@brainjar/cli 0.5.2 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainjar/cli",
-  "version": "0.5.2",
+  "version": "0.6.1",
   "description": "Shape how your AI thinks — composable soul, persona, and rules for AI agents",
   "type": "module",
   "license": "MIT",

package/src/api-types.ts

@@ -107,6 +107,27 @@ export interface ApiComposeResult {
   warnings?: string[]
 }
 
+// --- Content version types ---
+
+export interface ApiVersionSummary {
+  version: number
+  created_at: string
+}
+
+export interface ApiVersionList {
+  versions: ApiVersionSummary[]
+}
+
+export interface ApiContentVersion {
+  id: string
+  content_type: string
+  slug: string
+  version: number
+  content: string | null
+  metadata: Record<string, unknown> | null
+  created_at: string
+}
+
 // --- Content bundle types (export/import) ---
 
 export interface BundleSoul {

package/src/commands/brain.ts

@@ -160,7 +160,26 @@ export const brain = Cli.create('brain', {
     },
   })
   .command('drop', {
-    description: 'Delete a brain',
+    description: 'Deactivate the current brain — clears soul, persona, and rules',
+    options: z.object({
+      project: z.boolean().default(false).describe('Remove project brain override or deactivate workspace brain'),
+    }),
+    async run(c) {
+      const api = await getApi()
+
+      const mutationOpts = c.options.project
+        ? { project: basename(process.cwd()) }
+        : undefined
+      await putState(api, { soul_slug: '', persona_slug: '', rule_slugs: [] }, mutationOpts)
+
+      await sync({ api })
+      if (c.options.project) await sync({ api, project: true })
+
+      return { deactivated: true, project: c.options.project }
+    },
+  })
+  .command('delete', {
+    description: 'Delete a brain permanently',
     args: z.object({
       name: z.string().describe('Brain name to delete'),
     }),
@@ -177,6 +196,6 @@ export const brain = Cli.create('brain', {
         throw e
       }
 
-      return { dropped: name }
+      return { deleted: name }
     },
   })

package/src/commands/persona.ts

@@ -6,7 +6,7 @@ import { ErrorCode, createError } from '../errors.js'
 import { normalizeSlug, getEffectiveState, getStateOverride, putState } from '../state.js'
 import { sync } from '../sync.js'
 import { getApi } from '../client.js'
-import type { ApiPersona, ApiPersonaList, ApiRuleList } from '../api-types.js'
+import type { ApiPersona, ApiPersonaList, ApiRuleList, ApiVersionList, ApiContentVersion } from '../api-types.js'
 
 export const persona = Cli.create('persona', {
   description: 'Manage personas — role behavior and workflow for the agent',
@@ -17,6 +17,7 @@ export const persona = Cli.create('persona', {
       name: z.string().describe('Persona name'),
     }),
     options: z.object({
+      content: z.string().optional().describe('Persona content (if omitted, creates with a starter template you can edit)'),
       description: z.string().optional().describe('One-line description of the persona'),
       rules: z.array(z.string()).optional().describe('Rules to bundle with this persona'),
     }),
@@ -50,24 +51,29 @@ export const persona = Cli.create('persona', {
 
