Deep Agents Code now retries transient model request failures
automatically. If a request fails because of a dropped connection, a
rate limit, or a provider server error, dcode waits and tries again
instead of failing the turn. This covers the main agent, subagents,
goal-criteria checks, conversation compaction, auto-mode classification,
and rubric grading even when the grader connection drops mid-response.
How retrying works:
- Retries happen at the individual model call, not the whole turn, so
tool calls that already completed are never replayed.
- If a response started streaming to your terminal before the failure,
that attempt is not retried — this prevents duplicated output.
Rubric-grader messages are the narrow exception: both clients filter
that nested stream, so the failed grader model call can retry without
duplicating visible output.
- You can see retry progress in the terminal, both interactively and in
headless mode.
- Rate-limit responses that carry a valid `Retry-After` header wait as
directed, up to 60 seconds. Other failures use an exponential backoff
(starting at 0.2s, doubling up to a 10s cap, with jitter).
- Permanent failures — authentication errors, permission denials,
invalid requests, context overflow — fail immediately without burning
retries.
- Auto-mode classification runs under a deadline, so its total retry
wait is capped to fit inside it; a rate-limited classifier surfaces the
provider error rather than stalling.
Controlling retries:
- `--max-retries N` (or `[retries] max_retries = N` in `config.toml`)
sets how many retries follow the initial request. The default is 5; `0`
disables retries entirely. Set `[retries.<provider>]` to override per
provider.
- These settings now control dcode's own retry loop. Previously they set
the provider SDK's retry count; that loop is disabled so the two don't
multiply. If dcode can't identify the provider's retry control, it warns
you, since the provider may still be retrying underneath.
- Retries outside the main agent loop (compaction summaries,
classifiers, rubric grading) apply to models dcode builds itself. A
model you supply directly gets the default budget of 5, with a warning
if its own SDK retry loop is also still active.
Rubric grading retains its earlier mid-response reliability. Grader
messages stream under a nested namespace that both interactive and
headless clients filter, and unidentified nested messages are excluded
from hook transcripts. Only the grader's retry middleware marks that
stream as hidden, allowing dropped reads and truncated bodies to retry
the failed model node without replaying completed verification tools.
Main-agent and other visible streams keep the duplicate-output guard.
---
<details>
<summary>Test plan</summary>
- Focused model-retry, rubric-grader, client-rendering, transcript, and
agent-wiring tests: 152 passed
- Ruff checks for all touched files
- `ty` checks for all touched files
- Pre-commit hooks
</details>
Made by [Open
SWE](https://openswe.vercel.app/agents/7fe4aaa6-4f25-5c78-b472-91ae81e8c1b5)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fixes#5843
---
The `deepagents-code` Python 3.12 unit-test leg failed three
`test_diff.py` assertions that expected the Unicode line-continuation
glyph `…` but rendered the ASCII fallback `.`. The same tests passed on
3.13 and 3.14, and the PR that hit the failure did not touch the diff
renderer.
The diff widget reads `get_glyphs()`, which caches the detected charset
mode in a process-wide module variable. Several tests in
`test_charset.py` patch `UI_CHARSET_MODE` to force ASCII or Unicode and
reset that cache in `setup_method` — before each test — but never reset
it afterward. `TestIsAsciiMode::test_true_in_ascii_mode` therefore
leaves the cache pinned to ASCII. Whether any later test in the same
pytest-xdist worker inherits that state depends entirely on how tests
are distributed across workers, which is why the failure surfaced only
on the 3.12 leg and disappeared under other run orders.
Two changes make the intended behavior deterministic across the matrix:
- `test_charset.py` now uses an autouse fixture that resets the glyph
cache both before and after each test, so a forced charset cannot leak
into unrelated tests.
- `test_diff.py` now sets `UI_CHARSET_MODE=unicode` and resets the cache
around every test, so the rendering expectations no longer depend on
ambient process state.
Adds Z.ai's GLM-5.3-Flash to the dcode model switcher for Baseten, so it
can be picked from `/model` and the onboarding picker instead of typed
in by hand.
---
Z.ai released [GLM-5.3-Flash](https://z.ai/blog/glm-5.3-flash) on
2026-08-26, its first natively multimodal model in the GLM-5 series
(320B total / 18B active, hybrid linear and sparse attention, 1M
context, MIT licensed). Baseten made it available through Model APIs the
same day, per their
[changelog](https://www.baseten.co/resources/changelog/glm-53-fast-available-on-baseten/)
and [model page](https://www.baseten.co/library/glm-53-flash/).
The `baseten` provider is already wired into `PROVIDER_API_KEY_ENV`, and
`_RECOMMENDED_MODELS` already carries `zai-org/GLM-5.2` and
`zai-org/GLM-5.2-Fast`, so this only needs the new spec and its display
name. The model ID `zai-org/GLM-5.3-Flash` is taken verbatim from
Baseten's own model page rather than derived from another provider's
naming scheme. The entry is placed alphabetically within the existing
`baseten:` block, and the display name follows the sibling GLM entries.
