Desktop 1.4.1 · DeepAgent Core V4.1
+Desktop 1.4.2 · DeepAgent Core V4.0.4
--- @@ -91,22 +91,25 @@ For high-risk decisions, convene an **Expert Panel**. Correctness, security, per Project IM brings people and agents into the same thread. Mention an agent to start a scoped run with project context, stream its progress, inspect its artifacts, and keep the answer attached to the conversation that requested it. -## DeepAgent Core V4.1 +## DeepAgent Core V4.0.4 -V4.1 brings the complete DeepAgent control plane together: +V4.0.4 closes production contract gaps while keeping the current turn engine stable: -- **Durable Session V2:** prompt admission is persisted before execution; exact retries do not duplicate user intent; same-session wakes coalesce safely. -- **One provider-turn contract:** native and AI SDK providers share the same budget, permission, artifact, audit, learning, and close lifecycle. -- **Single durable truth:** DocumentStore owns documents, plans, learning candidates, governance state, and version conflicts through atomic, recoverable writes. -- **Event-driven Agent OS:** durable events, priority routing, backpressure, worker claims, leases, handoffs, retries, dead-letter recovery, and distributed placement coordinate autonomous work. -- **Consumer-driven goals:** `goal.tick.requested` claims and executes one idempotent tick, records facts, and schedules the next tick only when the durable goal remains eligible. -- **Human oversight:** approval queues, trace correlation, takeover, rollback, Wiki archives, notifications, and organization/workspace isolation remain part of the execution path. -- **Secure integrations:** MCP credentials use environment references or native OS secret storage; catalog risk, runtime permissions, trusted sources, and tool capability checks fail closed. +- **Single durable truth:** DocumentStore uses atomic, recoverable writes for documents, plans, learning candidates, governance state, and version conflicts. +- **Isolated subagents:** write-capable subagents use dedicated worktrees by default and return their changes to the parent workspace through a bounded, conflict-aware path. +- **Reliable event delivery:** the Event Bus has a transport seam, durable consumer offsets, offline catch-up, real priority ordering, and observable queue depth. +- **Governed learning and goals:** knowledge promotion is tied to review evidence and ship-gate snapshots; event-driven goal ticks remain idempotent and respect quiet hours. +- **Secure integrations:** MCP credentials use environment references or native OS secret storage on macOS, Linux, and Windows; capability and source checks fail closed. +- **Publishing truth:** installation, CLI examples, release metadata, public domains, and supported-version documentation match the product that is actually shipped. ## Installation +> **Note:** The `deepagent-code` npm package is not yet publicly published. +> Install via the desktop app or the install script below. + ```bash -npm install -g deepagent-code +# Install script (macOS / Linux) +curl -fsSL https://deepagent.ltd/install | bash ``` Then run: @@ -183,7 +186,7 @@ reference (base URL overrides, headers, per-model config, gateways). Start the agent and give it a task: ```bash -deepagent-code "add rate limiting to /api/users endpoint" +deepagent-code run "add rate limiting to /api/users endpoint" ``` The agent will: diff --git a/README.zh.md b/README.zh.md index 15a1714d..e6dde70a 100644 --- a/README.zh.md +++ b/README.zh.md @@ -14,7 +14,7 @@ Enterprise 版本 -桌面版 1.4.1 · DeepAgent Core V4.1
+桌面版 1.4.2 · DeepAgent Core V4.0.4
