@staix/agent-hub 0.7.8 → 0.7.10

package/CHANGELOG.md

@@ -4,6 +4,14 @@ Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the
 
 ## Unreleased
 
+## 0.7.10
+
+- A `local.deny` entry, or a project path, containing `"` no longer breaks the local worker's sandbox profile (its bash and git tools stopped with a parse error); the deny rules are written as plain SBPL strings, which can hold a quote (#23).
+
+## 0.7.9
+
+- A committed `.agenthub/config.json` can no longer choose what the hub runs, which files it sends as credentials, where task text goes, or how far the local worker's sandbox reaches: those machine-local fields (launch commands, checks, the legacy MLX binary and model directory, gateway URLs and key files, the memory endpoint, sandbox widening) apply only from a file git confirms nobody committed, such as the new `.agenthub/config.local.json`, and are otherwise ignored with a log line and a doctor row. A tracked file is recognised by identity, which also closes a way past the 0.7.8 completion-check gate: a committed file under a spelling macOS opens as `config.json` but git does not match (such as `ſ` for `s`) counted as uncommitted (#17).
+
 ## 0.7.8
 
 - README, the operations guide and the upgrade-recovery spec no longer describe protocol 10 and the queue commands as unreleased (#9).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.7.8, control protocol 10. Durable delivery records distinguish queued
+Status: 0.7.10, control protocol 10. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up && ahub tail
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.8 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.7.10 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.7.8 and control protocol 10. Live verification
+This guide describes ahub 0.7.10 and control protocol 10. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Install and start
@@ -22,6 +22,19 @@ Run it after an upgrade when those blocks need refreshing. `ahub setup`
 updates the shared Claude plugin. Keep `ahub tail` open when a local worker
 may request an approval.
 
+`.agenthub/config.json` can be committed and shared. The fields that choose
+what the hub runs, which files it sends as credentials, where task text goes,
+or how far the local worker's sandbox reaches (`kimi_cmd`, `codex_bin`,
+`pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`,
+`omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`,
+`local.read_allow`, `local.bash_network`) are machine-local: they apply only
+from a file git confirms nobody committed. Put them in
+`.agenthub/config.local.json` (`ahub init` adds it to `.gitignore`), which is
+read after `config.json`; outside a git repository they keep their defaults, and
+an empty value always means the default.
+A committed value is ignored with a line in `hub.log`, a note from `ahub
+codex` and `ahub models`, and a row in `ahub doctor`.
+
 Managed launchers attach native peers to the project daemon:
 
 ```bash
@@ -64,9 +77,8 @@ marks such a task done, the tool answers at once, the hub runs the command in th
 project root (one at a time; what it left in its process group is killed when it
 exits, at the timeout or on shutdown), and then either
 sends the task to review with the command, exit code and output tail, or keeps it
-with its owner and tells it what failed. The hub runs `checks` only when git
-confirms that nobody committed `.agenthub/config.json`: a committed file must not
-choose commands the hub runs, and outside a git repository it runs none. Keys that
+with its owner and tells it what failed. `checks` is machine-local (see Install
+and start): a committed file must not choose commands the hub runs. Keys that
 are not task classes are ignored with a log line. A hub stopped mid-check leaves
 the task in progress (`check interrupted`); the owner marks it done again.
 
@@ -214,8 +226,8 @@ source and carries every recovery fix released up to it. Protocol 8 and older
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.7.8 ahub upgrade --to 0.7.8 --dry-run
-bunx --package @staix/agent-hub@0.7.8 ahub upgrade --to 0.7.8 --yes
+bunx --package @staix/agent-hub@0.7.10 ahub upgrade --to 0.7.10 --dry-run
+bunx --package @staix/agent-hub@0.7.10 ahub upgrade --to 0.7.10 --yes
 ```
 
 | Running now | Coordinator to use |
@@ -237,19 +249,19 @@ The coordinator verifies and retains the exact target package, preserves its
 own source, and promotes the global CLI only after restored projects pass
 readback.
