curl -LsSf https://langch.in/dcode | bash# With model provider extras
# OpenAI, Anthropic, and Gemini are included by default
DEEPAGENTS_CODE_EXTRAS="nvidia,ollama" curl -LsSf https://langch.in/dcode | bashRun:
dcodeThe fastest way to start using Deep Agents. deepagents-code is a pre-built coding agent in your terminal — similar to Claude Code or Cursor — powered by any LLM that supports tool calling. One install command and you're up and running, no code required.
What deepagents-code adds on top of the SDK:
By default, dcode trusts the directory you run it in. Human-in-the-loop approval gates model-requested tool calls, but project artifacts are read before any approval prompt.
Do not run dcode in a directory you do not trust without a sandbox backend. For untrusted repositories, use a remote sandbox so execution is isolated from your machine. Running dcode in a directory lets that directory's files shape execution. See THREAT_MODEL.md for details.
Administrators can enforce any supported config.toml setting with a read-only
managed_config.toml using the same TOML schema:
/Library/Application Support/dcode/managed_config.tomlProgramData directory reported by the registry, usually
C:\ProgramData\dcode\managed_config.toml. The %ProgramData% environment
variable is ignored, because any user can change it./etc/dcode/managed_config.tomlManaged values override two lower layers: the DEEPAGENTS_CODE_ and
compatibility environment variables, and ~/.deepagents/config.toml.
For an agent launch, managed values also override these CLI flags: the model,
the auto-classifier model, the interpreter toggle, the programmatic tool-calling
list, the recursion limit, the shell allow list, and the startup mode. A managed
[sandboxes].default names the backend of a launch that is already sandboxed;
it does not sandbox a launch that asked for no sandbox. A managed startup mode
only revokes --auto-approve and --yolo; the mode itself reaches the runtime
through the merged configuration, so a headless launch still works. Subcommand
display flags such as dcode threads --relative are not overridden.
Tables merge recursively. Deny lists are unioned. An explicitly managed allow or trust list replaces lower-precedence grants. An empty managed list removes every lower-precedence grant.
A managed value whose type contradicts the manifest is ignored, and the lower-precedence value stays in effect. Two exceptions:
startup.mode, startup.yolo_switcher,
shell.allow_list, skills.extra_allowed_dirs,
interpreter.enable_interpreter, interpreter.ptc,
interpreter.ptc_acknowledge_unsafe, models.allowed,
models.auto_classifier, runtime.recursion_limit, sandboxes.default,
tracing.langsmith_redact)
stop every command except config, doctor, auth path, and the help
screens. If one is ignored, the user's flag or environment variable stays in
force. This grants the escalation, or it removes the boundary that the policy
declared. Three
cases stop the launch and block /reload: a value the manifest rejects, a
runtime.recursion_limit outside its bounds, and a key shadowed by a scalar
ancestor (startup = "manual" in place of [startup] and mode). A managed
[sandboxes].default that names an unavailable backend stops a sandboxed
launch; a launch that asked for no sandbox is unaffected. A scalar at any
known configuration section (for example, threads = "bad" instead of
[threads]) also stops launch and reload rather than replacing the user's
whole section.[models.providers], [themes],
[async_subagents], [sandboxes.providers]) the dedicated typed reader
validates instead, so a wrong-typed managed leaf can displace a valid user
leaf. The reader then falls back to the built-in default. A managed scalar
still replaces a colliding user table there, the same as on the top-level
merge.[shell].allow_list is read from ~/.deepagents/config.toml and from
DEEPAGENTS_CODE_SHELL_ALLOW_LIST, so a managed file can enforce it. A user can
also grant themselves shell auto-approval from their own config file. An empty
managed list removes every lower-precedence grant.