--- @@ -91,22 +91,25 @@ DeepAgent 可以把独立工作拆分给数量有界、相互隔离的 Worker。 项目 IM 把团队成员和智能体放进同一条讨论。@ 某个智能体即可启动有明确作用域的运行，使用项目上下文、流式展示进度、关联执行工件，并把答案留在发起任务的对话里。 -## DeepAgent Core V4.1 +## DeepAgent Core V4.0.4 -V4.1 把完整的 DeepAgent 控制平面汇聚在一起： +V4.0.4 在保持当前 turn 引擎稳定的前提下，关闭生产合同缺口： -- **持久 Session V2：** prompt 先持久准入、再调度执行；精确重试不会复制用户意图；同一 Session 的唤醒会安全合并。 -- **统一供应商轮次合同：** native 与 AI SDK provider 共享预算、权限、工件、审计、学习和关闭生命周期。 - **单一持久真相：** DocumentStore 通过原子、可恢复写入统一管理文档、计划、学习候选、治理状态和版本冲突。 -- **事件驱动 Agent OS：** 持久事件、优先级路由、回压、Worker claim、租约、handoff、重试、死信恢复与分布式 placement 协调自主工作。 -- **消费者驱动 Goal：** `goal.tick.requested` 每次认领并执行一个幂等 tick，记录事实，并只在持久目标仍满足条件时调度下一 tick。 -- **人类监督：** 审批队列、全链路 trace、接管、回滚、Wiki 档案、通知，以及组织和 workspace 隔离始终位于执行路径上。 -- **安全集成：** MCP 凭据使用环境变量引用或原生操作系统 secret storage；目录风险、运行时权限、可信来源和工具 capability 逐层失败关闭。 +- **隔离子智能体：** 具备写权限的子智能体默认使用独立 worktree，并通过有界、可感知冲突的路径把改动回传到父工作区。 +- **可靠事件投递：** Event Bus 提供可替换 transport、持久 consumer offset、离线补投、真实优先级排序和可观测队列深度。 +- **受治理的学习与目标：** 知识晋升关联审阅证据与 ship-gate snapshot；事件驱动 goal tick 保持幂等并遵守 quiet hours。 +- **安全集成：** MCP 凭据使用环境变量引用或 macOS、Linux、Windows 原生 secret storage；capability 与来源检查逐层失败关闭。 +- **发布真实性：** 安装方式、CLI 示例、发布元数据、公开域名和支持版本文档与实际交付产品一致。 ## 安装 +> **说明：** `deepagent-code` npm 包尚未公开发布。 +> 请通过桌面应用或下面的安装脚本安装。 + ```bash -npm install -g deepagent-code +# 安装脚本（macOS / Linux） +curl -fsSL https://deepagent.ltd/install | bash ``` 然后运行： @@ -178,7 +181,7 @@ deepagent auth list 启动智能体并交给它一个任务： ```bash -deepagent-code "为 /api/users 端点添加限流" +deepagent-code run "为 /api/users 端点添加限流" ``` 智能体将会： diff --git a/SECURITY.md b/SECURITY.md index dc4bf2ae..ee97178b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,7 +8,7 @@ Do not include live secrets in reports. Use redacted examples or synthetic crede ## Supported versions -Before the first public stable tag, the supported line is the current `main` branch and the latest published pre-release. Security fixes may be released as patch versions. +The active development line is the `dev` branch. The supported release is the latest published version on the `core-v4.0-beta` branch and the desktop app release derived from it. Security fixes are applied to the active line and backported to the latest release where feasible. ## Source availability @@ -20,13 +20,13 @@ Preset MCP servers are opt-in. The preset catalog records intended risk tiers, b Read-only database presets are intended to use restricted server modes and SQL guardrails. Guardrails are defense in depth, not a substitute for least-privilege database users. -## Known limitation: preset MCP credentials in V3.4.1 +## MCP credential security (V4.0+) -When enabling preset MCP servers that require credentials, credential values may currently be persisted in local configuration. Until V3.5 M-CRED lands: +As of V4.0, MCP server credentials are stored in OS-backed secret storage where available (macOS Keychain; Linux and Windows fall back to a 0600 file). Credential values are not persisted in plain-text configuration. Only variable names or references travel through config files; values are resolved at runtime. + +If you are running a version older than V4.0: - Do not commit DeepAgent Code configuration files containing secrets. - Prefer environment-variable indirection where a server supports it. - Use least-privilege tokens and database users. - Rotate credentials if they were accidentally committed or shared. - -The planned V3.5 M-CRED work stores secrets in OS-backed secret storage where available (macOS Keychain, Windows Credential Manager, Linux Secret Service), passes only variable names or references through configuration, and resolves values at runtime. diff --git a/bun.lock b/bun.lock index 82ed0bd7..ed42c9ff 100644 --- a/bun.lock +++ b/bun.lock @@ -29,7 +29,7 @@ }, "packages/app": { "name": "@deepagent-code/app", - "version": "1.4.0", + "version": "1.0.0-beta", "dependencies": { "@codemirror/autocomplete": "6", "@codemirror/commands": "6", @@ -109,15 +109,20 @@ "lildax": "./bin/lildax.cjs", }, "dependencies": { + "@agentclientprotocol/sdk": "^0.21.0", "@deepagent-code/core": "workspace:*", "@deepagent-code/sdk": "workspace:*", "@deepagent-code/server": "workspace:*", "@deepagent-code/tui": "workspace:*", "@effect/platform-node": "catalog:", "@opentui/core": "catalog:", + "@opentui/keymap": "catalog:", "@opentui/solid": "catalog:", "@parcel/watcher": "2.5.1", + "deepagent-code": "workspace:*", + "drizzle-orm": "catalog:", "effect": "catalog:", + "jsonc-parser": "^3.3.1", "solid-js": "catalog:", }, "devDependencies": { @@ -344,7 +349,7 @@ }, "packages/desktop": { "name": "@deepagent-code/desktop", - "version": "1.4.0", + "version": "1.4.2", "dependencies": { "@zip.js/zip.js": "2.7.62", "effect": "catalog:", diff --git a/design/README.md b/design/README.md index bd41fcfb..f2239621 100644 --- a/design/README.md +++ b/design/README.md @@ -1,266 +1,123 @@ -# DeepAgent Code Architecture & Design +# DeepAgent Code — Architecture & Design -> Public architecture baseline for DeepAgent Core V4.1. +> **Public design overview for DeepAgent Core V4.0.4 / Desktop 1.4.2.