 
-Once the installed CLI is 0.7.8, review the current project or all registered
+Once the installed CLI is 0.7.10, review the current project or all registered
 projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.7.8 --dry-run
+ahub upgrade --to 0.7.10 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.7.8 --yes
+ahub upgrade --to 0.7.10 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.8
+bun add -g github:STAIxBWLB/agent-hub#v0.7.10
 ahub setup
 ```
 

package/docs/security.md

@@ -7,7 +7,7 @@ agent-hub connects agents that can each run commands. This page says what the hu
 - **Other agents' text is untrusted.** Every message that crosses from one peer to another is framed as untrusted input (a channel tag with `meta.source` for Claude, a fixed header line plus a standing instruction for the others). A message body cannot forge the hub's own headers: such lines are quoted (`sanitize`). Replies inherit a hop count capped at 3, so agents cannot ping-pong forever; neither a digest nor a steer can reset it.
 - **The control link is loopback plus a secret.** The daemon and the Codex proxy bind 127.0.0.1 only. The control WebSocket requires a per-run token (`.agenthub/state/control-token`, mode 600), and both servers refuse any request that carries an `Origin` header: any web page can open a WebSocket to localhost, and browsers always send `Origin`. External clients cannot claim the console user's id or a hub-managed peer's id.
 - **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after `approvals.timeout_s` (default 120 s) of silence; the macOS notification for a waiting request carries the peer and the tool name only. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They touch no file and run no process, and every call passes the hub's own checks. The match relies on the agent putting the tool name in the request's `title`, as Kimi does; an ACP agent that titles calls with model-written text must not be configured as `kimi_cmd`. A payload longer than the console shows is marked as cut and never offers a session-wide grant. `--unattended` turns prompts off, says so loudly, and is never the default.
-- **Completion checks run only from a config nobody committed.** A command in `checks` runs as you, outside the local worker's sandbox, like a git hook, when a task of that class is marked done. The hub runs `checks` only when git confirms that `.agenthub/config.json` is not committed, in any letter case, and that `.agenthub` is not a committed symlink or submodule; without a repository, or when git fails, it runs none. So a cloned repository cannot choose a check. Nothing in `routing.toml` or in task text is ever run. The launch commands in the same file (`kimi_cmd`, `codex_bin`, `pi.cmd`) have no such guard: start a hub only in a checkout whose `.agenthub/config.json` you trust.
+- **A committed config cannot choose launch commands, credential files, data endpoints or a wider sandbox.** The machine-local fields (`kimi_cmd`, `codex_bin`, `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`, `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`, `local.read_allow`, `local.bash_network`) apply only from a config file git confirms nobody committed: `.agenthub/config.json` or `.agenthub/config.local.json`, matched by file identity so no other spelling the file system accepts slips past, and `.agenthub` itself not a committed symlink or submodule. Without a repository, or when git fails, they keep their defaults; an empty value always means the default. "Untracked" is answered by the repository that contains the project: a checkout copied or extracted into an unrelated repository, or into an ignored directory of one, is trusted like your own files. So a cloned repository cannot choose a launch command, a completion check, a gateway to send a key file to, a memory endpoint, or a wider sandbox. A command in `checks` runs as you, outside the local worker's sandbox, like a git hook. Nothing in `routing.toml` or in task text is ever run. `routing.toml` and the other shared fields still come from the checkout, and they matter: `routing.toml` picks the models the local worker and the hub's inference use at your gateway and can turn the PII constraint off, and roles and budget shape who does what. Review them in a repository you do not trust.
 - **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not: no writes outside the project, its git dir and temp; the home directory is unreadable except toolchains; no `.git/hooks` or `.git/config` writes; no network, loopback included. Without the sandbox there is no `bash` tool.
 - **PII has an enforced path.** A task matching `signals.pii_patterns` goes to `local` or to nobody; its text is absent from other peers' envelopes, the console stream, the log and the board listing; the console user reviews it; `local` answers such a turn to the console only, keeps it out of its history, refuses it when the only gateway is off campus, and may not save notes or spin off tasks during it. Nothing about it is sent to claude-mem, whose observer is a cloud model.
 - **Secrets stay where they are read.** The gateway key and Cloudflare Access values are read inside the gateway client and go only into request headers: never into logs, errors, envelopes, tool output, memory, or the generated Switchyard config (the key travels by environment variable name). Subscription logins of Claude, Codex and Kimi are never proxied or pooled.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -816,3 +816,26 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
   (`check finished late`); if it is in progress with the same owner again, that
   owner is asked to mark it done again. A check interrupted by a hub stop records
   `check interrupted`, is not resumed, and the owner marks the task done again.
