After `/reload` or a pending `/mcp reconnect` restarts the owned server,
quitting now allows coordinated graceful teardown to finish instead of
canceling Textual’s application loop early.
---
Restart tracking now distinguishes Textual workers and explicitly
detached tasks from inline callers on the long-lived message loop. The
deferred web-search restart prompt is also registered at its scheduling
site, preserving cancellation and waiting for genuine background restart
work before the server stops.
<details>
<summary>Test plan</summary>
- `python -m pytest -q
tests/unit_tests/test_app.py::TestExitGracefulWorkerHandoff
tests/unit_tests/test_app.py::TestRespawnServer` (49 passed)
- Ruff check and format validation for the edited files
- `make -C libs/code type`
</details>
Interactive shutdown is faster because independent cleanup now overlaps
instead of running sequentially, without skipping any cleanup.
---
`session.end` hooks run off the Textual event loop. Interrupted-agent
cleanup still finishes before server shutdown; afterward, pending hooks
drain while the server stops.
Server stop and restart paths are synchronized to prevent duplicate or
racing teardown. Existing timeouts and cleanup guarantees are unchanged,
and debug logs record phase timings.
Made by [Open
SWE](https://openswe.vercel.app/agents/ce9a3224-140d-08bc-25d2-202982da0203)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Gemini 3.6 Flash supersedes 3.5 Flash, so surface the newer model in the
`/model` selector instead of the older one.
Swaps both the `google_genai` and `openrouter` Gemini `3.5 Flash`
entries in the `deepagents-code` recommended-model list for `3.6 Flash`,
and moves the model-specific default thinking-level keying in
`reasoning_effort` over to the new id so the recommended model keeps its
`medium` default. Representative unit-test references are updated to
match.
Made by [Open
SWE](https://openswe.vercel.app/agents/0441ce8a-bfb9-b73a-31c9-9754af24aaad)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Deep Agents Code now respects explicit MCP server disables for servers
bundled with installed plugins.
---
Installing or enabling a plugin is the user's trust decision for all of
its bundled components, including MCP servers. First-time plugin servers
therefore continue to load without requiring a separate project
approval.
Plugin-provided MCP servers now pass through the user-level deny policy
before loading. An explicitly disabled server remains disabled even when
it is supplied by an installed plugin. If the MCP trust policy cannot be
read, plugin servers fail closed rather than risking bypassing a saved
disable. Invalid plugin MCP configuration shapes are surfaced as
configuration errors.
---------
Co-authored-by: corridor-security[bot] <203152403+corridor-security[bot]@users.noreply.github.com>
Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>
Co-authored-by: Mason Daugherty <github@mdrxy.com>
Co-authored-by: Mason Daugherty <mason@langchain.dev>
Users who configure a process-wide MCP allowlist and also choose “Allow
for this project — until changed” are now prompted only once (fixes an
issue where this was previously discarded).
---
A user can intentionally have two kinds of MCP approval at the same
time:
- Process-wide server names in
`DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS`, which bypass
project and server-definition binding.
- Project-scoped approvals saved by the startup prompt, which match only
the same project root, server name, and server-definition fingerprint.
### Before
1. The user starts `dcode` in a project whose MCP servers are not in the
process-wide allowlist.
2. They choose “Allow for this project — until changed.”
3. `dcode` writes valid scoped approvals and reports:
Allowing 2 project MCP servers for this session; remembering 2 for this
project.
4. On the next launch, the presence of the process-wide env var causes
the loader to ignore every saved scoped approval, even when the env var
contains unrelated names.
5. The same “Approve project MCP servers” prompt appears again.
### After
- Process-wide names and scoped remembered approvals are independent
grants, so both remain active.
- The next launch recognizes the saved project/server fingerprints and
does not prompt again.
- An explicitly empty process-wide allowlist contributes no global names
but does not clear remembered project approvals.
- A changed server command or URL still requires re-approval, and
disabled server names still take precedence over every approval source.
Regression coverage reproduces the repeated-launch case and verifies
both populated and empty process-wide allowlists.
Pressing Esc in the project MCP approval prompt now aborts startup and
returns to the terminal instead of treating Esc as **Deny** and
continuing into the TUI.
---
Esc now produces the same launch-cancellation outcome in both project
MCP selectors. The explicit **Deny** option remains available and
selected by default, so declining trust still requires choosing it and
pressing Enter.
Related #4860
Auto mode can now use a uniquely allocated OS temporary text file when a
command requires file-based input, then remove that exact artifact
without asking separately. Predictable or pre-existing temp paths and
all other outside-worktree writes remain denied.
---
dcode owns the scratch lifecycle: the model supplies content and an
optional suffix, while dcode chooses and exclusively creates the path. A
successful allocation records private provenance scoped to the current
thread and user turn. Only the exact same file identity can be removed;
failed calls, prior proposals, other turns, parent directories, and
generic file tools receive no authority.
The classifier may use this provenance only to establish what the
artifact is. Literal user text remains the sole source of consent for
the action that consumes it or any destination it affects.
<details>
<summary>Test plan</summary>
- `python -m pytest -q tests/unit_tests/test_auto_mode.py`
- `make -C libs/code lint`
- `make -C libs/code type`
</details>
Fixes the newline-entry inconsistencies across dcode's text-entry
surfaces, and refactors so any future surface inherits the affordances.
Three gaps came out of a comparison with Codex and opencode:
- The goal-criteria editor advertised a hardcoded "Shift+Enter newline"
in its footer. On terminals that cannot report Shift+Enter (e.g. macOS
Terminal.app) that chord submits, so the hint pointed at the wrong key.
