groove-dev 0.27.110 → 0.27.112

package/node_modules/@groove-dev/gui/dist/index.html

@@ -6,7 +6,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="icon" type="image/png" href="/favicon.png" />
     <title>Groove GUI</title>
-    <script type="module" crossorigin src="/assets/index-B8JomvGM.js"></script>
+    <script type="module" crossorigin src="/assets/index-CHu5w3i3.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-26L3JoZv.js">
     <link rel="modulepreload" crossorigin href="/assets/reactflow-DoBZjiHE.js">
     <link rel="modulepreload" crossorigin href="/assets/codemirror-CFF1Lrnz.js">

package/node_modules/@groove-dev/gui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/gui",
-  "version": "0.27.110",
+  "version": "0.27.112",
   "description": "GROOVE GUI — visual agent control plane",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/gui/src/stores/groove.js

@@ -2702,7 +2702,7 @@ export const useGrooveStore = create((set, get) => ({
       set({ trainingOptIn: enabled });
       if (!enabled) set({ trainingStats: null });
     } catch (e) {
-      get().addToast('error', 'Failed to update training preference');
+      get().addToast('error', 'Failed to update training preference', e.body?.detail || e.message);
     }
   },
 

package/node_modules/moe-training/client/consent.js

@@ -1,44 +1,46 @@
 // FSL-1.1-Apache-2.0 — see LICENSE
 
-import Database from 'better-sqlite3';
 import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { CURRENT_CONSENT_VERSION } from '../shared/constants.js';
 
+function ensureDir(filePath) {
+  const dir = filePath.replace(/[/\\][^/\\]+$/, '');
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+}
+
+function readJSON(filePath) {
+  if (!existsSync(filePath)) return null;
+  try { return JSON.parse(readFileSync(filePath, 'utf-8')); } catch { return null; }
+}
+
+function writeJSON(filePath, data) {
+  ensureDir(filePath);
+  writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
+}
+
 export class ConsentManager {
-  constructor(dbPath) {
-    this._dbPath = dbPath || join(homedir(), '.groove', 'consent.db');
-    const dir = this._dbPath.replace(/[/\\][^/\\]+$/, '');
-    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-    this._db = new Database(this._dbPath);
-    this._db.pragma('journal_mode = WAL');
-    this._db.exec(`
-      CREATE TABLE IF NOT EXISTS consent_history (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        user_id TEXT NOT NULL,
-        opted_in INTEGER NOT NULL,
-        consent_version TEXT NOT NULL,
-        metadata TEXT,
-        created_at TEXT NOT NULL DEFAULT (datetime('now'))
-      )
-    `);
+  constructor(consentPath) {
+    this._path = consentPath || join(homedir(), '.groove', 'consent.json');
   }
 
-  recordConsent(userId, optedIn, consentVersion, metadata) {
-    this._db.prepare(
-      'INSERT INTO consent_history (user_id, opted_in, consent_version, metadata) VALUES (?, ?, ?, ?)'
-    ).run(userId, optedIn ? 1 : 0, consentVersion, metadata ? JSON.stringify(metadata) : null);
+  recordConsent(userId, optedIn, consentVersion) {
+    const data = {
+      user_id: userId,
+      opted_in: !!optedIn,
+      consent_version: consentVersion,
+      updated_at: new Date().toISOString(),
+    };
+    writeJSON(this._path, data);
   }
 
   isOptedIn(userId) {
-    const row = this._db.prepare(
-      'SELECT opted_in, consent_version FROM consent_history WHERE user_id = ? ORDER BY id DESC LIMIT 1'
-    ).get(userId);
-    if (!row) return false;
-    if (row.consent_version !== CURRENT_CONSENT_VERSION) return false;
-    return row.opted_in === 1;
+    const data = readJSON(this._path);
+    if (!data) return false;
+    if (data.consent_version !== CURRENT_CONSENT_VERSION) return false;
+    return data.opted_in === true;
   }
 
   revokeConsent(userId) {
@@ -46,34 +48,28 @@ export class ConsentManager {
   }
 
   getOptedInCount() {
-    const row = this._db.prepare(`
-      SELECT COUNT(DISTINCT user_id) as cnt FROM consent_history ch1
-      WHERE opted_in = 1
-        AND consent_version = ?
-        AND id = (SELECT MAX(id) FROM consent_history ch2 WHERE ch2.user_id = ch1.user_id)
-    `).get(CURRENT_CONSENT_VERSION);
-    return row?.cnt || 0;
+    const data = readJSON(this._path);
+    if (!data || !data.opted_in || data.consent_version !== CURRENT_CONSENT_VERSION) return 0;
+    return 1;
   }
 
