues/5867)).
+- Added the ability to copy the current model from the picker header ([#5904](https://github.com/langchain-ai/deepagents/issues/5904)).
+- Linked the doctor commit hash to GitHub ([#5920](https://github.com/langchain-ai/deepagents/issues/5920)).
+- Standardized the external editor shortcut ([#5911](https://github.com/langchain-ai/deepagents/issues/5911)).
+
+### Bug Fixes
+
+- Deferred recursion-limit handling to the LangGraph server ([#5882](https://github.com/langchain-ai/deepagents/issues/5882)).
+- Disabled Git terminal prompts in `execute` ([#5878](https://github.com/langchain-ai/deepagents/issues/5878)).
+- Improved privacy and debug-only visibility for MCP token and editable paths ([#5866](https://github.com/langchain-ai/deepagents/issues/5866), [#5850](https://github.com/langchain-ai/deepagents/issues/5850)).
+- Updated the model-switch warning to point to `/offload` ([#5901](https://github.com/langchain-ai/deepagents/issues/5901)).
+- Rejected stale successful updates ([#5847](https://github.com/langchain-ai/deepagents/issues/5847)).
+- Fixed thread timestamp rendering on systems without the glibc-only `%-I` `strftime` flag ([#5886](https://github.com/langchain-ai/deepagents/issues/5886)).
+- Respected ASCII mode in the splash border ([#5923](https://github.com/langchain-ai/deepagents/issues/5923)).
+- Skipped unchanged config writes ([#5919](https://github.com/langchain-ai/deepagents/issues/5919)).
+- Skipped uncorrelated-result warnings for auto-mode policy denials ([#5869](https://github.com/langchain-ai/deepagents/issues/5869)).
+
 ## [0.1.63](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.62...deepagents-code==0.1.63) (2026-08-26)
 
 ### Features

{deepagents_code-0.1.63 → deepagents_code-0.1.65}/COMMANDS.md

@@ -8,7 +8,7 @@ Regenerate this file with `make commands-catalog` after changing command names,
 aliases, descriptions, visibility, or hidden-command metadata.
 
 
-## Public (42)
+## Public (45)
 
 | Command | Aliases | Description |
 | --- | --- | --- |
@@ -25,6 +25,7 @@ aliases, descriptions, visibility, or hidden-command metadata.
 | `/docs` |  | Open the docs |
 | `/editor` |  | Open prompt in an external editor ($EDITOR) |
 | `/effort` |  | Set reasoning effort for the current model |
+| `/extensions` |  | List loaded Python extensions and their provenance |
 | `/feedback` |  | Send feedback or report an issue |
 | `/force-clear` |  | Recover a stuck session with a fresh thread |
 | `/goal` |  | Set and manage a persistent objective with acceptance criteria |
@@ -45,12 +46,14 @@ aliases, descriptions, visibility, or hidden-command metadata.
 | `/rubric` | `/criteria` | Set explicit acceptance criteria for rubric grading |
 | `/scrollbar` |  | Show or hide the chat scrollbar |
 | `/skill-creator` |  | Create or refine agent skills |
+| `/summarization-model` |  | Set the model used for context-compaction summaries |
 | `/theme` |  | Change color theme |
 | `/threads` |  | Browse and resume past threads |
 | `/timestamps` |  | Show or hide message timestamps |
 | `/tokens` |  | Show token usage |
 | `/tools` |  | List the tools available to the agent |
 | `/trace` |  | Open this thread in LangSmith |
+| `/uninstall` |  | Remove an installed optional extra |
 | `/update` |  | Check for and install updates |
 | `/version` | `/about` | Show version information |
 | `/yolo` |  | Switch to YOLO approval mode (no review) |

