deepagents 1.10.8 → 1.11.1

package/dist/{langsmith-DjCMSywL.js → langsmith-DVh4u6Za.js}

@@ -470,7 +470,7 @@ function migrateToFileDataV2(data, filePath) {
 * @returns BackendProtocolV2-compatible backend
 */
 function adaptBackendProtocol(backend) {
-	return {
+	const adapted = {
 		async ls(path) {
 			const result = await ("ls" in backend ? backend.ls(path) : backend.lsInfo(path));
 			if (Array.isArray(result)) return { files: result };
@@ -488,6 +488,7 @@ function adaptBackendProtocol(backend) {
 		},
 		write: (filePath, content) => backend.write(filePath, content),
 		edit: (filePath, oldString, newString, replaceAll) => backend.edit(filePath, oldString, newString, replaceAll),
+		delete: backend.delete?.bind(backend),
 		uploadFiles: backend.uploadFiles ? (files) => backend.uploadFiles(files) : void 0,
 		downloadFiles: backend.downloadFiles ? (paths) => backend.downloadFiles(paths) : void 0,
 		async read(filePath, offset, limit) {
@@ -502,6 +503,13 @@ function adaptBackendProtocol(backend) {
 			return result;
 		}
 	};
+	const routePrefixes = backend.routePrefixes;
+	if (Array.isArray(routePrefixes)) Object.defineProperty(adapted, "routePrefixes", {
+		value: routePrefixes,
+		enumerable: true,
+		configurable: true
+	});
+	return adapted;
 }
 /**
 * Adapt a sandbox backend from v1 to v2 interface.
@@ -669,7 +677,8 @@ var StateBackend = class {
 	* In legacy mode, this is a no-op — the caller uses `filesUpdate`
 	* from the return value instead.
 	*
-	* @param update - Map of file paths to their updated {@link FileData}
+	* @param update - Map of file paths to their updated {@link FileData},
+	*   or null deletion markers.
 	*/
 	sendFilesUpdate(update) {
 		if (this.isLegacy) return;
@@ -793,6 +802,15 @@ var StateBackend = class {
 		};
 	}
 	/**
+	* Delete a file from state by sending a null deletion marker through Pregel.
+	*/
+	delete(filePath) {
+		if (!(filePath in this.files)) return { error: `Error: File '${filePath}' not found` };
+		if (this.isLegacy) return { error: "StateBackend.delete requires a zero-argument StateBackend in a LangGraph execution context." };
+		this.sendFilesUpdate({ [filePath]: null });
+		return { path: filePath };
+	}
+	/**
 	* Search file contents for a literal text pattern.
 	* Binary files are skipped.
 	*/
@@ -1159,6 +1177,19 @@ var CompositeBackend = class {
 		return await backend.edit(strippedKey, oldString, newString, replaceAll);
 	}
 	/**
+	* Delete a file, routing to the appropriate backend.
+	*/
+	async delete(filePath) {
+		const [backend, strippedKey] = this.getBackendAndKey(filePath);
+		if (!backend.delete) return { error: "Backend does not support delete" };
+		const result = await backend.delete(strippedKey);
+		if (result.path !== void 0) return {
+			...result,
+			path: filePath
+		};
+		return result;
+	}
+	/**
 	* Execute a command via the default backend.
 	* Execution is not path-specific, so it always delegates to the default backend.
 	*
@@ -1300,14 +1331,10 @@ const FILESYSTEM_TOOL_NAMES = [
 	"grep",
 	"execute"
 ];
-const TOOLS_EXCLUDED_FROM_EVICTION = [
-	"ls",
-	"glob",
-	"grep",
-	"read_file",
-	"edit_file",
-	"write_file"
-];
+function isFilesystemToolName(name) {
+	return typeof name === "string" && FILESYSTEM_TOOL_NAMES.includes(name);
+}
+const TOOLS_EXCLUDED_FROM_EVICTION = FILESYSTEM_TOOL_NAMES.filter((name) => name !== "execute");
 /**
 * Maximum size for binary (non-text) files read via read_file, in bytes.
 * Base64-encoded content is ~33% larger, so 10MB raw ≈ 13.3MB in context.
@@ -1475,19 +1502,46 @@ const FilesystemStateSchema = new StateSchema({ files: new ReducedValue(z.record
 	inputSchema: z.record(z.string(), FileDataSchema.nullable()).optional(),
 	reducer: fileDataReducer
 }) });
+/** Extract a message string from an unknown thrown value without `instanceof`. */
+function getErrorMessage$1(error) {
+	if (typeof error === "object" && error !== null && "message" in error && typeof error.message === "string") return error.message;
+	return String(error);
+}
 /**
-* Throw a permission-denied error if `path` is denied under `rules`.
