Agent management and creation.
Accepted internal output modes for CLI subcommands.
Default agent / assistant identifier when no -a flag is given.
Opt into experimental, unstable dcode behavior.
Off by default; parsed by is_env_truthy (see there for the accepted truthy
values). Marks experimental runs in UI/trace metadata. Behavior behind this
flag may change or be removed without notice.
Whether dcode's built-in general-purpose subagent runs in fork mode.
On by default. Set to a falsy value to make the subagent receive only the delegated
task instead of inheriting the parent agent's conversation and state. Parsed by
is_env_truthy; set this only through the launching shell or global
~/.deepagents/.env, never a project .env.
Process-wide path snapshot captured before any dotenv loader can run.
Default model-node retry attempts after the first call when config is absent.
Canonical source for the dcode retry default; model_retry re-exports it so the
middleware and the config resolver never drift.
Subdirectory of the offload root that holds per-thread conversation archives.
Lives directly under ~/.deepagents/ in local mode. The /agent picker
excludes this reserved name in addition to requiring an AGENTS.md marker.
When True, compact_conversation requires HITL approval like other gated tools.
Matches the ### Model Identity section in the system prompt, up to the
next heading or end of string.
Return whether env var name is set to a recognizably truthy value.
Unlike bool(os.environ.get(name)), this does not treat "0" or
"false" as enabled. Use this for on/off flags where the user would
reasonably expect VAR=0 to mean "disabled".
Create the validated profile directory for an agent.
Create the user-level skills directory for an agent.
Return the directory containing skills bundled with dcode.
Return existing project-level AGENTS.md paths.
Return the project-level tool-agnostic .agents/skills directory.
Return the project-level custom-subagent directory, when available.
Return the project's experimental .claude/skills directory.
Return the project-level dcode skills directory, when in a project.
Return the user-level AGENTS.md path for an agent profile.
Return the launch user's tool-agnostic ~/.agents/skills directory.
Return the custom-subagent directory for an agent profile.
Return the launch user's experimental ~/.claude/skills directory.
Return the immutable launch-time user profile root.
Report whether name resolves onto an app-owned profile directory.
Use this instead of name in reserved_agent_dir_names() wherever the
input is a user-supplied agent name: the membership test is exact-string
and misses case and trailing-dot aliases that the filesystem itself would
resolve onto the reserved directory.
Asynchronously read a live approval mode from a LangGraph Store.
The graph server supplies an async batched Store whose synchronous methods
reject calls from the event-loop thread. Prefer aget() for that runtime,
while retaining a synchronous fallback for lightweight local test stores.
Return a validated mode, failing closed to manual.
Read a live approval mode from the server-side LangGraph Store.
Return the construction-scoped environment or the live process environment.
Get the default coding agent instructions.
These are the immutable base instructions that cannot be modified by the agent. Long-term memory (AGENTS.md) is handled separately by the middleware.
Get the glyph set for the current charset mode.
Resolve the LangSmith project name if tracing is configured.
Checks for the required API key and tracing environment variables.
When both are present, resolves the project name with priority:
credentials.deepagents_langchain_project (from
DEEPAGENTS_CODE_LANGSMITH_PROJECT), then LANGSMITH_PROJECT from the
environment (note: this may already have been overridden at bootstrap time
to match DEEPAGENTS_CODE_LANGSMITH_PROJECT), then 'deepagents-code'.
Restore launch and project-dotenv LangSmith settings for user commands.
Precedence, highest first: the launch shell the user started dcode from,
then the project .env. The global profile .env is deliberately excluded,
because it configures the agent rather than the user's own commands.
Also pops the client-to-server carrier and every DEEPAGENTS_CODE_-prefixed
selector, so agent.py can pass the result with inherit_env=False.
Get the default working directory for a given sandbox provider.
Read the server project context from environment transport data.
List subagents from user and/or project directories.
Scans for subagent definitions in the provided directories. Project subagents override user subagents with the same name.
Check a URL for suspicious Unicode and domain spoofing patterns.
Detect deceptive or hidden Unicode code points in text.
Join safety warnings into a display string with overflow indicator.
Render hidden Unicode characters as explicit markers.
Example output: abc<U+202E RIGHT-TO-LEFT OVERRIDE>def.
Neutralize control characters and deceptive Unicode in untrusted text.
Untrusted strings (MCP server errors, config-file contents, tool output)
can carry ANSI escape sequences, other control characters, or invisible
Unicode that corrupts the terminal, breaks out of a layout, or injects fake
lines into logs and prompts. This first removes the invisible/bidi code
points flagged by strip_dangerous_unicode, then replaces every remaining
Unicode "Other" (control/format) character with a space.
Remove known dangerous/invisible Unicode characters from text.
Summarize Unicode issues for warning messages.
Deduplicates by code point. When more than max_items unique entries exist,
the summary is truncated with a +N more entries suffix.
Load async subagent definitions from config.toml.