Only the Baseten entry is added here. Other providers that may serve
this model are intentionally out of scope for this PR.
`dcode -x` now drains pending LangSmith traces before its child server
exits.
---
The child `langgraph dev` process could terminate before final trace
updates left the SDK queue. The custom HTTP app now flushes existing
tracers during lifespan shutdown on a bounded daemon worker, so a stuck
telemetry call cannot delay exit.
The parent uses graceful process-group signaling on POSIX and Ctrl+Break
for a dedicated Windows process group, with enough shutdown margin for
both the trace flush and LangGraph teardown. No tracing client is
created when tracing is disabled.
<details>
<summary>Test plan</summary>
- Unit coverage for successful, failed, disabled, and timed-out flushes
- Cross-platform server termination unit coverage
- Real `langgraph dev` subprocess shutdown test
- `make lint`
</details>
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`/clear` now emphasizes starting fresh, while `/force-clear` is framed
as recovery for a stuck session.
---
The previous descriptions focused on implementation details and made the
intended use cases hard to distinguish. The generated command catalog is
updated from the registry.
Made by [Open
SWE](https://openswe.vercel.app/agents/e6814be2-5315-55be-aca4-e8542b57afb0)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Administrators can point the fixed managed-config file at a bounded
HTTPS TOML policy.
---
This adds remote managed configuration while keeping the fixed local
descriptor as the trust anchor. The remote document supplies the
complete managed policy.
Remote loading:
- uses system TLS validation and bypasses proxies
- refuses redirects
- enforces a 5-second timeout and 1 MiB response limit
- fails closed during startup
- preserves the last-known-good policy when a reload fails
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Dynamic subagent model usage now appears in live dcode cost and usage
statistics.
```mermaid
flowchart LR
A[Dynamic subagent request] --> B[Session cost recorder]
B -->|Versioned usage event| C[Live Textual and headless stats]
B -->|Drain raw usage| D[Cost middleware]
D -->|Checkpoint and authoritative total| C
```
Streams completed dynamic-subagent usage into existing provisional
client accounting while preserving checkpointed graph cost as the
durable authority. Events are minimized, thread-validated, deduplicated,
and best-effort.
## References
- Plan:
https://openswe.vercel.app/agents/4f3fc359-7153-5467-8164-33aa496b8a56/plan
Made by [Open
SWE](https://openswe.vercel.app/agents/4f3fc359-7153-5467-8164-33aa496b8a56)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Closes#5757
`DEEPAGENTS_HOME` now selects the dcode user profile and trust root at
launch while preserving `~/.deepagents` as the default.
---
This makes the configured home an immutable, normalized path captured
before dotenv loading and shared by the client, server, reloads, and
child processes. A central path snapshot separates profile data,
installation-owned resources, and project configuration so cwd changes
and mutable environment state cannot move the trust root. Absolute
profiles also remain usable when the launch user's home cannot be
resolved; optional home-based integrations are skipped in that case.
Profile resolution rejects ambiguous or unsafe roots, including relative
and `~user` forms, filesystem and launch-home aliases, dangling
symlinks, non-directories, and unreadable or unsearchable directories.
The installer applies the same validation as Python and changes
ownership only for exact leaves it creates.
MCP discovery now retains explicit user or project provenance. Only the
exact configured user `.mcp.json` receives user-level trust, and
filesystem aliases or collisions fail closed to project scope. This
prevents project dotenv files, ancestor homes, checkout-contained
profiles, and case or symlink aliases from self-approving project MCP
servers.
Install and update locks and managed ripgrep prefer installation-scoped
locations, with profile-scoped fallbacks when the shared locations are
unusable. A fallback ripgrep is checksum-verified and exposed through a
process-private `PATH` shim so profile-controlled sibling executables
never enter subprocess lookup. Runtime consumers, prompts, bundled
skills, UI messages, diagnostics, and token permission hints use the
effective configured paths, and failed write-probe cleanup is surfaced
without repeated warnings.
<details>
<summary>Test plan</summary>
- Added deterministic path, dotenv, cwd, reload, client/server,
missing-home, and subprocess regressions.
- Added root-validation and installer parity coverage, including
symlink, permission, ownership, and write-probe cases.
- Added MCP provenance, filesystem-identity, trust-classification, and
project self-approval security regressions.
- Added shared-lock, managed-ripgrep fallback, checksum,
private-`PATH`-shim, and optional-ripgrep regressions.
- Added prompt, bundled-skill, diagnostics, and MCP token-path consumer
regressions.
- Current-head validation is covered by the `deepagents-code` lint job
and Python 3.12–3.14 test matrix.
</details>
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Remove tests that only exercise local expressions, language/dataclass
mechanics, annotations, or source text, plus an exact duplicate and
assertions already covered by stronger behavior tests. Production
behavior and meaningful regression coverage are unchanged.
Made by [Open
SWE](https://openswe.vercel.app/agents/105f8f81-8407-5183-be73-7f5df20dd8f7)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Session-scoped CLI flags now use shared configuration resolution, so
managed policy wins consistently and users are warned when a flag is
overridden or rejected.
