deepagents-code 0.2.0__tar.gz → 0.2.1__tar.gz

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 # Deep Agents Code Changelog
 
+## [0.2.1](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.2.0...deepagents-code==0.2.1) (2026-10-23)
+
+### Features
+
+- Support skill-scoped MCP tools ([#7010](https://github.com/langchain-ai/deepagents/pull/7010)).
+- Default the Anthropic Auto classifier to Claude Sonnet 5.5 ([#7163](https://github.com/langchain-ai/deepagents/pull/7163)).
+
+### Bug Fixes
+
+- Automatically migrate to Python 3.14 when no other session is running ([#7160](https://github.com/langchain-ai/deepagents/pull/7160)).
+- Use native structured output for the Anthropic Auto classifier ([#7162](https://github.com/langchain-ai/deepagents/pull/7162)).
+
 ## [0.2.0](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.88...deepagents-code==0.2.0) (2026-10-22)
 
 ### ⚠ BREAKING CHANGES

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: deepagents-code
-Version: 0.2.0
+Version: 0.2.1
 Summary: Terminal coding agent built on the Deep Agents SDK - works with any model, with persistent memory, customizable skills, subagents, and approval controls.
 Project-URL: Homepage, https://www.langchain.com/dcode
 Project-URL: Documentation, https://docs.langchain.com/oss/deepagents/code/overview
@@ -28,7 +28,7 @@ Requires-Python: <3.15,>=3.14
 Requires-Dist: aiosqlite>=0.22.1
 Requires-Dist: anyio>=4.14.2
 Requires-Dist: deepagents-acp<1.0.0,>=0.0.10
-Requires-Dist: deepagents==0.7.30
+Requires-Dist: deepagents==0.7.31
 Requires-Dist: fastmcp>=4.0.0b4
 Requires-Dist: filelock<3.30,>=3.29.7
 Requires-Dist: genai-prices<0.2.0,>=0.1.13
@@ -40,7 +40,7 @@ Requires-Dist: langchain-quickjs<0.4.0,>=0.3.4
 Requires-Dist: langchain<2.0.0,>=1.4.7
 Requires-Dist: langgraph-checkpoint-sqlite<4.0.0,>=3.1.2
 Requires-Dist: langgraph-cli[inmem]<1.0.0,>=0.4.37
-Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.36.4
+Requires-Dist: langgraph-runtime-inmem<1.0.0,>=0.36.5
 Requires-Dist: langgraph-sdk<1.0.0,>=0.4.8
 Requires-Dist: langsmith[sandbox]>=0.14.12
 Requires-Dist: markdownify>=1.2.3

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "981a87a"
+BUILD_COMMIT = "8f48aab"