- The VSCode `backslash+enter`→newline fallback (for terminals that
emulate Shift+Enter that way) lived only in the chat input, so
Shift+Enter submitted with a stray backslash in the goal editor and the
`ask_user` free-text prompt.
- The `ask_user` free-text prompt never told users how to insert a
newline at all.
Rather than patch each surface, the shared newline affordances now live
in the common `PasteBurstTextArea` base: the modifier-Enter / Ctrl+J
bindings, the derived newline-key set, and the backslash+enter fallback
(via small `_consume_backslash_enter_newline` /
`_track_backslash_pending` / `_consume_modifier_newline` helpers). Both
the chat input and the inline prompts inherit them, and any future
`TextArea`-based input surface that extends the base gets them for free.
A shared `newline_hint()` helper renders the terminal-aware shortcut
(`Ctrl+J` / `Option+Enter` / `Shift+Enter`) consistently, now used by
both the goal editor and the `ask_user` footer.
The chat input's existing behavior — including the completion-active
gating on the backslash path and key ordering — is preserved.
Made by [Open
SWE](https://openswe.vercel.app/agents/a7bdfa65-aba1-0246-373d-5a12d84a9860)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
The install script now respects the configured uv tool binary directory,
retries transient downloads, and avoids unsafe fallback files and broad
ownership changes. Existing installations that are current but shadowed
on `PATH` are reinstalled into the uv tool directory instead of being
incorrectly treated as up to date.
---
The installer previously assumed uv placed executables in
`~/.local/bin`, so custom uv configuration could make version detection,
verification, `PATH` setup, and ownership repair target the wrong files.
A single transient PyPI or uv bootstrap failure also immediately fell
back or failed, and predictable `/tmp` fallbacks were used when `mktemp`
was unavailable.
This resolves the tool bin through `uv tool dir --bin` with legacy
fallbacks, compares executable paths by inode, preserves existing
regular files when adding links, retries downloads three times, and
fails closed for required temporary files. Root and MDM installs avoid
running pre-existing user executables and narrow ownership changes to
paths created by the installer.
Regression tests cover custom and legacy uv bin locations, shadowed
installs, root execution, retries, and secure temporary-file failures.
The `Ctrl+\` debug console now only copies a log line or snapshot value
on click when a new "Click to copy" checkbox is checked, and that choice
is remembered across restarts. The checkbox defaults to off, so clicks
no longer clobber the clipboard while scrolling or selecting text.
Keyboard Enter-to-copy for the selected log line stays always on.
---
Previously every click in the console (a log line, or a copyable
snapshot value such as the thread ID) copied to the clipboard, which was
easy to trigger accidentally. This puts that behavior behind an opt-in
toolbar checkbox while preserving the primary keyboard copy path.
Snapshot `(langsmith)` links still open on click regardless of the
toggle, and the checkbox is reachable via the existing Tab focus cycle.
The preference is persisted to `[ui].debug_console_click_to_copy` in
`~/.deepagents/config.toml` (mirroring the `[ui].show_scrollbar`
pattern), with a `DEEPAGENTS_CODE_DEBUG_CONSOLE_CLICK_TO_COPY` env
override and a matching config-manifest entry so `dcode config` can
introspect it. The config write runs off the UI thread and degrades to a
toast on failure.
Made by [Open
SWE](https://openswe.vercel.app/agents/349c457d-f7ec-252c-cdc3-54fa375ad517)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
The `/plugins` modal now dims the background behind it, consistent with
other modals.
---
The `/plugins` (`PluginManagerScreen`) modal overrode Textual's default
`ModalScreen` backdrop with `background: transparent`, making it fully
see-through instead of dimming the content behind it like every other
modal. Removing the override lets it inherit the standard `background:
$background 60%` dim backdrop (which still degrades to transparent under
ansi themes).
Made by [Open
SWE](https://openswe.vercel.app/agents/8d011f9e-b11e-7cc1-e8a6-6138c7381983)
---------
Signed-off-by: Mason Daugherty <github@mdrxy.com>
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
When `DEEPAGENTS_CODE_EXPERIMENTAL` is set, `dcode` now surfaces that
unstable behavior is active — an `(experimental mode)` tag on the
startup splash (alongside the existing `(debug enabled)` tag) and an
`Experimental` on/off row in the Debug Console snapshot.
---
Experimental behavior was previously invisible, so users couldn't tell
when the flag was in effect. The splash tag mirrors the `(debug
enabled)` pattern (its own themed style helper, ANSI fallback, rendered
even when the version is hidden, ordered debug → experimental → local).
The Debug Console gains an always-present `Experimental` field so the
diagnostic snapshot reports the flag state directly.
Made by [Open
SWE](https://openswe.vercel.app/agents/6cb12589-9525-8da6-05db-a4134a7ea44a)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`dcode update` now returns fresh results even in the seconds right after
a new release lands on PyPI.
---
`dcode update` already calls `is_update_available(bypass_cache=True)`,
which skips the local on-disk version cache. But PyPI's JSON API is
served through a CDN (Fastly), so immediately after a release an edge
node can keep serving a stale copy until the purge propagates. That's
why a first `dcode update` reported "Already on the latest version
(v0.1.43)" while a retry seconds later found v0.1.44.
When the local cache is bypassed, the PyPI requests now also defeat the
CDN edge cache: they send `Cache-Control: no-cache` / `Pragma: no-cache`
request headers and append a unique cache-busting query parameter so the
CDN cache key misses and the response comes fresh from origin. A shared
`_pypi_request_kwargs` helper applies this consistently to the version
check, the per-release pre-release-pin lookup, and the SDK release-time
lookup. Routine (non-forced) refreshes are unchanged.