       const effectiveRules = rulesList
 
-      const lines: string[] = []
-      lines.push(`# ${name}`)
-      lines.push('')
-      if (c.options.description) {
-        lines.push(c.options.description)
+      let content: string
+      if (c.options.content) {
+        content = c.options.content.trim()
+      } else {
+        const lines: string[] = []
+        lines.push(`# ${name}`)
+        lines.push('')
+        if (c.options.description) {
+          lines.push(c.options.description)
+        }
+        lines.push('')
+        lines.push('## Direct mode')
+        lines.push('- ')
+        lines.push('')
+        lines.push('## Subagent mode')
+        lines.push('- ')
+        lines.push('')
+        lines.push('## Always')
+        lines.push('- ')
+        lines.push('')
+        content = lines.join('\n')
       }
-      lines.push('')
-      lines.push('## Direct mode')
-      lines.push('- ')
-      lines.push('')
-      lines.push('## Subagent mode')
-      lines.push('- ')
-      lines.push('')
-      lines.push('## Always')
-      lines.push('- ')
-      lines.push('')
-
-      const content = lines.join('\n')
+
       await api.put<ApiPersona>(`/api/v1/personas/${name}`, {
         content,
         bundled_rules: effectiveRules,
@@ -87,11 +93,12 @@ export const persona = Cli.create('persona', {
     },
   })
   .command('update', {
-    description: 'Update a persona\'s content (reads from stdin)',
+    description: 'Update a persona\'s content (reads from stdin or --content)',
     args: z.object({
       name: z.string().describe('Persona name'),
     }),
     options: z.object({
+      content: z.string().optional().describe('Persona content (reads from stdin if omitted)'),
       rules: z.array(z.string()).optional().describe('Update bundled rules'),
     }),
     async run(c) {
@@ -109,11 +116,14 @@ export const persona = Cli.create('persona', {
         throw e
       }
 
-      const chunks: Uint8Array[] = []
-      for await (const chunk of Bun.stdin.stream()) {
-        chunks.push(chunk)
+      let content = c.options.content?.trim()
+      if (!content) {
+        const chunks: Uint8Array[] = []
+        for await (const chunk of Bun.stdin.stream()) {
+          chunks.push(chunk)
+        }
+        content = Buffer.concat(chunks).toString().trim()
       }
-      const content = Buffer.concat(chunks).toString().trim()
 
       // Validate rules if provided
       const rulesList = c.options.rules
@@ -157,6 +167,7 @@ export const persona = Cli.create('persona', {
     options: z.object({
       project: z.boolean().default(false).describe('Show project persona override (if any)'),
       short: z.boolean().default(false).describe('Print only the active persona name'),
+      version: z.number().optional().describe('Show a specific version from history'),
     }),
     async run(c) {
       const api = await getApi()
@@ -167,6 +178,14 @@ export const persona = Cli.create('persona', {
         return state.persona ?? 'none'
       }
 