** Internal implementation details and roadmap documents live in the private `docs/` tree and are intentionally not version-controlled. -DeepAgent Code is a document-centered, event-driven AI coding system. It combines a coding-agent runtime with a durable control plane that owns context, planning, learning, collaboration, safety, and human oversight. +--- -The architecture is designed around one requirement: a long-running agent must remain correct and governable after many model turns, tool calls, user interventions, process restarts, and worker handoffs. +## What is DeepAgent Code? -## Design Principles +DeepAgent Code is an AI coding agent that adds a **control plane** on top of the [opencode](https://github.com/sst/opencode) runtime. It keeps the proven opencode foundations (runtime, tool, MCP, session, provider stack) and layers in: -### One durable truth per concept +- **Durable document and project memory** — atomic, recoverable storage with retrieval gates, provenance, governance, and conflict detection +- **Connected context** — selective, evidence-backed assembly across code, knowledge, project memory, and execution documents +- **Plans and long-running goals** — structured plans, stale-state detection, validation evidence, bounded retries, and human control +- **Event-driven coordination** — durable delivery, priority routing, offline catch-up, idempotent goal ticks, and observable queue state +- **Isolated agent collaboration** — bounded subagents, worktree isolation for write-capable workers, and conflict-aware change return +- **AI IDE microservice** — LSP-backed semantic code navigation via `code_intel` +- **Secure MCP catalog** — curated integrations, derived safety tiers, environment references, and native OS secret storage -Sessions, inputs, plans, documents, goals, events, approvals, and learning decisions each have one authoritative durable representation. In-memory state is a cache or an ownership hint, never a competing source of truth. +--- -### Admission is separate from execution +## Architectural Principles -A user instruction is durably admitted before execution is scheduled. A successful API response therefore means the instruction is recorded, not merely present in a process-local queue. +### 1. Enhance, don't replace -### One provider-turn contract +DeepAgent is built **on top of** the opencode agent/runtime/session/tool/MCP stack. V4.0.4 strengthens the control plane without replacing the current turn engine, tool system, or provider layer. -Native and AI SDK providers pass through the same model-turn boundary. Budget, permissions, tool policy, prompt assembly, artifacts, audit, learning, and close semantics cannot be bypassed by selecting another provider implementation. +### 2. One durable authority per concern -### Context is selected, not accumulated +Documents, plans, event delivery state, knowledge promotion, and goal progress each have one authoritative durable store. In-memory state may accelerate delivery, but it cannot become a second source of truth. -The model receives a bounded working set assembled from explicit Context Sources. Full tool output and durable history remain referenceable artifacts; only admitted summaries, evidence, and snippets enter the active context. +### 3. Full tool output does not enter context -### Safety fails closed +Per the deterministic task control contract: raw LSP results, diagnostic dumps, and capability indexes are written to **evidence artifacts** (ref-linked, tool-only visibility). Only summaries and `file:line` snippets appear in the model context. -External events, credentials, tools, paths, autonomy, worker placement, and outbound messages are checked at their execution boundaries. Missing identity, trust, capability, or approval never widens access. +### 4. Fail-closed on safety -### Humans can always intervene +MCP catalog entries default to **not connected** (zero startup overhead). Dangerous write operations (force-push, DROP, file delete) require explicit approval. Read-only DB connections enforce restricted-mode at the server level. -Steering, plan editing, approval, pause, resume, takeover, rollback, and review are part of the runtime contract. They are not dashboard-only controls layered over an autonomous black box. +### 5. Keep execution boundaries explicit -## System Map +Write-capable subagents run in isolated worktrees by default. Event consumers claim durable work with idempotency and retry boundaries. Users retain explicit paths to approve, steer, pause, resume, take over, or roll back long-running work. -```text -┌─────────────────────────────────────────────────────────────────────┐ -│ Experience │ -│ Desktop · Web · TUI · IM · Repo & Wiki · Expert Panel · Oversight │ -└──────────────────────────────┬──────────────────────────────────────┘ - │ -┌──────────────────────────────▼──────────────────────────────────────┐ -│ Durable Session Runtime │ -│ Session V2 · System Context · Context Epoch · Steering · Queue │ -│ Prompt cache policy · Provider-turn lifecycle · Tool materialization│ -└──────────────────────────────┬──────────────────────────────────────┘ - │ -┌──────────────────────────────▼──────────────────────────────────────┐ -│ DeepAgent Control Plane │ -│ PlanController · GoalController · Context Graph · Learning │ -│ Event Router · Scheduler · Worker Pool · Handoff · Security gates │ -└──────────────────────────────┬──────────────────────────────────────┘ - │ -┌──────────────────────────────▼──────────────────────────────────────┐ -│ Durable State │ -│ DocumentStore · Session/Event database · Event Bus · Audit/Artifacts│ -└──────────────────────────────┬──────────────────────────────────────┘ - │ -┌──────────────────────────────▼──────────────────────────────────────┐ -│ Execution Services │ -│ Provider · Tool · LSP · MCP · Git/Worktree · Debug · Profile │ -└─────────────────────────────────────────────────────────────────────┘ -``` - -## Session V2 - -Session V2 separates durable prompt admission from model execution. - -### Prompt admission - -- Each prompt creates one durable `session_input` before scheduling work. -- Reusing a Session ID adopts that Session rather than creating a parallel execution entity. -- Reusing a prompt message ID is accepted only for an exact retry with the same Session, content, and delivery mode. -- Conflicting ID reuse fails instead of silently reconciling different user intent. -- A prompt can be admitted without waking execution when the caller requests admit-only behavior. - -### Delivery vocabulary - -| Delivery | Meaning | -|---|---| -| normal turn | Start a normal activity when the Session is idle | -| `steer` | Add guidance to the active activity at the next safe provider-turn boundary | -| `goal_steer` | Add guidance to the next Goal tick | -| `queue` | Open a future FIFO activity after the active activity settles | -| interrupt | Target the active process-local ownership chain immediately | - -Steering never aborts an in-flight tool or stream. The input is persisted first, absorbed in stable order, and materialized into history exactly once. - -### Execution ownership - -`SessionExecution` is process-global and keyed by Session ID. A drain discovers placement from durable Session location only when it starts. SessionRunner, model resolution, tools, permissions, and filesystem services remain Location-scoped. - -Same-Session resumes join one coordinator; advisory wakes coalesce; different Sessions can run concurrently. Every provider turn performs one explicit `llm.stream(request)` call and reloads projected history before durable continuation. - -### Prompt cache invariant - -The system prompt is split into a byte-stable prefix and one append-only volatile tail: - -- Agent instructions, stable policy, and System Context baseline stay in the prefix. -- Round state, budgets, plan snapshots, prior results, fan-out decisions, and steering stay in the tail. -- OpenAI-compatible providers use a stable Session cache key; providers with cache markers use their protocol-native breakpoint. -- Prefix hash and cache outcomes distinguish normal compaction misses from accidental prefix