deepagents-code 0.1.65__tar.gz → 0.1.67__tar.gz

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/.gitignore

@@ -158,6 +158,7 @@ venv.bak/
 *.jks
 credentials.json
 token.json
+**/.deepagents/mcp-tokens/
 Cookies
 Cookies.db
 cookies.sqlite

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.67](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.66...deepagents-code==0.1.67) (2026-09-09)
+
+### Features
+
+- Added `GPT-6 Astra` support ([#6141](https://github.com/langchain-ai/deepagents/issues/6141)).
+- Reuses the server across workspace switches ([#6152](https://github.com/langchain-ai/deepagents/issues/6152)).
+- Limits thread resume age ([#6068](https://github.com/langchain-ai/deepagents/issues/6068)).
+
+### Bug Fixes
+
+- Improved workspace isolation by resolving project policy per workspace, scoping project dotenv to workspaces, and isolating LangSmith auth and workspace tracing ([#6064](https://github.com/langchain-ai/deepagents/issues/6064), [#5980](https://github.com/langchain-ai/deepagents/issues/5980), [#6061](https://github.com/langchain-ai/deepagents/issues/6061)).
+- Improved transcript tail reconciliation by bounding and serializing reconciliation work ([#6057](https://github.com/langchain-ai/deepagents/issues/6057), [#6143](https://github.com/langchain-ai/deepagents/issues/6143)).
+- Refuses a second sandbox workspace and moves sandbox creation and entry off the guarded event loop ([#5979](https://github.com/langchain-ai/deepagents/issues/5979), [#6017](https://github.com/langchain-ai/deepagents/issues/6017)).
+- Surfaces stale updates in-session ([#6063](https://github.com/langchain-ai/deepagents/issues/6063)).
+- Surfaces the LangSmith credential in `dcode config` ([#6083](https://github.com/langchain-ai/deepagents/issues/6083)).
+- Offloads server config imports ([#6089](https://github.com/langchain-ai/deepagents/issues/6089)).
+- Correctly parses extra skill directories with the platform separator ([#6151](https://github.com/langchain-ai/deepagents/issues/6151)).
+
+## [0.1.66](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.65...deepagents-code==0.1.66) (2026-09-03)
+
+### Features
+
+- Defaulted general-purpose subagents to fork mode ([#6024](https://github.com/langchain-ai/deepagents/issues/6024)).
+- Defaulted the Auto classifier by provider ([#6039](https://github.com/langchain-ai/deepagents/issues/6039)).
+- Added support for binding conversations to a recorded workspace ([#5946](https://github.com/langchain-ai/deepagents/issues/5946)).
+- Added tracing for the effective approval mode ([#5972](https://github.com/langchain-ai/deepagents/issues/5972)).
+
+### Bug Fixes
+
+- Fixed request-time working directory binding and now show the bound workspace in shell approvals ([#5968](https://github.com/langchain-ai/deepagents/issues/5968), [#5966](https://github.com/langchain-ai/deepagents/issues/5966)).
+- Fixed marketplace plugin installs to accept bare relative source paths and identify the rejected source path when validation fails ([#5959](https://github.com/langchain-ai/deepagents/issues/5959), [#5960](https://github.com/langchain-ai/deepagents/issues/5960)).
+- Classifier errors now include model names ([#6038](https://github.com/langchain-ai/deepagents/issues/6038)).
+- Updated the splash screen to use a sharp border ([#5970](https://github.com/langchain-ai/deepagents/issues/5970)).
+
+### Performance Improvements
+
+- Reduced QuickJS middleware tracing overhead by omitting trace inputs ([#6015](https://github.com/langchain-ai/deepagents/issues/6015)).
+
 ## [0.1.65](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.64...deepagents-code==0.1.65) (2026-08-28)
 
 ### Features

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/DEVELOPMENT.md

@@ -89,6 +89,8 @@ Set the same override for [local dev installs](#local-dev-installs) (`dcode-dev`
 
 When onboarding a new tracing project to Engine, capture the nature of that project first: a production/GA app warrants high-priority alerts, while a staging or active-dev project should use looser thresholds (or stay off Engine) so it does not generate false positives.
 
