release(deepagents): 0.7.0

[github-actions]

Caution

Merging this PR will automatically publish to PyPI and create a GitHub release.

For the full release process, see .github/RELEASING.md.

---

Release notes preview: keep this section in sync with the package CHANGELOG.md. Publish reads the merged CHANGELOG via release.yml, not this PR description — keep them aligned anyway so the PR stays an accurate historical record for reviewers and anyone returning later.

---

0.7.0 (2026-07-29)

See the docs for curated release notes.

⚠ BREAKING CHANGES

• create_deep_agent no longer includes TodoListMiddleware by default, the write_todos tool, todos state channel, and todo-planning prompt are now absent. Pass middleware=[TodoListMiddleware()] to restore them on the main agent; add it to each SubAgent's middleware to restore them there. (#4929) (9340518)
• Default agent prompts are now lean: the authored base prompt is empty, and tool-usage prose that duplicates tool schemas is trimmed. BASE_AGENT_PROMPT is deprecated (removal in deepagents==0.9.0) but remains importable and still returns the previous authored prompt verbatim; pass it as create_deep_agent(system_prompt=BASE_AGENT_PROMPT) to restore the old behavior. (#4859) (#4979) (a8d1b32) (d9f54fc)
• The built-in tool-usage prompt constants TASK_SYSTEM_PROMPT, ASYNC_TASK_SYSTEM_PROMPT, SUMMARIZATION_SYSTEM_PROMPT, FILESYSTEM_SYSTEM_PROMPT, and EXECUTION_SYSTEM_PROMPT are removed, and the system_prompt default on SubAgentMiddleware, AsyncSubAgentMiddleware, SummarizationToolMiddleware, and create_summarization_tool_middleware is now None, which injects no prose. Pass your own string to restore prompt text. (#4859) (a8d1b32)
• FilesystemBackend and LocalShellBackend now default to virtual_mode=True. Filesystem paths are anchored under root_dir, .. traversal is rejected, and paths resolving outside root_dir raise ValueError. Previously an unspecified virtual_mode emitted a deprecation warning and fell back to False, where absolute host paths were used as-is and .. could escape root_dir. Pass virtual_mode=False explicitly to restore the old filesystem behavior. (#4541) (540a0fa)
• Agents now see a destructive, recursive delete filesystem tool whenever the backend supports it, and filesystem permissions classify delete as a write operation — so an existing rule allowing writes to a path also authorizes recursively deleting that subtree unless a narrower deny or interrupt rule covers the target. Because recursive deletes affect descendants, deny and interrupt checks use bulk path overlap instead of exact-path matching. To keep the previous behavior, add a deny or interrupt rule, or omit delete from FilesystemMiddleware(tools=...). Missing paths return a not-found error, CompositeBackend reports an unsupported-operation error when a routed sub-backend cannot delete, and the tool is hidden from the model entirely when the backend itself does not implement it. (#3659) (#3691) (#3765) (#3851) (f2a21ec)
• write_file can now create a file if it is missing and replaces it entirely if it already exists, instead of returning a file-exists error. The write_file tool description no longer requires reading the file first. There is no "create-only" compatibility mode. Workflows, prompts, tests, or guardrails that relied on the file-exists error to force edit_file usage or to protect existing content must omit write_file, add explicit permission or interrupt rules, or use edit_file where preserving existing content matters. (#4109) (2506fcc)
• Removed deprecated backend compatibility shims. Callers must pass concrete BackendProtocol instances (not factories), configure StoreBackend with an explicit namespace, and use the current ls / glob / grep / ReadResult APIs. (#4541) (540a0fa)
• The deprecated files_update attribute and constructor keyword are removed from WriteResult and EditResult. Custom backends must stop passing files_update=, and callers must stop reading result.files_update; state writes are emitted directly by StateBackend. (#4541) (540a0fa)
• Removed the deprecated BackendProtocol methods ls_info, als_info, glob_info, aglob_info, grep_raw, and agrep_raw. Use ls / glob / grep and their async counterparts. (#4541) (540a0fa)
• SummarizationMiddleware(history_path_prefix=...) was removed and now raises TypeError. Configure CompositeBackend(artifacts_root=...) instead. (#4541) (540a0fa)
• Agent-facing ls and glob tool output now renders empty results as No files found instead of []; direct backend APIs continue to return structured empty LsResult and GlobResult values. Callers that parse tool output should update those checks. (#3709) (efafd1e)
• read_file no longer renders raw text with a fixed-width cat -n-style line-number gutter and tab separator. Line and continuation markers are dynamically aligned and separated from source content by two spaces, and the LINE_NUMBER_WIDTH constant is removed from deepagents.backends.utils and deepagents.middleware.filesystem. Callers that parse raw tool output should update those parsers. (#4561) (cf057b4)