[models].allowed narrows dcode to exact provider:model specifications:
[models]
allowed = ["acme:production", "acme:production-fast"]
The rules:
provider:model, the same as at construction, so
gpt-5.6-terra matches an openai:gpt-5.6-terra entry. A bare name whose
provider dcode cannot infer never matches.bedrock:<id>. A bare Bedrock ID is rejected,
because its version colon would make it a specification that nothing matches.[models.providers.<name>].models registers models additively. It does not
grant permission, so a custom model may need both registration and an
allowlist entry.dcode never writes the managed file. Users can still save a preference. The
theme, terminal-mapping, UI-toggle, and MCP-server screens, and the
--auto-update flag, report when a managed value keeps a saved preference from
taking effect. The model-default, recent-model, and Auto-classifier writers
refuse a value outside the effective allowlist, and report the policy as the
reason. Other save paths do not check the allowlist.
A missing managed file applies no policy. If one exists but is unreadable, not
UTF-8, or invalid TOML, every command fails closed except the ones needed to
diagnose it: --help, --version, help, config, doctor, and
auth path. A managed file that becomes unusable later also blocks /reload:
the session keeps the policy that was in force, and the reload reports that it
kept it. Use dcode config path and dcode doctor to inspect its
fixed path and parse health; dcode config also warns when the file exists but
could not be parsed, or parses and declares a value that cannot be enforced.
A deny list that cannot be read denies everything rather than nothing. This
covers a managed [mcp].disabled_servers that is neither an array of names nor
a comma-separated string, and a [mcp] section that is not a table. A managed
[mcp].enabled_project_server_approvals that is not an array is treated the
same way: the key is present, so policy means to narrow access, and reading its
presence as absence would leave both the user's approvals and the
DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS bypass in force.
A corrupt ~/.deepagents/config.toml does not disable managed policy: the user
file is ignored and managed values still apply.
Deployment tooling must create and protect this file with administrator or root
permissions. dcode does not validate the file owner or mode. dcode provides
no privileged writer. Deployment and sudo policy are the administrator's
responsibility.
See our Releases and Versioning policies.
As an open-source project in a rapidly developing field, we are extremely open to contributions, whether it be in the form of a new feature, improved infrastructure, or better documentation.
For detailed information on how to contribute, see the Contributing Guide.
This project was primarily inspired by Claude Code, and initially was largely an attempt to see what made Claude Code general purpose, and make it even more so.
Raised when an external editor cannot be opened or read.
Represents a pasted image with its base64 encoding.
Represents a pasted video with its base64 encoding.
Structured version facts for a single installed distribution.
Network-free snapshot of the version facts diagnostics need.
Raised when installed extras cannot be determined safely.
Install status for one optional dependency extra.
Resolved recovery action for a missing provider package.
Structured proposal returned by the criteria agent.
A new proposal or a rejection-based regeneration.
An amendment to an accepted goal; both extra fields are required.
Main-agent state carrying a criteria request until it is cleared.
Private per-invocation state for the nested criteria agent.
Run goal-criteria requests entirely inside the main server graph.
Canonical goal/rubric fields used for notices and fingerprints.
The three user-controlled text sections a goal-state notice can embed.
Metadata extracted from a canonical goal-state notice.
tool.use hook payload (schema documented in hooks).
tool.error hook payload (schema documented in hooks).
tool.result hook payload (schema documented in hooks).
In-progress state for a single streamed tool call.
Counts of buffered tool calls that never emitted a tool.use.
Middleware that provides an ask_user tool for interactive questioning.
A single choice option for a multiple choice or multi-select question.
A question to ask the user.
Request payload sent via interrupt when asking the user questions.
Trusted same-turn authorization recorded after an ask_user response.
Widget result when the user submits answers.
Widget result when the user cancels the prompt.
Declared context_schema for the agent graph.
Client-facing builder for the per-run graph context payload.
Discriminator for ConfigResolutionError reasons.
Structured error returned when a login target cannot be resolved.
Successful resolution of a merged MCP config for login.
Resolved server config plus enough context for error messages.
A priced side-operation delta pending checkpoint persistence.
Agent state extended with the cumulative thread-cost channel.
Own the thread's cumulative _session_cost_usd checkpoint value.
Stable identifiers for notification actions dispatched by the app.
One button/action row in the notification modal.
Typed payload for a missing-dependency notification.
