ctxinit 0.1.0

package/dist/llm/providers/openai-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-api.js","sourceRoot":"","sources":["../../../src/llm/providers/openai-api.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AASH,oDAAmD;AAEnD;;GAEG;AACH,MAAa,iBAAkB,SAAQ,+BAAe;IAC5C,MAAM,CAAU,OAAO,GAAG,4CAA4C,CAAC;IACvE,MAAM,CAAU,aAAa,GAAG,QAAQ,CAAC;IAEjD,YAAY,MAAyB;QACnC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,YAAY;QACd,OAAO;YACL,QAAQ,EAAE,IAAI,EAAE,2BAA2B;YAC3C,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,IAAI;YACf,gBAAgB,EAAE,MAAM;YACxB,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAChE,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAmB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAChE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC,aAAa,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAEjD,uBAAuB;QACvB,MAAM,QAAQ,GAA6C,EAAE,CAAC;QAE9D,oBAAoB;QACpB,IAAI,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAC9C,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACzE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,YAAY,GAAG,CAAC,YAAY,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;iBACjE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,qBAAqB;QACrB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAA4B;YACpC,KAAK;YACL,UAAU,EAAE,SAAS;YACrB,WAAW;YACX,QAAQ;SACT,CAAC;QAEF,gCAAgC;QAChC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,eAAe,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACjD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAE1E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,UAAU,MAAM,EAAE;iBACpC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAO/B,CAAC;YAEF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;YAExD,OAAO;gBACL,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa;gBACvC,gBAAgB,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB;gBAC/C,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY;gBACrC,QAAQ,EAAE,EAAE,KAAK,EAAE;aACpB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;;AAnHH,8CAoHC"}

package/dist/llm/types.d.ts

@@ -0,0 +1,128 @@
+/**
+ * LLM Provider Types
+ *
+ * Unified interface for LLM providers supporting both API and CLI invocation.
+ */
+/**
+ * Supported LLM provider types
+ */
+export type LLMProviderType = 'claude-api' | 'openai-api' | 'gemini-api' | 'claude-code' | 'cursor' | 'codex' | 'gemini-cli' | 'interactive';
+/**
+ * Provider configuration
+ */
+export interface LLMProviderConfig {
+    type: LLMProviderType;
+    /** API key (for API providers) */
+    apiKey?: string;
+    /** Model to use */
+    model?: string;
+    /** CLI command path override */
+    cliPath?: string;
+    /** Max tokens for response */
+    maxTokens?: number;
+    /** Temperature for generation */
+    temperature?: number;
+    /** Timeout in milliseconds */
+    timeout?: number;
+    /** Enable verbose logging for debugging */
+    verbose?: boolean;
+}
+/**
+ * Message format for LLM communication
+ */
+export interface LLMMessage {
+    role: 'system' | 'user' | 'assistant';
+    content: string;
+}
+/**
+ * LLM request
+ */
+export interface LLMRequest {
+    messages: LLMMessage[];
+    /** Optional system prompt (some providers handle separately) */
+    systemPrompt?: string;
+    /** Max tokens for response */
+    maxTokens?: number;
+    /** Temperature */
+    temperature?: number;
+    /** JSON mode - request structured JSON output */
+    jsonMode?: boolean;
+}
+/**
+ * LLM response
+ */
+export interface LLMResponse {
+    content: string;
+    /** Tokens used in prompt */
+    promptTokens?: number;
+    /** Tokens used in response */
+    completionTokens?: number;
+    /** Total tokens */
+    totalTokens?: number;
+    /** Provider-specific metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Provider capabilities
+ */
+export interface LLMProviderCapabilities {
+    /** Supports JSON mode */
+    jsonMode: boolean;
+    /** Supports system prompts */
+    systemPrompt: boolean;
+    /** Supports streaming */
+    streaming: boolean;
+    /** Max context window */
+    maxContextTokens: number;
+    /** Max output tokens */
+    maxOutputTokens: number;
+}
+/**
+ * Provider interface - all providers must implement this
+ */
+export interface LLMProvider {
+    /** Provider type */
+    readonly type: LLMProviderType;
+    /** Provider display name */
+    readonly name: string;
+    /** Provider capabilities */
+    readonly capabilities: LLMProviderCapabilities;
+    /**
+     * Check if provider is available (API key set, CLI installed, etc.)
+     */
+    isAvailable(): Promise<boolean>;
+    /**
+     * Send request to LLM
+     */
+    complete(request: LLMRequest): Promise<LLMResponse>;
+}
+/**
+ * Bootstrap-specific output structure
+ */
+export interface BootstrapLLMOutput {
+    /** Enhanced project.md content */
+    projectMd?: string;
+    /** Enhanced architecture.md content */
+    architectureMd?: string;
+    /** Generated/enhanced rules */
+    rules: Array<{
+        /** Path relative to .context/ (e.g., "rules/typescript-patterns.md") */
+        path: string;
+        /** Full file content with frontmatter */
+        content: string;
+    }>;
+    /** Any warnings or suggestions from LLM */
+    suggestions?: string[];
+}
+/**
+ * Provider detection result
+ */
+export interface ProviderDetectionResult {
+    available: LLMProviderType[];
+    recommended: LLMProviderType | null;
+    details: Record<LLMProviderType, {
+        available: boolean;
+        reason?: string;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/llm/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/llm/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,eAAe,GAEvB,YAAY,GACZ,YAAY,GACZ,YAAY,GAEZ,aAAa,GACb,QAAQ,GACR,OAAO,GACP,YAAY,GAEZ,aAAa,CAAC;AAElB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,eAAe,CAAC;IACtB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,yBAAyB;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,8BAA8B;IAC9B,YAAY,EAAE,OAAO,CAAC;IACtB,yBAAyB;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,yBAAyB;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,wBAAwB;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,4BAA4B;IAC5B,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAE/C;;OAEG;IACH,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+BAA+B;IAC/B,KAAK,EAAE,KAAK,CAAC;QACX,wEAAwE;QACxE,IAAI,EAAE,MAAM,CAAC;QACb,yCAAyC;QACzC,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,WAAW,EAAE,eAAe,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE;QAC/B,SAAS,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ"}