Made by [Open
SWE](https://openswe.vercel.app/agents/f2647aaa-94ac-f901-c39d-e081d0eb1f79)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Related #4786
When `dcode` starts with MCP servers enabled, it loads the code used to
connect to those servers. Loading the optional authentication support
for the first time can perform filesystem work. Previously, that work
happened on the async server's event loop, where blocking calls are
rejected, so startup could fail with:
BlockingError: Blocking call to os.getcwd
`dcode` now loads MCP authentication support in a worker thread before
the server needs it. This keeps the potentially blocking work away from
the event loop so the runtime no longer rejects it during startup.
---
#4786 addressed the immediate failure by limiting `filelock` to versions
before 3.30. This follow-up hardens `dcode` against the broader problem
instead of relying only on one dependency version. The version limit
remains in place for now.
If the optional authentication support cannot be loaded, the failure is
still reported only for an MCP server that needs it; it does not prevent
unrelated or stdio MCP servers from loading.
A startup smoke test uses the same blocking-call detector as the runtime
to verify that first-time authentication loading happens in a worker
thread, so CI catches regressions.
Marketplace entries in the plugin manager now have spacing between them,
matching the plugins list.
---
The marketplaces tab rendered entries back-to-back, while the plugins
list (`_plugin_options`) inserts a disabled spacer `Option` between
rows. This applies the same disabled-spacer pattern between marketplace
rows so both surfaces are visually consistent. The spacers are disabled,
so keyboard navigation still skips over them.
Made by [Open
SWE](https://openswe.vercel.app/agents/045a43e2-f199-47e8-a7f0-ffb5dbff5762)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Auto mode now shows the same warning whether it is enabled at startup or
toggled during a session.
---
The startup path used implementation-specific copy that differed from
the toggle path. Reuse one warning constant so both paths stay aligned
and future edits cannot drift.
Approval prompts no longer suggest enabling Auto mode when it is
unavailable (experimental opt-in off).
---
The HITL approval widget always offered "Enable Auto for this thread
(a)" even when Auto mode is ineligible (e.g.
`DEEPAGENTS_CODE_EXPERIMENTAL` is off or a sandbox is active), where
choosing it only surfaced the "Auto is available only in the opt-in
local TUI beta" warning and did nothing. `ApprovalMenu` now takes
`auto_mode_eligible` (passed from `App._auto_mode_eligible`) and omits
the Auto option when it can't be enabled, dynamically renumbering
options and quick keys. A live Auto fallback still shows its
Switch-to-Manual affordance.
Made by [Open
SWE](https://openswe.vercel.app/agents/6c5eb368-e615-f9d7-b8d0-bbce9ebaa3ff)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Auto mode no longer raises `BlockingError` while resolving proposed file
paths on the LangGraph server event loop.
---
Auto mode still uses canonical, symlink-aware `Path.resolve()` before
deciding whether a write stays inside the worktree. The async planning
path now runs the complete deterministic policy check in a worker
thread, so current and future filesystem-backed policy checks cannot
block the event loop.
Regression coverage drives `awrap_model_call()` with the original
absolute `/tmp/langchain-groq-reasoning-model-pr.md` target and verifies
resolution happens off the event-loop thread. It also confirms routine
in-worktree writes remain deterministic allows and symlink escapes still
require classifier review.
Deep Agents Code now offers an opt-in **Auto** approval mode. Auto
immediately runs a narrow, deterministic set of routine actions. For
other approval-gated actions, the active model checks whether they match
the user's literal request. It runs approved actions and blocks the
rest. After repeated denials or classifier failures, Auto sends the next
batch to the normal approval UI, then continues in Auto mode.
Auto is experimental and currently limited to interactive, local TUI
sessions using `FilesystemBackend`. Manual remains the default.
> [!WARNING]
> Auto is an authorization heuristic for a local coding agent. It is
**not** sandbox containment, an operating-system boundary, or a
guarantee that model-generated actions are safe.
## Enable Auto
1. Set `DEEPAGENTS_CODE_EXPERIMENTAL=1`.
2. Select Auto in one of these ways:
- In-app: use <kbd>Shift</kbd>+<kbd>Tab</kbd> or
<kbd>Ctrl</kbd>+<kbd>T</kbd> to toggle between Manual and Auto.
- At launch: pass `-y` or `--auto-approve`.
- By default: set `[startup].mode = "auto"` in
`~/.deepagents/config.toml`.
`-y` and `--auto-approve` now select Auto rather than unrestricted
execution. Users who want the previous unrestricted behavior must choose
`--yolo`. The removed `dangerously-auto` startup value is no longer
recognized and falls back to Manual.
---
## Why
The previous approval modes forced a binary choice:
- **Manual** preserved a human checkpoint, but repeatedly interrupted
routine coding work.
- **YOLO** removed that checkpoint entirely, including for actions that
exceeded the user's request (blanket approval).
