groove-dev 0.27.14 → 0.27.17

package/node_modules/@groove-dev/daemon/src/classifier.js

@@ -38,6 +38,7 @@ export class TaskClassifier {
   constructor() {
     this.windowSize = 200; // Large enough for quality signal extraction across tool calls
     this.agentWindows = {}; // for degradation detection and adaptive scoring
+    this._lastBroadcast = {};
   }
 
   addEvent(agentId, event) {
@@ -148,7 +149,30 @@ export class TaskClassifier {
     return { model: fallback, tier, reason: `No ${tier} model available, using ${fallback?.tier || 'default'}` };
   }
 
+  // Returns agents with significant classification changes since last poll.
+  // Called by the daemon's 30s broadcast timer — keeps classification
+  // completely decoupled from the stdout hot path.
+  getUpdates() {
+    const updates = [];
+    for (const [agentId, events] of Object.entries(this.agentWindows)) {
+      if (events.length < 40) continue; // Not enough data
+
+      const tier = this.classify(agentId);
+      const eventCount = events.length;
+      const lastBroadcast = this._lastBroadcast[agentId];
+
+      // Only report if classification changed or this is the first report
+      if (!lastBroadcast || lastBroadcast.tier !== tier ||
+          Math.abs(lastBroadcast.eventCount - eventCount) >= 20) {
+        updates.push({ agentId, tier, eventCount });
+        this._lastBroadcast[agentId] = { tier, eventCount };
+      }
+    }
+    return updates;
+  }
+
   clearAgent(agentId) {
     delete this.agentWindows[agentId];
+    delete this._lastBroadcast[agentId];
   }
 }

package/node_modules/@groove-dev/daemon/src/credentials.js

@@ -11,6 +11,7 @@ const SALT_PREFIX = 'groove-v1';
 
 export class CredentialStore {
   constructor(grooveDir) {
+    this.grooveDir = grooveDir;
     this.path = resolve(grooveDir, 'credentials.json');
     this.data = {};
     this.encryptionKey = this.deriveKey();
@@ -21,7 +22,15 @@ export class CredentialStore {
   // Not unbreakable, but much better than base64 — credentials file is
   // meaningless if copied to another machine or read without this process.
   deriveKey() {
-    const machineId = `${SALT_PREFIX}:${homedir()}:${hostname()}`;
+    const seedPath = resolve(this.grooveDir, '.credential-seed');
+    let seed = '';
+    try {
+      seed = readFileSync(seedPath, 'utf8');
+    } catch {
+      seed = randomBytes(32).toString('hex');
+      writeFileSync(seedPath, seed, { mode: 0o600 });
+    }
+    const machineId = `${SALT_PREFIX}:${seed}:${homedir()}:${hostname()}`;
     return scryptSync(machineId, 'groove-credential-salt', 32);
   }
 
@@ -101,7 +110,8 @@ export class CredentialStore {
   decrypt(encoded) {
     const parts = encoded.split(':');
     if (parts.length !== 3) {
-      // Legacy base64 format — migrate on read
+      // Legacy base64 format — migration path: decoded plaintext will be
+      // re-encrypted with AES-256-GCM on the next setKey call
       return Buffer.from(encoded, 'base64').toString('utf8');
     }
     const [ivHex, authTagHex, ciphertext] = parts;