Reads the [async_subagents] section where each sub-table defines a remote
LangGraph deployment:
[async_subagents.researcher]
description = "Research agent"
url = "https://my-deployment.langsmith.dev"
graph_id = "agent"
Return a sorted list of available agent names from ~/.deepagents/.
Scans the user's .deepagents directory and returns each real
subdirectory that contains the AGENTS.md agent marker and is not an
app-reserved name. Fail-closed: bare directories, reserved app state
(bin/, plugins/, conversation_history/), symlinks, and hidden
entries are not agents.
Filesystem errors (missing parent, permission denied, broken entries) are logged and surfaced as an empty list rather than raised — the caller shows an empty modal instead of crashing mid-render.
List all available agents.
Reset an agent to default or copy from another agent.
Build the ### Model Identity section for the system prompt.
Get the base system prompt for the agent.
Loads the base system prompt template from system_prompt.md and
interpolates dynamic sections (model identity, working directory,
skills path, and execution mode for interactive vs headless).
Return ordered skill sources for PluginSkillsMiddleware and audit tooling.
Lowest to highest precedence: built-in -> plugins -> user .deepagents -> user .agents -> project .deepagents -> project .agents -> user .claude (experimental) -> project .claude (experimental)
Create a CLI-configured agent with flexible options.
This is the main entry point for creating a Deep Agents Code agent, usable both internally and from external code (e.g., benchmarking frameworks).
One complete generation of credentials and project context.
Result of creating a chat model, bundling the model with its metadata.
This separates model creation from runtime-state mutation so callers can decide when to commit the metadata to process-wide state.
Declared context_schema for the agent graph.
Registered via context_schema= when the graph is built, so LangGraph
coerces each run's context= payload into this dataclass — in-process,
runtime.context is a CLIContextSchema instance.
It exists alongside CLIContext (below) because the payload is shaped
differently on each side of the API boundary: in-process it is coerced to
this dataclass, but over the LangGraph API server (RemoteGraph) it is
serialized to JSON and arrives as a plain dict. Consumers
(configurable_model._get_context, _should_interrupt_tool_call)
therefore accept both shapes. CLIContext is the client-facing builder for
constructing that payload.
Fields mirror CLIContext; see its per-field docstrings for semantics.
Path-safety and size limits for read-only repository inspection tools.
Tool-approval policy selected for an interactive thread.
Swap the model or per-call settings from runtime.context.
Reads two optional keys from the runtime context dict:
'model' — a provider:model spec (e.g. "openai:gpt-5").
When present and different from the current model, the request is
re-routed to the new model.'model_params' — a dict of extra model settings (e.g.
{"temperature": 0}) that are shallow-merged into the
request's model_settings.This middleware is typically the outermost layer so it intercepts every
model call before provider-specific middleware (like
AnthropicPromptCachingMiddleware) runs.
Configuration consumed by CodeInterpreterMiddleware.
Inject local context (git state, project structure, etc.) into the system prompt.
Runs a bash detection script via backend.execute() on first interaction
and stores that snapshot for stable system-prompt injection. After each
summarization event, changed context is appended as an internal conversation
message so the cached prompt prefix stays byte-identical.
Because the script runs inside the backend, it works for both local shells and remote sandboxes.
Load namespaced plugin skills without extending the SDK source API.
Wraps the SDK SkillsMiddleware. Sources without a namespace load exactly
as the SDK loads them. Sources carrying a plugin namespace are walked
recursively so nested skill directories (skills/foo/bar/review/SKILL.md)
are discovered, and each skill's name is qualified as
plugin_id:foo:bar:review before the last-one-wins merge — matching
the plugin skill naming convention.
Explicit user/project path context for project-sensitive behavior.
Run a context-aware nested grader with CLI verification middleware.
The nested grader receives Deep Agents Code's verification middleware and
runtime context without requiring those application-specific capabilities in
the SDK's RubricMiddleware. The grader middleware stack owns model retries,
so transient failures follow the same budget and taxonomy as every other
dcode model call without replaying completed grader tools.
The CLI configures the grader's CodeModelRetryMiddleware with hidden
stream output. Grader messages use a nested namespace that both clients
filter before rendering, so a dropped read or truncated body can retry the
failed model node without duplicating visible output or replaying completed
grader tools. Other model retry middleware instances keep the streamed-output
guard enabled.
The grader model is selected per request from thread state rather than
fixed at construction. inherit_main_model supplies the default for a
thread that has recorded no selection of its own.
Validate shell commands against an allow-list without HITL interrupts.
When the agent invokes the execute shell tool, this middleware checks
the command against the configured allow-list before execution.
Rejected commands are returned as error ToolMessage objects — the
graph never pauses, so LangSmith traces stay as a single continuous
run.
Use this middleware in non-interactive mode to avoid the interrupt/resume cycle that fragments traces.
Stock HITL routing with an async live-mode read after model completion.
The transient routing marker is added only to a shallow state copy passed
directly into stock HITL routing. It is neither checkpointed nor accepted
without the process-local _RoutingDecision type identity, so graph input
cannot forge an autonomous mode.