虚拟路径解析错误会逃脱文件系统工具的范围,而不会给用户提供可见的反馈

import os, tempfile from pathlib import Path from LangChain.tools import ToolRuntime from deepagents.backends.filesystem import FilesystemBackend from deepagents.middleware.filesystem import FilesystemMiddleware tmp = Path(tempfile.mkdtemp()) root, outside = tmp / "root", tmp / "outside" root.mkdir(); outside.mkdir() (outside / "dict.json").write_text('{"real": true}\n') os.symlink(outside, root / "data", target_is_directory=True) # link leaves root mw = FilesystemMiddleware(backend=FilesystemBackend(root_dir=root, virtual_mode=True)) tool = {t.name: t for t in mw.tools}["read_file"] rt = ToolRuntime(state={"messages": []}, context=None, config={}, stream_writer=lambda *_: None, tool_call_id="c1", store=None) tool.func(file_path="/data/dict.json", runtime=rt) # raises instead of returning Self-contained: no model, no API key, no network. It drives the real "read_file" tool, so the result is what an agent turn would receive. Equivalent through "create_deep_agent(...)" with any model scripted to call "read_file(file_path="/data/dict.json")". A symlink pointing outside the workspace is what any "mount the dataset/config into the agent's directory" step produces. On Windows, substitute an NTFS junction ("mklink /J") — symlinks there need elevation, and the failing check is platform-independent.