Auto introduces a third policy: keep the low-friction path for clearly
routine work, but make authorization explicit for potentially
consequential actions.
| Mode | Policy | Entry points | Availability |
|---|---|---|---|
| **Manual** | Uses the normal human approval UI for gated actions |
Default; `[startup].mode = "manual"` | All interactive sessions |
| **Auto** | Uses narrow deterministic rules, then classifier review,
with human fallback after repeated denials or failures | `-y`,
`--auto-approve`, `[startup].mode = "auto"`, or the live keyboard toggle
| Experimental, local, unsandboxed TUI sessions |
| **YOLO** | Runs gated actions without review | `--yolo` or
`[startup].mode = "yolo"` | Interactive sessions after a one-time
acknowledgement |
## How Auto handles a proposed action
```mermaid
flowchart TD
A[Model proposes tool calls] --> B{Covered by the approval policy?}
B -->|No| X[Existing tool behavior is unchanged]
B -->|Yes| S{Is this thread still in Auto, with readable denial/failure history?}
S -->|No| J[Open the existing approval HITL widget]
S -->|Yes| C{Narrow deterministic allow?}
C -->|Yes| R[Execute without a classifier call]
C -->|No| D[Build one structured decision batch]
D --> H{Was this batch already reviewed, or do earlier denials/failures require human review?}
H -->|Yes| J
H -->|No| E[Active model reviews effects against user request/input]
E -->|Allow| R
E -->|Deny| Q{Total-denial threshold reached?}
Q -->|No| F[Return a sanitized error result]
Q -->|Yes| J
E -->|Unavailable or invalid| G[Return a compact unavailable result]
F --> I[Agent can revise its plan]
G --> I
J -->|Approve| R
J -->|Reject| K[Return a rejection result]
J -->|Switch to Manual| L[Persist Manual, then review the full gated batch]
R --> M[Reconcile the result and continue]
K --> M
I --> M
L --> M
```
In practice:
1. **Auto starts with Manual's existing human-in-the-loop (HITL)
rules.** It changes only how HITL-gated actions are reviewed.
- These built-in tools are not HITL-gated: `ls`, `read_file`, `glob`,
`grep`, `ask_user`, `get_goal`, `get_rubric`, and `update_goal`.
- MCP tools with valid read-only annotations, the optional `js_eval`
tool, and caller-supplied tools without HITL configuration continue to
run normally.
2. **Only narrow cases resolve locally.** The deterministic policy can
allow, never deny:
- A routine write such as `src/parser.py` can proceed based on its
resolved path and suffix; a sensitive target such as
`.github/workflows/ci.yml` goes to classifier review.
- A read-only Git command such as `git status` can proceed; a mutating
command such as `git commit -m change` goes to classifier review.
Explicit shell allow-list entries still apply after Auto removes broad
and wildcard rules.
- An MCP tool with a valid read-only annotation can proceed; tools
without read-only annotations, or with contradictory or malformed
annotations, go to classifier review.
<details>
<summary>How MCP read-only annotations are evaluated</summary>
MCP servers can attach standard `ToolAnnotations` when advertising a
tool. Deep Agents Code copies those annotations into the wrapped tool's
metadata and lets the tool bypass classifier review only when:
- `readOnlyHint` is the literal Boolean `true`;
- `destructiveHint` is absent, `null`, or `false`; and
- every supplied standard hint (`readOnlyHint`, `destructiveHint`,
`idempotentHint`, or `openWorldHint`) is a Boolean or `null`, rather
than a string or another type.
For example:
- `readOnlyHint: true, destructiveHint: false` proceeds without
classifier review.
- No `readOnlyHint` goes to review because the tool never explicitly
claimed to be read-only.
- `readOnlyHint: true, destructiveHint: true` goes to review because the
hints contradict each other.
- `readOnlyHint: true, destructiveHint: "false"` goes to review because
`"false"` is a string, not a Boolean.
In Auto, tools that do not pass this check enter the classifier batch.
In Manual, they use the normal approval UI; headless runtimes reject
them because they have no approval UI. The annotation is a
server-provided assertion that Deep Agents Code does not independently
verify.
</details>
3. **The classifier reviews all unresolved calls together.** Only
pre-expansion literal user text can authorize an action. Referenced
paths, summarized arguments, prior tool calls, and MCP metadata provide
effect context but cannot grant permission. Expanded files, assistant
prose, and tool results are excluded.
- **Example:** For the literal request `Research issue #123, update
@src/parser.py, and open a PR`, proposed `fetch_url` and `git push`
calls can be reviewed in one batch and receive separate decisions. The
referenced path and summarized call arguments help identify what each
action would affect, but the expanded file contents are not sent.
Instructions found in that file, assistant prose, or a prior tool result
therefore cannot widen the user's request or authorize another action.
4. **Auto revalidates before side effects.** The decision plan is bound
to the thread, mode, batch, and exact gated calls. Missing or invalid
state, a mode race, or a replay falls back to human review. Denied calls
are skipped and receive sanitized error results so the agent can revise
its plan.
- **Examples:** If the user switches to Manual while classifier review
is in progress, an earlier Auto decision cannot execute silently; the
normal approval UI opens instead. A plan associated with another thread,
a different set of tool-call IDs, missing decisions, or a previously
processed batch also requires human review. If Auto denies a proposed
`delete`, it returns an error result with that call's ID instead of
invoking the tool, allowing the agent to propose a safer next step.
## Limits and user-visible behavior
- The Manual approval menu can enable Auto for the current thread.
Threshold fallback can switch permanently to Manual or perform a one-off
review while leaving Auto enabled.
- Denials, classifier failures, and fallbacks appear as short sanitized
transcript events rather than raw classifier output.
- Auto requested without the experimental opt-in, or in a sandboxed
session, falls back to Manual with a warning. Explicit autonomous-mode
flags are rejected in non-interactive and ACP entry points.
- The active model is not an independent security authority. MCP
read-only annotations are trusted as a deliberate beta tradeoff.
- Parent-level Auto review does not cover actions performed inside
delegated subagents or broader explicitly configured PTC/`js_eval`
fan-out. Model providers and tracing backends may still observe
classifier inputs and outputs even though the TUI hides them.
