fix(harness): reject workspace path traversal

[RainYuY]

AgentScope-Java Version

2.0.1-SNAPSHOT

Description

Background

In ROOTED filesystem mode, relative paths containing parent-directory segments such as ../secret.txt could be normalized outside the configured workspace root. Similar traversal paths could also reach workspace read, write, append, and copy operations through WorkspaceManager.

Changes

• Reject exact .. path segments for both Unix-style and Windows-style separators.
• Preserve valid names containing literal double dots, such as some..dir/note.txt.
• Ensure resolved paths in ROOTED mode remain under the configured workspace root.
• Prevent relative paths from escaping user namespaces.
• Report rejected file uploads as permission_denied.
• Apply the same path validation to workspace-relative read, write, append, and copy operations.
• Add regression tests covering:
  • Relative path traversal.
  • File upload traversal.
  • Cross-namespace traversal.
  • Windows-style traversal paths.
  • Valid filenames containing literal double dots.
  • Logical absolute paths that still resolve inside the workspace.

Testing

JAVA_HOME=/path/to/jdk17 mvn \
  -pl agentscope-harness \
  -am \
  -Dtest=LocalFilesystemModeTest,WorkspaceManagerPathSafetyTest \
  -Dsurefire.failIfNoSpecifiedTests=false \
  test

[RainYuY]

@chickenlj @jujn PTAL