package/dist/llm/types.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * LLM Provider Types
+ *
+ * Unified interface for LLM providers supporting both API and CLI invocation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/llm/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/llm/types.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/dist/parser/index.d.ts

@@ -0,0 +1,3 @@
+export * from './rule-parser';
+export * from './path-security';
+//# sourceMappingURL=index.d.ts.map

package/dist/parser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC"}

package/dist/parser/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./rule-parser"), exports);
+__exportStar(require("./path-security"), exports);
+//# sourceMappingURL=index.js.map

package/dist/parser/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,kDAAgC"}

package/dist/parser/path-security.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Path security validation error
+ */
+export declare class PathSecurityError extends Error {
+    readonly type: 'traversal' | 'absolute' | 'encoded' | 'null_byte' | 'symlink';
+    constructor(message: string, type: 'traversal' | 'absolute' | 'encoded' | 'null_byte' | 'symlink');
+}
+/**
+ * Validate that a path is safe and within the project directory
+ *
+ * @param filePath - The file path to validate (relative to project root)
+ * @param projectRoot - The project root directory
+ * @throws PathSecurityError if the path is unsafe
+ */
+export declare function validatePath(filePath: string, projectRoot: string): void;
+/**
+ * Validate that a symlink target is within the project directory
+ *
+ * @param symlinkPath - The path to the symlink
+ * @param projectRoot - The project root directory
+ * @throws PathSecurityError if the symlink target is outside the project
+ */
+export declare function validateSymlink(symlinkPath: string, projectRoot: string): void;
+/**
+ * Check if a path is safe (returns boolean instead of throwing)
+ *
+ * @param filePath - The file path to validate
+ * @param projectRoot - The project root directory
+ * @returns true if path is safe, false otherwise
+ */
+export declare function isPathSafe(filePath: string, projectRoot: string): boolean;
+/**
+ * Sanitize a path by removing dangerous components
+ * Note: This is for display purposes only - always use validatePath for security
+ *
+ * @param filePath - The file path to sanitize
+ * @returns Sanitized path string
+ */
+export declare function sanitizePath(filePath: string): string;
+//# sourceMappingURL=path-security.d.ts.map

package/dist/parser/path-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-security.d.ts","sourceRoot":"","sources":["../../src/parser/path-security.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,IAAI,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS;gBADpF,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS;CAKvF;AAwCD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CA2CxE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CA2B9E;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAOzE;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CASrD"}

