feat(code): add --allow-fs-tools filesystem tool allowlist to dcode - #4635
Merged
Conversation
Nishitha M (imnishitha)
changed the title
--allow-fs-tools filesystem tool allowlist to dcode
github-actions
Bot
added
dcode
Nishitha M (imnishitha)
changed the title
--allow-fs-tools filesystem tool allowlist to dcode--allow-fs-tools filesystem tool allowlist to dcode
github-actions
Bot
changed the title
--allow-fs-tools filesystem tool allowlist to dcode--allow-fs-tools filesystem tool allowlist to dcode
Nishitha M (imnishitha)
marked this pull request as ready for review
July 10, 2026 18:06
![open-swe[bot]](https://avatars.githubusercontent.com/in/1395372?s=60&v=4){kind=small}
# Conflicts: # libs/code/deepagents_code/agent.py # libs/code/deepagents_code/main.py # libs/code/tests/unit_tests/test_agent.py # libs/code/tests/unit_tests/test_main_acp_mode.py
…nt and harden tool catalog backstop The `--allow-fs-tools` flag restricted filesystem tools for the main agent and synchronous subagents but not the nested goal-criteria agent, which kept its own unrestricted read-only repository tools (`ls`, `read_file`, `glob`, `grep`). Delegating to goal-criteria generation could therefore read files outside the parent allowlist. `_create_goal_criteria_agent` now accepts `fs_tools` and narrows its `FilesystemMiddleware` tool list to the parent-allowed subset, so the restriction is consistent across every local agent path. The tool-catalog backstop in `collect_built_in_tools` previously filtered silently when a disallowed filesystem tool leaked through enumeration. That filter is now load-bearing for `/tools` display accuracy: if it ever removes a tool, it logs an error instead of quietly reshaping the listing over an unrestricted agent. Also consolidates the duplicated `FsToolName` mirror set into a single `_constants.FS_TOOL_NAMES` imported by both `main` and `tool_catalog`, hoists `_parse_allow_fs_tools_flag` to run once early in `cli_main` (before startup side effects) rather than at two late call sites, and adds tests covering the criteria-agent restriction, backstop logging, `None` vs `all` middleware divergence, early-exit on invalid values, and `ServerConfig.from_env` absent-var round-trip.
Mason Daugherty (mdrxy)
pushed a commit
that referenced
this pull request
Jul 22, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. The published GitHub release body is extracted from the merged `CHANGELOG.md` by `release.yml`, not from this PR description._ --- ## [0.1.45](deepagents-code==0.1.44...deepagents-code==0.1.45) (2026-07-22) ### Features - Added the Hooks v2 execution engine and typed hooks data models ([#4880](#4880), [#4870](#4870)) - Added a filesystem tool allowlist for `dcode` with `--allow-fs-tools` ([#4635](#4635)) - Added a GLM-5.2 harness profile ([#4710](#4710)) - Added a built-in thread inspector skill ([#4769](#4769)) - Replaced Gemini 3.5 Flash with Gemini 3.6 Flash in the model switcher ([#4890](#4890)) - Show experimental mode in the splash screen and debug console ([#4863](#4863)) - Gate debug console click-to-copy behind a checkbox ([#4810](#4810)) ### Bug Fixes - Improved scratch-file handling by allowing cleanup of agent-created scratch files and safe OS-temp scratch artifacts ([#4860](#4860), [#4869](#4869)) - Skip grading during `/goal` proposals ([#4941](#4941)) - Improved MCP approval handling: Esc now aborts project MCP approval, disabled MCP servers are honored for plugins, remembered approvals are preserved with the env allowlist, and approvals are shared across Git worktrees ([#4888](#4888), [#4848](#4848), [#4889](#4889), [#4939](#4939)) - Hardened installer downloads and paths ([#4871](#4871)) - Fixed forced `dcode update` checks to bust the CDN cache ([#4862](#4862)) - Prevented failed exit setup from stranding the app ([#4913](#4913)) - Fixed routing so `ctrl+x` goes to the focused `ask_user` input ([#4926](#4926)) - Show `-m` prompts as queued immediately on startup ([#4861](#4861)) - Kept harness-profile diagnostics out of terminal output ([#4943](#4943)) - Avoid tracking inline restart callers ([#4894](#4894)) - Fixed debug console thread ID copying on click ([#4945](#4945)) ### Performance Improvements - Reduced exit latency by coordinating async shutdown teardown ([#4831](#4831)) - Sped up local context detection ([#4922](#4922)) _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
Mason Daugherty (mdrxy)
added a commit
to langchain-ai/docs
that referenced
this pull request
Jul 22, 2026
Deep Agents Code adds `--allow-fs-tools` in [langchain-ai/deepagents#4635](langchain-ai/deepagents#4635), but the CLI reference does not yet explain how to start a session with a restricted filesystem tool set. This documents the valid filesystem tool names, validation rules, scope across agent modes, and the interaction between `execute` and shell command approval. It also adds `dcode tools list` to the management command reference and shows how tool-shaping flags affect its output.
