Python: Reject Windows junctions in FileSystemAgentFileStore

[sricursion]

Motivation & Context

FileSystemAgentFileStore promises root-scoped access and rejects linked or reparse paths during direct operations, but its directory listing and recursive search paths only checked Path.is_symlink(). On Windows, directory junctions are reparse points that do not report as symlinks, so file_access_grep could descend outside the configured root.

Description & Review Guide

• What are the major changes? Add a shared link and reparse-point predicate using lstat(), POSIX link mode, Path.is_junction() when available, and the Windows reparse attribute fallback. Apply it to direct path validation, directory listing, and recursive search, and add a Windows regression test with a real directory junction.
• What is the impact of these changes? FileSystemAgentFileStore now consistently omits symlinks, junctions, and other reparse points from listing and search, preventing recursive file access from crossing the configured root. Existing regular-file behavior and public APIs are unchanged.
• What do you want reviewers to focus on? The cross-version Windows reparse detection and fail-closed behavior when an entry cannot be inspected.

Related Issue

Fixes #7290

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add [BREAKING] to the title prefix, before or after any language prefix) - a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

This PR hardens the Python FileSystemAgentFileStore containment boundary on Windows by treating NTFS directory junctions (and other reparse points) as link-like entries during listing and recursive search, preventing enumeration from escaping the configured root.

Changes:

• Introduces a shared _is_link_or_reparse_point() predicate (symlink + junction + Windows reparse attribute) and uses it across direct path validation, directory listing, and recursive search enumeration.
• Updates link/reparse probing to be lstat()-based and fail-closed when link/reparse status cannot be determined.
• Adds a Windows regression test that creates a real directory junction and asserts that read/list/search do not traverse it.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
python/packages/core/agent_framework/_harness/_file_access.py	Adds unified link/reparse detection and applies it consistently to validation, listing, and recursive search enumeration.
python/packages/core/tests/core/test_harness_file_access.py	Adds a Windows junction regression test and updates the fail-closed probe test to patch Path.lstat.

[sricursion]

@microsoft-github-policy-service agree

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/core/agent_framework/_harness
_file_access.py	634	50	92%	93, 203, 234, 297, 407, 409, 421, 425, 453, 466–467, 474–481, 485, 489, 855–856, 881, 885, 940–942, 964–967, 1006, 1008, 1065, 1067, 1471–1472, 1483–1484, 1496–1497, 1511–1512, 1535–1536, 1551, 1556–1557, 1586
TOTAL	45539	4473	90%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9386	34 💤	0 ❌	0 🔥	2m 30s ⏱️

[sricursion]

Thanks Eduard and Westey.