   getConsentHistory(userId) {
-    const rows = this._db.prepare(
-      'SELECT * FROM consent_history WHERE user_id = ? ORDER BY id ASC'
-    ).all(userId);
-    return rows.map((r) => ({
-      ...r,
-      opted_in: r.opted_in === 1,
-      metadata: r.metadata ? JSON.parse(r.metadata) : null,
-    }));
+    const data = readJSON(this._path);
+    if (!data) return [];
+    return [{
+      user_id: data.user_id,
+      opted_in: data.opted_in,
+      consent_version: data.consent_version,
+      created_at: data.updated_at,
+      metadata: null,
+    }];
   }
 
-  close() {
-    this._db.close();
-  }
+  close() {}
 
   static getOrCreateUserId(userIdPath) {
     const filePath = userIdPath || join(homedir(), '.groove', 'user_id');
-    const dir = filePath.replace(/[/\\][^/\\]+$/, '');
-    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    ensureDir(filePath);
     if (existsSync(filePath)) {
       return readFileSync(filePath, 'utf-8').trim();
     }
@@ -82,15 +78,11 @@ export class ConsentManager {
     return uid;
   }
 
-  static isCaptureEnabled(userIdPath, dbPath) {
+  static isCaptureEnabled(userIdPath, consentPath) {
     const filePath = userIdPath || join(homedir(), '.groove', 'user_id');
     if (!existsSync(filePath)) return false;
+    const manager = new ConsentManager(consentPath);
     const userId = readFileSync(filePath, 'utf-8').trim();
-    const manager = new ConsentManager(dbPath);
-    try {
-      return manager.isOptedIn(userId);
-    } finally {
-      manager.close();
-    }
+    return manager.isOptedIn(userId);
   }
 }

package/node_modules/moe-training/client/domain-tagger.js

@@ -1,5 +1,7 @@
 // FSL-1.1-Apache-2.0 — see LICENSE
 
+import { EMBEDDING_SERVICE_URL } from '../shared/constants.js';
+
 const DEFAULT_MODEL = 'sentence-transformers/all-MiniLM-L6-v2';
 const DEFAULT_TOP_K = 3;
 
@@ -171,7 +173,7 @@ const DOMAIN_TAXONOMY = {
 
 export class DomainTagger {
   constructor(options = {}) {
-    this._serviceUrl = options.serviceUrl || process.env.EMBEDDING_SERVICE_URL || null;
+    this._serviceUrl = options.serviceUrl !== undefined ? options.serviceUrl : EMBEDDING_SERVICE_URL;
     this._registryUrl = options.registryUrl || process.env.LEAF_REGISTRY_URL || null;
     this._registry = options.registry || null;
     this._model = options.model || DEFAULT_MODEL;

package/node_modules/moe-training/client/trajectory-capture.js

@@ -298,9 +298,10 @@ export class TrajectoryCapture {
 
     if (this._domainTagger) {
       const role = ctx.metadata.agent_role || '';
-      const firstPrompt = ctx.allSteps.find((s) => s.type === 'thought')?.content || '';
       const thoughtSteps = ctx.allSteps.filter((s) => s.type === 'thought');
-      const routingText = DomainTagger.buildRoutingText(role, firstPrompt, thoughtSteps);
+      const firstPrompt = thoughtSteps[0]?.content || '';
+      const remainingThoughts = thoughtSteps.slice(1);
+      const routingText = DomainTagger.buildRoutingText(role, firstPrompt, remainingThoughts);
       ctx.metadata.domain_tags = await this._domainTagger.tag(routingText);
       ctx.metadata.session_embedding = await this._domainTagger.embed(routingText);
     }

package/node_modules/moe-training/shared/constants.js

@@ -39,3 +39,4 @@ export const TRAINING_EXCLUSION_REASONS = ['too_few_steps', 'no_actions', 'no_ob
 export const USER_MESSAGE_MAX_CHARS = 2000;
 
 export const CENTRAL_COMMAND_URL = process.env.GROOVE_CENTRAL_URL || 'https://api.groovedev.ai';
+export const EMBEDDING_SERVICE_URL = process.env.EMBEDDING_SERVICE_URL || `${CENTRAL_COMMAND_URL}/v1/embed`;