+A server keeps the first workspace's tracing configuration for its lifetime. Workspaces sharing that server must use matching tracing credentials, projects, endpoints, profile selectors, tracing flags, and redaction policy. A conflicting workspace is refused before its settings can affect cached or concurrent runs; start a separate server for that workspace. Restart the server to change its tracing configuration.
+
 ## Debugging
 
 Deep Agents Code runs as two processes: the **Textual TUI** you interact with, and a **`langgraph dev` subprocess** that hosts the agent graph. Each writes its own log, and a single switch turns both on:

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/Makefile

@@ -73,6 +73,7 @@ lint lint_diff lint_package lint_tests:
 	[ "$(PYTHON_FILES)" = "" ] || uv run --all-groups ruff format $(PYTHON_FILES) --diff
 	$(MAKE) type PYTHON_FILES="$(PYTHON_FILES)"
 	uv run --all-groups python scripts/generate_commands_catalog.py --check
+	uv run --all-groups python scripts/check_process_cwd.py deepagents_code
 
 type: ## Run type checker
 type typecheck:

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: deepagents-code
-Version: 0.1.65
+Version: 0.1.67
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://www.langchain.com/dcode
 Project-URL: Documentation, https://docs.langchain.com/oss/deepagents/code/overview
@@ -30,21 +30,21 @@ Requires-Python: <4.0,>=3.12
 Requires-Dist: aiosqlite<1.0.0,>=0.22.1
 Requires-Dist: anyio<5.0.0,>=4.14.2
 Requires-Dist: deepagents-acp<1.0.0,>=0.0.10
-Requires-Dist: deepagents==0.7.10
+Requires-Dist: deepagents==0.7.13
 Requires-Dist: filelock<3.30,>=3.29.7
-Requires-Dist: genai-prices<0.2.0,>=0.1.4
+Requires-Dist: genai-prices<0.2.0,>=0.1.6
 Requires-Dist: httpx<1.0.0,>=0.28.1
-Requires-Dist: langchain-anthropic<2.0.0,>=1.7.0
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.7
+Requires-Dist: langchain-anthropic<2.0.0,>=1.7.1
+Requires-Dist: langchain-google-genai<5.0.0,>=4.4.0
 Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.2
-Requires-Dist: langchain-openai<2.0.0,>=1.6.0
+Requires-Dist: langchain-openai<2.0.0,>=1.6.1
 Requires-Dist: langchain-quickjs<0.4.0,>=0.3.4
-Requires-Dist: langchain<2.0.0,>=1.3.18
+Requires-Dist: langchain<2.0.0,>=1.4.0
 Requires-Dist: langgraph-checkpoint-sqlite<4.0.0,>=3.1.1
 Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.31
-Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.33.2
+Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.34.0
 Requires-Dist: langgraph-sdk<1.0.0,>=0.4.4
-Requires-Dist: langsmith[sandbox]>=0.11.2
+Requires-Dist: langsmith[sandbox]>=0.12.2
 Requires-Dist: markdownify<2.0.0,>=1.2.3
 Requires-Dist: mcp<2.0.0,>=1.28.1
 Requires-Dist: packaging>=26.2
@@ -66,23 +66,23 @@ Provides-Extra: agentcore
 Requires-Dist: langchain-agentcore-codeinterpreter<1.0.0,>=0.0.5; extra == 'agentcore'
 Provides-Extra: all-providers
 Requires-Dist: aiohttp<3.15.0,>=3.14.3; extra == 'all-providers'
-Requires-Dist: langchain-anthropic<2.0.0,>=1.7.0; extra == 'all-providers'
-Requires-Dist: langchain-aws<2.0.0,>=1.7.4; extra == 'all-providers'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.7.1; extra == 'all-providers'
+Requires-Dist: langchain-aws<2.0.0,>=1.7.5; extra == 'all-providers'
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.4; extra == 'all-providers'
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'all-providers'
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'all-providers'
