intellectronica/ruler

Review signals: 15 known vulnerability.

Reviewed as expected for a test run: tests pointed at /nonexistent, a folder that does not exist, so nothing could be written.

OSV reports a known vulnerability in this dependency version. 7 distinct locations. 15 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Ruler applies centralised .ruler rules to a supported agent's config file (Claude Code): Real input produced the expected result: Applying rules for Claude Code

  Source: - **Automatic Distribution**: Ruler applies these rules to configuration files of supported AI agents

  Input: ruler apply --agents claude on a project with .ruler/ rules

  Expected: output reports applying rules for Claude Code

  Command: /tmp/rulerprefix/bin/ruler apply --project-root /tmp/ruler-demo --agents claude

  Observed: Applying rules for Claude Code... [ruler] Updated .gitignore with 2 unique path(s) in the Ruler block. Ruler apply completed successfully.

• Rules are stored centrally in a .ruler/ directory as Markdown files: Real input produced the expected result: Ruler apply completed successfully.

  Source: **Centralised Rule Management**: Store all AI instructions in a dedicated `.ruler/` directory using Markdown files

  Input: ruler apply --agents claude against .ruler/testing.md containing a marker phrase

  Expected: generated CLAUDE.md is produced from .ruler contents (apply completes successfully)

  Command: /tmp/rulerprefix/bin/ruler apply --project-root /tmp/ruler-demo --agents claude

  Observed: Ruler apply completed successfully.

Examples

• --dry-run previews apply changes without writing files: command completed successfully

  Source: README.md Options table (--dry-run: Preview changes without writing files.)

  Input: ruler apply --dry-run --agents claude on /tmp/ruler-demo

  Expected: prints a dry-run line for Claude Code

  Command: /tmp/rulerprefix/bin/ruler apply --project-root /tmp/ruler-demo --agents claude --dry-run

  Observed: [ruler:dry-run] Applying rules for Claude Code... [ruler:dry-run] Would update .gitignore with 2 unique path(s): /tmp/ruler-demo/CLAUDE.md, /tmp/ruler-demo/CLAUDE.md.bak Ruler apply completed successfully.

Local or hosted: local

Install ruler from the pinned source and run `ruler apply` to distribute .ruler rules into a Claude Code config (CLAUDE.md), plus `--dry-run`.