{deepagents_code-0.1.63 → deepagents_code-0.1.65}/DEVELOPMENT.md

@@ -102,14 +102,15 @@ uv run deepagents-code
 | Variable | Effect |
 | --- | --- |
 | `DEEPAGENTS_CODE_DEBUG` | Master switch. Preserves the server subprocess log on exit (printing its path to stderr) and attaches the client `DEBUG` file handler. Truthy: `1`/`true`/`yes`/`on` (case-insensitive). Falsy: `0`/`false`/`no`/`off`/empty/unset. |
-| `DEEPAGENTS_CODE_DEBUG_FILE=<path>` | Overrides the client log path (default `/tmp/deepagents_debug.log`). **Only takes effect when `DEEPAGENTS_CODE_DEBUG` is truthy**; does **not** affect the server subprocess log. |
+| `DEEPAGENTS_CODE_DEBUG_DIRECTORY=<path>` | Overrides the client log directory (default `/tmp/deepagents_debug`). Each thread writes to `<thread-id>.log`. **Only takes effect when `DEEPAGENTS_CODE_DEBUG` is truthy**; does **not** affect the server subprocess log. |
+| `DEEPAGENTS_CODE_DEBUG_FILE=<path>` | Deprecated compatibility override. When `DEEPAGENTS_CODE_DEBUG_DIRECTORY` and `[debug].directory` are unset, per-thread logs use this path's parent directory. Existing `[debug].file` config works the same way. |
 
 Then pick the log you need by symptom:
 
 | Symptom | Log you want | Default location |
 | --- | --- | --- |
 | App crashes on launch (one-line failure banner) | **Server subprocess log** — the real traceback | `$TMPDIR/deepagents_server_log_*.txt` |
-| App starts, then misbehaves (UI, model calls, slash commands) | **Client app log** — `deepagents_code` at `DEBUG` | `/tmp/deepagents_debug.log` |
+| App starts, then misbehaves (UI, model calls, slash commands) | **Client app log** — `deepagents_code` at `DEBUG` | `/tmp/deepagents_debug/<thread-id>.log` |
 
 ### Startup crash -> server subprocess log
 
@@ -133,12 +134,12 @@ The TUI only surfaces a one-line banner; the actual exception lives in the subpr
 For problems that appear after the app is up, tail the client log in another terminal while reproducing:
 
 ```bash
-tail -f /tmp/deepagents_debug.log
+tail -f /tmp/deepagents_debug/<thread-id>.log
 ```
 
-To send it elsewhere, also `export DEEPAGENTS_CODE_DEBUG_FILE=<path>`. The handler appends across runs, so a single file accumulates every session.
+To send logs elsewhere, also `export DEEPAGENTS_CODE_DEBUG_DIRECTORY=<path>`. Each thread gets its own append-only file, and changing threads in the app switches the active log file.
 
-The file is created or tightened to user-only access. A symlink at the path is refused. If the file cannot be secured, no file handler is attached and a warning goes to stderr. Use the in-app Debug Console in that case.
+The directory is created or tightened to owner-only access, and each file is created or tightened to user-only access. Symlinks are refused. If either cannot be secured, no file handler is attached and a warning goes to stderr. Use the in-app Debug Console in that case.
 
 Stdio MCP server stderr is captured here at `DEBUG`. This keeps server-side failures visible when the TUI cannot show process stderr. Each record is one line, capped at 4096 characters. Characters in the Unicode `C` categories are removed, which includes control and format characters. The ESC byte of an ANSI sequence is removed but the rest stays as literal text, so the log is not free of escape-sequence residue. The text comes from the server. It can contain credentials or other sensitive values. Enable `DEBUG` logging only if you accept that risk, and do not share the log file.
 