drift. - -## Document System - -DocumentStore is the durable body for DeepAgent state. Documents carry: - -- a stable ID and monotonic version; -- type, scope, status, domain, tags, and description; -- provenance and evidence references; -- confidence, sensitivity, and approval risk; -- typed links such as `supports`, `blocks`, `conflicts`, `validates`, `supersedes`, `contains`, `imports`, and `calls`. - -Writes use atomic replacement and conflict detection. Concurrent handles observe one authority, process-level writers coordinate through lock/CAS semantics, and migrations are incremental, restartable, and integrity-checked. - -### Scope - -| Scope | Purpose | -|---|---| -| `session-private` | Current conversation and run-local state | -| `project-shared` | Knowledge and decisions shared by one project | -| `user-global` | Cross-project preferences and explicitly promoted knowledge | -| `public-system` | Built-in skills and domain-pack documents | -| `sealed` | Audit/evaluator material that cannot enter model context | - -Plans, run context, worklogs, designs, diagnoses, evaluations, knowledge, memory, strategies, methodologies, skills, and failure dossiers share this document algebra instead of maintaining separate storage models. - -## System Context and the Four Graphs - -The Context System connects four projections over the same durable knowledge surface: - -1. **Code:** files, symbols, imports, calls, definitions, references, diagnostics. -2. **Knowledge:** facts, strategies, methodologies, skills, and failure dossiers. -3. **Memory:** decisions, constraints, project conventions, environment facts, and handoffs. -4. **Documents:** plans, designs, run context, evidence, worklogs, and evaluations. - -Context Sources produce typed observations from their domains. Session-owned selection applies budget, relevance, scope, sensitivity, evidence strength, conflict, and snapshot rules. A Context Epoch records the selected baseline so a provider turn is reproducible and observable. - -The Event Router can attach a context strategy to an event. SessionRunner executes that strategy in the target Location, records query and admission decisions in trace, and degrades safely when an optional source is unavailable. - -Compaction preserves a stable structure: goal, constraints, completed and active work, blockers, decisions, next steps, critical facts/open questions, and relevant files. Durable references remain outside the prose summary and can be reloaded when needed. - -## Planning and Goal Execution +--- -### Plan authority +## Component Map -A structural plan is a versioned DocumentStore document. Session hot state keeps only its plan pointer/version and stale latch. The model plan tool, human plan editor, Goal worker, UI, Grader, and archive all read and update the same plan through version-aware writes. - -The runtime derives plan staleness from facts it already observes: - -- the user adds new guidance; -- a tool or execution step fails; -- validation fails; -- repeated work makes no progress; -- the active domain-pack snapshot changes. - -Read and diagnosis tools remain available while stale. Mutating tools require the plan to be synchronized, with bounded anti-deadlock behavior. - -### Goal Loop - -A Goal has objective completion criteria, a plan, a durable run context, a budget ledger, and a bounded controller. Each tick: - -1. claims the expected durable Goal/plan version; -2. applies pending user plan edits and steering; -3. executes one coherent step; -4. records tools, tokens, cost, time, evidence, and progress; -5. evaluates objective criteria and stall state; -6. emits facts and schedules the next tick only when eligible. - -`goal.tick.requested` is a durable command, not a post-hoc trace marker. Duplicate delivery cannot repeat provider or tool side effects. Pause, stop, takeover, hard limits, quiet hours, needs-human, and terminal state all stop self-continuation. - -Hot plan edits preserve reusable step IDs and completed evidence, increment the plan version, and reset progress/stall baselines without interrupting the in-flight tick. - -## Event-Driven Agent Runtime - -The Event Bus provides persist-before-dispatch