 Requires-Dist: langchain-fireworks<2.0.0,>=1.6.1; extra == 'all-providers'
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.7; extra == 'all-providers'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.4.0; extra == 'all-providers'
 Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.4; extra == 'all-providers'
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'all-providers'
 Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'all-providers'
 Requires-Dist: langchain-ibm<2.0.0,>=1.1.0; extra == 'all-providers'
-Requires-Dist: langchain-litellm<2.0.0,>=0.7.0; extra == 'all-providers'
+Requires-Dist: langchain-litellm<2.0.0,>=0.7.1; extra == 'all-providers'
 Requires-Dist: langchain-meta<2.0.0,>=0.5.0; extra == 'all-providers'
 Requires-Dist: langchain-mistralai<2.0.0,>=1.1.6; extra == 'all-providers'
 Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.4.3; extra == 'all-providers'
 Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'all-providers'
-Requires-Dist: langchain-openai<2.0.0,>=1.6.0; extra == 'all-providers'
+Requires-Dist: langchain-openai<2.0.0,>=1.6.1; extra == 'all-providers'
 Requires-Dist: langchain-openrouter<2.0.0,>=0.2.8; extra == 'all-providers'
 Requires-Dist: langchain-perplexity<2.0.0,>=1.4.1; extra == 'all-providers'
 Requires-Dist: langchain-together<2.0.0,>=0.4.0; extra == 'all-providers'
@@ -94,11 +94,11 @@ Requires-Dist: langchain-modal>=0.0.5; extra == 'all-sandboxes'
 Requires-Dist: langchain-runloop>=0.0.6; extra == 'all-sandboxes'
 Requires-Dist: langchain-vercel-sandbox>=0.0.1; extra == 'all-sandboxes'
 Provides-Extra: anthropic
-Requires-Dist: langchain-anthropic<2.0.0,>=1.7.0; extra == 'anthropic'
+Requires-Dist: langchain-anthropic<2.0.0,>=1.7.1; extra == 'anthropic'
 Provides-Extra: baseten
 Requires-Dist: langchain-baseten<1.0.0,>=0.2.4; extra == 'baseten'
 Provides-Extra: bedrock
-Requires-Dist: langchain-aws<2.0.0,>=1.7.4; extra == 'bedrock'
+Requires-Dist: langchain-aws<2.0.0,>=1.7.5; extra == 'bedrock'
 Provides-Extra: cohere
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'cohere'
 Provides-Extra: daytona
@@ -108,7 +108,7 @@ Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'deepseek'
 Provides-Extra: fireworks
 Requires-Dist: langchain-fireworks<2.0.0,>=1.6.1; extra == 'fireworks'
 Provides-Extra: google-genai
-Requires-Dist: langchain-google-genai<5.0.0,>=4.3.7; extra == 'google-genai'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.4.0; extra == 'google-genai'
 Provides-Extra: groq
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'groq'
 Provides-Extra: huggingface
@@ -116,7 +116,7 @@ Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'huggingface'
 Provides-Extra: ibm
 Requires-Dist: langchain-ibm<2.0.0,>=1.1.0; extra == 'ibm'
 Provides-Extra: litellm
-Requires-Dist: langchain-litellm<2.0.0,>=0.7.0; extra == 'litellm'
+Requires-Dist: langchain-litellm<2.0.0,>=0.7.1; extra == 'litellm'
 Provides-Extra: media
 Requires-Dist: av<19.0.0,>=18.0.0; extra == 'media'
 Requires-Dist: pillow<13.0.0,>=12.3.0; extra == 'media'
@@ -132,7 +132,7 @@ Requires-Dist: langchain-nvidia-ai-endpoints<2.0.0,>=1.4.3; extra == 'nvidia'
 Provides-Extra: ollama
 Requires-Dist: langchain-ollama<2.0.0,>=1.1.0; extra == 'ollama'
 Provides-Extra: openai
-Requires-Dist: langchain-openai<2.0.0,>=1.6.0; extra == 'openai'
+Requires-Dist: langchain-openai<2.0.0,>=1.6.1; extra == 'openai'
 Provides-Extra: openrouter
 Requires-Dist: langchain-openrouter<2.0.0,>=0.2.8; extra == 'openrouter'
 Provides-Extra: perplexity