Features

• Custom middleware passed to create_deep_agent(..., middleware=[...]) can replace a default middleware instance when .name matches, so defaults such as SummarizationMiddleware can be overridden without also excluding the built-in instance. (#4251) (90c8472)
• FilesystemMiddleware(tools=[...]) accepts a keyword-only allowlist of built-in filesystem tools, typed by the newly exported FsToolName literal ("ls", "read_file", "write_file", "edit_file", "delete", "glob", "grep", "execute"); pass "all" or omit the argument to keep every tool. A list must include "read_file" or the constructor raises ValueError. Omitted built-in tools are non-executable, and custom user tools are unaffected. (#4325) (#4698) (704a70d) (9709525)
• Shorten LLM-facing descriptions for the task tool and filesystem tools (read_file, grep, edit_file, glob, execute). (#5009) (761f5f0)
• GrepResult and GlobResult now carry a truncated flag so supporting backends can return valid partial results when a match cap or backend deadline is reached; agent-facing tool output adds a note telling the model to narrow the search. FilesystemBackend returns partial grep and glob results on its backend timeout rather than erroring, while other backend or middleware timeouts may still return errors. Its glob also gains brace expansion such as *.{py,md} (already supported by the state and store backends). (#4063) (ef591e7)
• The agent-facing grep match cap is configurable: FilesystemMiddleware(grep_max_count=...) sets the default (1000; None disables it) and the model can override it per call through the tool's new max_count argument. grep / agrep on BackendProtocol and all built-in backends accept a keyword-only max_count. Local ripgrep output is streamed and terminated once the cap is reached. Direct FilesystemBackend.grep() callers can request surrounding lines with keyword-only context_lines. (#4570) (#4706) (8e86f5e) (65230df)
• Paginated built-in read_file responses report the returned source-line range and next offset; total and remaining line counts are included when the backend knows the file length. Resume offsets remain safe when sandbox or middleware limits shorten the visible page. (#4540) (8321194)
• Optional video frame extraction for read_file, enabled by the new deepagents[video] extra. Video files are sampled into JPEG frames, with offset and limit interpreted as seconds. Without the extra, existing generic video/file content-block behavior remains. (#4094) (b927147)
• FilesystemMiddleware can capture oversized execute tool output directly inside the sandbox artifact path on compatible, opted-in BaseSandbox implementations to reduce round trips; LangSmithSandbox opts in by default. (#4230) (02f5bd7)
• Automatically enable Fireworks prompt-cache session affinity when a compatible langchain-fireworks installation is available. (#4598) (5d878bf)
• Add a built-in NVIDIA Nemotron 3 Ultra harness profile and NVIDIA NIM app-origin attribution. (#4192) (#4455) (d5a60ec) (4cb4749)
• RubricMiddleware now accepts any positive max_iterations cap instead of enforcing a hard upper bound. (#4405) (d6692a7)

Bug Fixes

• Keep fields marked with PrivateStateAttr, including fields declared through create_deep_agent(state_schema=...), out of subagent inputs and returned parent-state updates. (#4587) (a4662c0)
• Preserve ContextT through the create_deep_agent(..., middleware=[...]) type annotation so type checkers accept context-aware middleware when a matching context_schema is passed. (#4055) (7be76c7)
• Accept YAML list values as well as comma-separated strings for skill allowed-tools frontmatter, and make skill truncation warnings actionable with field name, path, length, configured limit, and impact. (#4140) (#4141) (d62534c) (2f5f5b8)
• Align filesystem instructions with the tools that remain after allowlist and backend-capability filtering, so agents no longer reference hidden grep/glob tools or prohibit equivalent shell search when dedicated search tools are unavailable. (#4920) (#4921) (d3650c7) (b65cc00)
• Propagate default-backend failures from CompositeBackend.ls("/") and CompositeBackend.als("/") instead of returning successful route-only listings. (#4925) (4c3b166)
• Correct CompositeBackend.glob / CompositeBackend.aglob routing so explicit default-backend paths such as /tools do not also return files from routed backends such as /memories. (#4531) (cbdb0a7)
• Propagate default- and routed-backend failures from root CompositeBackend.glob(..., path=None) / aglob(..., path=None) and path="/" searches instead of returning incomplete successful results. (#4063) (ef591e7)
• Constrain sandbox glob and slash-pattern grep searches to their declared search root by treating leading / as search-root-relative, rejecting .. traversal segments, and filtering symlink-resolved matches outside the root. (#4588) (c6c7213)
• Unify grep(..., glob=...) include-glob semantics across filesystem and in-memory backends: basename patterns like *.py match at any depth, and slash-containing patterns like src/**/*.py match relative paths consistently. (#3936) (feab6e0)
• Improve agent-facing grep descriptions and no-match hints to steer regex-looking patterns toward literal searches, route slash-containing sandbox include-globs correctly, and shorten default search timeouts so bad patterns and huge trees return guidance faster. (#4168) (b1dbf5e)
• Align sandbox delete behavior with other backends by returning not-found errors for missing paths, and avoid over-blocking unrelated sibling deletes when deny rules use glob patterns. (#4321) (d77496b)
• Improve rubric grader failure diagnostics with configured model, structured-output strategy, and integer HTTP status when available. (#4938) (#4967) (f51d3a0) (bca70aa)
• Emit max_iterations_reached as the terminal RubricMiddleware status when the iteration cap is exhausted, instead of a final needs_revision event that will not loop. (#4406) (a51c8d2)
• Handle missing async subagent URLs consistently in check_async_task and cancel_async_task. (#3967) (b0d92c0)

