@staix/agent-hub 0.7.9 → 0.7.11

package/CHANGELOG.md

@@ -4,6 +4,14 @@ Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the
 
 ## Unreleased
 
+## 0.7.11
+
+- A project whose path contains a backslash works with the local worker and Pi again: Bun 1.3.14's `realpathSync` throws for such paths, so the sandbox profile, the file tools' path guard and the Pi resume check now resolve paths through `realPath`, which then asks the system `realpath`; it returns each name as stored on disk, so another spelling of `.git/config` or `.env` is still refused (#26).
+
+## 0.7.10
+
+- A `local.deny` entry, or a project path, containing `"` no longer breaks the local worker's sandbox profile (its bash and git tools stopped with a parse error); the deny rules are written as plain SBPL strings, which can hold a quote (#23).
+
 ## 0.7.9
 
 - A committed `.agenthub/config.json` can no longer choose what the hub runs, which files it sends as credentials, where task text goes, or how far the local worker's sandbox reaches: those machine-local fields (launch commands, checks, the legacy MLX binary and model directory, gateway URLs and key files, the memory endpoint, sandbox widening) apply only from a file git confirms nobody committed, such as the new `.agenthub/config.local.json`, and are otherwise ignored with a log line and a doctor row. A tracked file is recognised by identity, which also closes a way past the 0.7.8 completion-check gate: a committed file under a spelling macOS opens as `config.json` but git does not match (such as `ſ` for `s`) counted as uncommitted (#17).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.7.9, control protocol 10. Durable delivery records distinguish queued
+Status: 0.7.11, control protocol 10. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up && ahub tail
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.9 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.7.11 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.7.9 and control protocol 10. Live verification
+This guide describes ahub 0.7.11 and control protocol 10. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Install and start
@@ -226,8 +226,8 @@ source and carries every recovery fix released up to it. Protocol 8 and older
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.7.9 ahub upgrade --to 0.7.9 --dry-run
-bunx --package @staix/agent-hub@0.7.9 ahub upgrade --to 0.7.9 --yes
+bunx --package @staix/agent-hub@0.7.11 ahub upgrade --to 0.7.11 --dry-run
+bunx --package @staix/agent-hub@0.7.11 ahub upgrade --to 0.7.11 --yes
 ```
 
 | Running now | Coordinator to use |
@@ -249,19 +249,19 @@ The coordinator verifies and retains the exact target package, preserves its
 own source, and promotes the global CLI only after restored projects pass
 readback.
 
-Once the installed CLI is 0.7.9, review the current project or all registered
+Once the installed CLI is 0.7.11, review the current project or all registered
 projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.7.9 --dry-run
+ahub upgrade --to 0.7.11 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.7.9 --yes
+ahub upgrade --to 0.7.11 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.9
+bun add -g github:STAIxBWLB/agent-hub#v0.7.11
 ahub setup
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.7.9",
+  "version": "0.7.11",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.7.9",
+  "version": "0.7.11",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15727,7 +15727,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.7.9",
+  version: "0.7.11",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/adapters/pi.ts

@@ -1,10 +1,11 @@
 import { randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { join, resolve, relative } from "node:path";
 import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
 import { renderDigest, replyAudience, replyParent, type Envelope, type PeerId } from "../hub/envelope.ts";
 import { BasePeer } from "../hub/peers.ts";
 import { stopOwnedProcess } from "../hub/child-process.ts";
+import { realPath } from "../hub/project.ts";
 
 export interface PiModelDescriptor { id: string; name?: string; contextWindow?: number; maxTokens?: number; reasoning?: boolean; }
 export interface PiToolSchema { name: string; description?: string; parameters: Record<string, unknown>; }
@@ -139,11 +140,11 @@ export class PiPeer extends BasePeer {
     const sessions = join(this.opts.stateDir, "pi-sessions");
     mkdirSync(sessions, { recursive: true, mode: 0o700 });
     if (this.opts.sessionFile) {
-      const file = realpathSync(this.opts.sessionFile);
-      const rel = relative(realpathSync(sessions), file);
-      if (!rel || rel.startsWith("..") || resolve(realpathSync(sessions), rel) !== file) throw new Error("Pi session file is outside the managed project session directory");
+      const file = realPath(this.opts.sessionFile);
+      const rel = relative(realPath(sessions), file);
+      if (!rel || rel.startsWith("..") || resolve(realPath(sessions), rel) !== file) throw new Error("Pi session file is outside the managed project session directory");
       const header = JSON.parse(readFileSync(file, "utf8").split("\n", 1)[0]!);
-      if (header.type !== "session" || typeof header.cwd !== "string" || realpathSync(header.cwd) !== realpathSync(this.opts.cwd) || (this.opts.sessionId && header.id !== this.opts.sessionId)) throw new Error("Pi session header does not match the requested project/session");
+      if (header.type !== "session" || typeof header.cwd !== "string" || realPath(header.cwd) !== realPath(this.opts.cwd) || (this.opts.sessionId && header.id !== this.opts.sessionId)) throw new Error("Pi session header does not match the requested project/session");
     }
     const token = randomUUID();
     this.tuiExit = new Promise((resolvePromise) => { this.resolveTuiExit = resolvePromise; });

