deepcode-hku 2.0.0__tar.gz → 2.1.0__tar.gz

{deepcode_hku-2.0.0 → deepcode_hku-2.1.0}/MANIFEST.in

@@ -3,11 +3,13 @@ include README_ZH.md
 include LICENSE
 include THIRD_PARTY_NOTICES.md
 include requirements.txt
+include uv.lock
 include __init__.py
 recursive-include prompts *
 recursive-include schema *
 recursive-include cli *.py
 recursive-include core *.py
+recursive-include core/skills/builtin *
 recursive-include core/application/goal_prompts *.md
 recursive-include app_server *.py
 recursive-include protocol *.json

{deepcode_hku-2.0.0/deepcode_hku.egg-info → deepcode_hku-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepcode-hku
-Version: 2.0.0
+Version: 2.1.0
 Summary: Open agentic coding with durable sessions, goals, and verification
 Home-page: https://github.com/HKUDS/DeepCode
 Author: DeepCode Team
@@ -22,7 +22,7 @@ Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: aiofiles>=0.8.0
-Requires-Dist: aiohttp>=3.14.1
+Requires-Dist: aiohttp>=3.14.3
 Requires-Dist: anthropic>=0.40.0
 Requires-Dist: asyncio-mqtt
 Requires-Dist: google-genai
@@ -37,7 +37,7 @@ Requires-Dist: openapi
 Requires-Dist: pathlib2
 Requires-Dist: prompt_toolkit>=3.0.0
 Requires-Dist: pydantic-settings>=2.14.2
-Requires-Dist: pypdf>=6.14.2
+Requires-Dist: pypdf>=6.15.0
 Requires-Dist: PyYAML>=6.0
 Requires-Dist: reportlab>=3.5.0
 Requires-Dist: rich>=13.0.0
@@ -78,7 +78,8 @@ Dynamic: summary
 </table>
 
 <div align="center">
-<a href="https://trendshift.io/repositories/14665" target="_blank"><img src="https://trendshift.io/api/badge/repositories/14665" alt="HKUDS%2FDeepCode | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
+<a href="https://trendshift.io/repositories/14665?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-14665" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/14665" alt="HKUDS%2FDeepCode | Trendshift" width="250" height="55"/></a>
+<a href="https://trendshift.io/repositories/14665?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-14665" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/14665/daily?language=Python" alt="HKUDS%2FDeepCode | Trendshift" width="250" height="55"/></a>
 </div>
 
 <!-- <img src="https://readme-typing-svg.herokuapp.com?font=Russo+One&size=28&duration=2000&pause=800&color=06B6D4&background=00000000&center=true&vCenter=true&width=800&height=50&lines=%E2%9A%A1+OPEN+AGENTIC+CODING+%E2%9A%A1" alt="DeepCode Tech Subtitle" style="margin-top: 5px; filter: drop-shadow(0 0 12px #06B6D4) drop-shadow(0 0 24px rgba(6,182,212,0.4));"/> -->
@@ -194,6 +195,7 @@ Skills, permissions, Goals, and Automations. See the
 - [🎬 Live demonstrations](#live-demonstrations)
 - [🛠️ Development](#development)
 - [⭐ Star History](#star-history)
+- [🙏 Appreciation](#contributors)
 - [📖 Citation](#citation)
 - [📄 License](#license)
 
