fix(harness): use ':' separator in sandbox slot session id so SQL stores accept it

[logicwu0]

AgentScope-Java Version

2.0.1-SNAPSHOT (main); bug also present in 2.0.0.

Description

Fixes #2327.

Background. SessionSandboxStateStore.slotSessionId() packs the sandbox SandboxIsolationKey into a single sessionId string using / as the segment separator (e.g. sandbox/session/<id>, sandbox/user/<agentId>/<id>, sandbox/agent/<agentId>, sandbox/global). That string is then passed as the sessionId argument to the backing AgentStateStore.

Problem. SQL-backed stores validate the sessionId and reject / and \ as path separators — PostgresAgentStateStore.validateSessionId and MysqlAgentStateStore.validateSessionId both throw IllegalArgumentException in that case. As a result, sandbox state persistence fails on every SQL backend under any IsolationScope (SESSION/USER/AGENT/GLOBAL). The original issue reported Postgres, but MySQL is affected too: its slotId() uses : only to join userId/sessionId, so it cannot dodge the / that already lives inside the sandbox slot's sessionId.

Fix. Switch the slot-id segment separator from / to :. This is exactly the convention MysqlAgentStateStore#slotId already relies on (and documents) for the same validateSessionId reason, so it stays consistent with the codebase. The change is on the producer side (SessionSandboxStateStore), so it fixes all backing stores at once; no store-specific changes needed. No code reverse-parses these slot strings on /, so changing the separator is safe.

How to test. Added slotSessionId_hasNoPathSeparators_soSqlStoresAccept_allScopes in SessionSandboxStateStoreTest. It drives the store through a backend that mirrors the validateSessionId contract (rejects //\) and round-trips save/load/delete for all four isolation scopes. It fails (RED) with the old / separators — IllegalArgumentException: ... cannot contain path separators: sandbox/session/sess-001, the same error seen on Postgres/MySQL — and passes (GREEN) with the fix. The pre-existing tests (which use InMemoryAgentStateStore, no validation) are unchanged.

mvn -pl agentscope-harness test: all green; spotless:check clean.

Checklist

Please check the following items before code is ready to be reviewed.

• Code has been formatted with mvn spotless:apply
• All tests are passing (mvn test)
• Javadoc comments are complete and follow project conventions
• Related documentation has been updated (e.g. links, examples, etc.)
• Code is ready for review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!