deepagents_code-0.2.1/deepagents_code/_session_lock.py

@@ -0,0 +1,184 @@
+"""Presence lock telling a launch whether other dcode sessions share its install.
+
+A Python migration rebuilds the uv tool environment, which breaks every dcode
+process — and every server it spawned — still running from the old one. Startup
+auto-update may only migrate when no other session uses the installation, and
+it cannot tell that from a process listing: shims, renamed symlinks, and the
+server bootstrap all run under different names.
+
+Instead, each dcode process of a non-editable install (editable installs never
+auto-update) holds a shared `flock` on `SESSION_LOCK_FILE` for its lifetime,
+and hands the descriptor to the servers it spawns so they hold
+the same lock. A process asking "am I alone?" tries to take the lock
+exclusively; that succeeds only when no other session's open file holds it.
+The kernel drops a lock when its last descriptor closes, so a crashed session
+can never leave a stale claim behind.
+
+The answer is a snapshot. It cannot see sessions of versions from before this
+lock existed, and nothing stops a session that launches while the migration
+runs; both are accepted as rare and recoverable by a relaunch.
+
+POSIX only. On Windows, or whenever the lock cannot be taken, a process is
+never reported as alone, so the migration stays deferred to `dcode update`.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import sys
+from typing import TYPE_CHECKING
+
+from deepagents_code._paths import PATHS
+
+if sys.platform != "win32":
+    import fcntl
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+SESSION_LOCK_FILE: Path = PATHS.installation.locks_dir / "sessions.lock"
+"""Advisory lock held shared by every registered dcode process of one installation.
+
+Lives beside `update.lock`, outside the tool environment, so a migration that
+rebuilds the environment keeps the same file. Carries no data.
+
+Installation-scoped only, with no per-profile fallback: a profile-scoped lock
+would hide sessions of other profiles, and over-reporting "alone" is the one
+failure this lock must not have.
+"""
+
+_held_fd: int | None = None
+"""Descriptor holding this process's shared lock, or `None` when not held."""
+
+
+def hold_session_lock() -> None:
+    """Register this process as a running session for its lifetime.
+
+    Idempotent and fail-soft: when the lock cannot be taken, the process runs
+    unregistered and `is_sole_session` reports `False`. The descriptor is
+    non-inheritable, so the re-exec after an update drops it and the new
+    process registers itself again.
+    """
+    global _held_fd  # noqa: PLW0603  # one registration per process
+    if _held_fd is not None or sys.platform == "win32":
+        return
+    try:
+        SESSION_LOCK_FILE.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        fd = os.open(SESSION_LOCK_FILE, os.O_RDWR | os.O_CREAT, 0o600)
+    except OSError:
+        logger.warning(
+            "Could not open session lock %s", SESSION_LOCK_FILE, exc_info=True
+        )
+        return
+    try:
+        # Blocks only while another process is inside `is_sole_session`, the
+        # one place the lock is ever held exclusively, and only for an instant.
+        # Failing fast instead would leave this session invisible to that check.
+        fcntl.flock(fd, fcntl.LOCK_SH)
+    except OSError:
+        logger.warning(
+            "Could not take session lock %s", SESSION_LOCK_FILE, exc_info=True
+        )
+        os.close(fd)
+        return
+    _held_fd = fd
+
+
+def session_lock_fds() -> tuple[int, ...]:
+    """Return descriptors a spawned server must inherit to count as this session.
+
+    `flock` locks belong to the open file description, so a child given the
+    descriptor holds the same lock: the server keeps the install marked in use
+    if it outlives its client, and does not count as a second session.
+    """
+    return () if _held_fd is None else (_held_fd,)
+
+
+def session_lock_unavailable() -> bool:
+    """Return whether this POSIX process failed to register as a session.
+
+    Lets callers tell "other sessions are running" apart from "presence cannot
+    be known", which quitting other sessions would never fix.
+    """
+    return sys.platform != "win32" and _held_fd is None
+
+
+def is_sole_session() -> bool:
+    """Return whether no other dcode session holds this installation.
+
+    Converting a `flock` is not atomic: the shared lock is released before the
+    exclusive one is tried, so two processes checking at once could each see
+    the other as absent. An exclusive lock on `sessions.check.lock` beside
+    `SESSION_LOCK_FILE` admits one checker at a time; a process that finds it
+    taken is not alone.
+
+    Returns:
+        `True` only when this process holds the session lock and could take
+            it exclusively. `False` when another session holds it, or when the
+            lock is unavailable and presence cannot be known.
+    """
+    if _held_fd is None:
+        return False
+    check_file = SESSION_LOCK_FILE.with_name("sessions.check.lock")
+    try:
+        guard = os.open(check_file, os.O_RDWR | os.O_CREAT, 0o600)
+    except OSError:
+        logger.warning("Could not open %s", check_file, exc_info=True)
+        return False
+    try:
+        fcntl.flock(guard, fcntl.LOCK_EX | fcntl.LOCK_NB)
+    except OSError:
+        return False
+    else:
+        return _probe_exclusive(_held_fd)
+    finally:
+        os.close(guard)
+
+
+def _probe_exclusive(fd: int) -> bool:
+    """Try to take the session lock exclusively, then hold it shared again.
+
+    Returns:
+        Whether the exclusive attempt succeeded and the shared lock is back.
+    """
+    try:
+        fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+    except BlockingIOError:
+        sole = False
+    except OSError:
+        logger.warning(
+            "Could not check session lock %s", SESSION_LOCK_FILE, exc_info=True
+        )
+        sole = False
+    else:
+        sole = True
+    # Re-take it on both branches: on Linux a failed upgrade attempt has already
+    # released the shared lock.
+    return _restore_shared(fd) and sole
+
+
+def _restore_shared(fd: int) -> bool:
+    """Hold the session lock shared again, or unregister on failure.
+
+    Returns:
+        Whether this process is still registered.
+    """
+    global _held_fd  # noqa: PLW0603  # unregister a lock this process lost
+    try:
+        # Blocking is safe: the check lock is held, so no other process holds
+        # this lock exclusively.
+        fcntl.flock(fd, fcntl.LOCK_SH)
+    except OSError:
+        logger.warning(
+            "Could not restore the shared session lock %s; other dcode sessions "
+            "will not see this one",
+            SESSION_LOCK_FILE,
+            exc_info=True,
+        )
+        _held_fd = None
+        os.close(fd)
+        return False
+    return True

