deepagents 1.10.8 → 1.11.1

package/dist/{langsmith-CiAeUke2.cjs → langsmith-DhbsxI45.cjs}

@@ -494,7 +494,7 @@ function migrateToFileDataV2(data, filePath) {
 * @returns BackendProtocolV2-compatible backend
 */
 function adaptBackendProtocol(backend) {
-	return {
+	const adapted = {
 		async ls(path) {
 			const result = await ("ls" in backend ? backend.ls(path) : backend.lsInfo(path));
 			if (Array.isArray(result)) return { files: result };
@@ -512,6 +512,7 @@ function adaptBackendProtocol(backend) {
 		},
 		write: (filePath, content) => backend.write(filePath, content),
 		edit: (filePath, oldString, newString, replaceAll) => backend.edit(filePath, oldString, newString, replaceAll),
+		delete: backend.delete?.bind(backend),
 		uploadFiles: backend.uploadFiles ? (files) => backend.uploadFiles(files) : void 0,
 		downloadFiles: backend.downloadFiles ? (paths) => backend.downloadFiles(paths) : void 0,
 		async read(filePath, offset, limit) {
@@ -526,6 +527,13 @@ function adaptBackendProtocol(backend) {
 			return result;
 		}
 	};
+	const routePrefixes = backend.routePrefixes;
+	if (Array.isArray(routePrefixes)) Object.defineProperty(adapted, "routePrefixes", {
+		value: routePrefixes,
+		enumerable: true,
+		configurable: true
+	});
+	return adapted;
 }
 /**
 * Adapt a sandbox backend from v1 to v2 interface.
@@ -693,7 +701,8 @@ var StateBackend = class {
 	* In legacy mode, this is a no-op — the caller uses `filesUpdate`
 	* from the return value instead.
 	*
-	* @param update - Map of file paths to their updated {@link FileData}
+	* @param update - Map of file paths to their updated {@link FileData},
+	*   or null deletion markers.
 	*/
 	sendFilesUpdate(update) {
 		if (this.isLegacy) return;
@@ -817,6 +826,15 @@ var StateBackend = class {
 		};
 	}
 	/**
+	* Delete a file from state by sending a null deletion marker through Pregel.
+	*/
+	delete(filePath) {
+		if (!(filePath in this.files)) return { error: `Error: File '${filePath}' not found` };
+		if (this.isLegacy) return { error: "StateBackend.delete requires a zero-argument StateBackend in a LangGraph execution context." };
+		this.sendFilesUpdate({ [filePath]: null });
+		return { path: filePath };
+	}
+	/**
 	* Search file contents for a literal text pattern.
 	* Binary files are skipped.
 	*/
@@ -1183,6 +1201,19 @@ var CompositeBackend = class {
 		return await backend.edit(strippedKey, oldString, newString, replaceAll);
 	}
 	/**
+	* Delete a file, routing to the appropriate backend.
+	*/
+	async delete(filePath) {
+		const [backend, strippedKey] = this.getBackendAndKey(filePath);
+		if (!backend.delete) return { error: "Backend does not support delete" };
+		const result = await backend.delete(strippedKey);
+		if (result.path !== void 0) return {
+			...result,
+			path: filePath
+		};
+		return result;
+	}
+	/**
 	* Execute a command via the default backend.
 	* Execution is not path-specific, so it always delegates to the default backend.
 	*
@@ -1324,14 +1355,10 @@ const FILESYSTEM_TOOL_NAMES = [
 	"grep",
 	"execute"
 ];
-const TOOLS_EXCLUDED_FROM_EVICTION = [
-	"ls",
-	"glob",
-	"grep",
-	"read_file",
-	"edit_file",
-	"write_file"
-];
+function isFilesystemToolName(name) {
+	return typeof name === "string" && FILESYSTEM_TOOL_NAMES.includes(name);
+}
+const TOOLS_EXCLUDED_FROM_EVICTION = FILESYSTEM_TOOL_NAMES.filter((name) => name !== "execute");
 /**
 * Maximum size for binary (non-text) files read via read_file, in bytes.
 * Base64-encoded content is ~33% larger, so 10MB raw ≈ 13.3MB in context.
