Upgrade to LangChain deep agents

[GeneralJerel]

Summary

• Replace langchain.agents.create_agent with deepagents.create_deep_agent
• Convert 3 skill .txt files to SKILL.md format in subdirectories for proper deep agent skill discovery
• Remove old skills/__init__.py loader — deep agents handle skill loading via the skills= parameter
• Add deepagents>=0.1.0 dependency

Why

Deep agents provide a proper skills system with progressive disclosure (only loading skill details when relevant), plus built-in planning, sub-agents, and filesystem tools. This replaces the current approach of injecting ~47KB of raw skill text into the system prompt.

What changed

File	Change
apps/agent/main.py	create_agent → create_deep_agent, removed skill text injection, added skills= param
apps/agent/pyproject.toml	Added deepagents>=0.1.0
apps/agent/skills/__init__.py	Deleted
apps/agent/skills/*.txt	Converted to skills/*/SKILL.md format with frontmatter

No frontend changes — the graph export shape, CopilotKitMiddleware, and AgentState contract are all unchanged.

Test plan

• pnpm dev:agent boots without import errors
• Agent logs show 3 skills discovered from skills/ directory
• Ask agent to create a diagram — verifies skills are loaded and widgetRenderer works
• Add/edit/toggle/delete todos via chat and UI — verifies bidirectional state sync
• Save and apply a template — verifies template tools work
• Ask for a chart — verifies query_data tool still works

Closes #47

🤖 Generated with Claude Code

[GeneralJerel]

Review: Upgrade to LangChain deep agents

4 commits, 8 files changed (+89, -73)

Two logically distinct changes bundled together:

1. Agent migration: create_agent → create_deep_agent with skills-based architecture
2. Widget renderer fix: Sequential CDN script loading + CSP expansion

Agent Migration (main.py, skills/, pyproject.toml)

Clean migration:

• state_schema → context_schema (fixed in second commit)
• Skill text injection (~47KB in system prompt) replaced by directory-based discovery via skills= param
• Old skills/__init__.py loader properly removed
• Skills converted to SKILL.md frontmatter format in subdirectories

Minor observations:

• deepagents>=0.1.0 — no upper bound on a 0.x package. A breaking change in 0.2.0 could silently break things. Consider pinning tighter (e.g. >=0.1.0,<0.2.0).
• allowed-tools: [] is empty in all three SKILL.md files — intentional? If deep agents support tool-gating per skill, worth documenting why.
• Skill content diffs are just Unicode → ASCII substitutions (→ → ->, × → x, ≈ → ~) — encoding normalization, not content changes.

Widget Renderer (widget-renderer.tsx)

Good fix. The forEach → recursive runScripts change correctly solves the race condition where inline scripts ran before their CDN dependencies loaded.

• External scripts chain via onload/onerror before advancing
• Inline scripts execute synchronously and advance immediately
• type attribute preserved (needed for type="module")
• Error handling continues the chain on failure

CSP connect-src expansion adds 4 CDN origins, consistent with the existing script-src allowlist. Reasonable given the sandboxed iframe context.

Note: reportHeight() fires immediately after starting the async script chain, so height may be stale until external scripts finish rendering. The existing ResizeObserver + periodic interval mitigates this, but if users see a brief layout jump after CDN scripts load, that's why.

README

Docs updated accurately.

Verdict

LGTM with minor suggestion to tighten deepagents version constraint. Widget renderer fix is solid, agent migration is clean.