langchain-ai/deepagentsjs
1
0
Fork 0
mirror of https://github.com/langchain-ai/deepagentsjs.git synced 2026-07-21 03:45:22 -04:00
Code Issues 42 Packages Projects Releases 10 Wiki Activity
482 Commits 109 Branches 110 Tags
@langchain/quickjs@0.4.0
Commit Graph

22 Commits

Author SHA1 Message Date
github-actions[bot] c231aed3ee chore: version packages (#525) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/quickjs@0.4.0

### Minor Changes

- [#531](https://github.com/langchain-ai/deepagentsjs/pull/531)
[`a76b7df`](https://github.com/langchain-ai/deepagentsjs/commit/a76b7df62310e7f2dd49bb1ea5f1b3ee6c8590b6)
Thanks [@colifran](https://github.com/colifran)! - chore(quickjs):
update `REPLMiddleware` to be named `CodeInterpreterMiddleware`

### Patch Changes

- [#524](https://github.com/langchain-ai/deepagentsjs/pull/524)
[`2cbd524`](https://github.com/langchain-ai/deepagentsjs/commit/2cbd5245a43fb1ba97fa532c1942a8903e090cfa)
Thanks [@colifran](https://github.com/colifran)! - fix(quickjs):
individual repl sessions use individual wasm module causing inefficient
memory usage

## deepagents-acp@0.1.11

### Patch Changes

- Updated dependencies
\[[`f164f99`](https://github.com/langchain-ai/deepagentsjs/commit/f164f992e06a157573612fb2640232f44d9daa18)]:
    -   deepagents@1.10.1

## deepagents@1.10.1

### Patch Changes

- [#479](https://github.com/langchain-ai/deepagentsjs/pull/479)
[`f164f99`](https://github.com/langchain-ai/deepagentsjs/commit/f164f992e06a157573612fb2640232f44d9daa18)
Thanks [@ramon-langchain](https://github.com/ramon-langchain)! -
feat(deepagents): add snapshot/start/stop lifecycle to LangSmithSandbox

## @deepagents/evals@0.0.10

### Patch Changes

- Updated dependencies
\[[`f164f99`](https://github.com/langchain-ai/deepagentsjs/commit/f164f992e06a157573612fb2640232f44d9daa18)]:
    -   deepagents@1.10.1

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Colin Francis <colin.francis@langchain.dev>
 2026-05-11 14:32:28 -07:00
github-actions[bot] 6da7007e52 chore: version packages (#521) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## deepagents@1.10.0

### Minor Changes

- [#458](https://github.com/langchain-ai/deepagentsjs/pull/458)
[`b1e1b7b`](https://github.com/langchain-ai/deepagentsjs/commit/b1e1b7bd3bcc3bd5b03dd461e72559ed69c77e22)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(deepagents): new events streaming

## @langchain/quickjs@0.3.0

### Minor Changes

- [#520](https://github.com/langchain-ai/deepagentsjs/pull/520)
[`2548954`](https://github.com/langchain-ai/deepagentsjs/commit/254895457fce2de7df4547ebcf825d60868bacce)
Thanks [@colifran](https://github.com/colifran)! - chore(quickjs):
rename to REPLMiddleware and adjust defaults

## deepagents-acp@0.1.10

### Patch Changes

- Updated dependencies
\[[`b1e1b7b`](https://github.com/langchain-ai/deepagentsjs/commit/b1e1b7bd3bcc3bd5b03dd461e72559ed69c77e22)]:
    -   deepagents@1.10.0