---
CLI values previously reached runtime consumers outside the shared
resolver, causing inconsistent behavior across launches, configuration
inspection, ACP, thread listing, and tools.
This adds an immutable `CliProvider` between managed configuration and
the environment and gives every resolver the same CLI snapshot.
Consumers now read effective resolved values, while deduplicated
warnings explain managed overrides and rejected flags. Existing flag
behavior and startup fast paths are preserved.
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Bumps the exact `deepagents` pin in `libs/code/pyproject.toml` from
`0.7.8` to `0.7.9` (current workspace SDK version) and regenerates
`libs/code/uv.lock`.
Opened automatically by `bump_code_sdk_pin.yml` after a commit on `main`
changed the SDK version. Merge this before the next `deepagents-code`
release so the SDK pin check goes green.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
`dcode -v` and `dcode --version` now warn when the fresh local update
cache knows about a newer release. The check stays offline, honors
update-check opt-outs, and fails softly when cached status is
unavailable.
**Before**
```text
deepagents-code 0.1.61
deepagents (SDK) 0.7.8
```
**After (when a cached update is known)**
```text
deepagents-code 0.1.61
deepagents (SDK) 0.7.8
Update available: v0.1.62. Run: uv tool install -U deepagents-code
```
---
The warning uses the existing fresh local update cache and
install-method-aware upgrade command, so version output does not make a
network request.
Made by [Open
SWE](https://openswe.vercel.app/agents/b0010396-c78a-554c-a946-99194751d0aa)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Coding-agent middleware spans no longer serialize duplicate message and
state payloads.
---
This extends the SDK trace policy from #5377 to all middleware owned by
`deepagents-code`, while avoiding a process-wide policy that could
change third-party middleware tracing. A contract test keeps every owned
middleware class opted in.
Made by [Open
SWE](https://openswe.vercel.app/agents/a391e2dc-ba5f-53fb-82fe-ad847a895937)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Keep the macOS Textual interface visible while filtering unmanaged
native diagnostics.
---
`TerminalStderrGuard` points fd 2 at `/dev/null`. Textual 8.2.8 renders
every Unix frame to `sys.__stderr__`. #5813 therefore sent the whole
interface to `/dev/null`:
```
$ deepagents # macOS, stdout and stderr on the same terminal
# (blank screen, no prompt, no error)
```
When suppression is active, Textual now renders through the matching
stdout terminal instead. Native fd-2 writes stay suppressed, and
redirected stderr and terminal handoffs stay preserved:
```
$ deepagents # macOS, stdout and stderr on the same terminal
╭─ deepagents ─────────────────────────────────────────╮
│ > │
╰──────────────────────────────────────────────────────╯
```
## When stdout cannot carry the interface
The override applies only when it is safe. `stdout_driver_class()`
declines, and the caller then drops stderr suppression, in two cases:
- `sys.__stdout__` is `None` or closed. An active guard proves only that
fd 1 is a terminal, not that the Python object is usable. Frames written
to a dead stream kill Textual's writer thread, and the event loop then
blocks forever on the full write queue.
- `TEXTUAL_DRIVER` names an explicit driver. That driver renders to
stderr, so the guard would hide it. The user's choice wins.
In both cases the interface stays visible on an unguarded stderr. A
visible interface with native noise beats an invisible one.
## Coupling to Textual internals
The subclass replaces the private `_file` attribute, so it follows the
rule the patches in `_textual_patches.py` follow: do not guess when the
ground shifts. If Textual stops keeping its output stream in `_file`,
the subclass raises instead of assigning a dead attribute. The error
surfaces after the caller's `finally` restores fd 2, so it reaches the
terminal.
The test asserts the upstream contract as well as the override, so a
rename in Textual fails in CI rather than in a user's terminal.
Made by [Open
SWE](https://openswe.vercel.app/agents/35f98f77-db79-5fa8-bf6b-12877813719d)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Stacked on #5234. Review that one first; this PR's diff is only the
`libs/code` half.
## The bug
`ReliableRubricMiddleware` overrides `_grade`/`_agrade` to retry a
transient grader transport failure. Those are the same methods that hold
the SDK's coverage retry, and the override never calls `super()`, so
dcode replaced the coverage retry rather than composing with it.
The consequence is asymmetric, because the *downgrade* that the coverage
retry protects is in `_finalize_evaluation`, which dcode does inherit:
| | grader calls before downgrade |
|---|---|
| SDK `RubricMiddleware` | 2 (under-report, re-ask, still short) |
| dcode `ReliableRubricMiddleware` | 1 (under-report) |
So a grader that miscounts its criteria once turns a `satisfied` into
`needs_revision` in dcode with no second chance. At `max_iterations=3` a
slip on the final iteration becomes `max_iterations_reached`, and
`_resolve_pending_goal_completion` then refuses to complete a `/goal`
whose work was actually satisfied.
Second, smaller bug: on that downgrade path no criterion is marked
failed, so the transcript rendered "Acceptance criteria not yet
satisfied" plus "Address every unmet criterion, then retry the check."
above an empty list.
