fix(portable): reject drive-relative Windows commands such as C:server

win32.isAbsolute reports them relative, but they resolve against a per-drive
working directory on a Windows consumer; treat any nonempty win32 root as
rooted.

Author: ScriptedAlchemy

packages/agent-bundle/src/adapters/portable-mcp-rules.ts

@@ -58,7 +58,10 @@ export const containedPortableRelativePath = (relativePath: string): string | un
 
 const staysInsidePosixRoot = (relativePath: string): boolean => containedPortableRelativePath(relativePath) !== undefined;
 
-const isAnyPlatformAbsolute = (value: string): boolean => posix.isAbsolute(value) || win32.isAbsolute(value);
+// A nonempty win32 root also catches drive-relative forms such as `C:server`,
+// which `win32.isAbsolute` reports as relative yet resolve against a per-drive cwd.
+const isAnyPlatformRooted = (value: string): boolean =>
+  posix.isAbsolute(value) || win32.isAbsolute(value) || win32.parse(value).root.length > 0;
 
 /** §7.2.1: a stdio command is a bare executable name or a plugin-relative `./` path. */
 export const portableCommandIssues = (command: unknown): readonly PortableMcpRuleIssue[] => {
@@ -75,7 +78,7 @@ export const portableCommandIssues = (command: unknown): readonly PortableMcpRul
     }
     return Object.freeze([]);
   }
-  if (command.length === 0 || /[\s/\\\0]/u.test(command) || isAnyPlatformAbsolute(command) || command.startsWith('.')) {
+  if (command.length === 0 || /[\s/\\\0]/u.test(command) || isAnyPlatformRooted(command) || command.startsWith('.')) {
     return Object.freeze([issue(
       'command',
       `${JSON.stringify(command)} is neither a bare executable name nor a plugin-relative ./ path (Agent Plugins 1.0.0 §7.2.1)`,

packages/agent-bundle/tests/portable-adapter.test.ts

@@ -477,6 +477,7 @@ it('fails closed at plan time on Agent Plugins 1.0.0 normative MCP rules the sch
         transport: 'stdio',
       },
       { command: 'C:\\tools\\server.exe', id: 'mcp:win-abs', name: 'windows-absolute', provenance, targets: ['portable'], transport: 'stdio' },
+      { command: 'C:server', id: 'mcp:win-drive', name: 'windows-drive-relative', provenance, targets: ['portable'], transport: 'stdio' },
       {
         command: 'node',
         env: { '${PLUGIN_ROOT}': 'literal' },
@@ -509,6 +510,7 @@ it('fails closed at plan time on Agent Plugins 1.0.0 normative MCP rules the sch
     ['portable.mcp.command.standard', 'Portable MCP server "anchor-collision" command "./../anchor/server" escapes the plugin root (Agent Plugins 1.0.0 §4.1).'],
     ['portable.mcp.cwd.standard', 'Portable MCP server "anchor-cwd" cwd "${PLUGIN_ROOT}/../anchor" escapes its plugin root after resolution (Agent Plugins 1.0.0 §7.2.1).'],
     ['portable.mcp.command.standard', 'Portable MCP server "windows-absolute" command "C:\\\\tools\\\\server.exe" is neither a bare executable name nor a plugin-relative ./ path (Agent Plugins 1.0.0 §7.2.1).'],
+    ['portable.mcp.command.standard', 'Portable MCP server "windows-drive-relative" command "C:server" is neither a bare executable name nor a plugin-relative ./ path (Agent Plugins 1.0.0 §7.2.1).'],
     ['portable.mcp.env.standard', 'Portable MCP server "placeholder-env-key" env key "${PLUGIN_ROOT}" contains an Agent Plugins placeholder, but expansion never applies to env keys (Agent Plugins 1.0.0 §9.2).'],
     ['portable.mcp.url.standard', 'Portable MCP server "plain-http" url uses plain HTTP against non-loopback host "mcp.example.test"; non-loopback endpoints must use HTTPS (Agent Plugins 1.0.0 §7.2.1).'],
     ['portable.mcp.headers.standard', 'Portable MCP server "bad-headers" headers/x-tenant repeats header "X-Tenant" under different casing; header names are case-insensitive (Agent Plugins 1.0.0 §7.2.1).'],

packages/agent-bundle/tests/portable-plugin-validation.test.ts

@@ -159,6 +159,7 @@ it('applies the normative text where the schemas are silent: commands, cwd, URLs
         type: 'streamable-http',
         url: 'https://mcp.example.test/mcp',
       },
+      driveRelativeCommand: { command: 'C:server', type: 'stdio' },
       missingBundled: { command: './bin/absent', type: 'stdio' },
       pathCommand: { command: 'bin/server', type: 'stdio' },
       placeholderCommand: { command: '${PLUGIN_ROOT}/bin/launch', type: 'stdio' },
@@ -184,6 +185,7 @@ it('applies the normative text where the schemas are silent: commands, cwd, URLs
     'mcp.json/mcpServers/headers/headers/Bad Header is not a valid HTTP header field name (Agent Plugins 1.0.0 §7.2.1).',
     'mcp.json/mcpServers/headers/headers/x-tenant repeats header "X-Tenant" under different casing; header names are case-insensitive (Agent Plugins 1.0.0 §7.2.1).',
     'mcp.json/mcpServers/headers/headers/X-Token contains an Agent Plugins placeholder, but clients never expand placeholders in headers (Agent Plugins 1.0.0 §7.2.1).',
+    'mcp.json/mcpServers/driveRelativeCommand/command "C:server" is neither a bare executable name nor a plugin-relative ./ path (Agent Plugins 1.0.0 §7.2.1).',
     'mcp.json/mcpServers/missingBundled/command "./bin/absent" does not resolve to a bundled regular file (Agent Plugins 1.0.0 §7.2.1).',
     'mcp.json/mcpServers/pathCommand/command "bin/server" is neither a bare executable name nor a plugin-relative ./ path (Agent Plugins 1.0.0 §7.2.1).',
     'mcp.json/mcpServers/placeholderCommand/command contains an Agent Plugins placeholder, but clients never expand placeholders in command (Agent Plugins 1.0.0 §7.2.1).',