Typed payload for an update-available notification.
A single notice waiting for user action.
In-memory store of pending notifications.
Revert agent edits to the managed onboarding-name memory block.
A dangerous Unicode character found in text.
Safety analysis output for a URL string.
User-facing OAuth interaction surface shared by CLI and TUI.
Default OAuthInteraction that drives the flow via stdin/stdout.
The one-per-process result of building this server's agent.
Goal/rubric state channels shared by every schema that touches them.
Extends agent state with per-checkpoint facts restored on resume.
Persists per-checkpoint resume facts after each model call.
Validate shell commands against an allow-list without HITL interrupts.
Stock HITL routing with an async live-mode read after model completion.
Prompt-cache behavior needed to decide and price a warning.
Estimated input cost for a cold prefix and its warm-cache delta.
Validated data needed to render one advisory warning.
A single labeled diagnostic fact.
A named group of related diagnostic items.
Character set mode for TUI display.
Character glyphs for TUI display.
Global settings and environment detection for deepagents-code.
Why /trace found no LangSmith key, when an empty override is involved.
Offline snapshot of LangSmith tracing configuration for diagnostics.
Base class for typed LangSmith project URL lookup failures.
The langsmith package is not installed.
The LangSmith project URL lookup exceeded its hard timeout.
The LangSmith SDK call raised — auth, 404, network, etc.
The LangSmith project does not exist yet (lookup returned 404).
Result of creating a chat model, bundling the model with its metadata.
Nested-grader state used to scope verification-tool budgets.
Run a context-aware nested grader and retry transient transport failures.
Thread metadata returned by list_threads.
Unified parse result for dropped-path payload detection.
Track pasted images and videos in the current conversation.
Token stats for a single model within a session.
Token and cost stats for one UsageKind bucket.
Usage returned after recording one streamed model message.
Stats accumulated over a single agent turn (or full session).
What a stream consumer last recorded for one request.
Tool-approval policy selected for an interactive thread.
Stored approval-mode control payload.
Goal/rubric text exceeds a model-visible context budget.
A persisted API key credential.
A persisted OAuth subscription credential.
Result of a credential write that may have warnings to surface.
Result of a credential delete that may have warnings to surface.
A different dcode entry point is winning on PATH than the one we upgraded.
A single package version change parsed from uv's environment-diff output.
Raised when uv tool requested requirements cannot be preserved.
Path-safety and size limits for read-only repository inspection tools.
A single tool's display metadata.
A named group of tools sharing a source.
An MCP server that was discovered but currently exposes no tools.
Everything dcode tools list needs to render, in display order.
Classification that controls whether a command can skip the message queue.
A single slash-command definition.
A single autocomplete entry for the slash-command controller.
OSC 9;4 progress states.
Complete set of semantic colors for one theme variant.
Metadata for a registered theme.
Structured log record retained by the in-memory debug buffer.
Logging handler retaining the most recent structured records in memory.
A transport-independent event delivered from outside the TUI.
Source of external events for the Textual app.
Line-delimited JSON event source over a local Unix domain socket.
Parsed origin remote attribution for coding-agent-v1 traces.
Full configuration payload passed from the app to the server subprocess.
Swap the model or per-call settings from runtime.context.
Raised when model configuration or creation fails.
Raised when a model is outside the effective models.allowed policy.
Raised when no credentials are configured for any default-resolvable provider.
Raised when models.allowed is active but none of its models can auth.
Raised when neither the app nor init_chat_model can infer a provider.
Raised when a provider is selected but its API key env var is unset.
Raised when a provider is selected but its LangChain package is not installed.
Credential readiness state for a model provider.
Origin of a CONFIGURED credential, used to discriminate display.
Credential readiness information for a provider.
A model specification in provider:model format.
Profile data for a model with override tracking.
Configuration for a model provider.
Parsed model configuration from config.toml.
A project-scoped, definition-bound MCP server approval.
User-level allow/deny lists for project MCP servers.
Coalesced thread-selector configuration read from a single TOML parse.