package/node_modules/moe-training/test/client/consent.test.js

@@ -8,12 +8,12 @@ import { tmpdir } from 'node:os';
 import { ConsentManager } from '../../client/consent.js';
 
 describe('ConsentManager', () => {
-  let tmpDir, dbPath, manager;
+  let tmpDir, consentPath, manager;
 
   beforeEach(() => {
     tmpDir = mkdtempSync(join(tmpdir(), 'consent-test-'));
-    dbPath = join(tmpDir, 'consent.db');
-    manager = new ConsentManager(dbPath);
+    consentPath = join(tmpDir, 'consent.json');
+    manager = new ConsentManager(consentPath);
   });
 
   afterEach(() => {
@@ -43,19 +43,24 @@ describe('ConsentManager', () => {
 
   it('getOptedInCount counts correctly', () => {
     manager.recordConsent('user1', true, '1.0');
-    manager.recordConsent('user2', true, '1.0');
-    manager.recordConsent('user3', false, '1.0');
-    assert.equal(manager.getOptedInCount(), 2);
+    assert.equal(manager.getOptedInCount(), 1);
   });
 
-  it('getConsentHistory returns all records', () => {
-    manager.recordConsent('user1', true, '1.0', { source: 'ui' });
-    manager.revokeConsent('user1');
+  it('getConsentHistory returns current state', () => {
+    manager.recordConsent('user1', true, '1.0');
     const history = manager.getConsentHistory('user1');
-    assert.equal(history.length, 2);
+    assert.equal(history.length, 1);
     assert.equal(history[0].opted_in, true);
-    assert.deepEqual(history[0].metadata, { source: 'ui' });
-    assert.equal(history[1].opted_in, false);
+  });
+
+  it('consent.json is written with 0o600 permissions', () => {
+    manager.recordConsent('user1', true, '1.0');
+    assert.ok(existsSync(consentPath));
+    const data = JSON.parse(readFileSync(consentPath, 'utf-8'));
+    assert.equal(data.opted_in, true);
+    assert.equal(data.consent_version, '1.0');
+    assert.equal(data.user_id, 'user1');
+    assert.ok(data.updated_at);
   });
 });
 
@@ -96,26 +101,24 @@ describe('ConsentManager.isCaptureEnabled', () => {
   });
 
   it('returns false when no user_id file exists', () => {
-    const result = ConsentManager.isCaptureEnabled(join(tmpDir, 'no_file'), join(tmpDir, 'c.db'));
+    const result = ConsentManager.isCaptureEnabled(join(tmpDir, 'no_file'), join(tmpDir, 'consent.json'));
     assert.equal(result, false);
   });
 
   it('returns false when user not opted in', () => {
     const uidPath = join(tmpDir, 'user_id');
-    const uid = ConsentManager.getOrCreateUserId(uidPath);
-    const dbPath = join(tmpDir, 'consent.db');
-    const result = ConsentManager.isCaptureEnabled(uidPath, dbPath);
+    ConsentManager.getOrCreateUserId(uidPath);
+    const result = ConsentManager.isCaptureEnabled(uidPath, join(tmpDir, 'consent.json'));
     assert.equal(result, false);
   });
 
   it('returns true when user is opted in', () => {
     const uidPath = join(tmpDir, 'user_id');
     const uid = ConsentManager.getOrCreateUserId(uidPath);
-    const dbPath = join(tmpDir, 'consent.db');
-    const mgr = new ConsentManager(dbPath);
+    const consentPath = join(tmpDir, 'consent.json');
+    const mgr = new ConsentManager(consentPath);
     mgr.recordConsent(uid, true, '1.0');
-    mgr.close();
-    const result = ConsentManager.isCaptureEnabled(uidPath, dbPath);
+    const result = ConsentManager.isCaptureEnabled(uidPath, consentPath);
     assert.equal(result, true);
   });
 });

package/node_modules/moe-training/test/client/domain-tagger.test.js

@@ -8,7 +8,7 @@ describe('DomainTagger', () => {
   let tagger;
 
   beforeEach(async () => {
-    tagger = new DomainTagger();
+    tagger = new DomainTagger({ serviceUrl: null });
     await tagger.init();
   });
 