+
+## Amendment: machine-local config fields (issue #17)
+
+- Machine-local fields: `kimi_cmd`, `codex_bin`, `pi.cmd`, `checks`, `mlx.bin`,
+  `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`, `omniroute.access_hosts`,
+  `omniroute.api_key_file`, `omniroute.cf_client_id_file`,
+  `omniroute.cf_client_secret_file`, `memory.worker_url`, `local.read_allow`,
+  `local.bash_network` (`MACHINE_LOCAL` in `src/hub/config-trust.ts`).
+- `loadConfig` reads `.agenthub/config.json`, then `.agenthub/config.local.json`
+  over it block by block. In each file, an empty machine-local value is dropped
+  (it means the default); one set to anything but its default applies only when
+  git confirms that file is untracked, matching tracked files under `.agenthub`
+  by identity (dev and inode) rather than by name, and `.agenthub` not a committed
+  symlink or submodule; otherwise it is dropped and the config's `ignored` list
+  says which and why. No repository or a git error refuses. A file that sets none
+  of them asks git nothing, so a committed copy of the template is quiet.
+  The containing repository answers "untracked": a checkout copied into an
+  unrelated repository is trusted (documented limit).
+- The Claude channel reads `roles` from both files in the same order.
+- This replaces the checks-only gate of issue #7: the daemon logs `ignored` at
+  start, `ahub codex` and `ahub models` print it, `ahub doctor` shows a row.
+  `ahub init` adds `.agenthub/config.local.json` to `.gitignore`.
+- `routing.toml` and the shared fields still come from the checkout.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.7.8",
+  "version": "0.7.10",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.7.8",
+  "version": "0.7.10",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15727,7 +15727,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.7.8",
+  version: "0.7.10",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",
@@ -15834,11 +15834,14 @@ var projectRoot2 = process.env.AGENTHUB_PROJECT_DIR ?? process.cwd();
 var peerId = process.env.AGENTHUB_PEER_ID ?? "claude";
 var toolsOnly = process.env.AGENTHUB_MODE === "tools";
 function roles() {
-  try {
-    return { ...DEFAULT_ROLES, ...JSON.parse(readFileSync3(join3(projectRoot2, ".agenthub", "config.json"), "utf8")).roles };
-  } catch {
-    return DEFAULT_ROLES;
-  }
+  const read = (name) => {
+    try {
+      return JSON.parse(readFileSync3(join3(projectRoot2, ".agenthub", name), "utf8")).roles ?? {};
+    } catch {
+      return {};
+    }
+  };
+  return { ...DEFAULT_ROLES, ...read("config.json"), ...read("config.local.json") };
 }
 var MAX_RECONNECT_DELAY_MS = 30000;
 var TERMINAL_CLOSES = {

package/src/adapters/claude-channel.ts

@@ -21,11 +21,15 @@ const peerId = process.env.AGENTHUB_PEER_ID ?? "claude";
 const toolsOnly = process.env.AGENTHUB_MODE === "tools";
 
 function roles(): Record<string, string[]> {
-  try {
-    return { ...DEFAULT_ROLES, ...JSON.parse(readFileSync(join(projectRoot, ".agenthub", "config.json"), "utf8")).roles };
-  } catch {
-    return DEFAULT_ROLES;
-  }
+  // The machine's own file overrides the shared one, as in loadConfig (issue #17).
+  const read = (name: string) => {
+    try {
+      return JSON.parse(readFileSync(join(projectRoot, ".agenthub", name), "utf8")).roles ?? {};
+    } catch {
+      return {};
+    }
+  };
+  return { ...DEFAULT_ROLES, ...read("config.json"), ...read("config.local.json") };
 }
 const MAX_RECONNECT_DELAY_MS = 30_000;
 /** Close codes a retry cannot fix: bad token, wrong project, reserved or taken id, wire version. */

package/src/cli/init.ts

@@ -59,7 +59,11 @@ export function init(cwd: string): string[] {
   }
 
   const ignore = join(cwd, ".gitignore");
-  const lines = existsSync(ignore) ? readFileSync(ignore, "utf8") : "";
-  if (!lines.split("\n").includes(".agenthub/state/")) write(ignore, `${lines}${lines && !lines.endsWith("\n") ? "\n" : ""}.agenthub/state/\n`);
+  let lines = existsSync(ignore) ? readFileSync(ignore, "utf8") : "";
+  // The machine's own config: only a file nobody committed may choose commands and credential files (issue #17).
