[DZH166]

Link to Issue or Description of Change

No issue exists for this yet; the change is described below following the issue
template structure.

Problem:

AgentRefConfig.config_path lets a YAML agent config reference another agent's
config file. resolve_agent_reference in
src/google/adk/agents/config_agent_utils.py rejects absolute paths with:

if os.path.isabs(ref_config.config_path):
    raise ValueError("Absolute paths are not allowed in AgentRefConfig config_path: ...")

os.path.isabs is platform-dependent. On Windows, a root-relative path that
has a root but no drive — for example /etc/passwd or \etc\passwd — is not
absolute (ntpath.isabs('/etc/passwd') is False), so the guard does not fire.
The path then falls through to the traversal check, which either reports the
wrong error ("Path traversal detected ... resolves outside the agent directory"
instead of the intended "Absolute paths are not allowed ...") or, when the agent
directory sits on a different drive than the resolved root, an unhandled
ValueError: Paths don't have the same drive from os.path.commonpath.

The repo's own unit test tests/unittests/agents/test_agent_config.py::test_resolve_agent_reference_blocks_absolute_path
asserts the intended cross-platform behavior and is not skipped on any platform,
but it fails on Windows for exactly this reason (CI only runs on Linux, so the
failure is invisible there).

Solution:

Treat a config_path rooted under either platform's spelling as absolute, so
the guard behaves identically everywhere:

if os.path.isabs(ref_config.config_path) or ref_config.config_path.startswith(("/", "\\")):

This matches the platform-independent path checks the codebase already uses
elsewhere (e.g. skills/_utils.py and skill_toolset.py combine
PurePosixPath/PureWindowsPath root checks). Behavior on POSIX is unchanged;
on Windows, root-relative paths now raise the documented error.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.

• All unit tests pass locally.

• Added test_resolve_agent_reference_blocks_root_relative_path, which checks
  both /etc/passwd and \etc\passwd raise the documented error.

• Red→green on Windows 11, Python 3.13.9:

  • Before the fix:
    pytest tests/unittests/agents/test_agent_config.py →
    1 failed (test_resolve_agent_reference_blocks_absolute_path:
    expected "Absolute paths are not allowed in AgentRefConfig config_path",
    got "Path traversal detected ..."), 194 passed.
  • After the fix: 196 passed (the previously failing test plus the new
    regression test).

• pytest tests/unittests/agents → 972 passed, 1 xfailed.

• ruff check and pyink --check (repo pins: ruff 0.15.17, pyink 25.12) pass
  on both changed files.

Manual End-to-End (E2E) Tests:

Not applicable beyond the above: the change only alters which ValueError
message a rejected reference raises, and it is exercised directly by the unit
tests with a mocked from_config (no network or model calls involved).

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end (see Testing Plan).
• Any dependent changes have been merged and published in downstream modules.

Additional context

• Verified against main at 766275863d1e80489344f0fbe5b4bfa3b933a9a9.
• Duplicate check: no open PR or open issue mentions resolve_agent_reference,
  AgentRefConfig, or isabs (GitHub search, 2026-11-04). PR fix: Port agent-config code-reference and config_path validation to v1 #6790 ("Port
  agent-config code-reference and config_path validation to v1") was merged
  against the v1 branch and does not touch this guard on main.

AI assistance

This contribution was prepared with AI assistance (code search, reproduction,
and patch drafting). The final diff is two files: a one-condition change in
resolve_agent_reference plus a regression test; all validation commands and
results above were run locally against the repository's own test suite.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.