+      if (c.options.version) {
+        const name = c.args.name
+        if (!name) throw createError(ErrorCode.MISSING_ARG, { message: 'Name is required when using --version' })
+        const slug = normalizeSlug(name, 'persona name')
+        const v = await api.get<ApiContentVersion>(`/api/v1/personas/${slug}/versions/${c.options.version}`)
+        return { name: slug, version: v.version, content: v.content, metadata: v.metadata, created_at: v.created_at }
+      }
+
       if (c.args.name) {
         const name = normalizeSlug(c.args.name, 'persona name')
         try {
@@ -204,6 +223,40 @@ export const persona = Cli.create('persona', {
       }
     },
   })
+  .command('history', {
+    description: 'List version history for a persona',
+    args: z.object({
+      name: z.string().describe('Persona name'),
+    }),
+    async run(c) {
+      const name = normalizeSlug(c.args.name, 'persona name')
+      const api = await getApi()
+      const result = await api.get<ApiVersionList>(`/api/v1/personas/${name}/versions`)
+      return { name, versions: result.versions }
+    },
+  })
+  .command('revert', {
+    description: 'Restore a persona to a previous version',
+    args: z.object({
+      name: z.string().describe('Persona name'),
+    }),
+    options: z.object({
+      to: z.number().describe('Version number to restore'),
+    }),
+    async run(c) {
+      const name = normalizeSlug(c.args.name, 'persona name')
+      const api = await getApi()
+      const v = await api.get<ApiContentVersion>(`/api/v1/personas/${name}/versions/${c.options.to}`)
+      if (!v.content) throw createError(ErrorCode.BAD_REQUEST, { message: 'Version has no content to restore' })
+      const bundledRules = (v.metadata as { bundled_rules?: string[] })?.bundled_rules ?? []
+      await api.put<ApiPersona>(`/api/v1/personas/${name}`, { content: v.content, bundled_rules: bundledRules })
+
+      const state = await getEffectiveState(api)
+      if (state.persona === name) await sync({ api })
+
+      return { reverted: name, to_version: c.options.to }
+    },
+  })
   .command('use', {
     description: 'Activate a persona',
     args: z.object({
@@ -245,6 +298,31 @@ export const persona = Cli.create('persona', {
       return result
     },
   })
+  .command('delete', {
+    description: 'Delete a persona permanently',
+    args: z.object({
+      name: z.string().describe('Persona name to delete'),
+    }),
+    async run(c) {
+      const name = normalizeSlug(c.args.name, 'persona name')
+      const api = await getApi()
+
+      try {
+        await api.delete(`/api/v1/personas/${name}`)
+      } catch (e) {
+        if (e instanceof IncurError && e.code === ErrorCode.NOT_FOUND) {
+          throw createError(ErrorCode.PERSONA_NOT_FOUND, { params: [name] })
+        }
+        throw e
+      }
+
+      // If this persona was active, sync to reflect removal
+      const state = await getEffectiveState(api)
+      if (state.persona === name) await sync({ api })
+
+      return { deleted: name }
+    },
+  })
   .command('drop', {
     description: 'Deactivate the current persona',
     options: z.object({
@@ -256,7 +334,7 @@ export const persona = Cli.create('persona', {
       const mutationOpts = c.options.project
         ? { project: basename(process.cwd()) }
         : undefined
-      await putState(api, { persona_slug: null }, mutationOpts)
+      await putState(api, { persona_slug: '' }, mutationOpts)
 
       await sync({ api })
       if (c.options.project) await sync({ api, project: true })

package/src/commands/rules.ts

@@ -6,7 +6,7 @@ import { ErrorCode, createError } from '../errors.js'
 import { normalizeSlug, getEffectiveState, getStateOverride, putState } from '../state.js'
 import { sync } from '../sync.js'
 import { getApi } from '../client.js'
-import type { ApiRule, ApiRuleList } from '../api-types.js'
+import type { ApiRule, ApiRuleList, ApiVersionList, ApiContentVersion } from '../api-types.js'
 
 export const rules = Cli.create('rules', {
   description: 'Manage rules — behavioral constraints for the agent',
@@ -17,6 +17,7 @@ export const rules = Cli.create('rules', {
       name: z.string().describe('Rule name'),
     }),
     options: z.object({
+      content: z.string().optional().describe('Rule content (if omitted, creates with a starter template you can edit)'),
       description: z.string().optional().describe('One-line description of the rule'),
     }),
     async run(c) {
@@ -32,15 +33,20 @@ export const rules = Cli.create('rules', {
         if (e instanceof IncurError && e.code !== ErrorCode.NOT_FOUND) throw e
       }
 
-      const scaffold = [
-        `# ${name}`,
-        '',
-        c.options.description ?? 'Describe what this rule enforces and why.',
-        '',
-        '## Constraints',
-        '- ',
-        '',
-      ].join('\n')
+      let scaffold: string
+      if (c.options.content) {
+        scaffold = c.options.content.trim()
+      } else {
+        scaffold = [
+          `# ${name}`,
+          '',
+          c.options.description ?? 'Describe what this rule enforces and why.',
+          '',
+          '## Constraints',
+          '- ',
+          '',
+        ].join('\n')
+      }
 
       await api.put<ApiRule>(`/api/v1/rules/${name}`, {
         entries: [{ name: `${name}.md`, content: scaffold }],
@@ -59,10 +65,13 @@ export const rules = Cli.create('rules', {
     },
   })
   .command('update', {
-    description: 'Update a rule\'s content (reads from stdin)',
+    description: 'Update a rule\'s content (reads from stdin or --content)',
     args: z.object({
       name: z.string().describe('Rule name'),
     }),
+    options: z.object({
+      content: z.string().optional().describe('Rule content (reads from stdin if omitted)'),
+    }),
     async run(c) {
       const name = normalizeSlug(c.args.name, 'rule name')
       const api = await getApi()
@@ -77,11 +86,14 @@ export const rules = Cli.create('rules', {
         throw e
       }
 