## @deepagents/evals@0.0.9

### Patch Changes

- Updated dependencies
\[[`b1e1b7b`](https://github.com/langchain-ai/deepagentsjs/commit/b1e1b7bd3bcc3bd5b03dd461e72559ed69c77e22)]:
    -   deepagents@1.10.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-05-05 16:00:39 -07:00
dependabot[bot] 3175ccca1b build(deps): bump langsmith from 0.5.20 to 0.6.0 (#512) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from
0.5.20 to 0.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's
releases</a>.</em></p>
<blockquote>
<h2>v0.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(js): bump JS to 0.4.3 by <a
href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2253">langchain-ai/langsmith-sdk#2253</a></li>
<li>Revert &quot;feat: add js prompt caching&quot; by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2258">langchain-ai/langsmith-sdk#2258</a></li>
<li>Revert &quot;feat: Replace UUID5 with deterministic UUID7 for
replicas&quot; by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2257">langchain-ai/langsmith-sdk#2257</a></li>
<li>release(js): bump to 0.4.4 by <a
href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2259">langchain-ai/langsmith-sdk#2259</a></li>
<li>feat: add prompt cache back and setup environment tests by <a
href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2260">langchain-ai/langsmith-sdk#2260</a></li>
<li>feat(python): Bump pydantic to v2 by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2248">langchain-ai/langsmith-sdk#2248</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.2...v0.6.0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.2...v0.6.0</a></p>
<h2>v0.6.0rc0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat(js): Add support for tracing AI SDK 6 by <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2237">langchain-ai/langsmith-sdk#2237</a></li>
<li>fix(js): Remove default Jestlike timeout by <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2243">langchain-ai/langsmith-sdk#2243</a></li>
<li>feat(js): Add support for tracing tool loop agent by <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2244">langchain-ai/langsmith-sdk#2244</a></li>
<li>feat: Replace UUID5 with deterministic UUID7 for replicas by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2249">langchain-ai/langsmith-sdk#2249</a></li>
<li>feat: add prompt caching to python sdk by <a
href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2246">langchain-ai/langsmith-sdk#2246</a></li>
<li>feat: add js prompt caching by <a
href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2251">langchain-ai/langsmith-sdk#2251</a></li>
<li>fix(claude): correctly parse llm and tool inputs in claude agent sdk
by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2255">langchain-ai/langsmith-sdk#2255</a></li>
<li>bump(python): 0.5.2 by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2256">langchain-ai/langsmith-sdk#2256</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.1...v0.6.0rc0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.1...v0.6.0rc0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits/v0.6.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=npm_and_yarn&previous-version=0.5.20&new-version=0.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-05 05:41:13 +00:00
github-actions[bot] 9a8ff1941a chore: version packages (#444) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## deepagents-acp@0.1.9

### Patch Changes

- [#501](https://github.com/langchain-ai/deepagentsjs/pull/501)
[`5b0eaea`](https://github.com/langchain-ai/deepagentsjs/commit/5b0eaea7b20461414983b71ba08d26d078b49214)
Thanks [@sukhmanghotraa](https://github.com/sukhmanghotraa)! - fix: bump
@langchain/core to ^1.1.42 across all workspace packages

- Updated dependencies
\[[`5b0eaea`](https://github.com/langchain-ai/deepagentsjs/commit/5b0eaea7b20461414983b71ba08d26d078b49214),
[`e90171a`](https://github.com/langchain-ai/deepagentsjs/commit/e90171abe4bcc76767246be470a7b17b94692f41),
[`8fd575f`](https://github.com/langchain-ai/deepagentsjs/commit/8fd575f06ca27cb0bef1a649aa34124a2c04ddd3),
[`3657941`](https://github.com/langchain-ai/deepagentsjs/commit/3657941ea36b21b9b512c1eb68a250ae79124383),
[`998d772`](https://github.com/langchain-ai/deepagentsjs/commit/998d772a07acc76fcc0d419e65b3c74a64d9ac52),
[`55f3bd8`](https://github.com/langchain-ai/deepagentsjs/commit/55f3bd8d74cac22d124fd6d1b11538dc2c2c2aec),
[`79e20e1`](https://github.com/langchain-ai/deepagentsjs/commit/79e20e18082a19b65094b953cd857908a7525801),
[`2442d7d`](https://github.com/langchain-ai/deepagentsjs/commit/2442d7d080c8a1008197eda526de52400303dd72),
[`43cd121`](https://github.com/langchain-ai/deepagentsjs/commit/43cd121133562abf0dee76c6db01f2bde0eb3fd3),
[`2994444`](https://github.com/langchain-ai/deepagentsjs/commit/2994444f32a6c0503defa6157652e742361abb00)]:
    -   deepagents@1.9.1

## deepagents@1.9.1

### Patch Changes

- [#501](https://github.com/langchain-ai/deepagentsjs/pull/501)
[`5b0eaea`](https://github.com/langchain-ai/deepagentsjs/commit/5b0eaea7b20461414983b71ba08d26d078b49214)
Thanks [@sukhmanghotraa](https://github.com/sukhmanghotraa)! - fix: bump
@langchain/core to ^1.1.42 across all workspace packages