deepagents_code-0.1.65/EXTENSIONS.md

@@ -0,0 +1,148 @@
+# Python extensions
+
+Python extensions customize the agent server without modifying `dcode`. They
+are experimental and load only when `DEEPAGENTS_CODE_EXPERIMENTAL=1` is set
+before starting `dcode`.
+
+An installed plugin declares one or more Python entry files in its manifest:
+
+```json
+{
+  "name": "shared-memory",
+  "version": "1.0.0",
+  "extensions": {
+    "com.langchain.deepagents.code": {
+      "pythonExtensions": "./extension.py"
+    }
+  }
+}
+```
+
+The entry file exposes an async `extension` setup function. See
+[`memory_store.py`](./examples/extensions/memory_store.py) for an example that
+registers a shared `/memories/` storage route.
+
+Install and enable the plugin through the normal plugin commands, then run
+`/restart`. Backend composition happens while the agent graph is built, so
+backend route changes cannot be applied by `/reload`. A separately managed
+remote agent server must be restarted or redeployed by its operator.
+
+The `/memories/` route makes shared storage available to model file
+operations. It does not automatically move dcode's built-in `AGENTS.md` memory.
+An extension that wants that content in the model's prompt must also register
+middleware that reads the shared location.
+
+## Supported registrations
+
+| Method | Purpose |
+| --- | --- |
+| `register_middleware(class_or_instance)` | Add LangChain `AgentMiddleware`. Classes must have a zero-argument constructor; use an instance otherwise. |
+| `register_tool(function_or_tool)` | Expose a callable or `BaseTool` to the model. |
+| `register_backend_route(prefix, storage)` | Make a `BackendProtocol` storage provider available under a virtual path. |
+| `on_shutdown(callback)` | Release session resources when the agent server stops. Sync and async callbacks are supported. |
+
+The factory must be declared with `async def`; dcode awaits every factory before
+building the agent. The registrar remains valid for callbacks that outlive the
+factory. Runtime tools appear on the next model request, backend routes update
+the registry but require `/restart`, and middleware also takes effect after the
+next server rebuild. `/extensions` reports when a restart is required.
+
+Do not open long-lived connections or start background tasks during module
+import. A storage provider may connect lazily on first use. If setup opens a
+session resource, register an idempotent `on_shutdown` callback to release it.
+
+The API exposes read-only session context (`d.cwd`, `d.mode`, `d.has_ui`, and
+`d.path`), not mutable TUI or thread state. Custom slash commands are not part
+of this API. Run `/extensions` to inspect registered units and their source.
+
+## Storage routes
+
+`BackendProtocol` is the SDK name for a storage implementation. Route prefixes
+are lowercase absolute paths with leading and trailing slashes, such as
+`/memories/` or `/company/knowledge/`. Traversal, empty segments, backslashes,
+URL query or fragment syntax, and overlaps with dcode's internal routes are
+rejected.
+
+Routed content is available through the model's file tools. Shell `execute`
+remains attached to the default local or sandbox storage, so shell commands
+cannot see virtual routed content.
+
+Local agents may mount `FilesystemBackend` and `LocalShellBackend`. Sandboxed
+agents reject direct instances of either class, including subclasses, because
+they would expose host storage while `execute` still runs inside the sandbox.
+Other `BackendProtocol` implementations such as `StateBackend`, `StoreBackend`,
+and `ContextHubBackend` are supported. This check is intentionally shallow:
+dcode does not recursively inspect custom or composite backend wrappers, whose
+authors own their isolation contract.
+
+The first extension registration of a route prefix or unit name wins. Extension
+tools and middleware replace same-named built-ins. A route that is a parent or
+child of dcode's artifact or conversation-history storage fails agent
+construction or runtime registration immediately; internal routes cannot be
+replaced.
+
+## Packaging, discovery, and trust
+
+For quick user-wide extensions, place Python files in
+`~/.deepagents/extensions/`. Installed plugins remain the preferred
+distribution mechanism: they provide stable identity, versions, updates, and a
+durable data directory. Dcode resolves plugin manifest entries inside the
+installed snapshot and rejects traversal, absolute paths, symlink escapes,
+missing files, and non-Python files. Entries without a plugin version are
+ignored. Installed Python distributions may also expose module entry points in
+the `dcode.extensions` group.
+
+Sources load in this order:
+
+| Source | Version and trust behavior |
+| --- | --- |
+| `~/.deepagents/extensions/` | User-owned loose files; implicitly authorized. |
+| `[extensions].extra_files` and `extra_dirs` | Explicit paths in trusted user configuration. |
+| `-e/--extension PATH` | Temporary file or directory authorized for one run. |
+| Enabled installed plugins | Identified by `name@marketplace`, loaded from the versioned plugin cache. Installing and enabling the plugin authorizes its code. |
+| `dcode.extensions` entry points | Modules from installed Python distributions. |
+| `.deepagents/extensions/` | Project-controlled and normally versioned with the project; never scanned before project trust. |
+
+The project directory is the local development escape hatch. Its scan is
+shallow: direct `*.py` files are extensions, and a direct subdirectory is a
+package extension when it contains `__init__.py` or `extension.py`.
+
+Project extensions execute arbitrary Python with the user's process privileges.
+Interactive launches ask before loading them and can remember the canonical
+project path. Headless or CI launches can opt in for one run with
+`--trust-project-extensions`. Only trust projects you control.
+
+## Configuration
+
+```toml
+# ~/.deepagents/config.toml
+[extensions]
+enabled = true
+trust = "ask"  # ask | always | never
+extra_files = ["~/src/policy.py"]
+extra_dirs = ["~/src/company-extensions"]
+```
+
+Environment overrides:
+
+- `DEEPAGENTS_CODE_EXTENSIONS` enables or disables all extension loading.
+- `DEEPAGENTS_CODE_EXTENSIONS_TRUST` overrides the project trust policy.
+
+Relative extra paths resolve from `~/.deepagents/`. Repeat `-e PATH` to add
+multiple temporary sources for one invocation.
+
+## Failure and security behavior
+
+Each setup function is transactional. If import or initialization fails, all of
+that extension's partial registrations are removed and later extensions still
+load. Failures are written to the debug log.
+
+Extension tools override same-named built-ins and are not automatically added to
+dcode's human-approval map. An extension that performs sensitive work must
+enforce its own approval or policy through middleware.
+
+Every registration retains its plugin ID, version, installed root, and source
+scope. This attribution tells dcode which extension added a storage route; it
+does not prove that an arbitrary storage implementation is safe. A provider can
+access the network or host files, so install plugins only from trusted sources
+and choose shared namespaces that preserve tenant and user isolation.

