Objective

Fix import path resolution so that paths starting with .github/ or / are resolved from the repository root rather than from baseDir (.github/workflows/).

Context

This is the minimum-viable fix for #23900. Currently, imports: [.github/agents/planner.md] fails because it resolves to .github/workflows/.github/agents/planner.md (joining the import path onto baseDir), which doesn't exist. The documented .github/agents/ location for agent files is therefore unusable.

Root Cause

In pkg/parser/remote_fetch.go, ResolveIncludePath() unconditionally does:

fullPath := filepath.Join(baseDir, filePath)

where baseDir is typically .github/workflows/. No special handling exists for paths that are already relative to the repository root.

Approach

1. In ResolveIncludePath (pkg/parser/remote_fetch.go):

   • Before the filepath.Join(baseDir, filePath) line, detect repo-root-relative paths:
     • Path starts with .github/ → resolve from repo root (derived as filepath.Dir(filepath.Dir(baseDir)) from .github/workflows/, or by traversing up to find .github parent)
     • Path starts with / → treat as absolute from repo root (strip leading slash then resolve from repo root)
   • Preserve current behavior for all other paths (backward-compatible)

2. Update the security check that follows to allow the resolved paths. Currently, the check verifies that the resolved path is within the .github/ folder — this should still hold (both .github/agents/ and .github/workflows/ satisfy it).

3. Suggested logic:

// Determine resolution base
resolvBase := baseDir
if strings.HasPrefix(filePath, ".github/") || strings.HasPrefix(filePath, "/") {
    // Repo-root-relative: go up from .github/workflows to repo root
    repoRoot := deriveRepoRoot(baseDir) // walk up past .github
    resolvBase = repoRoot
    filePath = strings.TrimPrefix(filePath, "/")
}
fullPath := filepath.Join(resolvBase, filePath)

Where deriveRepoRoot traverses up until finding the parent of the .github directory.

4. Also update remote_fetch_wasm.go with the same change (it has its own ResolveIncludePath stub).

Files to Modify

• pkg/parser/remote_fetch.go — primary fix in ResolveIncludePath
• pkg/parser/remote_fetch_wasm.go — mirror the fix for wasm build
• pkg/parser/import_bfs.go — verify baseDir propagation is still correct for nested imports from .github/agents/ files

Acceptance Criteria

• imports: [.github/agents/planner.md] resolves to <repo-root>/.github/agents/planner.md
• imports: [/agents/agent.md] resolves to <repo-root>/agents/agent.md
• Existing imports like imports: [agents/planner.md] (relative to .github/workflows/) continue to work unchanged
• Security check still blocks paths that would escape the repo root or the .github/ tree
• Cross-repo imports (owner/repo/path@ref) are unaffected
  Related to Fix: Flexible import path resolution and cross-repo agent imports #23900

Generated by Plan Command for issue #23900 · ● 1.4M · ◷

• expires on Apr 6, 2026, 2:14 PM UTC