eslint-plugin-ai-guard 1.1.10 → 1.1.11

package/README.md

@@ -28,11 +28,35 @@ npx ai-guard run          # recommended preset (lowest noise)
 npx ai-guard run --strict
 npx ai-guard run --security
 npx ai-guard init         # auto-creates ESLint config for you
+npx ai-guard init --dry-run
 npx ai-guard doctor       # diagnoses setup issues
 npx ai-guard baseline     # track only *new* issues going forward
 ```
 That's it. **Zero configuration required.**
 
+## 🤖 Set Up AI Agent Rules
+
+Generate instruction files so Claude Code, Cursor, and GitHub Copilot
+automatically avoid the 17 most common AI-generated anti-patterns:
+
+```bash
+npx ai-guard init-context
+```
+
+Follow the prompts to select your agent(s). Or generate all at once:
+
+```bash
+npx ai-guard init-context --all
+```
+
+This writes:
+- `CLAUDE.md` — read automatically by Claude Code
+- `.cursorrules` — read automatically by Cursor
+- `.github/copilot-instructions.md` — read automatically by GitHub Copilot
+
+Your AI tools will now avoid these patterns before you even run the linter.
+Use `--force` to regenerate after upgrading to a new version with new rules.
+
 ## 🧪 Real-World Usage Philosophy
 
 `ai-guard` is designed for production adoption in existing codebases:
@@ -62,7 +86,8 @@ const users = await Promise.all(userIds.map(async (id) => {
 
 ### Terminal Output
 
-![ai-guard linting demo](./assets/demo.png)
+![ai-guard linting demo](./assets/example_1.png)
+![ai-guard linting demo](./assets/example_2.png)
 
 *The terminal output above shows `ai-guard` catching multiple AI-generated anti-patterns in a single run.*
 
@@ -102,7 +127,7 @@ const users = await Promise.all(userIds.map(async (id) => {
   Disallow dynamic `eval()` or `new Function()`.
 - **`ai-guard/no-sql-string-concat`** (Warn in `recommended`, Error in `security`/`strict`)
   Disallow variable concatenation/interpolation in SQL queries. AI tools frequently generate dangerous code enabling SQL injection.
-- **`ai-guard/no-unsafe-deserialize`** (Warn)
+- **`ai-guard/no-unsafe-deserialize`** (Warn in `recommended`/`security`, Error in `strict`)
   Disallow `JSON.parse()` on likely untrusted inputs (like `req.body`) without visible validation.
 - **`ai-guard/require-auth-middleware`** (Warn)
   Enforce authentication middleware on Express/Fastify routes. AI tools frequently generate unprotected endpoints exposing sensitive data.

package/dist/cli/index.js

@@ -315,8 +315,8 @@ var init_config_manager = __esm({
 
 // cli/index.ts
 var import_commander = require("commander");
-var import_fs6 = __toESM(require("fs"));
-var import_path9 = __toESM(require("path"));
+var import_fs7 = __toESM(require("fs"));
+var import_path10 = __toESM(require("path"));
 
 // cli/commands/run.ts
 var import_ora = __toESM(require("ora"));
@@ -473,12 +473,21 @@ async function loadPluginModuleFromCwd(cwd) {
   const requireFromCwd = createRequire(import_path.default.join(cwd, "package.json"));
   try {
     const resolved = requireFromCwd.resolve("eslint-plugin-ai-guard");
-    return await import((0, import_url.pathToFileURL)(resolved).href);
+    return import((0, import_url.pathToFileURL)(resolved).href);
   } catch {
   }
   const localDistEntry = import_path.default.join(cwd, "dist", "index.js");
   if (import_fs.default.existsSync(localDistEntry)) {
-    return await import((0, import_url.pathToFileURL)(localDistEntry).href);
+    return import((0, import_url.pathToFileURL)(localDistEntry).href);
+  }
+  const localSrcEntry = import_path.default.join(cwd, "src", "index.ts");
+  if (import_fs.default.existsSync(localSrcEntry)) {
+    try {
+      return import((0, import_url.pathToFileURL)(localSrcEntry).href);
