langchain-ai/deepagents deepagents==0.7.0

on GitHub

See the docs for curated release notes.

⚠ BREAKING CHANGES

• create_deep_agent no longer includes TodoListMiddleware by default, the write_todos tool, todos state channel, and todo-planning prompt are now absent. Pass middleware=[TodoListMiddleware()] to restore them on the main agent; add it to each SubAgent's middleware to restore them there. (#4929) (9340518)
• Default agent prompts are now lean: the authored base prompt is empty, and tool-usage prose that duplicates tool schemas is trimmed. BASE_AGENT_PROMPT is deprecated (removal in deepagents==0.9.0) but remains importable and still returns the previous authored prompt verbatim; pass it as create_deep_agent(system_prompt=BASE_AGENT_PROMPT) to restore the old behavior. (#4859) (#4979) (a8d1b32) (d9f54fc)
• The built-in tool-usage prompt constants TASK_SYSTEM_PROMPT, ASYNC_TASK_SYSTEM_PROMPT, SUMMARIZATION_SYSTEM_PROMPT, FILESYSTEM_SYSTEM_PROMPT, and EXECUTION_SYSTEM_PROMPT are removed, and the system_prompt default on SubAgentMiddleware, AsyncSubAgentMiddleware, SummarizationToolMiddleware, and create_summarization_tool_middleware is now None, which injects no prose. Pass your own string to restore prompt text. (#4859) (a8d1b32)
• FilesystemBackend and LocalShellBackend now default to virtual_mode=True. Filesystem paths are anchored under root_dir, .. traversal is rejected, and paths resolving outside root_dir raise ValueError. Previously an unspecified virtual_mode emitted a deprecation warning and fell back to False, where absolute host paths were used as-is and .. could escape root_dir. Pass virtual_mode=False explicitly to restore the old filesystem behavior. (#4541) (540a0fa)
• Agents now see a destructive, recursive delete filesystem tool whenever the backend supports it, and filesystem permissions classify delete as a write operation — so an existing rule allowing writes to a path also authorizes recursively deleting that subtree unless a narrower deny or interrupt rule covers the target. Because recursive deletes affect descendants, deny and interrupt checks use bulk path overlap instead of exact-path matching. To keep the previous behavior, add a deny or interrupt rule, or omit delete from FilesystemMiddleware(tools=...). Missing paths return a not-found error, CompositeBackend reports an unsupported-operation error when a routed sub-backend cannot delete, and the tool is hidden from the model entirely when the backend itself does not implement it. (#3659) (#3691) (#3765) (#3851) (f2a21ec)
• write_file can now create a file if it is missing and replaces it entirely if it already exists, instead of returning a file-exists error. The write_file tool description no longer requires reading the file first. There is no "create-only" compatibility mode. Workflows, prompts, tests, or guardrails that relied on the file-exists error to force edit_file usage or to protect existing content must omit write_file, add explicit permission or interrupt rules, or use edit_file where preserving existing content matters. (#4109) (2506fcc)
• Removed deprecated backend compatibility shims. Callers must pass concrete BackendProtocol instances (not factories), configure StoreBackend with an explicit namespace, and use the current ls / glob / grep / ReadResult APIs. (#4541) (540a0fa)
• The deprecated files_update attribute and constructor keyword are removed from WriteResult and EditResult. Custom backends must stop passing files_update=, and callers must stop reading result.files_update; state writes are emitted directly by StateBackend. (#4541) (540a0fa)
• Removed the deprecated BackendProtocol methods ls_info, als_info, glob_info, aglob_info, grep_raw, and agrep_raw. Use ls / glob / grep and their async counterparts. (#4541) (540a0fa)
• SummarizationMiddleware(history_path_prefix=...) was removed and now raises TypeError. Configure CompositeBackend(artifacts_root=...) instead. (#4541) (540a0fa)
• Agent-facing ls and glob tool output now renders empty results as No files found instead of []; direct backend APIs continue to return structured empty LsResult and GlobResult values. Callers that parse tool output should update those checks. (#3709) (efafd1e)
• read_file no longer renders raw text with a fixed-width cat -n-style line-number gutter and tab separator. Line and continuation markers are dynamically aligned and separated from source content by two spaces, and the LINE_NUMBER_WIDTH constant is removed from deepagents.backends.utils and deepagents.middleware.filesystem. Callers that parse raw tool output should update those parsers. (#4561) (cf057b4)

