fix(code): require AGENTS.md marker for /agent discovery - #5076
Merged
Conversation
Fail-closed agent listing so only dirs with a real AGENTS.md appear in the picker, instead of denylisting app-owned names under ~/.deepagents/.
github-actions
Bot
added
dcode
![open-swe[bot]](https://avatars.githubusercontent.com/in/1395372?s=60&v=4){kind=small}
Belt-and-suspenders: still denylist bin/plugins/conversation_history so dcode -a plugins stamping AGENTS.md cannot surface app state in /agent.
Mason Daugherty (mdrxy)
pushed a commit
that referenced
this pull request
Jul 27, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. Publish reads the merged CHANGELOG via `release.yml`, not this PR description — keep them aligned anyway so the PR stays an accurate historical record for reviewers and anyone returning later._ --- ## [0.1.48](deepagents-code==0.1.47...deepagents-code==0.1.48) (2026-07-27) ### Features - Added Fireworks `kimi-k3`, GLM-5.2-Fast, and Kimi-K3 to model selection and recommended models. ([#5082](#5082), [#5072](#5072)) - Migrated legacy hooks to v2 events. ([#4971](#4971)) ### Bug Fixes - Require an `AGENTS.md` marker for `/agent` discovery, resolving unintended discovery behavior. ([#5076](#5076), closes [#4991](#4991)) - Removed the redundant `/restart` hint from the restart prompt. ([#5083](#5083)) - Removed the caret flash in plugin type-to-search. ([#5078](#5078)) _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
…in-ai#5076) Makes `/agent` listing fail-closed: only `~/.deepagents/<name>/` directories that contain a real `AGENTS.md` file are shown as switchable agents. --- langchain-ai#4991 stopped the leak of `plugins/` and `conversation_history/` by expanding a reserved-name denylist. That still defaulted to "every subdirectory is an agent unless named." Any new app-owned dir under `~/.deepagents/` would leak again unless the denylist was updated. Discovery now requires the agent marker the product already stamps — `AGENTS.md` (created empty on first use when memory is enabled). Bare folders, app state (`bin/`, `plugins/`, `conversation_history/`, `.state/`, and future siblings), directory symlinks, and symlink markers are excluded without maintaining a name denylist. Related langchain-ai#4991
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. Publish reads the merged CHANGELOG via `release.yml`, not this PR description — keep them aligned anyway so the PR stays an accurate historical record for reviewers and anyone returning later._ --- ## [0.1.48](langchain-ai/deepagents@deepagents-code==0.1.47...deepagents-code==0.1.48) (2026-07-27) ### Features - Added Fireworks `kimi-k3`, GLM-5.2-Fast, and Kimi-K3 to model selection and recommended models. ([langchain-ai#5082](langchain-ai#5082), [langchain-ai#5072](langchain-ai#5072)) - Migrated legacy hooks to v2 events. ([langchain-ai#4971](langchain-ai#4971)) ### Bug Fixes - Require an `AGENTS.md` marker for `/agent` discovery, resolving unintended discovery behavior. ([langchain-ai#5076](langchain-ai#5076), closes [langchain-ai#4991](langchain-ai#4991)) - Removed the redundant `/restart` hint from the restart prompt. ([langchain-ai#5083](langchain-ai#5083)) - Removed the caret flash in plugin type-to-search. ([langchain-ai#5078](langchain-ai#5078)) _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes
/agentlisting fail-closed: only~/.deepagents/<name>/directories that contain a realAGENTS.mdfile are shown as switchable agents.#4991 stopped the leak of
plugins/andconversation_history/by expanding a reserved-name denylist. That still defaulted to "every subdirectory is an agent unless named." Any new app-owned dir under~/.deepagents/would leak again unless the denylist was updated.Discovery now requires the agent marker the product already stamps —
AGENTS.md(created empty on first use when memory is enabled). Bare folders, app state (bin/,plugins/,conversation_history/,.state/, and future siblings), directory symlinks, and symlink markers are excluded without maintaining a name denylist.Related #4991