## The fix
- The transport retry moves down to `_invoke_grader`/`_ainvoke_grader`,
which wrap exactly one grader call and delegate to `super()`. The two
retries now nest correctly: a transport fault is retried within a call,
an under-report across calls.
- `_grader_input` takes the SDK's `correction` argument and builds its
payload through `super()`, so the retry's corrective feedback reaches
the grader and the delimiter sanitization is no longer re-implemented
here.
- The `after_agent`/`aafter_agent` overrides are deleted. They existed
only to re-raise `GraphBubbleUp` and to thread `runtime.context`; the
SDK does both now. This also drops the private `_strategy_from_result`
import.
- `_format_rubric_event`/`_format_rubric_details` read the new
`unverified` flag and describe the verdict as a verification gap ("could
not be verified", "the grader could not account for every criterion")
instead of pointing at criteria that do not exist.
## Tests
`libs/code`: 11680 passed, 3 skipped. `make lint` and `make type` clean.
New coverage:
- the coverage retry fires for an under-reporting grader, sync and
async, and the second call carries the correction
- a transport fault and an under-report in the same pass produce three
grader calls
- `unverified` rendering for `needs_revision` and
`max_iterations_reached`, plus a guard that the ordinary revision
wording is unchanged
---------
Co-authored-by: Mason Daugherty <github@mdrxy.com>
Native macOS diagnostics no longer corrupt the Textual interface while
it owns the terminal.
---
macOS frameworks can write directly to fd 2, bypassing Textual's
Python-level stderr capture. Suppress those writes only when stdout and
stderr share a TTY, while preserving redirected stderr and restoring it
for external editors, process suspension, and teardown.
Tests cover fd suppression/restoration, platform and TTY gates, editor
suspension, and app cleanup.
Made by [Open
SWE](https://openswe.vercel.app/agents/35f98f77-db79-5fa8-bf6b-12877813719d)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
The stale editable-dependency prompt shown before the TUI launches now
defaults to "Refresh environment now" instead of "Abort launch": a bare
Enter (or clicking through with the default highlight) repairs the
environment rather than killing the launch. "Abort launch" keeps its
leading position in the list, one keystroke up from the new default.
---
When an editable `dcode` install falls behind the checkout's dependency
floors, the prompt's whole purpose is to steer the user toward
refreshing — yet it opened with "Abort launch" highlighted, so the path
of least resistance was the least useful outcome and users could
reflexively Enter their way out of a launch they wanted. In the text
fallback the prompt advertised `Abort launch [N]` as the default, so a
bare Enter aborted there too.
The picker now computes its initial highlight by action identity and
prefers the refresh action when one is offered; deny-only prompts
(project trust, MCP approvals) still default to refusing. The text
fallback mirrors the picker: hints read `Abort launch [n] · Refresh
environment now [U]` and an empty answer maps to `REFRESH`, while
explicit `n`/`no` still aborts.
Raises the LangChain-ecosystem dependency lower bounds (`langchain*`,
`langgraph*`, `langsmith*`, `deepagents*`) for `deepagents-code` to the
latest compatible stable PyPI release, and regenerates every affected
`uv.lock`. Upper bounds, extras, and markers are preserved; exact `==`
pins are left alone.
Raised 1 minimum(s):
| Manifest | Dependency | Change |
|---|---|---|
| `libs/code/pyproject.toml` | `langchain` | `langchain>=1.3.16,<2.0.0`
→ `langchain>=1.3.17,<2.0.0` |
Opened automatically by `raise_langchain_minimums.yml`. Review the
raised bounds against any compatibility notes in the manifest comments
before merging.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Raises the LangChain-ecosystem dependency lower bounds (`langchain*`,
`langgraph*`, `langsmith*`, `deepagents*`) for `deepagents` to the
latest compatible stable PyPI release, and regenerates every affected
`uv.lock`. Upper bounds, extras, and markers are preserved; exact `==`
pins are left alone.
Raised 1 minimum(s):
| Manifest | Dependency | Change |
|---|---|---|
| `libs/deepagents/pyproject.toml` | `langchain` |
`langchain>=1.3.16,<2.0.0` → `langchain>=1.3.17,<2.0.0` |
Opened automatically by `raise_langchain_minimums.yml`. Review the
raised bounds against any compatibility notes in the manifest comments
before merging.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
`deepagents-cli` was deprecated in #5780 in favor of
`managed-deepagents` (`mda`), and 0.3.0 (#5782) was its final release.
The package has been warning at import time since; this PR deletes the
source tree and unwinds it from repo infrastructure.
What changes:
- Deletes `libs/cli/` (source, tests, lockfile, docs).
- Removes `libs/cli` from `release-please-config.json` /
`.release-please-manifest.json` and from the release detection/dispatch
logic in `release-please.yml` and `release.yml`, so release-please stops
managing the package.
- Removes the `cli`/`deepagents-cli` scopes from PR title lint,
branch-name check (workflow + `.githooks/pre-push`), the PR labeler
config and scope-rename aliases, the `cli` file rules, CI change
filters, lint/test jobs, integration-test options, dependabot,
pre-commit hooks, CODEOWNERS, and the bug-report template.
