deepagents 1.10.8 → 1.11.0

package/README.md

@@ -107,6 +107,23 @@ const agent = createDeepAgent({
 });
 ```
 
+A string is placed before the built-in Deep Agent prompt. For full control over
+prompt assembly, provide a structured configuration:
+
+```typescript
+const agent = createDeepAgent({
+  systemPrompt: {
+    prefix: "You are the support assistant for Acme.",
+    base: null, // Remove the built-in Deep Agent prompt.
+    suffix: "Follow Acme's escalation policy.",
+  },
+});
+```
+
+Structured prompts are assembled as `prefix` → `base` → `suffix`, followed by
+any model-specific harness profile suffix. Omit `base` to retain the active
+base prompt, or set it to `null` to remove the base entirely.
+
 See the [JavaScript Deep Agents docs](https://docs.langchain.com/oss/javascript/deepagents/overview) for full configuration options.
 
 ## LangGraph Native

package/dist/{agent-DsjC63Eg.d.cts → agent-CBuaNmw7.d.cts}

@@ -93,6 +93,13 @@ interface BackendProtocolV1 {
    * @returns EditResult with error, path, filesUpdate, and occurrences
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): MaybePromise<EditResult>;
+  /**
+   * Delete a single file.
+   *
+   * @param filePath - Absolute path to the file to delete
+   * @returns DeleteResult with path on success or error on failure
+   */
+  delete?(filePath: string): MaybePromise<DeleteResult>;
   /**
    * Upload multiple files.
    * Optional - backends that don't support file upload can omit this.
@@ -192,6 +199,14 @@ interface BackendProtocolV2 extends Omit<BackendProtocolV1, "read" | "readRaw" |
    * @returns GlobResult with list of FileInfo objects matching the pattern on success or error on failure
    */
   glob(pattern: string, path?: string): MaybePromise<GlobResult>;
+  /**
+   * Delete a single file.
+   * Optional - backends that don't support file deletion can omit this.
+   *
+   * @param filePath - Absolute path to the file to delete
+   * @returns DeleteResult with path on success or error on failure
+   */
+  delete?(filePath: string): MaybePromise<DeleteResult>;
 }
 /**
  * Protocol for sandboxed backends with isolated runtime.
@@ -385,6 +400,15 @@ interface EditResult {
   /** Metadata for the edit operation, attached to the ToolMessage */
   metadata?: Record<string, unknown>;
 }
+/**
+ * Result from backend delete operations.
+ */
+interface DeleteResult {
+  /** Error message on failure, undefined on success */
+  error?: string;
+  /** File path of deleted file, undefined on failure */
+  path?: string;
+}
 /**
  * Result of code execution.
  * Simplified schema optimized for LLM consumption.
@@ -737,6 +761,11 @@ interface FilesystemPermission {
  * collisions with user-supplied tools at construction time.
  */
 declare const FILESYSTEM_TOOL_NAMES: readonly ["ls", "read_file", "write_file", "edit_file", "glob", "grep", "execute"];
+/**
+ * Built-in filesystem tool names accepted by
+ * {@link createFilesystemMiddleware}'s `tools` allowlist.
+ */
+type FsToolName = (typeof FILESYSTEM_TOOL_NAMES)[number];
 /**
  * Type for the files state record.
  */
@@ -751,10 +780,46 @@ type FilesRecordUpdate = Record<string, FileData | null>;
 interface FilesystemMiddlewareOptions {
   /** Backend instance or factory (default: StateBackend) */
   backend?: AnyBackendProtocol | BackendFactory;
-  /** Optional custom system prompt override */
+  /**
+   * Optional filesystem-specific system prompt override.
+   *
+   * When omitted, the middleware generates a prompt that reflects the tools
+   * visible for the current model request. Supplying a custom prompt replaces
+   * that generated filesystem prompt entirely.
+   */
   systemPrompt?: string | null;
-  /** Optional custom tool descriptions override */
-  customToolDescriptions?: Record<string, string> | null;
+  /**
+   * Optional descriptions for built-in filesystem tools.
+   *
+   * Keys correspond to {@link FsToolName}. Descriptions for tools that are not
+   * enabled by the `tools` allowlist are ignored because those tools are not
+   * exposed to the model.
+   */
+  customToolDescriptions?: Partial<Record<FsToolName, string>> | null;
+  /**
+   * Allowlist of built-in filesystem tools to expose to the model.
+   *
+   * - `undefined`, `null`, and `"all"` preserve the default behavior: every
+   *   filesystem tool is registered, subject to backend capability filtering.
+   * - Passing an array restricts the middleware to only those tool names.
+   * - `read_file` must be included in every explicit array because it is used
+   *   by normal file-inspection flows and by large-result recovery guidance.
+   * - Backend capability checks still narrow the final visible tool set. For
+   *   example, `execute` is removed when the resolved backend does not support
+   *   command execution, even if it appears in this allowlist.
+   * - User-provided non-filesystem tools are not affected by this allowlist.
+   *
+   * The generated filesystem system prompt is based on the tools that remain
+   * visible after this allowlist and backend capability filtering are applied.
+   *
+   * @example Read/search-only filesystem access
+   * ```ts
+   * createFilesystemMiddleware({
+   *   tools: ["read_file", "ls", "glob", "grep"],
+   * });
+   * ```
+   */
+  tools?: readonly FsToolName[] | "all" | null;
   /** Optional token limit before evicting a tool result to the filesystem (default: 20000 tokens, ~80KB) */
   toolTokenLimitBeforeEvict?: number | null;
   /** Optional token limit before evicting a HumanMessage to the filesystem (default: 50000 tokens, ~200KB) */
@@ -769,15 +834,42 @@ interface FilesystemMiddlewareOptions {
    * **Note on `execute`**: permissions are not enforced on `execute` because
    * shell commands can access any path regardless of path-based rules. Using
    * permissions with an execution-capable backend (one where `isSandboxBackend`
-   * returns `true`) throws a `ConfigurationError` unless the backend is a
-   * `CompositeBackend` and every permission path is scoped to a route prefix.