@@ -203,6 +205,114 @@ Skills, permissions, Goals, and Automations. See the
 
 ## News
 
+**2026-08-12 · Reviewed upstream core Skills**
+
+- **Start with reviewed upstream Skills.** DeepCode now bundles eight pinned,
+  provenance-tracked Agent Skills from OpenAI, Codex, and Anthropic for Skill
+  authoring, code review, security analysis, frontend design, MCP construction,
+  and web application testing. They use the same catalog and Turn runtime as
+  project, user, and Plugin Skills.
+
+**2026-08-12 · Managed MCP catalog, OAuth, and real connection checks**
+
+- **Start from reviewed templates without hidden execution.** DeepCode bundles
+  a validated catalog based on Nanobot's current 16 MCP templates. Adding
+  one copies ordinary user configuration in a disabled state; it never silently
+  runs `npx`, Docker, or a remote server.
+- **Configure MCP consistently in every interface.** Desktop and TUI now join
+  the management CLI and App Server on one preset, configuration, test, OAuth,
+  and live-status service rather than maintaining interface-specific clients.
+- **Distinguish config, authorization, and connectivity.** A real MCP probe
+  initializes the server and counts tools, resources, and prompts. Browser
+  OAuth uses a loopback callback and a private credential file outside project
+  configuration, while Agent startup never opens a browser implicitly.
+
+**2026-08-10 · Generic MCP runtime and portable local Plugins**
+
+- **Connect standard MCP servers from every interface.** User and trusted
+  project configuration, App Server, CLI, and Desktop now share one generic
+  stdio/SSE/Streamable HTTP client runtime with bounded discovery, stable tool
+  identities, timeouts, cancellation, and session-owned cleanup.
+- **Keep credentials and authority explicit.** Executable config layers replace
+  whole entries, child processes receive a minimal environment, provider keys
+  stay in private DeepCode connections, and MCP policy can only narrow global
+  trust, read-only, approval, and sandbox decisions.
+- **Run Agent Plugins 1.0 MCP components without format forks.** Valid
+  `mcp.json` servers join the same runtime only when an Agent Session starts,
+  receive isolated `PLUGIN_ROOT` / `PLUGIN_DATA`, and fail independently from
+  bundled Skills and other servers.
+- **Connect OpenSpace as MCP plus two ordinary Skills.** A reviewed recipe binds
+  an OpenRouter connection without plaintext secrets, imports OpenSpace's host
+  Skills into the standalone catalog, and keeps cloud/upload tools disabled by
+  default.
+
+- **Register trusted local Plugin folders.** CLI and Desktop now share a
+  user-level Plugin registry with add, inspect, enable, disable, and unregister
+  operations; unregistering never deletes source files.
+- **Keep one execution path.** Enabled Plugins contribute authority-bound
+  Skills through the existing Skill Provider host, so selection, dependencies,
+  progressive reads, permissions, revisions, and audit metadata remain the
+  same across CLI, TUI, headless execution, and Desktop.
+- **Preserve standalone Skills.** Project and user Skills remain independently
+  installable and take precedence over a same-named Plugin Skill. Plugins are
+  an optional packaging source, never a replacement Skill lifecycle.
+- **Use one portable package contract.** Local Plugins use the Agent Plugins
+  1.0.0 root manifest and fixed `skills/` layout; experimental DeepCode
+  manifests are no longer accepted. Hooks, Apps, Marketplaces, downloads, and
+  updates remain inert.
+
+**2026-08-09 · Skills now have a real runtime contract**
+
+- **Load guidance through one provider boundary.** Skill discovery, content
+  reads, and package search now stay with the provider that owns the Skill,
+  while the catalog remains metadata-only. Local Skills keep their existing
+  precedence and identity, and future providers no longer need filesystem
+  shortcuts to fit the runtime.
+- **Compose Skills without hiding missing capabilities.** Skills can declare
+  tool and Skill dependencies; DeepCode expands them in order, detects cycles,
+  and fails before the first model request when a requirement is unavailable.
+- **Reveal only what the task needs.** The Agent can search and read bounded
+  package resources progressively, with revision, traversal, symlink, and size
+  checks applied at the shared provider contract.
+- **Keep execution constrained and auditable.** A Skill can narrow the tools
+  already allowed by the Session but cannot grant new permissions. CLI, TUI,
+  and Desktop share the same immutable Turn snapshot and persist only Skill
+  identity, invocation kind, and revision—not the instruction body.
+- **See changes everywhere without restarting.** One workspace host now owns
+  the shared catalog and provider cache, while each Agent Session keeps its own
+  Turn context. Local Skill and policy changes refresh Desktop automatically,
+  and Composer, management, CLI, and headless execution resolve through the
+  same lifecycle.
+
+**2026-08-07 · Thinking controls, more providers, and a Desktop you can tune**
+
+- **Reasoning controls work again across the board.** Thinking levels are now
+  resolved from the model catalog, so Claude, GPT-5, Kimi, Qwen and Grok all
+  offer their real effort levels, and DeepSeek, GLM and MiniMax get a working
+  thinking toggle. A newly released model inherits its family's controls
+  instead of silently losing them.
+- **Three more providers.** Requesty and Forge join as gateways, and MiniMax
+  arrives with its own catalog entry — including the 1M-context M3 tier.
+- **Make the Desktop yours.** Settings → Appearance adds conversation width,
+  a light/dark override that no longer follows the OS blindly, font size, and
+  font selection filtered to what is actually installed on your machine.
+- **Safer command execution on Windows.** A Job Object backend gives the
+  sandbox real process-tree isolation where previously there was none.
+
+**2026-08-04 · Skills that work wherever you do**
+
+- **Keep reusable expertise close to your work.** DeepCode discovers Skills
+  from the current project as well as your personal collection, while keeping
+  existing DeepCode and Claude-compatible Skill locations working.
+- **Use the same Skill from CLI or Desktop.** Select it for a task and DeepCode
+  carries its identity and version with the Turn, so the Session shows which
+  guidance shaped the result.
+- **Create Skills without leaving DeepCode.** The built-in Skill Creator helps
+  you scaffold and validate focused, reusable workflows from either interface.
+- **Stay focused as your library grows.** Context-aware discovery keeps the
+  Agent prompt concise while the complete Skill catalog remains available to
+  browse and manage.
+
 **2026-08-03 · 🎉 DeepCode v2.0 is here**
 