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/_version.py

@@ -2,7 +2,7 @@
 
 # Keep the `x-release-please-version` annotation — release-please uses it to
 # bump `__version__` in sync with `pyproject.toml` on every release PR.
-__version__ = "0.2.0"  # x-release-please-version
+__version__ = "0.2.1"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/code"
 """URL for `deepagents-code` documentation."""

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/agent.py

@@ -2772,6 +2772,28 @@ def create_cli_agent(
     ):
         extension_registry = None
     mcp_tools = tuple(mcp_tools or ())
+    skill_tools = tuple(
+        item
+        for item in mcp_tools
+        if (item.metadata or {}).get("_deepagents_code_skill_only") is True
+    )
+    skill_tool_ids = {id(item) for item in skill_tools}
+    tools = [item for item in tools if id(item) not in skill_tool_ids]
+    if skill_tools and mcp_server_info:
+        skill_tool_names = {item.name for item in skill_tools}
+        mcp_server_info = [
+            replace(
+                server,
+                tools=tuple(
+                    item for item in server.tools if item.name not in skill_tool_names
+                ),
+            )
+            for server in mcp_server_info
+        ]
+    if skill_tools and not enable_skills:
+        logger.warning(
+            "Skill-only MCP tools are unavailable because skills are disabled"
+        )
     if auto_mode_enabled and sandbox is not None:
         logger.warning(
             "Classifier-backed Auto is unavailable with a sandbox; using Manual HITL"
@@ -2792,6 +2814,12 @@ def create_cli_agent(
             # Base instructions are loaded fresh from get_system_prompt()
             agent_md.touch()
 
+    skill_sources = (
+        get_skill_sources(assistant_id=assistant_id, project_context=project_context)
+        if enable_skills
+        else []
+    )
+
     # Load custom subagents from filesystem
     custom_subagents: list[SubAgent | CompiledSubAgent] = []
     resolved_shell_allow_list = _resolve_shell_allow_list()
@@ -2892,6 +2920,16 @@ def create_cli_agent(
             middleware.append(
                 ManagedMemoryGuardMiddleware([get_user_agent_md_path(assistant_id)])
             )
+        if enable_skills and skill_tools:
+            middleware.insert(
+                0,
+                PluginSkillsMiddleware(
+                    backend=FilesystemBackend(virtual_mode=False),
+                    sources=skill_sources,
+                    path_base=effective_cwd,
+                    tools=skill_tools,
+                ),
+            )
         return middleware
 
     from deepagents_code._cli_context import INHERIT_CLASSIFIER_MODEL
@@ -3097,14 +3135,11 @@ def create_cli_agent(
 
     # Add skills middleware
     if enable_skills:
-        sources = get_skill_sources(
-            assistant_id=assistant_id,
-            project_context=project_context,
-        )
         skills_middleware = PluginSkillsMiddleware(
             backend=FilesystemBackend(virtual_mode=False),
-            sources=sources,
+            sources=skill_sources,
             path_base=effective_cwd,
+            tools=skill_tools,
         )
         agent_middleware.append(skills_middleware)
         instruction_middleware.append(skills_middleware)