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      log.debug(`Local src plugin import failed: ${reason}`);
+    }
   }
   throw new Error(
     "eslint-plugin-ai-guard is not installed. Run: npm install --save-dev eslint-plugin-ai-guard"
@@ -493,7 +502,13 @@ async function runEslint(options) {
   const rawPlugin = await loadPluginModuleFromCwd(process.cwd());
   const plugin = normalizePlugin(rawPlugin);
   const rules = getRules(options.preset);
-  const targetPath = import_path.default.resolve(options.targetPath);
+  const resolvedTargetPath = import_path.default.resolve(options.targetPath);
+  if (!import_fs.default.existsSync(resolvedTargetPath)) {
+    throw new Error(`Path not found: ${options.targetPath}`);
+  }
+  const targetStat = import_fs.default.statSync(resolvedTargetPath);
+  const isSingleFileTarget = targetStat.isFile();
+  const eslintCwd = isSingleFileTarget ? import_path.default.dirname(resolvedTargetPath) : resolvedTargetPath;
   const startMs = Date.now();
   const JS_TS_FILES = [
     "**/*.js",
@@ -556,11 +571,11 @@ async function runEslint(options) {
     });
   }
   const eslint = new ESLint({
-    cwd: targetPath,
+    cwd: eslintCwd,
     overrideConfigFile: true,
     overrideConfig: configBlocks
   });
-  const patterns = JS_TS_FILES;
+  const patterns = isSingleFileTarget ? [import_path.default.basename(resolvedTargetPath)] : JS_TS_FILES;
   const perPatternResults = await Promise.all(
     patterns.map(async (pattern) => {
       try {
@@ -617,8 +632,23 @@ async function runEslint(options) {
 
 // cli/commands/run.ts
 function registerRunCommand(program2) {
-  program2.command("run").description("Run ai-guard rules on your project (zero ESLint config required)").option("--path <dir>", "Directory or file to scan", ".").option("--strict", "Use the strict rule preset (all rules at error)").option("--security", "Use the security-only rule preset").option("--json", "Output results as JSON").option("--max-warnings <n>", "Fail if warnings exceed this count", parseInt).action(async (opts) => {
+  program2.command("run").description("Run ai-guard rules on your project (zero ESLint config required)").option("--path <dir>", "Directory or file to scan", ".").option("--strict", "Use the strict rule preset (all rules at error)").option("--security", "Use the security-only rule preset").option("--json", "Output results as JSON").option(
+    "--max-warnings <n>",
+    "Fail if warnings exceed this count",
+    (value) => Number.parseInt(value, 10)
+  ).action(async (opts) => {
+    if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
+      log.blank();
+      log.error("--max-warnings must be a non-negative integer.");
+      log.blank();
+      process.exit(1);
+      return;
+    }
     const preset = opts.strict ? "strict" : opts.security ? "security" : "recommended";
+    if (opts.strict && opts.security && !opts.json) {
+      log.warn("Both --strict and --security were provided. Using --strict.");
+      log.blank();
+    }
     if (!opts.json) {
       log.banner("AI GUARD RESULTS");
       log.blank();
@@ -662,7 +692,7 @@ function registerRunCommand(program2) {
         files: result.files
       };
       console.log(JSON.stringify(jsonOutput, null, 2));
-      process.exit(exitCode(result, opts.maxWarnings));
+      process.exit(getRunExitCode(result, opts.maxWarnings));
       return;
     }
     log.success(`Scanned:  ${import_chalk2.default.white(opts.path)}`);
@@ -729,10 +759,10 @@ function registerRunCommand(program2) {
     log.info(`Run ${import_chalk2.default.cyan("ai-guard baseline")} to save these issues and track only new ones`);
     log.info(`Run ${import_chalk2.default.cyan("ai-guard ignore")}    to suppress dist/build noise`);