-      const chunks: Uint8Array[] = []
-      for await (const chunk of Bun.stdin.stream()) {
-        chunks.push(chunk)
+      let content = c.options.content?.trim()
+      if (!content) {
+        const chunks: Uint8Array[] = []
+        for await (const chunk of Bun.stdin.stream()) {
+          chunks.push(chunk)
+        }
+        content = Buffer.concat(chunks).toString().trim()
       }
-      const content = Buffer.concat(chunks).toString().trim()
 
       if (!content) {
         throw createError(ErrorCode.MISSING_ARG, {
@@ -133,10 +145,20 @@ export const rules = Cli.create('rules', {
     args: z.object({
       name: z.string().describe('Rule name to show'),
     }),
+    options: z.object({
+      version: z.number().optional().describe('Show a specific version from history'),
+    }),
     async run(c) {
       const name = normalizeSlug(c.args.name, 'rule name')
       const api = await getApi()
 
+      if (c.options.version) {
+        const v = await api.get<ApiContentVersion>(`/api/v1/rules/${name}/versions/${c.options.version}`)
+        const entries = (v.metadata as { entries?: Array<{ sort_key: number; content: string }> })?.entries ?? []
+        const content = entries.map(e => e.content.trim()).join('\n\n')
+        return { name, version: v.version, content, created_at: v.created_at }
+      }
+
       try {
         const rule = await api.get<ApiRule>(`/api/v1/rules/${name}`)
         const content = rule.entries.map(e => e.content.trim()).join('\n\n')
@@ -149,6 +171,40 @@ export const rules = Cli.create('rules', {
       }
     },
   })
+  .command('history', {
+    description: 'List version history for a rule',
+    args: z.object({
+      name: z.string().describe('Rule name'),
+    }),
+    async run(c) {
+      const name = normalizeSlug(c.args.name, 'rule name')
+      const api = await getApi()
+      const result = await api.get<ApiVersionList>(`/api/v1/rules/${name}/versions`)
+      return { name, versions: result.versions }
+    },
+  })
+  .command('revert', {
+    description: 'Restore a rule to a previous version',
+    args: z.object({
+      name: z.string().describe('Rule name'),
+    }),
+    options: z.object({
+      to: z.number().describe('Version number to restore'),
+    }),
+    async run(c) {
+      const name = normalizeSlug(c.args.name, 'rule name')
+      const api = await getApi()
+      const v = await api.get<ApiContentVersion>(`/api/v1/rules/${name}/versions/${c.options.to}`)
+      const entries = (v.metadata as { entries?: Array<{ sort_key: number; content: string }> })?.entries
+      if (!entries) throw createError(ErrorCode.BAD_REQUEST, { message: 'Version has no entries to restore' })
+      await api.put<ApiRule>(`/api/v1/rules/${name}`, { entries: entries.map(e => ({ name: `${name}.md`, content: e.content })) })
+
+      const state = await getEffectiveState(api)
+      if (state.rules.includes(name)) await sync({ api })
+
+      return { reverted: name, to_version: c.options.to }
+    },
+  })
   .command('add', {
     description: 'Activate a rule or rule pack',
     args: z.object({
@@ -182,13 +238,38 @@ export const rules = Cli.create('rules', {
       return { activated: name, project: c.options.project }
     },
   })
-  .command('remove', {
+  .command('delete', {
+    description: 'Delete a rule permanently',
+    args: z.object({
+      name: z.string().describe('Rule name to delete'),
+    }),
+    async run(c) {
+      const name = normalizeSlug(c.args.name, 'rule name')
+      const api = await getApi()
+
+      try {
+        await api.delete(`/api/v1/rules/${name}`)
+      } catch (e) {
+        if (e instanceof IncurError && e.code === ErrorCode.NOT_FOUND) {
+          throw createError(ErrorCode.RULE_NOT_FOUND, { params: [name] })
+        }
+        throw e
+      }
+
+      // If this rule was active, sync to reflect removal
+      const state = await getEffectiveState(api)
+      if (state.rules.includes(name)) await sync({ api })
+
+      return { deleted: name }
+    },
+  })
+  .command('drop', {
     description: 'Deactivate a rule',
     args: z.object({
-      name: z.string().describe('Rule name to remove'),
+      name: z.string().describe('Rule name to deactivate'),
     }),
     options: z.object({
-      project: z.boolean().default(false).describe('Remove rule at project scope'),
+      project: z.boolean().default(false).describe('Deactivate rule at project scope'),
     }),
     async run(c) {
       const name = normalizeSlug(c.args.name, 'rule name')