@@ -1499,19 +1526,46 @@ const FilesystemStateSchema = new _langchain_langgraph.StateSchema({ files: new
 	inputSchema: zod_v4.z.record(zod_v4.z.string(), FileDataSchema.nullable()).optional(),
 	reducer: fileDataReducer
 }) });
+/** Extract a message string from an unknown thrown value without `instanceof`. */
+function getErrorMessage$1(error) {
+	if (typeof error === "object" && error !== null && "message" in error && typeof error.message === "string") return error.message;
+	return String(error);
+}
 /**
-* Throw a permission-denied error if `path` is denied under `rules`.
+* Check whether `path` is permitted under `rules` for `operation`, returning an
+* error string to surface to the model (or `undefined` when allowed).
 *
-* No-op when `rules` is empty (permissive default). Paths that fail
-* `validatePath` are silently skipped — the tool's own input validation
-* will surface a better error.
+* Never throws: an invalid path (non-absolute, or containing `..` or `~`) or a
+* denied path is a recoverable tool error, not a fatal run-ending one. Such
+* paths are rejected, never normalized, so they cannot bypass a deny rule or
+* reach the backend.
 *
 * @internal
 */
-function enforcePermission(rules, operation, path) {
+function checkPermission(rules, operation, path) {
 	if (rules.length === 0) return;
-	const canonical = validatePath(path);
-	if (decidePathAccess(rules, operation, canonical) === "deny") throw new Error(`Error: permission denied for ${operation} on ${canonical}`);
+	let canonical;
+	try {
+		canonical = validatePath(path);
+	} catch (error) {
+		return `Error: ${getErrorMessage$1(error)}`;
+	}
+	if (decidePathAccess(rules, operation, canonical) === "deny") return `Error: permission denied for ${operation} on ${canonical}`;
+}
+/**
+* Build an error {@link ToolMessage} for a rejected or denied path. Returning a
+* bare string would be wrapped as a `status: "success"` message whose content
+* merely starts with "Error:"; marking `status: "error"` reports the failure
+* accurately so callers and the model can distinguish a real failure from a
+* successful result.
+*/
+function toolError(runtime, toolName, message) {
+	return new langchain.ToolMessage({
+		content: message,
+		name: toolName,
+		tool_call_id: runtime.toolCall?.id,
+		status: "error"
+	});
 }
 /**
 * Filter a list of filesystem entries to those the rules permit.
@@ -1532,24 +1586,33 @@ function filterByPermissions(entries, rules, operation, getPath) {
 		}
 	});
 }
-const FILESYSTEM_SYSTEM_PROMPT = langchain.context`
-  ## Following Conventions
+const FILESYSTEM_TOOL_DESCRIPTION_LINES = {
+	ls: "ls: list files in a directory (requires absolute path)",
+	read_file: "read_file: read a file from the filesystem",
+	write_file: "write_file: write to a file in the filesystem",
+	edit_file: "edit_file: edit a file in the filesystem",
+	glob: "glob: find files matching a pattern (e.g., \"**/*.py\")",
+	grep: "grep: search for text within files"
+};
+function hasFilesystemToolDescription(name) {
+	return name in FILESYSTEM_TOOL_DESCRIPTION_LINES;
+}
+function buildFilesystemSystemPrompt(visibleTools) {
+	const promptToolNames = FILESYSTEM_TOOL_NAMES.filter((name) => visibleTools.has(name));
+	return langchain.context`
+    ## Following Conventions
 
-  - Read files before editing — understand existing content before making changes
-  - Mimic existing style, naming conventions, and patterns
+    - Read files before editing — understand existing content before making changes
+    - Mimic existing style, naming conventions, and patterns
 
-  ## Filesystem Tools \`ls\`, \`read_file\`, \`write_file\`, \`edit_file\`, \`glob\`, \`grep\`
+    ## Filesystem Tools ${promptToolNames.map((name) => `\`${name}\``).join(", ")}
 
-  You have access to a filesystem which you can interact with using these tools.
-  All file paths must start with a /.
+    You have access to a filesystem which you can interact with using these tools.
+    All file paths must start with a /.
 
-  - ls: list files in a directory (requires absolute path)
-  - read_file: read a file from the filesystem
-  - write_file: write to a file in the filesystem
-  - edit_file: edit a file in the filesystem
-  - glob: find files matching a pattern (e.g., "**/*.py")
-  - grep: search for text within files
-`;
+    ${promptToolNames.filter(hasFilesystemToolDescription).map((name) => `- ${FILESYSTEM_TOOL_DESCRIPTION_LINES[name]}`).join("\n")}
+  `;
+}
 const LS_TOOL_DESCRIPTION = langchain.context`
   Lists all files in a directory.
