@staix/agent-hub 0.34.0 → 0.34.1

package/CHANGELOG.md

@@ -4,6 +4,10 @@ Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the
 
 ## Unreleased
 
+## 0.34.1
+
+- `ahub upgrade` works with npm 12 again (#1253, PR #1254, task 766). npm 12 wraps `npm view --json` output for one package in a one-element array. The default target ("unexpected latest release") and `--to` ("unexpected release identity") both refused it. Both now share one parser that accepts the npm 11 value and a one-element array of it, and still refuses any other shape, with a message naming the `npm view` command to check. Until this release, an npm 12 machine can upgrade by putting npm 11 first on PATH for the run.
+
 ## 0.34.0
 
 - `ahub upgrade` no longer dead-ends on Orca panes that are orphaned but still connected after an Orca restart (#1246, PR #1249, task 760). The `terminal-orphaned` blocker names the peer, project and handle and the refresh key (`[r]` on the plan, `[s]` on an open operation). The interactive plan screen offers `[t] reattach N orphaned terminals`: after the person picks it, it runs `orca terminal switch` only for the panes the plan verified (same identity, still orphaned and connected, no project or machine recovery hold), bounds every Orca call and the confirmation poll by 5 s, and plans again. Nothing else is mutated; `--dry-run`, a pipe and `--yes` never switch a pane. A live Orca restart remains unverified.

package/README.md

@@ -5,7 +5,7 @@ Code, Codex, Kimi Code, Pi and a hub-owned local worker (plus Qwen Code, Jcode a
 Antigravity if you want them) share a message bus, a task board and a memory, each
 connected through its own native interface.
 
-Status: 0.34.0, control protocol 17 (accepts 16). Bun + TypeScript, one loopback daemon per
+Status: 0.34.1, control protocol 17 (accepts 16). Bun + TypeScript, one loopback daemon per
 project. Site: [agent-hub.staix.net](https://agent-hub.staix.net).
 
 ## Quick start

package/docs/quickstart.md

@@ -46,6 +46,12 @@ terminal in that project: it reviews the plan with you, applies it and follows
 it; other projects keep their version. It then names the `bun add -g` and
 `ahub setup` step when your global CLI or plugin is older than the new daemon.
 
+## Upgrading to 0.34.1
+
+`ahub upgrade` reads npm 12's `npm view --json` output again; with npm 12, 0.34.0 and earlier refused both the default target and `--to`. Update the global CLI to 0.34.1 first, either `bun add -g @staix/agent-hub@0.34.1` or, if you installed with dotfiles, `dot ai family install ahub --version 0.34.1`; then run `ahub upgrade` in each project. If you must run an older CLI's upgrade on npm 12, put npm 11 first on PATH for that run (`npm i --prefix ~/.cache/npm11 npm@11`, then `PATH="$HOME/.cache/npm11/node_modules/.bin:$PATH" ahub upgrade`). Nothing else changes.
+
+`ahub upgrade` does not update the global CLI or the shared Claude plugin: run `bun add -g @staix/agent-hub@0.34.1` and then `ahub setup` yourself, and `ahub doctor` warns while either is older than a running daemon.
+
 ## Upgrading to 0.34.0
 
 After an Orca restart, `ahub upgrade` no longer stops at panes that are orphaned but still connected: the plan screen offers `[t]` to reattach exactly the panes it verified (each Orca call bounded by 5 s), and the blocker names the refresh key. `ahub setup` now writes the stable install path of a symlinked CLI (for example a dotfiles-managed `~/.local/bin/ahub`) into the marketplace and the Claude profile hook instead of a versioned one, replaces a stale managed hook in place, and a refused marketplace replacement names every blocking row and the next step; `ahub doctor` checks the profile hook of each Claude home it can see. If you installed with dotfiles, follow [Installed with dotfiles](#installed-with-dotfiles) instead of `bun add -g`. Nothing else changes until you use it; N-1 is published 0.33.0 and control remains 16 through 17.