Performance Improvements

• Run LangSmith sandbox commands over the async client. (#5061) (0d08747)

---

End release notes preview.

---

Note

A New Contributors section is appended to the GitHub release notes automatically at publish time (see Release Pipeline, step 2).

[open-swe]

✅ Open SWE Review: No issues found

Open SWE reviewed this PR and found no potential bugs to report.

Open in Web • View Open SWE trace

[open-swe]

Open SWE Review found 1 potential issue.

Open in Web • View Open SWE trace

[github-actions]

⚠️ A release fan-out gate was bypassed.

Active bypass label(s): allow-scope-mismatch

Consequence: release-please will open a separate release PR for every managed component this PR touches, because it scopes commits by changed file path (not by title scope alone).

Touched release-please component(s): deepagents, deepagents-acp, deepagents-cli, deepagents-code, deepagents-talon, langchain-daytona, langchain-modal, langchain-quickjs, langchain-runloop, langchain-vercel-sandbox

This PR title does not currently look bump-worthy. Fan-out still matters if the squash-merge subject is later rewritten to a bump-worthy type (or a BEGIN_COMMIT_OVERRIDE block makes it one).

Confirm intentional, or split

Prefer:

1. One feature/fix PR scoped to the single package that owns the user-facing change.
2. One chore(deps): ... PR for cross-package dependency / lockfile churn (chore is hidden and does not open release PRs).

Remove the bypass label(s) to re-enable the blocking checks.

📖 Multi-component fan-out
📖 Lockfile churn fan-out
📖 Reverting a merged-but-unreleased PR

[github-actions]

This PR has been open for at least 14 days.

It will be closed automatically once it has been open for at least 30 days and this warning is at least 16 days old, unless the do-not-close label is applied.

[github-actions]

Warning

Partner upper-bound mismatch — this release bumps deepagents to 0.7.0, but the following partner packages have an upper bound that would exclude it:

Partner	Current bound	File
daytona	<0.7.0	libs/partners/daytona/pyproject.toml
modal	<0.7.0	libs/partners/modal/pyproject.toml
runloop	<0.7.0	libs/partners/runloop/pyproject.toml
vercel	<0.7.0	libs/partners/vercel/pyproject.toml

To fix: update each partner's pyproject.toml to deepagents>=0.7.0,<0.8.0, run uv lock in each directory, and open follow-up PRs (or include the bumps in this release).

If intentional: no action needed — existing published partner versions will continue to work with the older SDK range. New partner releases will need the bump.

[github-actions]

ℹ️ PR scope/file mismatch acknowledged via the allow-scope-mismatch label.

Title scope(s): deepagents

Touched package dir(s) not covered by those scopes:

• package label dcode from libs/code/

Release-please consequence: if this PR title is bump-worthy (feat/fix/etc.), release-please scopes by changed file path, not the title scope — so it can still open a separate release PR for every managed component this PR touches, even when the title names only one package. Prefer splitting into one package-scoped feature/fix PR and one chore(deps): PR for cross-package churn.

Remove the label to re-enable the block.

📖 Multi-component fan-out

[github-actions]

The package release workflow has started:

• release(deepagents): 0.7.0

Follow the linked run for build, test, and publish status.