Address review: path traversal guards and docstring fix

- Reject absolute paths and '..' segments in context_file in both bash and
  PowerShell scripts to prevent writes outside the project root
- Fix docstring in _update_init_options_for_integration to accurately
  describe marker preservation behavior

Author: mnriem

extensions/agent-context/scripts/bash/update-agent-context.sh

@@ -99,6 +99,12 @@ if [[ -z "$CONTEXT_FILE" ]]; then
   exit 0
 fi
 
+# Reject absolute paths and path traversal in context_file
+if [[ "$CONTEXT_FILE" == /* ]] || [[ "$CONTEXT_FILE" == *..* ]]; then
+  echo "agent-context: context_file must be a project-relative path without '..' segments; got '$CONTEXT_FILE'." >&2
+  exit 1
+fi
+
 [[ -z "$MARKER_START" ]] && MARKER_START="$DEFAULT_START"
 [[ -z "$MARKER_END"   ]] && MARKER_END="$DEFAULT_END"
 

extensions/agent-context/scripts/powershell/update-agent-context.ps1

@@ -140,6 +140,12 @@ if (-not $ContextFile) {
     exit 0
 }
 
+# Reject absolute paths and path traversal in context_file
+if ([System.IO.Path]::IsPathRooted($ContextFile) -or $ContextFile.Contains('..')) {
+    Write-Warning "agent-context: context_file must be a project-relative path without '..' segments; got '$ContextFile'."
+    exit 1
+}
+
 $MarkerStart = $DefaultStart
 $MarkerEnd   = $DefaultEnd
 $cm = Get-ConfigValue -Object $Options -Key 'context_markers'

src/specify_cli/__init__.py

@@ -1190,8 +1190,9 @@ def _update_init_options_for_integration(
     ``context_file`` and ``context_markers`` are stored in the agent-context
     extension config (``.specify/extensions/agent-context/agent-context-config.yml``),
     not in ``init-options.json``.  Existing user-customised markers are
-    preserved; the start/end values are only seeded from defaults when they
-    are absent or invalid.
+    always preserved when the config already exists; invalid marker values
+    are silently ignored at runtime by ``_resolve_context_markers()`` which
+    falls back to the class-level defaults.
     """
     from .integrations.base import SkillsIntegration
     opts = load_init_options(project_root)