package/node_modules/@groove-dev/daemon/src/federation/ambassador.js

@@ -0,0 +1,204 @@
+// GROOVE — Federation Ambassador Agent Coordination
+// FSL-1.1-Apache-2.0 — see LICENSE
+
+import { EventEmitter } from 'events';
+import { validateContract } from './contracts.js';
+
+const MAX_POUCH_LOG = 200;
+
+export class AmbassadorManager extends EventEmitter {
+  constructor(federation) {
+    super();
+    this.federation = federation;
+    this.daemon = federation.daemon;
+    this.ambassadors = new Map(); // peerId -> agentId
+    this.taskQueue = new Map(); // peerId -> [{ contract, from, receivedAt }]
+    this.pouchLog = []; // recent pouch messages for GUI
+  }
+
+  getAmbassadorForPeer(peerId) {
+    const agentId = this.ambassadors.get(peerId);
+    if (!agentId) return null;
+    const agent = this.daemon.registry.get(agentId);
+    if (!agent || agent.status === 'killed' || agent.status === 'completed') {
+      this.ambassadors.delete(peerId);
+      return null;
+    }
+    return agent;
+  }
+
+  hasAmbassadorForPeer(peerId) {
+    return !!this.getAmbassadorForPeer(peerId);
+  }
+
+  registerAmbassador(peerId, agentId) {
+    if (this.hasAmbassadorForPeer(peerId)) {
+      throw new Error(`Ambassador already exists for peer ${peerId}`);
+    }
+    this.ambassadors.set(peerId, agentId);
+
+    const queued = this.taskQueue.get(peerId) || [];
+    if (queued.length > 0) {
+      for (const item of queued) {
+        this._deliverToAmbassador(agentId, item);
+      }
+      this.taskQueue.delete(peerId);
+    }
+
+    this.daemon.audit.log('federation.ambassador.register', { peerId, agentId });
+    this.emit('registered', { peerId, agentId });
+  }
+
+  unregisterAmbassador(peerId) {
+    const agentId = this.ambassadors.get(peerId);
+    this.ambassadors.delete(peerId);
+    if (agentId) {
+      this.daemon.audit.log('federation.ambassador.unregister', { peerId, agentId });
+      this.emit('unregistered', { peerId, agentId });
+    }
+  }
+
+  receivePouch(senderId, contract, signature) {
+    const verified = this.federation.receiveContract(senderId, contract, signature);
+    if (!verified.verified) {
+      throw new Error('Pouch signature verification failed');
+    }
+
+    const validation = validateContract(verified.contract);
+    if (!validation.valid) {
+      throw new Error(`Invalid pouch contract: ${validation.error}`);
+    }
+
+    this._logPouch('inbound', senderId, verified.contract);
+
+    const peerEntry = this._findPeerBySenderId(senderId);
+    const peerId = peerEntry?.id || senderId;
+
+    const ambassador = this.getAmbassadorForPeer(peerId);
+    if (ambassador) {
+      this._deliverToAmbassador(ambassador.id, {
+        contract: verified.contract,
+        from: senderId,
+        receivedAt: new Date().toISOString(),
+      });
+    } else {
+      if (!this.taskQueue.has(peerId)) {
+        this.taskQueue.set(peerId, []);
+      }
+      this.taskQueue.get(peerId).push({
+        contract: verified.contract,
+        from: senderId,
+        receivedAt: new Date().toISOString(),
+      });
+    }
+
+    this.emit('pouch-received', { from: senderId, type: verified.contract.type });
+    return { received: true, queued: !ambassador };
+  }
+
+  async sendPouch(peerId, contract) {
+    const validation = validateContract(contract);
+    if (!validation.valid) {
+      throw new Error(`Invalid outbound contract: ${validation.error}`);
+    }
+
+    const envelope = this.federation.sign({
+      ...contract,
+      from: this.federation._daemonId(),
+    });
+
+    const sent = this.federation.connections.sendTo(peerId, {
+      type: 'pouch',
+      senderId: this.federation._daemonId(),
+      payload: envelope.payload,
+      signature: envelope.signature,
+    });
+
+    if (!sent) {
+      const peer = this.federation.peers.get(peerId);
+      if (!peer) throw new Error(`Unknown peer: ${peerId}`);
+
+      const url = `http://${peer.host}:${peer.port}/api/federation/pouch`;
+      const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          senderId: this.federation._daemonId(),
+          payload: envelope.payload,
+          signature: envelope.signature,
+        }),
+      });
+
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.error || `Pouch delivery failed: HTTP ${res.status}`);
+      }
+    }
+
+    this._logPouch('outbound', peerId, contract);
+    this.daemon.audit.log('federation.pouch.send', { peerId, type: contract.type });
+    this.emit('pouch-sent', { to: peerId, type: contract.type });
+    return { sent: true };
+  }
+
+  _deliverToAmbassador(agentId, item) {
+    this.daemon.broadcast({
+      type: 'federation:pouch',
+      data: {
+        agentId,
+        from: item.from,
+        contract: item.contract,
+        receivedAt: item.receivedAt,
+      },
+    });
+    this.emit('delivered', { agentId, from: item.from, type: item.contract.type });
+  }
+
+  _findPeerBySenderId(senderId) {
+    for (const peer of this.federation.peers.values()) {
+      if (peer.id === senderId) return peer;
+    }
+    return null;
+  }
+
+  _logPouch(direction, peer, contract) {
+    this.pouchLog.push({
+      direction,
+      peer,
+      type: contract.type,
+      taskId: contract.spec?.taskId || null,
+      timestamp: new Date().toISOString(),
+    });
+    if (this.pouchLog.length > MAX_POUCH_LOG) {
+      this.pouchLog = this.pouchLog.slice(-MAX_POUCH_LOG);
+    }
+    this.daemon.broadcast({
+      type: 'federation:pouch-log',
+      data: this.pouchLog.slice(-1)[0],
+    });
+  }
+
+  getPouchLog(limit = 50) {
+    return this.pouchLog.slice(-limit);
+  }
+
+  getStatus() {
+    const ambassadors = [];
+    for (const [peerId, agentId] of this.ambassadors) {
+      const agent = this.daemon.registry.get(agentId);
+      ambassadors.push({
+        peerId,
+        agentId,
+        agentStatus: agent?.status || 'unknown',
+        queuedTasks: (this.taskQueue.get(peerId) || []).length,
+      });
+    }
+    return { ambassadors, totalQueued: Array.from(this.taskQueue.values()).reduce((s, q) => s + q.length, 0) };
+  }
+
+  destroy() {
+    this.ambassadors.clear();
+    this.taskQueue.clear();
+    this.removeAllListeners();
+  }
+}