- [#442](https://github.com/langchain-ai/deepagentsjs/pull/442)
[`e90171a`](https://github.com/langchain-ai/deepagentsjs/commit/e90171abe4bcc76767246be470a7b17b94692f41)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(deepagents): closer align store backend with Python

- [#496](https://github.com/langchain-ai/deepagentsjs/pull/496)
[`8fd575f`](https://github.com/langchain-ai/deepagentsjs/commit/8fd575f06ca27cb0bef1a649aa34124a2c04ddd3)
Thanks [@colifran](https://github.com/colifran)! - feat(deepagents):
implement functional skills for quickjs middleware

- [#448](https://github.com/langchain-ai/deepagentsjs/pull/448)
[`3657941`](https://github.com/langchain-ai/deepagentsjs/commit/3657941ea36b21b9b512c1eb68a250ae79124383)
Thanks [@ItayCoCo](https://github.com/ItayCoCo)! - fix: follow symlinks
in sandbox find commands by adding -L flag to find invocations in
buildLsCommand, buildFindCommand, and buildGrepCommand

- [#486](https://github.com/langchain-ai/deepagentsjs/pull/486)
[`998d772`](https://github.com/langchain-ai/deepagentsjs/commit/998d772a07acc76fcc0d419e65b3c74a64d9ac52)
Thanks [@colifran](https://github.com/colifran)! - feat(quickjs): remove
built-in VFS globals, add PTC instance injection and StateBackend
read-your-writes

- [#470](https://github.com/langchain-ai/deepagentsjs/pull/470)
[`55f3bd8`](https://github.com/langchain-ai/deepagentsjs/commit/55f3bd8d74cac22d124fd6d1b11538dc2c2c2aec)
Thanks [@jacoblee93](https://github.com/jacoblee93)! - Adds agent type
metadata prop to configurable

- [#451](https://github.com/langchain-ai/deepagentsjs/pull/451)
[`79e20e1`](https://github.com/langchain-ai/deepagentsjs/commit/79e20e18082a19b65094b953cd857908a7525801)
Thanks [@JadenKim-dev](https://github.com/JadenKim-dev)! - remove
unconditional @langchain/anthropic import

- [#465](https://github.com/langchain-ai/deepagentsjs/pull/465)
[`2442d7d`](https://github.com/langchain-ai/deepagentsjs/commit/2442d7d080c8a1008197eda526de52400303dd72)
Thanks [@hntrl](https://github.com/hntrl)! - fix(deepagents): route
summarization through active request model

- [#492](https://github.com/langchain-ai/deepagentsjs/pull/492)
[`43cd121`](https://github.com/langchain-ai/deepagentsjs/commit/43cd121133562abf0dee76c6db01f2bde0eb3fd3)
Thanks [@colifran](https://github.com/colifran)! - implement file system
permissions for fs middleware tools

- [#459](https://github.com/langchain-ai/deepagentsjs/pull/459)
[`2994444`](https://github.com/langchain-ai/deepagentsjs/commit/2994444f32a6c0503defa6157652e742361abb00)
Thanks [@open-swe](https://github.com/apps/open-swe)! - fix(deepagents):
skill loading should default to 1000 lines

## @langchain/quickjs@0.2.6

### Patch Changes

- [#501](https://github.com/langchain-ai/deepagentsjs/pull/501)
[`5b0eaea`](https://github.com/langchain-ai/deepagentsjs/commit/5b0eaea7b20461414983b71ba08d26d078b49214)
Thanks [@sukhmanghotraa](https://github.com/sukhmanghotraa)! - fix: bump
@langchain/core to ^1.1.42 across all workspace packages

- [#496](https://github.com/langchain-ai/deepagentsjs/pull/496)
[`8fd575f`](https://github.com/langchain-ai/deepagentsjs/commit/8fd575f06ca27cb0bef1a649aa34124a2c04ddd3)
Thanks [@colifran](https://github.com/colifran)! - feat(deepagents):
implement functional skills for quickjs middleware

- [#486](https://github.com/langchain-ai/deepagentsjs/pull/486)
[`998d772`](https://github.com/langchain-ai/deepagentsjs/commit/998d772a07acc76fcc0d419e65b3c74a64d9ac52)
Thanks [@colifran](https://github.com/colifran)! - feat(quickjs): remove
built-in VFS globals, add PTC instance injection and StateBackend
read-your-writes

