[Security boundary] Root marker probe failures can load ancestor project instructions

[Lzb-gzist]

Summary

Agent instruction project-root discovery currently treats every root-marker probe failure as if the marker were absent. If an inner project's marker is temporarily unavailable, discovery continues upward and can select an outer repository as the root, causing instruction files from that ancestor project to be loaded into the current session.

Reproduction

1. Create an outer repository with .git and an AGENTS.md containing outer project rule.
2. Create an inner project below it with its own .git and AGENTS.md containing inner project rule.
3. Start a session below the inner project through ctx.fs.
4. Make the provider's metadata probe for the inner .git throw, while the outer .git remains readable.

On current master, the derived workspace context contains both outer project rule and inner project rule, and the provider reads the outer AGENTS.md. The new regression test fails on the old implementation with exactly that leaked ancestor instruction.

Root cause

existsAsMarker() returns a boolean. Its catch path calls signal.throwIfAborted() and then returns false, erasing the difference between confirmed absence and provider/host I/O failure. findProjectRoot() therefore keeps walking past a directory whose project-boundary status is unknown.

Impact

• Instructions from an unrelated ancestor repository can influence the current agent session.
• A transient provider, permission, or I/O failure silently changes the trust boundary instead of failing closed.
• Nested repositories and monorepo-adjacent workspaces are particularly exposed because a valid outer marker makes the fallback appear successful.

Proposed fix

• Replace the boolean marker result with present, absent, and unavailable states.
• For host probes, classify only ENOENT and ENOTDIR as confirmed absence; retain other failures as unavailable.
• Continue checking other configured markers in the same directory so a confirmed present sibling still identifies the root.
• If no marker is present but any probe at that directory is unavailable, use that directory as the containment boundary and stop walking upward.
• Preserve cancellation behavior by rethrowing aborted signals.

Patch

• Commit: Lzb-gzist@b3fe68e
• Compare: https://github.com/deepseek-ai/deepseek-harness/compare/master...Lzb-gzist:agent/agent-instructions-root-marker-fail-closed?expand=1
• Branch: agent/agent-instructions-root-marker-fail-closed

Verification

• Reproduced the ancestor-instruction leak against the old implementation, then verified the regression after the fix.
• Agent Instructions unit suite: 153 tests passed.
• Targeted lint and TypeScript checks passed.
• Full repository lint and host build passed.
• Documentation synchronization: 28/28 checks passed.
• English/Chinese translation pairing passed.
• Pre-commit staged checks and pre-push host/client TypeScript checks passed.
• git diff --check passed.

[7empestx]

Failing open on a probe error is the kind of boundary bug that only shows up under adversarial conditions, since nothing in normal use ever trips it. Nice catch. The same class of failure applies to any instruction file an agent loads by discovery: the trust boundary moves and the agent never notices.

I run agent-sandbox, we scan agents for prompt injection in an isolated sandbox and hand back a pass/fail report; instruction-file and workspace-content injection is one of the payload classes. First cohort is free if you want a harness-driven agent run through it: https://agent.beehivewebstudio.com