langchain-agentx-python 2.4.1__tar.gz → 2.4.5__tar.gz

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: langchain-agentx-python
-Version: 2.4.1
+Version: 2.4.5
 Summary: LangChain/LangGraph-based agent utilities for CodeBaseX.
 Author-email: GoodMood2008 <GoodMood2008@users.noreply.github.com>
 License:                                  Apache License

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/__init__.py

@@ -11,7 +11,7 @@ from langchain_agentx import create_loop_agent
 ```
 """
 
-__version__ = "2.4.1"
+__version__ = "2.4.5"
 
 from .mcp.call import McpToolCaller
 from .mcp.client_manager import McpClientManager, McpConnectedClient

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/loop/config/interaction_profile.py

@@ -25,7 +25,10 @@ if TYPE_CHECKING:
 _WORKER_CONTAINER_TYPES = frozenset(
     {"background_task", "background", "batch", "worker", "sdk"}
 )
-_INTERACTIVE_HEADLESS_MODES = frozenset({"auto", "dontAsk", "bypassPermissions"})
+# acceptEdits：headless 子图继承父写快路径（与 auto 同属写链放行 mode）
+_INTERACTIVE_HEADLESS_MODES = frozenset(
+    {"auto", "dontAsk", "bypassPermissions", "acceptEdits"}
+)
 _HITL_PROFILE_IDS = frozenset({"code-interactive", "code-plan"})
 _HEADLESS_PROFILE_IDS = frozenset(
     {"qa-auto", "workflow-auto", "worker-deny", "interactive-headless"}
@@ -120,7 +123,8 @@ class InteractionProfileResolver:
                 if mode in ("default", "plan"):
                     raise ValueError(
                         f"interactive + headless=True cannot use permission_mode={mode!r}; "
-                        "use auto, dontAsk, or bypassPermissions (print/script entry)"
+                        "use auto, dontAsk, bypassPermissions, or acceptEdits "
+                        "(interactive-headless / print/script entry)"
                     )
                 if mode not in _INTERACTIVE_HEADLESS_MODES:
                     raise ValueError(

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/loop/graph/factory.py

@@ -985,6 +985,7 @@ class LoopGraphBuilder:
             system_prompt=self._base_prompt,
             capabilities=self._services.capabilities,
             cwd=runtime_cwd,
+            permission_mode=self._config.permission_mode,
             boundary_snapshot=BoundarySnapshotPropagator.from_workspace_boundary(
                 boundary=self._workspace_boundary,
                 runtime_cwd=runtime_cwd,
@@ -1048,6 +1049,7 @@ class LoopGraphBuilder:
             system_prompt=base_prompt,
             capabilities=self._services.capabilities,
             cwd=runtime_cwd,
+            permission_mode=self._config.permission_mode,
             boundary_snapshot=BoundarySnapshotPropagator.from_workspace_boundary(
                 boundary=self._workspace_boundary,
                 runtime_cwd=runtime_cwd,

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/loop/hook/registry.py

@@ -18,6 +18,7 @@ registry.py — HookRegistry 用户侧入口。
 from __future__ import annotations
 
 import copy
+import types
 from dataclasses import replace
 from typing import Any, Callable
 from uuid import uuid4
@@ -25,6 +26,51 @@ from uuid import uuid4
 from .config import HookSpec, HooksConfigSnapshot
 from .types import HookEvent
 
+# fresh_state 克隆时，同一父实例上的多个 bound method 共用一个克隆 self
+_CallableSelfCloneMap = dict[int, Any]
+
+
+def _clone_hook_callable(
+    fn: Any,
+    *,
+    self_clones: _CallableSelfCloneMap,
+) -> Any:
+    """克隆 hook 回调；bound method 按 ``id(__self__)`` 去重，再绑到同一克隆实例。"""
+    self_obj = getattr(fn, "__self__", None)
+    func = getattr(fn, "__func__", None)
+    if self_obj is None or func is None or isinstance(self_obj, type):
+        # 普通函数 / 静态 / 类方法：保持 deepcopy 语义（通常仍是同一对象）
+        try:
+            return copy.deepcopy(fn)
+        except Exception:
+            return fn
+
+    key = id(self_obj)
+    if key not in self_clones:
+        self_clones[key] = copy.deepcopy(self_obj)
