langchain-ai/deepagentsjs
1
0
Fork 0
mirror of https://github.com/langchain-ai/deepagentsjs.git synced 2026-07-19 08:26:01 -04:00
Code Issues 42 Packages Projects Releases 10 Wiki Activity

[PR #492] [MERGED] feat(deepagents): implement file system permissions for fs middleware tools #506

New Issue
Closed
opened 2026-06-05 17:23:29 -04:00 by yindo · 0 comments
yindo commented 2026-06-05 17:23:29 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/deepagentsjs/pull/492
Author: @colifran
Created: 4/27/2026
Status: ✅ Merged
Merged: 4/28/2026
Merged by: @colifran

Base: main ← Head: colifran/perms

📝 Commits (10+)

📊 Changes

17 files changed (+1438 additions, -21 deletions)

View changed files

➕ .changeset/shy-readers-flow.md (+6 -0)
📝 libs/deepagents/src/agent.ts (+8 -2)
📝 libs/deepagents/src/backends/composite.ts (+19 -0)
📝 libs/deepagents/src/index.ts (+7 -0)
➕ libs/deepagents/src/middleware/fs.permissions.test.ts (+491 -0)
📝 libs/deepagents/src/middleware/fs.ts (+213 -16)
➕ libs/deepagents/src/middleware/subagents.permissions.test.ts (+221 -0)
📝 libs/deepagents/src/middleware/subagents.ts (+23 -0)
➕ libs/deepagents/src/permissions/agent.permissions.test.ts (+109 -0)
➕ libs/deepagents/src/permissions/enforce.test.ts (+159 -0)
➕ libs/deepagents/src/permissions/enforce.ts (+90 -0)
➕ libs/deepagents/src/permissions/index.ts (+12 -0)
➕ libs/deepagents/src/permissions/types.ts (+40 -0)
📝 libs/deepagents/src/types.ts (+20 -0)
📝 libs/providers/quickjs/src/middleware.int.test.ts (+1 -2)
📝 libs/providers/quickjs/src/middleware.ts (+4 -1)
📝 libs/providers/quickjs/src/session.ts (+15 -0)

📄 Description

Summary

  • Adds a FilesystemPermission class and a permissions parameter to createDeepAgent and SubAgent that controls which filesystem operations each agent is allowed to perform
  • Rules are evaluated first-match-wins with a permissive default; mode: "deny" blocks the operation before any backend call
  • Permissions are closed over at tool-creation time — no runtime config threading, no ToolPolicy in langchain-core
  • ls, glob, and grep enforce permissions in two passes: the base path check throws early; results are post-filtered to strip entries the caller can't read
  • Subagents receive the parent agent's permissions by default; setting permissions on a SubAgent is a full replacement, not a merge
  • FilesystemPermission, FilesystemPermissionOptions, FilesystemOperation, and PermissionMode are exported from the top-level package entry point

Tests

  • permissions/types.test.ts — FilesystemPermission construction, validation (rejects relative paths, .., ~), defaults
  • permissions/enforce.test.ts — validatePath, globMatch (wildcards, brace expansion, dotfiles), decidePathAccess (first-match-wins, operation mismatch, multiple ops/paths)
  • middleware/fs.permissions.test.ts — each fs tool (read, write, edit, ls, glob, grep) with allow/deny rules and mock backends; verifies backend is never called on a denied path; verifies execute is unaffected
  • permissions/agent.permissions.test.ts — CreateDeepAgentParams.permissions type and default; wiring to createFilesystemMiddleware
  • middleware/subagents.permissions.test.ts — SubAgent.permissions type; ?? resolution (inherit vs override vs own deny); createFilesystemMiddleware behavior for each resolved-permissions case