+  for (const entry of [".agenthub/state/", ".agenthub/config.local.json"]) {
+    if (!lines.split("\n").includes(entry)) lines = `${lines}${lines && !lines.endsWith("\n") ? "\n" : ""}${entry}\n`;
+  }
+  write(ignore, lines);
   return changed;
 }

package/src/cli/main.ts

@@ -96,6 +96,12 @@ try {
   } else selected = projectContext(process.cwd());
 } catch (error) { fail((error as Error).message); }
 const cwd = selected.root;
+/** The project config, saying on stderr which machine-local fields it had to ignore (issue #17). */
+const projectConfig = () => {
+  const config = loadConfig(cwd);
+  for (const line of config.ignored ?? []) console.error(`note: ${line}; only a config file nobody committed may set it`);
+  return config;
+};
 const stateDir = selected.stateDir;
 try { process.chdir(cwd); } catch { fail(`project directory is unavailable: ${cwd}`); }
 const unattendedEnv = process.env.AGENTHUB_UNATTENDED === "1";
@@ -472,7 +478,7 @@ const commands: Record<string, () => Promise<void> | void> = {
     if (!res.ok) fail(res.error);
     const control = readControl(stateDir);
     if (control?.instanceId) await recordTerminalLaunch("codex", cwd, stateDir, control.instanceId);
-    const launch = buildLaunch("codex", args, { unattended: unattendedEnv, proxyUrl: res.proxyUrl, codexBin: loadConfig(cwd).codex_bin });
+    const launch = buildLaunch("codex", args, { unattended: unattendedEnv, proxyUrl: res.proxyUrl, codexBin: projectConfig().codex_bin });
     if (launch0.warning) console.error(launch0.warning);
     exec(launch.cmd, launch.args);
   },
@@ -517,7 +523,7 @@ const commands: Record<string, () => Promise<void> | void> = {
 
   models: async () => {
     const action = args[0] ?? "status";
-    const configured = loadConfig(cwd).mlx;
+    const configured = projectConfig().mlx;
     const runtimeDir = configured.runtimeDir ? resolve(cwd, configured.runtimeDir) : join(homedir(), ".agenthub", "runtimes", "mlx");
     const modelPath = configured.modelPath ? resolve(cwd, configured.modelPath) : join(homedir(), ".agenthub", "models", "qwen3-8b-mlx");
     const mlxOptions = configured.provider === "ollama" ? configured : { ...configured, runtimeDir, modelPath };
@@ -757,13 +763,14 @@ const commands: Record<string, () => Promise<void> | void> = {
     row(plugin.state === "current", "claude plugin", plugin.state === "missing" ? "missing: run ahub setup" : plugin.state === "current" ? `agent-hub@agent-hub ${plugin.version}` : `agent-hub@agent-hub is stale (${plugin.why}): run ahub setup`);
 
     const config = loadConfig(cwd);
+    row(!config.ignored, "config", config.ignored ? `${config.ignored.join("; ")} (move them to .agenthub/config.local.json)` : "no machine-local field ignored");
     const omni = new OmniRoute(config.omniroute);
     const gateway = await omni.base();
-    row(!!gateway, "omniroute", gateway ? `${new URL(gateway).host} healthy` : config.omniroute.urls.length || process.env.AGENTHUB_OMNIROUTE_URL ? "no candidate reachable (VPN off?); ahub local cannot run" : "not configured: set omniroute.urls in .agenthub/config.json (any OpenAI-compatible gateway); ahub local cannot run");
-    row(!!omni.apiKey(), "omniroute key", omni.apiKey() ? "present" : "missing: set OMNIROUTE_API_KEY or omniroute.api_key_file in .agenthub/config.json");
+    row(!!gateway, "omniroute", gateway ? `${new URL(gateway).host} healthy` : config.omniroute.urls.length || process.env.AGENTHUB_OMNIROUTE_URL ? "no candidate reachable (VPN off?); ahub local cannot run" : "not configured: set omniroute.urls in .agenthub/config.local.json (any OpenAI-compatible gateway); ahub local cannot run");
+    row(!!omni.apiKey(), "omniroute key", omni.apiKey() ? "present" : "missing: set OMNIROUTE_API_KEY or omniroute.api_key_file in .agenthub/config.local.json");
     const sy = spawnSync(process.env.AGENTHUB_SWITCHYARD_BIN ?? "switchyard-server", ["--version"], { encoding: "utf8" });