- Updates docs (`AGENTS.md`, `libs/README.md`, `libs/DEVELOPMENT.md`,
`RELEASING.md`, threat models, openwiki briefs) and release-infra script
tests that used `libs/cli` as a fixture (swapped to `libs/acp` /
`libs/evals` equivalents).
Intentionally left in place:
- `examples/ralph_mode/` still imports `deepagents_cli` — tracked
separately; the example needs migration onto `libs/code`'s
non-interactive runner.
- Historical references: the `libs/code/CHANGELOG.md` fork note, and the
`SNAPSHOT_NAME = "deepagents-cli"` constant in the LangSmith sandbox
integration test (it names a live LangSmith snapshot, not the deleted
package).
- `CLI_MAX_RETRIES_KEY = "__deepagents_cli_max_retries__"` in
`libs/code` — a live internal carrier key; renaming is out of scope.
Published `deepagents-cli` releases on PyPI are unaffected; the repo
simply stops cutting new ones.
---------
Signed-off-by: Mason Daugherty <github@mdrxy.com>
`/offload` now runs only as a server-owned operation on built-in dcode
servers. Local and ACP agents no longer support it, and custom or older
servers without the route are unsupported.
---
The graph-operation prototype coupled the TUI to LangGraph run routing
and lifecycle behavior. This revision puts the ownership boundary in
dcode's server backend: the built-in LangGraph deployment registers a
custom HTTP app that resolves the same cached runtime, compaction
policy, hooks, model configuration, and `CompositeBackend` as the
interactive agent.
```mermaid
flowchart LR
user["User runs /offload"] --> tui["TUI"]
subgraph client["Client"]
tui --> remote["RemoteAgent"]
hookexec["Configured hook executor"]
remote <--> hookexec
end
subgraph server["Built-in dcode LangGraph server"]
api["Offload HTTP boundary"]
runtime["Shared server runtime"]
operation["OffloadOperation"]
hooks["PreCompact + PreToolUse"]
compact["Agent compaction service"]
state[("Thread checkpoint")]
backend["Agent CompositeBackend"]
cost["Cost recorder"]
api -->|"resolve"| runtime
runtime --> operation
operation --> hooks --> compact
api -->|"read + validate"| state
compact -->|"plan archive"| backend
cost -->|"priced delta"| api
api -->|"summary event + cost"| state
api -->|"then append archive"| backend
end
remote -->|"thread ID + runtime context"| api
api -->|"typed result or hook request"| remote
compact -->|"summarize"| model["Configured model provider"]
style api fill:#dcfce7,stroke:#16a34a
style operation fill:#dcfce7,stroke:#16a34a
style state fill:#dcfce7,stroke:#16a34a
```
The server operation:
- reads and hydrates checkpoint state itself; the request contains no
graph name, checkpoint, or conversation messages;
- refuses a thread that holds work in flight — active, interrupted,
carrying pending graph tasks, or advanced past the checkpoint it read. A
thread whose last run *failed* is still offloadable: LangGraph leaves
that thread on `error` until the next run completes, which is exactly
when a user reaches for `/offload` to recover from an overflow;
- commits only the channels `OffloadStateUpdate` declares. The runtime
guard is an allowlist derived from that type, so a future merge adding
any other channel is refused, not just `messages`. No synthetic
assistant or tool message is persisted, and the operation cannot replace
conversation history;
- resolves the summarizer's model and transport from the checkpoint, not
from the request. A client cannot point the server's credentialed
provider calls at an endpoint of its choosing;
- runs the agent's `PreCompact` and `PreToolUse` hooks, transporting
interrupt/resume payloads opaquely through the client and returning
denials as typed results. The session's approval mode is carried across,
so a configured hook sees the same mode it sees on an interactive turn;
- reserves the summary in the checkpoint *before* appending the archive,
and rolls the append back if the link cannot be committed. A per-session
lock serializes an archive's read/write cycle against concurrent
compactions;
- records priceable model cost in the same checkpoint update. Every
prepared charge is explicitly committed or rolled back, and an abandoned
one warns rather than vanishing;
- uses the agent's existing compaction backend/policy and archive guard,
so server-side archives remain readable by the agent;
- accepts an explicit cancellation for an in-flight operation and
confirms the outcome, so a client that gives up learns whether the
operation finished or was cancelled.
The client calls the server route directly. There is no capability probe
and no seeded tool-call fallback. A local in-process or ACP agent gets a
short unsupported message. A server that does not register the route
gets a message naming that cause instead of a bare transport error.
Careful review is warranted around the custom-route/thread-state
boundary, the archive reserve-then-append ordering, and hook replay
identity. The real integration test launches the production server
configuration, checks message preservation around `/offload`, verifies
route authentication, and reads the archive back through the running
agent.
### User-visible output
Success is unchanged in shape:
```
Offloaded 6 older messages, freeing up context window space.
Conversation: ~1.0K → ~250 tokens (75% decrease), 4 messages kept.