+   * returns `true`) throws a `ConfigurationError` unless either:
+   *
+   * - `execute` is disabled via `tools`, or
+   * - the backend is a `CompositeBackend` and every permission path is scoped to
+   *   a route prefix.
    *
    * When omitted or empty, all filesystem operations are permitted.
    */
   permissions?: FilesystemPermission[];
 }
 /**
- * Create filesystem middleware with all tools and features.
+ * Create middleware that provides built-in filesystem tools and filesystem-aware
+ * prompt guidance.
+ *
+ * By default, the middleware registers every built-in filesystem tool listed in
+ * {@link FILESYSTEM_TOOL_NAMES}. Use {@link FilesystemMiddlewareOptions.tools}
+ * to narrow that set for read-only, search-only, or otherwise restricted
+ * agents. The allowlist only controls built-in filesystem tools; custom tools
+ * from the agent or other middleware are left untouched.
+ *
+ * The middleware also filters tools whose backend capabilities are unavailable
+ * at request time. In particular, `execute` is only visible when the resolved
+ * backend supports command execution. The filesystem prompt is generated from
+ * the final visible filesystem tools so the model is not instructed to call
+ * tools it cannot see.
+ *
+ * @param options Filesystem middleware configuration.
+ * @returns Agent middleware that contributes filesystem state, tools, prompt
+ * guidance, permission checks, and large-result eviction.
+ *
+ * @example Read-only filesystem middleware
+ * ```ts
+ * const middleware = createFilesystemMiddleware({
+ *   tools: ["read_file", "ls", "glob", "grep"],
+ * });
+ * ```
  */
 declare function createFilesystemMiddleware(options?: FilesystemMiddlewareOptions): AgentMiddleware<StateSchema<{
   files: ReducedValue<FilesRecord | undefined, FilesRecordUpdate | undefined>;
@@ -1584,7 +1676,8 @@ declare class StateBackend implements BackendProtocolV2 {
    * In legacy mode, this is a no-op — the caller uses `filesUpdate`
    * from the return value instead.
    *
-   * @param update - Map of file paths to their updated {@link FileData}
+   * @param update - Map of file paths to their updated {@link FileData},
+   *   or null deletion markers.
    */
   private sendFilesUpdate;
   /**
@@ -1624,6 +1717,10 @@ declare class StateBackend implements BackendProtocolV2 {
    * Returns EditResult with filesUpdate and occurrences.
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): EditResult;
+  /**
+   * Delete a file from state by sending a null deletion marker through Pregel.
+   */
+  delete(filePath: string): DeleteResult;
   /**
    * Search file contents for a literal text pattern.
    * Binary files are skipped.
@@ -2490,6 +2587,25 @@ type InferSubagentByName<T, TName extends string> = InferDeepAgentSubagents<T> e
  * ```
  */
 type InferSubagentReactAgentType<TSubagent extends SubAgent | CompiledSubAgent> = TSubagent extends CompiledSubAgent ? TSubagent["runnable"] : TSubagent extends SubAgent ? ReactAgent<AgentTypeConfig<ResponseFormatUndefined, undefined, AnyAnnotationRoot, ExtractSubAgentMiddleware<TSubagent>, readonly []>> : never;
+/**
+ * Structured system prompt configuration for {@link createDeepAgent}.
+ *
+ * Prompt parts are assembled in the order `prefix` → `base` → `suffix`,
+ * followed by any model-specific harness profile suffix.
+ */
+interface SystemPromptConfig {
+  /** Content placed before the base prompt. */
+  prefix?: string | SystemMessage | null;
+  /**
+   * Replacement for the active base prompt.
+   *
+   * Omit this field to retain the harness profile base or built-in base prompt.
+   * Set it to `null` to omit the base prompt entirely.
+   */
+  base?: string | SystemMessage | null;
+  /** Content placed after the base prompt and before any harness profile suffix. */
+  suffix?: string | SystemMessage | null;
+}
 /**
  * Configuration parameters for creating a Deep Agent
  * Matches Python's create_deep_agent parameters
@@ -2507,8 +2623,14 @@ interface CreateDeepAgentParams<TResponse extends SupportedResponseFormat = Supp
   model?: BaseLanguageModel | string;
   /** Tools the agent should have access to */
   tools?: TTools | StructuredTool$1[];
-  /** Custom system prompt for the agent. This will be combined with the base agent prompt */
-  systemPrompt?: string | SystemMessage;
+  /**
+   * Custom system instructions for the agent.
+   *
+   * A string or {@link SystemMessage} is placed before the active base prompt.
+   * For more control, provide a {@link SystemPromptConfig} to replace or remove
+   * the base prompt and add content after it.
+   */
+  systemPrompt?: string | SystemMessage | SystemPromptConfig;
   /**
    * Optional schema for custom agent state. Allows you to define custom state properties
    * beyond built-in `messages`, `todos`, and `files`. These properties can be accessed
@@ -3077,6 +3199,13 @@ declare class StoreBackend implements BackendProtocolV2 {
    * Returns EditResult. External storage sets filesUpdate=null.
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+  /**
+   * Delete a file from the store.
+   *
+   * The file path is used as an exact store key. Wildcards are treated
+   * literally and do not expand to multiple entries.
+   */
+  delete(filePath: string): Promise<DeleteResult>;
   /**
    * Search file contents for a literal text pattern.
    * Binary files are skipped.
@@ -3132,6 +3261,15 @@ declare class FilesystemBackend implements BackendProtocolV2 {
    * @throws Error if path traversal detected or path outside root
    */
   private resolvePath;
+  /**
+   * Resolve the concrete path to unlink for a virtual delete operation.
+   *
+   * Virtual-mode path containment is lexical in resolvePath(), so deleting via
+   * that path could follow a symlinked parent outside the virtual root. Resolve
+   * and validate the real parent, then unlink through that real parent path so a
+   * replacement of the original lexical parent cannot redirect the unlink.