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "a233ded"
+BUILD_COMMIT = "d0fbc7c"

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/deepagents_code/_cli_context.py

@@ -87,6 +87,8 @@ class CLIContextSchema:
 
     prompt_id: str | None = None
 
+    workspace: dict[str, Any] = field(default_factory=dict)
+
     @classmethod
     def from_payload(cls, payload: object) -> CLIContextSchema | None:
         """Coerce a run's `context=` payload into this schema.
@@ -159,6 +161,7 @@ class CLIContextSchema:
             hooks_snapshot_id=_str("hooks_snapshot_id"),
             hooks_server_events=events,
             prompt_id=_str("prompt_id"),
+            workspace=_mapping("workspace"),
         )
 
 
@@ -249,3 +252,6 @@ class CLIContext(TypedDict, total=False):
 
     prompt_id: str | None
     """Optional per-turn prompt id projected into hook context."""
+
+    workspace: dict[str, Any]
+    """Server-validated workspace binding for the active thread."""

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/deepagents_code/_constants.py

@@ -37,13 +37,28 @@ Hardcoded rather than read from `deepagents.middleware.rubric.RubricMiddleware`
 because this module is dependency-free and importing the SDK for a display
 string would violate the startup-performance rule (see AGENTS.md). This is a
 hand-maintained duplicate that can rot if the SDK bumps its default, so
-`test_reliable_rubric.py::TestReliableRubricMiddleware::test_displayed_max_iterations_default_matches_sdk`
+`test_reliable_rubric.py::TestRubricMiddlewareIntegration::test_displayed_max_iterations_default_matches_sdk`
 is the drift guard that fails when the two diverge.
 """
 
 FIREWORKS_PROVIDER_ID_PREFIX: Final[str] = "accounts/fireworks/"
 """Prefix used to infer Fireworks from fully-qualified IDs."""
 
+LANGSMITH_API_KEY_ENV: Final[str] = "LANGSMITH_API_KEY"
+"""Primary env var the LangSmith SDK reads for its API key."""
+
+LANGSMITH_API_KEY_FALLBACK_ENV_VARS: Final[tuple[str, ...]] = ("LANGCHAIN_API_KEY",)
+"""Legacy env vars the LangSmith SDK accepts after `LANGSMITH_API_KEY_ENV`."""
+
+LANGSMITH_API_KEY_ENV_VARS: Final[tuple[str, ...]] = (
+    LANGSMITH_API_KEY_ENV,
+    *LANGSMITH_API_KEY_FALLBACK_ENV_VARS,
+)
+"""Env vars LangSmith reads for its API key, in precedence order.
+
+Mirrors the SDK's own `LANGSMITH_`-then-`LANGCHAIN_` lookup.
+"""
+
 FIREWORKS_MODEL_ID_PREFIXES: Final[tuple[str, ...]] = (
     "accounts/fireworks/models/",
     "accounts/fireworks/routers/",

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/deepagents_code/_env_vars.py

@@ -24,6 +24,10 @@ ever renamed, only the value here changes.
 from __future__ import annotations
 
 import os
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from collections.abc import Mapping
 
 # ---------------------------------------------------------------------------
 # Constants — import these instead of bare string literals.
@@ -251,6 +255,15 @@ setting it (see `config._PROJECT_DOTENV_DENIED_ENV_KEYS`); only the user's
 shell, launch env, or global `~/.deepagents/.env` can.
 """
 
+FORKED_SUBAGENTS = "DEEPAGENTS_CODE_FORKED_SUBAGENTS"
+"""Whether dcode's built-in `general-purpose` subagent runs in fork mode.
+
+On by default. Set to a falsy value to make the subagent receive only the delegated
+task instead of inheriting the parent agent's conversation and state. Parsed by
+`is_env_truthy`; set this only through the launching shell or global
+`~/.deepagents/.env`, never a project `.env`.
+"""
+
 EXPERIMENTAL = "DEEPAGENTS_CODE_EXPERIMENTAL"
 """Opt into experimental, unstable dcode behavior.
 
