{"record":{"id":"47ebf52ded994f5e","repo":"langchain-ai/deepagents","slug":"permission-path-must-start-with-path-r","errorCode":null,"errorMessage":"Permission path must start with '/': {path!r}","messagePattern":"Permission path must start with '/': (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"libs/deepagents/deepagents/middleware/filesystem.py","lineNumber":413,"sourceCode":"    - `\"allow\"` (default): the call proceeds.\n    - `\"deny\"`: the tool returns a permission-denied error.\n    - `\"interrupt\"`: the call is paused for human approval via\n        [`HumanInTheLoopMiddleware`][langchain.agents.middleware.HumanInTheLoopMiddleware].\n\n        Best paired with patterns that have a literal leading anchor (e.g.,\n        `/secrets/**`, `/projects/*/secrets/**`). Bulk tools\n        (`ls`/`glob`/`grep`) fire the interrupt based on whether their\n        search subtree could overlap the rule's anchored prefix, so a fully\n        unanchored pattern (`/**/secrets`) collapses to `/` and\n        conservatively over-fires for any bulk call.\n    \"\"\"\n\n    def __post_init__(self) -> None:\n        \"\"\"Validate permission path patterns.\"\"\"\n        for path in self.paths:\n            if not path.startswith(\"/\"):\n                msg = f\"Permission path must start with '/': {path!r}\"\n                raise ValueError(msg)\n            parts = PurePosixPath(path.replace(\"\\\\\", \"/\")).parts\n            if \"..\" in parts:\n                msg = f\"Permission path must not contain '..': {path!r}\"\n                raise ValueError(msg)\n            if \"~\" in parts:\n                msg = f\"Permission path must not contain '~': {path!r}\"\n                raise NotImplementedError(msg)\n\n\ndef _check_fs_permission(\n    rules: list[FilesystemPermission],\n    operation: FilesystemOperation,\n    path: str,\n) -> Literal[\"allow\", \"deny\", \"interrupt\"]:\n    for rule in rules:\n        if operation not in rule.operations:\n            continue\n        if any(wcglob.globmatch(path, pattern, flags=_FS_WCMATCH_FLAGS) for pattern in rule.paths):","sourceCodeStart":395,"sourceCodeEnd":431,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/deepagents/deepagents/middleware/filesystem.py#L395-L431","documentation":"FilesystemPermission validates its path patterns in __post_init__; every pattern must be an absolute POSIX-style path starting with '/'. Relative patterns are rejected with this ValueError to keep permission matching unambiguous.","triggerScenarios":"Creating FilesystemPermission(paths=[...]) with an entry like 'src/foo' or 'foo.txt' (no leading slash).","commonSituations":"Building permission rules from user-relative CLI input; reading patterns from config that were written relative to a project dir; joining paths without a leading '/'.","solutions":["Prefix the pattern with '/' (e.g. '/src/foo')","Normalize/resolve the path to absolute form before constructing the permission","Reject or transform relative patterns at your config-load boundary"],"exampleFix":"// before\nFilesystemPermission(paths=[\"src/secrets\"])\n// after\nFilesystemPermission(paths=[\"/src/secrets\"])","handlingStrategy":"validation","validationCode":"def ensure_absolute(p: str) -> str:\n    if not p.startswith(\"/\"):\n        raise ValueError(f\"permission path must be absolute: {p!r}\")\n    return p","typeGuard":null,"tryCatchPattern":"try:\n    perm = FilesystemPermission(paths=paths)\nexcept ValueError as e:\n    logger.error(\"bad permission pattern: %s\", e)\n    raise","preventionTips":["Normalize all permission patterns to absolute POSIX form at config load","Reject relative paths in user-facing config with a clear message","Use posixpath joins that preserve the leading '/'"],"tags":["python","filesystem","validation","configuration"],"backgroundTag":"path-must-be-absolute","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}