{"record":{"id":"79ca76312965ac1e","repo":"langchain-ai/deepagents","slug":"interpreter-ptc-all-exposes-every-host-tool-to-p","errorCode":null,"errorMessage":"interpreter_ptc='all' exposes every host tool to PTC calls that bypass HITL approval. Set interpreter_ptc_acknowledge_unsafe=True (or use auto_approve=True) to opt in.","messagePattern":"interpreter_ptc='all' exposes every host tool to PTC calls that bypass HITL approval\\. Set interpreter_ptc_acknowledge_unsafe=True \\(or use auto_approve=True\\) to opt in\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"libs/code/deepagents_code/agent.py","lineNumber":1022,"sourceCode":"\n    if isinstance(ptc, str):\n        normalized = ptc.strip().lower()\n        if normalized == \"safe\":\n            from deepagents_code.config import INTERPRETER_PTC_SAFE_PRESET\n\n            # Return the preset as-is; the middleware exposes whichever members\n            # exist in the live registry at runtime (they are SDK built-ins not\n            # present in `tools` here).\n            return sorted(INTERPRETER_PTC_SAFE_PRESET)\n        if normalized == \"all\":\n            if not auto_approve and not acknowledge_unsafe:\n                msg = (\n                    \"interpreter_ptc='all' exposes every host tool to PTC \"\n                    \"calls that bypass HITL approval. Set \"\n                    \"interpreter_ptc_acknowledge_unsafe=True (or use \"\n                    \"auto_approve=True) to opt in.\"\n                )\n                raise ValueError(msg)\n            # `all` can only enumerate the tools passed to `create_cli_agent`;\n            # SDK runtime built-ins (filesystem, `task`, …) are injected later\n            # and are not enumerable here. Exposing them under `all` needs an\n            # \"expose everything\" sentinel in `CodeInterpreterMiddleware`\n            # (tracked in langchain-ai/deepagents#3847).\n            included = sorted(live_set)\n            write_included = sorted(_INTERPRETER_WRITE_TOOLS & live_set)\n            if write_included:\n                logger.info(\n                    \"interpreter_ptc='all' includes write/shell tools: %s\",\n                    write_included,\n                )\n            return included\n        msg = (\n            f\"Invalid interpreter_ptc string {ptc!r}; expected 'safe', 'all', \"\n            \"or a list of tool names.\"\n        )\n        raise ValueError(msg)","sourceCodeStart":1004,"sourceCodeEnd":1040,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/code/deepagents_code/agent.py#L1004-L1040","documentation":"`_resolve_ptc_option` resolves the `interpreter_ptc` option for the code interpreter. The value 'all' exposes every host tool to PTC (Python-executed tool calls), which bypasses human-in-the-loop approval. Because that is dangerous by default, the library raises ValueError unless you explicitly opt in with `interpreter_ptc_acknowledge_unsafe=True` or run with `auto_approve=True`.","triggerScenarios":"Calling `create_cli_agent(..., interpreter_ptc=\"all\")` (or interpreter_ptc=\" ALL \" after normalization) while `auto_approve=False/None` and `interpreter_ptc_acknowledge_unsafe` is not set to True. Also hit by tests exercising the ack-check path.","commonSituations":"Trying to give the interpreter access to every tool for convenience in a headless run; copying example config with interpreter_ptc='all' into an interactive (non-auto-approve) agent; migrating from interpreter_ptc='safe' to 'all' without adding the acknowledgement flag.","solutions":["Add `interpreter_ptc_acknowledge_unsafe=True` to the `create_cli_agent` call to explicitly accept the risk.","Use `auto_approve=True` if the agent runs fully non-interactive and you accept no HITL at all.","Prefer `interpreter_ptc=\"safe\"` or an explicit tool-name list to keep the HITL approval gate intact."],"exampleFix":"// before\nagent = create_cli_agent(..., interpreter_ptc=\"all\")\n// after\nagent = create_cli_agent(\n    ...,\n    interpreter_ptc=\"all\",\n    interpreter_ptc_acknowledge_unsafe=True,\n)","handlingStrategy":"validation","validationCode":"def resolve_ptc(ptc, auto_approve, acknowledge_unsafe):\n    if isinstance(ptc, str) and ptc.strip().lower() == \"all\":\n        if not auto_approve and not acknowledge_unsafe:\n            raise ValueError(\"interpreter_ptc='all' requires interpreter_ptc_acknowledge_unsafe=True or auto_approve=True\")\n    return ptc\n\nresolve_ptc(ptc, auto_approve, acknowledge_unsafe)  # call before create_cli_agent","typeGuard":null,"tryCatchPattern":"try:\n    agent = create_cli_agent(..., interpreter_ptc=\"all\")\nexcept ValueError as e:\n    if \"interpreter_ptc_acknowledge_unsafe\" in str(e):\n        agent = create_cli_agent(..., interpreter_ptc=\"all\", interpreter_ptc_acknowledge_unsafe=True)\n    else:\n        raise","preventionTips":["Default to interpreter_ptc=\"safe\"; escalate to \"all\" only with a written security justification.","Set interpreter_ptc_acknowledge_unsafe=True explicitly (never implicitly via shared kwargs) so the opt-in is auditable.","In CI, lint agent construction calls for interpreter_ptc='all' without the acknowledgement flag."],"tags":["python","configuration","security","hitl","validation"],"backgroundTag":"unsafe-option-requires-acknowledgement","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}