DOCSEARCHbyAlgolia
Submit Docs

DeepCode

repository·main·Indexed 12 days ago

https://github.com/hkuds/deepcode

An open-source multi-agent system for agentic coding that converts natural language and research papers into production-ready code. It features a Tauri 2 desktop workbench and a CLI for managing Projects, Sessions, Agent runtimes, and Automations, with support for advanced loop and context engineering.

Tokens
132.6K
Snippets
265
Records
547
Agent score
97%

What's inside DeepCode

  1. What is DeepCode and its core capabilities

    main

    DeepCode is an open-source agentic coding framework designed for real-world software engineering. Unlike simple code generators, it uses a multi-agent system to handle complex, multi-step goals through a process called Loop Engineering (continuous understanding, implementation, verification, and repair).

    Key pillars of DeepCode include:

    • Deep Context: Understands tasks by combining project structure, engineering rules, Skills, Session history, and long-term memory.
    • Deep Execution: Performs actual work like searching, editing, running commands, and executing tests.
    • Deep Verification: Uses tests, builds, diagnostics, and diffs to verify results rather than just providing plausible-sounding code.
    • Deep Continuity: Persists conversations, decisions, tool logs, and evidence across time, directories, clients, and model switches.

  2. Overview of DeepCode: Open Agentic Coding

    main

    DeepCode is an open-source agentic coding platform that uses multi-agent systems to advance code generation technology. It aims to transform research papers and natural language instructions into production-ready code.

    DeepCode provides a single Agent runtime with two distinct interfaces:

    1. Interactive CLI: Designed for terminal-based workflows.
    2. Tauri Desktop: A visual workbench for managing Sessions, Goals, and reviewing tool activities, code modifications, and verification processes.

    Both interfaces share the same local Project data, Session history, Models, Skills, Permissions, Goals, and Automations.

  3. Use the webapp-testing toolkit for local web application testing

    main

    The webapp-testing toolkit allows you to interact with and test local web applications using Playwright. It supports verifying frontend functionality, debugging UI behavior, capturing screenshots, and viewing browser logs.

    To test a web application, you should write native Python Playwright scripts. For dynamic applications where a server must be running, use the scripts/with_server.py helper to manage the server lifecycle automatically.

  4. Understand DeepCode v2.0 Core Concepts

    main

    DeepCode v2.0 is a general-purpose Coding Agent framework designed for repository-level work. It uses Loop Engineering to move through a cycle of understanding, implementation, verification, and repair, rather than providing a single answer.

    Key capabilities include:

    • Repository Exploration: Exploring codebases, editing files, running commands/tests, and reviewing changes.
    • Goal Management: Providing high-level goals that the agent pursues through multiple 'Turns'. You can add requirements, correct direction, switch models, or stop/resume/revise goals without losing progress.
    • Automations: Converting natural-language instructions into project-specific tasks that can run on demand or on a recurring interval (e.g., regression checks, test repair, documentation upkeep).
    • Visibility: Monitoring plans, tool activity, code changes, test results, and verification evidence.
    • Execution Modes: Use the Desktop interface for a visual experience or the CLI for terminal-based/headless execution.

  5. Next.js (TypeScript/JavaScript) Web Security Spec

    main

    This specification defines the security requirements and operating modes for Next.js applications (targeting Next.js 16.1.x and Node.js 20.9+). It establishes safety boundaries and anti-abuse constraints that must be followed during development and production.

    Operating Modes

    • Generation mode (default): Standard code generation.
    • Passive review mode: Always active during editing to provide continuous security feedback.
    • Active audit mode: Triggered by an explicit scan request to perform a deep security analysis.

    Core Definitions

    • Untrusted input: Any data that must be treated as attacker-controlled unless proven otherwise.
    • State-changing request: Any request that modifies server-side or client-side state.

    Secure Baseline Requirements

    • Production Mode: Next.js MUST be run in production mode in production environments. Avoid using next dev or setting NODE_ENV=development in live environments.

  6. Understand the FastAPI Web Security Spec operating modes

    main

    The FastAPI Web Security Spec operates in three distinct modes depending on the user's intent. Understanding these modes helps you know how the agent will behave when interacting with your FastAPI codebase:

    1. Generation mode (default): When writing or modifying code, the agent follows all 'MUST' and 'SHOULD' requirements to ensure secure-by-default code. It avoids introducing risky sinks like shell execution or unsafe deserialization.
    2. Passive review mode (always on): While you are editing code, the agent continuously monitors nearby code for spec violations and will mention issues with brief explanations and safe fixes.
    3. Active audit mode (explicit request): Triggered when you ask to "scan", "audit", or "hunt for vulns". The agent performs a systematic search of the codebase following a specific audit order (from deployment scripts down to injection classes) and outputs findings in a structured format.