@@ -276,7 +289,7 @@ EXTERNAL_EVENT_SOCKET_PATH = "DEEPAGENTS_CODE_EXTERNAL_EVENT_SOCKET_PATH"
 """Override the default Unix-socket path for the external event listener."""
 
 EXTRA_SKILLS_DIRS = "DEEPAGENTS_CODE_EXTRA_SKILLS_DIRS"
-"""Colon-separated paths added to the skill containment allowlist."""
+"""Paths added to the skill containment allowlist, split with `os.pathsep`."""
 
 GOAL_AUTO_ACCEPT_CRITERIA = "DEEPAGENTS_CODE_GOAL_AUTO_ACCEPT_CRITERIA"
 """Apply generated goal criteria automatically in Auto mode.
@@ -685,7 +698,12 @@ def classify_env_bool(raw: str) -> bool | None:
     return None
 
 
-def is_env_truthy(name: str, *, default: bool = False) -> bool:
+def is_env_truthy(
+    name: str,
+    *,
+    default: bool = False,
+    environ: Mapping[str, str] | None = None,
+) -> bool:
     """Return whether env var *name* is set to a recognizably truthy value.
 
     Unlike `bool(os.environ.get(name))`, this does not treat `"0"` or
@@ -697,12 +715,14 @@ def is_env_truthy(name: str, *, default: bool = False) -> bool:
             constant from this module).
         default: Value returned when the variable is unset OR set to a
             value that is neither recognizably truthy nor falsy.
+        environ: Environment to read, defaulting to the process environment.
+            Pass a workspace snapshot to keep the read scoped.
 
     Returns:
         `True` for `1`/`true`/`yes`/`on` (case-insensitive), `False` for
         `0`/`false`/`no`/`off`/empty string, or `default` otherwise.
     """
-    raw = os.environ.get(name)
+    raw = (os.environ if environ is None else environ).get(name)
     if raw is None:
         return default
     classified = classify_env_bool(raw)

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/deepagents_code/_server_config.py

@@ -12,8 +12,9 @@ with `from_env()`.
 from __future__ import annotations
 
 import json
+import logging
 import os
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, cast
 
@@ -21,10 +22,92 @@ from deepagents_code._constants import DEFAULT_AGENT_NAME as DEFAULT_ASSISTANT_I
 from deepagents_code._env_vars import SERVER_ENV_PREFIX
 
 if TYPE_CHECKING:
+    from collections.abc import Mapping
+
     from deepagents import FsToolName
 