+   */
+  private resolveDeletePath;
   /**
    * List files and directories in the specified directory (non-recursive).
    *
@@ -3166,6 +3304,10 @@ declare class FilesystemBackend implements BackendProtocolV2 {
    * Returns EditResult. External storage sets filesUpdate=null.
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+  /**
+   * Delete a file from the filesystem.
+   */
+  delete(filePath: string): Promise<DeleteResult>;
   /**
    * Search for a literal text pattern in files.
    *
@@ -3315,6 +3457,10 @@ declare class CompositeBackend implements BackendProtocolV2 {
    * @returns EditResult with path, occurrences, or error
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+  /**
+   * Delete a file, routing to the appropriate backend.
+   */
+  delete(filePath: string): Promise<DeleteResult>;
   /**
    * Execute a command via the default backend.
    * Execution is not path-specific, so it always delegates to the default backend.
@@ -3373,6 +3519,7 @@ declare class ContextHubBackend implements BackendProtocolV2 {
   glob(pattern: string, _path?: string): Promise<GlobResult>;
   write(filePath: string, content: string): Promise<WriteResult>;
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+  delete(filePath: string): Promise<DeleteResult>;
   uploadFiles(files: Array<[string, Uint8Array]>): Promise<FileUploadResponse[]>;
   downloadFiles(paths: string[]): Promise<FileDownloadResponse[]>;
 }
@@ -3653,6 +3800,12 @@ declare abstract class BaseSandbox implements SandboxBackendProtocolV2 {
    * reclaim buffers before the next large allocation is made.
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+  /**
+   * Delete a file from the sandbox via a server-side rm.
+   *
+   * Uses rm -f, so deleting a path that does not exist succeeds silently.
+   */
+  delete(filePath: string): Promise<DeleteResult>;
 }
 //#endregion
 //#region src/backends/langsmith.d.ts
@@ -3995,5 +4148,5 @@ declare function createDeepAgent<TResponse extends SupportedResponseFormat = Sup
   }, import("zod/v4/core").$strip>>;
 }, import("zod/v4/core").$strip>, undefined, unknown, readonly (ClientTool | ServerTool)[], readonly []>, AgentMiddleware<undefined, undefined, unknown, readonly (ClientTool | ServerTool)[], readonly []>, ...TMiddleware, ...FlattenSubAgentMiddleware<TSubagents>], TTools, TSubagents, TStreamTransformers>>;
 //#endregion
-export { createAsyncSubAgentMiddleware as $, FileInfo as $t, findProjectRoot as A, parseHarnessProfileConfig as At, InferDeepAgentSubagents as B, FilesystemMiddlewareOptions as Bt, parseSkillMetadata as C, SandboxBackendProtocolV2 as Cn, createSubAgent as Ct, Settings as D, HarnessProfileConfigData as Dt, filesValue as E, registerHarnessProfile as Et, DeepAgent as F, HarnessProfile as Ft, InferSubagentReactAgentType as G, AnyBackendProtocol as Gt, InferStructuredResponse as H, FilesystemOperation as Ht, DeepAgentTypeConfig as I, HarnessProfileOptions as It, SupportedResponseFormat as J, BackendRuntime as Jt, MergedDeepAgentState as K, BackendFactory as Kt, DefaultDeepAgentTypeConfig as L, REQUIRED_MIDDLEWARE_NAMES as Lt, SubagentRunStream$1 as M, EMPTY_HARNESS_PROFILE as Mt, AnySubAgent as N, createHarnessProfile as Nt, SettingsOptions as O, generalPurposeSubagentConfigSchema as Ot, CreateDeepAgentParams as P, GeneralPurposeSubagentConfig as Pt, AsyncTaskStatus as Q, FileDownloadResponse as Qt, ExtractSubAgentMiddleware as R, ConfigurationError as Rt, listSkills as S, BackendProtocolV2 as Sn, TASK_SYSTEM_PROMPT as St, createAgentMemoryMiddleware as T, SandboxBackendProtocolV1 as Tn, getHarnessProfile as Tt, InferSubAgentMiddlewareStates as U, FilesystemPermission as Ut, InferDeepAgentType as V, createFilesystemMiddleware as Vt, InferSubagentByName as W, PermissionMode as Wt, AsyncSubAgentMiddlewareOptions as X, ExecuteResponse as Xt, AsyncSubAgent as Y, EditResult as Yt, AsyncTask as Z, FileData as Zt, StoreBackendContext as _, StateAndStore as _n, DEFAULT_SUBAGENT_PROMPT as _t, adaptBackendProtocol as a, LsResult as an, MAX_SKILL_DESCRIPTION_LENGTH as at, ListSkillsOptions as b, isSandboxProtocol as bn, SubAgent as bt, LangSmithSandboxCreateOptions as c, ReadResult as cn, SkillMetadata$1 as ct, LocalShellBackend as d, SandboxError as dn, MemoryMiddlewareOptions as dt, FileOperationError as en, isAsyncSubAgent as et, LocalShellBackendOptions as f, SandboxErrorCode as fn, createMemoryMiddleware as ft, StoreBackend as g, SandboxListResponse as gn, DEFAULT_GENERAL_PURPOSE_DESCRIPTION as gt, FilesystemBackend as h, SandboxListOptions as hn, CompiledSubAgent as ht, LangSmithStartSandboxOptions as i, GrepResult as in, createCompletionCallbackMiddleware as it, DeepAgentRunStream as j, serializeProfile as jt, createSettings as k, harnessProfileConfigSchema as kt, LangSmithSandboxOptions as l, SandboxBackendProtocol as ln, SkillsMiddlewareOptions as lt, CompositeBackend as m, SandboxInfo as mn, createPatchToolCallsMiddleware as mt, LangSmithCaptureSnapshotOptions as n, GlobResult as