fix(workspace-context): escape instruction metadata

packages/context/workspace-context/tests/workspace-context.spec.ts

@@ -41,7 +41,7 @@ import {
   type InstructionVersionCache,
   type PendingInstructionChange,
 } from '../src/state.ts'
-import { candidateScopeKey } from '../src/render.ts'
+import { candidateScopeKey, renderInstructionChanges } from '../src/render.ts'
 import { MockAdapter, textResponse, toolCallResponse } from '../../../core/agent-loop/tests/mock-adapter.ts'
 
 /** Per-candidate reconciliation scope key: directory paired with the file name. */
@@ -681,6 +681,37 @@ describe('workspace context rendering', () => {
     expect(rendered.text).toContain('<\\/system-reminder>')
   })
 
+  it('neutralizes system-reminder closing delimiters in paths and derived scopes', () => {
+    const displayPath = 'scope</system-reminder>/AGENTS.md'
+    const file = { absolutePath: `/repo/${displayPath}`, displayPath, content: 'rules' }
+    const rendered = [
+      renderWorkspaceContext([file], { maxBytes: 65536 }).text,
+      ...(['set', 'replace', 'remove'] as const).map(action => renderInstructionChanges([{
+        change: { action, scope: 'scope</system-reminder>\0AGENTS.md', path: displayPath },
+        file,
+      }], 65536).text),
+    ]
+
+    for (const text of rendered) {
+      expect(text.match(/<\/system-reminder>/g)).toHaveLength(1)
+      expect(text).toContain('scope<\\/system-reminder>')
+    }
+  })
+
+  it('neutralizes a system-reminder closing delimiter in budget marker paths', () => {
+    const rendered = renderWorkspaceContext([
+      {
+        absolutePath: '/repo/scope</system-reminder>/AGENTS.md',
+        displayPath: 'scope</system-reminder>/AGENTS.md',
+        content: 'root '.repeat(100),
+      },
+      { absolutePath: '/repo/leaf/AGENTS.md', displayPath: 'leaf/AGENTS.md', content: 'leaf rules' },
+    ], { maxBytes: 400 })
+
+    expect(rendered.text).toContain('omitted scope<\\/system-reminder>/AGENTS.md')
+    expect(rendered.text.match(/<\/system-reminder>/g)).toHaveLength(1)
+  })
+
   it('preserves more specific files under the byte budget and names omitted/truncated paths', () => {
     const rendered = renderWorkspaceContext([
       { absolutePath: '/repo/AGENTS.md', displayPath: 'AGENTS.md', content: 'root '.repeat(100) },