@staix/agent-hub 0.7.9 → 0.7.10

package/CHANGELOG.md

@@ -4,6 +4,10 @@ Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the
 
 ## Unreleased
 
+## 0.7.10
+
+- A `local.deny` entry, or a project path, containing `"` no longer breaks the local worker's sandbox profile (its bash and git tools stopped with a parse error); the deny rules are written as plain SBPL strings, which can hold a quote (#23).
+
 ## 0.7.9
 
 - A committed `.agenthub/config.json` can no longer choose what the hub runs, which files it sends as credentials, where task text goes, or how far the local worker's sandbox reaches: those machine-local fields (launch commands, checks, the legacy MLX binary and model directory, gateway URLs and key files, the memory endpoint, sandbox widening) apply only from a file git confirms nobody committed, such as the new `.agenthub/config.local.json`, and are otherwise ignored with a log line and a doctor row. A tracked file is recognised by identity, which also closes a way past the 0.7.8 completion-check gate: a committed file under a spelling macOS opens as `config.json` but git does not match (such as `ſ` for `s`) counted as uncommitted (#17).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.7.9, control protocol 10. Durable delivery records distinguish queued
+Status: 0.7.10, control protocol 10. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up && ahub tail
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.9 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.7.10 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.7.9 and control protocol 10. Live verification
+This guide describes ahub 0.7.10 and control protocol 10. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Install and start
@@ -226,8 +226,8 @@ source and carries every recovery fix released up to it. Protocol 8 and older
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.7.9 ahub upgrade --to 0.7.9 --dry-run
-bunx --package @staix/agent-hub@0.7.9 ahub upgrade --to 0.7.9 --yes
+bunx --package @staix/agent-hub@0.7.10 ahub upgrade --to 0.7.10 --dry-run
+bunx --package @staix/agent-hub@0.7.10 ahub upgrade --to 0.7.10 --yes
 ```
 
 | Running now | Coordinator to use |
@@ -249,19 +249,19 @@ The coordinator verifies and retains the exact target package, preserves its
 own source, and promotes the global CLI only after restored projects pass
 readback.
 
-Once the installed CLI is 0.7.9, review the current project or all registered
+Once the installed CLI is 0.7.10, review the current project or all registered
 projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.7.9 --dry-run
+ahub upgrade --to 0.7.10 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.7.9 --yes
+ahub upgrade --to 0.7.10 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.9
+bun add -g github:STAIxBWLB/agent-hub#v0.7.10
 ahub setup
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.7.9",
+  "version": "0.7.10",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.7.9",
+  "version": "0.7.10",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15727,7 +15727,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.7.9",
+  version: "0.7.10",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/local/deny.ts

@@ -17,7 +17,14 @@ export function isDenied(path: string, extra: string[] = []): boolean {
   return DENY_SEGMENTS.some((s) => hasSegment(norm, s)) || DENY_NAMES.some((re) => new RegExp(re).test(basename(norm))) || extra.some((e) => e && norm.includes(e));
 }
 
-const sbplEscape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/"/g, '\\"');
+/** Regex metacharacters only; `sbplString` quotes the finished regex. */
+const sbplEscape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * An SBPL string literal. Only the plain `"..."` form can hold a quote: in the raw `#"..."` form a backslash escapes
+ * nothing, so a `"` in a path ended the literal and broke the whole profile (issue #23).
+ */
+export const sbplString = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 
 /**
  * Seatbelt regex filters equivalent to isDenied. Seatbelt sees absolute paths, so the `local.deny` substrings are
@@ -32,5 +39,5 @@ export function denyRegexes(root: string, extra: string[] = []): string[] {
     ...DENY_SEGMENTS.map((s) => `/${sbplEscape(s)}(/|$)`),
     ...names,
     ...extra.filter(Boolean).map((e) => `^${sbplEscape(root)}/.*${sbplEscape(e)}`),
-  ].map((re) => `(regex #"${re.replace(/"/g, '\\"')}")`);
+  ].map((re) => `(regex ${sbplString(re)})`);
 }

package/src/local/sandbox.ts

@@ -2,14 +2,14 @@ import { spawn, spawnSync } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
-import { denyRegexes } from "./deny.ts";
+import { denyRegexes, sbplString } from "./deny.ts";
 
 const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 export const OUTPUT_CAP = 20_000;
 
 export const sandboxAvailable = () => process.platform === "darwin" && existsSync(SANDBOX_EXEC);
 
-const q = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+const q = sbplString;
 
 /**
  * Seatbelt profile for everything the local worker executes (bash, git). Path checks cannot scope a shell,