     row(sy.status === 0 ? true : undefined, "switchyard", sy.status === 0 ? sy.stdout.trim() : "not installed: ahub local uses fixed_model on OmniRoute (cargo install --locked switchyard-server)");
-    const mlxConfig = loadConfig(cwd).mlx;
+    const mlxConfig = config.mlx;
     const mlx = await inspectMlx({ ...mlxConfig, runtimeDir: mlxConfig.runtimeDir ? resolve(cwd, mlxConfig.runtimeDir) : undefined, modelPath: mlxConfig.modelPath ? resolve(cwd, mlxConfig.modelPath) : undefined });
     row(mlx.state === "ready" || mlx.state === "stopped", "pi mlx", `${mlx.state}${mlx.model ? ` (${mlx.model})` : ""}${mlx.lastError ? `: ${mlx.lastError}` : ""}`);
 

package/src/hub/checks.ts

@@ -1,4 +1,4 @@
-import { spawn, spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import { childEnv } from "./child-process.ts";
 
 export interface CheckResult {
@@ -16,22 +16,6 @@ const KEEP_CHARS = 64 * 1024;
 /** How long output may still arrive after the command exited; a descendant that left the group can hold the pipes. */
 const DRAIN_MS = 500;
 
-/**
- * Why the completion checks of issue #7 must not run, or undefined when git confirms nobody committed the config.
- * A command a cloned repository ships would otherwise run on the owner's machine the first time an agent marks a task
- * done. Unknown is not untracked: no repository, no git, or a git error all refuse. The directory itself counts too (a
- * committed symlink or submodule at `.agenthub`), and so does any spelling of the path, since macOS opens either.
- */
-export function checksRefusal(cwd: string): string | undefined {
-  const r = spawnSync("git", ["-C", cwd, "ls-files", "-s", "-z", "--", ":(icase).agenthub"], { encoding: "utf8", env: childEnv(process.env) });
-  if (r.status !== 0) return "git could not confirm that .agenthub/config.json is untracked";
-  const tracked = r.stdout.split("\0").some((row) => {
-    const path = row.slice(row.indexOf("\t") + 1).toLowerCase();
-    return path === ".agenthub" || path === ".agenthub/config.json";
-  });
-  return tracked ? ".agenthub/config.json is committed to git" : undefined;
-}
-
 /** Runs one check command in the project root, in its own process group so a timeout stops what it started. */
 export function runCheck(command: string, cwd: string, timeoutMs: number, running?: Set<() => void>): Promise<CheckResult> {
   return new Promise((resolve) => {

package/src/hub/config-trust.ts

@@ -0,0 +1,84 @@
+import { spawnSync } from "node:child_process";
+import { statSync } from "node:fs";
+import { join } from "node:path";
+import { childEnv } from "./child-process.ts";
+
+/**
+ * Fields of the project config that choose what the hub runs, which files it sends as credentials, where task text
+ * goes, or how far the local worker's sandbox reaches (issue #17). Only a file git confirms nobody committed may set
+ * them; a cloned repository would otherwise choose them for the owner's machine.
+ */
+export const MACHINE_LOCAL = [
+  "kimi_cmd",
+  "codex_bin",
+  "pi.cmd",
+  "checks",
+  "mlx.bin",
+  "mlx.runtimeDir",
+  "mlx.modelPath", // the legacy runtime runs code a model directory names (mlx-lm's model_file)
+  "omniroute.urls",
+  "omniroute.access_hosts",
+  "omniroute.api_key_file",
+  "omniroute.cf_client_id_file",
+  "omniroute.cf_client_secret_file",
+  "memory.worker_url",
+  "local.read_allow",
+  "local.bash_network",
+] as const;
+
+/**
+ * Why `.agenthub/<name>` must not set machine-local fields, or undefined when git confirms nobody committed it.
+ * Unknown is not untracked: no repository, no git, or a git error all refuse. The directory itself counts too (a
+ * committed symlink or submodule at `.agenthub`). A tracked file is matched by identity, not by name: macOS opens
+ * spellings git keeps apart (letter case, and folds such as "ſ" for "s").
