Makes the `dcode` working-directory trust boundary explicit so users
understand that running it in a project directory lets that project
influence the process environment — the broader issue behind the `.env`
shell-startup-hook fix in #4288.
- `libs/code/README.md`: adds a `Security model` section — `dcode`
trusts the directory you run it in; do not run it in untrusted
directories without a sandbox backend.
- `libs/code/THREAT_MODEL.md`: adds threat `T12` (project `.env` injects
shell interpreter startup hooks) under `TB11`, extends the `TB11`
boundary controls/details with the dotenv shell-hook denylist
(`BASH_ENV`, `ENV`), and clarifies the `.env` out-of-scope row to
separate ordinary config discovery from the in-scope code-execution
implication.
`T11` was already taken by the ripgrep-install threat, so the new entry
is numbered `T12`. Companion docs-site warning: langchain-ai/docs#4619.
Made by [Open
SWE](https://openswe.vercel.app/agents/25c781c1-fad7-a196-6adb-5e606877a1f2)
---------
Signed-off-by: Mason Daugherty <github@mdrxy.com>
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Co-authored-by: open-swe[bot] <215916821+open-swe[bot]@users.noreply.github.com>
`README.md` guidance now points readers toward the shared LangChain
learning and community resources across the repo. Python install
snippets also use `uv add` consistently instead of `pip install` or `uv
pip install`.
## Changes
- Added LangChain Academy and Code of Conduct links across package and
example READMEs, using existing Resources sections where available and
adding a short Resources section where needed.
- Updated partner package quick-install snippets for Daytona, Modal, and
Runloop to use `uv add`.
- Updated example setup instructions to use `uv add deepagents-cli` and
`uv add --editable .` for local installs.
- Refreshed the root README intro so the JavaScript/TypeScript library
link sits in the main overview and the Deep Agents Code install callout
appears before Quickstart.
Add a pointer to the LangChain ecosystem overview from the top-level and
SDK READMEs, and migrate every reference to the `deepagents-code` docs
onto its new short URL.
Mason Daugherty