{deepagents_code-0.1.63 → deepagents_code-0.1.65}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: deepagents-code
-Version: 0.1.63
+Version: 0.1.65
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://www.langchain.com/dcode
 Project-URL: Documentation, https://docs.langchain.com/oss/deepagents/code/overview
@@ -30,21 +30,21 @@ Requires-Python: <4.0,>=3.12
 Requires-Dist: aiosqlite<1.0.0,>=0.22.1
 Requires-Dist: anyio<5.0.0,>=4.14.2
 Requires-Dist: deepagents-acp<1.0.0,>=0.0.10
-Requires-Dist: deepagents==0.7.9
+Requires-Dist: deepagents==0.7.10
 Requires-Dist: filelock<3.30,>=3.29.7
 Requires-Dist: genai-prices<0.2.0,>=0.1.4
 Requires-Dist: httpx<1.0.0,>=0.28.1
-Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.5
+Requires-Dist: langchain-anthropic<2.0.0,>=1.7.0
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.7
 Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.2
 Requires-Dist: langchain-openai<2.0.0,>=1.6.0
 Requires-Dist: langchain-quickjs<0.4.0,>=0.3.4
-Requires-Dist: langchain<2.0.0,>=1.3.17
+Requires-Dist: langchain<2.0.0,>=1.3.18
 Requires-Dist: langgraph-checkpoint-sqlite<4.0.0,>=3.1.1
 Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.31
-Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.33.0
-Requires-Dist: langgraph-sdk<1.0.0,>=0.4.3
-Requires-Dist: langsmith[sandbox]>=0.11.1
+Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.33.2
+Requires-Dist: langgraph-sdk<1.0.0,>=0.4.4
+Requires-Dist: langsmith[sandbox]>=0.11.2
 Requires-Dist: markdownify<2.0.0,>=1.2.3
 Requires-Dist: mcp<2.0.0,>=1.28.1
 Requires-Dist: packaging>=26.2
@@ -66,13 +66,13 @@ Provides-Extra: agentcore
 Requires-Dist: langchain-agentcore-codeinterpreter<1.0.0,>=0.0.5; extra == 'agentcore'
 Provides-Extra: all-providers
 Requires-Dist: aiohttp<3.15.0,>=3.14.3; extra == 'all-providers'
-Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1; extra == 'all-providers'
-Requires-Dist: langchain-aws<2.0.0,>=1.7.3; extra == 'all-providers'
-Requires-Dist: langchain-baseten<1.0.0,>=0.2.3; extra == 'all-providers'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.7.0; extra == 'all-providers'
+Requires-Dist: langchain-aws<2.0.0,>=1.7.4; extra == 'all-providers'
+Requires-Dist: langchain-baseten<1.0.0,>=0.2.4; extra == 'all-providers'
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'all-providers'
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'all-providers'
-Requires-Dist: langchain-fireworks<2.0.0,>=1.6.0; extra == 'all-providers'
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.5; extra == 'all-providers'
+Requires-Dist: langchain-fireworks<2.0.0,>=1.6.1; extra == 'all-providers'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.7; extra == 'all-providers'
 Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.4; extra == 'all-providers'
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'all-providers'
 Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'all-providers'
@@ -94,11 +94,11 @@ Requires-Dist: langchain-modal>=0.0.5; extra == 'all-sandboxes'
 Requires-Dist: langchain-runloop>=0.0.6; extra == 'all-sandboxes'
 Requires-Dist: langchain-vercel-sandbox>=0.0.1; extra == 'all-sandboxes'
 Provides-Extra: anthropic
-Requires-Dist: langchain-anthropic<2.0.0,>=1.6.1; extra == 'anthropic'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.7.0; extra == 'anthropic'
 Provides-Extra: baseten
-Requires-Dist: langchain-baseten<1.0.0,>=0.2.3; extra == 'baseten'
+Requires-Dist: langchain-baseten<1.0.0,>=0.2.4; extra == 'baseten'
 Provides-Extra: bedrock
-Requires-Dist: langchain-aws<2.0.0,>=1.7.3; extra == 'bedrock'
+Requires-Dist: langchain-aws<2.0.0,>=1.7.4; extra == 'bedrock'
 Provides-Extra: cohere
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'cohere'
 Provides-Extra: daytona
@@ -106,9 +106,9 @@ Requires-Dist: langchain-daytona>=0.0.7; extra == 'daytona'
 Provides-Extra: deepseek
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'deepseek'
 Provides-Extra: fireworks
-Requires-Dist: langchain-fireworks<2.0.0,>=1.6.0; extra == 'fireworks'
+Requires-Dist: langchain-fireworks<2.0.0,>=1.6.1; extra == 'fireworks'
 Provides-Extra: google-genai
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.5; extra == 'google-genai'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.3.7; extra == 'google-genai'
 Provides-Extra: groq
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'groq'
 Provides-Extra: huggingface
@@ -200,128 +200,6 @@ By default, `dcode` trusts the directory you run it in. Human-in-the-loop approv
 
