agentscope-ai / agentscope-ai/agentscope-java

[Bug]:compaction summary leaks host filesystem path into the agent prompt (invalid inside Docker sandbox)

Abierto
#2,566 1 comentario 0 reacciones 0 asignados Ver en GitHub
area/build area/core/memory area/extensions bug
Lenguaje dominante
Java
Estrellas
5.6k
Forks
1.3k
Merge medio
4 d 12 h
PR fusionados (30 d)
77

Descripción

**Describe the bug**

When compaction is enabled and the agent runs in a Docker sandbox, the injected summary message leaks a **host-side filesystem path** to the original conversation history instead of a sandbox-visible path.

With `CompactionConfig.offloadBeforeCompact` at its default (`true`), `MemoryFlushManager#resolveOffloadPath` returns the host-local session-JSONL path via `workspaceManager.resolveSessionContextFile(...).toString()`, and `ConversationCompactor#buildSummaryMessage` (~L441) embeds it verbatim into the agent-facing summary text:

> *The full conversation history has been saved to `.agentscope\docker-compaction\workspace\alice\agents\compaction-agent\sessions\alice-session-id.jsonl` should you need to refer back to it for details.*

This path does not exist inside the container (where `pwd` is `/workspace`). On a Windows host the path also contains backslashes, which are valid filename characters — not separators — on Linux, so any attempt by the agent to "refer back" to it fails. The statement is factually wrong and can mislead the agent.

**To Reproduce**

Steps to reproduce the behavior:

1. Build a `HarnessAgent` with a `DockerFilesystemSpec` and a `CompactionConfig` that triggers compaction (default `offloadBeforeCompact(true)`):

```java
HarnessAgent agent = HarnessAgent.builder()
.name("compaction-agent")
.model(model)
.workspace(Paths.get(".agentscope/docker-compaction/workspace"))
.stateStore(new JsonFileAgentStateStore(Paths.get(".agentscope/docker-compaction/state")))
.compaction(CompactionConfig.builder()
.triggerMessages(10)
.keepMessages(3)
.build())
.filesystem(new DockerFilesystemSpec()
.image("ubuntu:24.04")
.snapshotSpec(new LocalSnapshotSpec(Paths.get(".agentscope/docker-compaction/snapshot"))))
.build();
RuntimeContext ctx = RuntimeContext.builder().userId("alice").sessionId("alice-session-id").build();
agent.call(new UserMessage("Create an agents.md file declaring your name is coder ..."), ctx).block();
```

2. The single `agent.call` must exercise enough tool calls for the message history to exceed `triggerMessages`. The prompt above triggers 5 tool rounds — `list_files` ×2, `execute("pwd && ls -la")`, `write_file`, `read_file` — i.e. 11 messages, which trips compaction.
3. Inspect the injected summary USER message (`name = __compaction_summary__`) in the session JSONL. It contains the host path shown above; inside the container that path does not exist.

**Expected behavior**

The compaction summary should not present a host-local filesystem path to an agent executing inside a sandbox. Either omit the path from the summary text (the offloaded archive is for operator/external use, not for the agent to `cat` inside the container), or expose a path that is actually resolvable within the sandbox namespace (if a host→sandbox path translation is available).

**Error messages**

No exception or stack trace — this is a silent semantic defect. The observable signal is the incorrect path inside the summary message. If the agent subsequently tries to read it (e.g. `read_file(".agentscope\docker-compaction\...")`), the tool call fails with `Empty or not a directory` / file-not-found because the path does not exist in the container.

**Environment (please complete the following information)**

- AgentScope-Java Version: 2.0.0
- Java Version: 17
- OS: Windows (host); sandbox is an `ubuntu:24.04` Docker container

**Additional context**

- Workaround: `CompactionConfig.builder().offloadBeforeCompact(false)` makes `buildSummaryMessage` take the path-less `else` branch. But this also disables message offload, so it is a workaround rather than a fix.
- The bug is mostly invisible under the Local (non-sandbox) filesystem — the path separator is correct and the file lives in the same filesystem. The Docker sandbox amplifies it (path does not exist + `\` is not a separator on Linux), which is likely why it went unnoticed.
- Relevant source (2.0.0): `agentscope-harness/.../memory/compaction/ConversationCompactor.java` (~L441, `buildSummaryMessage`) and `agentscope-harness/.../memory/MemoryFlushManager.java` (~L194, `resolveOffloadPath`).

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.