package/src/commands/soul.ts

@@ -6,7 +6,7 @@ import { ErrorCode, createError } from '../errors.js'
 import { normalizeSlug, getEffectiveState, getStateOverride, putState } from '../state.js'
 import { sync } from '../sync.js'
 import { getApi } from '../client.js'
-import type { ApiSoul, ApiSoulList } from '../api-types.js'
+import type { ApiSoul, ApiSoulList, ApiVersionList, ApiContentVersion } from '../api-types.js'
 
 export const soul = Cli.create('soul', {
   description: 'Manage soul — personality and values for the agent',
@@ -17,6 +17,7 @@ export const soul = Cli.create('soul', {
       name: z.string().describe('Soul name'),
     }),
     options: z.object({
+      content: z.string().optional().describe('Soul content (if omitted, creates with a starter template you can edit)'),
       description: z.string().optional().describe('One-line description of the soul'),
     }),
     async run(c) {
@@ -32,24 +33,29 @@ export const soul = Cli.create('soul', {
         if (e instanceof IncurError && e.code !== ErrorCode.NOT_FOUND) throw e
       }
 
-      const lines: string[] = []
-      lines.push(`# ${name}`)
-      lines.push('')
-      if (c.options.description) {
-        lines.push(c.options.description)
+      let content: string
+      if (c.options.content) {
+        content = c.options.content.trim()
+      } else {
+        const lines: string[] = []
+        lines.push(`# ${name}`)
         lines.push('')
+        if (c.options.description) {
+          lines.push(c.options.description)
+          lines.push('')
+        }
+        lines.push('## Voice')
+        lines.push('- ')
+        lines.push('')
+        lines.push('## Character')
+        lines.push('- ')
+        lines.push('')
+        lines.push('## Standards')
+        lines.push('- ')
+        lines.push('')
+        content = lines.join('\n')
       }
-      lines.push('## Voice')
-      lines.push('- ')
-      lines.push('')
-      lines.push('## Character')
-      lines.push('- ')
-      lines.push('')
-      lines.push('## Standards')
-      lines.push('- ')
-      lines.push('')
-
-      const content = lines.join('\n')
+
       await api.put<ApiSoul>(`/api/v1/souls/${name}`, { content })
 
       if (c.agent || c.formatExplicit) {
@@ -65,10 +71,13 @@ export const soul = Cli.create('soul', {
     },
   })
   .command('update', {
-    description: 'Update a soul\'s content (reads from stdin)',
+    description: 'Update a soul\'s content (reads from stdin or --content)',
     args: z.object({
       name: z.string().describe('Soul name'),
     }),
+    options: z.object({
+      content: z.string().optional().describe('Soul content (reads from stdin if omitted)'),
+    }),
     async run(c) {
       const name = normalizeSlug(c.args.name, 'soul name')
       const api = await getApi()
@@ -83,11 +92,14 @@ export const soul = Cli.create('soul', {
         throw e
       }
 