+* Check whether `path` is permitted under `rules` for `operation`, returning an
+* error string to surface to the model (or `undefined` when allowed).
 *
-* No-op when `rules` is empty (permissive default). Paths that fail
-* `validatePath` are silently skipped — the tool's own input validation
-* will surface a better error.
+* Never throws: an invalid path (non-absolute, or containing `..` or `~`) or a
+* denied path is a recoverable tool error, not a fatal run-ending one. Such
+* paths are rejected, never normalized, so they cannot bypass a deny rule or
+* reach the backend.
 *
 * @internal
 */
-function enforcePermission(rules, operation, path) {
+function checkPermission(rules, operation, path) {
 	if (rules.length === 0) return;
-	const canonical = validatePath(path);
-	if (decidePathAccess(rules, operation, canonical) === "deny") throw new Error(`Error: permission denied for ${operation} on ${canonical}`);
+	let canonical;
+	try {
+		canonical = validatePath(path);
+	} catch (error) {
+		return `Error: ${getErrorMessage$1(error)}`;
+	}
+	if (decidePathAccess(rules, operation, canonical) === "deny") return `Error: permission denied for ${operation} on ${canonical}`;
+}
+/**
+* Build an error {@link ToolMessage} for a rejected or denied path. Returning a
+* bare string would be wrapped as a `status: "success"` message whose content
+* merely starts with "Error:"; marking `status: "error"` reports the failure
+* accurately so callers and the model can distinguish a real failure from a
+* successful result.
+*/
+function toolError(runtime, toolName, message) {
+	return new ToolMessage({
+		content: message,
+		name: toolName,
+		tool_call_id: runtime.toolCall?.id,
+		status: "error"
+	});
 }
 /**
 * Filter a list of filesystem entries to those the rules permit.
@@ -1508,24 +1562,33 @@ function filterByPermissions(entries, rules, operation, getPath) {
 		}
 	});
 }
-const FILESYSTEM_SYSTEM_PROMPT = context`
-  ## Following Conventions
+const FILESYSTEM_TOOL_DESCRIPTION_LINES = {
+	ls: "ls: list files in a directory (requires absolute path)",
+	read_file: "read_file: read a file from the filesystem",
+	write_file: "write_file: write to a file in the filesystem",
+	edit_file: "edit_file: edit a file in the filesystem",
+	glob: "glob: find files matching a pattern (e.g., \"**/*.py\")",
+	grep: "grep: search for text within files"
+};
+function hasFilesystemToolDescription(name) {
+	return name in FILESYSTEM_TOOL_DESCRIPTION_LINES;
+}
+function buildFilesystemSystemPrompt(visibleTools) {
+	const promptToolNames = FILESYSTEM_TOOL_NAMES.filter((name) => visibleTools.has(name));
+	return context`
+    ## Following Conventions
 
-  - Read files before editing — understand existing content before making changes
-  - Mimic existing style, naming conventions, and patterns
+    - Read files before editing — understand existing content before making changes
+    - Mimic existing style, naming conventions, and patterns
 
-  ## Filesystem Tools \`ls\`, \`read_file\`, \`write_file\`, \`edit_file\`, \`glob\`, \`grep\`
+    ## Filesystem Tools ${promptToolNames.map((name) => `\`${name}\``).join(", ")}
 
-  You have access to a filesystem which you can interact with using these tools.
-  All file paths must start with a /.
+    You have access to a filesystem which you can interact with using these tools.
+    All file paths must start with a /.
 
-  - ls: list files in a directory (requires absolute path)
-  - read_file: read a file from the filesystem
-  - write_file: write to a file in the filesystem
-  - edit_file: edit a file in the filesystem
-  - glob: find files matching a pattern (e.g., "**/*.py")
-  - grep: search for text within files
-`;
+    ${promptToolNames.filter(hasFilesystemToolDescription).map((name) => `- ${FILESYSTEM_TOOL_DESCRIPTION_LINES[name]}`).join("\n")}
+  `;
+}
 const LS_TOOL_DESCRIPTION = context`
   Lists all files in a directory.