 DeepCode v2.0 introduces a new general-purpose Coding Agent framework for
@@ -232,50 +342,25 @@ DeepCode v2.0 is built to help you spend less time supervising every step and
 more time shipping software you are proud of. We cannot wait to see what you
 build! 🚀
 
-**2026-07-31 · One execution model across CLI and Desktop**
-
-- Interactive, headless, Goal, Automation, and Desktop work all use the same
-  durable Project, Session, Thread, and Turn lifecycle.
-- Workspace trust is explicit and independent from the Session access preset:
-  **Ask**, **Read only**, or **Full access**.
-- Model-aware Thinking controls and typed reasoning presentation remain
-  separate, so changing display detail never changes the model request.
-
-**2026-07-21 · Durable Goals and safe Session lifecycle**
-
-- Run long tasks as resumable, evidence-driven Goals shared by CLI and Desktop.
-- Archive history for later or permanently delete it through one guarded
-  Session lifecycle, without touching repository files.
-- Interrupted deletions recover from a durable tombstone instead of reviving
-  stale Session records.
-
-**2026-07-20 · Session-level model control and shared Skills**
-
-- Configure named LLM connections once and use them throughout DeepCode.
-- Switch the connection or model for future Turns without losing the
-  conversation that came before it.
-- Discover, import, enable, and select the same project or user Skills
-  regardless of how the task was started.
-
-**2026-07-17 · Durable Session navigation and replay**
-
-- Projects organize their own collapsible Session history while older Sessions
-  remain discoverable across directories.
-- Long conversations replay incrementally instead of being rejected as one
-  oversized message.
-- Approvals, change review, tests, and Artifacts remain attached to the task
-  that produced them.
-
-**2026-07-10 · Loop Engineering and parallel agents**
-
-- Give DeepCode a mutable Goal; it can inspect, implement, verify where
-  appropriate, and repair across ordinary Turns while remaining steerable.
-- Delegate focused work to agents in isolated worktrees, then surface conflicts
-  explicitly before integration.
-
 <details>
-<summary><strong>Earlier milestones</strong></summary>
-
+<summary><strong>Earlier 2026 milestones</strong></summary>
+
+- **2026-07-31 · One execution model across CLI and Desktop.** Interactive,
+  headless, Goal, Automation, and Desktop work share the same durable Project,
+  Session, Thread, and Turn lifecycle. Workspace trust stays independent from
+  the Session access preset, and reasoning controls remain model-aware.
+- **2026-07-21 · Durable Goals and safe Session lifecycle.** Long-running Goals
+  are resumable across CLI and Desktop, while guarded archival and deletion
+  preserve repository files and recover safely after interruption.
+- **2026-07-20 · Session-level model control and shared Skills.** Named LLM
+  connections and future-Turn model switches preserve conversation history;
+  project and user Skills are shared across entry points.
+- **2026-07-17 · Durable Session navigation and replay.** Projects organize
+  collapsible Session history, long conversations replay incrementally, and
+  approvals, reviews, tests, and Artifacts remain attached to their task.
+- **2026-07-10 · Loop Engineering and parallel agents.** Mutable Goals can
+  inspect, implement, verify, and repair across steerable Turns, while focused
+  work can be delegated in isolated worktrees with explicit conflict handling.
 - **2026-07-08 · Durable Sessions and memory.** Session history survives
   restarts, project instructions can live in `AGENTS.md` or `DEEPCODE.md`, and
   persistent notes remain with the workspace.
@@ -405,12 +490,15 @@ reasoning summary returned by the Provider.
 ### Reusable Skills
 
