fix: restore AGENTS.md from the PR base branch

[WeAreResilience]

Summary

restoreConfigFromBase already replaces CLAUDE.md from the PR base. The documented @AGENTS.md import still resolved against the working tree, so a PR that rewrote AGENTS.md could inject instructions after that restore.

This adds AGENTS.md and AGENTS.local.md to SENSITIVE_PATHS. The PR-head copies are snapshotted into .claude-pr/ for review agents, then replaced from base (or deleted if they only exist on the head).

Fixes #1696

Test plan

• bun test test/restore-config.test.ts (20 pass, run three times)
• bun run typecheck
• Existing symlink-to-AGENTS.md restore tests still pass

From RESILIENCE Agentic Solutions.

Made with Cursor

[tarunag10]

The root-file fix and tests cover the documented @AGENTS.md pattern cleanly. One residual trust-boundary case is worth making explicit before merge: a restored base CLAUDE.md can import a nested path such as @docs/AGENTS.md, and that path still resolves from the PR-head checkout because SENSITIVE_PATHS only snapshots the two root filenames. If the intended scope is the documented root convention, I suggest adding a comment/test that records this limitation; if the intended invariant is “restored instructions cannot import PR-controlled content,” the robust fix is to resolve and restore the base @-import closure rather than enumerate filenames. I would avoid a broad **/AGENTS.md glob unless restore-config can preserve directory semantics and snapshot every matched path safely.

[WeAreResilience]

Agreed — the right invariant is that restored instructions cannot import PR-controlled content.

This follow-up walks the base @-import closure after SENSITIVE_PATHS are restored (documented syntax, relative to the importing file, max four hops, code spans/fences skipped). Extra repo-relative files are snapshotted into .claude-pr/, then checked out from base or deleted if they are absent there. Absolute/~/.. escapes are ignored, and directory targets are not restored — no **/AGENTS.md glob.

The @docs/AGENTS.md case you named is now a test, along with PR-only nested deletes, backtick literals, path escapes, a two-hop cycle, and the fifth-hop depth bound.

[WeAreResilience]

Friendly ping: the base @-import closure follow-up is ready for review whenever a maintainer has a moment. Happy to adjust scope if you'd prefer the narrower root-file fix.