delivery, idempotency, priority, retry, acknowledgement, dead-letter handling, retention, replay, and correlation. Local deployments use the embedded backend; distributed deployments use Redis Streams or Kafka through the same backend contract. - -The Router combines event type, trusted source, actor identity, Agent trigger/capability metadata, autonomy ceiling, approval intent, context strategy, deduplication, priority, and workspace backpressure into one traceable route decision. - -The Worker Pool owns bounded concurrency, placement, claims, leases, renewal, recovery, and handoff. Independent DAG nodes run concurrently; dependency edges remain ordered. File and symbol claims are shared across Workers so conflicting writes cannot run together. - -Write-capable Agents use isolated worktrees by default. Parent Agents receive bounded summaries, status, artifact/session references, and necessary diffs; complete child transcripts remain in their own Sessions. - -## Human Collaboration and Oversight - -### Repo & Wiki - -Repo & Wiki is a human-facing projection, never a second source of truth. It exposes document and code navigation, full-text search, docs-to-code links, knowledge governance, and execution archives. Organization and workspace identity are enforced on query, index, archive, and promotion paths. - -### Expert Panel - -Panelists receive the same frozen question and evidence under differentiated lenses. Anonymous multi-round debate avoids identity anchoring. A deterministic Arbiter applies quorum, preserves minority opinions, and routes unsafe ambiguity to the Approval Queue. Distributed panelists run through the Worker Pool. - -### IM and proactive delivery - -Project IM supports groups, direct conversations, threads, search, attachments, agent mentions, progress streaming, and permission revalidation when project bindings change. Event-driven notifications and digests pass through content safety, path ACL, external-link, rate, and quiet-hours policies before delivery. - -### Oversight - -Correlation IDs connect event, route, context, worker claim, Session, provider turn, tool, artifact, approval, and outbound action. Operators can inspect Approval Queue items, dead letters, budgets, conflicts, takeovers, rollbacks, and final delivery without reconstructing state from logs. - -## Learning and Knowledge Governance - -Learning runs outside the interactive turn on idle, pause, project switch, and Session finalization triggers. Candidates enter the same DocumentStore lifecycle used by human governance. - -- Low-risk project candidates can pass deterministic auto-review. -- Medium-risk/global candidates use an isolated blank-thread reviewer with no Session history. -- Sensitive, strategic, regulated, or irreversible candidates require human review. -- Rejection status, reason, and fingerprint remain authoritative in DocumentStore; auxiliary indexes are rebuildable projections. -- Promotion changes the same document's status/version instead of copying it into a second identity. -- Released retrieval sets name a snapshot and carry evaluation matrix, baseline, repeats, and ablation verdict. +``` +┌─────────────────────────────────────────────────────────────┐ +│ DeepAgent Control Plane │ +│ │ +│ DocumentStore ─ Plan/Goal ─ Knowledge Governance │ +│ │ │ │ │ +│ Context Graph ─ Event Bus ─ Oversight and Audit │ +│ │ │ │ │ +│ ┌────▼──────────────▼────────────────▼──────────────────┐ │ +│ │ Agent Gateway: budget · permission · evidence · policy│ │ +│ └────┬───────────────────────────────────────────────────┘ │ +└───────│─────────────────────────────────────────────────────┘ + │ +┌───────▼────────────────────────────────────────────────────┐ +│ opencode Foundation │ +│ Session · Provider · Tool Registry · LSP · MCP │ +└────────────────────────────────────────────────────────────┘ + │ +┌───────▼────────────────────────────────────────────────────┐ +│ Execution Boundaries │ +│ isolated subagents · worktrees · event consumers · tools │ +└────────────────────────────────────────────────────────────┘ +``` -A failed release gate restores the previous knowledge snapshot. Selected and rejected refs remain reproducible in run artifacts. +--- -## Code Intelligence +## code_intel — AI IDE Microservice -The AI IDE surface combines: +The `code_intel` tool wraps the LSP stack as a **symbol-driven semantic API**. The agent specifies a symbol name and an intent; `code_intel` resolves line/column coordinates internally and returns `file:line` + code snippets. -- semantic symbol lookup and intent-oriented `code_intel` queries; -- definitions, references, calls, imports, type hierarchy, diagnostics, and rename preview; -- unsaved-buffer `textDocument/didOpen`, `didChange`, `didSave`, and `didClose` synchronization; -- incremental code indexing with exact mtime I/O hints and content-SHA correctness authority; -- deterministic fallback to repository search/read when a language server is unavailable. +```typescript +code_intel({ symbol: "AgentGateway.open", intent: "overview" }) +// → definition + type + references + callers + callees + doc summary +// full detail → evidence artifact (ref only in context) +``` -Full LSP output stays in evidence artifacts. The model receives bounded summaries and precise source references. +Supported intents: `definition · references · implementations · type · calls_in · calls_out · supertypes · subtypes · type_hints · hover · rename_preview · quick_fix · outline · diagnostics · overview` -## MCP and Credential Security +Graceful degradation: if no LSP server is configured for the file type, returns a hint to use `grep/read`. Capability only grows, never drops. -MCP servers can be added from the curated catalog or configured manually through Desktop, HTTP, or CLI. Catalog risk tiers are derived from trusted templates rather than mutable user configuration. Servers default to disconnected; writes, external fetches, and privileged actions pass through runtime permission gates. +--- -Credentials use indirection rather than plaintext project configuration: +## MCP Catalog — Safety Model -- `${VAR}` and `${VAR:-default}` resolve at connection time; -- `secret://` handles resolve through macOS Keychain, Linux Secret Service, or Windows Credential Manager/DPAPI; -- environments without a native keyring require explicit approval for an audited local fallback outside the project repository; -- logs, artifacts, outbound messages, and config views redact resolved values. +Each catalog entry carries a **risk tier** derived at load time from the catalog template. The tier is **not user-writable** — it is computed from the entry definition, preventing config-injection attacks. -## Security Boundaries +| Tier | Examples | Default behavior | +|------|----------|-----------------| +| `read_only` | postgres-readonly | All ops auto-allowed | +| `write_guarded` | filesystem, github, git | Write ops require explicit approval | +| `external_fetch` | fetch, browser (Playwright) | External requests require explicit approval | -Autonomous execution passes four independent gates: +**Credentials** are declared by key name in the catalog template (`CredentialSpec`). Configuration stores environment references or `secret://` handles instead of plaintext values. Handles resolve at connection time through macOS Keychain, Linux Secret Service (`libsecret`), or Windows DPAPI-backed credential storage. -1. the event source is trusted for the workspace; -2. the actor has permission for the project and resource; -3. the Agent descriptor permits the trigger, capability, and autonomy level; -4. the runtime permits the concrete tool, path, network target, and side effect. +--- -Additional controls include durable budgets, rate limits, quiet hours, secret/path/link filtering, worktree isolation, hardened read-only Git, human approval, takeover, rollback, and complete audit correlation. +## Security Model Summary -## Repository Map +| Mechanism | Status | +|-----------|--------| +| MCP risk tier — catalog-derived, not config-injectable | Available | +| MCP catalog defaults to not connected | Available | +| Dangerous writes: approval gate (`ctx.ask`) | Available | +| Read-only DB: restricted mode enforced at server | Available | +| Credential indirection (`${VAR}` / `secret://`) | Available | +| Native secret storage (macOS / Linux / Windows) | Available in V4.0.4 | +| Subagent write isolation and conflict-aware return | Available in V4.0.4 | -| Area | Path | -|---|---| -| Core Session, documents, context, event, and policy algebra | `packages/core/src/` | -| CLI/server runtime, tools, Goal and event wiring | `packages/deepagent-code/src/` | -| Desktop/Web application UI | `packages/app/src/` | -| Electron host and isolated browser views | `packages/desktop/src/` | -| Provider abstraction | `packages/llm/` | -| Domain knowledge packs | `packages/domain-packs/` | -| Generated JavaScript SDK | `packages/sdk/js/` | +--- -## License and Source +## License -DeepAgent Code is licensed under **AGPL-3.0-or-later**. The canonical repository is [github.com/deepagent-ltd/deepagent-code](https://github.com/deepagent-ltd/deepagent-code). +DeepAgent Code is licensed under **AGPL-3.0-or-later**. +Source code: [github.com/deepagent-ltd/deepagent-code](https://github.com/deepagent-ltd/deepagent-code) -The project is derived from [opencode](https://github.com/sst/opencode) under the MIT License. Upstream attribution is preserved in [NOTICE](../NOTICE). +DeepAgent Code is derived from [opencode](https://github.com/sst/opencode) (MIT). +See `NOTICE` in the repository root for the full upstream attribution. diff --git a/github/README.md b/github/README.md index 86f4d99f..9d75e57b 100644 --- a/github/README.md +++ b/github/README.md @@ -88,7 +88,7 @@ This will walk you through installing the GitHub app, creating the workflow, and persist-credentials: false - name: Run deepagent-code - uses: lessweb/deepagent-code/github@latest + uses: deepagent-ltd/deepagent-code/github@latest env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -101,7 +101,7 @@ This will walk you through installing the GitHub app, creating the workflow, and ## Support -This is an early release. If you encounter issues or have feedback, please create an issue at https://github.com/lessweb/deepagent-code/issues. +This is an early release. If you encounter issues or have feedback, please create an issue at https://github.com/deepagent-ltd/deepagent-code/issues. ## Development diff --git a/github/action.yml b/github/action.yml index 47f9d13d..249fd2a9 100644 --- a/github/action.yml +++ b/github/action.yml @@ -45,7 +45,7 @@ runs: id: version shell: bash run: | - VERSION=$(curl -sf https://api.github.com/repos/lessweb/deepagent-code/releases/latest | grep -o '"tag_name": *"[^"]*"' | cut -d'"' -f4) + VERSION=$(curl -sf https://api.github.com/repos/deepagent-ltd/deepagent-code/releases/latest | grep -o '"tag_name": *"[^"]*"' | cut -d'"' -f4) echo "version=${VERSION:-latest}" >> $GITHUB_OUTPUT - name: Cache deepagent-code diff --git a/package.json b/package.json index 6e0cdade..4d838030 100644 --- a/package.json +++ b/package.json @@ -19,7 +19,7 @@ "prepare": "husky", "random": "echo 'Random script'", "sso": "aws sso login --sso-session=deepagent-code --no-browser", - "test": "echo 'do not run tests from root' && exit 1" + "test": "bun run --cwd packages/app test && bun run --cwd packages/ui test" }, "workspaces": { "packages": [ diff --git a/packages/app/README.md b/packages/app/README.md index 9040c386..1bf37cbd 100644 --- a/packages/app/README.md +++ b/packages/app/README.md @@ -1,33 +1,32 @@ -## Usage +# @deepagent-code/app — Desktop Application -Dependencies for these templates are managed with [pnpm](https://pnpm.io) using `pnpm up -Lri`. +SolidJS front-end shell for the DeepAgent Code desktop app (Electron/Tauri). -This is the reason you see a `pnpm-lock.yaml`. That said, any package manager will work. This file can safely be removed once you clone a template. +## Stack -```bash -$ npm install # or pnpm install or yarn install -``` - -### Learn more on the [Solid Website](https://solidjs.com) and come chat with us on our [Discord](https://discord.com/invite/solidjs) - -## Available Scripts +- **UI:** SolidJS + Vite (Bun) +- **Backend:** `deepagent-code` package spawned as a local server or connected via the server-mode gateway +- **Build output:** `dist/` — consumed by the Electron/Tauri packager in CI -In the project directory, you can run: +## Development -### `npm run dev` or `npm start` +```bash +# from repo root +bun install +bun run dev # hot-reload dev server +``` -Runs the app in the development mode.