Model spec string (e.g. 'anthropic:claude-opus-4-7'); None lets the server pick its default.

Model spec used only for context-compaction summaries.

None reuses the main agent model.

Extra kwargs forwarded to the chat model constructor (temperature, max_tokens, etc.).

Explicit --max-retries value, separate from provider model kwargs.

Model profile metadata overrides resolved by the client.

Identifier of the agent graph to invoke on the server.

Override for the agent's system prompt; None uses the agent's default.

Auto-approve every tool call without human-in-the-loop interrupts.

Route only shell tool calls through HITL; validate others via middleware.

Restrictive allow-list of shell commands; None disables the allow-list.

Must be non-empty when set.

Whether the agent runs in an interactive session (vs. one-shot/non-interactive).

Enable the shell execution tool on the server.

Enable the ask_user tool that lets the agent prompt the user mid-run.

Enable the long-term memory subsystem.

Enable the skills subsystem (SKILL.md loading and skill tools).

Enable CodeInterpreterMiddleware (js_eval REPL) on the main agent.

Always the resolved concrete value: from_cli_args collapses the tri-state caller option via _resolve_enable_interpreter before constructing the config, so the bool | None "defer to default" sentinel never reaches this field. The False default here is only the bare-constructor/from_env fallback; the user-facing default (on in local mode) is resolver-backed.

Local-mode only; the server graph raises if a sandbox is configured and this flag is True.

Invocation-scoped override for interpreter.ptc.

None means "fall through to whatever interpreter.ptc resolves to from ~/.deepagents/config.toml". A string is one of "safe"/"all"; a list is an explicit allowlist of tool names that may also include the "safe" preset (expanded at agent-build time); "all" is rejected inside a list.

Override for interpreter.ptc_acknowledge_unsafe — required when interpreter_ptc="all" is paired with non-auto_approve mode.

Allowlist for FilesystemMiddleware's tools param, from --allow-fs-tools.

None means "all filesystem tools" and is also what --allow-fs-tools all parses to: it leaves the SDK's own default FilesystemMiddleware in place (no replacement). A list is an explicit allowlist of filesystem tool names, must include "read_file", and installs a restricted replacement (see create_cli_agent).

Grader model spec for RubricMiddleware (e.g. 'anthropic:...').

None reuses the main agent model.

Explicit grader iterations per rubric attempt; None uses the SDK default.

Classifier model spec for Auto mode (e.g. 'anthropic:claude-haiku-4-5').

None falls through to DEEPAGENTS_CODE_AUTO_CLASSIFIER_MODEL, then [models].auto_classifier, and then to the main agent model. An empty value round-trips to None, so it means "inherit", never "empty spec".

Explicit main-agent LangGraph recursion_limit (graph step budget).

None resolves from runtime configuration. An explicit value from --recursion-limit wins over the env var and config.toml, but managed config outranks the flag. Must be a positive integer when set.

Sandbox backend identifier (e.g. 'daytona'); None runs tools on the host. 'none' is normalized to None in __post_init__.

Existing sandbox ID to attach to; None creates a fresh sandbox.

Sandbox snapshot (langsmith) or blueprint (runloop) name; must be None when sandbox_id is set.

Absolute path to a setup script executed inside the sandbox on first attach.

User's original working directory, serialized as an absolute path.

Detected project root (e.g. nearest git/uv/npm boundary), or None when outside a project.

Absolute path to the MCP server config file; None disables MCP-from-config.

Disable all MCP server connections regardless of other config.

Tri-state trust flag for project-scoped MCP servers: True/False/None (prompt user).

Whether the project's Python extensions may execute for this run.

Absolute one-run extension files or directories from repeatable CLI flags.

Return non-secret resource policy for a durable workspace binding.

Return the command-scoped policy a managed client may claim.

Return policy that must be resolved for each project directory.

Fingerprint the exact client-claimable session policy.

Resolve directory-bound policy for one server workspace.

Project-scoped policy (PROJECT_WORKSPACE_FIELDS) is valid only for the directory it was resolved against: it came from the launch-time CLI and that project's trust decisions. Reusing it for another directory would apply one project's MCP servers, sandbox setup, and extensions to a different, possibly untrusted, checkout.

So the launch project keeps its policy verbatim, and any other project starts from nothing: MCP and sandbox setup are dropped rather than rediscovered, and extension trust is re-read from the trust store for that project. _same_workspace_project fails closed, so an unresolvable path also takes the drop branch.

Keep an existing thread's extension trust when a new grant appears.

Fingerprint durable access policy plus workspace identity.

Covers the trust/tool/sandbox/approval payload (the to_workspace_payload() keys) and the workspace's cwd/project_root. Cosmetic model settings (MODEL_COMPATIBLE_FIELDS) are excluded so a model switch does not invalidate a durable binding; runtime-only fields (RUNTIME_ONLY_FIELDS) are excluded because they are not persisted.

Fingerprint the full runtime identity, including model settings.

Any change to model, model params, prompt, policy, or runtime fields yields a different value, so the runtime cache can rebuild on any of them while the binding only guards the policy fingerprint.

Fingerprint the resolved runtime config except workspace identity.

Retained for compatibility; equivalent to runtime_fingerprint().

Serialize this config to a DEEPAGENTS_CODE_SERVER_* env-var mapping.

None values signal that the variable should be cleared from the environment (rather than set to an empty string), so callers can iterate and set or clear each variable in os.environ.

Reconstruct a ServerConfig from DEEPAGENTS_CODE_SERVER_* env vars.

This is the inverse of to_env() and is called inside the server subprocess to recover the app's configuration.

Build a ServerConfig from parsed CLI arguments.

Handles path normalization (e.g. resolving relative MCP config paths against the user's working directory) so that the raw serialized values are always absolute and unambiguous.