     from deepagents_code.project_utils import ProjectContext
 
+logger = logging.getLogger(__name__)
+
+
+SESSION_WORKSPACE_FIELDS = frozenset(
+    {
+        "allow_fs_tools",
+        "assistant_id",
+        "auto_approve",
+        "enable_ask_user",
+        "enable_interpreter",
+        "enable_memory",
+        "enable_shell",
+        "enable_skills",
+        "interactive",
+        "interpreter_ptc",
+        "interpreter_ptc_acknowledge_unsafe",
+        "interrupt_shell_only",
+        "no_mcp",
+        "recursion_limit",
+        "sandbox_id",
+        "sandbox_snapshot_name",
+        "sandbox_type",
+        "shell_allow_list",
+    }
+)
+"""Policy a managed client may claim for its own command invocation.
+
+These come from the client's own CLI flags, so the client already knows them
+and claiming them proves only that both sides agree. Together with
+`PROJECT_WORKSPACE_FIELDS` this must partition `to_workspace_payload()`
+exactly: a payload field in neither set is never verified against a client
+claim and never checked for project drift.
+`test_workspace_claim_partitions_every_policy_field` pins that.
+"""
+PROJECT_WORKSPACE_FIELDS = frozenset(
+    {
+        "extension_paths",
+        "mcp_config_path",
+        "sandbox_setup",
+        "trust_project_extensions",
+        "trust_project_mcp",
+    }
+)
+"""Policy the server must resolve per project directory, never accept.
+
+Each of these grants code execution scoped to a checkout -- MCP servers,
+sandbox setup commands, Python extensions. A client that could claim them could
+execute one directory's configuration against another directory's trust
+decision.
+"""
+
+
+def _same_workspace_project(first: str | None, second: str) -> bool:
+    """Whether two paths name the same project directory.
+
+    Fails closed: an unset launch root, a missing path, or an undecidable
+    comparison counts as *different*, so the caller drops project policy rather
+    than carrying it across an unverified boundary. `_same_directory` compares
+    by device and inode, so a symlinked or differently cased spelling of one
+    directory still compares equal.
+
+    Returns:
+        `True` only when both paths name the same directory.
+    """
+    if first is None:
+        return False
+    from deepagents_code._paths import DeepAgentsHomeError, _same_directory
+
+    try:
+        return _same_directory(Path(first), Path(second))
+    except DeepAgentsHomeError:
+        logger.warning(
+            "Could not compare project directories %s and %s; treating as "
+            "separate projects, so project-scoped policy will not apply",
+            first,
+            second,
+            exc_info=True,
+        )
+        return False
+
 
 def _read_env_bool(suffix: str, *, default: bool = False) -> bool:
     """Read a `DEEPAGENTS_CODE_SERVER_*` boolean from the environment.
@@ -422,6 +505,150 @@ class ServerConfig:
     extension_paths: tuple[str, ...] = ()
     """Absolute one-run extension files or directories from repeatable CLI flags."""
 
