Filesystem Claude middleware rejects allowed nested paths on Windows #40063

Submission checklist

• This is a bug, not a usage question.
• I added a clear and descriptive title that summarizes this issue.
• I used the GitHub search to find a similar question and didn't find it.
• I am sure that this is a bug in LangChain rather than my code.
• The bug is not resolved by updating to the latest stable version of LangChain (or the specific integration package).
• This is not related to the langchain-community package.
• I posted a self-contained, minimal, reproducible example. A maintainer can copy it and run it AS IS.

Package (Required)

• langchain
• langchain-openai
• langchain-anthropic
• langchain-classic
• langchain-core
• langchain-model-profiles
• langchain-tests
• langchain-text-splitters
• langchain-chroma
• langchain-deepseek
• langchain-exa
• langchain-fireworks
• langchain-groq
• langchain-huggingface
• langchain-mistralai
• langchain-nomic
• langchain-ollama
• langchain-openrouter
• langchain-perplexity
• langchain-qdrant
• langchain-xai
• Other / not sure / general

Related Issues / PRs

#40060 is the same report, automatically closed because it was submitted through the API without an Issue Type. This Web Form submission replaces it.

#38106 tightened segment-boundary checks for allowed_prefixes, but it does not normalize the filesystem-derived virtual path on Windows. GitHub searches for this middleware, Windows, and allowed_prefixes found no issue or PR with the same symptom.

Reproduction Steps / Example Code (Python)

from pathlib import Path
from tempfile import TemporaryDirectory

from langchain_anthropic.middleware import FilesystemClaudeTextEditorMiddleware

with TemporaryDirectory() as temp_dir:
    root = Path(temp_dir)
    (root / "workspace" / "nested").mkdir(parents=True)

    middleware = FilesystemClaudeTextEditorMiddleware(
        root_path=str(root),
        allowed_prefixes=["/workspace"],
    )

    # This virtual path is a descendant of the allowed prefix.
    resolved = middleware._validate_and_resolve_path(
        "/workspace/nested/file.txt"
    )
    print(resolved)

Error Message and Stack Trace (if applicable)

ValueError: Path must start with one of: ['/workspace']

Description

On Windows, the filesystem-backed Claude text editor rejects a valid nested path when allowed_prefixes is narrower than /. The same base-class logic is used by FilesystemClaudeMemoryMiddleware.

User impact

Windows users cannot view, create, or edit nested files under an explicitly allowed directory. The default memory prefix /memories is affected for nested memory files as well.

Expected behavior

/workspace/nested/file.txt is accepted when /workspace is allowed, and /memories/nested/note.txt is accepted by the filesystem memory middleware.

Actual behavior

The path is rejected with ValueError, even though the resolved filesystem path remains inside root_path and inside the allowed virtual directory.

Root cause

_validate_and_resolve_path reconstructs virtual_path with str(full_path.relative_to(self.root_path)). On Windows this produces /workspace\\nested\\file.txt. _is_within_allowed_prefix deliberately compares forward-slash directory boundaries, so the valid descendant no longer starts with /workspace/.

Proposed fix scope

Convert the root-relative path to POSIX form before applying allowed_prefixes, and add a platform-independent regression test for the shared filesystem base class. No public API or dependency change is required.

System Info

System Information

OS: Windows
OS Version: 10.0.22631
Python Version: 3.13.0 (64-bit)

Package Information

langchain-anthropic: 1.7.0
langchain_core: 1.6.1
langchain: 1.3.18
langsmith: 0.8.18

Repository baseline

origin/master: b4d46a5

Social handles (optional)

No response