@bonesofspring/ai-rules 0.1.1 → 0.1.2

package/bin/cli.js

@@ -7,6 +7,9 @@ const path = require('path');
 
 const packageRoot = path.join(__dirname, '..');
 
+/** Single path segment: letters, digits, dot, underscore, hyphen; no separators or "..". */
+const PRESET_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+
 const PRESETS = {
   cursor: {
     rulesDir: '.cursor/rules',
@@ -31,6 +34,10 @@ Usage:
   ai-rules init <cursor|claude> --preset <name>   Copy preset rules and commands into the current directory
   ai-rules clean <cursor|claude>                 Remove preset target rules and commands directories
 
+Notes:
+  init merges into existing target folders; same-named files are overwritten.
+  Flags may appear before or after the subcommand (e.g. --preset next init cursor).
+
 Examples:
   npx @bonesofspring/ai-rules init cursor --preset next
   npx @bonesofspring/ai-rules clean claude
@@ -42,11 +49,23 @@ function parseArgs(argv) {
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--preset') {
-      args.preset = argv[++i];
+      const value = argv[i + 1];
+      if (value === undefined || value.startsWith('-')) {
+        args.presetError =
+          'Missing value for --preset (use --preset <name> or --preset=<name>)';
+        continue;
+      }
+      args.preset = value;
+      i++;
       continue;
     }
     if (a.startsWith('--preset=')) {
-      args.preset = a.slice('--preset='.length);
+      const value = a.slice('--preset='.length);
+      if (value === '') {
+        args.presetError = 'Missing value after --preset=';
+        continue;
+      }
+      args.preset = value;
       continue;
     }
     args._.push(a);
@@ -54,6 +73,35 @@ function parseArgs(argv) {
   return args;
 }
 
+/**
+ * @returns {string | null} Error message or null if valid.
+ */
+function validatePresetName(preset) {
+  if (preset === undefined || preset === '') {
+    return 'Missing --preset <name>';
+  }
+  if (!PRESET_NAME_RE.test(preset) || preset.includes('..')) {
+    return (
+      'Invalid preset name: use one path segment (letters, digits, ., _, -), ' +
+        'no slashes or ".." (example: next)'
+    );
+  }
+  return null;
+}
+
+/**
+ * Ensures resolved preset dir stays under the tool presets root (defense in depth).
+ */
+function assertPresetDirInsideRoot(presetsRoot, presetBase) {
+  const root = path.resolve(presetsRoot);
+  const resolved = path.resolve(presetBase);
+  const rel = path.relative(root, resolved);
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    console.error('Invalid preset path (escapes package presets directory).');
+    process.exit(1);
+  }
+}
+
 function copyDir(src, dest) {
   if (!fs.existsSync(src)) {
     throw new Error(`Source not found: ${src}`);
@@ -108,11 +156,15 @@ function cmdInit(tool, preset) {
     console.error(`Unknown tool: ${tool}. Use cursor or claude.`);
     process.exit(1);
   }
-  if (!preset) {
-    console.error('Missing --preset <name>');
+  const nameErr = validatePresetName(preset);
+  if (nameErr) {
+    console.error(nameErr);
     process.exit(1);
   }
-  const base = path.join(packageRoot, ...cfg.relBase, preset);
+  const presetsRoot = path.join(packageRoot, ...cfg.relBase);
+  const base = path.join(presetsRoot, preset);
+  assertPresetDirInsideRoot(presetsRoot, base);
+
   const rulesSrc = path.join(base, 'rules');
   const commandsSrc = path.join(base, 'commands');
   const cwd = process.cwd();
@@ -122,33 +174,39 @@ function cmdInit(tool, preset) {
     process.exit(1);
   }
 
-  if (tool === 'claude' && cfg.claudeMdSrc) {
-    const mdFrom = path.join(base, cfg.claudeMdSrc);
-    if (fs.existsSync(mdFrom)) {
-      const claudeRoot = path.join(cwd, '.claude');
-      fs.mkdirSync(claudeRoot, { recursive: true });
-      fs.copyFileSync(mdFrom, path.join(claudeRoot, 'CLAUDE.md'));
-      console.log('Copied CLAUDE.md → .claude/CLAUDE.md');
+  try {
+    if (tool === 'claude' && cfg.claudeMdSrc) {
+      const mdFrom = path.join(base, cfg.claudeMdSrc);
+      if (fs.existsSync(mdFrom)) {
+        const claudeRoot = path.join(cwd, '.claude');
+        fs.mkdirSync(claudeRoot, { recursive: true });
+        fs.copyFileSync(mdFrom, path.join(claudeRoot, 'CLAUDE.md'));
+        console.log('Copied CLAUDE.md → .claude/CLAUDE.md');
+      }
     }
-  }
 
-  if (fs.existsSync(rulesSrc)) {
-    copyDir(rulesSrc, path.join(cwd, cfg.rulesDir));
-    console.log(`Copied rules → ${cfg.rulesDir}`);
-  }
-  if (fs.existsSync(commandsSrc)) {
-    copyDir(commandsSrc, path.join(cwd, cfg.commandsDir));
-    console.log(`Copied commands → ${cfg.commandsDir}`);
-  }
+    if (fs.existsSync(rulesSrc)) {
+      copyDir(rulesSrc, path.join(cwd, cfg.rulesDir));
+      console.log(`Copied rules → ${cfg.rulesDir}`);
+    }
+    if (fs.existsSync(commandsSrc)) {
+      copyDir(commandsSrc, path.join(cwd, cfg.commandsDir));
+      console.log(`Copied commands → ${cfg.commandsDir}`);
+    }
 
-  if (tool === 'claude' && cfg.optionalClaudeDirs) {
-    for (const name of cfg.optionalClaudeDirs) {
-      const src = path.join(base, name);
-      if (fs.existsSync(src)) {
-        copyDir(src, path.join(cwd, '.claude', name));
-        console.log(`Copied ${name}/ → .claude/${name}/`);
+    if (tool === 'claude' && cfg.optionalClaudeDirs) {
+      for (const name of cfg.optionalClaudeDirs) {
+        const src = path.join(base, name);
+        if (fs.existsSync(src)) {
+          copyDir(src, path.join(cwd, '.claude', name));
+          console.log(`Copied ${name}/ → .claude/${name}/`);
+        }
       }
     }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`init failed: ${msg}`);
+    process.exit(1);
   }
 }
 
@@ -186,15 +244,30 @@ function main() {
   const parsed = parseArgs(argv);
   const [command, tool] = parsed._;
 
+  if (parsed.presetError) {
+    console.error(parsed.presetError);
+    process.exit(1);
+  }
+
   if (command === 'init') {
+    if (!tool) {
+      console.error('Missing <cursor|claude> after init.');
+      process.exit(1);
+    }
     cmdInit(tool, parsed.preset);
     return;
   }
   if (command === 'clean') {
+    if (!tool) {
+      console.error('Missing <cursor|claude> after clean.');
+      process.exit(1);
+    }
     cmdClean(tool);
     return;
   }
 
+  const got = command === undefined ? 'none' : command;
+  console.error(`Unknown command: ${got}. Use init or clean.`);
   printHelp();
   process.exit(1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bonesofspring/ai-rules",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Presets of Cursor and Claude rules/commands for Revy Ross personal use",
   "license": "MIT",
   "author": "Revy Ross",