 
@@ -1673,7 +1736,8 @@ const EXECUTION_SYSTEM_PROMPT = langchain.context`
 function createLsTool(backend, options) {
 	const { customDescription, permissions } = options;
 	return (0, langchain.tool)(async (input, runtime) => {
-		enforcePermission(permissions, "read", input.path ?? "/");
+		const permissionError = checkPermission(permissions, "read", input.path ?? "/");
+		if (permissionError !== void 0) return toolError(runtime, "ls", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const path = input.path || "/";
 		const lsResult = await resolvedBackend.ls(path);
@@ -1701,7 +1765,8 @@ function createLsTool(backend, options) {
 function createReadFileTool(backend, options) {
 	const { customDescription, toolTokenLimitBeforeEvict, permissions } = options;
 	return (0, langchain.tool)(async (input, runtime) => {
-		enforcePermission(permissions, "read", input.file_path);
+		const permissionError = checkPermission(permissions, "read", input.file_path);
+		if (permissionError !== void 0) return toolError(runtime, "read_file", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const { file_path, offset = 0, limit = 100 } = input;
 		const readResult = await resolvedBackend.read(file_path, offset, limit);
@@ -1778,7 +1843,8 @@ function createReadFileTool(backend, options) {
 function createWriteFileTool(backend, options) {
 	const { customDescription, permissions } = options;
 	return (0, langchain.tool)(async (input, runtime) => {
-		enforcePermission(permissions, "write", input.file_path);
+		const permissionError = checkPermission(permissions, "write", input.file_path);
+		if (permissionError !== void 0) return toolError(runtime, "write_file", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const { file_path, content } = input;
 		const result = await resolvedBackend.write(file_path, content);
@@ -1809,7 +1875,8 @@ function createWriteFileTool(backend, options) {
 function createEditFileTool(backend, options) {
 	const { customDescription, permissions } = options;
 	return (0, langchain.tool)(async (input, runtime) => {
-		enforcePermission(permissions, "write", input.file_path);
+		const permissionError = checkPermission(permissions, "write", input.file_path);
+		if (permissionError !== void 0) return toolError(runtime, "edit_file", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const { file_path, old_string, new_string, replace_all = false } = input;
 		const result = await resolvedBackend.edit(file_path, old_string, new_string, replace_all);
@@ -1842,7 +1909,8 @@ function createEditFileTool(backend, options) {
 function createGlobTool(backend, options) {
 	const { customDescription, permissions } = options;
 	return (0, langchain.tool)(async (input, runtime) => {
-		enforcePermission(permissions, "read", input.path ?? "/");
+		const permissionError = checkPermission(permissions, "read", input.path ?? "/");
+		if (permissionError !== void 0) return toolError(runtime, "glob", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const { pattern, path = "/" } = input;
 		const globResult = await resolvedBackend.glob(pattern, path);
@@ -1867,7 +1935,8 @@ function createGlobTool(backend, options) {
 function createGrepTool(backend, options) {
 	const { customDescription, permissions } = options;
 	return (0, langchain.tool)(async (input, runtime) => {
-		enforcePermission(permissions, "read", input.path ?? "/");
+		const permissionError = checkPermission(permissions, "read", input.path ?? "/");
+		if (permissionError !== void 0) return toolError(runtime, "grep", permissionError);
 		const resolvedBackend = await resolveBackend(backend, runtime);
 		const { pattern, path = "/", glob = null } = input;
 		const result = await resolvedBackend.grep(pattern, path, glob);
@@ -1923,6 +1992,12 @@ function createExecuteTool(backend, options) {
 * Returns true only when backend exposes route prefixes (CompositeBackend) and
 * every permission path is scoped under one of them.