package/dist/parser/path-security.js

@@ -0,0 +1,183 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PathSecurityError = void 0;
+exports.validatePath = validatePath;
+exports.validateSymlink = validateSymlink;
+exports.isPathSafe = isPathSafe;
+exports.sanitizePath = sanitizePath;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Path security validation error
+ */
+class PathSecurityError extends Error {
+    type;
+    constructor(message, type) {
+        super(message);
+        this.type = type;
+        this.name = 'PathSecurityError';
+    }
+}
+exports.PathSecurityError = PathSecurityError;
+/**
+ * Dangerous patterns that indicate path traversal attempts
+ */
+const TRAVERSAL_PATTERNS = [
+    /\.\./, // Parent directory reference
+    /\.\.%2[fF]/, // URL-encoded ../
+    /%2[fF]\.\./, // URL-encoded /..
+    /%252[fF]/, // Double-encoded /
+    /%00/, // Null byte (URL encoded)
+    /\0/, // Null byte (literal)
+];
+/**
+ * Check if a path contains traversal attempts
+ */
+function containsTraversalAttempt(filePath) {
+    return TRAVERSAL_PATTERNS.some(pattern => pattern.test(filePath));
+}
+/**
+ * Check if a path is absolute
+ */
+function isAbsolutePath(filePath) {
+    // Check for Windows-style paths (C:\ or \\)
+    if (/^[a-zA-Z]:[\\/]/.test(filePath) || filePath.startsWith('\\\\')) {
+        return true;
+    }
+    // Check for Unix-style absolute paths
+    return path.isAbsolute(filePath);
+}
+/**
+ * Check if a path contains null bytes
+ */
+function containsNullByte(filePath) {
+    return filePath.includes('\0') || /%00/i.test(filePath);
+}
+/**
+ * Validate that a path is safe and within the project directory
+ *
+ * @param filePath - The file path to validate (relative to project root)
+ * @param projectRoot - The project root directory
+ * @throws PathSecurityError if the path is unsafe
+ */
+function validatePath(filePath, projectRoot) {
+    // Check for null bytes first (most critical)
+    if (containsNullByte(filePath)) {
+        throw new PathSecurityError(`Path contains null byte: ${filePath}`, 'null_byte');
+    }
+    // Check for URL-encoded traversal patterns
+    if (/%2[fF]/.test(filePath) || /%252[fF]/.test(filePath)) {
+        throw new PathSecurityError(`Path contains URL-encoded characters: ${filePath}`, 'encoded');
+    }
+    // Check for absolute paths
+    if (isAbsolutePath(filePath)) {
+        throw new PathSecurityError(`Absolute paths are not allowed: ${filePath}`, 'absolute');
+    }
+    // Check for traversal attempts
+    if (containsTraversalAttempt(filePath)) {
+        throw new PathSecurityError(`Path traversal detected: ${filePath}`, 'traversal');
+    }
+    // Resolve the full path and verify it's within project
+    const resolvedPath = path.resolve(projectRoot, filePath);
+    const normalizedProject = path.normalize(projectRoot);
+    if (!resolvedPath.startsWith(normalizedProject)) {
+        throw new PathSecurityError(`Path escapes project directory: ${filePath}`, 'traversal');
+    }
+}
+/**
+ * Validate that a symlink target is within the project directory
+ *
+ * @param symlinkPath - The path to the symlink
+ * @param projectRoot - The project root directory
+ * @throws PathSecurityError if the symlink target is outside the project
+ */
+function validateSymlink(symlinkPath, projectRoot) {
+    const fullPath = path.resolve(projectRoot, symlinkPath);
+    try {
+        const stats = fs.lstatSync(fullPath);
+        if (!stats.isSymbolicLink()) {
+            return; // Not a symlink, nothing to validate
+        }
+        // Get the real path (follows all symlinks)
+        const realPath = fs.realpathSync(fullPath);
+        // Also resolve the project root to handle macOS /var -> /private/var symlinks
+        const realProjectRoot = fs.realpathSync(projectRoot);
+        if (!realPath.startsWith(realProjectRoot)) {
+            throw new PathSecurityError(`Symlink target is outside project: ${symlinkPath} -> ${realPath}`, 'symlink');
+        }
+    }
+    catch (error) {
+        if (error instanceof PathSecurityError) {
+            throw error;
+        }
+        // File doesn't exist or can't be read - that's okay for validation
+        // The actual file reading will fail later with a clearer error
+    }
+}
+/**
+ * Check if a path is safe (returns boolean instead of throwing)
+ *
+ * @param filePath - The file path to validate
+ * @param projectRoot - The project root directory
+ * @returns true if path is safe, false otherwise
+ */
+function isPathSafe(filePath, projectRoot) {
+    try {
+        validatePath(filePath, projectRoot);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Sanitize a path by removing dangerous components
+ * Note: This is for display purposes only - always use validatePath for security
+ *
+ * @param filePath - The file path to sanitize
+ * @returns Sanitized path string
+ */
+function sanitizePath(filePath) {
+    return filePath
+        .replace(/\0/g, '') // Remove null bytes
+        .replace(/%00/gi, '') // Remove encoded null bytes
+        .replace(/%2[fF]/g, '/') // Decode URL-encoded slashes
+        .replace(/%252[fF]/g, '/') // Decode double-encoded slashes
+        .replace(/\.\./g, '') // Remove parent references
+        .replace(/\/+/g, '/') // Normalize multiple slashes
+        .replace(/^\//, ''); // Remove leading slash
+}
+//# sourceMappingURL=path-security.js.map

