langchain-ai/deepagents · error · TypeError

SHELL_ALLOW_ALL should not be used with ShellAllowListMiddle

Error message

SHELL_ALLOW_ALL should not be used with ShellAllowListMiddleware; use auto_approve=True instead

What it means

`SHELL_ALLOW_ALL` is a sentinel meaning 'permit every shell command'. `ShellAllowListMiddleware` is by design a restrictive allow-list; passing the sentinel would silently turn it into allow-everything, defeating its purpose. The constructor detects the sentinel type and raises TypeError, directing you to `auto_approve=True` for unrestricted non-interactive runs.

Source

Thrown at libs/code/deepagents_code/agent.py:854

            allow_list: Allowed command names (e.g. `["ls", "cat", "grep"]`).
                Must be a non-empty restrictive list — not `SHELL_ALLOW_ALL`.

        Raises:
            ValueError: If `allow_list` is empty.
            TypeError: If `allow_list` is the `SHELL_ALLOW_ALL` sentinel.
        """
        from deepagents_code.config import SHELL_ALLOW_ALL

        super().__init__()
        if not allow_list:
            msg = "allow_list must not be empty; disable shell access instead"
            raise ValueError(msg)
        if isinstance(allow_list, type(SHELL_ALLOW_ALL)):
            msg = (
                "SHELL_ALLOW_ALL should not be used with "
                "ShellAllowListMiddleware; use auto_approve=True instead"
            )
            raise TypeError(msg)
        self._allow_list = list(allow_list)

    def _validate_tool_call(self, request: ToolCallRequest) -> ToolMessage | None:
        """Return an error tool message when a shell command is not allowed.

        Args:
            request: The tool call request being processed.

        Returns:
            An error `ToolMessage` when the shell command should be rejected,
            otherwise `None`.
        """
        from langchain_core.messages import ToolMessage as LCToolMessage

        from deepagents_code.config import is_shell_command_allowed

        if request.tool_call["name"] != "execute":
            return None

View on GitHub (pinned to a1af029e6e)

Solutions

Use `auto_approve=True` in `create_cli_agent` instead of ShellAllowListMiddleware when you want unrestricted, interrupt-free shell execution.
Replace SHELL_ALLOW_ALL with an explicit restrictive list such as ["ls", "cat", "grep"].
Guard shared config: resolve the sentinel to `auto_approve=True` before choosing the middleware.

Example fix

// before
from deepagents_code.config import SHELL_ALLOW_ALL
mw = ShellAllowListMiddleware(SHELL_ALLOW_ALL)
// after
if allow == SHELL_ALLOW_ALL:
    agent = create_cli_agent(..., auto_approve=True)  # no allow-list middleware
else:
    mw = ShellAllowListMiddleware(allow_list=allow)

Defensive patterns

Strategy: type-guard

Validate before calling

from deepagents_code.config import SHELL_ALLOW_ALL
if allow is SHELL_ALLOW_ALL or isinstance(allow, type(SHELL_ALLOW_ALL)):
    raise TypeError("Use auto_approve=True instead of SHELL_ALLOW_ALL with ShellAllowListMiddleware")

Type guard

def is_restrictive_allow_list(value: object) -> bool:
    from deepagents_code.config import SHELL_ALLOW_ALL
    return isinstance(value, list) and not isinstance(value, type(SHELL_ALLOW_ALL)) and len(value) > 0

Try / catch

try:
    mw = ShellAllowListMiddleware(allow_list=allow)
except TypeError as e:
    if "SHELL_ALLOW_ALL" in str(e):
        mw = None  # switch to create_cli_agent(..., auto_approve=True)
    else:
        raise

Prevention

Never feed config values straight into ShellAllowListMiddleware; check for the SHELL_ALLOW_ALL sentinel first.
Map sentinel -> auto_approve=True in one central place, not at each construction site.
Keep restrictive allow-lists explicit literals in config rather than shared constants.

When it happens

Trigger: Instantiating `ShellAllowListMiddleware(SHELL_ALLOW_ALL)` or passing a value whose type matches the sentinel (checked via `isinstance(allow_list, type(SHELL_ALLOW_ALL))`), typically by reading `SHELL_ALLOW_ALL` from config or sharing one allow-list variable between HITL and non-interactive code paths.

Common situations: Config that stores `SHELL_ALLOW_ALL` for interactive mode and reuses it when building a headless/non-interactive agent; refactors that replaced HITL approval with the allow-list middleware without swapping the sentinel for `auto_approve=True`.

Related errors

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/fe990bfa0c4a89df. Report an issue: GitHub.