package/src/cli/setup.ts

@@ -1,5 +1,6 @@
-import { readFileSync, realpathSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { realPath } from "../hub/project.ts";
 import { VERSION } from "../version.ts";
 
 export const PLUGIN = "agent-hub@agent-hub";
@@ -27,7 +28,7 @@ export function parseList<T>(json: string): T[] {
 
 const real = (p: string) => {
   try {
-    return realpathSync(p);
+    return realPath(p);
   } catch {
     return p;
   }

package/src/hub/project.ts

@@ -17,6 +17,26 @@ export function canonicalPath(path: string): string {
   return canonical(path);
 }
 
+/**
+ * realpathSync, except that Bun 1.3.14 throws ENOENT for an existing path containing a backslash (issue #26). Such a
+ * path goes to the system realpath, which handles it and returns every component as stored on disk: guardPath checks
+ * names, and on a case-insensitive disk `.GIT/config` or `id_rſa` would otherwise pass for another file. A missing
+ * path or a dangling symlink still throws, which guardPath relies on. Other paths take realpathSync's answer unchanged.
+ */
+export function realPath(path: string): string {
+  try {
+    return realpathSync(path);
+  } catch (error) {
+    if (!resolve(path).includes("\\")) throw error; // a relative path can sit under a backslash directory too
+    // The path as given: resolve() would fold a `..` after a symlink by text. GNU realpath accepts a dangling last
+    // component unless told -e; the BSD one on macOS refuses it by default.
+    const argv = process.platform === "darwin" ? ["/bin/realpath", "--", path] : ["realpath", "-e", "--", path];
+    const r = spawnSync(argv[0]!, argv.slice(1), { encoding: "utf8" });
+    if (r.status !== 0 || !r.stdout.endsWith("\n")) throw error;
+    return r.stdout.slice(0, -1);
+  }
+}
+
 function gitRoot(dir: string): string | undefined {
   const result = spawnSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
   if (result.status !== 0) return undefined;

package/src/local/deny.ts

@@ -17,7 +17,14 @@ export function isDenied(path: string, extra: string[] = []): boolean {
   return DENY_SEGMENTS.some((s) => hasSegment(norm, s)) || DENY_NAMES.some((re) => new RegExp(re).test(basename(norm))) || extra.some((e) => e && norm.includes(e));
 }
 
-const sbplEscape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/"/g, '\\"');
+/** Regex metacharacters only; `sbplString` quotes the finished regex. */
+const sbplEscape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * An SBPL string literal. Only the plain `"..."` form can hold a quote: in the raw `#"..."` form a backslash escapes
+ * nothing, so a `"` in a path ended the literal and broke the whole profile (issue #23).
+ */
+export const sbplString = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 
 /**
  * Seatbelt regex filters equivalent to isDenied. Seatbelt sees absolute paths, so the `local.deny` substrings are
@@ -32,5 +39,5 @@ export function denyRegexes(root: string, extra: string[] = []): string[] {
     ...DENY_SEGMENTS.map((s) => `/${sbplEscape(s)}(/|$)`),
     ...names,
     ...extra.filter(Boolean).map((e) => `^${sbplEscape(root)}/.*${sbplEscape(e)}`),
-  ].map((re) => `(regex #"${re.replace(/"/g, '\\"')}")`);
+  ].map((re) => `(regex ${sbplString(re)})`);
 }

package/src/local/sandbox.ts

@@ -1,15 +1,16 @@
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, realpathSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
-import { denyRegexes } from "./deny.ts";
+import { realPath } from "../hub/project.ts";
+import { denyRegexes, sbplString } from "./deny.ts";
 
 const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 export const OUTPUT_CAP = 20_000;
 
 export const sandboxAvailable = () => process.platform === "darwin" && existsSync(SANDBOX_EXEC);
 
-const q = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+const q = sbplString;
 
 /**
  * Seatbelt profile for everything the local worker executes (bash, git). Path checks cannot scope a shell,
@@ -30,8 +31,8 @@ function externalGitDirs(root: string): string[] {
 export function profile(cwd: string, network: boolean, readAllow: string[] = [], deny: string[] = []): string {
   const home = homedir();
   const inHome = (p: string) => (p.startsWith("~/") ? join(home, p.slice(2)) : p);
-  const root = realpathSync(cwd);
-  const tmp = realpathSync(tmpdir());
+  const root = realPath(cwd);
+  const tmp = realPath(tmpdir());
   const gitDirs = externalGitDirs(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
   return [

package/src/local/tools.ts

@@ -1,5 +1,6 @@
-import { lstatSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { lstatSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
+import { realPath } from "../hub/project.ts";
 import { hasSegment, isDenied } from "./deny.ts";
 import { OUTPUT_CAP, sandboxedExec } from "./sandbox.ts";
 
@@ -31,7 +32,7 @@ const lexists = (p: string) => {
 
 /** Absolute path inside cwd after resolving symlinks, or an Error. `write` also refuses .git and .agenthub. */
 export function guardPath(ctx: Pick<ToolContext, "cwd" | "deny">, path: string, mode: "read" | "write"): string {
-  const root = realpathSync(ctx.cwd);
+  const root = realPath(ctx.cwd);
   const abs = resolve(root, path);
   // Resolve symlinks on the deepest part that exists: a link pointing outside must not pass as an inside path.
   // lstat, not exists: a dangling symlink "does not exist" to existsSync, yet a write through it lands at its target.
@@ -39,7 +40,7 @@ export function guardPath(ctx: Pick<ToolContext, "cwd" | "deny">, path: string,
   while (!lexists(existing)) existing = dirname(existing);
   let realExisting: string;
   try {
-    realExisting = realpathSync(existing);
+    realExisting = realPath(existing);
   } catch {
     throw new Error(`${path} goes through a dangling symlink`);
   }