cd <guest-path> && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat /etc/os-release | head -2; ls /inputs 2>&1
cd <guest-path> && cat README.md | head -300
cd <guest-path> && (node -v; npm -v) 2>&1; grep -n '"node"\|engines' -A3 package.json | head; sed -n 300,600p README.md | grep -n '^#\|```' | head -80
cd <guest-path> && sudo -n true && echo SUDO_OK; (apt-cache policy nodejs | head -3); curl -sI https://nodejs.org/dist/index.json | head -1; env | grep -i proxy | sed 's/=.*@/=***@/'; git --version
set -e; export NODE_USE_ENV_PROXY=1; cd /tmp && curl -fsSL https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt -o shasums.txt && F=$(grep -o 'node-v22[0-9.]*-linux-x64.tar.xz' shasums.txt | head -1) && echo $F && curl -fsSL https://nodejs.org/dist/latest-v22.x/$F -o $F && grep " $F\$" shasums.txt | sha256sum -c - && mkdir -p /tmp/node && tar -xJf $F -C /tmp/node --strip-components=1 && /tmp/node/bin/node -v && /tmp/node/bin/npm -v
cd <guest-path> && export PATH=/tmp/node/bin:$PATH && git init -q && git remote add origin https://github.com/intellectronica/ruler && git fetch --depth 1 origin 3c0520f36234ba646c0d612bd363d010b2beab20 && git reset --mixed FETCH_HEAD && git log --oneline -1 && git status --short | head; echo ---; npm -v && npm ci 2>&1 | tail -5 && npm run build 2>&1 | tail -5; ls dist | head -3
cd <guest-path> && grep -n '"bin"' -A3 package.json; grep -n -i 'develop\|npm run\|npm test\|npm install\|contribut' README.md | head -30; grep -n '"scripts"' -A15 package.json
cd <guest-path> && export PATH=/tmp/node/bin:$PATH && npm install -g --prefix /tmp/rulerprefix . 2>&1 | tail -3 && /tmp/rulerprefix/bin/ruler --version; echo "rc=$?"; (timeout 900 npm test 2>&1 | grep -E 'Tests:|Test Suites:|FAIL' | head -20); echo "test_rc=${PIPESTATUS[0]}"
cd <guest-path> && grep -n -i 'telemetry\|consent\|analytics' README.md | head; grep -rn -i 'telemetry' src | head -3; sed -n 1,400p README.md | grep -n 'ruler init\|ruler apply' | head -20
mkdir -p /tmp/ruler-demo && cd /tmp/ruler-demo && /tmp/rulerprefix/bin/ruler init 2>&1 | tail -5; ls -la .ruler; echo ---; cat .ruler/ruler.toml | head -30
export PATH=/tmp/node/bin:$PATH; cd /tmp/ruler-demo && /tmp/rulerprefix/bin/ruler init 2>&1 | tail -5; ls -la .ruler; echo ---; cat .ruler/AGENTS.md | head -20; echo ---; cat .ruler/ruler.toml | head -40
export PATH=/tmp/node/bin:$PATH; cd /tmp/ruler-demo && echo 'Always write unit tests for new functions. MARKER-ALPHA-7731' > .ruler/testing.md && /tmp/rulerprefix/bin/ruler apply --project-root /tmp/ruler-demo --agents claude 2>&1; echo "rc=$?"; echo ---; cat CLAUDE.md; echo ---; cat .gitignore 2>/dev/null | tail -5
export PATH=/tmp/node/bin:$PATH; cd <guest-path> && grep -rn -i 'setInterval\|cron\|--watch\|webhook\|schedul' src README.md | head; echo ---DRY; cd /tmp/ruler-demo && /tmp/rulerprefix/bin/ruler apply --project-root /tmp/ruler-demo --agents claude --dry-run 2>&1; echo "rc=$?"; echo ---REVERT; /tmp/rulerprefix/bin/ruler revert --project-root /tmp/ruler-demo --agents claude 2>&1; echo "rc=$?"; ls -la /tmp/ruler-demo
export PATH=/tmp/node/bin:$PATH; cd <guest-path> && grep -n -F -- '- **Automatic Distribution**: Ruler applies these rules to configuration files of supported AI agents' README.md && grep -n -F -- '- **`.ruler/` Directory**' README.md | head -2; grep -n -F -- '**Centralised Rule Management**: Store all AI instructions in a dedicated `.ruler/` directory using Markdown files' README.md; grep -c 'Preview changes without writing files' README.md
ENVP='{"PATH":"/tmp/node/bin:/usr/local/bin:/usr/bin:/bin"}'
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/tmp/rulerprefix/bin/ruler","apply","--project-root","/tmp/ruler-demo","--agents","claude"],"cwd":"/tmp/ruler-demo","env":{"PATH":"/tmp/node/bin:/usr/local/bin:/usr/bin:/bin"},"expected_text":"Ruler apply completed successfully."}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Ruler applies centralised .ruler rules to a supported agent's config file (Claude Code)","source":"- **Automatic Distribution**: Ruler applies these rules to configuration files of supported AI agents","input":"ruler apply --agents claude on a project with .ruler/ rules","expected":"output reports applying rules for Claude Code","probe_kind":"cli","argv":["/tmp/rulerprefix/bin/ruler","apply","--project-root","/tmp/ruler-demo","--agents","claude"],"cwd":"/tmp/ruler-demo","env":{"PATH":"/tmp/node/bin:/usr/local/bin:/usr/bin:/bin"},"expected_text":"Applying rules for Claude Code"},