- [#498](https://github.com/langchain-ai/deepagentsjs/pull/498)
[`192bbd7`](https://github.com/langchain-ai/deepagentsjs/commit/192bbd7109817a826aa6bd982e16b54b5a5c8cb5)
Thanks [@colifran](https://github.com/colifran)! - fix(quickjs): bound
console buffering at capture time

- [#497](https://github.com/langchain-ai/deepagentsjs/pull/497)
[`79dcf9a`](https://github.com/langchain-ai/deepagentsjs/commit/79dcf9ae4567fcce71ea7e529f332baf6a3d6dcd)
Thanks [@colifran](https://github.com/colifran)! - feat(quickjs): add
maxPtcCallsbudget for ptc calls

- [#492](https://github.com/langchain-ai/deepagentsjs/pull/492)
[`43cd121`](https://github.com/langchain-ai/deepagentsjs/commit/43cd121133562abf0dee76c6db01f2bde0eb3fd3)
Thanks [@colifran](https://github.com/colifran)! - implement file system
permissions for fs middleware tools

- [#494](https://github.com/langchain-ai/deepagentsjs/pull/494)
[`e64c7e3`](https://github.com/langchain-ai/deepagentsjs/commit/e64c7e31a7e62929d5d2a9048ad7df3315a546cd)
Thanks [@colifran](https://github.com/colifran)! - feat(quickjs):
implement delete session in after agent hook to clean up completed repl
sessions

- [#499](https://github.com/langchain-ai/deepagentsjs/pull/499)
[`352e487`](https://github.com/langchain-ai/deepagentsjs/commit/352e4876679fb708d9690ffeab82363ba02677dc)
Thanks [@hntrl](https://github.com/hntrl)! - fix(quickjs): add
ls_code_input_language metadata to js_eval tool

## @deepagents/evals@0.0.8

### Patch Changes

- Updated dependencies
\[[`5b0eaea`](https://github.com/langchain-ai/deepagentsjs/commit/5b0eaea7b20461414983b71ba08d26d078b49214),
[`e90171a`](https://github.com/langchain-ai/deepagentsjs/commit/e90171abe4bcc76767246be470a7b17b94692f41),
[`8fd575f`](https://github.com/langchain-ai/deepagentsjs/commit/8fd575f06ca27cb0bef1a649aa34124a2c04ddd3),
[`3657941`](https://github.com/langchain-ai/deepagentsjs/commit/3657941ea36b21b9b512c1eb68a250ae79124383),
[`998d772`](https://github.com/langchain-ai/deepagentsjs/commit/998d772a07acc76fcc0d419e65b3c74a64d9ac52),
[`55f3bd8`](https://github.com/langchain-ai/deepagentsjs/commit/55f3bd8d74cac22d124fd6d1b11538dc2c2c2aec),
[`79e20e1`](https://github.com/langchain-ai/deepagentsjs/commit/79e20e18082a19b65094b953cd857908a7525801),
[`2442d7d`](https://github.com/langchain-ai/deepagentsjs/commit/2442d7d080c8a1008197eda526de52400303dd72),
[`43cd121`](https://github.com/langchain-ai/deepagentsjs/commit/43cd121133562abf0dee76c6db01f2bde0eb3fd3),
[`2994444`](https://github.com/langchain-ai/deepagentsjs/commit/2994444f32a6c0503defa6157652e742361abb00)]:
    -   deepagents@1.9.1

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-05-04 09:43:36 -07:00
sukh 5b0eaea7b2 fix: bump @langchain/core to ^1.1.42 across all workspace packages (#501) 
## Problem

When using `@langchain/google` as a model provider in the examples
workspace, the server crashes immediately with:

1. Runtime crash on startup:

    ```bash
    ERR_PACKAGE_PATH_NOT_EXPORTED: Package subpath './utils/uuid' is not
    defined by "exports" in @langchain/core/package.json
    ```

`@langchain/google` imports `@langchain/core/utils/uuid`, a subpath
added in `@langchain/core@1.1.42`. Both the examples workspace and
`libs/deepagents` were pinned to `^1.1.40` which does not export this
path.

 2. TypeScript type error after fixing the runtime crash:
 
    ```bash
Type 'ChatGoogle' is not assignable to type 'BaseLanguageModel<any,
BaseLanguageModelCallOptions>'
    ```
Even after bumping `@langchain/core` in `examples/` only, pnpm kept two
separate copies in its store - `1.1.40` for `deepagents` and `1.1.42`
for `@langchain/google`. TypeScript treats them as structurally
incompatible types because the type import paths differ.