     log.blank();
-    process.exit(exitCode(result, opts.maxWarnings));
+    process.exit(getRunExitCode(result, opts.maxWarnings));
   });
 }
-function exitCode(result, maxWarnings) {
+function getRunExitCode(result, maxWarnings) {
   if (result.totalErrors > 0) return 1;
   if (maxWarnings !== void 0 && result.totalWarnings > maxWarnings) return 1;
   return 0;
@@ -1641,11 +1671,491 @@ function registerBaselineCommand(program2) {
   });
 }
 
+// cli/commands/init-context.ts
+var import_fs6 = __toESM(require("fs"));
+var import_path9 = __toESM(require("path"));
+var import_chalk8 = __toESM(require("chalk"));
+var import_prompts2 = __toESM(require("prompts"));
+var RULE_CATEGORIES = {
+  "error-handling": [
+    "no-empty-catch",
+    "no-broad-exception",
+    "no-catch-log-rethrow",
+    "no-catch-without-use"
+  ],
+  async: [
+    "no-async-array-callback",
+    "no-floating-promise",
+    "no-await-in-loop",
+    "no-async-without-await",
+    "no-redundant-await"
+  ],
+  security: [
+    "no-hardcoded-secret",
+    "no-eval-dynamic",
+    "no-sql-string-concat",
+    "no-unsafe-deserialize",
+    "require-auth-middleware",
+    "require-authz-check"
+  ],
+  quality: [
+    "no-console-in-handler",
+    "no-duplicate-logic-block"
+  ]
+};
+var ALL_CATEGORIES = ["error-handling", "async", "security", "quality"];
+function errorHandlingSection() {
+  return `## Error Handling
+**Never** generate empty catch blocks:
+  \u274C  try { await fetchUser() } catch (e) {}
+  \u2705  try { await fetchUser() } catch (e) { logger.error(e); throw e; }
+
+**Never** catch (e: any) \u2014 use specific types or narrow with instanceof.
+
+**Never** catch, log, and immediately rethrow without adding context:
+  \u274C  catch (e) { console.error(e); throw e; }
+  \u2705  catch (e) { throw new Error('fetchUser failed', { cause: e }); }`;
+}
+function asyncSection() {
+  return `## Async Correctness
+**Never** pass async callbacks to array.map(), filter(), forEach(), or reduce():
+  \u274C  const results = ids.map(async (id) => await fetchUser(id));
+  \u2705  const results = await Promise.all(ids.map((id) => fetchUser(id)));
+
+**Never** use await inside a for...of or while loop when parallel execution
+is possible:
+  \u274C  for (const id of ids) { const user = await fetchUser(id); }
+  \u2705  const users = await Promise.all(ids.map(fetchUser));
+
+**Never** call an async function without await or .catch():
+  \u274C  sendEmail(user);
+  \u2705  await sendEmail(user);
+
+**Never** declare a function async if it never uses await.`;
+}
+function securitySection() {
+  return `## Security
+**Never** hardcode secrets, API keys, tokens, or passwords inline:
+  \u274C  const apiKey = 'sk-prod-abc123';
+  \u2705  const apiKey = process.env.API_KEY;
+
+**Never** concatenate user input into SQL strings:
+  \u274C  db.query('SELECT * FROM users WHERE id = ' + req.params.id);
+  \u2705  db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
+
+**Never** use eval() or new Function() with dynamic/user-supplied strings.
+
+**Never** call JSON.parse() on req.body, req.query, or req.params directly
+without schema validation.
+
+**Always** add authentication middleware before route handlers:
+  \u274C  router.get('/admin/users', getUsers);
+  \u2705  router.get('/admin/users', requireAuth, getUsers);
+
+**Always** verify that the authenticated user owns or has access to the
+resource being accessed when using req.params.id or similar identifiers.`;
+}
+function qualitySection() {
+  return `## Code Quality
+**Never** leave console.log or console.debug statements inside HTTP route
+handlers or event listeners in production code.
