{"record":{"id":"69d976007896f969","repo":"langchain-ai/deepagents","slug":"filesystemmiddleware-does-not-yet-support-permissi","errorCode":null,"errorMessage":"FilesystemMiddleware does not yet support permissions with backends that provide command execution (SandboxBackendProtocol). Tool-level permissions for the execute tool are not implemented. Either remove permissions or use a backend without execution support.","messagePattern":"FilesystemMiddleware does not yet support permissions with backends that provide command execution \\(SandboxBackendProtocol\\)\\. Tool-level permissions for the execute tool are not implemented\\. Either remove permissions or use a backend without execution support\\.","errorType":"exception","errorClass":"NotImplementedError","httpStatus":null,"severity":"error","filePath":"libs/deepagents/deepagents/middleware/filesystem.py","lineNumber":1724,"sourceCode":"        if callable(self.backend) and not isinstance(self.backend, BackendProtocol):\n            msg = (\n                \"backend must be an initialized backend instance. Backend factories \"\n                \"were removed in deepagents 0.7; pass StateBackend(), \"\n                \"CompositeBackend(...), or another BackendProtocol instance instead.\"\n            )\n            raise TypeError(msg)\n        self.state_schema = cast(\n            \"type[FilesystemState]\",\n            FilesystemState if _uses_state_backend(self.backend) else AgentState,\n        )\n        if _permissions and supports_execution(self.backend) and not _all_paths_scoped_to_routes(_permissions, self.backend):\n            msg = (\n                \"FilesystemMiddleware does not yet support permissions with backends that \"\n                \"provide command execution (SandboxBackendProtocol). Tool-level permissions \"\n                \"for the execute tool are not implemented. Either remove permissions or use \"\n                \"a backend without execution support.\"\n            )\n            raise NotImplementedError(msg)\n\n        artifacts_root = self.backend.artifacts_root if isinstance(self.backend, CompositeBackend) else \"/\"\n        _root = artifacts_root.rstrip(\"/\")\n        self._large_tool_results_prefix = f\"{_root}/large_tool_results\"\n        self._conversation_history_prefix = f\"{_root}/conversation_history\"\n\n        # Store configuration (private - internal implementation details)\n        self._custom_system_prompt = system_prompt\n        self._custom_tool_descriptions = custom_tool_descriptions or {}\n        self._tool_token_limit_before_evict = tool_token_limit_before_evict\n        self._human_message_token_limit_before_evict = human_message_token_limit_before_evict\n        self._max_execute_timeout = max_execute_timeout\n        self._grep_max_count = grep_max_count\n        if isinstance(tools, list):\n            self._enabled_tools: frozenset[str] | None = frozenset(tools)\n        elif tools == \"all\":\n            self._enabled_tools = frozenset(_ALL_FS_TOOL_NAMES)\n        else:  # None -- user did not specify, defaults to all tools opted-in","sourceCodeStart":1706,"sourceCodeEnd":1742,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/deepagents/deepagents/middleware/filesystem.py#L1706-L1742","documentation":"FilesystemMiddleware raises NotImplementedError when both custom permissions and an execution-capable backend (SandboxBackendProtocol) are used together. Tool-level permissions for the execute tool are not yet implemented, so the combination is unsupported rather than silently unenforced.","triggerScenarios":"Calling FilesystemMiddleware(permissions=..., backend=SandboxBackend(...)) (or any backend satisfying SandboxBackendProtocol) where the permissions are not all scoped to routes.","commonSituations":"Developers wanting to sandbox command execution while restricting file access via permissions; the sandbox backend provides execute, which permissions cannot yet gate.","solutions":["Remove the permissions argument when using an execution-capable backend","Use a backend without execution support (e.g. StateBackend) if permissions are required","Scope all permission paths to routes if that satisfies the _all_paths_scoped_to_routes check","Wait for/track upstream support for execute-tool permissions"],"exampleFix":"// before\nmw = FilesystemMiddleware(permissions=my_permissions, backend=SandboxBackend())\n// after\nmw = FilesystemMiddleware(backend=SandboxBackend())  # permissions dropped, or use StateBackend with permissions","handlingStrategy":"validation","validationCode":"from deepagents.backends import supports_execution\n\ndef check_permissions_backend_combo(permissions, backend):\n    if permissions and supports_execution(backend):\n        raise NotImplementedError(\"Permissions are unsupported with execution-capable backends\")","typeGuard":"def combo_supported(permissions, backend) -> bool:\n    return not (permissions and supports_execution(backend))","tryCatchPattern":"try:\n    mw = FilesystemMiddleware(permissions=perms, backend=backend)\nexcept NotImplementedError:\n    logger.warning(\"Permissions unsupported with execution backend; dropping permissions\")\n    mw = FilesystemMiddleware(backend=backend)","preventionTips":["Decide upfront: either permissions or an execution backend, not both","Check supports_execution(backend) before wiring permissions","Track upstream releases for execute-tool permission support"],"tags":["python","not-implemented","permissions","sandbox"],"backgroundTag":"unsupported-feature-combination","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}