groove-dev 0.17.1 → 0.17.2

package/node_modules/@groove-dev/daemon/src/integrations.js

@@ -235,6 +235,8 @@ export class IntegrationStore {
   /**
    * Build MCP config object for a set of integration IDs.
    * Returns the mcpServers object to merge into .mcp.json.
+   * SECURITY: credentials are NOT included in the config file.
+   * They are injected at spawn time via process environment only.
    */
   buildMcpConfig(integrationIds) {
     const mcpServers = {};
@@ -244,23 +246,33 @@ export class IntegrationStore {
       if (!entry) continue;
       if (!this._isInstalled(id)) continue;
 
-      // Build environment with credentials
-      const env = {};
-      for (const ek of (entry.envKeys || [])) {
-        const val = this.getCredential(id, ek.key);
-        if (val) env[ek.key] = val;
-      }
-
+      // No env block — credentials stay out of .mcp.json
       mcpServers[`groove-${id}`] = {
         command: entry.command || 'npx',
         args: entry.args || ['-y', entry.npmPackage],
-        env,
       };
     }
 
     return mcpServers;
   }
 
+  /**
+   * Get environment variables with decrypted credentials for a set of integration IDs.
+   * These are passed to the agent process at spawn time (in-memory only, never written to disk).
+   */
+  getSpawnEnv(integrationIds) {
+    const env = {};
+    for (const id of integrationIds) {
+      const entry = this.registry.find((s) => s.id === id);
+      if (!entry) continue;
+      for (const ek of (entry.envKeys || [])) {
+        const val = this.getCredential(id, ek.key);
+        if (val) env[ek.key] = val;
+      }
+    }
+    return env;
+  }
+
   /**
    * Write/merge MCP config into the project root .mcp.json.
    * Only adds/updates groove-* entries, preserves user's own MCP configs.

package/node_modules/@groove-dev/daemon/src/process.js

@@ -201,9 +201,12 @@ For normal file edits within your scope, proceed without review.
       }
     }
 
-    // Write MCP config for agent integrations
+    // Write MCP config for agent integrations (command/args only, no secrets)
+    // Credentials are injected via process environment below
+    let integrationEnv = {};
     if (config.integrations?.length > 0 && this.daemon.integrations) {
       this.daemon.integrations.writeMcpJson(config.integrations);
+      integrationEnv = this.daemon.integrations.getSpawnEnv(config.integrations);
     }
 
     const { command, args, env } = provider.buildSpawnCommand(spawnConfig);
@@ -232,7 +235,7 @@ For normal file edits within your scope, proceed without review.
     // Spawn the process
     const proc = cpSpawn(command, args, {
       cwd: agent.workingDir || this.daemon.projectDir,
-      env: { ...process.env, ...env, GROOVE_AGENT_ID: agent.id, GROOVE_AGENT_NAME: agent.name },
+      env: { ...process.env, ...env, ...integrationEnv, GROOVE_AGENT_ID: agent.id, GROOVE_AGENT_NAME: agent.name },
       stdio: ['ignore', 'pipe', 'pipe'],
       // Don't let agent process prevent daemon from exiting
       detached: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "groove-dev",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "Open-source agent orchestration layer — the AI company OS. MCP integrations (Slack, Gmail, Stripe, 15+), agent scheduling (cron), business roles (CMO, CFO, EA). GUI dashboard, multi-agent coordination, zero cold-start, infinite sessions. Works with Claude Code, Codex, Gemini CLI, Ollama.",
   "license": "FSL-1.1-Apache-2.0",
   "author": "Groove Dev <hello@groovedev.ai> (https://groovedev.ai)",

package/packages/daemon/src/integrations.js

@@ -235,6 +235,8 @@ export class IntegrationStore {
   /**
    * Build MCP config object for a set of integration IDs.
    * Returns the mcpServers object to merge into .mcp.json.
+   * SECURITY: credentials are NOT included in the config file.
+   * They are injected at spawn time via process environment only.
    */
   buildMcpConfig(integrationIds) {
     const mcpServers = {};
@@ -244,23 +246,33 @@ export class IntegrationStore {
       if (!entry) continue;
       if (!this._isInstalled(id)) continue;
 
-      // Build environment with credentials
-      const env = {};
-      for (const ek of (entry.envKeys || [])) {
-        const val = this.getCredential(id, ek.key);
-        if (val) env[ek.key] = val;
-      }
-
+      // No env block — credentials stay out of .mcp.json
       mcpServers[`groove-${id}`] = {
         command: entry.command || 'npx',
         args: entry.args || ['-y', entry.npmPackage],
-        env,
       };
     }
 
     return mcpServers;
   }
 
+  /**
+   * Get environment variables with decrypted credentials for a set of integration IDs.
+   * These are passed to the agent process at spawn time (in-memory only, never written to disk).
+   */
+  getSpawnEnv(integrationIds) {
+    const env = {};
+    for (const id of integrationIds) {
+      const entry = this.registry.find((s) => s.id === id);
+      if (!entry) continue;
+      for (const ek of (entry.envKeys || [])) {
+        const val = this.getCredential(id, ek.key);
+        if (val) env[ek.key] = val;
+      }
+    }
+    return env;
+  }
+
   /**
    * Write/merge MCP config into the project root .mcp.json.
    * Only adds/updates groove-* entries, preserves user's own MCP configs.

package/packages/daemon/src/process.js

@@ -201,9 +201,12 @@ For normal file edits within your scope, proceed without review.
       }
     }
 
-    // Write MCP config for agent integrations
+    // Write MCP config for agent integrations (command/args only, no secrets)
+    // Credentials are injected via process environment below
+    let integrationEnv = {};
     if (config.integrations?.length > 0 && this.daemon.integrations) {
       this.daemon.integrations.writeMcpJson(config.integrations);
+      integrationEnv = this.daemon.integrations.getSpawnEnv(config.integrations);
     }
 
     const { command, args, env } = provider.buildSpawnCommand(spawnConfig);
@@ -232,7 +235,7 @@ For normal file edits within your scope, proceed without review.
     // Spawn the process
     const proc = cpSpawn(command, args, {
       cwd: agent.workingDir || this.daemon.projectDir,
-      env: { ...process.env, ...env, GROOVE_AGENT_ID: agent.id, GROOVE_AGENT_NAME: agent.name },
+      env: { ...process.env, ...env, ...integrationEnv, GROOVE_AGENT_ID: agent.id, GROOVE_AGENT_NAME: agent.name },
       stdio: ['ignore', 'pipe', 'pipe'],
       // Don't let agent process prevent daemon from exiting
       detached: false,