 */
+function normalizeFilesystemTools(tools) {
+	if (tools == null || tools === "all") return null;
+	const enabledTools = new Set(tools);
+	if (!enabledTools.has("read_file")) throw new Error("read_file must be included in tools; it is required by FilesystemMiddleware");
+	return enabledTools;
+}
 function allPathsScopedToRoutes(permissions, backend) {
 	if (!CompositeBackend.isInstance(backend)) return false;
 	const prefixes = backend.routePrefixes;
@@ -1930,13 +2005,43 @@ function allPathsScopedToRoutes(permissions, backend) {
 	return permissions.every((rule) => rule.paths.every((path) => prefixes.some((prefix) => path.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`))));
 }
 /**
-* Create filesystem middleware with all tools and features.
+* Create middleware that provides built-in filesystem tools and filesystem-aware
+* prompt guidance.
+*
+* By default, the middleware registers every built-in filesystem tool listed in
+* {@link FILESYSTEM_TOOL_NAMES}. Use {@link FilesystemMiddlewareOptions.tools}
+* to narrow that set for read-only, search-only, or otherwise restricted
+* agents. The allowlist only controls built-in filesystem tools; custom tools
+* from the agent or other middleware are left untouched.
+*
+* The middleware also filters tools whose backend capabilities are unavailable
+* at request time. In particular, `execute` is only visible when the resolved
+* backend supports command execution. The filesystem prompt is generated from
+* the final visible filesystem tools so the model is not instructed to call
+* tools it cannot see.
+*
+* @param options Filesystem middleware configuration.
+* @returns Agent middleware that contributes filesystem state, tools, prompt
+* guidance, permission checks, and large-result eviction.
+*
+* @example Read-only filesystem middleware
+* ```ts
+* const middleware = createFilesystemMiddleware({
+*   tools: ["read_file", "ls", "glob", "grep"],
+* });
+* ```
 */
 function createFilesystemMiddleware(options = {}) {
-	const { backend = (runtime) => new StateBackend(runtime), systemPrompt: customSystemPrompt = null, customToolDescriptions = null, toolTokenLimitBeforeEvict = 2e4, humanMessageTokenLimitBeforeEvict = 5e4, permissions = [] } = options;
+	const { backend = (runtime) => new StateBackend(runtime), systemPrompt: customSystemPrompt = null, customToolDescriptions = null, toolTokenLimitBeforeEvict = 2e4, humanMessageTokenLimitBeforeEvict = 5e4, permissions = [], tools: filesystemTools = null } = options;
+	const enabledFilesystemTools = normalizeFilesystemTools(filesystemTools);
+	const executeToolEnabled = enabledFilesystemTools == null || enabledFilesystemTools.has("execute");
 	if (permissions.length > 0) validatePermissionPaths(permissions);
-	if (permissions.length > 0 && typeof backend !== "function" && isSandboxBackend(backend) && !allPathsScopedToRoutes(permissions, backend)) throw new Error("Filesystem permissions cannot be used with a backend that supports command execution. Shell commands can access any path, making path-based rules ineffective. Either remove permissions, use a backend without execution support, or use a CompositeBackend with all permission paths scoped to a route prefix.");
-	const baseSystemPrompt = customSystemPrompt || FILESYSTEM_SYSTEM_PROMPT;
+	if (permissions.length > 0 && executeToolEnabled && typeof backend !== "function" && isSandboxBackend(backend) && !allPathsScopedToRoutes(permissions, backend)) throw new Error("Filesystem permissions cannot be used with a backend that supports command execution. Shell commands can access any path, making path-based rules ineffective. Either remove permissions, use a backend without execution support, or use a CompositeBackend with all permission paths scoped to a route prefix.");
+	const baseSystemPrompt = customSystemPrompt ?? null;
+	/**
+	* All tools including execute
+	* (execute will be filtered at runtime if backend doesn't support it)
+	*/
 	const allToolsByName = {
 		ls: createLsTool(backend, {
 			customDescription: customToolDescriptions?.ls,
@@ -1968,7 +2073,7 @@ function createFilesystemMiddleware(options = {}) {
 			permissions
 		})
 	};
-	const allTools = Object.values(allToolsByName);
