fix(agent): scope subdirectory hint discovery to workspace - closes #14471

[vominh1919]

Fix: Scope subdirectory hint discovery to workspace directory

Bug

Closes #14471

Hermes has a second project-context injection path beyond the normal startup cwd-based prompt assembly. Post-tool-call path discovery can append context from nearby AGENTS.md, CLAUDE.md, or .cursorrules files based on tool arguments — even from directories completely outside the intended workspace.

This breaks workspace isolation expectations and can cause:

• Unexpected instruction contamination
• Profile/agent behavior drift
• Hard-to-debug prompt pollution
• Cross-project leakage of local instruction files

Root Cause

In agent/subdirectory_hints.py, SubdirectoryHintTracker._is_valid_subdir() only checks:

1. Is the path a directory?
2. Has it already been loaded?

It does not check whether the directory is inside the configured working_dir. This means any tool call that touches a file in an unrelated directory can trigger hint discovery there.

Fix

Add a workspace boundary check in _is_valid_subdir() using Path.relative_to(). Only directories inside working_dir are scanned for hint files:

def _is_valid_subdir(self, path: Path) -> bool:
    # ... existing checks ...
    # Scope to workspace — only scan directories inside working_dir
    try:
        path.relative_to(self.working_dir)
    except ValueError:
        logger.debug(
            "Skipping subdirectory hint for %s: outside working_dir %s",
            path, self.working_dir,
        )
        return False
    return True

Impact

• Prevents injection of unrelated AGENTS.md/CLAUDE.md/.cursorrules from outside the workspace
• Minimal change (15 lines added, 1 line modified)
• No behavioral change for directories inside the workspace
• Debug logging when a directory is skipped (for troubleshooting)

[teknium1]

Thanks for the careful diagnosis and the clean fix, @vominh1919 — you nailed both the root cause and the right direction.

This is already fixed on main. The same workspace-boundary guard you proposed now lives in agent/subdirectory_hints.py _is_valid_subdir() (the is_relative_to(self.working_dir) check), with a second guard in _load_hints_for_directory() and a symlink-safe fallback for older Python. The old test_outside_working_dir_still_checked test you cited as evidence the leak was baked in has been flipped to test_outside_working_dir_rejected (plus test_outside_working_dir_absolute_path_rejected and test_sibling_repo_not_loaded_via_ancestor_walk), so the intended behavior is now enforced.

Issue #14471 is closed for the same reason. Closing this as redundant — your analysis was spot-on. Thanks for contributing!