FilesystemBackend: Read and write files directly from the filesystem.
Check if content is empty and return warning message.
Format file content with line numbers (cat -n style).
Chunks lines longer than MAX_LINE_LENGTH with continuation markers (e.g., 5.1, 5.2).
Perform string replacement with occurrence validation.
Protocol for pluggable memory backends (single, unified).
Backends can store files in different locations (state, filesystem, database, etc.) and provide a uniform interface for file operations.
All file data is represented as dicts with the following structure: { "content": list[str], # Lines of text content "created_at": str, # ISO format timestamp "modified_at": str, # ISO format timestamp }
Result from backend edit operations.
Result of a single file download operation.
The response is designed to allow partial success in batch operations. The errors are standardized using FileOperationError literals for certain recoverable conditions for use cases that involve LLMs performing file operations.
Structured file listing info.
Minimal contract used across backends. Only "path" is required. Other fields are best-effort and may be absent depending on backend.
Result of a single file upload operation.
The response is designed to allow partial success in batch operations. The errors are standardized using FileOperationError literals for certain recoverable conditions for use cases that involve LLMs performing file operations.
Structured grep match entry.
Result from backend write operations.
Backend that reads and writes files directly from the filesystem.
Files are accessed using their actual filesystem paths. Relative paths are resolved relative to the current working directory. Content is read/written as plain text, and metadata (timestamps) are derived from filesystem stats.
This backend grants agents direct filesystem read/write access. Use with caution and only in appropriate environments.
Appropriate use cases:
Inappropriate use cases:
StateBackend, StoreBackend, or
SandboxBackend insteadSecurity risks:
.env files)Recommended safeguards:
StateBackend, StoreBackend or SandboxBackendIn general, we expect this backend to be used with Human-in-the-Loop (HITL) middleware, or within a properly sandboxed environment if you need to run untrusted workloads.
virtual_mode=True is primarily for virtual path semantics (for example with
CompositeBackend). It can also provide path-based guardrails by blocking
traversal (.., ~) and absolute paths outside root_dir, but it does not
provide sandboxing or process isolation. The default (virtual_mode=False)
provides no security even with root_dir set.