 
@@ -1649,7 +1712,8 @@ const EXECUTION_SYSTEM_PROMPT = context`
 function createLsTool(backend, options) {
 	const { customDescription, permissions } = options;
 	return tool(async (input, runtime) => {
-		enforcePermission(permissions, "read", input.path ?? "/");
+		const permissionError = checkPermission(permissions, "read", input.path ?? "/");
+		if (permissionError !== void 0) return toolError(runtime, "ls", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const path = input.path || "/";
 		const lsResult = await resolvedBackend.ls(path);
@@ -1677,7 +1741,8 @@ function createLsTool(backend, options) {
 function createReadFileTool(backend, options) {
 	const { customDescription, toolTokenLimitBeforeEvict, permissions } = options;
 	return tool(async (input, runtime) => {
-		enforcePermission(permissions, "read", input.file_path);
+		const permissionError = checkPermission(permissions, "read", input.file_path);
+		if (permissionError !== void 0) return toolError(runtime, "read_file", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const { file_path, offset = 0, limit = 100 } = input;
 		const readResult = await resolvedBackend.read(file_path, offset, limit);
@@ -1754,7 +1819,8 @@ function createReadFileTool(backend, options) {
 function createWriteFileTool(backend, options) {
 	const { customDescription, permissions } = options;
 	return tool(async (input, runtime) => {
-		enforcePermission(permissions, "write", input.file_path);
+		const permissionError = checkPermission(permissions, "write", input.file_path);
+		if (permissionError !== void 0) return toolError(runtime, "write_file", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const { file_path, content } = input;
 		const result = await resolvedBackend.write(file_path, content);
@@ -1785,7 +1851,8 @@ function createWriteFileTool(backend, options) {
 function createEditFileTool(backend, options) {
 	const { customDescription, permissions } = options;
 	return tool(async (input, runtime) => {
-		enforcePermission(permissions, "write", input.file_path);
+		const permissionError = checkPermission(permissions, "write", input.file_path);
+		if (permissionError !== void 0) return toolError(runtime, "edit_file", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const { file_path, old_string, new_string, replace_all = false } = input;
 		const result = await resolvedBackend.edit(file_path, old_string, new_string, replace_all);
@@ -1818,7 +1885,8 @@ function createEditFileTool(backend, options) {
 function createGlobTool(backend, options) {
 	const { customDescription, permissions } = options;
 	return tool(async (input, runtime) => {
-		enforcePermission(permissions, "read", input.path ?? "/");
+		const permissionError = checkPermission(permissions, "read", input.path ?? "/");
+		if (permissionError !== void 0) return toolError(runtime, "glob", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const { pattern, path = "/" } = input;
 		const globResult = await resolvedBackend.glob(pattern, path);
@@ -1843,7 +1911,8 @@ function createGlobTool(backend, options) {
 function createGrepTool(backend, options) {
 	const { customDescription, permissions } = options;
 	return tool(async (input, runtime) => {
-		enforcePermission(permissions, "read", input.path ?? "/");
+		const permissionError = checkPermission(permissions, "read", input.path ?? "/");
+		if (permissionError !== void 0) return toolError(runtime, "grep", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const { pattern, path = "/", glob = null } = input;
 		const result = await resolvedBackend.grep(pattern, path, glob);
@@ -1899,6 +1968,12 @@ function createExecuteTool(backend, options) {
 * Returns true only when backend exposes route prefixes (CompositeBackend) and
 * every permission path is scoped under one of them.
 */
+function normalizeFilesystemTools(tools) {
+	if (tools == null || tools === "all") return null;
+	const enabledTools = new Set(tools);
+	if (!enabledTools.has("read_file")) throw new Error("read_file must be included in tools; it is required by FilesystemMiddleware");
+	return enabledTools;
+}
 function allPathsScopedToRoutes(permissions, backend) {
 	if (!CompositeBackend.isInstance(backend)) return false;
 	const prefixes = backend.routePrefixes;
@@ -1906,13 +1981,43 @@ function allPathsScopedToRoutes(permissions, backend) {
 	return permissions.every((rule) => rule.paths.every((path) => prefixes.some((prefix) => path.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`))));
 }
 /**
-* Create filesystem middleware with all tools and features.
+* Create middleware that provides built-in filesystem tools and filesystem-aware
+* prompt guidance.
+*
+* By default, the middleware registers every built-in filesystem tool listed in
+* {@link FILESYSTEM_TOOL_NAMES}. Use {@link FilesystemMiddlewareOptions.tools}
+* to narrow that set for read-only, search-only, or otherwise restricted
+* agents. The allowlist only controls built-in filesystem tools; custom tools
+* from the agent or other middleware are left untouched.