 Do not run `dcode` in a directory you do not trust without a sandbox backend. For untrusted repositories, use a [remote sandbox](https://docs.langchain.com/oss/python/deepagents/code/remote-sandboxes) so execution is isolated from your machine. Running `dcode` in a directory lets that directory's files shape execution. See [`THREAT_MODEL.md`](https://github.com/langchain-ai/deepagents/blob/main/libs/code/THREAT_MODEL.md) for details.
 
-## Managed configuration
-
-Administrators can enforce any supported `config.toml` setting with a read-only
-`managed_config.toml` using the same TOML schema:
-
-- macOS: `/Library/Application Support/dcode/managed_config.toml`
-- Windows: the `ProgramData` directory reported by the registry, usually
-  `C:\ProgramData\dcode\managed_config.toml`. The `%ProgramData%` environment
-  variable is ignored, because any user can change it.
-- Linux and other supported POSIX systems: `/etc/dcode/managed_config.toml`
-
-Managed values override two lower layers: the `DEEPAGENTS_CODE_` and
-compatibility environment variables, and `~/.deepagents/config.toml`.
-
-For an agent launch, managed values also override these CLI flags: the model,
-the auto-classifier model, the interpreter toggle, the programmatic tool-calling
-list, the recursion limit, the shell allow list, and the startup mode. A managed
-`[sandboxes].default` names the backend of a launch that is already sandboxed;
-it does not sandbox a launch that asked for no sandbox. A managed startup mode
-only revokes `--auto-approve` and `--yolo`; the mode itself reaches the runtime
-through the merged configuration, so a headless launch still works. Subcommand
-display flags such as `dcode threads --relative` are not overridden.
-
-Tables merge recursively. Deny lists are unioned. An explicitly managed allow or
-trust list replaces lower-precedence grants. An empty managed list removes every
-lower-precedence grant.
-
-A managed value whose type contradicts the manifest is ignored, and the
-lower-precedence value stays in effect. Two exceptions:
-
-- The enforced keys (`startup.mode`, `startup.yolo_switcher`,
-  `shell.allow_list`, `skills.extra_allowed_dirs`,
-  `interpreter.enable_interpreter`, `interpreter.ptc`,
-  `interpreter.ptc_acknowledge_unsafe`, `models.allowed`,
-  `models.auto_classifier`, `runtime.recursion_limit`, `sandboxes.default`,
-  `tracing.langsmith_redact`)
-  stop every command except `config`, `doctor`, `auth path`, and the help
-  screens. If one is ignored, the user's flag or environment variable stays in
-  force. This grants the escalation, or it removes the boundary that the policy
-  declared. Three
-  cases stop the launch and block `/reload`: a value the manifest rejects, a
-  `runtime.recursion_limit` outside its bounds, and a key shadowed by a scalar
-  ancestor (`startup = "manual"` in place of `[startup]` and `mode`). A managed
-  `[sandboxes].default` that names an unavailable backend stops a sandboxed
-  launch; a launch that asked for no sandbox is unaffected. A scalar at any
-  known configuration section (for example, `threads = "bad"` instead of
-  `[threads]`) also stops launch and reload rather than replacing the user's
-  whole section.
-- Inside structured tables (`[models.providers]`, `[themes]`,
-  `[async_subagents]`, `[sandboxes.providers]`) the dedicated typed reader
-  validates instead, so a wrong-typed managed leaf can displace a valid user
-  leaf. The reader then falls back to the built-in default. A managed scalar
-  still replaces a colliding user table there, the same as on the top-level
-  merge.
-
-`[shell].allow_list` is read from `~/.deepagents/config.toml` and from
