hyperresearch

Vault.run_dir() and init_run join the vault_tag onto research/runs/ without validation, so tags like ../../x or absolute paths escape the vault. Fix it the same way as the --tag traversal in #114: resolve the joined path and require it to sit under research/runs/, rejecting the tag with a clear error otherwise. A simpler alternative is to restrict the tag to the slug pattern [A-Za-z0-9_.-]+ at the CLI boundary, blocking / and .. segments entirely. Note the fix touches every run subcommand since they all resolve the tag the same way.

Root cause (hyperresearch v0.10.0): in cli/lint.py (_check_quote_integrity), the span regex _QUOTE_SPAN_RE = re.compile(r'["“]([^"“”]{20,600})["”]') enforces a 20-character minimum. Any genuinely quoted phrase shorter than 20 chars (e.g. "TVL", "reasonable use") fails to match at all; its closing quote is then misread as a new *opening* quote and paired with the next quote character hundreds of characters later, producing one giant false 'hallucinated' span containing ordinary prose. Fix (patch the tool): replace the regex with a non-greedy match with no hard floor — r'["“]([^"“”]{1,600}?)["”]' — and let the existing if len(quote.split()) < 5: continue check skip verification of short spans instead of relying on regex length for filtering. Workaround (report-side, no code change): locate every quoted span under 20 characters (script that sequentially pairs " marks and flags spans <20 chars), then either italicize genuine short terms-of-art (*Low Security* instead of "Low Security") or merge adjacent short quotes from contiguous source text into one longer verbatim quote (e.g. combine five short label fragments into a single 90+ char quoted span) until run finish passes.

In hyperresearch 0.11.1, 14 of the 19 installed step skills under .claude/skills/ invoke the CLI as $HPR, but the HPR variable is never defined — not in the environment, not in .claude/settings.json, and not anywhere in the package. With HPR unset, $HPR expands to an empty string, so a command like $HPR run finish <vault_tag> --json becomes run finish ... and the shell reports run: command not found (a shell error, not a CLI error). Workarounds: 1) Export the variable yourself pointing at the installed binary: export HPR="$(command -v hyperresearch)" (add it to your shell profile or the agent's environment). 2) Or replace $HPR in the installed skills with the resolved absolute CLI path — the same path the installer already bakes into CLAUDE.md (shown as **CLI path: /path/to/hyperresearch**) and into all agent prompts. For example: grep -rl '\$HPR' .claude/skills/ | xargs sed -i "s|\$HPR|/path/to/hyperresearch|g". Verify with bash -c 'unset HPR; $HPR run status -j' before the fix (fails) and /path/to/hyperresearch run status -j after (works).