Fix AGENTS realpath containment on CI

[Waishnav]

Summary

• canonicalize workspace and agent roots before checking resolved AGENTS.md targets
• keep escaped symlink targets blocked while allowing platform path aliases such as macOS /var -> /private/var
• add coverage for opening a checkout through a symlinked workspace alias

Context

PR #65 passed on Ubuntu but failed macOS and Windows smoke tests because resolved file paths were compared against non-canonical roots, causing initial AGENTS files to be skipped.

Tests

• npx tsx src/workspaces.test.ts
• npm run typecheck
• npm test

Summary by CodeRabbit

• Bug Fixes
  • Improved initial instruction discovery by resolving workspace root and agent directories to their real paths before validating and loading initial-context files.
  • Fixed cases where expected global and root instruction files could be missing or not matched correctly when setups involve aliases or symlinks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c26faf74-9e80-455d-928e-dc9544560eae

📥 Commits

Reviewing files that changed from the base of the PR and between 6242f29 and 2fd5dc3.

📒 Files selected for processing (1)

• src/workspaces.test.ts

---

📝 Walkthrough

Walkthrough

loadInitialAgentsFiles now resolves the workspace root and agentDir before reading initial context files. The workspace tests also adjust AGENTS.md setup for Windows vs non-Windows and add an alias-root assertion for the collected agentsFiles.

Changes

Alias Root Realpath Resolution

Layer / File(s)	Summary
Resolve root/agentDir paths and validate via test src/workspaces.ts, src/workspaces.test.ts	loadInitialAgentsFiles resolves root and agentDir via tryRealpath before calling readResolvedContextFile; tests update AGENTS.md setup by platform and assert agentsFiles contents for an alias-root workspace.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant workspaces.test.ts
  participant loadInitialAgentsFiles
  participant tryRealpath
  participant readResolvedContextFile

  workspaces.test.ts->>loadInitialAgentsFiles: open workspace at aliasRoot
  loadInitialAgentsFiles->>tryRealpath: resolve root
  tryRealpath-->>loadInitialAgentsFiles: resolvedRoot
  loadInitialAgentsFiles->>tryRealpath: resolve agentDir
  tryRealpath-->>loadInitialAgentsFiles: resolvedAgentDir
  loadInitialAgentsFiles->>readResolvedContextFile: read with resolvedRoot and resolvedAgentDir
  readResolvedContextFile-->>loadInitialAgentsFiles: content
  loadInitialAgentsFiles-->>workspaces.test.ts: agentsFiles

Loading

Poem

A rabbit hopped through symlinked ground,
Chasing real paths till they were found,
Root and agentDir now surely align,
Global and root notes in proper time,
Thump thump — the tests all pass just fine 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: fixing AGENTS realpath containment issues in CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-agents-realpath-ci

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}