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/deepagentsjs/pull/492 **Author:** [@colifran](https://github.com/colifran) **Created:** 4/27/2026 **Status:** ✅ Merged **Merged:** 4/28/2026 **Merged by:** [@colifran](https://github.com/colifran) **Base:** `main` ← **Head:** `colifran/perms` --- ### 📝 Commits (10+) - [`1c7c4c4`](https://github.com/langchain-ai/deepagentsjs/commit/1c7c4c48cec9385b7a904806d852f6b5729676b1) implement core permissions logic - [`db84de2`](https://github.com/langchain-ai/deepagentsjs/commit/db84de27e0780cdda44111f0f9085bc02137b9bd) format - [`f781b9d`](https://github.com/langchain-ai/deepagentsjs/commit/f781b9d95984b059b74076df35b63dee27c01946) integrate permissions into fs middleware tools - [`14a8dfd`](https://github.com/langchain-ai/deepagentsjs/commit/14a8dfd564af02cef676425aa470560aeb83a986) wire permissions into deep agents - [`ddb963a`](https://github.com/langchain-ai/deepagentsjs/commit/ddb963a165c292d302ab595113be73fcaa523be4) permissions integ tests - [`20f96d0`](https://github.com/langchain-ai/deepagentsjs/commit/20f96d0a5651c5893131e21342b2849ee8875a83) implement subagent permission overrides - [`2dc24a1`](https://github.com/langchain-ai/deepagentsjs/commit/2dc24a1cbfe6a90b41632554633620e02c8e20d4) fix bug - [`c7cb86a`](https://github.com/langchain-ai/deepagentsjs/commit/c7cb86adca5b5185c68a8e84993729a6483e63b6) linting - [`d2e4d2f`](https://github.com/langchain-ai/deepagentsjs/commit/d2e4d2f231e5bc865825b4fb6b247b82725d3795) changeset - [`6391f39`](https://github.com/langchain-ai/deepagentsjs/commit/6391f3990bbf4813df07e1006f86d2b7a17565c9) throw error when permissions are configured for execute ### 📊 Changes **17 files changed** (+1438 additions, -21 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/shy-readers-flow.md` (+6 -0) 📝 `libs/deepagents/src/agent.ts` (+8 -2) 📝 `libs/deepagents/src/backends/composite.ts` (+19 -0) 📝 `libs/deepagents/src/index.ts` (+7 -0) ➕ `libs/deepagents/src/middleware/fs.permissions.test.ts` (+491 -0) 📝 `libs/deepagents/src/middleware/fs.ts` (+213 -16) ➕ `libs/deepagents/src/middleware/subagents.permissions.test.ts` (+221 -0) 📝 `libs/deepagents/src/middleware/subagents.ts` (+23 -0) ➕ `libs/deepagents/src/permissions/agent.permissions.test.ts` (+109 -0) ➕ `libs/deepagents/src/permissions/enforce.test.ts` (+159 -0) ➕ `libs/deepagents/src/permissions/enforce.ts` (+90 -0) ➕ `libs/deepagents/src/permissions/index.ts` (+12 -0) ➕ `libs/deepagents/src/permissions/types.ts` (+40 -0) 📝 `libs/deepagents/src/types.ts` (+20 -0) 📝 `libs/providers/quickjs/src/middleware.int.test.ts` (+1 -2) 📝 `libs/providers/quickjs/src/middleware.ts` (+4 -1) 📝 `libs/providers/quickjs/src/session.ts` (+15 -0) </details> ### 📄 Description ### Summary - Adds a FilesystemPermission class and a permissions parameter to createDeepAgent and SubAgent that controls which filesystem operations each agent is allowed to perform - Rules are evaluated first-match-wins with a permissive default; mode: "deny" blocks the operation before any backend call - Permissions are closed over at tool-creation time — no runtime config threading, no ToolPolicy in langchain-core - ls, glob, and grep enforce permissions in two passes: the base path check throws early; results are post-filtered to strip entries the caller can't read - Subagents receive the parent agent's permissions by default; setting permissions on a SubAgent is a full replacement, not a merge - FilesystemPermission, FilesystemPermissionOptions, FilesystemOperation, and PermissionMode are exported from the top-level package entry point ### Tests - permissions/types.test.ts — FilesystemPermission construction, validation (rejects relative paths, .., ~), defaults - permissions/enforce.test.ts — validatePath, globMatch (wildcards, brace expansion, dotfiles), decidePathAccess (first-match-wins, operation mismatch, multiple ops/paths) - middleware/fs.permissions.test.ts — each fs tool (read, write, edit, ls, glob, grep) with allow/deny rules and mock backends; verifies backend is never called on a denied path; verifies execute is unaffected - permissions/agent.permissions.test.ts — CreateDeepAgentParams.permissions type and default; wiring to createFilesystemMiddleware - middleware/subagents.permissions.test.ts — SubAgent.permissions type; ?? resolution (inherit vs override vs own deny); createFilesystemMiddleware behavior for each resolved-permissions case --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-05 17:23:29 -04:00
yindo closed this issue 2026-06-05 17:23:30 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
help wanted
needs-response
pull-request
Mirrored from GitHub Pull Request
 stale
triage: high-impact
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/deepagentsjs#506
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?