Address review: strict enabled check, docstring, segment-level path traversal

- Use 'is not False' for enabled check so only literal False disables
- Update upsert_context_section docstring to mention disabled-extension return
- Fix path traversal guards to check actual path segments, not substrings
  (allows filenames like 'notes..md' while rejecting '../' traversal)

Author: mnriem

extensions/agent-context/scripts/bash/update-agent-context.sh

@@ -99,11 +99,19 @@ if [[ -z "$CONTEXT_FILE" ]]; then
   exit 0
 fi
 
-# Reject absolute paths and path traversal in context_file
-if [[ "$CONTEXT_FILE" == /* ]] || [[ "$CONTEXT_FILE" == *..* ]]; then
-  echo "agent-context: context_file must be a project-relative path without '..' segments; got '$CONTEXT_FILE'." >&2
+# Reject absolute paths and '..' path segments in context_file
+if [[ "$CONTEXT_FILE" == /* ]]; then
+  echo "agent-context: context_file must be a project-relative path; got '$CONTEXT_FILE'." >&2
   exit 1
 fi
+IFS='/' read -ra _cf_parts <<< "$CONTEXT_FILE"
+for _seg in "${_cf_parts[@]}"; do
+  if [[ "$_seg" == ".." ]]; then
+    echo "agent-context: context_file must not contain '..' path segments; got '$CONTEXT_FILE'." >&2
+    exit 1
+  fi
+done
+unset _cf_parts _seg
 
 [[ -z "$MARKER_START" ]] && MARKER_START="$DEFAULT_START"
 [[ -z "$MARKER_END"   ]] && MARKER_END="$DEFAULT_END"

extensions/agent-context/scripts/powershell/update-agent-context.ps1

@@ -140,9 +140,14 @@ if (-not $ContextFile) {
     exit 0
 }
 
-# Reject absolute paths and path traversal in context_file
-if ([System.IO.Path]::IsPathRooted($ContextFile) -or $ContextFile.Contains('..')) {
-    Write-Warning "agent-context: context_file must be a project-relative path without '..' segments; got '$ContextFile'."
+# Reject absolute paths and '..' path segments in context_file
+if ([System.IO.Path]::IsPathRooted($ContextFile)) {
+    Write-Warning "agent-context: context_file must be a project-relative path; got '$ContextFile'."
+    exit 1
+}
+$cfSegments = $ContextFile -split '[/\\]'
+if ($cfSegments -contains '..') {
+    Write-Warning "agent-context: context_file must not contain '..' path segments; got '$ContextFile'."
     exit 1
 }
 

src/specify_cli/integrations/base.py

@@ -584,7 +584,7 @@ def _agent_context_extension_enabled(project_root: Path) -> bool:
         entry = extensions.get("agent-context")
         if not isinstance(entry, dict):
             return True
-        return bool(entry.get("enabled", True))
+        return entry.get("enabled", True) is not False
 
     def _resolve_context_markers(self, project_root: Path) -> tuple[str, str]:
         """Return the (start, end) context markers to use for *project_root*.
@@ -651,7 +651,8 @@ def upsert_context_section(
         when present, falling back to the class-level constants.
 
         Returns the path to the context file, or ``None`` when
-        ``context_file`` is not set.
+        ``context_file`` is not set or the ``agent-context`` extension is
+        disabled.
         """
         if not self.context_file:
             return None