langchain-ai/deepagents · error · ValueError

interpreter_ptc='all' exposes every host tool to PTC calls t

Error message

interpreter_ptc='all' exposes every host tool to PTC calls that bypass HITL approval. Set interpreter_ptc_acknowledge_unsafe=True (or use auto_approve=True) to opt in.

What it means

`_resolve_ptc_option` resolves the `interpreter_ptc` option for the code interpreter. The value 'all' exposes every host tool to PTC (Python-executed tool calls), which bypasses human-in-the-loop approval. Because that is dangerous by default, the library raises ValueError unless you explicitly opt in with `interpreter_ptc_acknowledge_unsafe=True` or run with `auto_approve=True`.

Source

Thrown at libs/code/deepagents_code/agent.py:1022

    if isinstance(ptc, str):
        normalized = ptc.strip().lower()
        if normalized == "safe":
            from deepagents_code.config import INTERPRETER_PTC_SAFE_PRESET

            # Return the preset as-is; the middleware exposes whichever members
            # exist in the live registry at runtime (they are SDK built-ins not
            # present in `tools` here).
            return sorted(INTERPRETER_PTC_SAFE_PRESET)
        if normalized == "all":
            if not auto_approve and not acknowledge_unsafe:
                msg = (
                    "interpreter_ptc='all' exposes every host tool to PTC "
                    "calls that bypass HITL approval. Set "
                    "interpreter_ptc_acknowledge_unsafe=True (or use "
                    "auto_approve=True) to opt in."
                )
                raise ValueError(msg)
            # `all` can only enumerate the tools passed to `create_cli_agent`;
            # SDK runtime built-ins (filesystem, `task`, …) are injected later
            # and are not enumerable here. Exposing them under `all` needs an
            # "expose everything" sentinel in `CodeInterpreterMiddleware`
            # (tracked in langchain-ai/deepagents#3847).
            included = sorted(live_set)
            write_included = sorted(_INTERPRETER_WRITE_TOOLS & live_set)
            if write_included:
                logger.info(
                    "interpreter_ptc='all' includes write/shell tools: %s",
                    write_included,
                )
            return included
        msg = (
            f"Invalid interpreter_ptc string {ptc!r}; expected 'safe', 'all', "
            "or a list of tool names."
        )
        raise ValueError(msg)

View on GitHub (pinned to a1af029e6e)

Solutions

1. Add `interpreter_ptc_acknowledge_unsafe=True` to the `create_cli_agent` call to explicitly accept the risk.
2. Use `auto_approve=True` if the agent runs fully non-interactive and you accept no HITL at all.
3. Prefer `interpreter_ptc="safe"` or an explicit tool-name list to keep the HITL approval gate intact.

Example fix

// before
agent = create_cli_agent(..., interpreter_ptc="all")
// after
agent = create_cli_agent(
    ...,
    interpreter_ptc="all",
    interpreter_ptc_acknowledge_unsafe=True,
)

def resolve_ptc(ptc, auto_approve, acknowledge_unsafe):
    if isinstance(ptc, str) and ptc.strip().lower() == "all":
        if not auto_approve and not acknowledge_unsafe:
            raise ValueError("interpreter_ptc='all' requires interpreter_ptc_acknowledge_unsafe=True or auto_approve=True")
    return ptc

resolve_ptc(ptc, auto_approve, acknowledge_unsafe)  # call before create_cli_agent

try:
    agent = create_cli_agent(..., interpreter_ptc="all")
except ValueError as e:
    if "interpreter_ptc_acknowledge_unsafe" in str(e):
        agent = create_cli_agent(..., interpreter_ptc="all", interpreter_ptc_acknowledge_unsafe=True)
    else:
        raise

When it happens

Trigger: Calling `create_cli_agent(..., interpreter_ptc="all")` (or interpreter_ptc=" ALL " after normalization) while `auto_approve=False/None` and `interpreter_ptc_acknowledge_unsafe` is not set to True. Also hit by tests exercising the ack-check path.

Common situations: Trying to give the interpreter access to every tool for convenience in a headless run; copying example config with interpreter_ptc='all' into an interactive (non-auto-approve) agent; migrating from interpreter_ptc='safe' to 'all' without adding the acknowledgement flag.

Related errors

• allow_fs_tools must be None or a non-empty list
• allow_list must not be empty; disable shell access instead
• SHELL_ALLOW_ALL should not be used with ShellAllowListMiddle
• Invalid interpreter_ptc string {ptc!r}; expected 'safe', 'al
• interpreter_ptc list entries cannot include 'all'; use 'all'

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/79ca76312965ac1e. Report an issue: GitHub.