## Fix

- Bump `@langchain/core` from `^1.1.40` → `^1.1.42` in all
`../package.json` files

## Testing

```bash
cd examples/research
pnpm dlx @langchain/langgraph-cli dev
# -> No ERR_PACKAGE_PATH_NOT_EXPORTED and agent starts correctly

---------

Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com>
 2026-05-01 15:41:53 -07:00
sukh 883581cda6 fix(deepagents): handle Windows absolute paths in tsdown external filter (#489) 
## Fix: `ERR_MODULE_NOT_FOUND` on Windows when building `deepagents`

### Problem

Building `libs/deepagents` on Windows produces a `dist/index.js` that
imports
local modules with `.ts` extensions instead of bundling them:

```js
import { createDeepAgent } from "./agent.ts";
import { ConfigurationError } from "./errors.ts";
```

This causes an immediate crash at runtime for any consumer of the
library:

```
Error [ERR_MODULE_NOT_FOUND]: Cannot find module
  'C:\...\deepagentsjs\libs\deepagents\dist\agent.ts'
  imported from C:\...\deepagentsjs\libs\deepagents\dist\index.js
  ```

  **Root Cause**
The `external` filter in `libs/deepagents/tsdown.config.ts:` used a regex intended to match
only npm package names (which don't start with `.` or `/`):

