fix(cli): shell-quote hub invite arguments

[luvs01]

Motivation

ocx hub invite prints a copy-and-run shell command that interpolates operator-supplied values. The --data-url flag reaches hubInviteCommand raw — it is the one value not passed through canonicalHttpOrigin — so a URL-legal but shell-unsafe origin (userinfo with metacharacters, or simply a value with spaces) breaks or alters the pasted command. Quoting every dynamic value also hardens the printed line against any future source becoming less trusted.

Description

• Add a single-quote shell-quoting helper in src/cli/hub.ts and apply it to every dynamic value in hubInviteCommand: the pairing code, the data URL, the management URL, and the --clients payload.
• The emitted command is unchanged for ordinary origins; only values containing shell-significant characters render differently (safely).

Tests

• bun test tests/cli/hub-invite.test.ts — 23 pass, covering the new quoting case and the updated printed-command expectations.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes
  • Improved the hub invite CLI’s generated connection commands by safely quoting pairing codes, URLs, and client lists.
  • Prevented special characters, shell expansion syntax, and environment-variable syntax from being interpreted unexpectedly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 69bda777-3359-4321-8c5e-9baca646893e

📥 Commits

Reviewing files that changed from the base of the PR and between 3d5efc7 and b73d208.

📒 Files selected for processing (2)

• src/cli/hub.ts
• tests/cli/hub-invite.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The hub invite command now shell-quotes pairing codes, URLs, and client lists. CLI tests verify quoting for normal values and values containing quotes or shell-significant syntax.

Changes

Hub invite shell quoting

Layer / File(s)	Summary
Shell quote generation and validation src/cli/hub.ts, tests/cli/hub-invite.test.ts	hubInviteCommand wraps dynamic command values in single quotes and escapes embedded single quotes. Tests update generated command expectations and cover URLs, pairing codes, client lists, and shell-significant characters.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: lidge-j

Merge Risk: ⚪ Minimal · up to b73d2

The invite command safely quotes its dynamic values, and no concrete merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: shell-quoting arguments in the hub invite CLI command.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request is already Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers: @lidge-jun @Ingwannu