5 files changed, 234 insertions, 34 deletions
diff --git a/packages/core/src/ide/ide-client.test.ts b/packages/core/src/ide/ide-client.test.ts
new file mode 100644
index 00000000..6955e495
--- /dev/null
+++ b/packages/core/src/ide/ide-client.test.ts
@@ -0,0 +1,68 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect } from 'vitest';
+import { IdeClient } from './ide-client.js';
+
+describe('IdeClient.validateWorkspacePath', () => {
+  it('should return valid if cwd is a subpath of the IDE workspace path', () => {
+    const result = IdeClient.validateWorkspacePath(
+      '/Users/person/gemini-cli',
+      'VS Code',
+      '/Users/person/gemini-cli/sub-dir',
+    );
+    expect(result.isValid).toBe(true);
+  });
+
+  it('should return invalid if GEMINI_CLI_IDE_WORKSPACE_PATH is undefined', () => {
+    const result = IdeClient.validateWorkspacePath(
+      undefined,
+      'VS Code',
+      '/Users/person/gemini-cli/sub-dir',
+    );
+    expect(result.isValid).toBe(false);
+    expect(result.error).toContain('Failed to connect');
+  });
+
+  it('should return invalid if GEMINI_CLI_IDE_WORKSPACE_PATH is empty', () => {
+    const result = IdeClient.validateWorkspacePath(
+      '',
+      'VS Code',
+      '/Users/person/gemini-cli/sub-dir',
+    );
+    expect(result.isValid).toBe(false);
+    expect(result.error).toContain('please open a workspace folder');
+  });
+
+  it('should return invalid if cwd is not within the IDE workspace path', () => {
+    const result = IdeClient.validateWorkspacePath(
+      '/some/other/path',
+      'VS Code',
+      '/Users/person/gemini-cli/sub-dir',
+    );
+    expect(result.isValid).toBe(false);
+    expect(result.error).toContain('Directory mismatch');
+  });
+
+  it('should handle multiple workspace paths and return valid', () => {
+    const result = IdeClient.validateWorkspacePath(
+      '/some/other/path:/Users/person/gemini-cli',
+      'VS Code',
+      '/Users/person/gemini-cli/sub-dir',
+    );
+    expect(result.isValid).toBe(true);
+  });
+
+  it('should return invalid if cwd is not in any of the multiple workspace paths', () => {
+    const result = IdeClient.validateWorkspacePath(
+      '/some/other/path:/another/path',
+      'VS Code',
+      '/Users/person/gemini-cli/sub-dir',
+    );
+    expect(result.isValid).toBe(false);
+    expect(result.error).toContain('Directory mismatch');
+  });
+});
diff --git a/packages/core/src/ide/ide-client.ts b/packages/core/src/ide/ide-client.ts
index 94107f21..810e82e0 100644
--- a/packages/core/src/ide/ide-client.ts
+++ b/packages/core/src/ide/ide-client.ts
@@ -5,6 +5,7 @@
  */
 
 import * as fs from 'node:fs';
+import { isSubpath } from '../utils/paths.js';
 import { detectIde, DetectedIde, getIdeInfo } from '../ide/detect-ide.js';
 import {
   ideContext,
@@ -93,7 +94,14 @@ export class IdeClient {
 
     this.setState(IDEConnectionStatus.Connecting);
 
-    if (!this.validateWorkspacePath()) {
+    const { isValid, error } = IdeClient.validateWorkspacePath(
+      process.env['GEMINI_CLI_IDE_WORKSPACE_PATH'],
+      this.currentIdeDisplayName,
+      process.cwd(),
+    );
+
+    if (!isValid) {
+      this.setState(IDEConnectionStatus.Disconnected, error, true);
       return;
     }
 