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/app.py

@@ -243,7 +243,7 @@ _DEFERRED_START_NOTICE = (
 
 _AUTO_CLASSIFIER_RECOMMENDED_MODELS = {
     "anthropic:claude-haiku-5-5": "Claude Haiku 5.5",
-    "anthropic:claude-sonnet-5": "Claude Sonnet 5",
+    "anthropic:claude-sonnet-5-5": "Claude Sonnet 5.5",
     "google_genai:gemini-3.8-flash": "Gemini 3.8 Flash",
     "openai:gpt-6-luna": "GPT-6 Luna",
 }

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/auto_mode.py

@@ -2864,8 +2864,7 @@ class AutoModeHITLMiddleware(HumanInTheLoopMiddleware[AutoModeState, Any, Any]):
                         selected,
                         # Classifier history never replays thinking blocks,
                         # so the Anthropic preserved-thinking binding would only
-                        # cost it the forced tool call `with_structured_output`
-                        # relies on.
+                        # add latency and cost to every review.
                         bind_preserved_thinking=False,
                         **retry_kwargs,
                     )
@@ -3089,12 +3088,18 @@ class AutoModeHITLMiddleware(HumanInTheLoopMiddleware[AutoModeState, Any, Any]):
         timeout_cm = asyncio.timeout(self._classifier_timeout_seconds)
         try:
             async with timeout_cm:
-                thinking = getattr(model, "thinking", None)
+                # Anthropic's native structured output constrains decoding to
+                # the schema. Forced tool calling only suggests it, and Claude
+                # intermittently wraps a valid verdict list in a JSON string or
+                # a placeholder key, which strict validation rejects and the
+                # fail-closed path turns into a denied batch. Models without
+                # native support (Claude 4.1 and earlier) reject the request
+                # outright, so they keep forced tool calling.
+                profile = getattr(model, "profile", None)
                 if (
-                    spec is None
-                    and getattr(model, "_llm_type", None) == "anthropic-chat"
-                    and isinstance(thinking, dict)
-                    and thinking.get("type") in {"adaptive", "enabled"}
+                    getattr(model, "_llm_type", None) == "anthropic-chat"
+                    and isinstance(profile, dict)
+                    and profile.get("structured_output") is True
                 ):
                     structured = model.with_structured_output(
                         _ClassifierBatch, method="json_schema"

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/client/launch/_server_bootstrap.py

@@ -76,7 +76,12 @@ class _ParentGuard:
 
 
 def _main() -> None:
-    guard = _ParentGuard(int(sys.argv[1]), float(sys.argv[2]))
+    reader, *held = (int(fd) for fd in sys.argv[1].split(","))
+    for fd in held:
+        # Keep the session lock in this process only, so a long-lived
+        # grandchild cannot hold the install in use after the server exits.
+        os.set_inheritable(fd, False)
+    guard = _ParentGuard(reader, float(sys.argv[2]))
     guard.start()
     if not guard.begin_dispatch():
         return

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/client/launch/server.py

@@ -1039,17 +1039,22 @@ class ServerProcess:
                 creationflags=_WINDOWS_CREATE_NEW_PROCESS_GROUP,
             )
 
+        from deepagents_code._session_lock import session_lock_fds
+
         reader, writer = os.pipe()  # Both ends are non-inheritable by default.
         self._parent_pipe_writer = writer
         # Abandoning the manager must not leak its writer. Explicit teardown
         # invokes this same finalizer so a reused descriptor is never closed twice.
         self._parent_pipe_finalizer = weakref.finalize(self, os.close, writer)
+        # The session lock keeps the install marked in use while the server
+        # runs, so a migration does not rebuild it underneath.
+        inherited = (reader, *session_lock_fds())
         try:
             return subprocess.Popen(  # noqa: S603  # argv is built internally
                 [
                     *cmd[:2],
                     "deepagents_code.client.launch._server_bootstrap",
-                    str(reader),
+                    ",".join(map(str, inherited)),
                     str(_SHUTDOWN_TIMEOUT),
                     *cmd[3:],
                 ],
@@ -1059,7 +1064,7 @@ class ServerProcess:
                 stderr=subprocess.STDOUT,
                 start_new_session=True,
                 creationflags=0,
-                pass_fds=(reader,),
+                pass_fds=inherited,
             )
         finally:
             os.close(reader)