-`DEEPAGENTS_CODE_SHELL_ALLOW_LIST`, so a managed file can enforce it. A user can
-also grant themselves shell auto-approval from their own config file. An empty
-managed list removes every lower-precedence grant.
-
-`[models].allowed` narrows dcode to exact `provider:model` specifications:
-
-```toml
-[models]
-allowed = ["acme:production", "acme:production-fast"]
-```
-
-The rules:
-
-- A missing key preserves unrestricted model selection.
-- An empty list blocks all local model use.
-- A list that dcode cannot parse also blocks all local model use. A typo must not
-  silently remove the restriction the user asked for. Fix or remove the key.
-- Matching is exact and splits only the first colon, so model identifiers may
-  contain additional colons. Matching is also case-sensitive.
-- Entries must be fully qualified. A bare model name that you type at a prompt
-  is first resolved to `provider:model`, the same as at construction, so
-  `gpt-5.6-terra` matches an `openai:gpt-5.6-terra` entry. A bare name whose
-  provider dcode cannot infer never matches.
-- Write a Bedrock model as `bedrock:<id>`. A bare Bedrock ID is rejected,
-  because its version colon would make it a specification that nothing matches.
-- The list filters model discovery and the selector. Construction-time checks
-  are authoritative for CLI flags, runtime switches, Auto classifiers, rubric
-  graders, and explicit local subagent models.
-- A managed list replaces a user list. Managed default, recent, and
-  Auto-classifier models must also appear in it.
-- `[models.providers.<name>].models` registers models additively. It does not
-  grant permission, so a custom model may need both registration and an
-  allowlist entry.
-
-`dcode` never writes the managed file. Users can still save a preference. The
-theme, terminal-mapping, UI-toggle, and MCP-server screens, and the
-`--auto-update` flag, report when a managed value keeps a saved preference from
-taking effect. The model-default, recent-model, and Auto-classifier writers
-refuse a value outside the effective allowlist, and report the policy as the
-reason. Other save paths do not check the allowlist.
-
-A missing managed file applies no policy. If one exists but is unreadable, not
-UTF-8, or invalid TOML, every command fails closed except the ones needed to
-diagnose it: `--help`, `--version`, `help`, `config`, `doctor`, and
-`auth path`. A managed file that becomes unusable later also blocks `/reload`:
-the session keeps the policy that was in force, and the reload reports that it
-kept it. Use `dcode config path` and `dcode doctor` to inspect its
-fixed path and parse health; `dcode config` also warns when the file exists but
-could not be parsed, or parses and declares a value that cannot be enforced.
-
-A deny list that cannot be read denies everything rather than nothing. This
-covers a managed `[mcp].disabled_servers` that is neither an array of names nor
-a comma-separated string, and a `[mcp]` section that is not a table. A managed
-`[mcp].enabled_project_server_approvals` that is not an array is treated the
-same way: the key is present, so policy means to narrow access, and reading its
-presence as absence would leave both the user's approvals and the
-`DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` bypass in force.
-
-A corrupt `~/.deepagents/config.toml` does not disable managed policy: the user
-file is ignored and managed values still apply.
-
-Deployment tooling must create and protect this file with administrator or root
-permissions. `dcode` does not validate the file owner or mode. `dcode` provides
-no privileged writer. Deployment and `sudo` policy are the administrator's
-responsibility.
-
 ## 📖 Resources
 