-      const chunks: Uint8Array[] = []
-      for await (const chunk of Bun.stdin.stream()) {
-        chunks.push(chunk)
+      let content = c.options.content?.trim()
+      if (!content) {
+        const chunks: Uint8Array[] = []
+        for await (const chunk of Bun.stdin.stream()) {
+          chunks.push(chunk)
+        }
+        content = Buffer.concat(chunks).toString().trim()
       }
-      const content = Buffer.concat(chunks).toString().trim()
 
       if (!content) {
         throw createError(ErrorCode.MISSING_ARG, {
@@ -121,6 +133,7 @@ export const soul = Cli.create('soul', {
     options: z.object({
       project: z.boolean().default(false).describe('Show project soul override (if any)'),
       short: z.boolean().default(false).describe('Print only the active soul name'),
+      version: z.number().optional().describe('Show a specific version from history'),
     }),
     async run(c) {
       const api = await getApi()
@@ -131,6 +144,14 @@ export const soul = Cli.create('soul', {
         return state.soul ?? 'none'
       }
 
+      if (c.options.version) {
+        const name = c.args.name
+        if (!name) throw createError(ErrorCode.MISSING_ARG, { message: 'Name is required when using --version' })
+        const slug = normalizeSlug(name, 'soul name')
+        const v = await api.get<ApiContentVersion>(`/api/v1/souls/${slug}/versions/${c.options.version}`)
+        return { name: slug, version: v.version, content: v.content, created_at: v.created_at }
+      }
+
       if (c.args.name) {
         const name = normalizeSlug(c.args.name, 'soul name')
         try {
@@ -168,6 +189,39 @@ export const soul = Cli.create('soul', {
       }
     },
   })
+  .command('history', {
+    description: 'List version history for a soul',
+    args: z.object({
+      name: z.string().describe('Soul name'),
+    }),
+    async run(c) {
+      const name = normalizeSlug(c.args.name, 'soul name')
+      const api = await getApi()
+      const result = await api.get<ApiVersionList>(`/api/v1/souls/${name}/versions`)
+      return { name, versions: result.versions }
+    },
+  })
+  .command('revert', {
+    description: 'Restore a soul to a previous version',
+    args: z.object({
+      name: z.string().describe('Soul name'),
+    }),
+    options: z.object({
+      to: z.number().describe('Version number to restore'),
+    }),
+    async run(c) {
+      const name = normalizeSlug(c.args.name, 'soul name')
+      const api = await getApi()
+      const v = await api.get<ApiContentVersion>(`/api/v1/souls/${name}/versions/${c.options.to}`)
+      if (!v.content) throw createError(ErrorCode.BAD_REQUEST, { message: 'Version has no content to restore' })
+      await api.put<ApiSoul>(`/api/v1/souls/${name}`, { content: v.content })
+
+      const state = await getEffectiveState(api)
+      if (state.soul === name) await sync({ api })
+
+      return { reverted: name, to_version: c.options.to }
+    },
+  })
   .command('use', {
     description: 'Activate a soul',
     args: z.object({
@@ -201,6 +255,31 @@ export const soul = Cli.create('soul', {
       return { activated: name, project: c.options.project }
     },
   })
+  .command('delete', {
+    description: 'Delete a soul permanently',
+    args: z.object({
+      name: z.string().describe('Soul name to delete'),
+    }),
+    async run(c) {
+      const name = normalizeSlug(c.args.name, 'soul name')
+      const api = await getApi()
+
+      try {
+        await api.delete(`/api/v1/souls/${name}`)
+      } catch (e) {
+        if (e instanceof IncurError && e.code === ErrorCode.NOT_FOUND) {
+          throw createError(ErrorCode.SOUL_NOT_FOUND, { params: [name] })
+        }
+        throw e
+      }
+
+      // If this soul was active, sync to reflect removal
+      const state = await getEffectiveState(api)
+      if (state.soul === name) await sync({ api })
+
+      return { deleted: name }
+    },
+  })
   .command('drop', {
     description: 'Deactivate the current soul',
     options: z.object({
@@ -212,7 +291,7 @@ export const soul = Cli.create('soul', {
       const mutationOpts = c.options.project
         ? { project: basename(process.cwd()) }
         : undefined
-      await putState(api, { soul_slug: null }, mutationOpts)
+      await putState(api, { soul_slug: '' }, mutationOpts)
 
