fix(code): clarify project hooks trust prompt and stop prompting for user hooks - #5426
Merged
Mason Daugherty (mdrxy) merged 8 commits intoAug 11, 2026
Merged
Conversation
…roject root The prompt asked to "Always allow hooks in this workspace" without ever saying what a workspace is. It now names the exact directory being trusted, warns that hooks run arbitrary shell commands and that future edits are covered, and offers "Always allow hooks in this repo". Also stop prompting when the launch directory has no git root. The user_cwd fallback treated any such directory (e.g. ~) as a project root, so the user hooks file at ~/.deepagents/hooks.json was presented as project-scoped — and "Allow once" there would execute user hooks under the project label.
github-actions
Bot
added
dcode
![open-swe[bot]](https://avatars.githubusercontent.com/in/1395372?s=60&v=4){kind=small}
Rich markup in filesystem paths (e.g. a repo named [repo]) was being consumed by Console.print, so the prompt did not reliably show the exact directory being trusted. Escape config_path and project_root with rich.markup.escape.
The prompt fires for any workspace, not just Git repositories, so "repo" named a precondition the gate does not require. Use "project", matching the "Project hooks" framing the prompt already leads with. Mirror the wording into the in-session cwd-switch prompt, which presents the same decision and still carried the older copy. Cover the path escaping: Rich consumes `[bold]` as a style tag, so an unescaped project path renders with the segment silently dropped in the prompt the trust decision rests on.
Mason Daugherty (mdrxy)
changed the title
Allow once installs a content-bound session grant: `with_session_grant` fingerprints hooks.json, and `allows` re-reads the file, so an edit invalidates the grant and the edited hooks stop running. Only the persisted store is keyed by root alone, so only always allow carries across edits and later sessions. The warning sat above both choices and claimed future edits were covered either way, overstating what allow once grants at the moment the user picks between them.
Mason Daugherty (mdrxy)
pushed a commit
that referenced
this pull request
Aug 12, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. Publish reads the merged CHANGELOG via `release.yml`, not this PR description — keep them aligned anyway so the PR stays an accurate historical record for reviewers and anyone returning later._ --- ## [0.1.55](deepagents-code==0.1.54...deepagents-code==0.1.55) (2026-08-12) ### Features - Added a `/context` usage report for inspecting context consumption ([#5407](#5407)). - Added a cache and context status row for at-a-glance session state ([#5408](#5408)). - Added configurable warnings when a session exceeds the configured cost threshold ([#5405](#5405)). - Added support for persisting and reconfiguring ACP sessions ([#5366](#5366)). - Added automatic updates for installed plugins ([#5368](#5368)). - Added a toggle for diff line numbers ([#5427](#5427)). - `Ctrl+S` in `/auto model` now stores `[models].auto_classifier` ([#5313](#5313)). ### Fixes - Restored edit diffs in resumed threads ([#5391](#5391)). - Added a resume hint after crashes ([#5412](#5412)). - Clarified the project hooks trust prompt and stopped prompting for user hooks ([#5426](#5426)). - Cleared dynamic subagents on the next turn ([#5437](#5437)). - Improved grouped tool summaries by counting distinct targets ([#5409](#5409)). - Improved ask-user choice wrapping and selection styling ([#5442](#5442)). - Serialized `dcode` self-upgrades across processes ([#5252](#5252)). - Added warnings for stale dependencies in editable installs ([#5386](#5386)). - Hid incomplete extras from version output ([#5352](#5352)). - Removed the optional-provider startup tip ([#5421](#5421)). - Removed the “Message restored to input” toast ([#5253](#5253)). _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The project hooks trust prompt now states what is actually being trusted, and no longer offers the user's own hooks file as if a project had shipped it.
Prompt copy
The old copy said hooks "can execute commands from " and named neither the scope nor the directory the grant attaches to. The distinction matters: allow once fingerprints
hooks.json(edits invalidate the grant); only always allow survives edits and later sessions.HookTrustScreen(shown on cwd switch) carries the same wording.User hooks are no longer promptable as project hooks
Launching from
~with no enclosing Git repo made the project hooks path identical to the user hooks path (~/.deepagents/hooks.json), so the prompt asked the user to grant project trust to their own config — and granting it subjected that file to the project-hook gate. The trust check now returns an ungranted policy when the two paths coincide.Non-Git workspaces otherwise keep working: the hooks loader resolves a non-repo directory as its own project root, so gating on a Git root would have silently stopped loading hooks that still get read.
Path escaping
Prompt paths are interpolated into Rich markup; a directory named
proj[bold]xwould render asprojx. Paths are now escaped.