<details>
<summary><strong>Implementation and reviewer details</strong></summary>
### Approval boundary and decision inputs
The following tools are HITL-gated:
- `execute`, `write_file`, `edit_file`, and `delete`;
- `web_search` and `fetch_url`;
- `task`;
- `start_async_task`, `update_async_task`, and `cancel_async_task`;
- `compact_conversation` when optional compaction approval is enabled;
and
- MCP tools without valid read-only annotations.
For deterministic writes and edits, the fast path uses only the resolved
target path and suffix; it does not inspect proposed content. Dependency
and lock files, sensitive names and locations, shell scripts,
unsupported file types, and paths outside the trusted root do not
qualify. Selected Git inspection commands must also pass shell-control
and outside-worktree path checks. Configured shell entries remain an
explicit user trust exception, but broad commands and wildcard entries
are ignored by Auto.
The classifier receives one typed batch containing:
- up to 20 client-attached, pre-expansion prompt rows, including literal
prompts, referenced path names, and turn IDs;
- trusted project-root and redacted-origin facts; and
- depth- and length-limited effect context from current arguments, prior
AI tool calls after the latest trusted prompt, and selected MCP
annotations.
Only `literal_user_text` is authorizing. Content-bearing write/edit
arguments are reduced to character counts. The classifier must return
exactly one unique decision for every unresolved tool-call ID; missing,
duplicated, unknown, or malformed decisions make the classifier
unavailable rather than partially authorizing the batch.
Before routing calls, Auto re-reads the live mode and validates its
private decision plan. Manual mode, invalid control state, mismatched
calls, or replayed batches require human review. Classifier review uses
a second call to the active session model with a 20-second timeout. Raw
classifier text and tool-call chunks are hidden from the transcript,
while usage accounting and tracing are retained.
Denial reasons are sanitized before persistence or display by removing
control characters, known credential values, credential-like
assignments, and URL credentials or query values. MCP tools without
valid read-only annotations are HITL-gated; headless runtimes reject
them because no approval UI is available.
### Failure and fallback behavior
| Condition | Result |
|---|---|
| Selected mode cannot be persisted | Persist Manual instead; if that
also fails, block graph execution |
| Classifier timeout, provider error, or invalid response | Block the
affected calls and return a compact unavailable result |
| Three consecutive policy denials in one user turn | Send the next
classifier-review-eligible calls to one-off human review |
| Two consecutive classifier-unavailable results | Send the next
classifier-review-eligible calls to one-off human review |
| A denial raises the thread's total denial count to 20 | Require human
review for that call immediately |
| Counter state cannot be read or reset before classification | Require
human review for every gated call in the batch |
| Counter state cannot be written after classification | Require human
review for classifier-path decisions; deterministic fast-path allows
remain eligible |
| Decision plan is missing, malformed, replayed, or bound to another
thread | Require Manual review |
| User chooses **Switch to Manual** during fallback | Persist Manual
before presenting the full gated batch for review |
### Python API and state compatibility
- Existing Boolean compatibility input retains its previous meaning:
`auto_approve=True` maps to YOLO, not Auto.
- Per-thread Store records persist the typed mode instead of a Boolean.
Missing, legacy, or malformed records fail closed.
- Startup and live mode changes take effect only after the Store write
succeeds.
- YOLO requires a versioned local acknowledgement and cannot be entered
through the live keyboard toggle.
### Reviewer guide
Suggested review order:
1. **Mode semantics and persistence** — `ApprovalMode`, Store payloads,
acknowledgement, startup resolution, and live mode writes.
2. **Authorization policy** — `AutoModeHITLMiddleware`, literal prompt
metadata, deterministic routing, structured classification,
sanitization, counters, and checkpoint validation.
3. **Graph boundary** — middleware replacement, the gated-tool
inventory, MCP annotation handling, headless rejection, PTC, and
delegated-subagent scope.
4. **Client behavior** — stream metadata, classifier-output filtering,
fallback interrupts, keyboard toggles, status presentation, and
transcript events.
Highest-risk invariants:
- every consequential tool in the supported boundary is gated or
explicitly outside scope;
- path-based writes and selected Git fast paths stay within their
documented checks;
- only literal user prompts can authorize classifier-reviewed effects;
- malformed output, Store failures, mode races, and checkpoint replay
fail closed; and
- hidden classifier chunks never create transcript content while usage
accounting remains intact.
</details>
When quitting waits for unfinished work, `deepagents-code` now shows a
brief "Finishing pending work before exit…" toast so the pause reads as
intentional rather than a hang.
---
`DeepAgentsApp.exit()` only defers teardown when it must wait for an
in-flight agent worker or pending fire-and-forget hooks. That wait was
previously silent, so a user pressing quit could think the app had
frozen. This adds a single toast on exactly that deferred path.
The notification is emitted before scheduling the `_graceful_exit`
coroutine. Because scheduling returns control to the event loop and
teardown is deferred behind at least one `await`, Textual's message pump
gets an opportunity to render the toast before `super().exit()` runs.
Immediate/idle exits skip this branch entirely, no delay is introduced,
and the existing two-second grace period is untouched. A repeated/forced
exit hits the existing force-quit guard before reaching the notify, so
the toast is never duplicated (including when both wait conditions
apply).
Made by [Open
SWE](https://openswe.vercel.app/agents/26e6d24a-3180-4334-b655-4075767ae45b)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`dcode config list`/`dcode config ls` are removed; use `dcode config
show` (add `--verbose` to see all option keys).