       await sync({ api })
       if (c.options.project) await sync({ api, project: true })

package/src/daemon.ts

@@ -8,6 +8,7 @@ import { readConfig, activeContext, localContext } from './config.js'
 import { ErrorCode, createError } from './errors.js'
 
 export const DIST_BASE = 'https://get.brainjar.sh/brainjar-server'
+export const SEMVER_RE = /^v?\d+\.\d+\.\d+(-[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?(\+[a-zA-Z0-9.]+)?$/
 
 /**
  * Compare two semver strings. Returns -1, 0, or 1.
@@ -156,7 +157,13 @@ export async function fetchLatestVersion(distBase: string = DIST_BASE): Promise<
       hint: 'Check your network connection or try again later.',
     })
   }
-  return (await response.text()).trim()
+  const version = (await response.text()).trim()
+  if (!SEMVER_RE.test(version)) {
+    throw createError(ErrorCode.VALIDATION_ERROR, {
+      message: `Invalid server version string from distribution: "${version}"`,
+    })
+  }
+  return version
 }
 
 /**

package/src/pack.ts

@@ -1,5 +1,5 @@
 import { readFile, readdir, writeFile, access, mkdir, stat } from 'node:fs/promises'
-import { join, dirname } from 'node:path'
+import { join, dirname, basename } from 'node:path'
 import { parse as parseYaml, stringify as stringifyYaml } from 'yaml'
 import { Errors } from 'incur'
 import { ErrorCode, createError } from './errors.js'
@@ -127,7 +127,13 @@ export async function exportPack(brainName: string, options: ExportOptions = {})
       const ruleDir = join(packDir, 'rules', ruleSlug)
       await mkdir(ruleDir, { recursive: true })
       for (const entry of rule.entries) {
-        await writeFile(join(ruleDir, entry.name), entry.content)
+        const safeName = basename(entry.name)
+        if (!safeName || safeName !== entry.name) {
+          throw createError(ErrorCode.PACK_INVALID_MANIFEST, {
+            message: `Rule entry name contains invalid path: "${entry.name}"`,
+          })
+        }
+        await writeFile(join(ruleDir, safeName), entry.content)
       }
     }
   }

package/src/upgrade.ts

@@ -2,14 +2,22 @@ import { execFile } from 'node:child_process'
 import {
   healthCheck,
   start,
-  stop,
   status as daemonStatus,
   upgradeServer,
+  SEMVER_RE,
 } from './daemon.js'
 import { checkForUpdates } from './version-check.js'
 import { ErrorCode, createError } from './errors.js'
 import pkg from '../package.json'
 
+function validateVersion(v: string, label: string): void {
+  if (!SEMVER_RE.test(v)) {
+    throw createError(ErrorCode.VALIDATION_ERROR, {
+      message: `Invalid ${label} version string: "${v}"`,
+    })
+  }
+}
+
 export interface ComponentResult {
   upgraded: boolean
   from: string
@@ -59,6 +67,7 @@ export async function upgradeCli(): Promise<ComponentResult> {
   }
 
   const latestVersion = updates.cli.latest
+  validateVersion(latestVersion, 'CLI')
   const pm = detectPackageManager()
 
   try {