+	const allTools = FILESYSTEM_TOOL_NAMES.filter((name) => enabledFilesystemTools == null || enabledFilesystemTools.has(name)).map((name) => allToolsByName[name]);
 	async function processToolMessage(msg, runtime, state, fallbackToolCallId) {
 		if (!toolTokenLimitBeforeEvict) return {
 			message: msg,
@@ -2042,8 +2147,14 @@ function createFilesystemMiddleware(options = {}) {
 			}));
 			let tools = request.tools;
 			if (!supportsExecution) tools = tools.filter((t) => t.name !== "execute");
-			let filesystemPrompt = baseSystemPrompt;
-			if (supportsExecution) filesystemPrompt = `${filesystemPrompt}\n\n${EXECUTION_SYSTEM_PROMPT}`;
+			const visibleFilesystemTools = /* @__PURE__ */ new Set();
+			for (const currentTool of tools) {
+				const toolName = typeof currentTool.name === "string" ? currentTool.name : void 0;
+				if (isFilesystemToolName(toolName)) visibleFilesystemTools.add(toolName);
+			}
+			const executionActive = supportsExecution && visibleFilesystemTools.has("execute");
+			let filesystemPrompt = baseSystemPrompt ?? buildFilesystemSystemPrompt(visibleFilesystemTools);
+			if (executionActive) filesystemPrompt = `${filesystemPrompt}\n\n${EXECUTION_SYSTEM_PROMPT}`;
 			const newSystemMessage = request.systemMessage.concat(filesystemPrompt);
 			let messages = request.messages;
 			if (humanMessageTokenLimitBeforeEvict && messages) {
@@ -3487,6 +3598,41 @@ function createSkillsMiddleware(options) {
 *
 * This module provides shared helpers used across middleware implementations.
 */
+/**
+* Merge custom middleware into an assembled stack by `.name`.
+*
+* Matching custom middleware replaces the existing entry in place. New
+* middleware is appended after the base stack in caller-provided order.
+*/
+function mergeMiddleware$1(base, custom) {
+	const merged = new Map(base.map((middleware) => [middleware.name, middleware]));
+	for (const middleware of custom) merged.set(middleware.name, middleware);
+	return [...merged.values()];
+}
+function middlewareNames(middleware) {
+	return new Set(middleware.map((entry) => entry.name));
+}
+function matchingMiddleware(middleware, names) {
+	return middleware.filter((entry) => names.has(entry.name));
+}
+/**
+* Merge custom middleware into default and tail middleware segments.
+*
+* Same-name custom entries replace matching defaults in either segment. Novel
+* custom entries are inserted between the default and tail segments unless
+* `appendNew` is false.
+*/
+function mergeMiddlewareStack(defaultMiddleware, customMiddleware, tailMiddleware = [], options = {}) {
+	const defaultMiddlewareNames = middlewareNames(defaultMiddleware);
+	const tailMiddlewareNames = middlewareNames(tailMiddleware);
+	const knownMiddlewareNames = /* @__PURE__ */ new Set([...defaultMiddlewareNames, ...tailMiddlewareNames]);
+	const novelMiddleware = options.appendNew === false ? [] : customMiddleware.filter((entry) => !knownMiddlewareNames.has(entry.name));
+	return [
+		...mergeMiddleware$1(defaultMiddleware, matchingMiddleware(customMiddleware, defaultMiddlewareNames)),
+		...novelMiddleware,
+		...mergeMiddleware$1(tailMiddleware, matchingMiddleware(customMiddleware, tailMiddlewareNames))
+	];
+}
 //#endregion
 //#region src/middleware/completion_callback.ts
 /**
@@ -5079,6 +5225,28 @@ function createCacheBreakpointMiddleware() {
 	});
 }
 //#endregion
+//#region src/middleware/tool_exclusion.ts
+function hasToolName(tool) {
+	return tool !== null && typeof tool === "object" && "name" in tool && typeof tool.name === "string";
+}
+/**
+* Create middleware that removes excluded tools after all tool-injecting
+* middleware has had a chance to add tools to the request.
+*
+* @internal
+*/
+function createToolExclusionMiddleware(excludedTools) {
+	return (0, langchain.createMiddleware)({
+		name: "_ToolExclusionMiddleware",
+		wrapModelCall(request, handler) {
+			return handler({
+				...request,
+				tools: request.tools?.filter((tool) => !hasToolName(tool) || !excludedTools.has(tool.name))
+			});
+		}
+	});
+}
+//#endregion
 //#region src/profiles/keys.ts
 /**
 * Normalize and validate a profile registry key.
@@ -5782,6 +5950,31 @@ const BASE_AGENT_PROMPT = langchain.context`
 
   For longer tasks, provide brief progress updates at reasonable intervals — a concise sentence recapping what you've done and what's next.
