Virtual path resolution errors escape the filesystem tool boundary without user-visible feedback

### 


import os, tempfile
from pathlib import Path

from langchain.tools import ToolRuntime

from deepagents.backends.filesystem import FilesystemBackend
from deepagents.middleware.filesystem import FilesystemMiddleware

tmp = Path(tempfile.mkdtemp())
root, outside = tmp / "root", tmp / "outside"
root.mkdir(); outside.mkdir()
(outside / "dict.json").write_text('{"real": true}\n')
os.symlink(outside, root / "data", target_is_directory=True)  # link leaves root

mw = FilesystemMiddleware(backend=FilesystemBackend(root_dir=root, virtual_mode=True))
tool = {t.name: t for t in mw.tools}["read_file"]
rt = ToolRuntime(state={"messages": []}, context=None, config={},
                 stream_writer=lambda *_: None, tool_call_id="c1", store=None)

tool.func(file_path="/data/dict.json", runtime=rt)   # raises instead of returning


Self-contained: no model, no API key, no network. It drives the real `read_file` tool, so the
result is what an agent turn would receive. Equivalent through `create_deep_agent(...)` with
any model scripted to call `read_file(file_path="/data/dict.json")`.

A symlink pointing outside the workspace is what any "mount the dataset/config into the
agent's directory" step produces. On Windows, substitute an NTFS junction
(`mklink /J`) — symlinks there need elevation, and the failing check is platform-independent.

# captured on Windows with an NTFS junction standing in for the symlink;
# only the temp-directory username is masked.

Traceback (most recent call last):
  File "repro.py", line 20, in <module>
    tool.func(file_path="/data/dict.json", runtime=rt)
  File ".../deepagents/middleware/filesystem.py", line 2104, in sync_read_file
    read_result = resolved_backend.read(validated_path, offset=offset, limit=limit)
  File ".../deepagents/backends/filesystem.py", line 441, in read
    resolved_path = self._resolve_path(file_path)
  File ".../deepagents/backends/filesystem.py", line 213, in _resolve_path
    raise ValueError(msg) from None
ValueError: Path:C:\Users\me\AppData\Local\Temp\repro_c8nx2b9b\outside\dict.json outside root directory: C:\Users\me\AppData\Local\Temp\repro_c8nx2b9b\root


Backend-level, six of seven methods leak the exception:


read    -> RAISED ValueError: outside root directory
write   -> RAISED ValueError: outside root directory
edit    -> RAISED ValueError: outside root directory
delete  -> RAISED ValueError: outside root directory
ls      -> RAISED ValueError: outside root directory
glob    -> RAISED ValueError: outside root directory
grep    -> returned GrepResult(error=None)   [graceful]


Tool-level, five of the seven tools let it escape (`glob`'s wrapper catches it,
`grep` never raises):


read_file(/data/dict.json)      -> ESCAPED ValueError
write_file(/data/x.txt)         -> ESCAPED ValueError
edit_file(/data/dict.json)      -> ESCAPED ValueError
delete(/data/dict.json)         -> ESCAPED ValueError
ls(/data)                       -> ESCAPED ValueError
glob(*, /data)                  -> ToolMessage[error] "Error: glob failed: ..."
grep(real, /data)               -> ToolMessage[success] "No matches found"


For contrast, the same tool with the same exception type from the other validator:


read_file(/../outside/dict.json) -> ToolMessage[error] "Path traversal not allowed"   [graceful]
read_file(/data/dict.json)       -> ESCAPED ValueError


## Expected behaviour

An error `ToolMessage`, so the model can read it and pick another path -- exactly
what these tools already return for "file not found" and for `validate_path`
rejections. Whether the path *should* be readable is a separate question;
refusing it is correct. Refusing it by raising through the tool boundary is not.

## Additional context

`ls()` catches `ValueError` in its child loop (L363) but logs at `debug` and
skips, so the link vanishes from the listing rather than being reported:

    ls('/')  ->  LsResult(error=None, entries=[])

The workspace looks empty while `read_file` on the same link raises. Agents
built on this get two contradictory views of the filesystem.

Raises:    ValueError: If path traversal is attempted in `virtual_mode` or if the        resolved path escapes the root directory.