+ */
+export function configRefusal(cwd: string, name: string): string | undefined {
+  const r = spawnSync("git", ["-C", cwd, "ls-files", "-s", "-z", "--", ":(icase).agenthub"], { encoding: "utf8", env: childEnv(process.env) });
+  if (r.status !== 0) return `git could not confirm that .agenthub/${name} is untracked`;
+  let opened: { dev: number; ino: number } | undefined;
+  try {
+    opened = statSync(join(cwd, ".agenthub", name));
+  } catch {
+    // not there: only the directory entry can still matter
+  }
+  const tracked = r.stdout.split("\0").filter(Boolean).some((row) => {
+    const path = row.slice(row.indexOf("\t") + 1);
+    if (path.toLowerCase() === ".agenthub") return true;
+    try {
+      const s = statSync(join(cwd, path));
+      return !!opened && s.dev === opened.dev && s.ino === opened.ino;
+    } catch {
+      return false;
+    }
+  });
+  return tracked ? `.agenthub/${name} is committed to git` : undefined;
+}
+
+const valueAt = (o: unknown, path: string): unknown => path.split(".").reduce<unknown>((v, k) => (v && typeof v === "object" ? (v as Record<string, unknown>)[k] : undefined), o);
+/** An empty value chooses nothing (the template writes `""` for the key files), so it is never reported. */
+const chooses = (v: unknown) => v !== undefined && v !== null && v !== "" && !(Array.isArray(v) && v.length === 0);
+
+const drop = (file: Record<string, unknown>, path: string) => {
+  const [head, key] = path.split(".") as [string, string?];
+  const block = file[head];
+  if (!key) delete file[head];
+  else if (block && typeof block === "object") delete (block as Record<string, unknown>)[key];
+};
+
+/**
+ * Drops the machine-local fields `file` sets to anything but the default unless git vouches for it, and says which
+ * went and why. An empty value always goes, trusted or not: it means the default, never "here" (an empty runtimeDir
+ * once resolved to the project root). A committed copy of the template sets them to defaults and asks git nothing.
+ */
+export function stripUntrusted(file: Record<string, unknown>, defaults: object, cwd: string, name: string): string | undefined {
+  for (const p of MACHINE_LOCAL) if (valueAt(file, p) !== undefined && !chooses(valueAt(file, p))) drop(file, p);
+  const set = MACHINE_LOCAL.filter((p) => {
+    const v = valueAt(file, p);
+    return v !== undefined && JSON.stringify(v) !== JSON.stringify(valueAt(defaults, p));
+  });
+  if (!set.length) return undefined;
+  const why = configRefusal(cwd, name);
+  if (!why) return undefined;
+  for (const p of set) drop(file, p);
+  return `${set.join(", ")} in .agenthub/${name} ignored: ${why}`;
+}

package/src/hub/daemon.ts

@@ -4,7 +4,8 @@ import { join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { childEnv } from "./child-process.ts";
-import { checksRefusal, runCheck } from "./checks.ts";
+import { runCheck } from "./checks.ts";
+import { stripUntrusted } from "./config-trust.ts";
 import type { ServerWebSocket } from "bun";
 import { AcpPeer, type PermissionRequest } from "../adapters/acp.ts";
 import { CodexPeer } from "../adapters/codex-appserver.ts";
@@ -62,6 +63,8 @@ export interface HubConfig {
   tasks: { release_after_min: number };
   /** A command per task class run when the owner marks the task done, and its timeout (issue #7). */
   checks: { timeout_s: number; [cls: string]: string | number };
+  /** Machine-local fields a config file set but git could not vouch for, and why (issue #17). */
+  ignored?: string[];
 }
 export const DEFAULT_CONFIG: HubConfig = {
   watchdog_ms: DEFAULT_WATCHDOG_MS,
@@ -90,39 +93,54 @@ export { stateDirFor };
 const RESERVED_IDS = new Set([USER, "codex", "kimi", "local", "pi", "hub", DIGEST]);
 const PEER_ID = /^[a-z][a-z0-9-]{0,31}$/;
 
+/** The shared project config, then the machine's own file, which overrides it block by block (issue #17). */
+const CONFIG_FILES = ["config.json", "config.local.json"] as const;
+const CONFIG_BLOCKS = ["memory", "roles", "budget", "inference", "omniroute", "local", "pi", "approvals", "tasks", "checks", "mlx"];