```js
const external = [/^[^./]/];
```
On Unix absolute paths start with `/` so the regex correctly excludes them. On Windows absolute paths start with a drive letter (e.g. C:\...), which also doesn't start with `.` or `/` - so rolldown matches them as external, excludes them from the bundle, and leaves raw `.ts` references in the output.

**Fix**
Replace the regex with a function that explicitly excludes Windows-style
absolute paths:
```js
const external = (id: string) =>
!id.startsWith(".") && !id.startsWith("/") &&
!/^[A-Za-z]:[\\/]/.test(id);
```

After this change `pnpm -w run build` in `libs/deepagents` produces a fully
bundled `[dist/index.js]` with no `.ts` imports and examples run correctly on Windows.

Notes

- `deps.neverBundle` (the tsdown-recommended replacement for `[external]` is not yet functional in tsdown 0.21.7 / rolldown 1.0.0-rc.12 and causes a build error. This fix is the correct workaround until that API stabilises.

---------

Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-04-27 13:57:05 -07:00
John Kennedy 6eb421ff9e fix(deps): patch 6 security alerts across 4 packages (1 critical, 5 medium) (#478) 
## Security Alert Patch

Resolves 6 open Dependabot security alerts (**1 critical, 5 medium**).

### Packages Updated

| Package | Old → New | Strategy | Scope | CVEs Resolved |
|---------|-----------|----------|-------|---------------|
| `protobufjs` | 7.5.4 → 7.5.5 | C (pnpm override) — parent ranges
already accept 7.5.5 | transitive (via modal, @grpc/proto-loader,
@opentelemetry/otlp-transformer) | **CVE-2026-41242** (critical) |
| `axios` | 1.13.6 → 1.15.1 | C (pnpm override) — @daytonaio/sdk
`^1.13.5` already accepts 1.15.x | transitive (via @daytonaio/sdk,
@daytonaio/api-client, @daytonaio/toolbox-api-client) | CVE-2025-62718,
CVE-2026-40175 |
| `follow-redirects` | 1.15.11 → 1.16.0 | C (pnpm override) — axios
`^1.15.11` already accepts 1.16.0 | transitive (via axios) |
GHSA-r4q5-vmmm-2653 |
| `langsmith` | floor raised to 0.5.19 | A (direct bump) —
`libs/deepagents` peerDep, `internal/eval-harness` dep | direct,
published | CVE-2026-40190, GHSA-rr7j-v2q5-chgv |

### Why pnpm.overrides for transitives

The three transitive bumps (protobufjs, axios, follow-redirects) use
pnpm.overrides because the parent packages' version ranges **already
allow the patched versions** — this is a lockfile refresh, not a
published-constraint change. End users installing `@langchain/daytona`
or `@langchain/modal` resolve their own lockfile and naturally get the
patched transitive versions; the overrides here just bring our lockfile
up to date.

For `langsmith`, the vulnerable 0.5.15 was pinned in
`libs/deepagents/peerDependencies` with floor `>=0.5.15`. Raising to
`>=0.5.19` closes the window for downstream consumers with stale
lockfiles.

### CVE Details

| ID | Package | Severity | Summary |
|----|---------|----------|---------|
| CVE-2026-41242 / GHSA-xq3m-2v4x-88gg | protobufjs | critical |
Arbitrary code execution in protobufjs |
| CVE-2025-62718 / GHSA-3p68-rc4w-qgx5 | axios | medium | NO_PROXY
hostname normalization bypass leading to SSRF |
| CVE-2026-40175 / GHSA-fvcv-3m26-pcqx | axios | medium | Unrestricted
cloud metadata exfiltration via header injection chain |
| GHSA-r4q5-vmmm-2653 | follow-redirects | medium | Leaks custom
authentication headers to cross-domain redirect targets |
| CVE-2026-40190 / GHSA-fw9q-39r9-c252 | langsmith | medium | Prototype
pollution via incomplete `__proto__` guard in internal lodash `set()` |
| GHSA-rr7j-v2q5-chgv | langsmith | medium | Streaming token events
bypass output redaction |

### Linear Tickets

No matching Linear tickets found (CLI unauthenticated in this
environment).

### Verification

- [x] `pnpm install --lockfile-only` clean — new lockfile contains
axios@1.15.1, protobufjs@7.5.5, follow-redirects@1.16.0,
langsmith@0.5.20 & 0.5.21 (vulnerable 0.5.15 fully removed)
- [x] `pnpm format:check` passes (313 files)
- [x] `pnpm lint` (oxlint) passes (0 warnings, 0 errors)
- [x] `pnpm test:unit` — 829/830 unit tests pass; the 1 failure and 6
unhandled errors are **pre-existing** on `main` (tied to recent
`ls_agent_type` feature #470 and broken
`@langchain/sandbox-standard-tests` module resolution), unrelated to
this patch
- [x] `pnpm typecheck` failure in `libs/standard-tests` is pre-existing
on `main`, unrelated to this patch
- [x] No major-version bumps; minimum-safe versions used throughout

🤖 Submitted by langster-patch
 2026-04-21 14:39:29 -07:00
Jacob Lee 55f3bd8d74 feat(deepagents): Adds agent type metadata prop to configurable (#470) 
Will be useful for trace display features

Python: https://github.com/langchain-ai/deepagents/pull/2788

---------

Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com>
 2026-04-17 22:03:59 -07:00
github-actions[bot] 02c1c7fa38 chore: version packages (#433) 
* chore: version packages

* cr

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-04-07 08:48:53 -07:00
github-actions[bot] 287776254f chore: version packages (alpha) (#429) 
* chore: version packages (alpha)

* cr

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-04-06 11:31:46 -07:00
dependabot[bot] 67d7423c82 build(deps-dev): bump typescript from 5.9.3 to 6.0.2 (#409) 
Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 6.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/compare/v5.9.3...v6.0.2)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 6.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-01 21:29:10 -07:00