 `;
+const PROMPT_SEPARATOR = "\n\n";
+/** Normalize legacy system prompt values to the structured representation. */
+function normalizeSystemPrompt(systemPrompt) {
+	if (systemPrompt === void 0) return {};
+	if (typeof systemPrompt === "string" || langchain.SystemMessage.isInstance(systemPrompt)) return { prefix: systemPrompt };
+	return systemPrompt;
+}
+/** Assemble prompt parts while preserving structured message content blocks. */
+function assemblePromptParts(parts) {
+	if (parts.length === 0) return "";
+	if (parts.every((part) => typeof part === "string")) return parts.join(PROMPT_SEPARATOR);
+	const contentBlocks = [];
+	for (const [index, part] of parts.entries()) {
+		if (index > 0) contentBlocks.push({
+			type: "text",
+			text: PROMPT_SEPARATOR
+		});
+		if (langchain.SystemMessage.isInstance(part)) contentBlocks.push(...part.contentBlocks);
+		else contentBlocks.push({
+			type: "text",
+			text: part
+		});
+	}
+	return new langchain.SystemMessage({ contentBlocks });
+}
 const BUILTIN_TOOL_NAMES = /* @__PURE__ */ new Set([
 	...FILESYSTEM_TOOL_NAMES,
 	...ASYNC_TASK_TOOL_NAMES,
@@ -5827,6 +6020,8 @@ function createDeepAgent(params = {}) {
 		providerHint: getModelProvider(model),
 		identifierHint: getModelIdentifier(model)
 	});
+	const filesystemTools = FILESYSTEM_TOOL_NAMES.filter((toolName) => !harnessProfile.excludedTools.has(toolName));
+	const profileFilesystemTools = filesystemTools.length === FILESYSTEM_TOOL_NAMES.length || !filesystemTools.includes("read_file") ? void 0 : filesystemTools;
 	const toolOverrides = harnessProfile.toolDescriptionOverrides;
 	const effectiveTools = Object.keys(toolOverrides).length > 0 ? tools.map((t) => t.name in toolOverrides ? Object.assign(Object.create(Object.getPrototypeOf(t)), t, { description: toolOverrides[t.name] }) : t) : tools;
 	const anthropicModel = isAnthropicModel(model);
@@ -5848,23 +6043,26 @@ function createDeepAgent(params = {}) {
 	* Only the general-purpose subagent inherits the main agent's skills.
 	* If a custom subagent needs skills, it must specify its own `skills` array.
 	*/
-	const normalizeSubagentSpec = (input) => {
+	const createSubagentDefaultMiddleware = (input) => {
 		const effectivePermissions = input.permissions ?? permissions;
-		const subagentMiddleware = [
+		return [
 			(0, langchain.todoListMiddleware)(),
 			createFilesystemMiddleware({
 				backend,
-				permissions: effectivePermissions
+				permissions: effectivePermissions,
+				tools: profileFilesystemTools
 			}),
 			createSummarizationMiddleware({ backend }),
 			createPatchToolCallsMiddleware(),
 			...input.skills != null && input.skills.length > 0 ? [createSkillsMiddleware({
 				backend,
 				sources: input.skills
-			})] : [],
-			...input.middleware ?? [],
-			...cacheMiddleware
+			})] : []
 		];
+	};
+	const normalizeSubagentSpec = (input) => {
+		let subagentMiddleware = mergeMiddlewareStack(createSubagentDefaultMiddleware(input), input.middleware ?? [], cacheMiddleware);
+		if (harnessProfile.excludedMiddleware.size > 0) subagentMiddleware = subagentMiddleware.filter((middleware) => !harnessProfile.excludedMiddleware.has(middleware.name));
 		return {
 			...input,
 			tools: input.tools ?? [],
@@ -5885,6 +6083,7 @@ function createDeepAgent(params = {}) {
 			skills,
 			tools: effectiveTools
 		});
+		generalPurposeSpec.middleware = mergeMiddlewareStack(generalPurposeSpec.middleware ?? [], customMiddleware, [], { appendNew: false });
 		inlineSubagents.unshift(generalPurposeSpec);
 	}
 	const skillsMiddleware = skills != null && skills.length > 0 ? [createSkillsMiddleware({
@@ -5895,7 +6094,8 @@ function createDeepAgent(params = {}) {
 		(0, langchain.todoListMiddleware)(),
 		createFilesystemMiddleware({
 			backend,
-			permissions
+			permissions,
+			tools: profileFilesystemTools
