groove-dev 0.24.16 → 0.25.0

package/node_modules/@groove-dev/daemon/src/api.js

@@ -1563,8 +1563,15 @@ Keep responses concise. Help them think, don't lecture them about the system the
       return res.json({ exists: false, agents: [] });
     }
     try {
-      const agents = JSON.parse(readFileSync(teamPath, 'utf8'));
-      res.json({ exists: true, agents: Array.isArray(agents) ? agents : [] });
+      const raw = JSON.parse(readFileSync(teamPath, 'utf8'));
+      // Support both old format (bare array) and new format ({ projectDir, agents })
+      if (Array.isArray(raw)) {
+        res.json({ exists: true, agents: raw });
+      } else if (raw && Array.isArray(raw.agents)) {
+        res.json({ exists: true, agents: raw.agents, projectDir: raw.projectDir || null });
+      } else {
+        res.json({ exists: false, agents: [] });
+      }
     } catch {
       res.json({ exists: false, agents: [] });
     }
@@ -1576,28 +1583,51 @@ Keep responses concise. Help them think, don't lecture them about the system the
       return res.status(404).json({ error: 'No recommended team found. Run a planner first.' });
     }
     try {
-      const agents = JSON.parse(readFileSync(teamPath, 'utf8'));
-      if (!Array.isArray(agents) || agents.length === 0) {
+      const raw = JSON.parse(readFileSync(teamPath, 'utf8'));
+
+      // Support both old format (bare array) and new format ({ projectDir, agents })
+      let agentConfigs;
+      let projectDir = null;
+      if (Array.isArray(raw)) {
+        agentConfigs = raw;
+      } else if (raw && Array.isArray(raw.agents)) {
+        agentConfigs = raw.agents;
+        projectDir = raw.projectDir || null;
+      } else {
+        return res.status(400).json({ error: 'Invalid recommended team format' });
+      }
+
+      if (agentConfigs.length === 0) {
         return res.status(400).json({ error: 'Recommended team is empty' });
       }
 
-      const defaultDir = daemon.config?.defaultWorkingDir || undefined;
+      const baseDir = daemon.config?.defaultWorkingDir || daemon.projectDir;
       const defaultTeamId = daemon.teams.getDefault()?.id || null;
 
+      // If planner specified a project directory, create it and use it as workingDir
+      let projectWorkingDir = baseDir;
+      if (projectDir) {
+        // Sanitize: kebab-case, no path traversal
+        const safeName = String(projectDir).replace(/[^a-zA-Z0-9_-]/g, '-').slice(0, 64);
+        projectWorkingDir = resolve(baseDir, safeName);
+        mkdirSync(projectWorkingDir, { recursive: true });
+        console.log(`[Groove] Project directory: ${projectWorkingDir}`);
+      }
+
       // Separate phase 1 (builders) and phase 2 (QC/finisher)
-      const phase1 = agents.filter((a) => !a.phase || a.phase === 1);
-      let phase2 = agents.filter((a) => a.phase === 2);
+      const phase1 = agentConfigs.filter((a) => !a.phase || a.phase === 1);
+      let phase2 = agentConfigs.filter((a) => a.phase === 2);
 
       // Safety net: if planner forgot the QC agent, auto-add one
       if (phase2.length === 0 && phase1.length >= 2) {
         phase2 = [{
           name: 'qc-agent',
           role: 'fullstack', phase: 2, scope: [],
-          prompt: 'QC Senior Dev: All builder agents have completed. Audit their changes for correctness, fix any issues, run tests, build the project, commit all changes, and launch the dev server. Output the localhost URL where the app can be accessed.',
+          prompt: 'QC Senior Dev: All builder agents have completed. Audit their changes for correctness, fix any issues, run tests, build the project, commit all changes, and launch the dev server. Output the localhost URL where the app can be accessed. IMPORTANT: Do NOT delete files from other projects or directories outside this project.',
         }];
       }
 
-      // Spawn phase 1 agents immediately
+      // Spawn phase 1 agents immediately — all scoped to projectWorkingDir
       const spawned = [];
       const failed = [];
       const phase1Ids = [];
@@ -1610,7 +1640,7 @@ Keep responses concise. Help them think, don't lecture them about the system the
             provider: config.provider || 'claude-code',
             model: config.model || 'auto',
             permission: config.permission || 'auto',
-            workingDir: config.workingDir || defaultDir,
+            workingDir: config.workingDir || projectWorkingDir,
             name: config.name || undefined,
           });
           validated.teamId = defaultTeamId;
@@ -1623,7 +1653,7 @@ Keep responses concise. Help them think, don't lecture them about the system the
         }
       }
 