{"kind":"claim","claim":"Rules are stored centrally in a .ruler/ directory as Markdown files","source":"**Centralised Rule Management**: Store all AI instructions in a dedicated `.ruler/` directory using Markdown files","input":"ruler apply --agents claude against .ruler/testing.md containing a marker phrase","expected":"generated CLAUDE.md is produced from .ruler contents (apply completes successfully)","probe_kind":"cli","argv":["/tmp/rulerprefix/bin/ruler","apply","--project-root","/tmp/ruler-demo","--agents","claude"],"cwd":"/tmp/ruler-demo","env":{"PATH":"/tmp/node/bin:/usr/local/bin:/usr/bin:/bin"},"expected_text":"Ruler apply completed successfully."}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"--dry-run previews apply changes without writing files","source":"README.md Options table (--dry-run: Preview changes without writing files.)","input":"ruler apply --dry-run --agents claude on /tmp/ruler-demo","expected":"prints a dry-run line for Claude Code","argv":["/tmp/rulerprefix/bin/ruler","apply","--project-root","/tmp/ruler-demo","--agents","claude","--dry-run"],"cwd":"/tmp/ruler-demo","env":{"PATH":"/tmp/node/bin:/usr/local/bin:/usr/bin:/bin"},"expected_text":"[ruler:dry-run] Applying rules for Claude Code..."}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected package.json bin (dist/cli/index.js), README usage/commands, and src for setInterval, cron, --watch, webhook or scheduling code: none found. ruler is a one-shot CLI (init/apply/revert); it runs once per invocation and does not loop or schedule itself.","checks":[]}
EOF
python3 -I -c "import json;[json.load(open('.coldpass/'+f)) for f in ['probe.json','claims.json','examples.json','cycles.json']];print('json ok')"
export PATH=/tmp/node/bin:$PATH; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install ruler from the pinned source and run `ruler apply` to distribute .ruler rules into a Claude Code config (CLAUDE.md), plus `--dry-run`.","operation_scope":"Linux Ubuntu 24.04 guest, Node 22.23.4 (README requires ^20.19.0 || ^22.12.0 || >=23), npm 10.9.9, Python 3.12.3 (not needed by the product; used only for JSON checks). Local CLI only; no browser, no credentials, no network services started. Test project at /tmp/ruler-demo (outside the checkout).","steps":["git init; git remote add origin https://github.com/intellectronica/ruler; git fetch --depth 1 origin 3c0520f36234ba646c0d612bd363d010b2beab20; git reset --mixed FETCH_HEAD","npm ci (README Development section: npm install)","npm run build","npm install -g --prefix /tmp/rulerprefix .  (local build, bin: ruler)","npm test  -> 163 suites, 1337 tests passed (setup only)","ruler init (in /tmp/ruler-demo)","ruler apply --project-root /tmp/ruler-demo --agents claude","ruler apply --dry-run --agents claude","ruler revert --agents claude (check only; generated CLAUDE.md removed)"],"deviations":["Node/npm were not installed in the guest. Installed Node 22.23.4 from the official nodejs.org linux-x64 tarball into /tmp/node (user-local, SHA256 verified against SHASUMS256.txt). No apt/system install was used.","npm install -g used a user prefix (/tmp/rulerprefix) with the local build instead of a system-wide global install.","The first `ruler init` attempt failed with `/usr/bin/env: node: No such file or directory` because the installed bin shebang needs node on PATH; fixed by putting /tmp/node/bin on PATH (probe/claims set env PATH accordingly).","Node installer telemetry/consent prompts: none exist in this README or source (grep for telemetry/consent/analytics found nothing)."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -c "import json;print(json.load(open('.coldpass/report.json'))['outcome'])"; ls -la .coldpass; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c "import json,sys;d=json.loads(sys.stdin.read());print('valid',d['valid'],'problems',d['problems'],'replay',d['replay']['status'])"