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/config.py

@@ -4685,7 +4685,7 @@ def resolve_auto_classifier_model_with_problem() -> tuple[str | None, str | None
 
 
 _DEFAULT_AUTO_CLASSIFIER_MODELS = {
-    "anthropic": "anthropic:claude-sonnet-5",
+    "anthropic": "anthropic:claude-sonnet-5-5",
     "google_genai": "google_genai:gemini-3.8-flash",
     "google_vertexai": "google_vertexai:gemini-3.8-flash",
     "openai": "openai:gpt-5.6-luna",

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/main.py

@@ -52,6 +52,11 @@ _UNPERSISTED_AUTO_UPDATE_FAILURE_NOTE = (
     "\n[yellow]Note:[/yellow] this failure could not be recorded, so dcode will "
     "retry this update on the next launch until the state directory becomes writable."
 )
+_UNPERSISTED_AUTO_UPDATE_DEFERRAL_NOTE = (
+    "\n[yellow]Note:[/yellow] this deferral could not be recorded, so dcode will "
+    "announce this update again on the next launch until the state directory "
+    "becomes writable."
+)
 
 
 class _TrustAction(Enum):
@@ -457,6 +462,27 @@ def _confirm_update_after_restart(console: Console, version: str) -> None:
     console.print(f"[green]Updated to v{version}.[/green]", highlight=False)
 
 
+def _session_lock_unavailable_note() -> str:
+    """Explain a migration deferral that quitting other sessions cannot fix.
+
+    Returns:
+        A line ending in a newline, or an empty string when the session lock
+            works and the deferral notice alone is accurate.
+    """
+    from deepagents_code._session_lock import (
+        SESSION_LOCK_FILE,
+        session_lock_unavailable,
+    )
+
+    if not session_lock_unavailable():
+        return ""
+    return (
+        f"dcode could not lock {SESSION_LOCK_FILE}, so it cannot tell whether "
+        "other sessions are running and will not migrate on its own. Run "
+        "`dcode update` instead.\n"
+    )
+
+
 def _mark_startup_auto_update_failed_safe(version: str) -> None:
     """Record the auto-update cooldown for *version*, never raising.
 
@@ -622,10 +648,12 @@ def _run_startup_auto_update(console: Console) -> None:
         is_update_check_enabled,
         mark_auto_update_default_acknowledged,
         mark_startup_auto_update_failed,
+        migration_deferral_message,
         perform_upgrade,
         release_requires_prereleases,
         should_announce_auto_update_default,
         should_skip_startup_auto_update_after_failure,
+        startup_auto_update_was_deferred,
         update_install_lock,
         upgrade_command,
     )
@@ -687,12 +715,15 @@ def _run_startup_auto_update(console: Console) -> None:
                 highlight=False,
             )
             return
+        # A deferred migration is retried as soon as no other session is
+        # running; the install lock section decides between migrating and
+        # repeating the deferral.
+        retrying_deferral = startup_auto_update_was_deferred(latest)
         if should_skip_startup_auto_update_after_failure(latest):
-            # A same-version upgrade failed or was deferred recently; retrying
-            # it here would very likely fail again and re-stall every launch
-            # (this runs before the TUI). Skip for the cooldown window and
-            # point at `dcode update`: unlike a bare uv command, it also
-            # handles a Python migration that startup deferred.
+            # A same-version upgrade failed recently; retrying it here would
+            # very likely fail again and re-stall every launch (this runs
+            # before the TUI). Skip for the cooldown window and point at
+            # `dcode update`.
             from deepagents_code._invocation import invoked_name
 
