fix(agent-context): recurse for nested plans in Python mtime fallback

[Quratulain-bilal]

Fixes #3733

Problem

The agent-context Python port's mtime fallback discovered plans with a one-level glob:

(root / "specs").glob("*/plan.md")

So a scoped layout created via SPECIFY_FEATURE_DIRECTORY — specs/<scope>/<feature>/plan.md, which sits two levels below specs/ — was missed whenever feature.json is absent. The fallback returned no plan, and the managed context section omitted its at <plan> line.

The bash and PowerShell twins were already fixed to recurse in #3024 (their comments explicitly call out "rather than the old one-level specs/*/plan.md scan"); the Python twin was left behind, so the three drifted out of parity.

Fix

Switch to specs.rglob("plan.md") with the same symlink-safe containment check the bash twin uses: resolve each candidate and confirm it stays within the project root before ranking by mtime. This keeps a plan reached through a specs/ symlink pointing outside the project from being selected (the lexical relative_to alone would accept it).

Tests

Adds two parity regression tests covering a nested specs/<scope>/<feature>/plan.md with no feature.json:

• vs bash (@requires_posix_bash, runs in CI)
• vs PowerShell (runs on the Windows runner)

Both fail on the pre-fix one-level glob and pass after. Verified locally on Windows: the PowerShell-parity test fails without the fix (Python omits the nested plan, diverging from PowerShell) and passes with it.

[Copilot]

Pull request overview

Fixes nested plan discovery parity in the agent-context Python port.

Changes:

• Recursively discovers plan.md files with symlink-safe containment.
• Adds Bash and PowerShell parity tests for nested plans.

Show a summary per file

File	Description
extensions/agent-context/scripts/python/update_agent_context.py	Implements recursive plan discovery.
tests/extensions/test_update_agent_context_python_parity.py	Adds nested-layout parity coverage.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Medium

[mnriem]

Please address Copilot feedback and fix test & lint errors

[Copilot]

Review details

Comments suppressed due to low confidence (2)

extensions/agent-context/scripts/python/update_agent_context.py:195

• The containment check runs only after rglob() has traversed the tree. When the top-level specs path itself is a symlink outside the project, rglob() follows that starting directory and recursively scans its external target before every candidate is rejected; for example, specs -> / can make this command walk most of the filesystem. Resolve and validate specs itself before starting recursion (and apply the same guard to the bash twin).

        candidates = []
        for p in specs.rglob("plan.md"):
            rel = _resolved_rel(p)

tests/extensions/test_update_agent_context_python_parity.py:367

• Path.rglob() does not recurse into symlinked directories by default, so this candidate is never yielded and the test passes even if _resolved_rel() stops rejecting escaping plans. Symlink the plan.md file itself so rglob() discovers it and the new containment guard is actually exercised.

        (specs / "linked").symlink_to(outside.parent, target_is_directory=True)
        # Sanity: the plan really is reachable through the symlink.
        assert (specs / "linked" / "001-x" / "plan.md").is_file()

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Medium

[Quratulain-bilal]

@merium Conflict resolved and pushed. Branch is now rebased on latest main. Please review!

[Copilot]

Review details

Comments suppressed due to low confidence (2)

extensions/agent-context/scripts/python/update_agent_context.py:186

• This containment rule makes the Python port diverge from PowerShell for file symlinks. The PowerShell fallback still selects Get-ChildItem's lexical FullName after only a root-prefix check (update-agent-context.ps1:433-445), so specs/x/plan.md pointing outside is accepted there but rejected here. The repository requires the sh/ps/py variants to stay behaviorally equivalent; add the same resolved-target containment check to PowerShell (and a parity case) as part of this change.

                return p.resolve().relative_to(root)
            except (OSError, ValueError):

tests/extensions/test_update_agent_context_python_parity.py:367

• This test does not exercise _resolved_rel: Path.rglob() does not recurse into directory symlinks by default, so both Python-backed scans omit this candidate even if the containment guard is removed. Use a regular directory containing a plan.md file symlink to an outside file; rglob will enumerate that path and the test will then fail without the new guard.

        (specs / "linked").symlink_to(outside.parent, target_is_directory=True)
        # Sanity: the plan really is reachable through the symlink.
        assert (specs / "linked" / "001-x" / "plan.md").is_file()

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Medium

[mnriem]

Thank you!