+    cloned_self = self_clones[key]
+    name = getattr(func, "__name__", None)
+    if isinstance(name, str) and name and hasattr(cloned_self, name):
+        rebound = getattr(cloned_self, name)
+        if callable(rebound) and getattr(rebound, "__self__", None) is cloned_self:
+            return rebound
+    return types.MethodType(func, cloned_self)
+
+
+def _clone_hook_config_fresh(
+    config: dict[str, Any],
+    *,
+    self_clones: _CallableSelfCloneMap,
+) -> dict[str, Any]:
+    """逐键深拷；``fn``/``callback`` 走 bound-method 去重克隆。"""
+    cloned: dict[str, Any] = {}
+    for key, value in config.items():
+        if key in ("fn", "callback") and callable(value):
+            cloned[key] = _clone_hook_callable(value, self_clones=self_clones)
+        else:
+            cloned[key] = copy.deepcopy(value)
+    return cloned
+
 
 # ── 任务完成 Hook 类型定义 ────────────────────────────────────────
 
@@ -326,13 +372,19 @@ class HookRegistry:
         *,
         fresh_state: bool = True,
     ) -> HookRegistry:
-        """过滤 clone 父 registry specs 到子 loop（LOCK-2；fresh_state 预留计数器隔离扩展）。"""
+        """过滤 clone 父 registry specs 到子 loop（LOCK-2）。
+
+        ``fresh_state=True``：可变 config 深拷，且同一父实例上的 bound method
+        （PRE/POST/…）共用**一份**克隆 ``__self__``——子会话相对父隔离，
+        子会话内跨事件状态机仍共享（见 bug hook-fork-bound-method-deepcopy-splits-state）。
+        """
         child = HookRegistry()
+        self_clones: _CallableSelfCloneMap = {}
         for spec in self._specs:
             if spec.event not in inherited_events:
                 continue
             if fresh_state:
-                config = copy.deepcopy(spec.config)
+                config = _clone_hook_config_fresh(spec.config, self_clones=self_clones)
             else:
                 config = dict(spec.config)
             cloned = replace(

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/loop/runtime/context_factory.py

@@ -5,8 +5,17 @@ loop/runtime/context_factory.py — RuntimeContextFactory 继承规则单点
       继承优先级（单点定义）：显式 override > SubagentConfig 默认 > 父 ctx 字段。
 在整体链路中的位置：SubagentOrchestrator.invoke_subagent() 调用。
 CC 对照：src/utils/forkedAgent.ts createSubagentContext() 中的字段合并逻辑。
-当前裁剪范围：v1 model / max_steps / available_tools / agent_depth 继承；permission_mode 直通；
+当前裁剪范围：v1 model / max_steps / available_tools / agent_depth 继承；
+      permission_mode 经 read_parent_permission_mode 写入 AgentLoopConfig（derive 侧）；
+      orchestrator 再经 resolve_definition_permission_mode 合并 definition/overrides 后
+      注入 SubagentContext.permission_mode（构图 SSOT；见 dual-track / parent-wins bug 单）；
       ``subagent_effective_cwd`` 由 ``SubagentExecutionPaths.prepare`` 注入（不在此 mkdir）。
+
+编排消费说明（防双轨幻觉）：
+      ``derive`` 返回完整 ``AgentLoopConfig``，但 ``create_subagent_graph`` **不直接吃**该对象；
+      orchestrator 当前只抽出并注入子 ctx 的字段：``model`` / ``max_steps`` /
+      ``agent_depth`` / ``permission_mode``（及 path/workspace 旁路）。子图权限权威在
+      ``SubagentContext.permission_mode``，勿在 graph 再读父 runnable。
 """
 
 from __future__ import annotations
@@ -83,16 +92,22 @@ class RuntimeContextFactory:
             else list(parent_ctx.available_tools or [])
         )
 
-        # 权限：override > 父 ctx.tool_flags["permission_mode"] > "default"
-        parent_permission = (
-            getattr(parent_ctx, "permission_mode", None)
-            or getattr(getattr(parent_ctx, "tool_flags", None), "get", lambda x: None)("permission_mode")
-            or "default"
+        # 权限：override > read_parent_permission_mode > "default"（AgentLoopConfig 侧）。
+        # 子图有效 mode（含 definition 父优先）由 orchestrator._resolve_effective_permission_mode
+        # 写入 SubagentContext.permission_mode；勿把本字段当作 definition merge 结果。
+        from langchain_agentx.tool_runtime.prompt.session_mode import (
+            read_parent_permission_mode,
         )
-        resolved_permission = (
+
+        parent_permission = (