 - **[Documentation](https://docs.langchain.com/deepagents-code)**

deepagents_code-0.1.65/README.md

@@ -0,0 +1,72 @@
+# 🧠🤖 Deep Agents Code
+
+[![PyPI - Version](https://img.shields.io/pypi/v/deepagents-code?label=%20)](https://pypi.org/project/deepagents-code/#history)
+[![PyPI - License](https://img.shields.io/pypi/l/deepagents-code)](https://opensource.org/licenses/MIT)
+[![PyPI - Downloads](https://img.shields.io/pepy/dt/deepagents-code)](https://pypistats.org/packages/deepagents-code)
+[![Twitter](https://img.shields.io/twitter/url/https/twitter.com/langchain_oss.svg?style=social&label=Follow%20%40LangChain)](https://x.com/langchain_oss)
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/langchain-ai/deepagents/main/libs/code/images/tui.png" alt="Deep Agents Code" width="600"/>
+</p>
+
+## Quick Install
+
+```bash
+curl -LsSf https://langch.in/dcode | bash
+```
+
+```bash
+# With model provider extras
+# OpenAI, Anthropic, and Gemini are included by default
+DEEPAGENTS_CODE_EXTRAS="nvidia,ollama" curl -LsSf https://langch.in/dcode | bash
+```
+
+Run:
+
+```bash
+dcode
+```
+
+## 🤔 What is this?
+
+The fastest way to start using Deep Agents. `deepagents-code` is a pre-built coding agent in your terminal — similar to Claude Code or Cursor — powered by any LLM that supports tool calling. One install command and you're up and running, no code required.
+
+**What `deepagents-code` adds on top of the SDK:**
+
+- **Interactive TUI** — rich terminal interface with streaming responses
+- **Conversation resume** — pick up where you left off across sessions
+- **Web search** — ground responses in live information
+- **Remote sandboxes** — run code in isolated environments (LangSmith, AgentCore, Daytona, Modal, Runloop, & more)
+- **Persistent memory** — agent remembers context across conversations
+- **Custom skills** — extend the agent with your own slash commands
+- **Headless mode** — run non-interactively for scripting and CI
+- **Human-in-the-loop** — approve or reject tool calls before execution
+
+## 🔒 Security model
+
+By default, `dcode` trusts the directory you run it in. Human-in-the-loop approval gates model-requested tool calls, but project artifacts are read before any approval prompt.
+
+Do not run `dcode` in a directory you do not trust without a sandbox backend. For untrusted repositories, use a [remote sandbox](https://docs.langchain.com/oss/python/deepagents/code/remote-sandboxes) so execution is isolated from your machine. Running `dcode` in a directory lets that directory's files shape execution. See [`THREAT_MODEL.md`](https://github.com/langchain-ai/deepagents/blob/main/libs/code/THREAT_MODEL.md) for details.
+
+## 📖 Resources
+
+- **[Documentation](https://docs.langchain.com/deepagents-code)**
+- **[Changelog](https://github.com/langchain-ai/deepagents/blob/main/libs/code/CHANGELOG.md)**
+- **[Source code](https://github.com/langchain-ai/deepagents/tree/main/libs/code)**
+- **[Deep Agents SDK](https://github.com/langchain-ai/deepagents)** — underlying agent harness
+- [LangChain Academy](https://academy.langchain.com/) — Comprehensive, free courses on LangChain libraries and products, made by the LangChain team.
+- [Code of Conduct](https://github.com/langchain-ai/langchain/?tab=coc-ov-file) — community guidelines and standards
+
+## 📕 Releases & Versioning
+
+See our [Releases](https://docs.langchain.com/oss/python/release-policy) and [Versioning](https://docs.langchain.com/oss/python/versioning) policies.
+
+## 💁 Contributing
+
+As an open-source project in a rapidly developing field, we are extremely open to contributions, whether it be in the form of a new feature, improved infrastructure, or better documentation.
+
+For detailed information on how to contribute, see the [Contributing Guide](https://docs.langchain.com/oss/python/contributing/overview).
+
+## 🤝 Acknowledgements
+
+This project was primarily inspired by Claude Code, and initially was largely an attempt to see what made Claude Code general purpose, and make it even more so.