+*
+* The middleware also filters tools whose backend capabilities are unavailable
+* at request time. In particular, `execute` is only visible when the resolved
+* backend supports command execution. The filesystem prompt is generated from
+* the final visible filesystem tools so the model is not instructed to call
+* tools it cannot see.
+*
+* @param options Filesystem middleware configuration.
+* @returns Agent middleware that contributes filesystem state, tools, prompt
+* guidance, permission checks, and large-result eviction.
+*
+* @example Read-only filesystem middleware
+* ```ts
+* const middleware = createFilesystemMiddleware({
+*   tools: ["read_file", "ls", "glob", "grep"],
+* });
+* ```
 */
 function createFilesystemMiddleware(options = {}) {
-	const { backend = (runtime) => new StateBackend(runtime), systemPrompt: customSystemPrompt = null, customToolDescriptions = null, toolTokenLimitBeforeEvict = 2e4, humanMessageTokenLimitBeforeEvict = 5e4, permissions = [] } = options;
+	const { backend = (runtime) => new StateBackend(runtime), systemPrompt: customSystemPrompt = null, customToolDescriptions = null, toolTokenLimitBeforeEvict = 2e4, humanMessageTokenLimitBeforeEvict = 5e4, permissions = [], tools: filesystemTools = null } = options;
+	const enabledFilesystemTools = normalizeFilesystemTools(filesystemTools);
+	const executeToolEnabled = enabledFilesystemTools == null || enabledFilesystemTools.has("execute");
 	if (permissions.length > 0) validatePermissionPaths(permissions);
-	if (permissions.length > 0 && typeof backend !== "function" && isSandboxBackend(backend) && !allPathsScopedToRoutes(permissions, backend)) throw new Error("Filesystem permissions cannot be used with a backend that supports command execution. Shell commands can access any path, making path-based rules ineffective. Either remove permissions, use a backend without execution support, or use a CompositeBackend with all permission paths scoped to a route prefix.");
-	const baseSystemPrompt = customSystemPrompt || FILESYSTEM_SYSTEM_PROMPT;
+	if (permissions.length > 0 && executeToolEnabled && typeof backend !== "function" && isSandboxBackend(backend) && !allPathsScopedToRoutes(permissions, backend)) throw new Error("Filesystem permissions cannot be used with a backend that supports command execution. Shell commands can access any path, making path-based rules ineffective. Either remove permissions, use a backend without execution support, or use a CompositeBackend with all permission paths scoped to a route prefix.");
+	const baseSystemPrompt = customSystemPrompt ?? null;
+	/**
+	* All tools including execute
+	* (execute will be filtered at runtime if backend doesn't support it)
+	*/
 	const allToolsByName = {
 		ls: createLsTool(backend, {
 			customDescription: customToolDescriptions?.ls,
@@ -1944,7 +2049,7 @@ function createFilesystemMiddleware(options = {}) {
 			permissions
 		})
 	};
-	const allTools = Object.values(allToolsByName);
+	const allTools = FILESYSTEM_TOOL_NAMES.filter((name) => enabledFilesystemTools == null || enabledFilesystemTools.has(name)).map((name) => allToolsByName[name]);
 	async function processToolMessage(msg, runtime, state, fallbackToolCallId) {
 		if (!toolTokenLimitBeforeEvict) return {
 			message: msg,
@@ -2018,8 +2123,14 @@ function createFilesystemMiddleware(options = {}) {
 			}));
 			let tools = request.tools;
 			if (!supportsExecution) tools = tools.filter((t) => t.name !== "execute");
-			let filesystemPrompt = baseSystemPrompt;
-			if (supportsExecution) filesystemPrompt = `${filesystemPrompt}\n\n${EXECUTION_SYSTEM_PROMPT}`;
+			const visibleFilesystemTools = /* @__PURE__ */ new Set();
+			for (const currentTool of tools) {
+				const toolName = typeof currentTool.name === "string" ? currentTool.name : void 0;
+				if (isFilesystemToolName(toolName)) visibleFilesystemTools.add(toolName);
+			}
+			const executionActive = supportsExecution && visibleFilesystemTools.has("execute");
+			let filesystemPrompt = baseSystemPrompt ?? buildFilesystemSystemPrompt(visibleFilesystemTools);
+			if (executionActive) filesystemPrompt = `${filesystemPrompt}\n\n${EXECUTION_SYSTEM_PROMPT}`;
 			const newSystemMessage = request.systemMessage.concat(filesystemPrompt);
 			let messages = request.messages;
 			if (humanMessageTokenLimitBeforeEvict && messages) {
@@ -3457,6 +3568,43 @@ function createSkillsMiddleware(options) {
 	});
 }
 //#endregion
+//#region src/middleware/utils.ts
+/**
+* Merge custom middleware into an assembled stack by `.name`.