```
Three failure paths now say something actionable:
| Situation | Before | Now |
| --- | --- | --- |
| Last turn failed (thread on `error`) | `Offload failed: Cannot offload
while the thread has an active or interrupted run.` — and no way out
until a turn succeeds | Offloads normally |
| Server does not register the route | `Offload failed: 404 Not Found` |
`Offload failed: This server does not provide dcode's /offload
operation. Use the built-in dcode server, or upgrade the server to a
version that registers it.` |
| Reporting fails after the server committed | `Offload failed:
<exception>` — prompting a second offload of an already compacted
conversation | `The conversation was offloaded, but the result could not
be displayed. Check logs for details.` |
A dropped endpoint override is now logged with the key names, so a user
whose gateway configuration is being ignored has something to find.
<details>
<summary>Test plan</summary>
- Full `make test`: 14,199 passed, 2 skipped.
- Real-server integration: 3 passed.
- `make format` and `make lint`: passed, including Ruff, `ty`, and
command-catalog validation.
- Three added tests were mutation-verified: re-keying the per-thread
lock on `operation_id`, renaming the route's path converter, and
deleting the hook round-limit `break` each fail the new test and passed
before it.
</details>
Made by [Open
SWE](https://openswe.vercel.app/agents/0ecc91e2-f151-5f52-94aa-e6ed75c6dfc1)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fixed misleading hover feedback on non-expandable tool results in the
terminal UI.
---
Tool rows now expose the hover gutter only when clicking can expand or
collapse hidden detail. Fully visible results ignore row clicks, while
expandable output, arguments, and task descriptions retain their
affordance.
Made by [Open
SWE](https://openswe.vercel.app/agents/7d257f30-8a87-5613-9143-5d5effa4b19c)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Conversation-history archives older than 30 days are now removed by a
best-effort startup worker; `[history].retention_days` overrides the
window and `0` disables cleanup.
---
The sweep is restricted to regular `.md` files directly under the
archive directory, logs and swallows filesystem/config failures, and
never blocks startup.
Made by [Open
SWE](https://openswe.vercel.app/agents/cd8f03c0-256c-5cb1-86f2-e0897df89b24)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`dcode` can now be restricted to an approved set of models. Add a
`models.allowed` list to `config.toml` (or push it via managed config)
and every model the app tries to use — the launch default, `--model`
flag, `/model` selections, saved defaults, and subagent model
declarations — is checked against it. Entries are exact `provider:model`
specs or `provider:*` wildcards that admit a whole provider's lineup.
Unset means all models are allowed; an empty list means none are.
---
**Why:** organizations rolling out `dcode` need to guarantee agents only
run on approved models (cost, compliance, data routing). Previously any
model with a credential was usable, and there was no enforcement point.
**How:**
- A new `models.allowed` config key (user or managed layer) parses into
an ordered, deduplicated allowlist of exact `provider:model` specs and
`provider:*` wildcards. A malformed list fails closed (deny-all) with an
error naming the defect, so a typo can't silently disable the guardrail.
- Every model-resolution path is gated: CLI flags, the model selector
(blocked entries are hidden from recommendations; typing a blocked spec
explains the policy and lists what's allowed), saved defaults (a blocked
stored default is ignored with a log, not advertised as `(default)`),
and subagent declarations (the error names the declaring file).
- Bare model names are canonicalized the same way `create_model`
resolves them before the policy check, so `gpt-5.6-terra` matches
`openai:gpt-5.6-terra` — or an `openai:*` wildcard — instead of being
spuriously rejected; a name whose provider can't be established stays
unmatchable, so inference is never a bypass.
- A `provider:*` wildcard admits that provider's whole lineup where an
exact list would prune unlisted models. The wildcard names no model
itself, so default resolution expands it to the provider's discovered
models — the registry profile lineup merged with any configured list —
rather than selecting it literally; a wildcard for a provider with no
discovered or configured models fails closed with a "no discoverable
models" message instead of a phantom credential prompt.
- Blocked selections raise `ModelNotAllowedError`, whose message names
the policy layer (user file vs. administrator-managed), quotes the
offending spec, and lists the allowed entries — instead of the previous
generic I/O-style failure. When the allowlist is active but no allowed
model has credentials, a distinct `NoAllowedModelCredentialsError` keeps
`/auth` from accepting a key and appearing to do nothing.
Edge cases covered: remote no-auth providers (e.g., a LAN Ollama
endpoint) remain valid allowlist fallback candidates; bare Bedrock IDs
must be written `bedrock:<id>` in the list since they otherwise split at
the version colon and could never match; `dcode tools list` skips
enforcement because it only compiles graphs it never invokes.
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Co-authored-by: Kimi K3 <kimi-k3@moonshot.ai>
Environment-variable guidance in the auth dialog is now shorter and
identifies both supported `.env` locations plus the exact scope of
`Ctrl+R`.
---
The previous copy was verbose and made the reload shortcut sound global
rather than dialog-specific.
