@loicngr/kobo 1.11.17 → 1.11.18

package/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to Kōbō are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/). Each release is an `## <version>`
 section — the in-app "What's new" dialog reads this file.
 
+## 1.11.18
+
+- fix(workspaces): reject an option-shaped branch name at creation
+
 ## 1.11.17
 
 - feat(client): render in the design system's own type, palette and tokens (#34)

package/dist/server/routes/workspaces.js

@@ -308,6 +308,14 @@ app.post('/', migrationGuard, async (c) => {
         if (!body.worktreePath && !body.workingBranch) {
             return c.json({ error: 'Missing required field: workingBranch' }, 400);
         }
+        // Only when the caller actually supplies it: when worktreePath is given
+        // instead, workingBranch is derived from git itself further down, not
+        // user input. A name starting with `-` would otherwise read as a git
+        // option (`--upload-pack=…`) rather than a branch name — see
+        // isValidBranchName's own doc comment for why this specific shape matters.
+        if (body.workingBranch && !gitOps.isValidBranchName(body.workingBranch)) {
+            return c.json({ error: `Invalid working branch name: ${body.workingBranch}` }, 400);
+        }
         creationId = typeof body.creationId === 'string' && body.creationId.length > 0 ? body.creationId : undefined;
         currentStep = 'validate';
         emitCreateProgress(creationId, currentStep);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loicngr/kobo",
-  "version": "1.11.17",
+  "version": "1.11.18",
   "description": "Kōbō — multi-workspace agent manager for Claude Code. Orchestrates isolated git worktrees with dev servers, Notion integration, and MCP tools.",
   "type": "module",
   "license": "GPL-3.0-or-later",