+
 export function loadConfig(cwd: string): HubConfig {
-  try {
-    const file = JSON.parse(readFileSync(join(cwd, ".agenthub", "config.json"), "utf8"));
-    if (file.mlx != null && (typeof file.mlx !== "object" || Array.isArray(file.mlx))) throw new Error("mlx configuration must be an object");
-    if (file.mlx?.provider !== undefined && !["ollama", "legacy"].includes(file.mlx.provider)) throw new Error("mlx.provider must be ollama or legacy");
-    if (file.mlx?.provider === undefined && (file.mlx?.modelPath || file.mlx?.runtimeDir || file.mlx?.bin || file.mlx?.port)) {
-      throw new Error("legacy MLX configuration requires explicit mlx.provider=legacy; migrate to provider=ollama to avoid Python serving");
+  const ignored: string[] = [];
+  const files = CONFIG_FILES.flatMap((name) => {
+    let file: Record<string, any>; // parsed JSON, checked field by field below
+    try {
+      file = JSON.parse(readFileSync(join(cwd, ".agenthub", name), "utf8"));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
+      throw error;
     }
-    const mlx = { ...(file.mlx?.provider === "legacy" ? { provider: "legacy" as const, maxInputTokens: 16_000, maxTokens: 2048 } : DEFAULT_CONFIG.mlx), ...file.mlx };
-    if (typeof mlx.runtimeDir === "string") mlx.runtimeDir = resolve(cwd, mlx.runtimeDir);
-    if (typeof mlx.modelPath === "string") mlx.modelPath = resolve(cwd, mlx.modelPath);
-    return {
-      ...DEFAULT_CONFIG,
-      ...file,
-      memory: { ...DEFAULT_CONFIG.memory, ...file.memory },
-      roles: { ...DEFAULT_CONFIG.roles, ...file.roles },
-      budget: { ...DEFAULT_CONFIG.budget, ...file.budget },
-      inference: { ...DEFAULT_CONFIG.inference, ...file.inference },
-      omniroute: { ...DEFAULT_CONFIG.omniroute, ...file.omniroute },
-      local: { ...DEFAULT_CONFIG.local, ...file.local },
-      pi: { ...DEFAULT_CONFIG.pi, ...file.pi },
-      approvals: {
-        timeout_s: file.approvals?.timeout_s ?? DEFAULT_CONFIG.approvals.timeout_s,
-        notify: typeof file.approvals?.notify === "boolean" ? file.approvals.notify : process.platform === "darwin",
-      },
-      tasks: { ...DEFAULT_CONFIG.tasks, ...file.tasks },
-      checks: { ...DEFAULT_CONFIG.checks, ...file.checks },
-      mlx,
-    };
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") return DEFAULT_CONFIG;
-    throw error;
+    const why = stripUntrusted(file, DEFAULT_CONFIG, cwd, name);
+    if (why) ignored.push(why);
+    return [file];
+  });
+  if (!files.length) return DEFAULT_CONFIG;
+  const file = files.reduce((a, b) => ({ ...a, ...b, ...Object.fromEntries(CONFIG_BLOCKS.filter((k) => a[k] !== undefined && b[k] !== undefined).map((k) => [k, { ...a[k], ...b[k] }])) }));
+  delete file.ignored; // the hub's own record, never a file's
+  if (file.mlx != null && (typeof file.mlx !== "object" || Array.isArray(file.mlx))) throw new Error("mlx configuration must be an object");
+  if (file.mlx?.provider !== undefined && !["ollama", "legacy"].includes(file.mlx.provider)) throw new Error("mlx.provider must be ollama or legacy");
+  if (file.mlx?.provider === undefined && (file.mlx?.modelPath || file.mlx?.runtimeDir || file.mlx?.bin || file.mlx?.port)) {
+    throw new Error("legacy MLX configuration requires explicit mlx.provider=legacy; migrate to provider=ollama to avoid Python serving");
   }
+  const mlx = { ...(file.mlx?.provider === "legacy" ? { provider: "legacy" as const, maxInputTokens: 16_000, maxTokens: 2048 } : DEFAULT_CONFIG.mlx), ...file.mlx };
+  if (typeof mlx.runtimeDir === "string" && mlx.runtimeDir) mlx.runtimeDir = resolve(cwd, mlx.runtimeDir);
+  if (typeof mlx.modelPath === "string" && mlx.modelPath) mlx.modelPath = resolve(cwd, mlx.modelPath);
+  return {
+    ...DEFAULT_CONFIG,
+    ...file,
+    memory: { ...DEFAULT_CONFIG.memory, ...file.memory },
+    roles: { ...DEFAULT_CONFIG.roles, ...file.roles },
+    budget: { ...DEFAULT_CONFIG.budget, ...file.budget },