             overrides.permission_mode
             if overrides.permission_mode is not None
-            else parent_permission
+            else read_parent_permission_mode(parent_ctx)
+        )
+        resolved_permission = (
+            parent_permission.strip()
+            if isinstance(parent_permission, str) and parent_permission.strip()
+            else "default"
         )
         workspace_root = getattr(parent_ctx, "workspace_root", None)
         parent_agent_home = getattr(parent_ctx, "agent_home_segment", None)
@@ -150,6 +165,8 @@ class RuntimeContextFactory:
         # 优先读 subagent.agent_depth（嵌套 L1→L2 若只写顶层会误成 0）。
         child_depth = int(getattr(parent_ctx, "agent_depth", 0) or 0) + 1
 
+        # 完整 AgentLoopConfig 供编排/后台路径复用；构图 SSOT 仍经 SubagentContext
+        # （orchestrator 仅透传 model/max_steps/agent_depth/permission_mode 等）。
         return AgentLoopConfig(
             model=resolved_model,
             session_id=getattr(parent_ctx, "session_id", "") or "",

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/loop/subagent/context.py

@@ -54,6 +54,7 @@ from langchain_agentx.loop.subagent.fork_worktree_notice import build_worktree_n
 from langchain_agentx.loop.message_contract import to_record
 from langchain_agentx.tool_runtime.prompt.session_mode import (
     read_parent_loop_config,
+    read_parent_permission_mode,
     resolve_subagent_headless,
 )
 from langchain_agentx.tool_runtime.session_store import AgentSessionStore
@@ -82,6 +83,8 @@ class SubagentContext:
     fork_from_parent: bool = False  # True = fork 模式，initial_messages 含父会话历史
     is_async: bool = False         # True = 走异步路径（coordinate/fork-async）
     headless: bool = True          # CC 对齐：async 强制 True；sync 继承父 loop headless
+    permission_mode: str | None = None
+    """子图 permission_mode SSOT（derive/ctx 工厂写入；create_subagent_graph 只读本字段）。"""
 
     # 共享字段（从父会话继承）
     session_store: Any = None  # SessionStore
@@ -177,6 +180,7 @@ def create_subagent_context(
     is_builtin_subagent: bool = False,
     recovery: RecoveryPolicy | RecoveryPolicyMode | None = None,
     inherit_hooks: bool | frozenset[HookEvent] | None = True,
+    permission_mode: str | None = None,
 ) -> SubagentContext:
     """工厂函数：从父上下文创建子 Agent 上下文
 
@@ -199,6 +203,7 @@ def create_subagent_context(
         fork_worktree_parent_cwd: 父 Agent 工作目录（须在 ``run_with_cwd_override`` 子 cwd 生效前由编排层捕获）。
         fork_worktree_path: 子 Agent 的 worktree 根路径（通常即 ``path_prep.worktree_dir``）。
         thinking_generation_enabled: 是否启用 request-side thinking（由 SubagentOrchestrator 根据 mode 决定）
+        permission_mode: 显式子 mode（orchestrator 传 derive 结果）；None 时从父 runnable/tool_flags 读一次
 
     Returns:
         SubagentContext 实例
@@ -301,6 +306,12 @@ def create_subagent_context(
         is_async=is_async,
     )
 
+    # permission_mode SSOT：显式（derive）> 父 runnable/tool_flags 读一次；构图不再重读父
+    if isinstance(permission_mode, str) and permission_mode.strip():
+        resolved_permission_mode: str | None = permission_mode.strip()
+    else:
+        resolved_permission_mode = read_parent_permission_mode(parent_ctx)
+
     resolved_query_source = (
         query_source
         if isinstance(query_source, str) and query_source.strip()
@@ -331,6 +342,7 @@ def create_subagent_context(
         fork_from_parent=fork_from_parent,
         is_async=is_async,
         headless=resolved_headless,
+        permission_mode=resolved_permission_mode,
         session_store=session_store,
         tool_registry=getattr(parent_ctx, "tool_registry", None),
         tool_loader=getattr(parent_ctx, "tool_loader", None),
@@ -403,6 +415,8 @@ class ForkedParentRuntime:
     cwd: str | None = None
     thinking_generation_enabled: bool | None = None
     boundary_snapshot: BoundarySnapshot | None = None
+    permission_mode: str | None = None
+    """父 loop permission_mode；后台 fork 写入 SubagentContext SSOT。"""
 
 
