fix(coding-agent): disambiguate resource paths

packages/coding-agent/test/paths.test.ts

@@ -2,7 +2,7 @@ import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, writeFileSyn
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
-import { canonicalizePath, isLocalPath } from "../src/utils/paths.js";
+import { canonicalizePath, getCwdRelativePath, isLocalPath } from "../src/utils/paths.js";
 
 let tempDir: string;
 
@@ -61,6 +61,18 @@ describe("canonicalizePath", () => {
 	});
 });
 
+describe("getCwdRelativePath", () => {
+	it("keeps cwd-relative names that start with dots", () => {
+		const cwd = join(tmpdir(), "pi-paths-cwd");
+		expect(getCwdRelativePath(join(cwd, "..config", "AGENTS.md"), cwd)).toBe(join("..config", "AGENTS.md"));
+	});
+
+	it("rejects parent-directory traversals", () => {
+		const cwd = join(tmpdir(), "pi-paths-cwd");
+		expect(getCwdRelativePath(join(cwd, "..", "AGENTS.md"), cwd)).toBeUndefined();
+	});
+});
+
 describe("isLocalPath", () => {
 	it("returns true for bare names", () => {
 		expect(isLocalPath("my-package")).toBe(true);

packages/coding-agent/test/tool-execution-component.test.ts

@@ -1,4 +1,4 @@
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { Text, type TUI } from "@earendil-works/pi-tui";
 import stripAnsi from "strip-ansi";
 import { Type } from "typebox";
@@ -342,12 +342,20 @@ describe("ToolExecutionComponent parity", () => {
 		},
 		{
 			title: "AGENTS.md",
-			path: join(process.cwd(), "AGENTS.md"),
+			path: join(process.cwd(), ".pi", "AGENTS.md"),
 			content: "Hidden resource instructions",
-			compact: "read resource AGENTS.md",
+			compact: "read resource .pi/AGENTS.md",
 			hidden: "Hidden resource instructions",
 			absent: undefined,
 		},
+		{
+			title: "outside AGENTS.md",
+			path: resolve(process.cwd(), "..", "AGENTS.md"),
+			content: "Hidden outside resource instructions",
+			compact: `read resource ${resolve(process.cwd(), "..", "AGENTS.md").replace(/\\/g, "/")}`,
+			hidden: "Hidden outside resource instructions",
+			absent: undefined,
+		},
 		{
 			title: "Pi documentation",
 			path: getReadmePath(),