+    def to_workspace_payload(self) -> dict[str, Any]:
+        """Return non-secret resource policy for a durable workspace binding."""
+        return {
+            "assistant_id": self.assistant_id,
+            "auto_approve": self.auto_approve,
+            "interrupt_shell_only": self.interrupt_shell_only,
+            "shell_allow_list": self.shell_allow_list,
+            "interactive": self.interactive,
+            "enable_shell": self.enable_shell,
+            "enable_ask_user": self.enable_ask_user,
+            "enable_memory": self.enable_memory,
+            "enable_skills": self.enable_skills,
+            "enable_interpreter": self.enable_interpreter,
+            "interpreter_ptc": self.interpreter_ptc,
+            "interpreter_ptc_acknowledge_unsafe": (
+                self.interpreter_ptc_acknowledge_unsafe
+            ),
+            "allow_fs_tools": self.allow_fs_tools,
+            "recursion_limit": self.recursion_limit,
+            "sandbox_type": self.sandbox_type,
+            "sandbox_id": self.sandbox_id,
+            "sandbox_snapshot_name": self.sandbox_snapshot_name,
+            "sandbox_setup": self.sandbox_setup,
+            "mcp_config_path": self.mcp_config_path,
+            "no_mcp": self.no_mcp,
+            "trust_project_mcp": self.trust_project_mcp,
+            "trust_project_extensions": self.trust_project_extensions,
+            "extension_paths": list(self.extension_paths),
+        }
+
+    def to_session_workspace_claim(self) -> dict[str, Any]:
+        """Return the command-scoped policy a managed client may claim.
+
+        Returns:
+            The session-scoped subset of the workspace policy.
+        """
+        return {
+            key: value
+            for key, value in self.to_workspace_payload().items()
+            if key in SESSION_WORKSPACE_FIELDS
+        }
+
+    def to_project_workspace_policy(self) -> dict[str, Any]:
+        """Return policy that must be resolved for each project directory.
+
+        Returns:
+            The project-scoped subset of the workspace policy.
+        """
+        return {
+            key: value
+            for key, value in self.to_workspace_payload().items()
+            if key in PROJECT_WORKSPACE_FIELDS
+        }
+
+    def session_workspace_fingerprint(self) -> str:
+        """Fingerprint the exact client-claimable session policy.
+
+        Returns:
+            The canonical SHA-256 fingerprint.
+        """
+        from deepagents_code.workspace import canonical_fingerprint
+
+        return canonical_fingerprint(self.to_session_workspace_claim())
+
+    def resolve_workspace(
+        self,
+        cwd: str,
+        project_root: str | None,
+    ) -> ServerConfig:
+        """Resolve directory-bound policy for one server workspace.
+
+        Project-scoped policy (`PROJECT_WORKSPACE_FIELDS`) is valid only for
+        the directory it was resolved against: it came from the launch-time CLI
+        and that project's trust decisions. Reusing it for another directory
+        would apply one project's MCP servers, sandbox setup, and extensions to
+        a different, possibly untrusted, checkout.
+
+        So the launch project keeps its policy verbatim, and any other project
+        starts from nothing: MCP and sandbox setup are *dropped* rather than
+        rediscovered, and extension trust is re-read from the trust store for
+        that project. `_same_workspace_project` fails closed, so an
+        unresolvable path also takes the drop branch.
+
+        Args:
+            cwd: Absolute, canonical working directory for the workspace.
+            project_root: Canonical project root, or `None` when the workspace
+                has none. The launch cwd uses the server's explicit root when
+                configured. Otherwise, extension trust is keyed on `cwd` when
+                no root exists.
+
+        Returns:
+            A config whose session policy is unchanged and whose project policy
+            is either the launch project's or empty.
+        """
+        if self.project_root is not None and _same_workspace_project(self.cwd, cwd):
+            project_root = str(Path(self.project_root).expanduser().resolve())
+        launch_root = self.project_root or self.cwd
+        target_root = project_root or cwd
+        if _same_workspace_project(launch_root, target_root):
+            return replace(self, cwd=cwd, project_root=project_root)
+        from deepagents_code.extensions.trust import is_project_extensions_trusted
+
+        return replace(
+            self,
+            cwd=cwd,
+            project_root=project_root,
+            sandbox_setup=None,
+            mcp_config_path=None,
+            trust_project_mcp=None,
+            trust_project_extensions=is_project_extensions_trusted(target_root),
+            extension_paths=(),
+        )
+
+    def preserve_bound_extension_trust(
+        self, bound_policy: Mapping[str, object]
+    ) -> ServerConfig:
+        """Keep an existing thread's extension trust when a new grant appears.
+
+        Args:
+            bound_policy: Server policy persisted when the thread was bound.
+
+        Returns:
+            A config that defers new grants to new threads. Revocations remain
+            visible so binding and runtime validation can reject them.
+        """
+        if bound_policy.get("trust_project_extensions") is False and (
+            self.trust_project_extensions is True
+        ):
+            return replace(self, trust_project_extensions=False)
+        return self
+
+    def workspace_fingerprint(self) -> str:
+        """Fingerprint the resolved runtime config except workspace identity.
+
+        Returns:
+            The canonical SHA-256 fingerprint.
+        """
+        values = self.to_env()
+        values.pop("CWD")
+        values.pop("PROJECT_ROOT")
+        from deepagents_code.workspace import canonical_fingerprint
+
+        return canonical_fingerprint(values)
+
     def __post_init__(self) -> None:
         """Normalize fields and validate invariants.
 

{deepagents_code-0.1.65 → deepagents_code-0.1.67}/deepagents_code/_version.py

@@ -2,7 +2,7 @@
 
 # Keep the `x-release-please-version` annotation — release-please uses it to
 # bump `__version__` in sync with `pyproject.toml` on every release PR.
-__version__ = "0.1.65"  # x-release-please-version
+__version__ = "0.1.67"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/code"
 """URL for `deepagents-code` documentation."""