---
`config list`/`config ls` duplicated `config show`, so this removes both
parser aliases and makes `config show` the sole command for displaying
effective config values and their sources. Drops `list_mode`, the
`config list` JSON label/catalog special-casing, backward-compat
comments, and now-dead paths; `config show --json` keeps effective-only
fields (catalog folded in only with `--verbose`) and always labels the
payload `"config show"`. User-facing suggestions now point at `config
show`/`config show --verbose`. Backward compatibility is intentionally
not preserved.
### Breaking change
`config list --json` was the machine-readable catalog endpoint (its JSON
envelope `command` field was `"config list"` and it always folded in
catalog fields). It is gone: the command no longer parses, and the
catalog fields are now available via `config show --verbose --json`
(payload labeled `"config show"`). Any machine consumer of `config list
--json` must migrate.
Made by [Open
SWE](https://openswe.vercel.app/agents/7351f382-9468-b4dc-2df4-03eaf75ef12f)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Typing in the chat input is no longer blocked while the `/restart`
command respawns the server.
---
Running `/restart` froze the chat input until the server finished
respawning. `_handle_restart_command` awaited the multi-second
`_restart_server_manual` (`server_proc.restart()`) directly on the
Textual message pump, so key events stopped being forwarded and the chat
input was "blocked". This is the same class of bug fixed for the MCP
viewer `Ctrl+R` reconnect path in #4753 — the fix runs the respawn as a
detached `asyncio.create_task` (mirroring the MCP viewer/force-reconnect
paths), keeping the pump free so keystrokes stay live and queued
messages drain once `ServerReady` fires.
Made by [Open
SWE](https://openswe.vercel.app/agents/a27e2ef4-b392-c236-f410-c1b9ebc533aa)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Editable installs conflated three distinct version facts, so `/version`,
`--version`, and `doctor` could silently report a single number that hid
stale metadata or a broken SDK dependency pin. Version diagnostics now
separate the live source version, the installed distribution metadata
version, and the `deepagents` requirement that `deepagents-code`
declares — reporting the source version as primary for editable
installs, showing the installed metadata alongside it when they drift,
and flagging an actionable mismatch when the installed SDK metadata does
not satisfy the declared requirement.
---
A new structured `DistributionVersion`/`VersionReport` representation in
`extras_info` is the single source of truth these surfaces render.
`resolve_sdk_version()` is preserved as a thin compatibility wrapper so
existing callers are untouched.
- `/version`, `--version`, and `doctor` render the same facts: an
editable SDK is now clearly identified (not just editable
`deepagents-code`), source/metadata drift shows both versions, and an
unsatisfied requirement (compared via `packaging.Requirement`) is
surfaced as `required by deepagents-code: <version> — mismatch`.
- `doctor` marks a dependency-requirement mismatch unhealthy, while
treating source/metadata drift as informational since it is normal while
editing SDK source.
- Normal non-editable output is unchanged when all versions agree, and
version collection stays fully offline and best-effort (no
`uv`/`pip`/PyPI, no subprocess).
- No package versions or dependency pins were changed.
Two existing `doctor` integration tests now isolate the SDK requirement
check so they stay deterministic regardless of the workspace's
intentional prerelease pin; the mismatch and drift paths have dedicated
new coverage.
Made by [Open
SWE](https://openswe.vercel.app/agents/1145d1a5-ba8a-abbb-e5b7-039e9c2a5b04)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fixed dcode TUI `task` elapsed timers resetting when a nested subagent
reached a human-in-the-loop approval checkpoint.
---
A long-running `task [general-purpose]` row's elapsed timer reset to
zero whenever a nested subagent hit a HITL approval checkpoint. The
interrupt handler paused/resumed *every* tracked tool row, and
`ToolCallMessage.pause_running()`/`set_running()` clear and reassign
`_start_time` — so an unrelated nested child's (or sibling subagent's)
approval restarted the outer `task` timers. This scopes pause/resume to
only the rows an interrupt actually owns (matched by tool name + args
via the new `_interrupt_owned_tool_rows` helper). Untracked nested-child
interrupts now own no outer row, so outer and sibling `task` timers stay
monotonic and completed `Took …` durations reflect full execution time.
A tool awaiting its own initial approval still pauses then resumes as
before.
Made by [Open
SWE](https://openswe.vercel.app/agents/5c0ae962-c16b-6e04-ada4-d4d76826adb9)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
The `/version` command's update-available line hard-coded `uv tool
install -U deepagents-code`, which is stale guidance now that dcode
auto-updates on relaunch and offers `/update` and `dcode update`. It now
points at the relaunch/auto-update path when auto-update is enabled, and
at `/update` or `dcode update` otherwise.
---
Made by [Open
SWE](https://openswe.vercel.app/agents/a8b54b7c-cc2f-e6cc-a034-61a8578b8a04)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fixed `/goal` criteria being discarded when clearing the completed
criteria request from the thread failed.
---
Follow-up to #4784. When a YOLO `/goal` criteria run succeeds, cleanup
clears the `goal_criteria_request` marker before syncing but ignored a
failed clear (checkpoint write failure). A stale marker still naming the
just-completed request then made the sync
(`_sync_goal_rubric_state_from_thread`) and restore
(`_restore_goal_rubric_state`) paths strip the freshly generated
`_pending_goal_*` payload, so no review/YOLO acceptance mounted and the
criteria were silently lost. The marker now supersedes a proposal only
when it names a *different* request than the pending proposal's request
id.
Made by [Open
SWE](https://openswe.vercel.app/agents/6f2018c7-ffa3-ac12-4dab-8eed1142e4c4)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Reduce noisy full-traceback DEBUG logs when an MCP server is skipped
because it requires authentication; the actionable warning and a concise
debug line remain.
