fix(coding-agent): disambiguate resource paths

packages/coding-agent/test/paths.test.ts

@@ -2,7 +2,7 @@ import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, writeFileSyn
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
-import { canonicalizePath, isLocalPath } from "../src/utils/paths.js";
+import { canonicalizePath, getCwdRelativePath, isLocalPath } from "../src/utils/paths.js";
 
 let tempDir: string;
 
@@ -61,6 +61,18 @@ describe("canonicalizePath", () => {
 	});
 });
 
+describe("getCwdRelativePath", () => {
+	it("keeps cwd-relative names that start with dots", () => {
+		const cwd = join(tmpdir(), "pi-paths-cwd");
+		expect(getCwdRelativePath(join(cwd, "..config", "AGENTS.md"), cwd)).toBe(join("..config", "AGENTS.md"));
+	});
+
+	it("rejects parent-directory traversals", () => {
+		const cwd = join(tmpdir(), "pi-paths-cwd");
+		expect(getCwdRelativePath(join(cwd, "..", "AGENTS.md"), cwd)).toBeUndefined();
+	});
+});
+
 describe("isLocalPath", () => {
 	it("returns true for bare names", () => {
 		expect(isLocalPath("my-package")).toBe(true);