-      // If there are phase 2 agents, register them for auto-spawn on phase 1 completion
+      // Phase 2 agents also scoped to projectWorkingDir
       if (phase2.length > 0 && phase1Ids.length > 0) {
         daemon._pendingPhase2 = daemon._pendingPhase2 || [];
         daemon._pendingPhase2.push({
@@ -1632,7 +1662,7 @@ Keep responses concise. Help them think, don't lecture them about the system the
             role: c.role, scope: c.scope || [], prompt: c.prompt || '',
             provider: c.provider || 'claude-code', model: c.model || 'auto',
             permission: c.permission || 'auto',
-            workingDir: c.workingDir || defaultDir,
+            workingDir: c.workingDir || projectWorkingDir,
             name: c.name || undefined,
             teamId: defaultTeamId,
           })),
@@ -1641,9 +1671,9 @@ Keep responses concise. Help them think, don't lecture them about the system the
 
       daemon.audit.log('team.launch', {
         phase1: spawned.length, phase2Pending: phase2.length, failed: failed.length,
-        agents: spawned.map((a) => a.role),
+        agents: spawned.map((a) => a.role), projectDir: projectDir || null,
       });
-      res.json({ launched: spawned.length, phase2Pending: phase2.length, agents: spawned, failed });
+      res.json({ launched: spawned.length, phase2Pending: phase2.length, agents: spawned, failed, projectDir: projectDir || null });
     } catch (err) {
       res.status(500).json({ error: err.message });
     }

package/node_modules/@groove-dev/daemon/src/introducer.js

@@ -127,6 +127,16 @@ export class Introducer {
       lines.push(`4. Clear your entry from \`.groove/coordination.md\` when done`);
     }
 
+    // File safety — prevent agents from deleting files they didn't create
+    lines.push('');
+    lines.push(`## File Safety`);
+    lines.push('');
+    lines.push(`CRITICAL: NEVER delete files you did not create in this session. Do NOT remove files from other projects, previous work, or unrelated directories.`);
+    if (newAgent.workingDir) {
+      lines.push(`Your working directory is \`${newAgent.workingDir}\`. Stay inside it. Do NOT modify or delete files outside this directory.`);
+    }
+    lines.push(`If you see files that seem unrelated to your task, leave them alone — they belong to another project or agent.`);
+
     // Memory containment — prevent agents from reading/writing auto-memory
     // which can contain stale context from unrelated sessions in the same dir
     lines.push('');

package/node_modules/@groove-dev/daemon/src/process.js

@@ -74,15 +74,33 @@ After completing your plan, you MUST do two things:
 1. Write your team recommendation as a clear summary in your output so the user can review it.
 
 2. Save a machine-readable team config to .groove/recommended-team.json using this EXACT format:
-[
-  { "role": "frontend", "phase": 1, "scope": ["src/components/**", "src/views/**"], "prompt": "Build the frontend: [specific tasks]" },
-  { "role": "backend", "phase": 1, "scope": ["src/api/**", "src/server/**"], "prompt": "Build the backend: [specific tasks]" },
-  { "role": "fullstack", "phase": 2, "scope": [], "prompt": "QC Senior Dev: Audit all changes from phase 1 agents. Verify correctness, fix issues, run tests, build the project, commit, and launch. Output the localhost URL." }
-]
+
+For NEW projects (building something from scratch):
+{
+  "projectDir": "my-project-name",
+  "agents": [
+    { "role": "frontend", "phase": 1, "scope": ["src/components/**", "src/views/**"], "prompt": "Build the frontend: [specific tasks]" },
+    { "role": "backend", "phase": 1, "scope": ["src/api/**", "src/server/**"], "prompt": "Build the backend: [specific tasks]" },
+    { "role": "fullstack", "phase": 2, "scope": [], "prompt": "QC Senior Dev: Audit all changes from phase 1 agents. Verify correctness, fix issues, run tests, build the project, commit, and launch. Output the localhost URL." }
+  ]
+}
+
+For EXISTING codebases (modifying/extending an existing project):
+{
+  "agents": [
+    { "role": "frontend", "phase": 1, "scope": ["src/components/**"], "prompt": "Update the frontend: [specific tasks]" },
+    { "role": "fullstack", "phase": 2, "scope": [], "prompt": "QC Senior Dev: Audit all changes, fix issues, run tests, build, commit, and launch." }
+  ]
+}
+
+PROJECT DIRECTORY RULES:
+- For NEW projects: ALWAYS include "projectDir" with a short, clean directory name (kebab-case, e.g. "cat-website", "landing-page", "api-service"). All agents will be spawned inside this directory so each project stays isolated.
+- For EXISTING codebases: Do NOT include "projectDir". Agents work in the current repo root. You can tell an existing codebase by the presence of package.json, .git, or established source directories.
+- NEVER mix projects. Each new project gets its own directory.
 
 MANDATORY RULES — NEVER SKIP THESE:
 
-1. The LAST entry in the array MUST be: { "role": "fullstack", "phase": 2, ... }
+1. The LAST entry in the agents array MUST be: { "role": "fullstack", "phase": 2, ... }
    This is the QC Senior Dev. It auto-spawns after all other agents finish.
    Its prompt: audit changes, fix issues, run tests, build, commit, launch.
    NEVER omit this agent. Every team needs a QC.
@@ -93,7 +111,7 @@ MANDATORY RULES — NEVER SKIP THESE:
 
 4. Set appropriate scopes. Write detailed prompts so each agent knows exactly what to build.
 
-5. If the project is a monorepo, set "workingDir" for agents that need specific subdirectories.
+5. NEVER instruct any agent to delete files from other projects or clean up unrelated code. Each agent must ONLY create and modify files relevant to its assigned tasks.
 
 IMPORTANT: Do not use markdown formatting like ** or ### in your output. Write in plain text with clean formatting. Use line breaks, dashes, and indentation for structure.