---
When an MCP server is skipped during discovery because it needs
authentication — either a token-refresh (`reauth`) failure or an RFC
9728 `401` OAuth challenge — `deepagents-code` logged the entire anyio
`ExceptionGroup` / httpx traceback at DEBUG via `exc_info`, on top of
the actionable WARNING. For these already-classified, expected outcomes
the traceback adds no diagnostic value and just floods debug output.
These two recognized branches now emit a concise single-line DEBUG
breadcrumb (the exception class name only). The full traceback is still
logged for genuinely unknown discovery errors (the `else` branch) and
for classifier failures, so real anomalies stay debuggable. The
user-facing WARNING is unchanged apart from dropping the now-inaccurate
"the original error is in debug logs" note from the reauth message.
Made by [Open
SWE](https://openswe.vercel.app/agents/a5ab799b-1747-0d65-16b6-ee0ccccee0c4)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
A long `task` tool description is rendered on a dim line truncated at
120 characters, but the full text was previously unreachable. This makes
the truncated preview expandable: clicking the description region or
pressing Ctrl+O toggles between the truncated and full description,
mirroring the collapsible command/code affordance on `execute`/`js_eval`
rows.
---
The `task` description now owns Ctrl+O when it is truncated (like an
expandable command/code block), while any expandable tool output stays
reachable by clicking its own region. A "click or Ctrl+O to
expand/collapse" hint is shown beside a truncated description.
<details>
<summary>Test plan</summary>
- Added `TestToolCallMessageTaskDescription` covering expandability
detection, the toggle swap, and click routing.
- Added an app-level Ctrl+O routing test that prefers a truncated `task`
description over expandable output.
- Updated existing Ctrl+O routing tests to account for the new
higher-priority branch.
</details>
Made by [Open
SWE](https://openswe.vercel.app/agents/f5d64d3e-e6e2-d1cf-f52c-0ecbd8829ef4)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
In the installed plugin details view, the `Status: ✓ Enabled` line was
rendered `dim` like every other status line. This styles it with the
`$success` theme color so a successful load reads as green, matching the
semantic coloring used elsewhere in the TUI. Other status lines
(error/disabled/pending, and the secondary MCP restart note) stay `dim`.
Made by [Open
SWE](https://openswe.vercel.app/agents/d3174852-cfc9-43f5-f431-56993468deaf)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fixed the `dcode` chat input deleting a collapsed `[Pasted text #N]` (or
`[image N]`) placeholder when backspacing the line break on the line
below it; the line break is now removed while the placeholder is
preserved.
---
In the `dcode` chat input, pasting large text collapses it into a
`[Pasted text #N]` placeholder. Pressing Enter to add a newline and then
backspacing from the start of that new line deleted the entire
placeholder instead of just rejoining the lines.
The cause is in `_find_placeholder_span`: its backwards-delete branch
treats any whitespace immediately after a placeholder as an
auto-inserted trailing separator and swallows the whole token with it.
Since `str.isspace()` also matches a newline, backspacing a line break
below a placeholder removed the placeholder. Restricting that branch to
a literal space (the separator actually auto-inserted after media
placeholders) lets a newline fall through to the default backspace,
which removes only the line break and leaves the cursor at the end of
the placeholder line. The same fix is applied to the shared base text
area used by the inline prompts.
Made by [Open
SWE](https://openswe.vercel.app/agents/79b11ee1-f326-668a-e659-c990811f4e29)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`ls` and `write_todos` results in the `deepagents-code` TUI now align
flush under the output-gutter glyph, matching other tools, instead of
being indented an extra four spaces.
---
The `ls` and `write_todos` renderers in the terminal UI prefixed every
row with four hardcoded spaces, so their entries rendered at a 4-space
hanging indent under the `⎿` output-gutter glyph. Every other tool
formatter (`grep`, `glob`, `read_file`, `execute`) sits flush after that
gutter, and the gutter layout already owns alignment for soft-wrapped
lines — so the extra pad just produced an inconsistent gap between the
glyph and the first item. This emits bare rows for both formatters and
also drops the matching indent from the todo stats header and
empty-state, so the whole block stays flush and consistent. The todo
continuation-line hang-indent auto-adjusts since it derives from the
status-label width.
Made by [Open
SWE](https://openswe.vercel.app/agents/c5dec078-214f-79a6-2417-4b0014e0944e)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Deep Agents Code now emits a `DEBUG` log when a higher-precedence skill
overrides another skill with the same name, aiding skill-resolution
debugging.
---
Skill sources (built-in, plugin, global, project) are merged by
precedence and a higher-precedence skill silently replaces a
lower-precedence one with the same name. This override is intentional
and unchanged; this PR makes it diagnosable by routing both
skill-discovery merge points — the CLI `skills list` loader
(`skills/load.py`) and the runtime `PluginSkillsMiddleware` — through a
shared `merge_skill` helper that emits a `DEBUG` log on each effective
replacement, recording the skill name plus the previous and replacement
source paths and labels.
Made by [Open
SWE](https://openswe.vercel.app/agents/5f97f80c-bed1-0fa5-d0b1-ce67060df37c)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
When an Ollama daemon is down, discovery no longer probes it twice or
emits duplicate, out-of-order debug logs at startup — it probes and logs
"not detected" once per reload.
---
Ollama discovery runs from two startup callers — `get_available_models`
and `get_model_profiles` — that both call
`_get_ollama_installed_models`. Empty results were never cached, so an
unreachable daemon was probed twice per reload and logged `Ollama daemon
not detected ...` twice. Because the second `not detected` (from
`get_model_profiles`) landed right after the first pass's `discovery
returned no models` line, the two appeared out of order even though each
individual pass logs in the correct order.