 def _clone_parent_session_store(parent_store: Any) -> Any:
@@ -510,6 +524,12 @@ class SubagentContextFactory:
             fork_from_parent=True,
             is_async=False,
             headless=True,
+            permission_mode=(
+                parent_runtime.permission_mode.strip()
+                if isinstance(parent_runtime.permission_mode, str)
+                and parent_runtime.permission_mode.strip()
+                else None
+            ),
             session_store=session_store,
             tool_registry=parent_runtime.tool_registry,
             tool_loader=parent_runtime.tool_loader,

langchain-agentx-python-2.4.5/langchain_agentx/loop/subagent/definition_permission.py

@@ -0,0 +1,73 @@
+"""loop/subagent/definition_permission.py — 子 Agent 定义 permissionMode 父优先合并
+
+职责：官网 Permission modes 规则核（纯函数）；不读 AppState、不写 ctx。
+链路：SubagentConfig / overrides.declared + 父 mode → orchestrator → SubagentContext SSOT。
+裁剪：auto_available 本期恒 True（LOCK-10）；无 plugin 忽略面；非法枚举由 loader 告警后置 None。
+
+规范化枚举见 ``tool_runtime.prompt.session_mode.normalize_definition_permission_mode``
+（避免 tools.loader → loop 反向依赖）。
+"""
+
+from __future__ import annotations
+
+from langchain_agentx.tool_runtime.prompt.session_mode import (
+    normalize_definition_permission_mode,
+)
+
+_ELEVATED_PARENT_MODES = frozenset(
+    {
+        "bypassPermissions",
+        "acceptEdits",
+        "auto",
+    }
+)
+
+
+def _normalize_parent_mode(parent_mode: str | None) -> str | None:
+    """父 mode：blank→None；manual→default；其余保留（含合法枚举）。"""
+    if parent_mode is None:
+        return None
+    if not isinstance(parent_mode, str):
+        return None
+    stripped = parent_mode.strip()
+    if not stripped:
+        return None
+    if stripped == "manual":
+        return "default"
+    return stripped
+
+
+def resolve_definition_permission_mode(
+    *,
+    parent_mode: str | None,
+    declared: str | None,
+    auto_available: bool = True,
+) -> str | None:
+    """合并父会话 mode 与子定义声明（官网 Permission modes / Nested 链式）。
+
+    LOCK-2：父 ∈ elevated → 忽略子声明。
+    LOCK-3：子 bypass 且父非 bypass → 保持父。
+    LOCK-10：本期 auto_available 默认 True。
+    """
+    parent = _normalize_parent_mode(parent_mode)
+    declared_n = normalize_definition_permission_mode(declared)
+
+    if declared_n is None:
+        return parent
+
+    if parent in _ELEVATED_PARENT_MODES:
+        return parent
+
+    if declared_n == "bypassPermissions" and parent != "bypassPermissions":
+        return parent
+
+    if declared_n == "auto" and not auto_available:
+        return parent
+
+    return declared_n
+
+
+__all__ = [
+    "normalize_definition_permission_mode",
+    "resolve_definition_permission_mode",
+]

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/loop/subagent/graph.py

@@ -24,6 +24,41 @@ if TYPE_CHECKING:
     from .context import SubagentContext
 
 
+def resolve_subagent_permission_mode(
+    *,
+    headless: bool,
+    inherited: str | None,
+) -> str:
+    """解析子图 permission_mode。
+
+    headless 时继承父 mode（父 ``auto`` → 子 ``auto``，写快路径才可通）；
+    无父 mode 时回落 ``dontAsk``（无交互面）。非 headless 无父 mode 回落 ``default``。
+
+    对照：docs/bug/headless-subagent-dontask-blocks-write-roots-2026-10-22.md
+    """
+    if isinstance(inherited, str) and inherited.strip():
+        return inherited.strip()
+    return "dontAsk" if headless else "default"
+
+
+def resolve_subagent_container_type(
+    *,
+    headless: bool,
+    permission_mode: str,
+) -> str:
+    """解析子图 container_type，与 ``InteractionProfileResolver`` 合法三元组对齐。
+
+    ``sdk`` 剖面强制 ``permission_mode=dontAsk``；若子图继承了 ``auto`` /
+    ``acceptEdits`` / ``bypassPermissions``，须改走 ``interactive`` + headless
+    （interactive-headless），否则 normalize 会拒掉。
+    """
+    if not headless:
+        return "interactive"
+    if permission_mode == "dontAsk":
+        return "sdk"
+    return "interactive"
+
+
 def create_subagent_graph(
