06 filesystem permission interrupts

它是什么

除了 interrupt_on，Deep Agents 的内置文件系统工具也能通过 FilesystemPermission(mode="interrupt") 暂停。命中规则时，会产生和普通工具审批一样的 interrupt。它解决的问题是：按路径和操作类型保护文件写入。

常用程度

中。涉及写文件、改配置、写 secrets、写生产目录时很有用。

最小代码

文件：deepagent_src/human_loop_teach/06_filesystem_permission_interrupt.py

permissions=[
    FilesystemPermission(
        operations=["write"],
        paths=["/secrets/**"],
        mode="interrupt",
    )
]

运行

uv run python deepagent_src/human_loop_teach/06_filesystem_permission_interrupt.py

预期输出末尾：

filesystem permission interrupt HITL real agent ok

验证方式

脚本要求 Agent 写 /secrets/key.txt，文件系统权限规则触发 interrupt。approve 后，虚拟文件系统的 write_file 才执行。

常见误区

这里保护的是 Deep Agents 的虚拟文件系统工具，不是操作系统真实 /secrets。生产里还要配真实后端权限，不要只靠模型层审批。

相关资源

查看示例代码：deepagent_src/human_loop_teach/06_filesystem_permission_interrupt.py

from __future__ import annotations

from deepagents import FilesystemPermission, create_deep_agent
from langgraph.checkpoint.memory import MemorySaver
from langgraph.types import Command

from _hitl_output import print_graph_output, require_interrupt, tool_messages
from _model import get_real_model


def main() -> None:
    agent = create_deep_agent(
        model=get_real_model(),
        permissions=[
            FilesystemPermission(
                operations=["write"],
                paths=["/secrets/**"],
                mode="interrupt",
            )
        ],
        checkpointer=MemorySaver(),
        system_prompt=(
            "When asked to save content to a path, call write_file exactly once."
        ),
    )
    config = {"configurable": {"thread_id": "hitl-filesystem-permission"}}
    result = agent.invoke(
        {
            "messages": [
                {
                    "role": "user",
                    "content": "把内容 demo 写入 /secrets/key.txt",
                }
            ]
        },
        config=config,
        version="v2",
    )
    print_graph_output(result)
    interrupt_value = require_interrupt(result)
    assert interrupt_value["action_requests"][0]["name"] == "write_file"

    result = agent.invoke(
        Command(resume={"decisions": [{"type": "approve"}]}),
        config=config,
        version="v2",
    )
    print_graph_output(result)

    assert any("/secrets/key.txt" in output for output in tool_messages(result, name="write_file"))
    print("filesystem permission interrupt HITL real agent ok")


if __name__ == "__main__":
    main()