 Skills turn team conventions, domain knowledge, review methods, and repeated
-workflows into reusable Agent capabilities. Store Skills with a project or
-install them in your user directory, then select them when a task needs them.
+workflows into reusable Agent capabilities. DeepCode includes pinned upstream
+Skills for authoring, review, security, frontend, MCP, and web testing workflows.
+Keep project Skills in `.agents/skills`, keep personal Skills in
+`~/.agents/skills`, or use the bundled Skill Creator to build one
+conversationally.
 
-DeepCode supports both DeepCode and Claude-style Skill directories. A Skill
-can guide how the Agent works, but it cannot bypass project trust, tool
-permissions, or safety boundaries.
+DeepCode also reads existing `.deepcode/skills` and Claude-style directories
+without migrating them. A Skill can guide how the Agent works, but it cannot
+bypass project trust, tool permissions, or safety boundaries.
 
 ### Permissions you can understand
 
@@ -466,8 +554,8 @@ run, be inspected, and keep improving.
 DeepCode has two interfaces with separate installation paths. Choose one to get
 started; both use the same Agent runtime and canonical Session history.
 
-> `uv tool install deepcode-hku` installs the CLI and shared Python runtime. It
-> does **not** install the Tauri Desktop application.
+> `uv tool install --python 3.12 deepcode-hku` installs the CLI and shared
+> Python runtime. It does **not** install the Tauri Desktop application.
 
 ### Option A — Install the CLI
 
@@ -480,10 +568,15 @@ winget install --id astral-sh.uv --exact
 Open a new terminal after the first `uv` installation, then run:
 
 ```console
-uv tool install deepcode-hku
+uv tool install --python 3.12 deepcode-hku
 deepcode init
 ```
 
