LangChain

langchain-inis is a native backend for LangChain Deep Agents — it implements deepagents.backends.sandbox.BaseSandbox directly, so create_deep_agent(backend=...) is the whole integration. For teams not using Deep Agents, the same package ships a lower-level LangGraph recipe.

Install

pip install langchain-inis deepagents

Usage

from inis import Client
from deepagents import create_deep_agent
from langchain_inis import InisSandboxBackend

backend = InisSandboxBackend.create()  # owned: this app destroys it
try:
    agent = create_deep_agent(model="anthropic:claude-sonnet-5", backend=backend)
    result = agent.invoke({"messages": [{"role": "user", "content": "List /workspace, then write hello.txt"}]})
    print(result["messages"][-1].content)
finally:
    backend.destroy()

No custom lifecycle tools in the model prompt — passing backend=backend is the whole integration. Deep Agents auto-registers ls/read_file/write_file/edit_file/glob/grep and execute against it, all bounded to the sandbox.

Owned vs. attached

• InisSandboxBackend.create(...) — a brand-new session this app owns and must backend.destroy() when done.
• InisSandboxBackend.attach(session_id, ...) — binds to a session this app does not own. Never destroys it; call backend.close() when done, which only releases the backend's local HTTP transport.

backend = InisSandboxBackend.attach(existing_session_id)
try:
    agent = create_deep_agent(model=..., backend=backend)
    ...
finally:
    backend.close()  # local transport only — the session is not this app's to destroy

One agent thread/conversation should map to one session — resolve session_id per thread using whatever key your app already tracks conversations by.

What it does

• execute/aexecute (shell)
• upload_files/download_files (+ async) — base64 for binary
• Every derived file op (ls/read/write/edit/grep/glob/delete) — BaseSandbox's own defaults, unmodified
• Owned/attached lifetime split — see above
• Structured error mapping — InisError.code mapped onto FileOperationError literals where it matches

Notes

True remote cancellation of an in-flight execute() is not implemented — BaseSandbox.execute(command, timeout=...) is timeout-only, with no abort hook. A timeout still ends the call. Streaming output is not implemented either.

enable_capture_offload is forced False: Deep Agents' automatic eviction of oversized tool results needs to write to a directory outside /workspace, which a non-root inis.run session can't do. Nothing is silently dropped — the practical ceiling is inis.run's own guest-side capture cap (up to 4 MiB per stream). Bound noisy commands yourself (head -c/tail -c, or write to a file and read back a slice). ExecuteResponse.truncated is set directly from inis.run's own per-stream truncation signal.

LangGraph recipe (lower-level, secondary path)

For teams not using Deep Agents, examples/langgraph_recipe.py is a complete, runnable example using plain LangGraph primitives (@tool, ToolNode, StateGraph): one session per graph thread ID, a bounded tool surface, and a small file-backed session store demonstrating a session ID surviving a process restart.

python examples/langgraph_recipe.py           # creates (or reattaches to) demo-thread-1
python examples/langgraph_recipe.py --end      # ... and cleans it up

TypeScript / LangChain.js

No dedicated langchain-inis JS package — use the TypeScript SDK directly, or the AI SDK helper if the app already runs on Vercel AI SDK. The surface is thin enough to inline as a LangChain.js Tool.

vs Pydantic AI

Both wrap the same Python SDK. Pick one — or use remote MCP and skip framework glue entirely.