Address review: bash backslash traversal guard, wheel packaging

- Reject backslash separators and Windows drive-letter paths in bash
  context_file validation (prevents traversal on Git-Bash/Windows)
- Add extensions/agent-context to pyproject.toml force-include so the
  bundled extension is included in wheel builds

Author: mnriem

extensions/agent-context/scripts/bash/update-agent-context.sh

@@ -99,11 +99,15 @@ if [[ -z "$CONTEXT_FILE" ]]; then
   exit 0
 fi
 
-# Reject absolute paths and '..' path segments in context_file
-if [[ "$CONTEXT_FILE" == /* ]]; then
+# Reject absolute paths, backslash separators, and '..' path segments in context_file
+if [[ "$CONTEXT_FILE" == /* ]] || [[ "$CONTEXT_FILE" =~ ^[A-Za-z]: ]]; then
   echo "agent-context: context_file must be a project-relative path; got '$CONTEXT_FILE'." >&2
   exit 1
 fi
+if [[ "$CONTEXT_FILE" == *\\* ]]; then
+  echo "agent-context: context_file must not contain backslash separators; got '$CONTEXT_FILE'." >&2
+  exit 1
+fi
 IFS='/' read -ra _cf_parts <<< "$CONTEXT_FILE"
 for _seg in "${_cf_parts[@]}"; do
   if [[ "$_seg" == ".." ]]; then

pyproject.toml

@@ -40,6 +40,7 @@ packages = ["src/specify_cli"]
 "scripts/powershell" = "specify_cli/core_pack/scripts/powershell"
 # Bundled extensions (installable via `specify extension add <name>`)
 "extensions/git" = "specify_cli/core_pack/extensions/git"
+"extensions/agent-context" = "specify_cli/core_pack/extensions/agent-context"
 # Bundled workflows (auto-installed during `specify init`)
 "workflows/speckit" = "specify_cli/core_pack/workflows/speckit"
 # Bundled presets (installable via `specify preset add <name>` or `specify init --preset <name>`)