package/docs/verification/2026-11-07-0.34.1.md

@@ -0,0 +1,54 @@
+# 0.34.1 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.34.1 and no live TUI launch.
+
+## Candidate
+
+Version 0.34.1, prepared from main `e4057676` plus the release branch's CHANGELOG commit `114a2ba8` (2 commits since v0.34.0, 0 of them `feat`; bump rule: patch). The release commits carry the version, the CHANGELOG section, the bundle and the documentation stamps.
+
+## Reviews
+
+Pull requests named by the commits since v0.34.0: #1253, #1254.
+
+| PR / task | Review | Approved and final PR head | Merge commit | Hosted CI |
+| --- | --- | --- | --- | --- |
+| [#1254](https://github.com/STAIxBWLB/agent-hub/pull/1254), task 766 | jcode (hub review), plus conductor OCR | `49ef4c3416110799d02bfce7d5ee89c3b477b0be` | `e405767641c170982975e380647d6693b33088bf` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42339115110) |
+
+#1254 merged at its approved head, with exact-head CI green, no unresolved thread and no connector findings. The first macOS run failed one test, `a stale reply is served at once while ONE refresh runs in the background...` in shard 1/4, which this change does not touch. It is the inbox stale-refresh flake also seen on main during 0.33.0. One failed-jobs rerun on the same head passed. codex-review was not used because the running 0.33.0 hub reports its 0.167.0 CLI as untrusted, so jcode reviewed.
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.34.0: none.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.34.1`, recorded by the person or the unique configured conductor only on the person's explicit release instruction naming the release in its own session (never a hub/task/review/file/peer relay), and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+Six documents were stale: README, the daemon and tests notes, operations, quickstart and security. Their only source change is `src/cli/recovery-package.ts` (the npm view parser) and its tests.
+
+- `docs/quickstart.md` gains the 0.34.1 upgrade note: update the global CLI first, and the npm 11 PATH workaround for an older CLI.
+- `README.md` gets the generated Status line.
+- Reviewed without content change:
+  - The tests note: its `npm view` fake rule still holds.
+  - The daemon note.
+  - Operations: the upgrade text names no output shape. The guide header stays 0.34.0, as on earlier patch releases.
+  - Security.
+
+All six are restamped at reviewed content commit `fc75a18dc2fa`.
+
+## Checks
+
+At committed `519d1e5f310d` on dgx02, with pinned Bun 1.4.2 and a frozen install, the following passed:
+
+- `node scripts/check-docs.mjs --require-fresh --committed`: 0 stale documents.
+- `bun x tsc --noEmit`.
+- `bun scripts/build.mjs --check`.
+- `node scripts/check-package.mjs`: 808 files, `@staix/agent-hub@0.34.1`.
+- `bun test --timeout 20000 test/upgrade-interactive.test.ts test/upgrade.test.ts`: 132 pass, 0 fail.
+
+A first run without `--timeout` hit Bun's 5 s default on one existing upgrade test; the gate's 20 s setting passes it. The full suite on both OSes is the release PR's exact-head hosted CI. The release PR is merged with a merge commit only when that CI is green.
+
+## Known gaps, not blocking
+
+- No `ahub upgrade` was run end to end on npm 12. The fixed functions were called live against the registry with npm 12.2.2 (both returned the 0.34.0 identity), and unit tests cover both shapes.
+- No installation or running-hub upgrade is claimed here.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "d31d7503fce542f37ed9cdacb3c40fc86786cb09",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "d31d7503fce542f37ed9cdacb3c40fc86786cb09",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "d31d7503fce542f37ed9cdacb3c40fc86786cb09",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "d31d7503fce542f37ed9cdacb3c40fc86786cb09",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "package.json",
         "src/",
@@ -132,7 +132,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "d31d7503fce542f37ed9cdacb3c40fc86786cb09",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -291,7 +291,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "d31d7503fce542f37ed9cdacb3c40fc86786cb09",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "test/",
         "scripts/check.sh",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.34.0",
+  "version": "0.34.1",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.34.0",
+  "version": "0.34.1",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -10248,7 +10248,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@staix/agent-hub",
-    version: "0.34.0",
+    version: "0.34.1",
     description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
     license: "MIT",
     type: "module",

package/src/cli/recovery-package.ts

@@ -212,24 +212,32 @@ export function stageCurrentRuntime(sourceRoot: string, version: string, home =
   } finally { if (!registry) owner.close(); }
 }
 
+/** #1253: npm 12 wraps `npm view --json` output for one package in a one-element array; npm 11 printed the value itself. Anything else is not one release. */
+function npmViewJson(stdout: string): unknown {
+  let value: unknown;
+  try { value = JSON.parse(stdout); } catch { return undefined; }
+  if (!Array.isArray(value)) return value;
+  return value.length === 1 ? value[0] : undefined;
+}
+
 export async function registryRelease(version: string, run: RunCommand = runCommand): Promise<{ version: string; integrity: string }> {
   exactVersion(version);
   const result = await run(["npm", "view", `@staix/agent-hub@${version}`, "version", "dist.integrity", "--json"], { timeoutMs: 30_000 });
   if (result.code !== 0) throw new Error(`registry metadata unavailable for @staix/agent-hub@${version}`);
-  const data = JSON.parse(result.stdout);
-  if (data.version !== version || typeof data["dist.integrity"] !== "string" || !data["dist.integrity"].startsWith("sha512-")) {
-    throw new Error("registry returned an unexpected release identity");
+  const data = npmViewJson(result.stdout) as Record<string, unknown> | undefined;
+  const integrity = data?.["dist.integrity"];
+  if (data?.version !== version || typeof integrity !== "string" || !integrity.startsWith("sha512-")) {
+    throw new Error(`registry returned an unexpected release identity for @staix/agent-hub@${version} (expected one release with a sha512 integrity from \`npm view --json\`); check \`npm view @staix/agent-hub@${version} version dist.integrity --json\` and your npm version`);
   }
-  return { version, integrity: data["dist.integrity"] };
+  return { version, integrity };
 }
 
 /** #272: the registry's latest release, the target when `--to` is left out. */
 export async function latestRelease(run: RunCommand = runCommand): Promise<string> {
   const result = await run(["npm", "view", "@staix/agent-hub", "version", "--json"], { timeoutMs: 30_000 });
   if (result.code !== 0) throw new Error("registry metadata unavailable for @staix/agent-hub; name the release with --to <version>");
-  let version: unknown;
-  try { version = JSON.parse(result.stdout); } catch { /* reported below */ }
-  if (typeof version !== "string") throw new Error("registry returned an unexpected latest release; name the release with --to <version>");
+  const version = npmViewJson(result.stdout);
+  if (typeof version !== "string") throw new Error("registry returned an unexpected latest release (expected one version from `npm view --json`); check `npm view @staix/agent-hub version --json`, or name the release with --to <version>");
   return exactVersion(version);
 }