     ctx: SubagentContext,
     loader: Any,
@@ -58,9 +93,10 @@ def create_subagent_graph(
         sync_tool_policy_roots_from_workspace,
     )
     from langchain_agentx.tool_runtime.loader import ToolRuntimeLoader
-    from langchain_agentx.tool_runtime.prompt.session_mode import read_parent_permission_mode
 
-    inherited_permission_mode = read_parent_permission_mode(ctx)
+    # permission_mode SSOT：只读 SubagentContext（derive/create_subagent_context 写入）
+    # 勿再 read_parent_permission_mode — docs/bug/subagent-permission-mode-dual-track-ssot-2026-10-22.md
+    inherited_permission_mode = ctx.permission_mode
 
     if ctx.boundary_snapshot is not None and isinstance(loader, ToolRuntimeLoader):
         sync_tool_policy_roots_from_workspace(
@@ -89,6 +125,18 @@ def create_subagent_graph(
     else:
         session_id = f"subagent:{ctx.subagent_type}:{ctx.agent_id}"
 
+    # 勿无条件 headless→dontAsk / 一律 sdk：会盖掉父 auto，且与 sdk 剖面冲突
+    # （docs/bug/headless-subagent-dontask-blocks-write-roots-2026-10-22.md）
+    sub_headless = bool(ctx.headless)
+    sub_permission_mode = resolve_subagent_permission_mode(
+        headless=sub_headless,
+        inherited=inherited_permission_mode,
+    )
+    sub_container_type = resolve_subagent_container_type(
+        headless=sub_headless,
+        permission_mode=sub_permission_mode,
+    )
+
     # Phase 3: config-first 模式
     config = AgentLoopConfig(
         session_id=session_id,
@@ -128,13 +176,9 @@ def create_subagent_graph(
             fork_from_parent=bool(ctx.fork_from_parent),
         ),
         max_steps=ctx.max_steps,
-        headless=bool(ctx.headless),
-        container_type="sdk" if ctx.headless else "interactive",
-        permission_mode=(
-            "dontAsk"
-            if ctx.headless
-            else (inherited_permission_mode or "default")
-        ),
+        headless=sub_headless,
+        permission_mode=sub_permission_mode,
+        container_type=sub_container_type,
         name=f"subagent:{ctx.subagent_type}:{ctx.agent_id[:8]}",
     )
     services = LoopServices(

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/loop/subagent/orchestrator.py

@@ -26,6 +26,9 @@ from langchain_agentx.loop.runtime.subagent_execution_paths import (
     resolve_subagent_workspace_root,
 )
 from langchain_agentx.loop.subagent.context import SubagentContext, create_subagent_context
+from langchain_agentx.loop.subagent.definition_permission import (
+    resolve_definition_permission_mode,
+)
 from langchain_agentx.loop.subagent.hooks_pipeline import (
     _apply_agent_frontmatter_hooks as _pipeline_apply_agent_hooks,
     _apply_skill_fork_hooks as _pipeline_apply_skill_hooks,
@@ -37,6 +40,7 @@ from langchain_agentx.loop.subagent.mcp_child_servers import McpChildServerSessi
 from langchain_agentx.loop.subagent.prompt import enhance_system_prompt_with_env
 from langchain_agentx.tool_runtime.prompt.session_mode import (
     read_parent_loop_config,
+    read_parent_permission_mode,
     resolve_subagent_headless,
 )
 from langchain_agentx.utils.cwd import run_with_cwd_override
@@ -433,6 +437,11 @@ class SubagentOrchestrator:
                     thinking_generation_enabled=thinking_generation_enabled,
                     is_builtin_subagent=getattr(subagent_config, "is_builtin", False),
                     inherit_hooks=True if inherit_hooks is None else inherit_hooks,
+                    permission_mode=self._resolve_effective_permission_mode(
+                        parent_ctx=ctx,
+                        overrides=overrides,
+                        subagent_config=subagent_config,
+                    ),
                 )
                 _apply_skill_fork_progress_host(
                     subagent_ctx,
@@ -709,6 +718,11 @@ class SubagentOrchestrator:
                     thinking_generation_enabled=thinking_generation_enabled,