@@ -245,37 +253,41 @@ export class IdeClient {
     }
   }
 
-  private validateWorkspacePath(): boolean {
-    const ideWorkspacePath = process.env['GEMINI_CLI_IDE_WORKSPACE_PATH'];
+  static validateWorkspacePath(
+    ideWorkspacePath: string | undefined,
+    currentIdeDisplayName: string | undefined,
+    cwd: string,
+  ): { isValid: boolean; error?: string } {
     if (ideWorkspacePath === undefined) {
-      this.setState(
-        IDEConnectionStatus.Disconnected,
-        `Failed to connect to IDE companion extension for ${this.currentIdeDisplayName}. Please ensure the extension is running and try refreshing your terminal. To install the extension, run /ide install.`,
-        true,
-      );
-      return false;
+      return {
+        isValid: false,
+        error: `Failed to connect to IDE companion extension for ${currentIdeDisplayName}. Please ensure the extension is running and try refreshing your terminal. To install the extension, run /ide install.`,
+      };
     }
+
     if (ideWorkspacePath === '') {
-      this.setState(
-        IDEConnectionStatus.Disconnected,
-        `To use this feature, please open a single workspace folder in ${this.currentIdeDisplayName} and try again.`,
-        true,
-      );
-      return false;
+      return {
+        isValid: false,
+        error: `To use this feature, please open a workspace folder in ${currentIdeDisplayName} and try again.`,
+      };
     }
 
-    const idePath = getRealPath(ideWorkspacePath).toLocaleLowerCase();
-    const cwd = getRealPath(process.cwd()).toLocaleLowerCase();
-    const rel = path.relative(idePath, cwd);
-    if (rel.startsWith('..') || path.isAbsolute(rel)) {
-      this.setState(
-        IDEConnectionStatus.Disconnected,
-        `Directory mismatch. Gemini CLI is running in a different location than the open workspace in ${this.currentIdeDisplayName}. Please run the CLI from the same directory as your project's root folder.`,
-        true,
-      );
-      return false;
+    const ideWorkspacePaths = ideWorkspacePath.split(':');
+    const realCwd = getRealPath(cwd);
+    const isWithinWorkspace = ideWorkspacePaths.some((workspacePath) => {
+      const idePath = getRealPath(workspacePath);
+      return isSubpath(idePath, realCwd);
+    });
+
+    if (!isWithinWorkspace) {
+      return {
+        isValid: false,
+        error: `Directory mismatch. Gemini CLI is running in a different location than the open workspace in ${currentIdeDisplayName}. Please run the CLI from one of the following directories: ${ideWorkspacePaths.join(
+          ', ',
+        )}`,
+      };
     }
-    return true;
+    return { isValid: true };
   }
 
   private getPortFromEnv(): string | undefined {
diff --git a/packages/core/src/utils/memoryImportProcessor.ts b/packages/core/src/utils/memoryImportProcessor.ts
index 751e0ace..c89b983b 100644
--- a/packages/core/src/utils/memoryImportProcessor.ts
+++ b/packages/core/src/utils/memoryImportProcessor.ts
@@ -6,6 +6,7 @@
 
 import * as fs from 'fs/promises';
 import * as path from 'path';
+import { isSubpath } from './paths.js';
 import { marked } from 'marked';
 
 // Simple console logger for import processing
@@ -411,10 +412,7 @@ export function validateImportPath(
 
   const resolvedPath = path.resolve(basePath, importPath);
 
-  return allowedDirectories.some((allowedDir) => {
-    const normalizedAllowedDir = path.resolve(allowedDir);
-    const isSamePath = resolvedPath === normalizedAllowedDir;
-    const isSubPath = resolvedPath.startsWith(normalizedAllowedDir + path.sep);
-    return isSamePath || isSubPath;
-  });
+  return allowedDirectories.some((allowedDir) =>
+    isSubpath(allowedDir, resolvedPath),
+  );
 }
diff --git a/packages/core/src/utils/paths.test.ts b/packages/core/src/utils/paths.test.ts
index d688c072..0e964672 100644
--- a/packages/core/src/utils/paths.test.ts
+++ b/packages/core/src/utils/paths.test.ts
@@ -4,8 +4,8 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { describe, it, expect } from 'vitest';
-import { escapePath, unescapePath } from './paths.js';
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { escapePath, unescapePath, isSubpath } from './paths.js';
 