How an option's raw env/TOML value is coerced to a typed value.
How valid provider values for one manifest option compose.
One user-tunable configuration option and where it can be set.
Metadata for a custom subagent loaded from filesystem.
State for local context middleware.
Inject local context (git state, project structure, etc.) into the system prompt.
Classifier denial categories exposed to the agent and TUI.
One structured classifier decision for a proposed tool call.
Validated classifier response for one unresolved action batch.
Server-owned denial and availability counters for one thread.
Checkpoint-safe disposition for one gated call.
Private checkpoint record joining model output to after-model routing.
Server-owned provenance for one exclusively allocated scratch file.
Reducer update that creates or removes one exact artifact record.
Agent state carrying private Auto decisions and scratch provenance.
Trusted metadata attached by the Textual client to a user message.
Apply deterministic policy, classifier review, and HITL fallback.
Reject dynamically gated MCP calls when no approval UI exists.
Line counts for a change, named so the pair cannot be swapped silently.
Raised when a downloaded archive fails SHA-256 verification.
Raised when no managed helper binary is available for this system.
ACP server that supplies trusted classifier context in Auto mode.
Deterministic chat model for integration tests.
Deterministic tool-calling model for auto-approve integration tests.
Exercise nested criteria generation with a repository read.
Data used to render HITL previews.
Line and byte level metrics for a file operation.
Track a single filesystem tool call.
Collect file operation metrics during an interaction.
Stored content for a collapsed paste.
Explicit user/project path context for project-sensitive behavior.
Whether a probed path exists, is absent, or could not be read.
Local directory or JSON file used as a marketplace source.
GitHub or Git repository used as a marketplace source.
Marketplace manifest downloaded from an HTTP URL.
Parsed plugin manifest.
Inventory of supported plugin components.
A discovered plugin ready to feed dcode adapters.
A plugin stored relative to its marketplace.
A plugin sourced from a GitHub repository.
A plugin sourced from a subdirectory in a Git repository.
A plugin sourced from a Git repository URL.
A catalog entry from a marketplace manifest.
A parsed marketplace manifest.
Persisted marketplace source record.
Install record for a plugin.
Result from plugin discovery.
Raised when a plugin manifest is malformed enough to skip the plugin.
Raised when existing plugin state cannot be safely modified.
Raised when a marketplace cannot be loaded.
Load namespaced plugin skills without extending the SDK source API.
Raised when the HITL interrupt loop exceeds _MAX_HITL_ITERATIONS rounds.
A tool call whose tool.use has fired but whose result has not arrived.
Mutable state accumulated while iterating over the agent stream.
Best-effort background LangSmith thread URL lookup state.
Manages a langgraph dev server subprocess.
An option paired with its resolved effective value, for display.
A tool.result payload held back until the authoritative result arrives.
A validated rubric_evaluation_end event forwarded to the caller.
Adapter for rendering agent output to Textual widgets.
One prompt summary row.
Message sent when a prompt row is clicked.
Filter, preview, copy, or select a previously submitted prompt.
How to resolve a cold prompt-cache warning.
Ask whether to send a turn whose prompt cache may be cold.
Ask whether to compact a just-resumed thread before the next turn.
Arrow-key navigable plugin manager for /plugins.
Posted when a plugin manager tab label is clicked.
Mouse-clickable tab label in the plugin manager header.
Compact welcome banner shown at startup.
Confirmation overlay before /update --deps upgrades dcode itself.
Confirmation overlay for a dependency refresh.
Confirmation overlay for installing an arbitrary --package.
Confirmation overlay for installing a model provider's extra.
Keep the current goal and lifecycle state visible above the input.
In-TUI first-run notice describing what Auto mode does.
Strategy for building a tool's HITL approval widget.
Renderer for write_file tool - shows full file content.
Renderer for task tool — interrupt description provides full context.
Renderer for delete tool - shows removed file content when available.
Renderer for edit_file tool - shows unified diff.
Dismissal payload identifying which action the user picked.
Posted when a notification row is clicked with the mouse.