+*
+* Matching custom middleware replaces the existing entry in place. New
+* middleware is appended after the base stack in caller-provided order.
+*/
+function mergeMiddleware$1(base, custom) {
+	const merged = new Map(base.map((middleware) => [middleware.name, middleware]));
+	for (const middleware of custom) merged.set(middleware.name, middleware);
+	return [...merged.values()];
+}
+function middlewareNames(middleware) {
+	return new Set(middleware.map((entry) => entry.name));
+}
+function matchingMiddleware(middleware, names) {
+	return middleware.filter((entry) => names.has(entry.name));
+}
+/**
+* Merge custom middleware into default and tail middleware segments.
+*
+* Same-name custom entries replace matching defaults in either segment. Novel
+* custom entries are inserted between the default and tail segments unless
+* `appendNew` is false.
+*/
+function mergeMiddlewareStack(defaultMiddleware, customMiddleware, tailMiddleware = [], options = {}) {
+	const defaultMiddlewareNames = middlewareNames(defaultMiddleware);
+	const tailMiddlewareNames = middlewareNames(tailMiddleware);
+	const knownMiddlewareNames = /* @__PURE__ */ new Set([...defaultMiddlewareNames, ...tailMiddlewareNames]);
+	const novelMiddleware = options.appendNew === false ? [] : customMiddleware.filter((entry) => !knownMiddlewareNames.has(entry.name));
+	return [
+		...mergeMiddleware$1(defaultMiddleware, matchingMiddleware(customMiddleware, defaultMiddlewareNames)),
+		...novelMiddleware,
+		...mergeMiddleware$1(tailMiddleware, matchingMiddleware(customMiddleware, tailMiddlewareNames))
+	];
+}
+//#endregion
 //#region src/middleware/completion_callback.ts
 /**
 * Callback middleware for async subagents.
@@ -5048,6 +5196,28 @@ function createCacheBreakpointMiddleware() {
 	});
 }
 //#endregion
+//#region src/middleware/tool_exclusion.ts
+function hasToolName(tool) {
+	return tool !== null && typeof tool === "object" && "name" in tool && typeof tool.name === "string";
+}
+/**
+* Create middleware that removes excluded tools after all tool-injecting
+* middleware has had a chance to add tools to the request.
+*
+* @internal
+*/
+function createToolExclusionMiddleware(excludedTools) {
+	return createMiddleware({
+		name: "_ToolExclusionMiddleware",
+		wrapModelCall(request, handler) {
+			return handler({
+				...request,
+				tools: request.tools?.filter((tool) => !hasToolName(tool) || !excludedTools.has(tool.name))
+			});
+		}
+	});
+}
+//#endregion
 //#region src/profiles/keys.ts
 /**
 * Normalize and validate a profile registry key.
@@ -5751,6 +5921,31 @@ const BASE_AGENT_PROMPT = context`
 
   For longer tasks, provide brief progress updates at reasonable intervals — a concise sentence recapping what you've done and what's next.