nn, createSummarizationMiddleware as nt, adaptSandboxProtocol as o, MaybePromise as on, MAX_SKILL_FILE_SIZE as ot, ContextHubBackend as p, SandboxGetOrCreateOptions as pn, StateBackend as pt, ResolveDeepAgentTypeConfig as q, BackendProtocol as qt, LangSmithSnapshot as r, GrepMatch as rn, CompletionCallbackOptions as rt, LangSmithSandbox as s, ReadRawResult as sn, MAX_SKILL_NAME_LENGTH as st, createDeepAgent as t, FileUploadResponse as tn, computeSummarizationDefaults as tt, BaseSandbox as u, SandboxDeleteOptions as un, createSkillsMiddleware as ut, StoreBackendNamespaceFactory as v, WriteResult as vn, GENERAL_PURPOSE_SUBAGENT as vt, AgentMemoryMiddlewareOptions as w, BackendProtocolV1 as wn, createSubAgentMiddleware as wt, SkillMetadata as x, resolveBackend as xn, SubAgentMiddlewareOptions as xt, StoreBackendOptions as y, isSandboxBackend as yn, SUBAGENT_RESPONSE_FORMAT_CONFIG_KEY as yt, FlattenSubAgentMiddleware as z, ConfigurationErrorCode as zt };
-//# sourceMappingURL=agent-DsjC63Eg.d.cts.map
+export { AsyncTaskStatus as $, ExecuteResponse as $t, findProjectRoot as A, harnessProfileConfigSchema as At, InferDeepAgentSubagents as B, ConfigurationErrorCode as Bt, parseSkillMetadata as C, isSandboxProtocol as Cn, TASK_SYSTEM_PROMPT as Ct, Settings as D, BackendProtocolV1 as Dn, registerHarnessProfile as Dt, filesValue as E, SandboxBackendProtocolV2 as En, getHarnessProfile as Et, DeepAgent as F, GeneralPurposeSubagentConfig as Ft, InferSubagentReactAgentType as G, FilesystemPermission as Gt, InferStructuredResponse as H, FsToolName as Ht, DeepAgentTypeConfig as I, HarnessProfile as It, SupportedResponseFormat as J, BackendFactory as Jt, MergedDeepAgentState as K, PermissionMode as Kt, DefaultDeepAgentTypeConfig as L, HarnessProfileOptions as Lt, SubagentRunStream$1 as M, serializeProfile as Mt, AnySubAgent as N, EMPTY_HARNESS_PROFILE as Nt, SettingsOptions as O, SandboxBackendProtocolV1 as On, HarnessProfileConfigData as Ot, CreateDeepAgentParams as P, createHarnessProfile as Pt, AsyncTask as Q, EditResult as Qt, ExtractSubAgentMiddleware as R, REQUIRED_MIDDLEWARE_NAMES as Rt, listSkills as S, isSandboxBackend as Sn, SubAgentMiddlewareOptions as St, createAgentMemoryMiddleware as T, BackendProtocolV2 as Tn, createSubAgentMiddleware as Tt, InferSubAgentMiddlewareStates as U, createFilesystemMiddleware as Ut, InferDeepAgentType as V, FilesystemMiddlewareOptions as Vt, InferSubagentByName as W, FilesystemOperation as Wt, AsyncSubAgent as X, BackendRuntime as Xt, SystemPromptConfig as Y, BackendProtocol as Yt, AsyncSubAgentMiddlewareOptions as Z, DeleteResult as Zt, StoreBackendContext as _, SandboxInfo as _n, DEFAULT_GENERAL_PURPOSE_DESCRIPTION as _t, adaptBackendProtocol as a, GlobResult as an, createCompletionCallbackMiddleware as at, ListSkillsOptions as b, StateAndStore as bn, SUBAGENT_RESPONSE_FORMAT_CONFIG_KEY as bt, LangSmithSandboxCreateOptions as c, LsResult as cn, MAX_SKILL_NAME_LENGTH as ct, LocalShellBackend as d, ReadResult as dn, createSkillsMiddleware as dt, FileData as en, createAsyncSubAgentMiddleware as et, LocalShellBackendOptions as f, SandboxBackendProtocol as fn, MemoryMiddlewareOptions as ft, StoreBackend as g, SandboxGetOrCreateOptions as gn, CompiledSubAgent as gt, FilesystemBackend as h, SandboxErrorCode as hn, createPatchToolCallsMiddleware as ht, LangSmithStartSandboxOptions as i, FileUploadResponse as in, CompletionCallbackOptions as it, DeepAgentRunStream as j, parseHarnessProfileConfig as jt, createSettings as k, generalPurposeSubagentConfigSchema as kt, LangSmithSandboxOptions as l, MaybePromise as ln, SkillMetadata$1 as lt, CompositeBackend as m, SandboxError as mn, StateBackend as mt, LangSmithCaptureSnapshotOptions as n, FileInfo as nn, computeSummarizationDefaults as nt, adaptSandboxProtocol as o, GrepMatch as on, MAX_SKILL_DESCRIPTION_LENGTH as ot, ContextHubBackend as p, SandboxDeleteOptions as pn, createMemoryMiddleware as pt, ResolveDeepAgentTypeConfig as q, AnyBackendProtocol as qt, LangSmithSnapshot as r, FileOperationError as rn, createSummarizationMiddleware as rt, LangSmithSandbox as s, GrepResult as sn, MAX_SKILL_FILE_SIZE as st, createDeepAgent as t, FileDownloadResponse as tn, isAsyncSubAgent as tt, BaseSandbox as u, ReadRawResult as un, SkillsMiddlewareOptions as ut, StoreBackendNamespaceFactory as v, SandboxListOptions as vn, DEFAULT_SUBAGENT_PROMPT as vt, AgentMemoryMiddlewareOptions as w, resolveBackend as wn, createSubAgent as wt, SkillMetadata as x, WriteResult as xn, SubAgent as xt, StoreBackendOptions as y, SandboxListResponse as yn, GENERAL_PURPOSE_SUBAGENT as yt, FlattenSubAgentMiddleware as z, ConfigurationError as zt };
+//# sourceMappingURL=agent-CBuaNmw7.d.cts.map

package/dist/{agent-DgVtHOV7.d.ts → agent-D0AY-3B9.d.ts}

@@ -94,6 +94,13 @@ interface BackendProtocolV1 {
    * @returns EditResult with error, path, filesUpdate, and occurrences
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): MaybePromise<EditResult>;
+  /**
+   * Delete a single file.