Posted when the user picks SUPPRESS from a notification's detail modal.
Posted when the user toggles the settings disclosure row.
Posted for an action that opens a follow-up modal in place.
Shared hub for pending notifications and warning preferences.
Free-form answer input for ask-user questions.
Posted when the user presses Enter to submit an ask-user answer.
Interactive widget for asking the user questions.
Message sent when user submits all answers.
Message sent when user cancels the ask_user prompt.
Types of messages in the chat.
Status of a tool call.
In-memory message data for virtualization.
Manages message data and widget window for virtualization.
Docked two-pane panel visualizing js_eval subagent fan-out by phase.
Modal visualization of the current model context window.
Ask before changing agents to resume a thread.
Captured stdout printed during a js_eval evaluation.
A successful js_eval evaluation result.
An error raised during a js_eval evaluation.
Run the ChatGPT OAuth Authorization Code Flow with PKCE inline.
Outcome of the CodexSignedInScreen quick-action overlay.
Quick-action overlay shown when openai_codex is already signed in.
Approval overlay for a skill resolving outside trusted directories.
Base class for tool approval widgets.
Generic approval widget for unknown tools.
Approval widget for write_file - shows file content with syntax highlighting.
Approval widget for edit_file - shows clean diff with colors.
Modal dialog for theme selection with live preview.
TextArea that detects paste-like keystroke bursts.
Paste-aware text area that collapses large pastes into placeholders.
Widget result when the generated criteria are accepted unchanged.
Widget result when the user submits revised criteria.
Widget result when the user rejects criteria with feedback.
Widget result when the user cancels the proposal.
Text input that keeps goal-review edit keystrokes inside the editor.
Posted when the user presses Enter to submit goal-review text.
Posted when Escape should leave goal criteria edit mode.
Inline review widget for generated goal acceptance criteria.
Message sent when the user accepts, edits, or cancels.
A clickable completion option in the autocomplete popup.
Message sent when a completion option is clicked.
Small clickable button shown at the right edge of the chat input row.
Message sent when an input action button is clicked.
Popup widget that displays completion suggestions as clickable options.
Message sent when the popup's visible row count changes.
Message sent when a completion option is clicked.
TextArea subclass with custom key handling for chat input.
Message sent when text is submitted.
Request previous history entry.
Request next history entry.
Posted when the user presses a printable key or backspace.
Bordered box that owns the chat composer size.
Drag target docked over the chat input's top border.
Message sent when a resize drag begins.
Message sent with the current drag delta.
Message sent when a resize drag stops, however it stopped.
Message sent when resize hover feedback changes.
Message sent when expanded sizing should be toggled.
Chat input widget with prompt, multi-line text, autocomplete, and history.
Message sent when input is submitted.
Message sent when input mode changes.
Posted when the user presses a printable key or backspace in the input.
Modal dialog for switching between available agents.
Manages command history with file persistence.
One startup tip displayed above the chat input.
Modal asking whether to restart the server after an MCP login.
Modal asking whether to reconnect after /mcp disable/enable toggles.
Confirmation overlay for /mcp reconnect --force with no pending login.
Approval menu using standard Textual patterns.
Message sent when user makes a decision.
A selectable tool item in the MCP viewer.
Read-only modal for a failed MCP server's error details.
A selectable server-header row in the MCP viewer.
Modal viewer for active MCP servers and their tools.
Posted when the changelog row is clicked with the mouse.
Modal dedicated to the update-available notification.
Outcome of the YOLO first-enable notice.
In-TUI acknowledgement shown before unrestricted YOLO becomes active.
Animated spinner using charset-appropriate frames.
Animated loading indicator with status text and elapsed time.
One-time choice for how Auto mode handles generated goal criteria.
Onboarding screen that asks for the user's name.
Onboarding screen that summarizes installed optional integrations.
Which stored preference Ctrl+S toggles, and how the footer names it.
A clickable model option in the selector.
Message sent when a model option is clicked.
Full-screen modal for model selection.
Modal asking whether to switch cwd when resuming or switching to a thread.