 describe('escapePath', () => {
   it('should escape spaces', () => {
@@ -212,3 +212,105 @@ describe('unescapePath', () => {
     expect(unescapePath('file\\\\\\(test\\).txt')).toBe('file\\\\(test).txt');
   });
 });
+
+describe('isSubpath', () => {
+  it('should return true for a direct subpath', () => {
+    expect(isSubpath('/a/b', '/a/b/c')).toBe(true);
+  });
+
+  it('should return true for the same path', () => {
+    expect(isSubpath('/a/b', '/a/b')).toBe(true);
+  });
+
+  it('should return false for a parent path', () => {
+    expect(isSubpath('/a/b/c', '/a/b')).toBe(false);
+  });
+
+  it('should return false for a completely different path', () => {
+    expect(isSubpath('/a/b', '/x/y')).toBe(false);
+  });
+
+  it('should handle relative paths', () => {
+    expect(isSubpath('a/b', 'a/b/c')).toBe(true);
+    expect(isSubpath('a/b', 'a/c')).toBe(false);
+  });
+
+  it('should handle paths with ..', () => {
+    expect(isSubpath('/a/b', '/a/b/../b/c')).toBe(true);
+    expect(isSubpath('/a/b', '/a/c/../b')).toBe(true);
+  });
+
+  it('should handle root paths', () => {
+    expect(isSubpath('/', '/a')).toBe(true);
+    expect(isSubpath('/a', '/')).toBe(false);
+  });
+
+  it('should handle trailing slashes', () => {
+    expect(isSubpath('/a/b/', '/a/b/c')).toBe(true);
+    expect(isSubpath('/a/b', '/a/b/c/')).toBe(true);
+    expect(isSubpath('/a/b/', '/a/b/c/')).toBe(true);
+  });
+});
+
+describe('isSubpath on Windows', () => {
+  const originalPlatform = process.platform;
+
+  beforeAll(() => {
+    Object.defineProperty(process, 'platform', {
+      value: 'win32',
+    });
+  });
+
+  afterAll(() => {
+    Object.defineProperty(process, 'platform', {
+      value: originalPlatform,
+    });
+  });
+
+  it('should return true for a direct subpath on Windows', () => {
+    expect(isSubpath('C:\\Users\\Test', 'C:\\Users\\Test\\file.txt')).toBe(
+      true,
+    );
+  });
+
+  it('should return true for the same path on Windows', () => {
+    expect(isSubpath('C:\\Users\\Test', 'C:\\Users\\Test')).toBe(true);
+  });
+
+  it('should return false for a parent path on Windows', () => {
+    expect(isSubpath('C:\\Users\\Test\\file.txt', 'C:\\Users\\Test')).toBe(
+      false,
+    );
+  });
+
+  it('should return false for a different drive on Windows', () => {
+    expect(isSubpath('C:\\Users\\Test', 'D:\\Users\\Test')).toBe(false);
+  });
+
+  it('should be case-insensitive for drive letters on Windows', () => {
+    expect(isSubpath('c:\\Users\\Test', 'C:\\Users\\Test\\file.txt')).toBe(
+      true,
+    );
+  });
+
+  it('should be case-insensitive for path components on Windows', () => {
+    expect(isSubpath('C:\\Users\\Test', 'c:\\users\\test\\file.txt')).toBe(
+      true,
+    );
+  });
+
+  it('should handle mixed slashes on Windows', () => {
+    expect(isSubpath('C:/Users/Test', 'C:\\Users\\Test\\file.txt')).toBe(true);
+  });
+
+  it('should handle trailing slashes on Windows', () => {
+    expect(isSubpath('C:\\Users\\Test\\', 'C:\\Users\\Test\\file.txt')).toBe(
+      true,
+    );
+  });
+
+  it('should handle relative paths correctly on Windows', () => {
+    expect(isSubpath('Users\\Test', 'Users\\Test\\file.txt')).toBe(true);
+    expect(isSubpath('Users\\Test\\file.txt', 'Users\\Test')).toBe(false);
+  });
+});
diff --git a/packages/core/src/utils/paths.ts b/packages/core/src/utils/paths.ts
index 7bab888e..e7cf54cc 100644
--- a/packages/core/src/utils/paths.ts
+++ b/packages/core/src/utils/paths.ts
@@ -200,3 +200,23 @@ export function getUserCommandsDir(): string {
 export function getProjectCommandsDir(projectRoot: string): string {
   return path.join(projectRoot, GEMINI_DIR, COMMANDS_DIR_NAME);
 }
+
+/**
+ * Checks if a path is a subpath of another path.
+ * @param parentPath The parent path.
+ * @param childPath The child path.
+ * @returns True if childPath is a subpath of parentPath, false otherwise.
+ */
+export function isSubpath(parentPath: string, childPath: string): boolean {
+  const isWindows = os.platform() === 'win32';
+  const pathModule = isWindows ? path.win32 : path;
+
+  // On Windows, path.relative is case-insensitive. On POSIX, it's case-sensitive.
+  const relative = pathModule.relative(parentPath, childPath);
+
+  return (
+    !relative.startsWith(`..${pathModule.sep}`) &&
+    relative !== '..' &&
+    !pathModule.isAbsolute(relative)
+  );
+}