Options for creating filesystem middleware.
interface FilesystemMiddlewareOptionsBackend instance or factory (default: StateBackend)
Optional descriptions for built-in filesystem tools.
Keys correspond to FsToolName. Descriptions for tools that are not
enabled by the tools allowlist are ignored because those tools are not
exposed to the model.
Optional token limit before evicting a HumanMessage to the filesystem (default: 50000 tokens, ~200KB)
Filesystem permission rules enforced on every tool call.
Rules are evaluated in declaration order; first match wins; permissive
default. Applies to ls, read_file, write_file, edit_file,
glob, and grep.
Note on execute: permissions are not enforced on execute because
shell commands can access any path regardless of path-based rules. Using
permissions with an execution-capable backend (one where isSandboxBackend
returns true) throws a ConfigurationError unless either:
execute is disabled via tools, orCompositeBackend and every permission path is scoped to
a route prefix.When omitted or empty, all filesystem operations are permitted.
System prompt override. Set to null to disable. Defaults to ASYNC_TASK_SYSTEM_PROMPT.
Allowlist of built-in filesystem tools to expose to the model.
undefined, null, and "all" preserve the default behavior: every
filesystem tool is registered, subject to backend capability filtering.read_file must be included in every explicit array because it is used
by normal file-inspection flows and by large-result recovery guidance.execute is removed when the resolved backend does not support
command execution, even if it appears in this allowlist.The generated filesystem system prompt is based on the tools that remain visible after this allowlist and backend capability filtering are applied.
createFilesystemMiddleware({
tools: ["read_file", "ls", "glob", "grep"],
});Optional token limit before evicting a tool result to the filesystem (default: 20000 tokens, ~80KB)