 `;
+const PROMPT_SEPARATOR = "\n\n";
+/** Normalize legacy system prompt values to the structured representation. */
+function normalizeSystemPrompt(systemPrompt) {
+	if (systemPrompt === void 0) return {};
+	if (typeof systemPrompt === "string" || SystemMessage.isInstance(systemPrompt)) return { prefix: systemPrompt };
+	return systemPrompt;
+}
+/** Assemble prompt parts while preserving structured message content blocks. */
+function assemblePromptParts(parts) {
+	if (parts.length === 0) return "";
+	if (parts.every((part) => typeof part === "string")) return parts.join(PROMPT_SEPARATOR);
+	const contentBlocks = [];
+	for (const [index, part] of parts.entries()) {
+		if (index > 0) contentBlocks.push({
+			type: "text",
+			text: PROMPT_SEPARATOR
+		});
+		if (SystemMessage.isInstance(part)) contentBlocks.push(...part.contentBlocks);
+		else contentBlocks.push({
+			type: "text",
+			text: part
+		});
+	}
+	return new SystemMessage({ contentBlocks });
+}
 const BUILTIN_TOOL_NAMES = /* @__PURE__ */ new Set([
 	...FILESYSTEM_TOOL_NAMES,
 	...ASYNC_TASK_TOOL_NAMES,
@@ -5796,6 +5991,8 @@ function createDeepAgent(params = {}) {
 		providerHint: getModelProvider(model),
 		identifierHint: getModelIdentifier(model)
 	});
+	const filesystemTools = FILESYSTEM_TOOL_NAMES.filter((toolName) => !harnessProfile.excludedTools.has(toolName));
+	const profileFilesystemTools = filesystemTools.length === FILESYSTEM_TOOL_NAMES.length || !filesystemTools.includes("read_file") ? void 0 : filesystemTools;
 	const toolOverrides = harnessProfile.toolDescriptionOverrides;
 	const effectiveTools = Object.keys(toolOverrides).length > 0 ? tools.map((t) => t.name in toolOverrides ? Object.assign(Object.create(Object.getPrototypeOf(t)), t, { description: toolOverrides[t.name] }) : t) : tools;
 	const anthropicModel = isAnthropicModel(model);
@@ -5817,23 +6014,26 @@ function createDeepAgent(params = {}) {
 	* Only the general-purpose subagent inherits the main agent's skills.
 	* If a custom subagent needs skills, it must specify its own `skills` array.
 	*/
-	const normalizeSubagentSpec = (input) => {
+	const createSubagentDefaultMiddleware = (input) => {
 		const effectivePermissions = input.permissions ?? permissions;
-		const subagentMiddleware = [
+		return [
 			todoListMiddleware(),
 			createFilesystemMiddleware({
 				backend,
-				permissions: effectivePermissions
+				permissions: effectivePermissions,
+				tools: profileFilesystemTools
 			}),
 			createSummarizationMiddleware({ backend }),
 			createPatchToolCallsMiddleware(),
 			...input.skills != null && input.skills.length > 0 ? [createSkillsMiddleware({
 				backend,
 				sources: input.skills
-			})] : [],
-			...input.middleware ?? [],
-			...cacheMiddleware
+			})] : []
 		];
+	};
+	const normalizeSubagentSpec = (input) => {
+		let subagentMiddleware = mergeMiddlewareStack(createSubagentDefaultMiddleware(input), input.middleware ?? [], cacheMiddleware);
+		if (harnessProfile.excludedMiddleware.size > 0) subagentMiddleware = subagentMiddleware.filter((middleware) => !harnessProfile.excludedMiddleware.has(middleware.name));
 		return {
 			...input,
 			tools: input.tools ?? [],
@@ -5854,6 +6054,7 @@ function createDeepAgent(params = {}) {
 			skills,
 			tools: effectiveTools
 		});
+		generalPurposeSpec.middleware = mergeMiddlewareStack(generalPurposeSpec.middleware ?? [], customMiddleware, [], { appendNew: false });
 		inlineSubagents.unshift(generalPurposeSpec);
 	}
 	const skillsMiddleware = skills != null && skills.length > 0 ? [createSkillsMiddleware({
@@ -5864,7 +6065,8 @@ function createDeepAgent(params = {}) {
 		todoListMiddleware(),
 		createFilesystemMiddleware({
 			backend,
-			permissions
+			permissions,
+			tools: profileFilesystemTools
 		}),
 		createSubAgentMiddleware({
 			defaultModel: model,
@@ -5876,15 +6078,16 @@ function createDeepAgent(params = {}) {
 		createSummarizationMiddleware({ backend }),
 		createPatchToolCallsMiddleware()
 	];
-	const middleware = [
