fix(code): allow `compact_conversation` in Auto mode without HITL by mdrxy · Pull Request #4947 · langchain-ai/deepagents

Mason Daugherty (mdrxy) · 2026-07-22T05:04:46Z

Auto mode no longer prompts for approval when the agent compacts the conversation.

In Auto mode, gated tool calls that aren't deterministically allowed are routed to the classifier and can end up requiring a human approval prompt. compact_conversation only summarizes older messages into backend storage to reclaim context window — it has no external side effect and crosses no trust boundary — so pausing an autonomous run (e.g. mid-/goal) for a compaction approval is unnecessary friction. This adds compact_conversation to _deterministic_allow so Auto always allows it without classifier review or a HITL prompt.

Made by Open SWE

`compact_conversation` only summarizes older messages into backend storage to reclaim context window; it has no external side effect and crosses no trust boundary. Treat it as a deterministic allow in Auto so autonomous runs (e.g. mid-`/goal`) never pause for a compaction approval prompt. Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

open-swe

Open SWE Review found 1 potential issue.

Open in Web • View Open SWE trace

open-swe · 2026-07-22T21:29:48Z

+    if name == "compact_conversation":
+        # Conversation compaction only summarizes older messages into backend
+        # storage to reclaim context window; it has no external side effect and
+        # crosses no trust boundary, so Auto always allows it without classifier
+        # review or a human approval prompt (e.g. mid-`/goal` autonomous runs).
+        return True


🟠 Name-only exemption bypasses custom tool review

This allow is based only on the call name, not on the resolved tool being the CLI compaction implementation. create_cli_agent(..., tools=[...]) currently allows a caller-supplied BaseTool named compact_conversation; that top-level tool wins over the middleware's built-in tool in the compiled graph. In Auto mode, calls to that custom implementation now skip both the classifier and HITL, even if it performs filesystem/network mutations. Please mark and verify the canonical compaction tool (or otherwise validate its identity) before granting the deterministic exemption.

(Refers to lines 1268-1273)

Your feedback helps Open SWE learn. React with 👍 or 👎 to tell us if this review comment was useful.

Mason Daugherty (mdrxy) · 2026-07-23T13:00:30Z

Superseded by #4993.

The replacement carries forward this PR's deterministic allowance for the built-in compact_conversation operation and combines it with #4946's validated ask_user consent handling. Reviewing both together provides one coherent Auto-mode policy for avoiding redundant approval prompts without creating a generalized bypass.

Closing this PR in favor of #4993.

Supersedes #4946 Supersedes #4947 Auto mode no longer interrupts users when an action is already covered by their explicit `ask_user` selection or when the agent is performing the built-in conversation-compaction operation. --- Previously, Auto mode could ask users to approve an action immediately after they selected it in an `ask_user` prompt. It could also pause autonomous work to approve `compact_conversation`, even though compaction is an internal maintenance operation without an externally consequential effect. The two cases now follow separate trust rules: - Server-created, same-turn receipts allow the authorization classifier to consider only the user's selected answer for the exact subsequent action. The receipt is bound to the LangGraph execution thread, the active turn, and the originating `ask_user` tool call, and is validated against the full checkpoint history so it survives conversation compaction. Only the latest `ask_user` exchange in the turn is admitted; model-authored questions, unselected choices, and prior answers are excluded. Invalid, stale, ambiguous, or overly broad consent continues through the normal approval path. - The trusted built-in `compact_conversation` operation is deterministically allowed without classifier or human review. The exemption is guarded by exact tool-object identity, not by name, so a caller-supplied tool with the same name cannot exploit it. At most one trusted compaction call is allowed per action batch; duplicates are denied without classifier review, and that denial is preserved across all fallback paths. <details> <summary>Test plan</summary> Targeted Auto-mode, ask_user, agent-wiring, and Textual-adapter tests: ``` uv run --group test pytest tests/unit_tests/test_ask_user_middleware.py \ tests/unit_tests/test_auto_mode.py \ tests/unit_tests/tui/test_textual_adapter.py::TestExecuteTaskTextualTurnMarkers \ tests/unit_tests/test_agent.py::test_cli_context_schema_fields_mirror_typed_dict \ tests/unit_tests/test_agent.py::TestCreateCliAgentInterpreterWiring \ --disable-socket --allow-unix-socket --benchmark-disable -q ``` Result: 135 passed. Full package unit tests: ``` make test ``` Result: 10617 passed, 4 skipped, 6 pre-existing failures in `TestLangsmithSecretRedaction` (env-dependent, fail on clean `origin/main`). Lint, format, type check, and commands catalog: ``` make lint ``` Result: All checks passed. A real LangGraph interrupt/resume test (`test_real_agent_resume_forwards_ask_user_receipt_to_classifier`) verifies the full path: `ask_user` interrupt → checkpoint resume → receipt minting with real `execution_info.thread_id` → classifier sees `same_turn_user_answers` → action executes without a second HITL prompt. A compiled-graph identity test (`test_compiled_agent_preserves_canonical_compaction_tool_identity`) verifies the canonical `CLICompactionMiddleware` tool object survives `create_deep_agent`'s middleware merge into the compiled `ToolNode`, and that `AutoModeHITLMiddleware._trusted_compaction_tool` references that same object. The 6 `TestLangsmithSecretRedaction` failures are pre-existing and env-dependent (real LangSmith credentials in the local environment); they fail identically on clean `origin/main` and are unrelated to this change. </details>