             console.print(
@@ -751,6 +782,23 @@ def _run_startup_auto_update(console: Console) -> None:
                     highlight=False,
                 )
                 return
+            # A migration rebuilds the shared tool environment, which would
+            # break dcode sessions running in other terminals, so it only runs
+            # here when no other session was found at this check.
+            from deepagents_code._session_lock import is_sole_session
+
+            sole_session = is_sole_session()
+            if retrying_deferral and not sole_session:
+                # Repeat the deferral without re-fetching the release's Python
+                # requirement or announcing an update that will not happen.
+                console.print(
+                    f"{migration_deferral_message(latest)}\n"
+                    f"{_session_lock_unavailable_note()}"
+                    f"Continuing with v{cli_version}.",
+                    markup=False,
+                    highlight=False,
+                )
+                return
             release_age = format_release_age_parenthetical(latest)
             console.print(
                 f"Updating dcode from v{cli_version} to v{latest}{release_age}..."
@@ -775,15 +823,12 @@ def _run_startup_auto_update(console: Console) -> None:
                 notices.append(message)
                 console.print(message, markup=False, highlight=False)
 
-            # A Python migration rebuilds the shared tool environment, which
-            # would break dcode sessions running in other terminals. Defer it
-            # to an explicit `dcode update`.
             success, output, _installed = asyncio.run(
                 perform_upgrade(
                     on_notice=show_notice,
                     log_path=log_path,
                     target_version=latest,
-                    allow_python_migration=False,
+                    allow_python_migration=sole_session,
                     on_migration_deferred=lambda: deferred.append(True),
                     on_unverified_install=lambda: unverified.append(True),
                 )
@@ -841,12 +886,13 @@ def _run_startup_auto_update(console: Console) -> None:
                 _mark_startup_auto_update_failed_safe(latest)
                 _exit_after_unrestartable_update(console, latest)
             return
-        persisted = mark_startup_auto_update_failed(latest)
+        persisted = mark_startup_auto_update_failed(latest, deferred=bool(deferred))
         if unverified:
             _exit_after_unverified_update(console, persisted=persisted)
         if deferred:
             # Nothing failed: the notice above explains how to migrate.
-            message = f"Continuing with v{cli_version}."
+            note = escape(_session_lock_unavailable_note())
+            message = f"{note}Continuing with v{cli_version}."
         elif notices:
             # The notice above carries its own recovery steps; a generic
             # command here would contradict them.
@@ -867,14 +913,16 @@ def _run_startup_auto_update(console: Console) -> None:
                 f"Run manually: [cyan]{cmd}[/cyan]\n"
                 f"Continuing with v{cli_version}."
             )
-        if not persisted and not deferred:
-            # The cooldown marker could not be saved (e.g. a read-only state
-            # dir), so this same failing upgrade would otherwise be retried on
-            # every launch. Surface it rather than silently re-stalling, the
-            # way the consent-announce path surfaces its un-persisted state.
-            # After a deferral nothing failed: a lost marker only repeats the
-            # deferral notice, which installs nothing.
-            message += _UNPERSISTED_AUTO_UPDATE_FAILURE_NOTE
+        if not persisted:
+            # The marker could not be saved (e.g. a read-only state dir), so
+            # this same upgrade would otherwise be retried on every launch.
+            # Surface it rather than silently re-stalling, the way the
+            # consent-announce path surfaces its un-persisted state.
+            message += (
+                _UNPERSISTED_AUTO_UPDATE_DEFERRAL_NOTE
+                if deferred
+                else _UNPERSISTED_AUTO_UPDATE_FAILURE_NOTE
+            )
         console.print(message, markup=True, highlight=False)
     except SystemExit:
         # Process replacement (and test doubles that simulate it), plus the
@@ -2630,7 +2678,7 @@ def parse_args() -> argparse.Namespace:
         dest="auto_classifier_model",
         metavar="MODEL",
         help="Model the Auto approval classifier reviews actions with "
-        "(e.g. anthropic:claude-sonnet-5). Local TUI or ACP only. Defaults to "
+        "(e.g. anthropic:claude-sonnet-5-5). Local TUI or ACP only. Defaults to "
         "DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL, then [models].auto_classifier, "
         "then a provider-specific model or the main agent model. A weaker model "
         "weakens Auto's review.",
@@ -5520,10 +5568,23 @@ def cli_main() -> None:
         # accessor triggers `_ensure_bootstrap()` (dotenv loading), and
         # commands dispatched below — notably `auth status` — resolve
         # credentials from the environment expecting `.env` to be loaded.
-        from deepagents_code.config import _get_credentials, console
+        from deepagents_code.config import (
+            _get_credentials,
+            _is_editable_install,
+            console,
+        )
 
