groove-dev 0.25.16 → 0.25.17

package/node_modules/@groove-dev/gui/dist/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="icon" type="image/png" href="/favicon.png" />
     <title>Groove GUI</title>
-    <script type="module" crossorigin src="/assets/index-BjUplOVu.js"></script>
+    <script type="module" crossorigin src="/assets/index-Ca4wKXQ9.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-C0HXlhrU.js">
     <link rel="modulepreload" crossorigin href="/assets/reactflow-BQPfi37R.js">
     <link rel="modulepreload" crossorigin href="/assets/codemirror-BBL3i_JW.js">

package/node_modules/@groove-dev/gui/src/components/agents/agent-feed.jsx

@@ -9,6 +9,7 @@ import {
 import { useGrooveStore } from '../../stores/groove';
 import { cn } from '../../lib/cn';
 import { timeAgo } from '../../lib/format';
+import { api } from '../../lib/api';
 
 const EMPTY = [];
 
@@ -532,11 +533,33 @@ export function AgentFeed({ agent }) {
     }
   }, [timeline.length]);
 
-  function handleFileSelect(e) {
+  async function handleFileSelect(e) {
     const files = Array.from(e.target.files || []);
     if (files.length === 0) return;
-    const names = files.map((f) => f.name).join(', ');
-    setInput((prev) => (prev ? prev + '\n' : '') + `[Attached: ${names}] — Read these files from the working directory.`);
+    const addToast = useGrooveStore.getState().addToast;
+
+    const uploaded = [];
+    for (const file of files) {
+      try {
+        const base64 = await new Promise((resolve, reject) => {
+          const reader = new FileReader();
+          reader.onload = () => resolve(reader.result.split(',')[1]); // strip data:...;base64,
+          reader.onerror = reject;
+          reader.readAsDataURL(file);
+        });
+        await api.post(`/agents/${agent.id}/upload`, { filename: file.name, content: base64 });
+        uploaded.push(file.name);
+      } catch (err) {
+        addToast('error', `Upload failed: ${file.name}`, err.message);
+      }
+    }
+
+    if (uploaded.length > 0) {
+      const names = uploaded.join(', ');
+      setInput((prev) => (prev ? prev + '\n' : '') + `[Uploaded: ${names}] — I've uploaded these files to your working directory. Read them and use their content.`);
+      addToast('success', `Uploaded ${uploaded.length} file${uploaded.length > 1 ? 's' : ''}`);
+    }
+
     e.target.value = '';
     inputRef.current?.focus();
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "groove-dev",
-  "version": "0.25.16",
+  "version": "0.25.17",
   "description": "Open-source agent orchestration layer — the AI company OS. MCP integrations (Slack, Gmail, Stripe, 15+), agent scheduling (cron), business roles (CMO, CFO, EA). GUI dashboard, multi-agent coordination, zero cold-start, infinite sessions. Works with Claude Code, Codex, Gemini CLI, Ollama.",
   "license": "FSL-1.1-Apache-2.0",
   "author": "Groove Dev <hello@groovedev.ai> (https://groovedev.ai)",

package/packages/daemon/src/api.js

@@ -420,6 +420,37 @@ export function createApi(app, daemon) {
     }
   });
 
+  // Upload file to agent's working directory
+  app.post('/api/agents/:id/upload', (req, res) => {
+    const agent = daemon.registry.get(req.params.id);
+    if (!agent) return res.status(404).json({ error: 'Agent not found' });
+
+    const { filename, content } = req.body;
+    if (!filename || !content) return res.status(400).json({ error: 'filename and content required' });
+
+    // Sanitize filename — no path traversal
+    const safeName = String(filename).replace(/[/\\]/g, '_').replace(/\.\./g, '');
+    if (!safeName) return res.status(400).json({ error: 'Invalid filename' });
+
+    const dir = agent.workingDir || daemon.projectDir;
+    const filePath = resolve(dir, safeName);
+
+    // Ensure file stays within working directory
+    if (!filePath.startsWith(dir)) {
+      return res.status(400).json({ error: 'Path traversal detected' });
+    }
+
+    try {
+      mkdirSync(dir, { recursive: true });
+      const buffer = Buffer.from(content, 'base64');
+      writeFileSync(filePath, buffer);
+      daemon.audit.log('file.upload', { agentId: agent.id, filename: safeName, size: buffer.length });
+      res.json({ ok: true, path: safeName, size: buffer.length });
+    } catch (err) {
+      res.status(500).json({ error: `Upload failed: ${err.message}` });
+    }
+  });
+
   // List MD files for an agent (from its working directory + .groove)
   app.get('/api/agents/:id/mdfiles', (req, res) => {
     const agent = daemon.registry.get(req.params.id);