@@ -176,7 +176,7 @@ describe('DomainTagger', () => {
   });
 
   it('returns null when not initialized', async () => {
-    const uninit = new DomainTagger();
+    const uninit = new DomainTagger({ serviceUrl: null });
     const result = await uninit.tag('Build a Python Django app');
     assert.equal(result, null);
   });
@@ -203,6 +203,7 @@ describe('DomainTagger', () => {
 
   it('accepts registry option and falls back to keyword mode without embedding service', async () => {
     const registryTagger = new DomainTagger({
+      serviceUrl: null,
       registry: [
         { id: 'quantum_computing', domain_description: 'Quantum computing, qubits, quantum gates' },
         { id: 'bioinformatics', domain_description: 'Biology, genomics, DNA analysis' },
@@ -215,6 +216,7 @@ describe('DomainTagger', () => {
 
   it('accepts registryUrl option and falls back to keyword mode when unavailable', async () => {
     const registryTagger = new DomainTagger({
+      serviceUrl: null,
       registryUrl: 'http://localhost:99999/api/leaves',
     });
     await registryTagger.init();
@@ -223,7 +225,7 @@ describe('DomainTagger', () => {
   });
 
   it('uses expanded taxonomy — has 40 domains by default', async () => {
-    const defaultTagger = new DomainTagger();
+    const defaultTagger = new DomainTagger({ serviceUrl: null });
     await defaultTagger.init();
     assert.ok(defaultTagger._domains.length >= 35, `Expected 35+ domains, got ${defaultTagger._domains.length}`);
   });
@@ -239,7 +241,7 @@ describe('DomainTagger', () => {
   });
 
   it('embed() returns null when not initialized', async () => {
-    const uninit = new DomainTagger();
+    const uninit = new DomainTagger({ serviceUrl: null });
     const result = await uninit.embed('Build a Python app');
     assert.equal(result, null);
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "groove-dev",
-  "version": "0.27.110",
+  "version": "0.27.112",
   "description": "Open-source agent orchestration layer — the AI company OS. Local model agent engine (GGUF/Ollama/llama-server), HuggingFace model browser, MCP integrations (Slack, Gmail, Stripe, 15+), agent scheduling (cron), business roles (CMO, CFO, EA). GUI dashboard, multi-agent coordination, zero cold-start, infinite sessions. Works with Claude Code, Codex, Gemini CLI, Ollama, any local model.",
   "license": "FSL-1.1-Apache-2.0",
   "author": "Groove Dev <hello@groovedev.ai> (https://groovedev.ai)",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.110",
+  "version": "0.27.112",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.110",
+  "version": "0.27.112",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/packages/daemon/src/api.js

@@ -112,7 +112,7 @@ export function createApi(app, daemon) {
       res.setHeader('Content-Security-Policy', "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; frame-ancestors 'self'");
     } else {
       res.setHeader('X-Frame-Options', 'DENY');
-      res.setHeader('Content-Security-Policy', "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; connect-src 'self' ws://localhost:* ws://127.0.0.1:* http://localhost:* http://127.0.0.1:*; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-src 'self'; frame-ancestors 'none'");
+      res.setHeader('Content-Security-Policy', "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; connect-src 'self' ws://localhost:* ws://127.0.0.1:* http://localhost:* http://127.0.0.1:*; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-src 'self' http://127.0.0.1:* http://localhost:*; frame-ancestors 'none'");
     }
     next();
   });
@@ -4855,9 +4855,13 @@ Keep responses concise. Help them think, don't lecture them about the system the
 
   app.get('/api/training/status', (req, res) => {
     let userId = null;
-    try { userId = ConsentManager.isCaptureEnabled() ? ConsentManager.getOrCreateUserId() : null; } catch (e) { /* no db yet */ }
+    let optedIn = false;
+    try {
+      userId = ConsentManager.getOrCreateUserId();
+      optedIn = ConsentManager.isCaptureEnabled();
+    } catch (e) { /* */ }
     res.json({
-      optedIn: !!daemon.config.training_opt_in,
+      optedIn,
       userId: userId ? userId.substring(0, 8) + '...' : null,
       captureActive: !!daemon.trajectoryCapture,
       sessionsCaptured: daemon.state.get('training_sessions_captured') || 0,
@@ -4869,39 +4873,23 @@ Keep responses concise. Help them think, don't lecture them about the system the
     const { enabled } = req.body;
     if (typeof enabled !== 'boolean') return res.status(400).json({ error: 'enabled must be boolean' });
 