+   *
+   * @param filePath - Absolute path to the file to delete
+   * @returns DeleteResult with path on success or error on failure
+   */
+  delete?(filePath: string): MaybePromise<DeleteResult>;
   /**
    * Upload multiple files.
    * Optional - backends that don't support file upload can omit this.
@@ -193,6 +200,14 @@ interface BackendProtocolV2 extends Omit<BackendProtocolV1, "read" | "readRaw" |
    * @returns GlobResult with list of FileInfo objects matching the pattern on success or error on failure
    */
   glob(pattern: string, path?: string): MaybePromise<GlobResult>;
+  /**
+   * Delete a single file.
+   * Optional - backends that don't support file deletion can omit this.
+   *
+   * @param filePath - Absolute path to the file to delete
+   * @returns DeleteResult with path on success or error on failure
+   */
+  delete?(filePath: string): MaybePromise<DeleteResult>;
 }
 /**
  * Protocol for sandboxed backends with isolated runtime.
@@ -386,6 +401,15 @@ interface EditResult {
   /** Metadata for the edit operation, attached to the ToolMessage */
   metadata?: Record<string, unknown>;
 }
+/**
+ * Result from backend delete operations.
+ */
+interface DeleteResult {
+  /** Error message on failure, undefined on success */
+  error?: string;
+  /** File path of deleted file, undefined on failure */
+  path?: string;
+}
 /**
  * Result of code execution.
  * Simplified schema optimized for LLM consumption.
@@ -738,6 +762,11 @@ interface FilesystemPermission {
  * collisions with user-supplied tools at construction time.
  */
 declare const FILESYSTEM_TOOL_NAMES: readonly ["ls", "read_file", "write_file", "edit_file", "glob", "grep", "execute"];
+/**
+ * Built-in filesystem tool names accepted by
+ * {@link createFilesystemMiddleware}'s `tools` allowlist.
+ */
+type FsToolName = (typeof FILESYSTEM_TOOL_NAMES)[number];
 /**
  * Type for the files state record.
  */
@@ -752,10 +781,46 @@ type FilesRecordUpdate = Record<string, FileData | null>;
 interface FilesystemMiddlewareOptions {
   /** Backend instance or factory (default: StateBackend) */
   backend?: AnyBackendProtocol | BackendFactory;
-  /** Optional custom system prompt override */
+  /**
+   * Optional filesystem-specific system prompt override.
+   *
+   * When omitted, the middleware generates a prompt that reflects the tools
+   * visible for the current model request. Supplying a custom prompt replaces
+   * that generated filesystem prompt entirely.
+   */
   systemPrompt?: string | null;
-  /** Optional custom tool descriptions override */
-  customToolDescriptions?: Record<string, string> | null;
+  /**
+   * Optional descriptions for built-in filesystem tools.
+   *
+   * Keys correspond to {@link FsToolName}. Descriptions for tools that are not
+   * enabled by the `tools` allowlist are ignored because those tools are not
+   * exposed to the model.
+   */
+  customToolDescriptions?: Partial<Record<FsToolName, string>> | null;
+  /**
+   * Allowlist of built-in filesystem tools to expose to the model.
+   *
+   * - `undefined`, `null`, and `"all"` preserve the default behavior: every
+   *   filesystem tool is registered, subject to backend capability filtering.
+   * - Passing an array restricts the middleware to only those tool names.
+   * - `read_file` must be included in every explicit array because it is used
+   *   by normal file-inspection flows and by large-result recovery guidance.
+   * - Backend capability checks still narrow the final visible tool set. For
+   *   example, `execute` is removed when the resolved backend does not support
+   *   command execution, even if it appears in this allowlist.
+   * - User-provided non-filesystem tools are not affected by this allowlist.
+   *
+   * The generated filesystem system prompt is based on the tools that remain
+   * visible after this allowlist and backend capability filtering are applied.
+   *
+   * @example Read/search-only filesystem access
+   * ```ts
+   * createFilesystemMiddleware({
+   *   tools: ["read_file", "ls", "glob", "grep"],
+   * });
+   * ```
+   */
+  tools?: readonly FsToolName[] | "all" | null;
   /** Optional token limit before evicting a tool result to the filesystem (default: 20000 tokens, ~80KB) */
   toolTokenLimitBeforeEvict?: number | null;
   /** Optional token limit before evicting a HumanMessage to the filesystem (default: 50000 tokens, ~200KB) */
@@ -770,15 +835,42 @@ interface FilesystemMiddlewareOptions {
    * **Note on `execute`**: permissions are not enforced on `execute` because
    * shell commands can access any path regardless of path-based rules. Using
    * permissions with an execution-capable backend (one where `isSandboxBackend`
-   * returns `true`) throws a `ConfigurationError` unless the backend is a
-   * `CompositeBackend` and every permission path is scoped to a route prefix.
+   * returns `true`) throws a `ConfigurationError` unless either:
+   *
+   * - `execute` is disabled via `tools`, or
+   * - the backend is a `CompositeBackend` and every permission path is scoped to
+   *   a route prefix.
    *
    * When omitted or empty, all filesystem operations are permitted.
    */
   permissions?: FilesystemPermission[];
 }
 /**
- * Create filesystem middleware with all tools and features.
+ * Create middleware that provides built-in filesystem tools and filesystem-aware
+ * prompt guidance.
