AIContext 0.7.0

AIContext 0.7.0

AIContext 0.7.0 makes export and init safe against links and ordinary I/O failures, gives the rule files in .aicontext/rules/ one exact grammar and one meaning of paths, refuses context sources that lead outside the project, and moves the release to a single verified workflow. It is not a drop-in update for every project: some input that was accepted before is an error now, and a few scopes mean something else. Read the upgrade notes first. The format of context.json does not change: specVersion stays 0.1.0, and no context.json that was valid before is rejected.

Highlights

• Export and init can no longer be carried outside the project by a link. The path guard follows links one component at a time, so a link target such as alias/../x cannot make export write, overwrite or delete a file outside the project or inside a separate project. Two spellings that differ only by letter case count as one directory only when the directory listing shows one entry. init checks every destination before it writes the first file, creates new files exclusively, and --force never crosses the project boundary.
• Sources outside the project are refused (AIC1008). A README.md, a section file, a rules/ directory or .aicontext/ itself that is a link leading outside the project used to be copied into AGENTS.md and the other generated files. It is now an error and the file is not read. Messages no longer repeat text that looks like a secret.
• Ordinary I/O problems are diagnostics, and the output tells the truth. A directory where a generated file has to go (AIC4105) and a file that has to change but is locked or read-only (AIC4106) stop the run before the first write, also in --dry-run and --check (exit code 1), and status shows the target as blocked. A write that fails midway stops, and the output lists exactly what was written (Created/Updated/Removed) and what was not (Not written). An existing regular file is replaced through a temporary file, so a failed write does not leave it half-written. A file that is a symbolic link is the exception: it is overwritten in place and has no such protection. An export is not a transaction and nothing is rolled back.
• Rule files have one exact grammar and one meaning. SPEC 4.4.1 defines the frontmatter subset: a header that cannot be read as written (an empty paths or description, a repeated key, a quote that is not closed) is an error instead of a silently broader, always-on rule. SPEC 4.4.2 defines paths: relative to the project root, *.ts is the root only, **/*.ts any depth, one level of {a,b}. A scope that a tool cannot be told (AIC4107) fails the export without writing anything instead of widening the rule.
• A scoped Copilot rule is loaded only for its scope. The scoped .instructions.md file has applyTo alone; the description is a Description: line in the body, so it can no longer load the rule elsewhere in the Local harness.
• A lone CR is a line break like LF and CRLF. A rule file with CR endings used to lose its header and become an always-on rule. LF and CRLF sources hash and export exactly as before.
• One verified release. publish.yml, started from the release tag, checks the tag and versions, runs the checks of a pull request, packs the NuGet packages once, smoke-tests those exact files and the standalone binaries, and only then attaches the binaries to the release and pushes the packages. Nothing is replaced. See RELEASING.md.
• Security model and SECURITY.md. The user manual states what the tool protects against and what it does not (not a sandbox, symbolic links and junctions only, an export is not a transaction, the secret lint is a heuristic), and SECURITY.md says how to report a vulnerability.

New

• Diagnostic codes AIC1007, AIC1008, AIC2006, AIC2007, AIC2008, AIC4105, AIC4106 and AIC4107; all are listed in the user manual.
• Library: ExportResult.Written, InitResult.Diagnostics / HasErrors, StaleExportPlanException.Reason, ExportOutput.Problem, TargetStatus.Problems, PortableGlob, ScopeTranslator, SecretScanner.Redact.
• Conformance suite: language-neutral fixtures for rule files and for paths patterns (exact sets of matched files, and the patterns that are invalid).
• The library README shows how to tell plan errors, Apply errors and the files that were really written apart.

Changed

• SPEC 4.4.1 and 4.4.2 (rule files), 6.2 (line endings), 6.4 (a refused scope, and no description field where a tool documents it as a second trigger) and 10 (sources outside the project) are new or clarified. specVersion stays 0.1.0; rule files carry no version, so the change is recorded in SPEC 9.1 and in the changelog.
• ExportResult.Unchanged counts only files that were already up to date. ExportService.Plan can return errors for blocked destinations, and ProjectInitializer.Initialize can return diagnostics instead of writing.

Upgrade notes

dotnet tool update --global AIContext.CLI
aicontext --version
aicontext validate
aicontext export --target all

• A source behind a link that leaves the project is refused with AIC1008. Keep the sources inside the project (a link into the project is fine).
• Rule headers. An empty paths or description, a repeated key, a quote that is not closed and paths: "a", "b" are errors now (AIC2003, AIC2004, AIC2007). A # after whitespace starts a comment, in description too: description: Fix #12 is Fix, so write "Fix #12".
• paths patterns. A pattern without / means the project root only for every tool; for Claude *.md used to mean any depth, so write **/*.md. **, src/, ./src/** and app/[id]/** are errors (AIC2008); write **/*, src/**, src/** and app/*/**. A comma in a pattern (Copilot, Cursor, Windsurf, Devin), and several patterns or a pattern without / for Windsurf and Devin, fail the export for that tool with AIC4107: rewrite the pattern, split the rule, or export without that target.
• Copilot. The first aicontext export rewrites .github/instructions/aicontext-*.instructions.md (the description moves into the body). Commit the result.
• Links. A link target with .. after another link can be refused (AIC4102, AIC4104) when the two ways to read it differ and one of them leaves the project. Use a target without .. after a link.
• Library users: recompile. Check plan.HasErrors, result.HasErrors and InitResult.HasErrors, and use result.Written for what was really written.

Known limitations

• A file that is a symbolic link is overwritten in place, so an interrupted write to it can leave the file it points to incomplete. An export is not a transaction.
• The removal of a generated file that is no longer produced and is read-only is not found by the plan; on Windows it fails when it is made (AIC4106).
• The checks assume that the file system does not change while the tool runs; a short gap between the last check and the write remains. A hard link cannot be told from a regular file, so a hard-linked source is read like any file.
• The translations of paths for each tool follow the vendors' documentation as of November 2026; the tools were not run.