+
+**Never** copy-paste the same logic block consecutively \u2014 extract shared
+logic into a helper function or consolidate duplicated code.`;
+}
+var SECTION_MAP = {
+  "error-handling": errorHandlingSection,
+  async: asyncSection,
+  security: securitySection,
+  quality: qualitySection
+};
+function getSections(categories) {
+  return categories.map((cat) => SECTION_MAP[cat]()).join("\n\n");
+}
+function generateClaudeFile(version, categories) {
+  return `<!-- DO NOT EDIT MANUALLY \u2014 generated by eslint-plugin-ai-guard -->
+<!-- Regenerate: npx ai-guard init-context --force -->
+
+# AI Guard Rules \u2014 Claude Code Instructions
+
+You are coding in a project that uses eslint-plugin-ai-guard.
+Avoid generating the following patterns. They will be flagged as lint errors.
+
+${getSections(categories)}
+
+---
+Generated by eslint-plugin-ai-guard v${version}.
+Run \`npx ai-guard init-context --force\` to regenerate.
+`;
+}
+function cursorErrorHandling() {
+  return `## Error Handling
+
+Rule: no-empty-catch
+Bad:  try { await fetchUser() } catch (e) {}
+Good: try { await fetchUser() } catch (e) { logger.error(e); throw e; }
+
+Rule: no-broad-exception
+Bad:  catch (e: any) { handle(e); }
+Good: catch (e) { if (e instanceof NetworkError) { retry(); } throw e; }
+
+Rule: no-catch-log-rethrow
+Bad:  catch (e) { console.error(e); throw e; }
+Good: catch (e) { throw new Error('fetchUser failed', { cause: e }); }`;
+}
+function cursorAsyncSection() {
+  return `## Async Correctness
+
+Rule: no-async-array-callback
+Bad:  const results = ids.map(async (id) => await fetchUser(id));
+Good: const results = await Promise.all(ids.map((id) => fetchUser(id)));
+
+Rule: no-await-in-loop
+Bad:  for (const id of ids) { const user = await fetchUser(id); }
+Good: const users = await Promise.all(ids.map(fetchUser));
+
+Rule: no-floating-promise
+Bad:  sendEmail(user);
+Good: await sendEmail(user);
+
+Rule: no-async-without-await
+Bad:  async function getUser() { return db.findOne(id); }
+Good: function getUser() { return db.findOne(id); }`;
+}
+function cursorSecuritySection() {
+  return `## Security
+
+Rule: no-hardcoded-secret
+Bad:  const apiKey = 'sk-prod-abc123';
+Good: const apiKey = process.env.API_KEY;
+
+Rule: no-sql-string-concat
+Bad:  db.query('SELECT * FROM users WHERE id = ' + req.params.id);
+Good: db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
+
+Rule: no-eval-dynamic
+Bad:  eval(userInput);
+Good: Use a safe parser or allowlist approach instead.
+
+Rule: no-unsafe-deserialize
+Bad:  const data = JSON.parse(req.body);
+Good: const data = schema.parse(req.body);
+
+Rule: require-auth-middleware
+Bad:  router.get('/admin/users', getUsers);
+Good: router.get('/admin/users', requireAuth, getUsers);
+
+Rule: require-authz-check
+Bad:  const user = await db.findById(req.params.id); res.json(user);
+Good: const user = await db.findById(req.params.id); if (user.ownerId !== req.user.id) throw new ForbiddenError(); res.json(user);`;
+}
+function cursorQualitySection() {
+  return `## Code Quality
+
+Rule: no-console-in-handler
+Bad:  router.get('/users', (req, res) => { console.log('hit'); ... });
+Good: router.get('/users', (req, res) => { logger.info('hit'); ... });
+
+Rule: no-duplicate-logic-block
+Bad:  Two identical consecutive code blocks copy-pasted.
+Good: Extract the duplicated logic into a shared helper function.`;
+}
+var CURSOR_SECTION_MAP = {
+  "error-handling": cursorErrorHandling,
+  async: cursorAsyncSection,
+  security: cursorSecuritySection,
+  quality: cursorQualitySection
+};
+function generateCursorFile(version, categories) {
+  const sections = categories.map((cat) => CURSOR_SECTION_MAP[cat]()).join("\n\n");
+  return `# AI Guard Rules \u2014 Cursor Instructions
+# DO NOT EDIT MANUALLY \u2014 generated by eslint-plugin-ai-guard
+# Regenerate: npx ai-guard init-context --force
+
+This project uses eslint-plugin-ai-guard to catch the 17 most common
+anti-patterns generated by AI coding tools. Follow these rules when
+generating or editing code in this project. Violations will be flagged
+as lint errors.
