fix(code): flag empty env override shadowing LangSmith key in /trace - #4996
Merged
Mason Daugherty (mdrxy) merged 6 commits intoJul 24, 2026
Merged
Conversation
When a LangSmith key is stored via `/auth` (or set canonically) but a present-but-empty `DEEPAGENTS_CODE_LANGSMITH_API_KEY` shadows it, `/trace` reported the generic "not configured, run /auth" message even though a key was stored. Detect that shadow case and name the offending variable so the fix is obvious. Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
github-actions
Bot
added
dcode
Mason Daugherty (mdrxy)
marked this pull request as ready for review
July 23, 2026 15:16
Match each empty prefixed override to the key it actually hides so `/trace` names the variable that restores a real key.
The shadow notice checked only key availability, but /trace's gate needs a key AND a tracing flag, and resolves keys LANGSMITH-before-LANGCHAIN. The message could therefore tell users to unset an override that wouldn't enable tracing, and mislabel an env key as "stored". - Guard the shadow-check call in _handle_trace_command like its sibling: echo the command first, wrap to_thread in try/except so a failing best-effort diagnostic can't crash /trace. - Reword the notice: no promise that tracing turns on (flag caveat), drop the "stored key" wording that's wrong for env-supplied keys. - Only report an override that gates the effective key: early-return when a key already resolves under normal precedence. - Return LangsmithShadowResult distinguishing shadowing_var / store_unreadable / neither; surface a corruption hint instead of the generic one, and log the underlying RuntimeError text. - Attribute stored-key suppression to the skipped /auth bridge in the docstring; harden tests (autouse env clear, remediation assertions, loop-continuation past store errors).
Mason Daugherty (mdrxy)
pushed a commit
that referenced
this pull request
Jul 24, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. The published GitHub release body is extracted from the merged `CHANGELOG.md` by `release.yml`, not from this PR description._ --- ## [0.1.46](deepagents-code==0.1.45...deepagents-code==0.1.46) (2026-07-24) ### Highlights - Auto mode is now generally available. [#4957](#4957) - Added configurable Auto goal-criteria acceptance. [#4940](#4940) - Improved Auto behavior by authorizing actions from active goal/rubric directives, avoiding redundant approval prompts, showing the enable notice only on first global enable, deduplicating classifier-unavailable transcript spam, logging underlying classifier failures, and reporting classifier timeout budgets. [#5017](#5017) [#4993](#4993) [#5012](#5012) [#5013](#5013) [#5011](#5011) [#5025](#5025) - Added Hooks v2 capability snapshots and session transcripts, and hardened Hooks v2 command execution. [#4916](#4916) [#4918](#4918) [#4917](#4917) - Raised the agent recursion limit to 2000 and made it configurable. [#4994](#4994) ### Improvements and fixes - Let the rubric grader inspect working-directory files, show rubric grader defaults, and improved `/rubric` help and empty-state messaging. [#4835](#4835) [#4966](#4966) [#5015](#5015) - Unified goal activation signaling. [#4980](#4980) - Made Version, Model, and CWD copyable in the Debug Console. [#4975](#4975) - Improved `config get` output when a key is missing. [#4976](#4976) - Aborted YOLO launch on `Ctrl+C`/`Ctrl+D` and made the YOLO warning friendlier for new users. [#4953](#4953) [#4950](#4950) - Updated LangSmith handling: secret redaction is disabled by default, `/trace` now flags empty env overrides that shadow the LangSmith key, and the default US endpoint is no longer treated as a custom target. [#4970](#4970) [#4996](#4996) [#5022](#5022) - Injected OpenAI `prompt_cache_key` for any OpenAI-provider endpoint. [#4995](#4995) - Improved tool and schema presentation: finished calls stay on the live tool-group line, first-party tool schemas now include field descriptions, and `web_search`/`fetch_url` tool descriptions were trimmed. [#4927](#4927) [#5019](#5019) [#5016](#5016) - Omitted `plugins/` and `conversation_history/` from the `/agent` picker. [#4991](#4991) - Made selector modal backdrop dimming consistent. [#4990](#4990) - Restored the `"Server log preserved at:"` notice on exit. [#4999](#4999) - Used the SDK pin as the effective editable version. [#4949](#4949) _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
langchain-ai#4996) `/trace` now gives an honest, targeted notice when tracing is off because a present-but-empty `DEEPAGENTS_CODE_LANGSMITH_API_KEY` (or `DEEPAGENTS_CODE_LANGCHAIN_API_KEY`) is shadowing a LangSmith key, instead of sending you to `/auth` as if nothing were configured. --- ### Background Per `resolve_env_var`'s precedence, a present-but-empty prefixed override deliberately shadows the canonical env key, and — because `apply_stored_service_credentials` skips the `/auth` bridge onto `LANGSMITH_API_KEY` when the prefixed var is present — a `/auth`-stored key too. That suppression is intentional and unchanged; the only problem was surfacing: `get_langsmith_project_name` returns `None` in this state and `/trace` collapsed it to the generic "not configured, run `/auth`" hint even though a key is available. ### What this adds `langsmith_key_shadowed_by_empty_override` returns a `LangsmithShadowResult` that distinguishes three states, and `/trace` renders each differently: - **A key is shadowed** → names the offending variable and how to fix it. The notice only fires for an override that gates the *effective* key: if a key already resolves under the normal `LANGSMITH_API_KEY`-before-`LANGCHAIN_API_KEY` precedence, no override is to blame (tracing is off for another reason, e.g. a missing flag) and the generic hint stands. The wording no longer promises tracing will switch on — it points at the flag too — and no longer calls an env-supplied key a "stored" key. - **The credential store is unreadable** (corrupt file) → a corruption-specific hint rather than the generic one, and the underlying error is logged. - **Neither** → the original "run `/auth`" message, unchanged. The shadow check is a best-effort diagnostic, so its call in `_handle_trace_command` is now guarded (command echo first, `try/except` fallback) — it can never crash `/trace`. The env-var precedence semantics are untouched; this is scoped to surfacing. Made by [Open SWE](https://openswe.vercel.app/agents/d32e941a-8cf2-d7a9-c1f7-3e8d1ff111cd) --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. The published GitHub release body is extracted from the merged `CHANGELOG.md` by `release.yml`, not from this PR description._ --- ## [0.1.46](langchain-ai/deepagents@deepagents-code==0.1.45...deepagents-code==0.1.46) (2026-07-24) ### Highlights - Auto mode is now generally available. [langchain-ai#4957](langchain-ai#4957) - Added configurable Auto goal-criteria acceptance. [langchain-ai#4940](langchain-ai#4940) - Improved Auto behavior by authorizing actions from active goal/rubric directives, avoiding redundant approval prompts, showing the enable notice only on first global enable, deduplicating classifier-unavailable transcript spam, logging underlying classifier failures, and reporting classifier timeout budgets. [langchain-ai#5017](langchain-ai#5017) [langchain-ai#4993](langchain-ai#4993) [langchain-ai#5012](langchain-ai#5012) [langchain-ai#5013](langchain-ai#5013) [langchain-ai#5011](langchain-ai#5011) [langchain-ai#5025](langchain-ai#5025) - Added Hooks v2 capability snapshots and session transcripts, and hardened Hooks v2 command execution. [langchain-ai#4916](langchain-ai#4916) [langchain-ai#4918](langchain-ai#4918) [langchain-ai#4917](langchain-ai#4917) - Raised the agent recursion limit to 2000 and made it configurable. [langchain-ai#4994](langchain-ai#4994) ### Improvements and fixes - Let the rubric grader inspect working-directory files, show rubric grader defaults, and improved `/rubric` help and empty-state messaging. [langchain-ai#4835](langchain-ai#4835) [langchain-ai#4966](langchain-ai#4966) [langchain-ai#5015](langchain-ai#5015) - Unified goal activation signaling. [langchain-ai#4980](langchain-ai#4980) - Made Version, Model, and CWD copyable in the Debug Console. [langchain-ai#4975](langchain-ai#4975) - Improved `config get` output when a key is missing. [langchain-ai#4976](langchain-ai#4976) - Aborted YOLO launch on `Ctrl+C`/`Ctrl+D` and made the YOLO warning friendlier for new users. [langchain-ai#4953](langchain-ai#4953) [langchain-ai#4950](langchain-ai#4950) - Updated LangSmith handling: secret redaction is disabled by default, `/trace` now flags empty env overrides that shadow the LangSmith key, and the default US endpoint is no longer treated as a custom target. [langchain-ai#4970](langchain-ai#4970) [langchain-ai#4996](langchain-ai#4996) [langchain-ai#5022](langchain-ai#5022) - Injected OpenAI `prompt_cache_key` for any OpenAI-provider endpoint. [langchain-ai#4995](langchain-ai#4995) - Improved tool and schema presentation: finished calls stay on the live tool-group line, first-party tool schemas now include field descriptions, and `web_search`/`fetch_url` tool descriptions were trimmed. [langchain-ai#4927](langchain-ai#4927) [langchain-ai#5019](langchain-ai#5019) [langchain-ai#5016](langchain-ai#5016) - Omitted `plugins/` and `conversation_history/` from the `/agent` picker. [langchain-ai#4991](langchain-ai#4991) - Made selector modal backdrop dimming consistent. [langchain-ai#4990](langchain-ai#4990) - Restored the `"Server log preserved at:"` notice on exit. [langchain-ai#4999](langchain-ai#4999) - Used the SDK pin as the effective editable version. [langchain-ai#4949](langchain-ai#4949) _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/tracenow gives an honest, targeted notice when tracing is off because a present-but-emptyDEEPAGENTS_CODE_LANGSMITH_API_KEY(orDEEPAGENTS_CODE_LANGCHAIN_API_KEY) is shadowing a LangSmith key, instead of sending you to/authas if nothing were configured.Background
Per
resolve_env_var's precedence, a present-but-empty prefixed override deliberately shadows the canonical env key, and — becauseapply_stored_service_credentialsskips the/authbridge ontoLANGSMITH_API_KEYwhen the prefixed var is present — a/auth-stored key too. That suppression is intentional and unchanged; the only problem was surfacing:get_langsmith_project_namereturnsNonein this state and/tracecollapsed it to the generic "not configured, run/auth" hint even though a key is available.What this adds
langsmith_key_shadowed_by_empty_overridereturns aLangsmithShadowResultthat distinguishes three states, and/tracerenders each differently:LANGSMITH_API_KEY-before-LANGCHAIN_API_KEYprecedence, no override is to blame (tracing is off for another reason, e.g. a missing flag) and the generic hint stands. The wording no longer promises tracing will switch on — it points at the flag too — and no longer calls an env-supplied key a "stored" key./auth" message, unchanged.The shadow check is a best-effort diagnostic, so its call in
_handle_trace_commandis now guarded (command echo first,try/exceptfallback) — it can never crash/trace.The env-var precedence semantics are untouched; this is scoped to surfacing.
Made by Open SWE