  7. Understand the Express Web Security Spec operating modes

    main

    The Express Web Security Spec operates in three distinct modes to support different developer workflows:

    1. Generation mode (default): Used when writing new Express code or modifying existing routes. The agent MUST follow all MUST requirements and SHOULD follow SHOULD requirements, prioritizing safe-by-default APIs and avoiding risky sinks (e.g., shell execution, unsafe redirects, or template rendering from untrusted strings).
    2. Passive review mode (always on): While editing an Express repository, the agent automatically notices and mentions spec violations in touched or nearby code, providing a brief explanation and a safe fix.
    3. Active audit mode: Triggered by explicit requests like "scan", "audit", or "hunt for vulns". The agent performs a systematic search of the codebase for spec violations and outputs findings in a structured format.

    Recommended Audit Order for Active Audits:

    1. Entrypoints (server/app bootstrap), deployment manifests, Dockerfiles, CI/CD.
    2. Express settings + middleware stack order (helmet, parsers, auth, sessions, CSRF, CORS).
    3. Proxy trust (trust proxy) and IP/protocol/host handling.
    4. Auth flows, sessions, cookies, password reset links, redirect handling.
    5. State-changing routes + CSRF protections.
    6. Template rendering and XSS defenses.
    7. File handling (uploads/downloads/static files) and path traversal.
    8. Injection classes (SQL, NoSQL, command execution, etc.).
    9. Outbound requests (SSRF).
    10. Rate limiting and brute-force defenses.
    11. Dependency hygiene.

  8. Format Tool Responses (Markdown vs JSON)

    main

    When implementing tools, you can support multiple output formats to cater to both human users and programmatic agents.

    Markdown Format

    • Use headers, lists, and formatting for clarity.
    • Convert timestamps to human-readable formats.
    • Show display names with IDs in parentheses.
    • Group related information logically.

    JSON Format

    • Return complete, structured data.
    • Include all available fields and metadata.
    • Use consistent field names and types.

    Always return both content (for text representation) and structuredContent (for the raw data object) in your tool response to follow the modern pattern.

  9. Identify untrusted input in Next.js applications

    main

    To prevent injection and other vulnerabilities, treat the following as untrusted input (attacker-controlled) unless proven otherwise:

    App Router

    • Route Handler params and request data: context.params (dynamic segments), search params (request.url, new URL(request.url).searchParams), request.headers, request.cookies, and body parsing via await request.json(), await request.formData(), or await request.text().
    • Dynamic APIs: Values retrieved from headers() and cookies() in Server Components or Server Functions.

    Pages Router

    • req.query, req.cookies, and req.body within pages/api/* handlers.

    General

    • Data from external systems (webhooks, third-party APIs, message queues).
    • Any persisted user content (e.g., database rows) that originated from users.

  10. Use Bundled Resources in Skills

    main

    To extend a skill's capability without bloating the context window, use the following optional directories:

    • scripts/: Contains executable code (Python, Bash, etc.) for tasks requiring deterministic reliability or repetitive execution (e.g., scripts/rotate_pdf.py).
    • references/: Contains documentation (schemas, API docs, policies) intended to be loaded into context only when Codex determines it is needed. If files are >10k words, include grep search patterns in SKILL.md.
    • assets/: Contains files used in the final output produced by Codex (e.g., assets/logo.png, assets/font.ttf, or HTML/React boilerplate) that do not need to be loaded into the context window.

  11. Avoid common AI-generated design defaults

    main

    When using the frontend-design skill, be aware of three common 'clusters' of AI-generated looks that should be avoided unless explicitly requested by a brief:

    1. Warm Minimalist: A warm cream background (near #F4F1EA) with a high-contrast serif display and a terracotta accent.
    2. High-Contrast Dark: A near-black background with a single bright acid-green or vermilion accent.
    3. Broadsheet: A layout with hairline rules, zero border-radius, and dense, newspaper-like columns.

    If the brief leaves a visual axis free, do not default to these patterns. Instead, make a deliberate, opinionated choice specific to the subject matter.

  12. DeepCode Interface Options

    main

    DeepCode offers two ways to interact with its agent runtime:

    DeepCode Desktop

    A visual workbench built with Tauri. It allows users to work in a visual workspace to monitor:

    • Sessions: The lifecycle of agent tasks.
    • Goals: The objectives assigned to the agent.
    • Tool Activity: Real-time monitoring of what tools the agent is using.
    • Code Changes: Reviewing modifications made by the agent.
    • Verification: Ensuring the generated code meets requirements.

    Interactive CLI

    A command-line interface intended for developers who prefer terminal-centric workflows. It provides access to the same underlying agent capabilities and local project data as the Desktop version.