feat(code,talon): require Python 3.12 or greater - #5603
Merged
Conversation
Raise the deepagents-code minimum Python from 3.11 to 3.12 and clean up the codebase along the way: - Convert TypeAlias annotations to PEP 695 `type` statements and TypeVar-based generics to type-parameter syntax - Import Protocol/override from typing instead of typing_extensions - Drop the pre-PEP-706 tarfile extraction fallback (3.11.0-3.11.3 only) - Refresh uv.lock, dropping 3.11-only backports (tomli, backports-tarfile) - Update CI matrices, ty target, and ruff target-version to 3.12 deepagents-talon depends on deepagents-code, so its floor moves in the same commit; it cannot bump independently without a broken window. release.yml now builds both packages on 3.12.
Mason Daugherty (mdrxy)
requested a review
from John Kennedy (jkennedyvz)
as a code owner
August 18, 2026 18:11
Mason Daugherty (mdrxy)
added
the
allow-lockfile-release
Contributor
|
ℹ️ Release fan-out acknowledged via the Consequence: release-please will open a separate release PR for every managed component this PR touches, because the title is bump-worthy ( Real-file multi-component hit(s): Remove the label to re-enable the block. Prefer the split recipe if this was unintentional: Split into:
|
github-actions
Bot
added
dcode
Contributor
|
Active bypass label(s): Consequence: release-please will open a separate release PR for every managed component this PR touches, because it scopes commits by changed file path (not by title scope alone). Touched release-please component(s): This PR title is currently bump-worthy ( Confirm intentional, or splitPrefer:
Remove the bypass label(s) to re-enable the blocking checks. 📖 Multi-component fan-out |
![open-swe[bot]](https://avatars.githubusercontent.com/in/1395372?s=60&v=4){kind=small}
Mason Daugherty (mdrxy)
changed the title
…2-floor # Conflicts: # libs/code/pyproject.toml
Mason Daugherty (mdrxy)
changed the title
This was referenced Aug 18, 2026
Mason Daugherty (mdrxy)
pushed a commit
that referenced
this pull request
Aug 19, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. Publish reads the merged CHANGELOG via `release.yml`, not this PR description — keep them aligned anyway so the PR stays an accurate historical record for reviewers and anyone returning later._ --- ## [0.1.58](deepagents-code==0.1.57...deepagents-code==0.1.58) (2026-08-19) ### Breaking Changes - `deepagents-code` now requires Python 3.12 or newer. ([#5603](#5603)) ### Features - Added OpenRouter `z-ai/glm-5.3` to the model switcher. ([#5641](#5641)) - Added support for re-authenticating MCP servers from the viewer. ([#5637](#5637)) - Footer pickers can now be opened with `ctrl+click`. ([#5611](#5611)) - Resume hints now account for `TERM_PROGRAM` support before showing terminal-specific guidance. ([#5580](#5580)) ### Fixes - Completed the `dcode config` command surface. ([#5581](#5581)) - Made `/offload` interruptible. ([#5590](#5590)) - Improved chat and footer UI behavior: rapid typing stays visible, double-click collapses a resized chat input, and the MCP footer wraps on narrow windows. ([#5424](#5424), [#5578](#5578), [#5651](#5651)) - Captured stdio MCP server stderr in the logger. ([#5610](#5610)) - Drained hook pipes after timeout. ([#5606](#5606)) - Grouped resume trace rounds. ([#5593](#5593)) - Omitted web-search prompt guidance when web search is unavailable. ([#5602](#5602)) - Resolved message pointer shapes per cell. ([#5592](#5592)) _End release notes preview._ --- > [!NOTE] > A **community contributors** list and a **Special thanks** section (crediting the users who filed the issues this release's PRs closed) are appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 3). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
Mason Daugherty (mdrxy)
added a commit
that referenced
this pull request
Aug 19, 2026
Related: #5549 Administrators can now enforce dcode settings through OS-managed `managed_config.toml` files. --- Adds fixed-path, read-only managed TOML policy for dcode with managed-first precedence, typed merge/provenance, fail-closed startup enforcement, diagnostics, and shadow-aware user writes. Migrates structured runtime readers while preserving public APIs and explicit custom-path seams. Requires Python 3.12+ (landed in #5603). The path is fixed per platform and never read from process environment variables, so an unprivileged user cannot redirect it: `/Library/Application Support/dcode/managed_config.toml` on macOS, `/etc/dcode/managed_config.toml` on Linux, and `<ProgramData>/dcode/managed_config.toml` on Windows, where ProgramData comes from the registry rather than `%ProgramData%`. ## Enforced keys A managed value the manifest rejects is ignored and the lower-precedence value stays in effect — except for the enforced keys, where ignoring it would grant a privilege or remove a boundary the policy declared. Those stop every command except `config`, `doctor`, `auth path`, and the help screens: `startup.mode`, `startup.yolo_switcher`, `shell.allow_list`, `skills.extra_allowed_dirs`, `interpreter.enable_interpreter`, `interpreter.ptc`, `interpreter.ptc_acknowledge_unsafe`, `models.auto_classifier`, `runtime.recursion_limit`, `sandboxes.default`, `tracing.langsmith_redact` ```console # /Library/Application Support/dcode/managed_config.toml [startup] mode = "manual" yolo_switcher = "false" # quoted boolean; the manifest rejects it $ dcode Error: Managed config at /Library/Application Support/dcode/managed_config.toml rejects startup.yolo_switcher. Ask your administrator to correct the value. $ echo $? 