feat(sdk): scope permissions to routes for composite backends with sandbox default

[Nick Hollon (nick-hollon-lc)]

Summary

Previously, _PermissionMiddleware unconditionally rejected any backend that supported execution (SandboxBackendProtocol), even when permissions only targeted paths under composite backend routes that don't involve execution at all.

This PR adds a check (_all_paths_scoped_to_routes) so that when a CompositeBackend has a sandbox default, permissions are allowed as long as every permission path is scoped under a known route prefix. Permissions that cover paths outside routes (hitting the sandbox default) still raise NotImplementedError.

Examples

from deepagents import create_deep_agent
from deepagents.backends import CompositeBackend
from deepagents.middleware.permissions import FilesystemPermission

sandbox = SandboxBackend(...)  # supports execution
memories = StoreBackend(...)

composite = CompositeBackend(
    default=sandbox,
    routes={"/memories/": memories},
)

# Previously raised NotImplementedError — now works because
# permissions are scoped entirely to the /memories/ route
agent = create_deep_agent(
    model=model,
    backend=composite,
    permissions=[
        FilesystemPermission(operations=["write"], paths=["/memories/**"], mode="deny"),
    ],
)

# Permissions outside any route still raise — they'd hit the sandbox default
agent = create_deep_agent(
    model=model,
    backend=composite,
    permissions=[
        FilesystemPermission(operations=["write"], paths=["/workspace/**"], mode="deny"),
    ],
)
# -> NotImplementedError

# Wildcard paths also raise — /** covers both routes and the default
agent = create_deep_agent(
    model=model,
    backend=composite,
    permissions=[
        FilesystemPermission(operations=["read"], paths=["/**"], mode="deny"),
    ],
)
# -> NotImplementedError

Changes

• permissions.py: Added _all_paths_scoped_to_routes helper and refined the __init__ guard to allow route-scoped permissions with sandbox defaults
• test_end_to_end.py: Added TestCompositeBackendPermissionsEndToEnd with 6 tests covering route-scoped allow/deny, wildcard rejection, mixed-path rejection, and multi-route scenarios

[Sydney Runkle (sydney-runkle)]

NICE

[Sydney Runkle (sydney-runkle)]

BOOM