Features

• Custom middleware passed to create_deep_agent(..., middleware=[...]) can replace a default middleware instance when .name matches, so defaults such as SummarizationMiddleware can be overridden without also excluding the built-in instance. (#4251) (90c8472)
• FilesystemMiddleware(tools=[...]) accepts a keyword-only allowlist of built-in filesystem tools, typed by the newly exported FsToolName literal ("ls", "read_file", "write_file", "edit_file", "delete", "glob", "grep", "execute"); pass "all" or omit the argument to keep every tool. A list must include "read_file" or the constructor raises ValueError. Omitted built-in tools are non-executable, and custom user tools are unaffected. (#4325) (#4698) (704a70d) (9709525)
• Shorten LLM-facing descriptions for the task tool and filesystem tools (read_file, grep, edit_file, glob, execute). (#5009) (761f5f0)
• GrepResult and GlobResult now carry a truncated flag so supporting backends can return valid partial results when a match cap or backend deadline is reached; agent-facing tool output adds a note telling the model to narrow the search. FilesystemBackend returns partial grep and glob results on its backend timeout rather than erroring, while other backend or middleware timeouts may still return errors. Its glob also gains brace expansion such as *.{py,md} (already supported by the state and store backends). (#4063) (ef591e7)
• The agent-facing grep match cap is configurable: FilesystemMiddleware(grep_max_count=...) sets the default (1000; None disables it) and the model can override it per call through the tool's new max_count argument. grep / agrep on BackendProtocol and all built-in backends accept a keyword-only max_count. Local ripgrep output is streamed and terminated once the cap is reached. Direct FilesystemBackend.grep() callers can request surrounding lines with keyword-only context_lines. (#4570) (#4706) (8e86f5e) (65230df)
• Paginated built-in read_file responses report the returned source-line range and next offset; total and remaining line counts are included when the backend knows the file length. Resume offsets remain safe when sandbox or middleware limits shorten the visible page. (#4540) (8321194)
• Optional video frame extraction for read_file, enabled by the new deepagents[video] extra. Video files are sampled into JPEG frames, with offset and limit interpreted as seconds. Without the extra, existing generic video/file content-block behavior remains. (#4094) (b927147)
• FilesystemMiddleware can capture oversized execute tool output directly inside the sandbox artifact path on compatible, opted-in BaseSandbox implementations to reduce round trips; LangSmithSandbox opts in by default. (#4230) (02f5bd7)
• Automatically enable Fireworks prompt-cache session affinity when a compatible langchain-fireworks installation is available. (#4598) (5d878bf)
• Add a built-in NVIDIA Nemotron 3 Ultra harness profile and NVIDIA NIM app-origin attribution. (#4192) (#4455) (d5a60ec) (4cb4749)
• RubricMiddleware now accepts any positive max_iterations cap instead of enforcing a hard upper bound. (#4405) (d6692a7)

Bug Fixes

• Keep fields marked with PrivateStateAttr, including fields declared through create_deep_agent(state_schema=...), out of subagent inputs and returned parent-state updates. (#4587) (a4662c0)
• Preserve ContextT through the create_deep_agent(..., middleware=[...]) type annotation so type checkers accept context-aware middleware when a matching context_schema is passed. (#4055) (7be76c7)
• Accept YAML list values as well as comma-separated strings for skill allowed-tools frontmatter, and make skill truncation warnings actionable with field name, path, length, configured limit, and impact. (#4140) (#4141) (d62534c) (2f5f5b8)
• Align filesystem instructions with the tools that remain after allowlist and backend-capability filtering, so agents no longer reference hidden grep/glob tools or prohibit equivalent shell search when dedicated search tools are unavailable. (#4920) (#4921) (d3650c7) (b65cc00)
• Propagate default-backend failures from CompositeBackend.ls("/") and CompositeBackend.als("/") instead of returning successful route-only listings. (#4925) (4c3b166)
• Correct CompositeBackend.glob / CompositeBackend.aglob routing so explicit default-backend paths such as /tools do not also return files from routed backends such as /memories. (#4531) (cbdb0a7)
• Propagate default- and routed-backend failures from root CompositeBackend.glob(..., path=None) / aglob(..., path=None) and path="/" searches instead of returning incomplete successful results. (#4063) (ef591e7)
• Constrain sandbox glob and slash-pattern grep searches to their declared search root by treating leading / as search-root-relative, rejecting .. traversal segments, and filtering symlink-resolved matches outside the root. (#4588) (c6c7213)
• Unify grep(..., glob=...) include-glob semantics across filesystem and in-memory backends: basename patterns like *.py match at any depth, and slash-containing patterns like src/**/*.py match relative paths consistently. (#3936) (feab6e0)
• Improve agent-facing grep descriptions and no-match hints to steer regex-looking patterns toward literal searches, route slash-containing sandbox include-globs correctly, and shorten default search timeouts so bad patterns and huge trees return guidance faster. (#4168) (b1dbf5e)
• Align sandbox delete behavior with other backends by returning not-found errors for missing paths, and avoid over-blocking unrelated sibling deletes when deny rules use glob patterns. (#4321) (d77496b)
• Improve rubric grader failure diagnostics with configured model, structured-output strategy, and integer HTTP status when available. (#4938) (#4967) (f51d3a0) (bca70aa)
• Emit max_iterations_reached as the terminal RubricMiddleware status when the iteration cap is exhausted, instead of a final needs_revision event that will not loop. (#4406) (a51c8d2)
• Handle missing async subagent URLs consistently in check_async_task and cancel_async_task. (#3967) (b0d92c0)

Performance Improvements

• Run LangSmith sandbox commands over the async client. (#5061) (0d08747)

Thanks to our community contributors: @kavishkartha05 (Twitter, LinkedIn), @nv-kasikritc

Internal maintainers: @nick-hollon-lc, @imnishitha, @hntrl, @srimanthtangedipalli-eng, @ramon-langchain, @jkennedyvz, @ccurme, @davibinboi, @mdrxy

Released by: @mdrxy