agents/middleware/execution-environment

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Execution environment middleware capabilities

The execution environment middleware gives the agent a workspace: tools it can call, a filesystem for reading and writing files across turns, and code execution for running scripts or shell commands. This is provided by FilesystemMiddleware.

FilesystemMiddleware tools provided

FilesystemMiddleware provides the following file system tools to work with a sandbox: read_file, write_file, edit_file, delete, glob, and grep. When used with LangSmithSandbox backend which implements the sandbox protocol, FilesystemMiddleware also adds the execute tool, allowing the agent to run shell commands.

LangSmithSandbox isolated environment

LangSmithSandbox gives the agent an isolated environment with a filesystem and an execute tool for running shell commands. With it, the agent can install packages, write scripts, and run them without touching the host. To boot from a custom image instead of the default runtime, pass snapshot_name or snapshot_id (Python) or snapshotId (JavaScript) to create_sandbox() or LangSmithSandbox.create().

LangSmithSandbox file upload paths must be absolute POSIX

With LangSmithSandbox, upload paths must be absolute POSIX paths (for example, /sales.csv). Relative paths such as sales.csv are rejected with invalid_path error and the file is not written to the sandbox.

ShellToolMiddleware purpose

ShellToolMiddleware exposes a persistent shell session to agents for command execution. It is useful for agents that need to execute system commands, development and deployment automation tasks, testing and validation workflows, and file system operations and script execution. Security consideration: use appropriate execution policies (HostExecutionPolicy, DockerExecutionPolicy, or CodexSandboxExecutionPolicy) to match deployment security requirements. Limitation: persistent shell sessions do not currently work with interrupts (human-in-the-loop).

ShellToolMiddleware configuration parameters

ShellToolMiddleware accepts: workspace_root (str | Path | None) base directory for shell session, if omitted a temporary directory is created and removed at agent end; startup_commands (tuple[str] | list[str] | str | None) optional commands executed sequentially after session starts; shutdown_commands (tuple[str] | list[str] | str | None) optional commands executed before session shuts down; execution_policy (BaseExecutionPolicy | None) controls timeouts, output limits, and resources with options HostExecutionPolicy (full host access, default), DockerExecutionPolicy (separate Docker container per run), CodexSandboxExecutionPolicy (Codex CLI sandbox); redaction_rules (tuple[RedactionRule] | list[RedactionRule] | None) optional rules sanitizing command output before returning to model; tool_description (str | None) optional override for registered shell tool description; shell_command (Sequence[str] | str | None) optional shell executable or arguments, defaults to /bin/bash; env (Mapping[str, Any] | None) optional environment variables supplied to shell session.

ShellToolMiddleware example - host execution

from langchain.agents import create_agent from langchain.agents.middleware import ( ShellToolMiddleware, HostExecutionPolicy, ) agent = create_agent( model="gpt-5.5", tools=[search_tool], middleware=[ ShellToolMiddleware( workspace_root="/workspace", execution_policy=HostExecutionPolicy(), ), ], ) This shows basic shell tool with host execution policy.

ShellToolMiddleware example - Docker isolation

from langchain.agents import create_agent from langchain.agents.middleware import ( ShellToolMiddleware, DockerExecutionPolicy, ) agent_docker = create_agent( model="gpt-5.5", tools=[], middleware=[ ShellToolMiddleware( workspace_root="/workspace", startup_commands=["pip install requests", "export PYTHONPATH=/workspace"], execution_policy=DockerExecutionPolicy( image="python:3.11-slim", command_timeout=60.0, ), ), ], ) This shows Docker isolation with startup commands and custom timeout.

Give your agent this brain