{deepagents_code-0.1.63 → deepagents_code-0.1.65}/THREAT_MODEL.md

@@ -28,6 +28,7 @@
 - Custom subagent loader (`subagents.py`, `agent.py:load_async_subagents`)
 - Conversation offload (`offload.py`)
 - Skill management (`skills/commands.py`)
+- Python extension loading (`extensions/`)
 - Persisted goal/rubric state notices (`goal_state_notice.py`, `goal_tools.py`,
   `goal_state_limits.py`)
 
@@ -55,6 +56,8 @@
 7. `DA_SERVER_*` environment variables are readable only by the CLI process and its child server subprocess (OS process isolation assumption).
 8. Users who set `class_path` in `config.toml` accept the same trust model as `pyproject.toml` build scripts — they control their own machine.
 9. Administrators deploy and protect the fixed `managed_config.toml` path with operating-system controls; the CLI does not validate its owner or mode and never writes it.
+10. User-directory, user-config, CLI, installed-plugin, and Python entry-point extensions are authorized by the user action that supplied them. Project extensions execute only after explicit, configured, or persisted trust.
+11. Extension backend routes cannot overlap dcode's local artifact or conversation-history storage. A sandboxed agent rejects direct `FilesystemBackend` and `LocalShellBackend` mounts, including subclasses; wrapper implementations are responsible for their own isolation because dcode does not recursively inspect arbitrary backend object graphs.
 
 ---
 
@@ -140,7 +143,7 @@
 | C6  | Hook Runtime                | Fires subprocess commands on agent lifecycle events                                                                 | framework-controlled | No³      | `hooks.runtime.HooksRuntime`, `hooks.runner.run_command_handler`                                  |
 | C7  | Sandbox Integration         | Creates/destroys remote sandboxes (Daytona, LangSmith, Modal, Runloop, AgentCore)                                  | framework-controlled | No⁴      | `integrations.sandbox_factory.create_sandbox`                                                     |
 | C8  | Session Persistence         | SQLite checkpoint store for LangGraph thread state                                                                  | framework-controlled | Yes      | `sessions.get_db_path`, `sessions.generate_thread_id`                                             |
-| C9  | Configuration System        | Managed/user TOML, env vars, `AGENTS.md` system prompts, model config                                               | administrator/user-controlled | N/A | `configuration`, `config.settings`, `model_config.ModelConfig`, fixed managed path, `~/.deepagents/config.toml` |
+| C9  | Configuration System        | Managed/user TOML, env vars, `AGENTS.md` system prompts, model config                                               | administrator/user-controlled | N/A | `configuration`, `config.Credentials`, `config.RuntimeState`, `_paths.PATHS`, `model_config.ModelConfig`, fixed managed path, `~/.deepagents/config.toml` |
 | C10 | Unicode/URL Safety          | Detects hidden Unicode, checks URL domain spoofing for approval UI warnings                                         | framework-controlled | Yes      | `unicode_security.detect_dangerous_unicode`, `unicode_security.check_url_safety`                  |
 | C11 | LangGraph Dev Server        | Subprocess running `langgraph dev` with `LANGGRAPH_AUTH_TYPE=noop`; managed by `ServerProcess`                      | framework-controlled | Yes⁵     | `client.launch.server.ServerProcess.start`, `client.launch.server.generate_langgraph_json`, `client.launch.server_manager.start_server_and_get_agent` |
 | C12 | Remote Agent Client         | HTTP+SSE client wrapping `RemoteGraph`; connects to C11 on localhost                                                | framework-controlled | Yes⁵     | `client.remote_client.RemoteAgent.astream`, `client.remote_client.RemoteAgent.aget_state`         |

{deepagents_code-0.1.63 → deepagents_code-0.1.65}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "970003e"
+BUILD_COMMIT = "a233ded"