+The explicit Python selection is intentional: DeepCode requires Python 3.12+
+and must not fall back to an unsupported legacy package on an older interpreter.
+If an existing uv tool environment still contains DeepCode 1.x, migrate it with
+`uv tool upgrade --python 3.12 deepcode-hku`.
+
 Create a model connection once. `--api-key` opens a non-echoing prompt:
 
 ```console
@@ -628,6 +721,7 @@ and CLI without export or conversion.
 | Adjust Thinking effort | Composer effort picker | `/effort` |
 | Choose tool access | Composer access picker | `/permissions` |
 | Load Skills for the next Turn | Composer Skills control | `/skill <name>` |
+| Create a reusable Skill | **Skills → Create Skill** | `$skill-creator` |
 | Set or revise a durable Goal | Goal panel | `/goal` |
 | Stop the active Turn | Use the stop control | `/stop` |
 
@@ -655,12 +749,49 @@ model discovery, and machine-readable checks are documented in the
 Skills turn reusable engineering knowledge into instructions the Agent can load
 for a task. Desktop provides a Skills workspace; the interactive CLI uses
 `/skills` to discover them and `/skill <name>` to select one for the next Turn.
-
-Project Skills can travel with a repository, while user Skills remain available
-across Projects. DeepCode also recognizes Claude-compatible Skill directories.
-A Skill can guide the Agent, but it cannot grant permissions or bypass Project
-trust, approvals, or tool policy. Import, enable, disable, and catalog commands
-live in the [advanced guide](docs/HEADLESS_AND_AUTOMATION.md#skill-management).
+Choose **Skills → Create Skill** in Desktop or invoke `$skill-creator` in CLI to
+create and validate one through a normal Agent Turn.
+
+Project Skills in `.agents/skills` travel with a repository; user Skills in
+`~/.agents/skills` remain available across Projects. Existing DeepCode and
+Claude-compatible directories remain readable. A Skill can guide the Agent,
+but it cannot grant permissions or bypass Project trust, approvals, or tool
+policy. Import, enable, disable, and catalog commands live in the
+[advanced guide](docs/HEADLESS_AND_AUTOMATION.md#skill-management).
+
+### Local Plugins
+
+Plugins optionally package Skills behind a validated local manifest; standalone
+project and user Skills continue to install and run without a Plugin. New
+packages must use the Agent Plugins 1.0.0 manifest and fixed `skills/` layout.
+Add a trusted folder from the Desktop Plugins workspace or with `deepcode
+plugin add <path>`; its Skills then appear in the ordinary Skill catalog and
+Composer. A standards-compliant `mcp.json` may also contribute MCP servers;
+registration remains inert and those processes start only inside an Agent
+Session. DeepCode does not execute Plugin hooks or Apps and does not download
+from a Marketplace. See the
+[local Plugin contract](docs/LOCAL_PLUGINS.md).
+
+### MCP servers
+
+Generic coding-agent MCP servers live in the top-level `mcpServers` section of
+`deepcode_config.json`; the historical Paper2Code `tools.mcpServers` section is
+kept separate. Configure servers in Desktop under **MCP**, or use the compact
+`deepcode mcp` CLI. The bundled catalog is listed with `deepcode mcp presets`;
+`add <id>` copies a disabled definition, `test <name>` performs a real
+handshake, and `login/logout <name>` manages explicit browser OAuth. The TUI
+offers the same actions under the single `/mcp` command. User and
+trusted-project layers replace whole server entries rather than merging
+executable fields. Provider secrets are referenced from private DeepCode
+connections, and MCP tool policy can only narrow global trust, read-only,
+approval, and sandbox decisions.
+
+DeepCode supports stdio, SSE, and Streamable HTTP, session-owned startup and
+shutdown, bounded discovery, stable `mcp__server__tool` identities, tool
+annotations, allow/deny lists, per-tool approvals, timeouts, and cancellation.
+For a concrete two-Skill plus MCP integration, see the
+[OpenSpace guide](docs/integrations/OPENSPACE.md). Setup, preset, OAuth, and
+connection-state details are in the [MCP client guide](docs/integrations/MCP.md).
 
 ### Safety and execution
 
@@ -940,6 +1071,8 @@ in [`desktop/README.md`](desktop/README.md) and the
 | Durable Paper2Code workflow                   | [P5 Paper2Code](docs/P5_PAPER2CODE_ARCHITECTURE.md)           |
 | Canonical Sessions and cross-directory resume | [P6 Session alignment](docs/P6_SESSION_ALIGNMENT_REVIEW.md)   |
 | Skills identity, security, and persistence    | [Skills architecture](docs/SKILLS_PRODUCT_ARCHITECTURE.md)    |
+| Generic MCP setup and connection lifecycle     | [MCP client guide](docs/integrations/MCP.md)                  |
+| OpenSpace integration                          | [OpenSpace integration](docs/integrations/OPENSPACE.md)       |
 | Automation scheduling and execution           | [Automation architecture](docs/AUTOMATION_ARCHITECTURE.md)    |
 | Desktop product and interaction model         | [Desktop UI specification](docs/DESKTOP_PRODUCT_UI_SPEC.md)   |
 | Privacy and diagnostics                       | [Privacy contract](docs/PRIVACY_AND_DIAGNOSTICS.md)           |
@@ -987,6 +1120,27 @@ The empty product-image slots have a shared
 
 ---
 
+<a id="contributors"></a>
+
+## 🙏 Appreciation
+
+Thanks to everyone in the open-source community — your stars, issues, pull
+requests and discussions shape where DeepCode goes next.
+
+<div align="center">
+
+<a href="https://github.com/HKUDS/DeepCode/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=HKUDS/DeepCode&max=999" alt="DeepCode contributors" />
+</a>
+
+</div>
+
+Everyone who has opened a pull request is listed in
+[CONTRIBUTORS.md](CONTRIBUTORS.md), including contributions that predate the
+v2.0 rebuild and so are not reflected in the graph above.
+
+---
+
 <a id="citation"></a>
 
 ## 📖 Citation