 		}),
 		createSubAgentMiddleware({
 			defaultModel: model,
@@ -5907,15 +6107,16 @@ function createDeepAgent(params = {}) {
 		createSummarizationMiddleware({ backend }),
 		createPatchToolCallsMiddleware()
 	];
-	const middleware = [
+	let middleware = mergeMiddlewareStack([
 		todoMiddleware,
 		...skillsMiddleware,
 		fsMiddleware,
 		subagentMiddleware,
 		summarizationMiddleware,
 		patchToolCallsMiddleware,
-		...asyncSubAgents.length > 0 ? [createAsyncSubAgentMiddleware({ asyncSubAgents })] : [],
-		...customMiddleware,
+		...asyncSubAgents.length > 0 ? [createAsyncSubAgentMiddleware({ asyncSubAgents })] : []
+	], customMiddleware, [
+		...resolveMiddleware(harnessProfile.extraMiddleware),
 		...cacheMiddleware,
 		...memory && memory.length > 0 ? [createMemoryMiddleware({
 			backend,
@@ -5923,32 +6124,19 @@ function createDeepAgent(params = {}) {
 			addCacheControl: anthropicModel
 		})] : [],
 		...interruptOn ? [(0, langchain.humanInTheLoopMiddleware)({ interruptOn })] : []
-	];
-	const profileMiddleware = resolveMiddleware(harnessProfile.extraMiddleware);
-	if (profileMiddleware.length > 0) {
-		const cacheIdx = middleware.findIndex((m) => m.name === "AnthropicPromptCachingMiddleware");
-		if (cacheIdx !== -1) middleware.splice(cacheIdx, 0, ...profileMiddleware);
-		else middleware.push(...profileMiddleware);
-	}
+	]);
 	if (harnessProfile.excludedMiddleware.size > 0) {
 		const excluded = harnessProfile.excludedMiddleware;
-		const filtered = middleware.filter((m) => !excluded.has(m.name));
-		middleware.length = 0;
-		middleware.push(...filtered);
-	}
-	if (harnessProfile.excludedTools.size > 0) {
-		const excludedTools = harnessProfile.excludedTools;
-		middleware.push((0, langchain.createMiddleware)({
-			name: "_ToolExclusionMiddleware",
-			wrapModelCall: async (request, handler) => {
-				return handler({
-					...request,
-					tools: request.tools?.filter((t) => !excludedTools.has(t.name))
-				});
-			}
-		}));
-	}
-	const effectiveBasePrompt = applyProfilePrompt(harnessProfile, BASE_AGENT_PROMPT);
+		middleware = middleware.filter((entry) => !excluded.has(entry.name));
+	}
+	if (harnessProfile.excludedTools.size > 0) middleware.push(createToolExclusionMiddleware(harnessProfile.excludedTools));
+	const promptConfig = normalizeSystemPrompt(systemPrompt);
+	const promptParts = [];
+	if (promptConfig.prefix !== void 0 && promptConfig.prefix !== null) promptParts.push(promptConfig.prefix);
+	const activeBasePrompt = promptConfig.base !== void 0 ? promptConfig.base : harnessProfile.baseSystemPrompt ?? BASE_AGENT_PROMPT;
+	if (activeBasePrompt !== null) promptParts.push(activeBasePrompt);
+	if (promptConfig.suffix) promptParts.push(promptConfig.suffix);
+	if (harnessProfile.systemPromptSuffix) promptParts.push(harnessProfile.systemPromptSuffix);
 	/**
 	* Return as DeepAgent with proper DeepAgentTypeConfig
 	* - Response: InferStructuredResponse<TResponse> (unwraps ToolStrategy<T>/ProviderStrategy<T> → T)
@@ -5961,19 +6149,7 @@ function createDeepAgent(params = {}) {
 	*/
 	return (0, langchain.createAgent)({
 		model,
-		systemPrompt: typeof systemPrompt === "string" ? new langchain.SystemMessage({ contentBlocks: [{
-			type: "text",
-			text: systemPrompt
-		}, {
-			type: "text",
-			text: effectiveBasePrompt
-		}] }) : langchain.SystemMessage.isInstance(systemPrompt) ? new langchain.SystemMessage({ contentBlocks: [...systemPrompt.contentBlocks, {
-			type: "text",
-			text: effectiveBasePrompt
-		}] }) : new langchain.SystemMessage({ contentBlocks: [{
-			type: "text",
-			text: effectiveBasePrompt
-		}] }),
+		systemPrompt: assemblePromptParts(promptParts),
 		stateSchema,
 		tools: effectiveTools,
 		middleware,
@@ -6325,6 +6501,19 @@ var StoreBackend = class {
 		}
 	}
 	/**
+	* Delete a file from the store.