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
…langchain-ai#4635) Related to langchain-ai#3952 Deep Agents Code users can now start a session with only the filesystem tools a task needs. This supports read-only audits, CI analysis, and plan-first workflows without requiring a custom agent configuration. --- Previously, dcode exposed all eight filesystem tools to the main agent and its synchronous subagents. The new `--allow-fs-tools` flag limits that filesystem tool surface: ```bash # Keep the existing unrestricted behavior (same as omission) dcode --allow-fs-tools all # Allow file listing and reading only dcode --allow-fs-tools ls,read_file # Allow read-only file discovery and search dcode -n "audit this repository" --allow-fs-tools ls,read_file,glob,grep ``` The flag accepts `all` or a comma-separated subset of `ls`, `read_file`, `write_file`, `edit_file`, `delete`, `glob`, `grep`, and `execute`. Explicit lists must include `read_file`, which the filesystem middleware requires. Omitting the flag, or passing `all`, preserves the existing unrestricted filesystem tool set. Empty lists, unknown names, and lists that combine `all` with named tools fail before the agent starts. The allowlist applies in the TUI, non-interactive mode, ACP mode, and the local server subprocess. It is installed on the main agent and every synchronous subagent, so delegation through `task` cannot restore a removed filesystem tool. Async subagents are unaffected because they use their own remote backend. Non-filesystem tools are also unaffected. `/tools` and `dcode tools list` reflect the configured allowlist, so the displayed filesystem tool surface matches what the model can use. --------- Co-authored-by: Mason Daugherty <mason@langchain.dev> Co-authored-by: Mason Daugherty <github@mdrxy.com>
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. The published GitHub release body is extracted from the merged `CHANGELOG.md` by `release.yml`, not from this PR description._ --- ## [0.1.45](langchain-ai/deepagents@deepagents-code==0.1.44...deepagents-code==0.1.45) (2026-07-22) ### Features - Added the Hooks v2 execution engine and typed hooks data models ([langchain-ai#4880](langchain-ai#4880), [langchain-ai#4870](langchain-ai#4870)) - Added a filesystem tool allowlist for `dcode` with `--allow-fs-tools` ([langchain-ai#4635](langchain-ai#4635)) - Added a GLM-5.2 harness profile ([langchain-ai#4710](langchain-ai#4710)) - Added a built-in thread inspector skill ([langchain-ai#4769](langchain-ai#4769)) - Replaced Gemini 3.5 Flash with Gemini 3.6 Flash in the model switcher ([langchain-ai#4890](langchain-ai#4890)) - Show experimental mode in the splash screen and debug console ([langchain-ai#4863](langchain-ai#4863)) - Gate debug console click-to-copy behind a checkbox ([langchain-ai#4810](langchain-ai#4810)) ### Bug Fixes - Improved scratch-file handling by allowing cleanup of agent-created scratch files and safe OS-temp scratch artifacts ([langchain-ai#4860](langchain-ai#4860), [langchain-ai#4869](langchain-ai#4869)) - Skip grading during `/goal` proposals ([langchain-ai#4941](langchain-ai#4941)) - Improved MCP approval handling: Esc now aborts project MCP approval, disabled MCP servers are honored for plugins, remembered approvals are preserved with the env allowlist, and approvals are shared across Git worktrees ([langchain-ai#4888](langchain-ai#4888), [langchain-ai#4848](langchain-ai#4848), [langchain-ai#4889](langchain-ai#4889), [langchain-ai#4939](langchain-ai#4939)) - Hardened installer downloads and paths ([langchain-ai#4871](langchain-ai#4871)) - Fixed forced `dcode update` checks to bust the CDN cache ([langchain-ai#4862](langchain-ai#4862)) - Prevented failed exit setup from stranding the app ([langchain-ai#4913](langchain-ai#4913)) - Fixed routing so `ctrl+x` goes to the focused `ask_user` input ([langchain-ai#4926](langchain-ai#4926)) - Show `-m` prompts as queued immediately on startup ([langchain-ai#4861](langchain-ai#4861)) - Kept harness-profile diagnostics out of terminal output ([langchain-ai#4943](langchain-ai#4943)) - Avoid tracking inline restart callers ([langchain-ai#4894](langchain-ai#4894)) - Fixed debug console thread ID copying on click ([langchain-ai#4945](langchain-ai#4945)) ### Performance Improvements - Reduced exit latency by coordinating async shutdown teardown ([langchain-ai#4831](langchain-ai#4831)) - Sped up local context detection ([langchain-ai#4922](langchain-ai#4922)) _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to #3952
Deep Agents Code users can now start a session with only the filesystem tools a task needs. This supports read-only audits, CI analysis, and plan-first workflows without requiring a custom agent configuration.
Previously, dcode exposed all eight filesystem tools to the main agent and its synchronous subagents. The new
--allow-fs-toolsflag limits that filesystem tool surface:The flag accepts
allor a comma-separated subset ofls,read_file,write_file,edit_file,delete,glob,grep, andexecute. Explicit lists must includeread_file, which the filesystem middleware requires. Omitting the flag, or passingall, preserves the existing unrestricted filesystem tool set. Empty lists, unknown names, and lists that combineallwith named tools fail before the agent starts.The allowlist applies in the TUI, non-interactive mode, ACP mode, and the local server subprocess. It is installed on the main agent and every synchronous subagent, so delegation through
taskcannot restore a removed filesystem tool. Async subagents are unaffected because they use their own remote backend. Non-filesystem tools are also unaffected./toolsanddcode tools listreflect the configured allowlist, so the displayed filesystem tool surface matches what the model can use.