+    inference: { ...DEFAULT_CONFIG.inference, ...file.inference },
+    omniroute: { ...DEFAULT_CONFIG.omniroute, ...file.omniroute },
+    local: { ...DEFAULT_CONFIG.local, ...file.local },
+    pi: { ...DEFAULT_CONFIG.pi, ...file.pi },
+    approvals: {
+      timeout_s: file.approvals?.timeout_s ?? DEFAULT_CONFIG.approvals.timeout_s,
+      notify: typeof file.approvals?.notify === "boolean" ? file.approvals.notify : process.platform === "darwin",
+    },
+    tasks: { ...DEFAULT_CONFIG.tasks, ...file.tasks },
+    checks: { ...DEFAULT_CONFIG.checks, ...file.checks },
+    mlx,
+    ...(ignored.length ? { ignored } : {}),
+  };
 }
 
 export interface DaemonOptions {
@@ -326,9 +344,9 @@ export async function startDaemon(opts: DaemonOptions) {
   const checkCommands = Object.fromEntries(Object.entries(config.checks).filter(([k, v]) => (CLASSES as readonly string[]).includes(k) && typeof v === "string" && v.trim())) as Record<string, string>;
   const strayChecks = Object.keys(config.checks).filter((k) => k !== "timeout_s" && !(k in checkCommands));
   if (strayChecks.length) log(`checks ignored for ${strayChecks.join(", ")}: not a task class with a command (classes: ${CLASSES.join(", ")})`);
-  const checksRefused = Object.keys(checkCommands).length ? checksRefusal(opts.cwd) : undefined;
-  if (checksRefused) log(`checks ignored: ${checksRefused}, and only a file nobody committed may choose commands the hub runs`);
-  const checksAllowed = Object.keys(checkCommands).length > 0 && !checksRefused;
+  // Commands and the other machine-local fields came only from a file git vouched for (loadConfig, issue #17).
+  for (const line of config.ignored ?? []) log(`${line}; only a config file nobody committed may set it`);
+  const checksAllowed = Object.keys(checkCommands).length > 0;
   const checkTimeoutS = typeof config.checks.timeout_s === "number" && config.checks.timeout_s >= 1 ? Math.min(config.checks.timeout_s, 3600) : 600;
   const runningChecks = new Set<() => void>();
   let checksClosed = false; // set on stop: a check still queued then must not start and outlive the hub

package/src/local/deny.ts

@@ -17,7 +17,14 @@ export function isDenied(path: string, extra: string[] = []): boolean {
   return DENY_SEGMENTS.some((s) => hasSegment(norm, s)) || DENY_NAMES.some((re) => new RegExp(re).test(basename(norm))) || extra.some((e) => e && norm.includes(e));
 }
 
-const sbplEscape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/"/g, '\\"');
+/** Regex metacharacters only; `sbplString` quotes the finished regex. */
+const sbplEscape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * An SBPL string literal. Only the plain `"..."` form can hold a quote: in the raw `#"..."` form a backslash escapes
+ * nothing, so a `"` in a path ended the literal and broke the whole profile (issue #23).
+ */
+export const sbplString = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 
 /**
  * Seatbelt regex filters equivalent to isDenied. Seatbelt sees absolute paths, so the `local.deny` substrings are
@@ -32,5 +39,5 @@ export function denyRegexes(root: string, extra: string[] = []): string[] {
     ...DENY_SEGMENTS.map((s) => `/${sbplEscape(s)}(/|$)`),
     ...names,
     ...extra.filter(Boolean).map((e) => `^${sbplEscape(root)}/.*${sbplEscape(e)}`),
-  ].map((re) => `(regex #"${re.replace(/"/g, '\\"')}")`);
+  ].map((re) => `(regex ${sbplString(re)})`);
 }

package/src/local/sandbox.ts

@@ -2,14 +2,14 @@ import { spawn, spawnSync } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
-import { denyRegexes } from "./deny.ts";
+import { denyRegexes, sbplString } from "./deny.ts";
 
 const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 export const OUTPUT_CAP = 20_000;
 
 export const sandboxAvailable = () => process.platform === "darwin" && existsSync(SANDBOX_EXEC);
 
-const q = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+const q = sbplString;
 
 /**
  * Seatbelt profile for everything the local worker executes (bash, git). Path checks cannot scope a shell,