+ *
+ * By default, the middleware registers every built-in filesystem tool listed in
+ * {@link FILESYSTEM_TOOL_NAMES}. Use {@link FilesystemMiddlewareOptions.tools}
+ * to narrow that set for read-only, search-only, or otherwise restricted
+ * agents. The allowlist only controls built-in filesystem tools; custom tools
+ * from the agent or other middleware are left untouched.
+ *
+ * The middleware also filters tools whose backend capabilities are unavailable
+ * at request time. In particular, `execute` is only visible when the resolved
+ * backend supports command execution. The filesystem prompt is generated from
+ * the final visible filesystem tools so the model is not instructed to call
+ * tools it cannot see.
+ *
+ * @param options Filesystem middleware configuration.
+ * @returns Agent middleware that contributes filesystem state, tools, prompt
+ * guidance, permission checks, and large-result eviction.
+ *
+ * @example Read-only filesystem middleware
+ * ```ts
+ * const middleware = createFilesystemMiddleware({
+ *   tools: ["read_file", "ls", "glob", "grep"],
+ * });
+ * ```
  */
 declare function createFilesystemMiddleware(options?: FilesystemMiddlewareOptions): AgentMiddleware<StateSchema<{
   files: ReducedValue<FilesRecord | undefined, FilesRecordUpdate | undefined>;
@@ -1585,7 +1677,8 @@ declare class StateBackend implements BackendProtocolV2 {
    * In legacy mode, this is a no-op — the caller uses `filesUpdate`
    * from the return value instead.
    *
-   * @param update - Map of file paths to their updated {@link FileData}
+   * @param update - Map of file paths to their updated {@link FileData},
+   *   or null deletion markers.
    */
   private sendFilesUpdate;
   /**
@@ -1625,6 +1718,10 @@ declare class StateBackend implements BackendProtocolV2 {
    * Returns EditResult with filesUpdate and occurrences.
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): EditResult;
+  /**
+   * Delete a file from state by sending a null deletion marker through Pregel.
+   */
+  delete(filePath: string): DeleteResult;
   /**
    * Search file contents for a literal text pattern.
    * Binary files are skipped.
@@ -2491,6 +2588,25 @@ type InferSubagentByName<T, TName extends string> = InferDeepAgentSubagents<T> e
  * ```
  */
 type InferSubagentReactAgentType<TSubagent extends SubAgent | CompiledSubAgent> = TSubagent extends CompiledSubAgent ? TSubagent["runnable"] : TSubagent extends SubAgent ? ReactAgent<AgentTypeConfig<ResponseFormatUndefined, undefined, AnyAnnotationRoot, ExtractSubAgentMiddleware<TSubagent>, readonly []>> : never;
+/**
+ * Structured system prompt configuration for {@link createDeepAgent}.
+ *
+ * Prompt parts are assembled in the order `prefix` → `base` → `suffix`,
+ * followed by any model-specific harness profile suffix.
+ */
+interface SystemPromptConfig {
+  /** Content placed before the base prompt. */
+  prefix?: string | SystemMessage | null;
+  /**
+   * Replacement for the active base prompt.
+   *
+   * Omit this field to retain the harness profile base or built-in base prompt.
+   * Set it to `null` to omit the base prompt entirely.
+   */
+  base?: string | SystemMessage | null;
+  /** Content placed after the base prompt and before any harness profile suffix. */
+  suffix?: string | SystemMessage | null;
+}
 /**
  * Configuration parameters for creating a Deep Agent
  * Matches Python's create_deep_agent parameters
@@ -2508,8 +2624,14 @@ interface CreateDeepAgentParams<TResponse extends SupportedResponseFormat = Supp
   model?: BaseLanguageModel | string;
   /** Tools the agent should have access to */
   tools?: TTools | StructuredTool$1[];
-  /** Custom system prompt for the agent. This will be combined with the base agent prompt */
-  systemPrompt?: string | SystemMessage;
+  /**
+   * Custom system instructions for the agent.
+   *
+   * A string or {@link SystemMessage} is placed before the active base prompt.
+   * For more control, provide a {@link SystemPromptConfig} to replace or remove
+   * the base prompt and add content after it.
+   */
+  systemPrompt?: string | SystemMessage | SystemPromptConfig;
   /**
    * Optional schema for custom agent state. Allows you to define custom state properties
    * beyond built-in `messages`, `todos`, and `files`. These properties can be accessed
@@ -3078,6 +3200,13 @@ declare class StoreBackend implements BackendProtocolV2 {
    * Returns EditResult. External storage sets filesUpdate=null.
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+  /**
+   * Delete a file from the store.
+   *
+   * The file path is used as an exact store key. Wildcards are treated
+   * literally and do not expand to multiple entries.
+   */
+  delete(filePath: string): Promise<DeleteResult>;
   /**
    * Search file contents for a literal text pattern.
    * Binary files are skipped.
@@ -3133,6 +3262,15 @@ declare class FilesystemBackend implements BackendProtocolV2 {
    * @throws Error if path traversal detected or path outside root
    */
   private resolvePath;
+  /**
+   * Resolve the concrete path to unlink for a virtual delete operation.
+   *
+   * Virtual-mode path containment is lexical in resolvePath(), so deleting via
+   * that path could follow a symlinked parent outside the virtual root. Resolve
+   * and validate the real parent, then unlink through that real parent path so a
+   * replacement of the original lexical parent cannot redirect the unlink.
+   */
+  private resolveDeletePath;
   /**
    * List files and directories in the specified directory (non-recursive).
    *
@@ -3167,6 +3305,10 @@ declare class FilesystemBackend implements BackendProtocolV2 {
    * Returns EditResult. External storage sets filesUpdate=null.
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+  /**
+   * Delete a file from the filesystem.
+   */
+  delete(filePath: string): Promise<DeleteResult>;
   /**
    * Search for a literal text pattern in files.
    *
@@ -3316,6 +3458,10 @@ declare class CompositeBackend implements BackendProtocolV2 {
    * @returns EditResult with path, occurrences, or error
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+  /**
+   * Delete a file, routing to the appropriate backend.
