fix(sdk): prevent local shell commands from stealing TUI input - #5873
Merged
Mason Daugherty (mdrxy) merged 2 commits intoAug 27, 2026
Conversation
github-actions
Bot
added
p0
Mason Daugherty (mdrxy)
marked this pull request as ready for review
August 27, 2026 04:24
github-actions
Bot
added
size: S
![open-swe[bot]](https://avatars.githubusercontent.com/in/1395372?s=60&v=4){kind=small}
Mason Daugherty (mdrxy)
force-pushed
the
mdrxy/sdk/detach-local-shell-session
branch
from
August 27, 2026 15:01
19b4e7a to
3581692
Compare
Mason Daugherty (mdrxy)
force-pushed
the
mdrxy/sdk/detach-local-shell-session
branch
from
August 27, 2026 17:19
9e315b9 to
b542259
Compare
Mason Daugherty (mdrxy)
force-pushed
the
mdrxy/sdk/detach-local-shell-session
branch
from
August 27, 2026 18:33
9f953e0 to
35cb8ea
Compare
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Mason Daugherty (mdrxy)
force-pushed
the
mdrxy/sdk/detach-local-shell-session
branch
from
August 27, 2026 20:36
35cb8ea to
d6aa48d
Compare
Mason Daugherty (mdrxy)
deleted the
mdrxy/sdk/detach-local-shell-session
branch
August 27, 2026 20:55
Mason Daugherty (mdrxy)
added a commit
that referenced
this pull request
Aug 27, 2026
Related: #4329 Git commands run through dcode's `execute` tool now fail with an explicit terminal-prompts-disabled message when credentials are unavailable. --- Stacked on #5873. Starting local shell subprocesses in a new session prevents them from stealing the Textual TUI's keyboard input, but Git can then surface a cryptic `/dev/tty` error when it tries to prompt for credentials. Set `GIT_TERMINAL_PROMPT=0` in dcode's curated local shell environment as defense in depth so Git skips the prompt attempt and reports the cause directly. This is intentionally scoped to dcode's agent `execute` environment. It does not alter the general SDK backend, remote sandboxes, or the user's parent environment, and dcode overrides an inherited value to keep non-interactive execution reliable. Made by [Open SWE](https://openswe.vercel.app/agents/000f0c29-ded9-5a80-abaa-daa77e57f972) --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Mason Daugherty (mdrxy)
pushed a commit
that referenced
this pull request
Aug 28, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. Publish reads the merged CHANGELOG via `release.yml`, not this PR description — keep them aligned anyway so the PR stays an accurate historical record for reviewers and anyone returning later._ --- ## [0.7.10](deepagents==0.7.9...deepagents==0.7.10) (2026-08-28) ### Bug Fixes - Prevent local shell commands from stealing TUI input ([#5873](#5873)) - Surface sandbox glob failures instead of reporting no matches ([#5566](#5566)) _End release notes preview._ --- > [!NOTE] > A **community contributors** list and a **Special thanks** section (crediting the users who filed the issues this release's PRs closed) are appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 3). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4329
Related: #5907
Local shell commands can no longer access the parent process's controlling terminal on POSIX systems, preventing credential prompts from stealing keyboard input from the dcode TUI.
The dcode agent routes
executethroughLocalShellBackend. Although that backend gives subprocessesstdin=subprocess.DEVNULL, programs such as Git and SSH can bypass standard input by opening/dev/ttydirectly. When they prompt for credentials, they then compete with Textual for the same terminal input, disrupting or effectively breaking the chat input until the process exits.Start each local shell command in a new POSIX session so it no longer has access to dcode's controlling terminal. Interactive commands now fail cleanly through captured output rather than intercepting keystrokes. This also aligns the agent
executepath with dcode's existing local!shell behavior.Windows behavior is unchanged because
start_new_sessionis enabled only on non-Windows platforms. Focused coverage runs the backend beneath a real controlling pseudo-terminal, proves the parent can open/dev/tty, and verifies the detached command cannot.Made by Open SWE
Co-authored-by: Sumit Kumar 187615421+sumit1kr@users.noreply.github.com