fix(#2312): prevent nested workspace directory in SANDBOXED mode when project is subdirectory of workspace [FaaFyfxR9WAQrL7FcAgEHJvztd8cVMxvjHRS55rw1nwH]

[waterWang]

Summary

When LocalFilesystemSpec is configured with LocalFsMode.SANDBOXED and the project directory is a subdirectory of the workspace (e.g., project=agentRoot/workspace, workspace=agentRoot), the OverlayFilesystem creates a circular dependency: the lower layer (project) is inside the upper layer (workspace).

This manifests as a nested working directory being created inside the user's workspace in SANDBOXED mode, while the same configuration works correctly in local mode.

Root Cause

In LocalFilesystemSpec.toFilesystem(), the overlay always creates two layers:

• Upper layer: LocalFilesystemWithShell(workspace, ...)
• Lower layer: LocalFilesystem(project, ...)

When project is a subdirectory of workspace, the lower layer is inside the upper layer's file tree, causing the overlay to create a nested directory structure.

Fix

1. Added an isSubdirectoryOf() helper that checks whether one path is a subdirectory of another (both normalized).
2. In toFilesystem(), detect when the project is a subdirectory of the workspace. When this is the case:
   • Skip adding the project to policyRoots (workspace already covers it)
   • Skip creating the overlay — use the workspace directly
   • The project directory will be created as a regular subdirectory when the agent first accesses it

Testing

• Existing tests should continue to pass since the overlay path is only skipped when the project is explicitly a subdirectory of the workspace, which is a rare edge case
• Manual verification: configure LocalFilesystemSpec with mode=LocalFsMode.SANDBOXED, project=agentRoot/workspace, workspace=agentRoot — no nested directory should be created

Closes #2312

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[oss-maintainer]

CI Failure — Spotless formatting

Build fails on spotless:check in agentscope-harness:

LocalFilesystemSpec.java — trailing newline mismatch at end of file

Fix: run mvn spotless:apply locally and push the formatted result.

[oss-maintainer]

Review: fix(#2312): prevent nested workspace directory in SANDBOXED mode

The logic is sound — detecting when project is a subdirectory of workspace and skipping the overlay avoids the circular dependency. The isSubdirectoryOf() helper with normalization is correct.

However, CI is failing due to a Spotless formatting violation (trailing newline) in LocalFilesystemSpec.java. Please run mvn spotless:apply and push the fix.

Code observations

• isSubdirectoryOf() correctly normalizes both paths before comparison
• Skipping policyRoots.add(effectiveProject) when it's a subdirectory is correct — workspace already covers it
• Returning upper directly (without overlay) when project ⊆ workspace is the right call

Once formatting is fixed, this should be good to merge.