+   */
+  delete(filePath: string): Promise<DeleteResult>;
   /**
    * Execute a command via the default backend.
    * Execution is not path-specific, so it always delegates to the default backend.
@@ -3374,6 +3520,7 @@ declare class ContextHubBackend implements BackendProtocolV2 {
   glob(pattern: string, _path?: string): Promise<GlobResult>;
   write(filePath: string, content: string): Promise<WriteResult>;
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+  delete(filePath: string): Promise<DeleteResult>;
   uploadFiles(files: Array<[string, Uint8Array]>): Promise<FileUploadResponse[]>;
   downloadFiles(paths: string[]): Promise<FileDownloadResponse[]>;
 }
@@ -3654,6 +3801,12 @@ declare abstract class BaseSandbox implements SandboxBackendProtocolV2 {
    * reclaim buffers before the next large allocation is made.
    */
   edit(filePath: string, oldString: string, newString: string, replaceAll?: boolean): Promise<EditResult>;
+  /**
+   * Delete a file from the sandbox via a server-side rm.
+   *
+   * Uses rm -f, so deleting a path that does not exist succeeds silently.
+   */
+  delete(filePath: string): Promise<DeleteResult>;
 }
 //#endregion
 //#region src/backends/langsmith.d.ts
@@ -3996,5 +4149,5 @@ declare function createDeepAgent<TResponse extends SupportedResponseFormat = Sup
   }, import("zod/v4/core").$strip>>;
 }, import("zod/v4/core").$strip>, undefined, unknown, readonly (ClientTool | ServerTool)[], readonly []>, AgentMiddleware<undefined, undefined, unknown, readonly (ClientTool | ServerTool)[], readonly []>, ...TMiddleware, ...FlattenSubAgentMiddleware<TSubagents>], TTools, TSubagents, TStreamTransformers>>;
 //#endregion
-export { createAsyncSubAgentMiddleware as $, FileInfo as $t, findProjectRoot as A, parseHarnessProfileConfig as At, InferDeepAgentSubagents as B, FilesystemMiddlewareOptions as Bt, parseSkillMetadata as C, SandboxBackendProtocolV2 as Cn, createSubAgent as Ct, Settings as D, HarnessProfileConfigData as Dt, filesValue as E, registerHarnessProfile as Et, DeepAgent as F, HarnessProfile as Ft, InferSubagentReactAgentType as G, AnyBackendProtocol as Gt, InferStructuredResponse as H, FilesystemOperation as Ht, DeepAgentTypeConfig as I, HarnessProfileOptions as It, SupportedResponseFormat as J, BackendRuntime as Jt, MergedDeepAgentState as K, BackendFactory as Kt, DefaultDeepAgentTypeConfig as L, REQUIRED_MIDDLEWARE_NAMES as Lt, SubagentRunStream$1 as M, EMPTY_HARNESS_PROFILE as Mt, AnySubAgent as N, createHarnessProfile as Nt, SettingsOptions as O, generalPurposeSubagentConfigSchema as Ot, CreateDeepAgentParams as P, GeneralPurposeSubagentConfig as Pt, AsyncTaskStatus as Q, FileDownloadResponse as Qt, ExtractSubAgentMiddleware as R, ConfigurationError as Rt, listSkills as S, BackendProtocolV2 as Sn, TASK_SYSTEM_PROMPT as St, createAgentMemoryMiddleware as T, SandboxBackendProtocolV1 as Tn, getHarnessProfile as Tt, InferSubAgentMiddlewareStates as U, FilesystemPermission as Ut, InferDeepAgentType as V, createFilesystemMiddleware as Vt, InferSubagentByName as W, PermissionMode as Wt, AsyncSubAgentMiddlewareOptions as X, ExecuteResponse as Xt, AsyncSubAgent as Y, EditResult as Yt, AsyncTask as Z, FileData as Zt, StoreBackendContext as _, StateAndStore as _n, DEFAULT_SUBAGENT_PROMPT as _t, adaptBackendProtocol as a, LsResult as an, MAX_SKILL_DESCRIPTION_LENGTH as at, ListSkillsOptions as b, isSandboxProtocol as bn, SubAgent as bt, LangSmithSandboxCreateOptions as c, ReadResult as cn, SkillMetadata$1 as ct, LocalShellBackend as d, SandboxError as dn, MemoryMiddlewareOptions as dt, FileOperationError as en, isAsyncSubAgent as et, LocalShellBackendOptions as f, SandboxErrorCode as fn, createMemoryMiddleware as ft, StoreBackend as g, SandboxListResponse as gn, DEFAULT_GENERAL_PURPOSE_DESCRIPTION as gt, FilesystemBackend as h, SandboxListOptions as hn, CompiledSubAgent as ht, LangSmithStartSandboxOptions as i, GrepResult as in, createCompletionCallbackMiddleware as it, DeepAgentRunStream as j, serializeProfile as jt, createSettings as k, harnessProfileConfigSchema as kt, LangSmithSandboxOptions as l, SandboxBackendProtocol as ln, SkillsMiddlewareOptions as lt, CompositeBackend as m, SandboxInfo as mn, createPatchToolCallsMiddleware as mt, LangSmithCaptureSnapshotOptions as n, GlobResult as nn, createSummarizationMiddleware as nt, adaptSandboxProtocol as o, MaybePromise as on, MAX_SKILL_FILE_SIZE as ot, ContextHubBackend as p, SandboxGetOrCreateOptions as pn, StateBackend as pt, ResolveDeepAgentTypeConfig as q, BackendProtocol as qt, LangSmithSnapshot as r, GrepMatch as rn, CompletionCallbackOptions as rt, LangSmithSandbox as s, ReadRawResult as sn, MAX_SKILL_NAME_LENGTH as st, createDeepAgent as t, FileUploadResponse as tn, computeSummarizationDefaults as tt, BaseSandbox as u, SandboxDeleteOptions as un, createSkillsMiddleware as ut, StoreBackendNamespaceFactory as v, WriteResult as vn, GENERAL_PURPOSE_SUBAGENT as vt, AgentMemoryMiddlewareOptions as w, BackendProtocolV1 as wn, createSubAgentMiddleware as wt, SkillMetadata as x, resolveBackend as xn, SubAgentMiddlewareOptions as xt, StoreBackendOptions as y, isSandboxBackend as yn, SUBAGENT_RESPONSE_FORMAT_CONFIG_KEY as yt, FlattenSubAgentMiddleware as z, ConfigurationErrorCode as zt };