+
+${sections}
+
+---
+These rules mirror eslint-plugin-ai-guard v${version}.
+Run \`npx ai-guard init-context --force\` to regenerate.
+`;
+}
+function copilotQuickRef(categories) {
+  const lines = [];
+  if (categories.includes("error-handling")) {
+    lines.push(
+      "Never: generate empty catch blocks",
+      "Never: catch (e: any) without narrowing",
+      "Never: catch, log, and rethrow without adding context"
+    );
+  }
+  if (categories.includes("async")) {
+    lines.push(
+      "Never: pass async callbacks to .map(), .filter(), .forEach()",
+      "Never: use await inside loops when Promise.all() works",
+      "Never: call async functions without await or .catch()",
+      "Never: mark functions async if they never await"
+    );
+  }
+  if (categories.includes("security")) {
+    lines.push(
+      "Never: hardcode API keys, secrets, or passwords",
+      "Never: concatenate user input into SQL strings",
+      "Never: use eval() or new Function() with dynamic input",
+      "Never: JSON.parse() untrusted input without validation",
+      "Always: add auth middleware before route handlers",
+      "Always: verify resource ownership in handlers"
+    );
+  }
+  if (categories.includes("quality")) {
+    lines.push(
+      "Never: leave console.log in route handlers",
+      "Never: copy-paste identical consecutive code blocks"
+    );
+  }
+  return lines.map((l) => `- ${l}`).join("\n");
+}
+function copilotDetails(categories) {
+  const details = [];
+  if (categories.includes("async")) {
+    details.push(`### no-floating-promise
+\`\`\`typescript
+// \u274C Bad \u2014 promise rejected silently
+sendEmail(user);
+
+// \u2705 Good
+await sendEmail(user);
+\`\`\``);
+    details.push(`### no-async-array-callback
+\`\`\`typescript
+// \u274C Bad \u2014 returns Promise[], not values
+ids.map(async (id) => await fetchUser(id));
+
+// \u2705 Good
+await Promise.all(ids.map((id) => fetchUser(id)));
+\`\`\``);
+  }
+  if (categories.includes("error-handling")) {
+    details.push(`### no-empty-catch
+\`\`\`typescript
+// \u274C Bad \u2014 error swallowed silently
+try { await fetchUser() } catch (e) {}
+
+// \u2705 Good
+try { await fetchUser() } catch (e) { logger.error(e); throw e; }
+\`\`\``);
+  }
+  if (categories.includes("security")) {
+    details.push(`### no-hardcoded-secret
+\`\`\`typescript
+// \u274C Bad
+const apiKey = 'sk-prod-abc123';
+
+// \u2705 Good
+const apiKey = process.env.API_KEY;
+\`\`\``);
+    details.push(`### no-sql-string-concat
+\`\`\`typescript
+// \u274C Bad \u2014 SQL injection
+db.query('SELECT * FROM users WHERE id = ' + req.params.id);
+
+// \u2705 Good
+db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
+\`\`\``);
+  }
+  return details.join("\n\n");
+}
+function generateCopilotFile(version, categories) {
+  return `<!-- DO NOT EDIT MANUALLY \u2014 generated by eslint-plugin-ai-guard -->
+<!-- Regenerate: npx ai-guard init-context --force -->
+
+# AI Guard \u2014 GitHub Copilot Instructions
+
+This project uses \`eslint-plugin-ai-guard\`. Follow these rules to avoid
+generating patterns that will be flagged as lint errors.
+
+## Quick Reference
+
+${copilotQuickRef(categories)}
+
+## Details
+
+${copilotDetails(categories)}
+
+---
+Generated by eslint-plugin-ai-guard v${version}.
+Run \`npx ai-guard init-context --force\` to regenerate.