                     is_builtin_subagent=getattr(subagent_config, "is_builtin", False),
                     inherit_hooks=True if inherit_hooks is None else inherit_hooks,
+                    permission_mode=self._resolve_effective_permission_mode(
+                        parent_ctx=ctx,
+                        overrides=overrides,
+                        subagent_config=subagent_config,
+                    ),
                 )
                 _apply_skill_fork_progress_host(
                     subagent_ctx,
@@ -854,6 +868,25 @@ class SubagentOrchestrator:
         )
         return overrides, runtime_ctx, prepared
 
+    @staticmethod
+    def _resolve_effective_permission_mode(
+        *,
+        parent_ctx: "ToolExecutionContext",
+        overrides: SubagentContextOverrides,
+        subagent_config: "SubagentConfig",
+    ) -> str | None:
+        """LOCK-8/9：overrides > definition×parent merge > 仅父；禁止裸传 derive。"""
+        parent_mode = read_parent_permission_mode(parent_ctx)
+        if overrides.permission_mode is not None:
+            declared = overrides.permission_mode
+        else:
+            declared = getattr(subagent_config, "permission_mode", None)
+        return resolve_definition_permission_mode(
+            parent_mode=parent_mode,
+            declared=declared,
+            auto_available=True,
+        )
+
     @staticmethod
     def _resolve_child_loader_headless(
         *,

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/tool_runtime/prompt/session_mode.py

@@ -1,9 +1,10 @@
 """
-prompt/session_mode.py — 会话 headless 推断（对齐 CC shouldAvoidPermissionPrompts）
+prompt/session_mode.py — 会话 headless / permission_mode 共享原语
 
 职责：
     在 session / loop 创建时推断是否应避免交互式 permission prompt；
-    子代理派生时继承/强制 headless（对齐 CC runAgent.ts agentGetAppState）。
+    子代理派生时继承/强制 headless（对齐 CC runAgent.ts agentGetAppState）；
+    规范化子 Agent 定义 permissionMode（供 loader 与 loop merge 共用，避免 tools→loop）。
 """
 
 from __future__ import annotations
@@ -13,6 +14,17 @@ from typing import Any
 
 _HEADLESS_CONTAINER_TYPES = frozenset({"background", "batch", "worker", "sdk"})
 
+_DEFINITION_PERMISSION_MODES = frozenset(
+    {
+        "default",
+        "acceptEdits",
+        "auto",
+        "dontAsk",
+        "bypassPermissions",
+        "plan",
+    }
+)
+
 
 def infer_session_headless(
     *,
@@ -64,10 +76,19 @@ def read_parent_loop_config(parent_ctx: Any) -> tuple[bool | None, str | None]:
 
 
 def read_parent_permission_mode(parent_ctx: Any) -> str | None:
-    """从父 ctx / runnable_config 读取 permission_mode（子 Agent compile 继承用）。"""
+    """从父 ctx / tool_flags / runnable_config 读取 permission_mode（子 Agent 继承用）。
+
+    读序：显式字段 > tool_flags > configurable > loop_config。
+    与 RuntimeContextFactory.derive / create_subagent_context 共用，避免双轨分歧。
+    """
     direct = getattr(parent_ctx, "permission_mode", None)
     if isinstance(direct, str) and direct.strip():
         return direct.strip()
+    tool_flags = getattr(parent_ctx, "tool_flags", None)
+    if isinstance(tool_flags, dict):
+        flag_mode = tool_flags.get("permission_mode")
+        if isinstance(flag_mode, str) and flag_mode.strip():
+            return flag_mode.strip()
     runnable_config = getattr(parent_ctx, "runnable_config", None)
     if not isinstance(runnable_config, dict):
         return None
@@ -83,6 +104,25 @@ def read_parent_permission_mode(parent_ctx: Any) -> str | None:
     return None
 
 
+def normalize_definition_permission_mode(value: str | None) -> str | None:
+    """规范化子声明 permissionMode：blank→None；manual→default；非法→None。
+
+    供 Agent markdown loader 与 ``resolve_definition_permission_mode`` 共用。
+    """
+    if value is None:
+        return None
+    if not isinstance(value, str):
+        return None
+    stripped = value.strip()
+    if not stripped:
+        return None
+    if stripped == "manual":
+        return "default"