Ask how project hooks in a newly entered workspace should be trusted.
Posted when an _ActionOption is clicked with the mouse.
Modal displaying a single notification's title, body, and actions.
Query field for the inline prompt search panel.
Posted on Escape or empty-query Backspace, to close the search.
Posted on Tab (older) or Shift+Tab (newer) to page the results.
One clickable prompt row in the inline search panel.
Message sent when a prompt row is clicked.
Inline prompt history search rendered above the input row.
Message sent when the panel's rendered row count changes.
Message sent when a prompt row is clicked in the panel.
The closed set of LangSmith region selections in the /auth prompt.
Outcome of resolving the region selector to an endpoint to persist.
Outcome of an AuthPromptScreen interaction.
Confirm before launching an authentication flow for a model.
Confirmation overlay shown before clearing a stored credential.
Modal that captures and persists an API key for one provider.
Modal that lists configured providers and lets the user manage keys.
Posted when a key prompt successfully persists credentials.
Posted when a key prompt deletes stored credentials.
A single row in the console's session snapshot.
Modal showing a session snapshot and a live tail of recent log records.
Result of handling a key event in the completion system.
Protocol for views that can display completion suggestions.
Protocol for completion controllers.
Controller for / slash command completion.
Controller for @ file completion with fuzzy matching from current cwd.
Manages multiple completion controllers, delegating to the active one.
Modal dialog for selecting a reasoning effort level.
A label that displays a model name with smart truncation.
A label that displays the git branch with glyph-aware truncation.
A bullet-separated chain of session metrics.
Two-line status bar for session identity and runtime metrics.
Raised by MCPLoginScreen.action_cancel when the user cancels the flow.
Modal that renders the OAuth login flow and collects user input.
Modal that shows self-update progress and a bounded log tail.
A clickable thread option in the selector.
Message sent when a thread option is clicked.
Emit scroll changes so the parent can refresh the overflow indicator.
Message sent when the controls pane scroll position changes.
Confirmation modal shown before deleting a thread.
Options dropdown overlay that consumes option navigation while focused.
Options dropdown that keeps focus contained while its menu is open.
Modal dialog for browsing and resuming threads.
Modal asking whether to restart the server for a spawn-time change.
One JSONL record in a materialized transcript projection.
Identity of a materialized transcript file.
Append-only JSONL transcript projections owned by the client process.
Collect completed stream messages into a Hooks transcript runtime.
Live client identity projected into every hook invocation.
Result of a lifecycle hook that may halt the caller.
Result of UserPromptSubmit, including its prompt rewrites.
Owns the Hooks v2 runtime, presenter, hook service, and transcripts.
Validated output and diagnostics from one command handler.
Client approval decision compatible with HITL resume payloads.
Normalized result shared by TUI and headless permission handling.
How one batch of gated tool calls was resolved by hooks.
Raised when a client-owned hook stops lifecycle processing.
Client state required to create a domain hook invocation.
Execute client-owned events and apply their common side effects.
Persisted trust record for one canonical workspace root.
Versioned on-disk trust store for project-scoped hooks.
Collect version facts for the installed deepagents SDK distribution.
Map a raw ToolMessage.status to the two-value hook domain, fail-closed.
Neutralize control characters and deceptive Unicode in untrusted text.
Resolve the model spec the Auto approval classifier should use.
Fetch the LangSmith project URL, raising on any failure.
Validate that the model has required capabilities for deepagents.
Read a live approval mode from the server-side LangGraph Store.
Return " (released Nd ago)" for version, or "" when unknown.
Return a human-readable age for SDK version (e.g., 'released 3d ago').
Reset the terminal's dynamic default background color with OSC 111.
Parse an ordered model allowlist of exact specs and provider wildcards.
Return the env var blanking the Auto classifier model, if any.
Build a safe agent/UI reason for a failed auto classifier call.
Resolve or materialize a marketplace plugin entry to a plugin root.
Merge managed policy over user config with this project's precedence.
Return managed settings whose declaration cannot be safely applied.