+`;
+}
+var AGENTS = [
+  {
+    id: "claude",
+    label: "Claude Code",
+    filePath: "CLAUDE.md",
+    generate: generateClaudeFile
+  },
+  {
+    id: "cursor",
+    label: "Cursor",
+    filePath: ".cursorrules",
+    generate: generateCursorFile
+  },
+  {
+    id: "copilot",
+    label: "GitHub Copilot",
+    filePath: import_path9.default.join(".github", "copilot-instructions.md"),
+    generate: generateCopilotFile
+  }
+];
+function getPackageVersion2(cwd) {
+  try {
+    const pkgPath = import_path9.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
+    if (import_fs6.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs6.default.readFileSync(pkgPath, "utf-8"));
+      if (pkg.version) return pkg.version;
+    }
+  } catch {
+  }
+  try {
+    const pkgPath = import_path9.default.join(cwd, "package.json");
+    if (import_fs6.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs6.default.readFileSync(pkgPath, "utf-8"));
+      if (pkg.version) return pkg.version;
+    }
+  } catch {
+  }
+  return "0.0.0";
+}
+function parseCategories(raw) {
+  if (!raw) return ALL_CATEGORIES;
+  const parts = raw.split(",").map((s) => s.trim().toLowerCase());
+  const valid = [];
+  for (const part of parts) {
+    if (part in RULE_CATEGORIES) {
+      valid.push(part);
+    }
+  }
+  return valid.length > 0 ? valid : ALL_CATEGORIES;
+}
+function registerInitContextCommand(program2) {
+  program2.command("init-context").description(
+    "Generate AI agent instruction files (CLAUDE.md, .cursorrules, copilot-instructions.md)\nso Claude Code, Cursor, and GitHub Copilot avoid the 17 most common AI anti-patterns."
+  ).option("--all", "Generate files for all agents (skip prompt)").option("--force", "Overwrite existing files without asking").option("--dry-run", "Print what would be generated without writing files").option("--rules <categories>", "Comma-separated categories: async,security,error-handling,quality").action(async (opts) => {
+    const cwd = process.cwd();
+    const version = getPackageVersion2(cwd);
+    const categories = parseCategories(opts.rules);
+    const isDryRun = opts.dryRun === true;
+    const isForce = opts.force === true;
+    log.banner("AI GUARD INIT-CONTEXT");
+    if (isDryRun) {
+      log.print(`  ${import_chalk8.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
+      log.blank();
+    }
+    let selectedAgents;
+    if (opts.all) {
+      selectedAgents = [...AGENTS];
+    } else {
+      const response = await (0, import_prompts2.default)({
+        type: "multiselect",
+        name: "agents",
+        message: "Which AI agents do you use?",
+        choices: [
+          { title: "Claude Code", value: "claude", description: "\u2192 writes CLAUDE.md" },
+          { title: "Cursor", value: "cursor", description: "\u2192 writes .cursorrules" },
+          { title: "GitHub Copilot", value: "copilot", description: "\u2192 writes .github/copilot-instructions.md" },
+          { title: "All three (recommended)", value: "all", description: "\u2192 writes all files" }
+        ],
+        hint: "- space to select, enter to confirm"
+      });
+      if (!response.agents || response.agents.length === 0) {
+        log.info("No agents selected. Nothing to do.");
+        return;
+      }
+      const selected = response.agents;
+      if (selected.includes("all")) {
+        selectedAgents = [...AGENTS];
+      } else {
+        selectedAgents = AGENTS.filter((a) => selected.includes(a.id));
+      }
+    }
+    log.info(`Categories: ${import_chalk8.default.cyan(categories.join(", "))}`);
+    log.info(`Version: ${import_chalk8.default.cyan(version)}`);
+    log.blank();
+    const results = [];
+    for (const agent of selectedAgents) {
+      const fullPath = import_path9.default.join(cwd, agent.filePath);
+      const exists = import_fs6.default.existsSync(fullPath);
+      if (exists && !isForce && !isDryRun) {
+        const confirm = await (0, import_prompts2.default)({
+          type: "confirm",
+          name: "overwrite",
+          message: `${agent.filePath} already exists. Overwrite?`,