+	let middleware = mergeMiddlewareStack([
 		todoMiddleware,
 		...skillsMiddleware,
 		fsMiddleware,
 		subagentMiddleware,
 		summarizationMiddleware,
 		patchToolCallsMiddleware,
-		...asyncSubAgents.length > 0 ? [createAsyncSubAgentMiddleware({ asyncSubAgents })] : [],
-		...customMiddleware,
+		...asyncSubAgents.length > 0 ? [createAsyncSubAgentMiddleware({ asyncSubAgents })] : []
+	], customMiddleware, [
+		...resolveMiddleware(harnessProfile.extraMiddleware),
 		...cacheMiddleware,
 		...memory && memory.length > 0 ? [createMemoryMiddleware({
 			backend,
@@ -5892,32 +6095,19 @@ function createDeepAgent(params = {}) {
 			addCacheControl: anthropicModel
 		})] : [],
 		...interruptOn ? [humanInTheLoopMiddleware({ interruptOn })] : []
-	];
-	const profileMiddleware = resolveMiddleware(harnessProfile.extraMiddleware);
-	if (profileMiddleware.length > 0) {
-		const cacheIdx = middleware.findIndex((m) => m.name === "AnthropicPromptCachingMiddleware");
-		if (cacheIdx !== -1) middleware.splice(cacheIdx, 0, ...profileMiddleware);
-		else middleware.push(...profileMiddleware);
-	}
+	]);
 	if (harnessProfile.excludedMiddleware.size > 0) {
 		const excluded = harnessProfile.excludedMiddleware;
-		const filtered = middleware.filter((m) => !excluded.has(m.name));
-		middleware.length = 0;
-		middleware.push(...filtered);
-	}
-	if (harnessProfile.excludedTools.size > 0) {
-		const excludedTools = harnessProfile.excludedTools;
-		middleware.push(createMiddleware({
-			name: "_ToolExclusionMiddleware",
-			wrapModelCall: async (request, handler) => {
-				return handler({
-					...request,
-					tools: request.tools?.filter((t) => !excludedTools.has(t.name))
-				});
-			}
-		}));
-	}
-	const effectiveBasePrompt = applyProfilePrompt(harnessProfile, BASE_AGENT_PROMPT);
+		middleware = middleware.filter((entry) => !excluded.has(entry.name));
+	}
+	if (harnessProfile.excludedTools.size > 0) middleware.push(createToolExclusionMiddleware(harnessProfile.excludedTools));
+	const promptConfig = normalizeSystemPrompt(systemPrompt);
+	const promptParts = [];
+	if (promptConfig.prefix !== void 0 && promptConfig.prefix !== null) promptParts.push(promptConfig.prefix);
+	const activeBasePrompt = promptConfig.base !== void 0 ? promptConfig.base : harnessProfile.baseSystemPrompt ?? BASE_AGENT_PROMPT;
+	if (activeBasePrompt !== null) promptParts.push(activeBasePrompt);
+	if (promptConfig.suffix) promptParts.push(promptConfig.suffix);
+	if (harnessProfile.systemPromptSuffix) promptParts.push(harnessProfile.systemPromptSuffix);
 	/**
 	* Return as DeepAgent with proper DeepAgentTypeConfig
 	* - Response: InferStructuredResponse<TResponse> (unwraps ToolStrategy<T>/ProviderStrategy<T> → T)
@@ -5930,19 +6120,7 @@ function createDeepAgent(params = {}) {
 	*/
 	return createAgent({
 		model,
-		systemPrompt: typeof systemPrompt === "string" ? new SystemMessage({ contentBlocks: [{
-			type: "text",
-			text: systemPrompt
-		}, {
-			type: "text",
-			text: effectiveBasePrompt
-		}] }) : SystemMessage.isInstance(systemPrompt) ? new SystemMessage({ contentBlocks: [...systemPrompt.contentBlocks, {
-			type: "text",
-			text: effectiveBasePrompt
-		}] }) : new SystemMessage({ contentBlocks: [{
-			type: "text",
-			text: effectiveBasePrompt
-		}] }),
+		systemPrompt: assemblePromptParts(promptParts),
 		stateSchema,
 		tools: effectiveTools,
 		middleware,
@@ -6294,6 +6472,19 @@ var StoreBackend = class {
 		}
 	}
 	/**
+	* Delete a file from the store.
+	*
+	* The file path is used as an exact store key. Wildcards are treated
+	* literally and do not expand to multiple entries.
+	*/
+	async delete(filePath) {
+		const store = this.getStore();
+		const namespace = this.getNamespace();
+		if (!await store.get(namespace, filePath)) return { error: `Error: File '${filePath}' not found` };
+		await store.delete(namespace, filePath);
+		return { path: filePath };
+	}
+	/**
 	* Search file contents for a literal text pattern.
 	* Binary files are skipped.