Hunter Lovell ca5cc0acfb chore: merge alpha into main (#404) 
* Revert "revert: "feat(deepagents): support multimodal files for backends (#298)" (#352)" (#353)

This reverts commit 03ea1c9729.

* revert: "revert: "feat(sdk): add async subagent middleware for remote LangGraph servers  (#323)" (#351)" (#354)

* Revert "revert: "feat(sdk): add async subagent middleware for remote LangGraph servers  (#323)" (#351)"

This reverts commit 367e43a5ed.

* use any backend protocol

* Reapply "chore(deepagents): refactor backend method names - `lsInfo` -> `ls`, …" (#349) (#356)

This reverts commit 573479d743.

* Reapply "chore(sdk): unify sync subagents and async subagents into a single pr…" (#348) (#355)

This reverts commit 96dc34ccb6.

* chore: align alpha with main (#358)

* fix(deepagents): remove orphaned ToolMessages for Gemini compatibility (#335)

* fix(deepagents): remove orphaned ToolMessages for Gemini compatibility

* Fix ToolMessages for Gemini compatibility

---------

Co-authored-by: Christian Bromann <git@bromann.dev>

* fix(deepagents): throw on built-in tool collision (#330)

* add error

* Create big-horses-fail.md

* add config error class

* cr

---------

Co-authored-by: Christian Bromann <git@bromann.dev>

* fix(deepagents): use `crypto.randomUUID()` instead of uuid (#336)

* fix(deepagents): use crypto.randomUUID() instead of uuid

* update pnpm-lock

* Create grumpy-weeks-wave.md

* Update libs/deepagents/src/middleware/fs.int.test.ts

* feat(deepagent): add LangSmithSandbox (#324)

* feat(deepagent): add LangSmithSandbox

* Change deepagents version from patch to minor

* format

* fix tests

* format

* make it a patch

* cr

* cr

* fix

* cr

* chore: version packages (#321)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* regen lockfile

* fix langsmith tests so that they use backend protocol v2 methods

* format

---------

Co-authored-by: pawel-twardziak <pawel.twardziak.dev@gmail.com>
Co-authored-by: Christian Bromann <git@bromann.dev>
Co-authored-by: Maahir Sachdev <maahir.sachdev@langchain.dev>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat(deepagents): add completion notifier middleware for async subagents (#334)

Port of langchain-ai/deepagents#2119 to TypeScript. Adds a
createCompletionNotifierMiddleware that async subagents can use to
proactively notify their supervisor when they complete or error,
closing the gap where the supervisor only learns about completion
when someone calls check_async_task.

- New createCompletionNotifierMiddleware with afterAgent and
  wrapModelCall hooks
- Uses @langchain/langgraph-sdk Client to send runs.create() to the
  supervisor's thread
- Reads parent_thread_id from subagent state (injected by
  start_async_task)
- Derives task_id from runtime.configurable.thread_id
- Silently no-ops if parent context is missing
- Guards against duplicate notifications
- 22 unit tests covering all hooks, edge cases, and error paths

fix(deepagents): make url required in completion notifier (no ASGI in JS)

JS does not have ASGI transport like Python, so the url parameter
must be provided explicitly. Removed all ASGI references from docs
and the localhost fallback default.

fix(deepagents): throw on built-in tool collision (#330)

* add error

* Create big-horses-fail.md

* add config error class

* cr

---------

Co-authored-by: Christian Bromann <git@bromann.dev>

fix(deepagents): use `crypto.randomUUID()` instead of uuid (#336)

* fix(deepagents): use crypto.randomUUID() instead of uuid

* update pnpm-lock

* Create grumpy-weeks-wave.md

* Update libs/deepagents/src/middleware/fs.int.test.ts

feat(deepagent): add LangSmithSandbox (#324)

* feat(deepagent): add LangSmithSandbox

* Change deepagents version from patch to minor

* format

* fix tests

* format

* make it a patch

* cr

* cr

* fix

* cr

regen lockfile

linting

linting

add missing url property

chore: version packages (#321)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

changeset

regen lockfil

* chore: enter alpha pre-release

* chore: target alpha for releases

* chore: version packages (alpha) (#359)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(deepagents): extend supported backend file types (#363)

* extend supported file types

* Create strong-tigers-share.md

---------

Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com>

* chore(deepagents): implement async subagents + use stream example (#360)

* async subagents + use stream example

* fix lockfile

* format

* linting

* readme and linting

* format

* proactively send responses when subagents complete

* better examples

* feat(deepagents): rename completion notifier to completion callback and align with Python (#361)

* feat(deepagents): rename completion notifier to completion callback and align with Python PR

- Rename completion_notifier.ts -> completion_callback.ts to match Python's
  completion_callback.py naming
- Rename exports: createCompletionNotifierMiddleware -> createCompletionCallbackMiddleware,
  CompletionNotifierOptions -> CompletionCallbackOptions
- Rename state key: parent_thread_id -> callbackThreadId, option: parentGraphId -> callbackGraphId
- Make url optional (Python allows omitting for ASGI transport)