+          initial: false
+        });
+        if (!confirm.overwrite) {
+          results.push({ file: agent.filePath, status: "skipped" });
+          continue;
+        }
+      }
+      const content = agent.generate(version, categories);
+      if (isDryRun) {
+        log.section(`Preview: ${agent.filePath}`);
+        log.print(import_chalk8.default.gray("\u2500".repeat(60)));
+        for (const line of content.split("\n").slice(0, 20)) {
+          log.print(import_chalk8.default.gray(`  ${line}`));
+        }
+        log.print(import_chalk8.default.gray("  ... (truncated)"));
+        log.print(import_chalk8.default.gray("\u2500".repeat(60)));
+        log.blank();
+        results.push({ file: agent.filePath, status: "dry-run" });
+        continue;
+      }
+      const parentDir = import_path9.default.dirname(fullPath);
+      if (!import_fs6.default.existsSync(parentDir)) {
+        import_fs6.default.mkdirSync(parentDir, { recursive: true });
+      }
+      import_fs6.default.writeFileSync(fullPath, content, "utf-8");
+      results.push({ file: agent.filePath, status: "created" });
+    }
+    log.section("Summary");
+    for (const result of results) {
+      switch (result.status) {
+        case "created":
+          log.print(`  ${import_chalk8.default.green("\u2705")} Created ${import_chalk8.default.white(result.file)}`);
+          break;
+        case "skipped":
+          log.print(`  ${import_chalk8.default.yellow("\u23ED")}  Skipped ${import_chalk8.default.white(result.file)} ${import_chalk8.default.gray("(already exists \u2014 use --force to overwrite)")}`);
+          break;
+        case "dry-run":
+          log.print(`  ${import_chalk8.default.cyan("\u{1F4DD}")} Would create ${import_chalk8.default.white(result.file)}`);
+          break;
+      }
+    }
+    log.blank();
+    if (isDryRun) {
+      log.info("Dry run complete \u2014 no files were written.");
+      log.info(`Re-run without ${import_chalk8.default.cyan("--dry-run")} to apply.`);
+    } else {
+      const createdCount = results.filter((r) => r.status === "created").length;
+      if (createdCount > 0) {
+        log.success(
+          "Done. Your AI agents will now automatically avoid the 17 most common AI-generated code anti-patterns."
+        );
+      }
+    }
+    log.blank();
+  });
+}
+
 // cli/index.ts
 function getVersion() {
   try {
-    const pkgPath = import_path9.default.resolve(__dirname, "../../package.json");
-    const raw = import_fs6.default.readFileSync(pkgPath, "utf-8");
+    const pkgPath = import_path10.default.resolve(__dirname, "../../package.json");
+    const raw = import_fs7.default.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";
   } catch {
@@ -1654,7 +2164,7 @@ function getVersion() {
 }
 var program = new import_commander.Command();
 program.name("ai-guard").description(
-  "Production-grade CLI for eslint-plugin-ai-guard\nCatch AI-generated code issues instantly \u2014 no ESLint config required.\n\nQuick start:\n  npx ai-guard run          Scan current project\n  npx ai-guard init         Auto-configure ESLint\n  npx ai-guard doctor       Check your setup\n  npx ai-guard baseline     Save baseline, track new issues only"
+  "Production-grade CLI for eslint-plugin-ai-guard\nCatch AI-generated code issues instantly \u2014 no ESLint config required.\n\nQuick start:\n  npx ai-guard run          Scan current project\n  npx ai-guard init         Auto-configure ESLint\n  npx ai-guard init-context Generate AI agent rules\n  npx ai-guard doctor       Check your setup\n  npx ai-guard baseline     Save baseline, track new issues only"
 ).version(getVersion(), "-v, --version", "Print version number").helpOption("-h, --help", "Show help");
 registerRunCommand(program);
 registerInitCommand(program);
@@ -1662,6 +2172,7 @@ registerDoctorCommand(program);
 registerPresetCommand(program);
 registerIgnoreCommand(program);
 registerBaselineCommand(program);
+registerInitContextCommand(program);
 program.configureOutput({
   writeErr(str) {
     const cleaned = str.replace(/^error:\s*/i, "").trim();