This tracks endpoints that fail the TCP presence preflight in
`_ollama_unreachable_endpoints` and negatively-caches their empty
result, so the probe and log happen once. A *reachable* daemon that
simply reports no models is still left uncached, preserving recovery of
a later `ollama pull` without `/reload` (covered by the existing
`test_empty_installed_model_discovery_not_cached`).
Made by [Open
SWE](https://openswe.vercel.app/agents/7b64e449-2a7e-f258-17a1-5ffe933608a3)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fix the live tool-group progress line in `dcode` so it counts only the
tools still running instead of every tool in the step.
---
The collapsed tool-group summary's live progress line summarizes the
whole assistant step instead of what is actually still running. Because
it aggregates every tool in the group, finished calls keep being
reported as in progress — e.g. it shows `Running 1 shell command,
running 2 agents…` even after the shell command and one of the agents
have completed.
This builds the present-tense line from only the still-pending members,
so finished calls drop out as they complete. The past-tense line (shown
once everything finishes) continues to summarize every tool that ran.
The cached present phrasing now rebuilds whenever the set of running
members changes, not just when the group grows.
Made by [Open
SWE](https://openswe.vercel.app/agents/25ed04be-b8ed-97c9-a600-d24d80c02162)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Clearing the Debug Console (`Ctrl+\`) traceback/log tail with `Ctrl+L`
now persists across closing and reopening the console for the process
lifetime, instead of re-populating from the in-memory buffer on the next
open.
---
The console modal is recreated fresh on every open and, on mount,
replays everything still retained in the always-on in-memory ring
buffer. `Ctrl+L` (`action_clear_view`) was deliberately a view-only
clear that advanced only the current instance's render cursor, so
closing and reopening replayed the buffer and the "cleared" records came
back.
This adds a process-lifetime "cleared upto" cursor owned by the app.
`DebugConsoleScreen` gains keyword-only `cleared_upto` (seeds its render
cursor so a prior clear is honored on open) and `on_clear` (reports the
new cursor when `Ctrl+L` fires). `DeepAgentsApp` stores the cursor in
`_debug_console_cleared_upto`, seeds each new console from it, and
persists updates via the callback.
The change stays strictly view-only: the shared ring buffer is never
mutated, other diagnostics are unaffected, and records logged *after* a
clear still appear. Clearing is by emission time, matching the existing
in-session semantics.
Made by [Open
SWE](https://openswe.vercel.app/agents/58c9cc66-afbe-b468-729d-375b731bbf71)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`/version` output (and incognito shell output) is now selectable and
copyable.
---
The output from the `/version` command could not be selected or copied.
Those tables — and incognito shell output — render through
`AppMessage(markdown=True)`, which produced a raw Rich renderable.
Textual only supports text selection over `Content`/`Text` visuals, so a
`RichVisual` carries none of the per-cell offset metadata selection
relies on and its text is neither highlightable nor copyable.
This renders the muted markdown to segments and rebuilds it as
`Content`, laid out to the widget's current width, so the
tables/rules/emphasis look the same but the text is now selectable and
copyable. Trailing padding is trimmed per line so copies stay clean.
Made by [Open
SWE](https://openswe.vercel.app/agents/f705adb2-3ebb-25a2-7ebd-ddce94887917)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`/version` now lists `langchain-quickjs` under its "Core dependencies"
section for editable installs.
---
`langchain-quickjs` powers the built-in interpreter and is a core
runtime dependency (declared directly in `dependencies`, not as an
optional extra). It was previously invisible in `/version`: the
"Installed optional dependencies" table only reads packages gated by
`extra == "..."` markers (and the `quickjs` extra is intentionally
empty), while the curated `CORE_DEPENDENCIES` list that drives the "Core
dependencies" section did not include it.
Adding it to `CORE_DEPENDENCIES` surfaces its resolved version alongside
the other LangChain-ecosystem packages, which helps diagnose editable
environments where a local checkout of the partner package may be
overriding the released one. The section is only rendered for editable
installs, matching existing behavior.
The `CORE_DEPENDENCIES`-driven tests iterate the tuple generically, so
they cover the new entry without modification.
Made by [Open
SWE](https://openswe.vercel.app/agents/e258f95b-7cc4-33f3-52f0-32d4aa4c13fd)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Plugins are now available by default in deepagents-code without setting
`DEEPAGENTS_CODE_EXPERIMENTAL`.
This removes the flag gates from CLI and slash-command discovery, plugin
skills and MCP loading, and reload behavior while preserving the flag
for unrelated experimental features.
Made by [Open
SWE](https://openswe.vercel.app/agents/019f6c79-6211-734f-b05c-a5a3401c8a6b)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Co-authored-by: Mason Daugherty <mason@langchain.dev>
Co-authored-by: Mason Daugherty <github@mdrxy.com>
Fixes MCP OAuth token refresh crashing tool calls under `langgraph dev`
with a `NodeCancelledError`.
---
OAuth refresh previously performed token-file work synchronously.
BlockBuster could interrupt that work, cancel session initialization,
and leave its `AsyncExitStack` to be finalized from another task. Users
then saw errors such as:
Attempted to exit cancel scope in a different task than it was entered
in
Token-file I/O now runs in worker threads. Writes are serialized, token
and expiry values are read from one snapshot, and cancellation waits for
token writes and refresh-lock acquisition or release to finish before
propagating. Partial MCP sessions are closed by the task that created
them without hiding the original failure.
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Mason Daugherty