-//# sourceMappingURL=agent-DgVtHOV7.d.ts.map
+export { AsyncTaskStatus as $, ExecuteResponse as $t, findProjectRoot as A, harnessProfileConfigSchema as At, InferDeepAgentSubagents as B, ConfigurationErrorCode as Bt, parseSkillMetadata as C, isSandboxProtocol as Cn, TASK_SYSTEM_PROMPT as Ct, Settings as D, BackendProtocolV1 as Dn, registerHarnessProfile as Dt, filesValue as E, SandboxBackendProtocolV2 as En, getHarnessProfile as Et, DeepAgent as F, GeneralPurposeSubagentConfig as Ft, InferSubagentReactAgentType as G, FilesystemPermission as Gt, InferStructuredResponse as H, FsToolName as Ht, DeepAgentTypeConfig as I, HarnessProfile as It, SupportedResponseFormat as J, BackendFactory as Jt, MergedDeepAgentState as K, PermissionMode as Kt, DefaultDeepAgentTypeConfig as L, HarnessProfileOptions as Lt, SubagentRunStream$1 as M, serializeProfile as Mt, AnySubAgent as N, EMPTY_HARNESS_PROFILE as Nt, SettingsOptions as O, SandboxBackendProtocolV1 as On, HarnessProfileConfigData as Ot, CreateDeepAgentParams as P, createHarnessProfile as Pt, AsyncTask as Q, EditResult as Qt, ExtractSubAgentMiddleware as R, REQUIRED_MIDDLEWARE_NAMES as Rt, listSkills as S, isSandboxBackend as Sn, SubAgentMiddlewareOptions as St, createAgentMemoryMiddleware as T, BackendProtocolV2 as Tn, createSubAgentMiddleware as Tt, InferSubAgentMiddlewareStates as U, createFilesystemMiddleware as Ut, InferDeepAgentType as V, FilesystemMiddlewareOptions as Vt, InferSubagentByName as W, FilesystemOperation as Wt, AsyncSubAgent as X, BackendRuntime as Xt, SystemPromptConfig as Y, BackendProtocol as Yt, AsyncSubAgentMiddlewareOptions as Z, DeleteResult as Zt, StoreBackendContext as _, SandboxInfo as _n, DEFAULT_GENERAL_PURPOSE_DESCRIPTION as _t, adaptBackendProtocol as a, GlobResult as an, createCompletionCallbackMiddleware as at, ListSkillsOptions as b, StateAndStore as bn, SUBAGENT_RESPONSE_FORMAT_CONFIG_KEY as bt, LangSmithSandboxCreateOptions as c, LsResult as cn, MAX_SKILL_NAME_LENGTH as ct, LocalShellBackend as d, ReadResult as dn, createSkillsMiddleware as dt, FileData as en, createAsyncSubAgentMiddleware as et, LocalShellBackendOptions as f, SandboxBackendProtocol as fn, MemoryMiddlewareOptions as ft, StoreBackend as g, SandboxGetOrCreateOptions as gn, CompiledSubAgent as gt, FilesystemBackend as h, SandboxErrorCode as hn, createPatchToolCallsMiddleware as ht, LangSmithStartSandboxOptions as i, FileUploadResponse as in, CompletionCallbackOptions as it, DeepAgentRunStream as j, parseHarnessProfileConfig as jt, createSettings as k, generalPurposeSubagentConfigSchema as kt, LangSmithSandboxOptions as l, MaybePromise as ln, SkillMetadata$1 as lt, CompositeBackend as m, SandboxError as mn, StateBackend as mt, LangSmithCaptureSnapshotOptions as n, FileInfo as nn, computeSummarizationDefaults as nt, adaptSandboxProtocol as o, GrepMatch as on, MAX_SKILL_DESCRIPTION_LENGTH as ot, ContextHubBackend as p, SandboxDeleteOptions as pn, createMemoryMiddleware as pt, ResolveDeepAgentTypeConfig as q, AnyBackendProtocol as qt, LangSmithSnapshot as r, FileOperationError as rn, createSummarizationMiddleware as rt, LangSmithSandbox as s, GrepResult as sn, MAX_SKILL_FILE_SIZE as st, createDeepAgent as t, FileDownloadResponse as tn, isAsyncSubAgent as tt, BaseSandbox as u, ReadRawResult as un, SkillsMiddlewareOptions as ut, StoreBackendNamespaceFactory as v, SandboxListOptions as vn, DEFAULT_SUBAGENT_PROMPT as vt, AgentMemoryMiddlewareOptions as w, resolveBackend as wn, createSubAgent as wt, SkillMetadata as x, WriteResult as xn, SubAgent as xt, StoreBackendOptions as y, SandboxListResponse as yn, GENERAL_PURPOSE_SUBAGENT as yt, FlattenSubAgentMiddleware as z, ConfigurationError as zt };
+//# sourceMappingURL=agent-D0AY-3B9.d.ts.map

package/dist/browser.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_langsmith = require("./langsmith-CiAeUke2.cjs");
+const require_langsmith = require("./langsmith-DDhVumyX.cjs");
 exports.BaseSandbox = require_langsmith.BaseSandbox;
 exports.CompositeBackend = require_langsmith.CompositeBackend;
 exports.ConfigurationError = require_langsmith.ConfigurationError;