[Bug][Windows] A file path whose case differs from the cwd (e.g. c:\ vs C:\) makes agent-instructions load AGENTS.md from outside the project

[luciomerlo]

Version: 0.2.2-rc.1 (commit fcc0ad4), Windows.

Summary

When a file tool (read, write, edit, …) is called with an absolute file_path whose letter case differs from the session cwd, for example a lowercase drive letter (c:\work\proj\src\a.ts while the cwd is C:\work\proj), nested-instruction discovery walks past the project root up to the drive root. It then probes and injects instruction files from every directory on the way, including C:\AGENTS.md and C:\work\AGENTS.md, which are outside the project.

Root cause

packages/context/agent-instructions/src/files.ts:

• descendantDirsBetween() (lines 276-283) checks containment with path.relative(). On win32 that check ignores case, so c:\work\proj\src counts as inside C:\work\proj.
• It then calls ancestorChain(resolvedRoot, targetDir) (lines 255-268), which stops on current !== resolvedRoot. That is an exact, case-sensitive string comparison, so the loop never matches the root. It climbs to c:\ and then appends the root.

state.ts:302-303 passes the model's raw file_path (taken from index.ts:77-83 without normalization) and turns each returned directory into a scope with relativeScope(projectRoot, dir). c:\ becomes ..\.., and files.ts:533 reads it back as join(projectRoot, '..\\..') = C:\.

Reproduction

The real descendantDirsBetween was run under vitest with node:path mocked to path.win32:

descendantDirsBetween('C:\\work\\proj', 'C:\\work\\proj\\src\\a.ts') -> ["C:\\work\\proj\\src"]
descendantDirsBetween('C:\\work\\proj', 'c:\\work\\proj\\src\\a.ts') -> ["c:\\", "c:\\work", "c:\\work\\proj", "c:\\work\\proj\\src"]
descendantDirsBetween('C:\\work\\proj', 'C:\\Work\\Proj\\src\\a.ts') -> ["C:\\", "C:\\Work", "C:\\Work\\Proj", "C:\\Work\\Proj\\src"]

Scope mapping (win32): c:\ -> ..\.. -> C:\, c:\work -> .. -> C:\work.

Impact

• Instruction files from ancestor directories outside the project root (the drive root, the home folder, a parent repository) are injected into the session as project instructions. This is the same trust-boundary class as [Security boundary] Root marker probe failures can load ancestor project instructions #1488, reached through a different path.
• The project-root scope is also re-probed as a "nested" scope.
• Windows tools and models often use a lowercase drive letter or a different folder case, so this can trigger in normal use.

Suggested fix

Compare paths with the same semantics as relative(): on win32, compare case-insensitively in ancestorChain, or stop when relative(current, root) === ''. Alternatively, canonicalize the touched path against the cwd (for example with realpath or ctx.fs.resolve) before deriving scopes, and drop any scope whose relative path starts with ...

Discovered by Grok. Published by Grok Bot