         _get_credentials()
 
+        # Mark this install as in use before anything can migrate it, so a
+        # concurrent launch's auto-update does not rebuild the environment out
+        # from under this process. Editable installs never auto-update, so
+        # nothing reads their registration.
+        if not _is_editable_install():
+            from deepagents_code._session_lock import hold_session_lock
+
+            hold_session_lock()
+
         if command is None:
             # The health gate already ran above, for every command, so the
             # violation check inside cannot fire. Kept as defense in depth: it

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/mcp_tools.py

@@ -438,6 +438,12 @@ def _validate_server_config(server_name: str, server_config: dict[str, Any]) ->
         error_msg = f"Server '{server_name}' config must be a dictionary"
         raise TypeError(error_msg)
 
+    if "skillOnly" in server_config and not isinstance(
+        server_config["skillOnly"], bool
+    ):
+        error_msg = f"Server '{server_name}' 'skillOnly' must be a boolean"
+        raise TypeError(error_msg)
+
     server_type = _resolve_server_type(server_config)
 
     if server_type in _SUPPORTED_REMOTE_TYPES:
@@ -2295,6 +2301,11 @@ async def _load_tools_from_config(
             for tool in server_tools:
                 original_name = (tool.metadata or {})[_MCP_ORIGINAL_TOOL_NAME_KEY]
                 tool.name = tool_names[server_name, original_name]
+                if server_config.get("skillOnly"):
+                    tool.metadata = {
+                        **(tool.metadata or {}),
+                        "_deepagents_code_skill_only": True,
+                    }
             server_tools = _apply_tool_filter(server_tools, server_name, server_config)
 
             # Pair each schema by the server-side name retained in the adapted

{deepagents_code-0.2.0 → deepagents_code-0.2.1}/deepagents_code/plugins/adapters/skills_middleware.py

@@ -42,6 +42,7 @@ if TYPE_CHECKING:
 
     from deepagents.backends.protocol import BackendProtocol
     from langchain_core.runnables import RunnableConfig
+    from langchain_core.tools import BaseTool
     from langgraph.runtime import Runtime
 
 logger = logging.getLogger(__name__)
@@ -440,6 +441,7 @@ class PluginSkillsMiddleware(SkillsMiddleware):
         sources: Sequence[CodeSkillSource],
         system_prompt: str | None = sdk_skills.SKILLS_SYSTEM_PROMPT,
         path_base: Path | None = None,
+        tools: Sequence[BaseTool] = (),
     ) -> None:
         """Initialize the middleware with Code-local plugin source tuples.
 
@@ -451,6 +453,7 @@ class PluginSkillsMiddleware(SkillsMiddleware):
             path_base: Directory that relative `skills.extra_allowed_dirs`
                 entries resolve against. If `None`, the process working
                 directory is used.
+            tools: Tools disclosed only after their skill is read or pinned.
         """
         self._allowed_roots = tuple(Path(source[0]).resolve() for source in sources)
         self._path_base = path_base
@@ -459,6 +462,7 @@ class PluginSkillsMiddleware(SkillsMiddleware):
             backend=backend,
             sources=sdk_sources,
             system_prompt=system_prompt,
+            tools=tools,
         )
         self._namespaces = tuple(
             source[2] if len(source) == _PLUGIN_SKILL_SOURCE_LENGTH else None