package/dist/parser/path-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-security.js","sourceRoot":"","sources":["../../src/parser/path-security.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,oCA2CC;AASD,0CA2BC;AASD,gCAOC;AASD,oCASC;AA9KD,uCAAyB;AACzB,2CAA6B;AAE7B;;GAEG;AACH,MAAa,iBAAkB,SAAQ,KAAK;IAGxB;IAFlB,YACE,OAAe,EACC,IAAoE;QAEpF,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAgE;QAGpF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AARD,8CAQC;AAED;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,MAAM,EAAqB,6BAA6B;IACxD,YAAY,EAAe,kBAAkB;IAC7C,YAAY,EAAe,kBAAkB;IAC7C,UAAU,EAAiB,mBAAmB;IAC9C,KAAK,EAAsB,0BAA0B;IACrD,IAAI,EAAuB,sBAAsB;CAClD,CAAC;AAEF;;GAEG;AACH,SAAS,wBAAwB,CAAC,QAAgB;IAChD,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,QAAgB;IACtC,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,sCAAsC;IACtC,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,QAAgB,EAAE,WAAmB;IAChE,6CAA6C;IAC7C,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,QAAQ,EAAE,EACtC,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,QAAQ,EAAE,EACnD,SAAS,CACV,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CACzB,mCAAmC,QAAQ,EAAE,EAC7C,UAAU,CACX,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,QAAQ,EAAE,EACtC,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAEtD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,iBAAiB,CACzB,mCAAmC,QAAQ,EAAE,EAC7C,WAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,WAAmB,EAAE,WAAmB;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5B,OAAO,CAAC,qCAAqC;QAC/C,CAAC;QAED,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,8EAA8E;QAC9E,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAErD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,iBAAiB,CACzB,sCAAsC,WAAW,OAAO,QAAQ,EAAE,EAClE,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACvC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,mEAAmE;QACnE,+DAA+D;IACjE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,UAAU,CAAC,QAAgB,EAAE,WAAmB;IAC9D,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,QAAgB;IAC3C,OAAO,QAAQ;SACZ,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAW,oBAAoB;SACjD,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAS,4BAA4B;SACzD,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAM,6BAA6B;SAC1D,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAI,gCAAgC;SAC7D,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAS,2BAA2B;SACxD,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAS,6BAA6B;SAC1D,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAU,uBAAuB;AACzD,CAAC"}

package/dist/parser/rule-parser.d.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+import { ParsedRule } from '../schemas/rule';
+/**
+ * Error thrown when rule parsing fails
+ */
+export declare class RuleParseError extends Error {
+    readonly path: string;
+    readonly line?: number | undefined;
+    readonly details?: z.ZodError | undefined;
+    constructor(message: string, path: string, line?: number | undefined, details?: z.ZodError | undefined);
+}
+/**
+ * Options for parsing rules
+ */
+export interface ParseOptions {
+    /** Project root directory */
+    projectRoot: string;
+    /** Path to the rules directory (default: .context/rules) */
+    rulesDir?: string;
+    /** Whether to validate symlinks (default: true) */
+    validateSymlinks?: boolean;
+}
+/**
+ * Parse a single rule file
+ *
+ * @param filePath - Path to the rule file (relative to rulesDir)
+ * @param options - Parse options
+ * @returns Parsed rule
+ * @throws RuleParseError if parsing fails
+ * @throws PathSecurityError if path is unsafe
+ */
+export declare function parseRule(filePath: string, options: ParseOptions): ParsedRule;
+/**
+ * Parse all rule files in a directory
+ *
+ * @param options - Parse options
+ * @returns Array of parsed rules and any errors encountered
+ */
+export declare function parseAllRules(options: ParseOptions): {
+    rules: ParsedRule[];
+    errors: RuleParseError[];
+};
+/**
+ * Check if a file has valid frontmatter without fully parsing
+ *
+ * @param content - File content
+ * @returns true if frontmatter appears valid
+ */
+export declare function hasValidFrontmatter(content: string): boolean;
+//# sourceMappingURL=rule-parser.d.ts.map

package/dist/parser/rule-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-parser.d.ts","sourceRoot":"","sources":["../../src/parser/rule-parser.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,UAAU,EAEX,MAAM,iBAAiB,CAAC;AAGzB;;GAEG;AACH,qBAAa,cAAe,SAAQ,KAAK;aAGrB,IAAI,EAAE,MAAM;aACZ,IAAI,CAAC,EAAE,MAAM;aACb,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ;gBAHpC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,YAAA,EACb,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,YAAA;CAKvC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,CAwF7E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG;IACpD,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B,CAqDA;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc5D"}