如何工具运行在workspace之外的路径 （指定项目路径）

[zxqQing]

.workspace(workspace) .filesystem(new LocalFilesystemSpec() .project(Path.of("D:/zxq/agent/QCodeTest")) .mode(LocalFsMode.ROOTED) .projectWritable(true) .inheritEnv(true) .isolationScope(IsolationScope.GLOBAL))

根据你当前的 sandbox 安全策略（已在 MEMORY.md 中明确固化为硬性规则）：

✅ 所有文件工具（如 read_file, list_files, glob_files, grep_files）仅允许访问以下两个根路径内的文件：

• D:\zxq\agent\QCode（你的 Java/Spring Boot 项目）
• C:\Users\zxq.qcode\workspace（你的 agent 工作区）
  ❌ D:\zxq\agent\QCodeTest 不在授权路径内，因此：
• read_file "D:/zxq/agent/QCodeTest/main.py" → ❌ 会被工具直接拒绝（报错：“Path does not exist” 或 “Access denied: outside allowed roots”）
• 同样，list_files "D:/zxq/agent/QCodeTest"、glob_files pattern="**/*.py" path="D:/zxq/agent/QCodeTest" 等全部失败
  这是有意设计的安全边界（非 bug、非临时限制），目的是防止越权读取、保障工程环境隔离。你之前也已确认并接受该策略 —— 并约定：对 QCodeTest 等外部目录，唯一合规方式是生成用户本地可执行的 PowerShell 脚本。

[stanleys12]

With the config you pasted, the framework already allows D:/zxq/agent/QCodeTest. The refusal you quoted looks like it comes from the model, not from the filesystem layer.

In ROOTED mode, absolute paths are accepted when they fall under the project root, the workspace, or any extra roots. LocalFilesystemSpec.toFilesystem builds that list from exactly those three sources, so your .project(Path.of("D:/zxq/agent/QCodeTest")) is in the allow-list:

agentscope-java/agentscope-harness/src/main/java/io/agentscope/harness/agent/filesystem/spec/LocalFilesystemSpec.java

Lines 325 to 329 in 44ec9e7

	List<Path> policyRoots = new ArrayList<>();
	policyRoots.add(effectiveProject);
	policyRoots.add(workspace);
	policyRoots.addAll(additionalRoots);
	PathPolicy pathPolicy = PathPolicy.of(policyRoots);

Your message says the allowed roots are QCode and C:\Users\zxq\.qcode\workspace, and that this rule is written in MEMORY.md. I found no such rule in the framework. The enum docs describe ROOTED as "project + workspace + additional roots":

agentscope-java/agentscope-harness/src/main/java/io/agentscope/harness/agent/workspace/LocalFsMode.java

Lines 26 to 34 in 44ec9e7

	* absolute paths leaving the root. Equivalent to the legacy {@code virtualMode=true}.
	* <li>{@link #ROOTED} — absolute paths are accepted only when they fall under one of the
	* roots in the configured {@link PathPolicy} (project + workspace + additional roots).
	* Relative paths still resolve against the filesystem root. This is the default for
	* Local-mode agents and matches the Claude-Code-style "project + additional dirs"
	* allow-list.
	* <li>{@link #UNRESTRICTED} — absolute paths pass through unchanged. Equivalent to the legacy
	* {@code virtualMode=false}. Escape hatch for tools or tests that need to read arbitrary
	* host paths.

So the likely cause is that MEMORY.md in your workspace contains that "hard rule" text, and the model is obeying it. Edit or remove that section of MEMORY.md, or clear the old memory, and the agent should stop refusing. If it still gets a real error from a tool, paste the exact tool error. A model's own explanation is not evidence of what the tool enforces.

To give the agent several directories, keep one as project and add the others as extra roots:

new LocalFilesystemSpec()
    .project(Path.of("D:/zxq/agent/QCodeTest"))
    .addRoot(Path.of("D:/zxq/agent/QCode"))
    .mode(LocalFsMode.ROOTED)
    .projectWritable(true)

addRoot is defined at L221 of the same file. additionalRoots(Collection) does the same for a list.

Two other notes:

• projectWritable(true) routes writes for non-workspace paths into the project directory. The shell's pwd is also the project directory (see the project javadoc at L263-L277).
• If you want no path restriction at all, .mode(LocalFsMode.UNRESTRICTED) lets absolute paths through unchanged. Only use it if you trust the agent with the whole host disk.

(I looked this up in the code with help from an AI assistant; the links are to the lines I checked.)

[zxqQing]

Thanks for your reply! I found the issue: I wasn’t recreating the HarnessAgent before each conversation, so the project directory wasn’t being updated. As a result, the filesystem was still using the previous configuration.

[stanleys12]

Glad that worked. If it answers your question, marking it as the answer helps the next person who searches for this.