**Before**
> Alternatively, environment variables can be used in place of the key
stored above. Set `DEEPAGENTS_CODE_TAVILY_API_KEY` for a dcode-only key;
it has the highest priority. Set `TAVILY_API_KEY` to share a key with
other provider SDK tools; it is used only when no scoped or stored key
exists. After setting one in a .env file, press Ctrl+R to reload without
restarting. A variable exported in a separate shell after launch is
invisible to this process; it needs a full relaunch. Configuration docs.
**After**
> Environment variables: `DEEPAGENTS_CODE_TAVILY_API_KEY` (dcode only,
highest priority) or `TAVILY_API_KEY` (shared, lowest priority). Put
either in the project `.env` or `~/.deepagents/.env`; press Ctrl+R in
this dialog to reload. New shell exports require restarting the app.
Configuration docs.
**Example scenario:** A user has the Tavily auth dialog open and adds
`DEEPAGENTS_CODE_TAVILY_API_KEY` to the project `.env`. They can press
`Ctrl+R` in that dialog to load it immediately. If they instead export
the variable from another shell, they must restart dcode because the
running process cannot inherit later shell changes.
Focused auth-widget tests cover precedence, dotenv locations, reload
scope, and restart guidance.
Made by [Open
SWE](https://openswe.vercel.app/agents/3e770dd7-d5a5-5aa2-b7e7-5fd34e54f359)
---------
Signed-off-by: Mason Daugherty <github@mdrxy.com>
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Co-authored-by: open-swe[bot] <215916821+open-swe[bot]@users.noreply.github.com>
`ConfigResolver` (with its cached per-process snapshot) shipped in
#5736, but every production reader still went through the legacy
`resolve_scalar` / `resolve_ranked_scalar` wrappers, which re-parse
`config.toml` on every call. This PR retires those wrappers and settles
the question the wrappers had been hiding: **when is configuration
read?**
## Behavior change
Configuration files are now read once into a single process-wide
generation. Every reader resolves against that generation, so no two
parts of the process can disagree about a setting.
**Editing `config.toml` while the app is running therefore has no effect
until the generation advances**, which happens in exactly two places: an
in-app write (toggling a preference refreshes the generation itself) and
`/reload`. A file that fails to parse leaves the previous generation in
force rather than half-applying the new one.
This is the convention every long-running Unix service uses — read at
start, change on an explicit signal. Watching files for edits is
deliberately not done: a partly applied configuration is a worse failure
than a stale one, and per-option exceptions (some live, some cached)
would make the effective configuration unpredictable per setting. The
policy is now written down in `ARCHITECTURE.md` and pinned by tests, so
it stops being an accident of which call path a reader happens to take.
Users who edit the file by hand and expect immediate effect will need
`/reload`. Worth a release note.
## Retiring the wrappers
1. **Plain single-key readers move to the shared resolver.** `app.py`,
`config.py`, `cold_cache.py`, `cost_tracking.py`, `main.py`,
`plugins/discovery.py`, and the two TUI widgets now call
`get_config_resolver().get(option)`, replacing per-call file parsing
with the resolver's cached snapshot. Diagnostics behavior is preserved
by calling `_emit_ranked_diagnostics(option, resolved)` explicitly at
each site. `Settings._reload_values` resolves through
`get_config_resolver(refresh_managed=refresh_managed)`, so `/reload` and
later readers observe the same generation instead of the cache going
stale; the env tier still comes from the method's `env` argument, and
the "a failed or blocked reload never drops policy in force" invariant
is unchanged.
2. **Explicit-snapshot callers build ad-hoc resolvers.** Callers that
pass `toml_data=`/`managed_toml_data=` deliberately inspect a specific
file generation rather than process state, so pointing them at the
shared cache would be wrong. The decision rule: if the caller snapshots
one generation itself — the `config` CLI (one read per invocation),
`update_check` (health reported next to the value), the sandbox/theme
loaders (a non-default `config_path` excludes managed policy), and the
managed-policy validators (a candidate generation not yet in force) — it
builds `resolver_from_snapshots(TomlSnapshot(...), TomlSnapshot(...))`
and calls `.get(option)`.
3. **The legacy path is deleted.** `resolve_scalar`,
`resolve_ranked_scalar`, and the now-dead `_coerce_env` helper are gone
from `config_manifest`. The manifest's remaining bespoke readers share a
private `_resolve_option`, which resolves through the shared generation
when the caller supplies no tables. The migration-parity equivalence
test is deleted with them — its job (proving the two paths agree) is
done. Tests that drove the wrappers directly now exercise the same
coercion, precedence, and diagnostics assertions through
`ConfigResolver`/`resolver_from_snapshots` or real TOML files under the
test-redirected config path.
4. **The remaining fresh-parse readers, and why.** Two keep a concrete
parse, and neither is on a live path:
- `resolve_read_project_dotenv` runs during dotenv bootstrap, before the
project `.env` is layered into `os.environ`; seeding the shared
generation there would capture an env tier later readers do not see.
- `resolve_startup_mode_with_source` inspects the raw user table on its
fall-through path, which the resolver does not expose. Its only
production caller (`dcode config`) passes an explicit generation.