78 ``` Skipping that key would leave YOLO one Shift+Tab away while `mode` was pinned. `dcode doctor` and `dcode config` stay reachable and report both halves of exit 78: a file that cannot be parsed, and one that parses but declares a value that cannot be enforced (`dcode config path` shows `rejected`). > <details> > <summary>Why this is stricter than the PRD</summary> > > The PRD specifies tolerant parsing (Claude Code precedent): an invalid entry is stripped with a warning and the rest of the file is enforced, with fail-closed behavior reserved for security deny-lists. This PR keeps that default for everything else but widens the fail-closed set to the enforced keys above. For those keys, stripping a rejected managed value is not a safe fallback: the effective config falls through to the user tier or the default, which is more permissive than the policy the admin declared (e.g. a malformed `shell.allow_list` would silently leave shell access unrestricted). Failing closed with exit 78 turns a silent privilege grant into a loud, fixable startup error. Cosmetic and non-privilege keys still follow the PRD's strip-with-warning rule. > > </details> ## Behavior changes - `[shell].allow_list` is now read from `~/.deepagents/config.toml` as well as `DEEPAGENTS_CODE_SHELL_ALLOW_LIST`, so a managed file can enforce it. A user can therefore also persist shell auto-approval in their own file, which an exported variable could not do. - A managed `[mcp].enabled_project_server_approvals` that is not an array denies. The key being present means policy intends to narrow access, so treating a malformed value as absent would keep both the user's approvals and the `DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` bypass in force. - Embedders: `resolve_scalar(option, toml_data=...)` loads ambient managed policy when `managed_toml_data` is omitted. Pass `managed_toml_data={}` to keep a call hermetic. <details> <summary>Out of scope (tracked follow-ups)</summary> - P1: `/config` TUI and `config` CLI show which tier each value came from, building on the per-leaf provenance this PR's merge already records - macOS managed-preferences (plist) provider — designed for, not built; would join the managed tier above the file per the PRD's conditional add-on </details> Made by [Open SWE](https://openswe.vercel.app/agents/7a09f758-f8a5-5972-b49d-416291235c33) ## References - Plan: https://openswe.vercel.app/agents/7a09f758-f8a5-5972-b49d-416291235c33/plan --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Mason Daugherty (mdrxy)
pushed a commit
that referenced
this pull request
Aug 24, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. Publish reads the merged CHANGELOG via `release.yml`, not this PR description — keep them aligned anyway so the PR stays an accurate historical record for reviewers and anyone returning later._ --- ## [0.0.4](deepagents-talon==0.0.3...deepagents-talon==0.0.4) (2026-08-24) ### Features - Require Python 3.12 or greater. ([#5603](#5603)) _End release notes preview._ --- > [!NOTE] > A **community contributors** list and a **Special thanks** section (crediting the users who filed the issues this release's PRs closed) are appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 3). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dcodenow requires Python 3.12 or newer (previously 3.11). Users on 3.11 will need to upgrade their interpreter to install or update to this release.The floor bump lets the codebase use 3.12-only syntax and drop 3.11 compatibility shims:
typestatements replaceTypeAliasannotations, and generic functions/classes use type-parameter syntax instead ofTypeVar/Generic[...]Protocol/overrideimport fromtypinginstead oftyping_extensionstarfileextraction fallback (needed only for 3.11.0–3.11.3) is gone; extraction always usesfilter="data"uv.lockre-locks without 3.11-only backports (tomli,backports-tarfile)ty, and rufftarget-versionall move to 3.12; integration test defaults and release builds are updated to matchdeepagents-talondepends ondeepagents-code, so its floor moves in the same commit — it cannot bump independently without a broken window where talon allows an interpreter its dependency rejects. This is the deliberate coordinated multi-package bump called out in RELEASING.md, so theallow-lockfile-releaselabel is applied to acknowledge the talon release-please fan-out.Test plan
ruff check/ruff format --checkcleanty checkcleanlibs/codeunit suite passes (two pre-existing failures intest_app.py/test_server_graph.pyreproduce on the base commit and are unrelated)