+    if stripped not in _DEFINITION_PERMISSION_MODES:
+        return None
+    return stripped
+
+
 def resolve_subagent_headless(
     *,
     parent_headless: bool | None,

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/tools/agent/loader.py

@@ -8,7 +8,8 @@ tools/agent/loader.py — 用户自定义 Agent 加载器
 CC 对照：src/tools/AgentTool/loadAgentsDir.ts getAgentDefinitionsWithOverrides()
          + parseAgentFromMarkdown()
 当前裁剪范围：v1 Markdown 解析 + YAML frontmatter + 优先级合并；
-             tools/disallowedTools/maxTurns/background/mcpServers/requiredMcpServers 字段支持；
+             tools/disallowedTools/maxTurns/background/mcpServers/requiredMcpServers/
+             permissionMode 字段支持（非法枚举 → None + warning，LOCK-11）；
              agents 目录下 ``.md`` 扩展名 **大小写不敏感**（``*.MD`` / ``*.Md`` 与 ``*.md`` 同等）；
              v2 memoization / file watcher
 
@@ -23,6 +24,7 @@ CC 对照：src/tools/AgentTool/loadAgentsDir.ts getAgentDefinitionsWithOverride
   disallowedTools: [Edit] # 可选，denylist（优先级高于 tools）
   maxTurns: 30            # 可选，default_max_steps
   background: false       # 可选，allow_async
+  permissionMode: dontAsk # 可选；与父 mode 合并见 resolve_definition_permission_mode
   hooks: {...}            # 可选，与 skill frontmatter 同结构（子 loop SUBAGENT_STOP）
   ---
   系统提示词 body...
@@ -203,6 +205,10 @@ class AgentDefinitionLoader:
         mcp_servers = mcp_parser.parse_servers(
             frontmatter.get("mcpServers", frontmatter.get("mcp_servers"))
         )
+        permission_mode = _parse_permission_mode(
+            frontmatter.get("permissionMode", frontmatter.get("permission_mode")),
+            file_path=file_path,
+        )
 
         return SubagentConfig(
             name=name.strip(),
@@ -221,6 +227,7 @@ class AgentDefinitionLoader:
             mcp_servers=mcp_servers,
             hooks=hooks,
             hooks_root=str(file_path.parent) if hooks else None,
+            permission_mode=permission_mode,
         )
 
     def _split_frontmatter(self, text: str) -> tuple[dict | None, str]:
@@ -380,6 +387,31 @@ def _parse_agent_memory_scope(raw: Any, file_path: Path):
     return scope  # type: AgentMemoryScope
 
 
+def _parse_permission_mode(raw: Any, *, file_path: Path) -> str | None:
+    """解析 frontmatter permissionMode；非法 → None + warning（LOCK-11）。"""
+    from langchain_agentx.tool_runtime.prompt.session_mode import (
+        normalize_definition_permission_mode,
+    )
+
+    if raw is None:
+        return None
+    if not isinstance(raw, str):
+        logger.warning(
+            "Agent file %s invalid permissionMode %r, ignoring",
+            file_path,
+            raw,
+        )
+        return None
+    normalized = normalize_definition_permission_mode(raw)
+    if normalized is None and raw.strip():
+        logger.warning(
+            "Agent file %s invalid permissionMode %r, ignoring",
+            file_path,
+            raw,
+        )
+    return normalized
+
+
 def _describe_tools(tools_raw: Any, disallowed_raw: Any) -> str:
     if tools_raw is None or tools_raw == ["*"]:
         base = "All tools"

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx/tools/agent/registry/config.py

@@ -51,3 +51,5 @@ class SubagentConfig:
     """Frontmatter ``hooks:``（与 skill 结构相同）；子 loop 由 orchestrator 注册。"""
     hooks_root: str | None = None
     """Agent 定义文件所在目录（``CLAUDE_AGENT_DIR`` / command env 根）。"""
+    permission_mode: str | None = None
+    """Frontmatter ``permissionMode``；与父 mode 经 ``resolve_definition_permission_mode`` 合并后写入 SSOT。"""

{langchain-agentx-python-2.4.1 → langchain-agentx-python-2.4.5}/langchain_agentx_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: langchain-agentx-python
-Version: 2.4.1
+Version: 2.4.5
 Summary: LangChain/LangGraph-based agent utilities for CodeBaseX.
 Author-email: GoodMood2008 <GoodMood2008@users.noreply.github.com>
 License:                                  Apache License