+	*
+	* The file path is used as an exact store key. Wildcards are treated
+	* literally and do not expand to multiple entries.
+	*/
+	async delete(filePath) {
+		const store = this.getStore();
+		const namespace = this.getNamespace();
+		if (!await store.get(namespace, filePath)) return { error: `Error: File '${filePath}' not found` };
+		await store.delete(namespace, filePath);
+		return { path: filePath };
+	}
+	/**
 	* Search file contents for a literal text pattern.
 	* Binary files are skipped.
 	*/
@@ -6537,10 +6726,10 @@ var ContextHubBackend = class ContextHubBackend {
 		if (this.cache === null) throw new Error("Context Hub cache failed to initialize");
 		return this.cache;
 	}
-	async commit(files) {
-		if (Object.keys(files).length === 0) return;
+	async commit(changes) {
+		if (Object.keys(changes).length === 0) return;
 		const payload = {};
-		for (const [path, content] of Object.entries(files)) payload[path] = {
+		for (const [path, content] of Object.entries(changes)) payload[path] = content === null ? null : {
 			type: "file",
 			content
 		};
@@ -6550,7 +6739,14 @@ var ContextHubBackend = class ContextHubBackend {
 		});
 		const match = URL_COMMIT_SUFFIX_RE.exec(url);
 		if (match) this.commitHash = match[1];
-		if (this.cache !== null) for (const [path, content] of Object.entries(files)) this.cache[path] = content;
+		if (this.cache !== null) {
+			const deletions = new Set(Object.entries(changes).filter(([, content]) => content === null).map(([path]) => path));
+			const updates = Object.fromEntries(Object.entries(changes).filter((entry) => entry[1] !== null));
+			this.cache = {
+				...Object.fromEntries(Object.entries(this.cache).filter(([path]) => !deletions.has(path))),
+				...updates
+			};
+		}
 	}
 	/**
 	* Return linked-entry paths mapped to their repo handles.
@@ -6709,6 +6905,20 @@ var ContextHubBackend = class ContextHubBackend {
 			throw error;
 		}
 	}
+	async delete(filePath) {
+		const hubPath = ContextHubBackend.stripPrefix(filePath);
+		try {
+			if (!(hubPath in await this.ensureCache())) return { error: `Error: File '${filePath}' not found` };
+			await this.commit({ [hubPath]: null });
+			return { path: filePath };
+		} catch (error) {
+			if (isLangSmithError(error)) {
+				this.cache = null;
+				return { error: ContextHubBackend.toHubUnavailableError(error) };
+			}
+			throw error;
+		}
+	}
 	async uploadFiles(files) {
 		const decoder = new TextDecoder("utf-8", { fatal: true });
 		const decoded = [];
@@ -7201,6 +7411,16 @@ var BaseSandbox = class {
 			occurrences: count
 		};
 	}
+	/**
+	* Delete a file from the sandbox via a server-side rm.
+	*
+	* Uses rm -f, so deleting a path that does not exist succeeds silently.
+	*/
+	async delete(filePath) {
+		const result = await this.execute(`rm -f ${shellQuote(filePath)}`);
+		if (result.exitCode === 0) return { path: filePath };
+		return { error: `Error deleting file '${filePath}': ${result.output.trim() || "unknown error"}` };
+	}
 };
 //#endregion
 //#region src/backends/langsmith.ts
@@ -7691,4 +7911,4 @@ Object.defineProperty(exports, "serializeProfile", {
 	}
 });
 
-//# sourceMappingURL=langsmith-CiAeUke2.cjs.map
+//# sourceMappingURL=langsmith-DhbsxI45.cjs.map