-    daemon.config.training_opt_in = enabled;
-    const { saveConfig } = await import('./firstrun.js');
-    saveConfig(daemon.grooveDir, daemon.config);
-
-    if (enabled) {
-      try {
-        const userId = ConsentManager.getOrCreateUserId();
-        const consent = new ConsentManager();
-        try {
-          consent.recordConsent(userId, true, '1.0');
-        } finally {
-          consent.close();
-        }
+    try {
+      const userId = ConsentManager.getOrCreateUserId();
+      const consent = new ConsentManager();
+      if (enabled) {
+        consent.recordConsent(userId, true, '1.0');
         await daemon._initTrajectoryCapture();
         daemon.state.set('training_enrolled_at', new Date().toISOString());
-      } catch (e) {
-        daemon.config.training_opt_in = false;
-        return res.status(500).json({ error: 'Failed to enable data sharing', detail: e.message });
-      }
-    } else {
-      if (daemon.trajectoryCapture) {
-        try { await daemon.trajectoryCapture.shutdown(); } catch (e) { /* */ }
-        daemon.trajectoryCapture = null;
-      }
-      try {
-        const userId = ConsentManager.getOrCreateUserId();
-        const consent = new ConsentManager();
-        try {
-          consent.revokeConsent(userId);
-        } finally {
-          consent.close();
+      } else {
+        consent.revokeConsent(userId);
+        if (daemon.trajectoryCapture) {
+          try { await daemon.trajectoryCapture.shutdown(); } catch (e) { /* */ }
+          daemon.trajectoryCapture = null;
         }
-      } catch (e) { /* no user_id yet */ }
+      }
+    } catch (e) {
+      console.error('[training/opt-in] Failed to update data sharing:', e);
+      return res.status(500).json({ error: 'Failed to update data sharing', detail: e.message });
     }
 
     daemon.broadcast({ type: 'training:status', data: { optedIn: enabled, captureActive: !!daemon.trajectoryCapture } });
@@ -4911,18 +4899,13 @@ Keep responses concise. Help them think, don't lecture them about the system the
 
   app.post('/api/training/opt-in/delete', async (req, res) => {
     try {
-      daemon.config.training_opt_in = false;
-      const { saveConfig } = await import('./firstrun.js');
-      saveConfig(daemon.grooveDir, daemon.config);
+      const userId = ConsentManager.getOrCreateUserId();
+      const consent = new ConsentManager();
+      consent.revokeConsent(userId);
       if (daemon.trajectoryCapture) {
         try { await daemon.trajectoryCapture.shutdown(); } catch (e) { /* */ }
         daemon.trajectoryCapture = null;
       }
-      try {
-        const userId = ConsentManager.getOrCreateUserId();
-        const consent = new ConsentManager();
-        try { consent.revokeConsent(userId); } finally { consent.close(); }
-      } catch (e) { /* */ }
       daemon.broadcast({ type: 'training:status', data: { optedIn: false, captureActive: false } });
       if (daemon.audit) daemon.audit.log('training.delete', {});
       res.json({ ok: true, deleted: true });
@@ -4948,7 +4931,6 @@ Keep responses concise. Help them think, don't lecture them about the system the
       'port', 'journalistInterval', 'rotationThreshold', 'autoRotation',
       'qcThreshold', 'maxAgents', 'defaultProvider', 'defaultWorkingDir',
       'onboardingDismissed', 'defaultModel', 'defaultChatProvider', 'defaultChatModel',
-      'training_opt_in',
     ];
     for (const key of Object.keys(req.body)) {
       if (!ALLOWED_KEYS.includes(key)) {

package/packages/daemon/src/index.js

@@ -666,17 +666,15 @@ export class Daemon {
   }
 
   async _initTrajectoryCapture() {
-    if (!this.config.training_opt_in) return;
     try {
-      if (ConsentManager.isCaptureEnabled()) {
-        const pkgPath = new URL('../package.json', import.meta.url);
-        const version = JSON.parse(readFileSync(pkgPath, 'utf8')).version;
-        this.trajectoryCapture = new TrajectoryCapture({
-          centralCommandUrl: process.env.GROOVE_CENTRAL_URL || 'https://api.groovedev.ai',
-          grooveVersion: version,
-        });
-        this.trajectoryCapture.init();
-      }
+      if (!ConsentManager.isCaptureEnabled()) return;
+      const pkgPath = new URL('../package.json', import.meta.url);
+      const version = JSON.parse(readFileSync(pkgPath, 'utf8')).version;
+      this.trajectoryCapture = new TrajectoryCapture({
+        centralCommandUrl: process.env.GROOVE_CENTRAL_URL || 'https://api.groovedev.ai',
+        grooveVersion: version,
+      });
+      this.trajectoryCapture.init();
     } catch (e) {
       // Training capture is never critical
     }