Supersedes langchain-ai#4946 Supersedes langchain-ai#4947 Auto mode no longer interrupts users when an action is already covered by their explicit `ask_user` selection or when the agent is performing the built-in conversation-compaction operation. --- Previously, Auto mode could ask users to approve an action immediately after they selected it in an `ask_user` prompt. It could also pause autonomous work to approve `compact_conversation`, even though compaction is an internal maintenance operation without an externally consequential effect. The two cases now follow separate trust rules: - Server-created, same-turn receipts allow the authorization classifier to consider only the user's selected answer for the exact subsequent action. The receipt is bound to the LangGraph execution thread, the active turn, and the originating `ask_user` tool call, and is validated against the full checkpoint history so it survives conversation compaction. Only the latest `ask_user` exchange in the turn is admitted; model-authored questions, unselected choices, and prior answers are excluded. Invalid, stale, ambiguous, or overly broad consent continues through the normal approval path. - The trusted built-in `compact_conversation` operation is deterministically allowed without classifier or human review. The exemption is guarded by exact tool-object identity, not by name, so a caller-supplied tool with the same name cannot exploit it. At most one trusted compaction call is allowed per action batch; duplicates are denied without classifier review, and that denial is preserved across all fallback paths. <details> <summary>Test plan</summary> Targeted Auto-mode, ask_user, agent-wiring, and Textual-adapter tests: ``` uv run --group test pytest tests/unit_tests/test_ask_user_middleware.py \ tests/unit_tests/test_auto_mode.py \ tests/unit_tests/tui/test_textual_adapter.py::TestExecuteTaskTextualTurnMarkers \ tests/unit_tests/test_agent.py::test_cli_context_schema_fields_mirror_typed_dict \ tests/unit_tests/test_agent.py::TestCreateCliAgentInterpreterWiring \ --disable-socket --allow-unix-socket --benchmark-disable -q ``` Result: 135 passed. Full package unit tests: ``` make test ``` Result: 10617 passed, 4 skipped, 6 pre-existing failures in `TestLangsmithSecretRedaction` (env-dependent, fail on clean `origin/main`). Lint, format, type check, and commands catalog: ``` make lint ``` Result: All checks passed. A real LangGraph interrupt/resume test (`test_real_agent_resume_forwards_ask_user_receipt_to_classifier`) verifies the full path: `ask_user` interrupt → checkpoint resume → receipt minting with real `execution_info.thread_id` → classifier sees `same_turn_user_answers` → action executes without a second HITL prompt. A compiled-graph identity test (`test_compiled_agent_preserves_canonical_compaction_tool_identity`) verifies the canonical `CLICompactionMiddleware` tool object survives `create_deep_agent`'s middleware merge into the compiled `ToolNode`, and that `AutoModeHITLMiddleware._trusted_compaction_tool` references that same object. The 6 `TestLangsmithSecretRedaction` failures are pre-existing and env-dependent (real LangSmith credentials in the local environment); they fail identically on clean `origin/main` and are unrelated to this change. </details>

github-actions Bot added dcode Related to `deepagents-code` fix A bug fix (PATCH) internal User is a member of the `langchain-ai` GitHub organization open-swe size: XS < 50 LOC labels Jul 22, 2026

Merge branch 'main' into open-swe/goal-compact-auto-allow

556ebe9

Mason Daugherty (mdrxy) marked this pull request as ready for review July 22, 2026 20:34

Merge branch 'main' into open-swe/goal-compact-auto-allow

e259f88

open-swe Bot reviewed Jul 22, 2026

View reviewed changes

This was referenced Jul 23, 2026

fix(code): avoid redundant Auto approval prompts #4993

Merged

fix(code): authorize Auto actions from ask_user selections #4946

Closed

Mason Daugherty (mdrxy) closed this Jul 23, 2026

Navigation Menu

Uh oh!

fix(code): allow `compact_conversation` in Auto mode without HITL - #4947

fix(code): allow `compact_conversation` in Auto mode without HITL#4947
Mason Daugherty (mdrxy) wants to merge 3 commits into
mainfrom
open-swe/goal-compact-auto-allow

Mason Daugherty (mdrxy) commented Jul 22, 2026 •

edited

Loading

Uh oh!

open-swe Bot left a comment

Uh oh!

open-swe Bot Jul 22, 2026

Uh oh!

Mason Daugherty (mdrxy) commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Mason Daugherty (mdrxy) commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

open-swe Bot left a comment

Choose a reason for hiding this comment

Uh oh!

open-swe Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Mason Daugherty (mdrxy) commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Mason Daugherty (mdrxy) commented Jul 22, 2026 •

edited

Loading