fix(skill): ensure thread-safe file uploads in SkillBox using fine-grained path locks

[jujn]

Description

Close #1096

Checklist

Please check the following items before code is ready to be reviewed.

• Code has been formatted with mvn spotless:apply
• All tests are passing (mvn test)
• Javadoc comments are complete and follow project conventions
• Related documentation has been updated (e.g. links, examples, etc.)
• Code is ready for review

[Copilot]

Pull request overview

This PR fixes a concurrency issue where multiple SkillBox instances can concurrently overwrite the same uploaded skill files, by introducing per-target-path synchronization and adding a regression test that exercises concurrent uploads.

Changes:

• Add a static per-file-path lock map in SkillBox.uploadSkillFiles() and synchronize writes per target file.
• Add a multi-threaded JUnit test to validate concurrent uploads do not throw and do not corrupt/truncate file contents.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
agentscope-core/src/main/java/io/agentscope/core/skill/SkillBox.java	Serializes file writes per resolved target path to prevent concurrent overwrite corruption.
agentscope-core/src/test/java/io/agentscope/core/skill/SkillBoxTest.java	Adds a concurrent upload test to reproduce/prevent the reported race.

Comments suppressed due to low confidence (2)

agentscope-core/src/main/java/io/agentscope/core/skill/SkillBox.java:59

• FILE_LOCKS is a static map that only ever grows (one entry per unique uploaded file path) and is never cleaned up. If agents use different work dirs (e.g., default temp dirs), this can cause unbounded memory growth over a long-running process. Consider using lock striping (fixed array of locks) or using a ReentrantLock per path with safe cleanup when no threads are queued (e.g., remove after unlock when uncontended).

    public SkillBox(Toolkit toolkit) {
        this(toolkit, null, null);

agentscope-core/src/main/java/io/agentscope/core/skill/SkillBox.java:781

• The per-file lock is held while doing Base64 decoding, which increases contention for concurrent uploads to the same file. Decode the content outside the synchronized section and only synchronize the actual filesystem write to minimize time under the lock.

                    fileCount++;
                } catch (IOException | IllegalArgumentException e) {
                    logger.error("Failed to upload file {}: {}", resourcePath, e.getMessage());
                }
            }

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!