- Match Python's strict error behavior: throw on empty messages, non-AIMessage types,
  and missing callbackThreadId
- Add truncation suffix with task_id hint for long messages
- Use generic error message in wrapModelCall (don't leak error details)
- Remove duplicate notification guard (Python notifies on every error)
- Add extractCallbackContext to async_subagents.ts: injects callbackThreadId
  into subagent input state when launching via start_async_task
- Add tests for extractCallbackContext and callback context injection

* cr

* Rename completion notifier to completion callback

Renamed completion notifier to completion callback for consistency with Python.

* fix(sdk): `AsyncTask` `updatedAt` field doesn't update on task status changes (#400)

* update updatedAt field to change on any task update

* added changeset

* chore: set up self hosted async subagent example (#399)

* self hosted async subagent example

* with postgres

* formatting

* eslint disable no console

* fix dockerfile and readme

* Update examples/async-subagent-server/server.ts

Co-authored-by: Christian Bromann <git@bromann.dev>

---------

Co-authored-by: Christian Bromann <git@bromann.dev>

* chore(sdk): update async subagent middleware for agent protocol (#394)

* update async subagent middleware for agent protocol

* add changeset

* Update libs/deepagents/src/middleware/async_subagents.ts

Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com>

* Update libs/deepagents/src/middleware/async_subagents.ts

Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com>

* Update libs/deepagents/src/middleware/async_subagents.ts

Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com>

* differentiate agent protocol

---------

Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com>

* chore(repo): migrate linting and formatting to oxc tooling (#391)

* chore(repo): migrate linting and formatting to oxc tooling

* cr

* cr

* chore(lint): clean up console disables for oxlint

* cr

* Apply suggestions from code review

Co-authored-by: Christian Bromann <git@bromann.dev>

---------

Co-authored-by: Christian Bromann <git@bromann.dev>

* refactor(deepagents): clean up createDeepAgent middleware wiring (#392)

* refactor(deepagents): clean up createDeepAgent middleware wiring

* fix(deepagents): avoid duplicate HITL middleware on subagents

* add comments, remove iife

* Create ten-masks-flow.md

* fix(deepagents): align prompt templates with runtime behavior (#393)

* fix(deepagents): align prompt templates with runtime behavior

* chore: add changeset for prompt alignment fixes

* cr

* cr

* fix store backend and tests

* lint

* fix rests and resolveBackend

* lint

* fix failing tests

* revert adapt resolve backend

* fix resolve backend

* better variable name

* fix backend factory to return a maybe promise

* mark resolve backend as internal

* format

---------

Co-authored-by: Colin Francis <131073567+colifran@users.noreply.github.com>
Co-authored-by: pawel-twardziak <pawel.twardziak.dev@gmail.com>
Co-authored-by: Christian Bromann <git@bromann.dev>
Co-authored-by: Maahir Sachdev <maahir.sachdev@langchain.dev>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Colin Francis <colin.francis@langchain.dev>
 2026-04-01 17:10:16 -07:00
github-actions[bot] a7c503bb97 chore: version packages (#396) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-03-30 21:38:24 -07:00
Christian Bromann 92b26577b8 fix(deepagents): bump langchain deps (#395) 
* fix(deepagents): bump langchain deps

* formay

* Update changeset by removing deprecated packages

Removed several packages from the changeset.

* fix build
 2026-03-30 21:24:30 -07:00
github-actions[bot] 02321d6fb1 chore: version packages (#388) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-03-30 13:13:32 -07:00
Christian Bromann 9301a9efcc fix(deepagents): update langchain packages (#390) 
* fix(deepagents): update langchain packages

* Create warm-parents-prove.md

* format
 2026-03-30 12:59:24 -07:00
github-actions[bot] 48f21c3c6f chore: version packages (#379) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-03-26 14:05:51 -07:00
github-actions[bot] 63260d45be chore: version packages (#321) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-03-23 21:56:56 -07:00
dependabot[bot] 0bc3efec28 build(deps-dev): bump tsdown from 0.20.3 to 0.21.4 (#343) 
Bumps [tsdown](https://github.com/rolldown/tsdown) from 0.20.3 to 0.21.4.
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](https://github.com/rolldown/tsdown/compare/v0.20.3...v0.21.4)

---
updated-dependencies:
- dependency-name: tsdown
  dependency-version: 0.21.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-23 13:01:21 -07:00
github-actions[bot] a649a896fd chore: version packages (#310) 
* chore: version packages

* cr

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-03-17 17:23:15 -07:00
Hunter Lovell 3394e22016 chore: bump langchain version (#319) 
* chore: bump langchain version

* cr

* cr
 2026-03-17 17:05:57 -07:00
Hunter Lovell b30cdf9064 feat: add eval harness and initial eval suites (#309) 
* Squashed '.agents/skills/langsmith-skills/' content from commit aec5e8f

git-subtree-dir: .agents/skills/langsmith-skills
git-subtree-split: aec5e8f059ff50b1cde655e50b27a25da7981e60

* feat: add eval harness and initial eval suites

* cr

* cr

* cr

* cr

* cr

* cr

* cr
 2026-03-17 10:06:55 -07:00