## Fixes found while reviewing this branch
- **`/reload` previews read a stale user tier.** The preview path shares
`_reload_values` with `refresh_managed=False`, so its cached user
snapshot could predate the `[shell].allow_list` edit being previewed.
The preview then reported no change while the accepted reload applied it
— diverging on a security-sensitive auto-approval setting, and reaching
the cwd-switch consent prompt as
`project_settings_change_detected=False`. The preview now reads the user
file fresh while keeping the managed snapshot the process is enforcing
(a preview must not refresh policy in force). This is the atomic-swap
half of the policy, not a liveness exception: preview and apply must
agree on one generation.
- **A lost diagnostic on UI preference writes.** `_save_ui_bool_result`
was the one migrated reader that did not pick up the wrapper's implicit
diagnostics call, so a malformed managed `[ui]` entry was reported
nowhere — removing the one signal an administrator has that their policy
is inert.
- **`/reload` reloaded every provider twice.**
`get_config_resolver(refresh_managed=True)` already reloads on a cache
hit, so the explicit `.reload()` was redundant: one `/reload` read the
managed file four times and re-ran `managed_policy_violations` with
each.
- **Merge strategies for real manifest options were unasserted.** The
deleted `test_populated_tiers_actually_reach_the_resolver` did not
depend on the `resolve_scalar` oracle, and `merge_strategy` appeared
nowhere else in the suite — so flipping `threads.columns` from
`DEEP_MERGE` to `REPLACE`, or `mcp.disabled_servers` from `UNION` to
`REPLACE`, passed the full suite. Restored and mutation-checked in both
directions.
- **`refresh_managed` was untested.** Removing the refresh from
`/reload` kept the suite green, because the existing reload tests drive
env rather than a file edit and monkeypatch `DEFAULT_CONFIG_PATH` (which
changes the resolver cache key and rebuilds a fresh resolver, hiding
staleness). Now pinned in both directions.
- **Comment rot.** Roughly ten comments still described per-call file
parsing, including one that promised live edits took effect without a
restart — the exact behavior the migration removed.
`get_option`, `get_config_options`, `_emit_ranked_diagnostics`, and the
manifest types stay public and unchanged; managed config remains
read-only; no new dependencies.
## Follow-ups
- `_emit_ranked_diagnostics` and `_ranked_source` now have nine external
importers, and the snapshot-construction block appears at six production
sites. A small `resolve_for_display(option)` seam (get + emit + label)
would restore the encapsulation the wrapper provided and make the
missing-emit bug above structurally impossible.
- A file corrupted *after* its generation is taken is not reported.
Corruption present when the file is read still logs with exact line and
column; only mid-session corruption is silent. A cheap mtime/size check
on `/reload` would close it.
- Five `cast(...)` calls exist only because `ConfigResolver.get` returns
`ResolvedValue[object]`; three sit behind validating predicates that
could be `TypeGuard`s. `AGENTS.md` treats `cast` as a last resort.
Incognito shell commands now show the same transcript widget as regular
shell commands, using the existing incognito color while remaining
excluded from model context.
---
This preserves the `!!` prefix when mounting `UserMessage`, allowing the
shared shell widget’s existing mode detection and styling to apply.
Made by [Open
SWE](https://openswe.vercel.app/agents/5d95e03a-8235-5a88-bcb2-8974878a4ffa)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Adds a searchable prompt clipboard for reusing previously submitted
prompts, with a two-tier Ctrl+R interaction modeled on codex and Claude
Code.
The first <kbd>Ctrl</kbd>+<kbd>R</kbd> opens an inline search panel
directly above the prompt input — a query field, up to five newest-first
matches, and a hint line — so recalling a recent prompt never leaves the
composer. Focus and the blinking cursor move into the query field while
the panel is open; typing filters matches case-insensitively while the
draft stays frozen underneath. <kbd>Enter</kbd> inserts the selected
prompt at the cursor, arrow keys navigate,
<kbd>Tab</kbd>/<kbd>Shift</kbd>+<kbd>Tab</kbd> page by five rows, and
<kbd>Esc</kbd> (or Backspace on an empty query) restores the draft and
cursor exactly as they were.
Pressing <kbd>Ctrl</kbd>+<kbd>R</kbd> again while the panel is open
escalates to the full-screen prompt clipboard, carrying the typed query
into its filter. The full view adds a scrollable list, a multi-line
preview pane, the same <kbd>Tab</kbd>/<kbd>Shift</kbd>+<kbd>Tab</kbd>
paging, and <kbd>Ctrl</kbd>+<kbd>C</kbd> to copy a prompt without
inserting it. `/prompts` opens this full view directly, as does Ctrl+R
while autocomplete is open.
---
Prompt history is local-only: it reads the shared JSONL history file,
deduplicates newest-first, and refreshes on open, with no telemetry or
sync. Both tiers insert through the undoable edit path, so a recalled
prompt can be undone with <kbd>Ctrl</kbd>+<kbd>Z</kbd> like any other
edit.
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
github-actions[bot]