 	*/
@@ -6506,10 +6697,10 @@ var ContextHubBackend = class ContextHubBackend {
 		if (this.cache === null) throw new Error("Context Hub cache failed to initialize");
 		return this.cache;
 	}
-	async commit(files) {
-		if (Object.keys(files).length === 0) return;
+	async commit(changes) {
+		if (Object.keys(changes).length === 0) return;
 		const payload = {};
-		for (const [path, content] of Object.entries(files)) payload[path] = {
+		for (const [path, content] of Object.entries(changes)) payload[path] = content === null ? null : {
 			type: "file",
 			content
 		};
@@ -6519,7 +6710,14 @@ var ContextHubBackend = class ContextHubBackend {
 		});
 		const match = URL_COMMIT_SUFFIX_RE.exec(url);
 		if (match) this.commitHash = match[1];
-		if (this.cache !== null) for (const [path, content] of Object.entries(files)) this.cache[path] = content;
+		if (this.cache !== null) {
+			const deletions = new Set(Object.entries(changes).filter(([, content]) => content === null).map(([path]) => path));
+			const updates = Object.fromEntries(Object.entries(changes).filter((entry) => entry[1] !== null));
+			this.cache = {
+				...Object.fromEntries(Object.entries(this.cache).filter(([path]) => !deletions.has(path))),
+				...updates
+			};
+		}
 	}
 	/**
 	* Return linked-entry paths mapped to their repo handles.
@@ -6678,6 +6876,20 @@ var ContextHubBackend = class ContextHubBackend {
 			throw error;
 		}
 	}
+	async delete(filePath) {
+		const hubPath = ContextHubBackend.stripPrefix(filePath);
+		try {
+			if (!(hubPath in await this.ensureCache())) return { error: `Error: File '${filePath}' not found` };
+			await this.commit({ [hubPath]: null });
+			return { path: filePath };
+		} catch (error) {
+			if (isLangSmithError(error)) {
+				this.cache = null;
+				return { error: ContextHubBackend.toHubUnavailableError(error) };
+			}
+			throw error;
+		}
+	}
 	async uploadFiles(files) {
 		const decoder = new TextDecoder("utf-8", { fatal: true });
 		const decoded = [];
@@ -7170,6 +7382,16 @@ var BaseSandbox = class {
 			occurrences: count
 		};
 	}
+	/**
+	* Delete a file from the sandbox via a server-side rm.
+	*
+	* Uses rm -f, so deleting a path that does not exist succeeds silently.
+	*/
+	async delete(filePath) {
+		const result = await this.execute(`rm -f ${shellQuote(filePath)}`);
+		if (result.exitCode === 0) return { path: filePath };
+		return { error: `Error deleting file '${filePath}': ${result.output.trim() || "unknown error"}` };
+	}
 };
 //#endregion
 //#region src/backends/langsmith.ts
@@ -7373,4 +7595,4 @@ var LangSmithSandbox = class LangSmithSandbox extends BaseSandbox {
 //#endregion
 export { GENERAL_PURPOSE_SUBAGENT as A, isSandboxProtocol as B, MAX_SKILL_NAME_LENGTH as C, createPatchToolCallsMiddleware as D, filesValue as E, createFilesystemMiddleware as F, getMimeType as G, adaptBackendProtocol as H, CompositeBackend as I, isTextMimeType as K, StateBackend as L, TASK_SYSTEM_PROMPT as M, createSubAgent as N, DEFAULT_GENERAL_PURPOSE_DESCRIPTION as O, createSubAgentMiddleware as P, SandboxError as R, MAX_SKILL_FILE_SIZE as S, createMemoryMiddleware as T, adaptSandboxProtocol as U, resolveBackend as V, checkEmptyContent as W, isAsyncSubAgent as _, createDeepAgent as a, createCompletionCallbackMiddleware as b, generalPurposeSubagentConfigSchema as c, serializeProfile as d, EMPTY_HARNESS_PROFILE as f, createAsyncSubAgentMiddleware as g, ConfigurationError as h, StoreBackend as i, SUBAGENT_RESPONSE_FORMAT_CONFIG_KEY as j, DEFAULT_SUBAGENT_PROMPT as k, harnessProfileConfigSchema as l, REQUIRED_MIDDLEWARE_NAMES as m, BaseSandbox as n, getHarnessProfile as o, createHarnessProfile as p, performStringReplacement as q, ContextHubBackend as r, registerHarnessProfile as s, LangSmithSandbox as t, parseHarnessProfileConfig as u, computeSummarizationDefaults as v, createSkillsMiddleware as w, MAX_SKILL_DESCRIPTION_LENGTH as x, createSummarizationMiddleware as y, isSandboxBackend as z };
 
-//# sourceMappingURL=langsmith-DjCMSywL.js.map
+//# sourceMappingURL=langsmith-DVh4u6Za.js.map