package/node_modules/@groove-dev/daemon/src/federation/connection.js

@@ -0,0 +1,359 @@
+// GROOVE — Federation WebSocket Connection Manager
+// FSL-1.1-Apache-2.0 — see LICENSE
+
+import { EventEmitter } from 'events';
+import WebSocket from 'ws';
+
+const HEARTBEAT_INTERVAL = 30_000;
+const INITIAL_RECONNECT_DELAY = 2_000;
+const MAX_RECONNECT_DELAY = 60_000;
+const KNOCK_TIMEOUT = 10_000;
+
+const STATES = {
+  DISCONNECTED: 'disconnected',
+  WHITELISTED: 'whitelisted',
+  MUTUAL: 'mutual',
+  KNOCKING: 'knocking',
+  CONNECTED: 'connected',
+};
+
+class PeerConnection extends EventEmitter {
+  constructor(manager, ip, port, remoteDaemonId) {
+    super();
+    this.manager = manager;
+    this.ip = ip;
+    this.port = port;
+    this.remoteDaemonId = remoteDaemonId;
+    this.state = STATES.DISCONNECTED;
+    this.ws = null;
+    this._heartbeatTimer = null;
+    this._reconnectTimer = null;
+    this._reconnectDelay = INITIAL_RECONNECT_DELAY;
+    this._knockTimeout = null;
+    this._destroyed = false;
+  }
+
+  get peerId() {
+    return this.remoteDaemonId || `${this.ip}:${this.port}`;
+  }
+
+  _setState(newState) {
+    const old = this.state;
+    if (old === newState) return;
+    this.state = newState;
+    this.emit('state-change', { ip: this.ip, state: newState, oldState: old, newState, peerId: this.peerId });
+  }
+
+  async initiateKnock() {
+    if (this._destroyed) return;
+    this._setState(STATES.KNOCKING);
+
+    const federation = this.manager.federation;
+    const challenge = { type: 'knock', daemonId: federation._daemonId() };
+    const envelope = federation.sign(challenge);
+
+    try {
+      const controller = new AbortController();
+      this._knockTimeout = setTimeout(() => controller.abort(), KNOCK_TIMEOUT);
+
+      const url = `http://${this.ip}:${this.port}/api/federation/knock`;
+      const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          senderId: federation._daemonId(),
+          publicKey: federation.getPublicKeyPem(),
+          payload: envelope.payload,
+          signature: envelope.signature,
+        }),
+        signal: controller.signal,
+      });
+
+      clearTimeout(this._knockTimeout);
+      this._knockTimeout = null;
+
+      if (!res.ok) {
+        this._setState(STATES.MUTUAL);
+        this._scheduleReconnect();
+        return;
+      }
+
+      const data = await res.json();
+      if (!data.accepted) {
+        this._setState(STATES.MUTUAL);
+        this._scheduleReconnect();
+        return;
+      }
+
+      if (data.peerId) this.remoteDaemonId = data.peerId;
+      if (data.publicKey) {
+        this._ensurePeerStored(data);
+      }
+
+      this._openWebSocket();
+    } catch {
+      clearTimeout(this._knockTimeout);
+      this._knockTimeout = null;
+      this._setState(STATES.MUTUAL);
+      this._scheduleReconnect();
+    }
+  }
+
+  _ensurePeerStored(data) {
+    const federation = this.manager.federation;
+    if (data.peerId && data.publicKey && !federation.peers.has(data.peerId)) {
+      federation._savePeer({
+        id: data.peerId,
+        name: data.peerName || data.peerId,
+        host: this.ip,
+        port: this.port,
+        publicKey: data.publicKey,
+        pairedAt: new Date().toISOString(),
+      });
+    }
+  }
+
+  _openWebSocket() {
+    if (this._destroyed) return;
+
+    const federation = this.manager.federation;
+    const url = `ws://${this.ip}:${this.port}/ws/federation`;
+
+    try {
+      this.ws = new WebSocket(url, {
+        headers: {
+          'X-Groove-DaemonId': federation._daemonId(),
+          'X-Groove-Signature': this._makeAuthHeader(),
+        },
+        handshakeTimeout: 10_000,
+      });
+    } catch {
+      this._setState(STATES.MUTUAL);
+      this._scheduleReconnect();
+      return;
+    }
+
+    this.ws.on('open', () => {
+      this._reconnectDelay = INITIAL_RECONNECT_DELAY;
+      this._setState(STATES.CONNECTED);
+      this._startHeartbeat();
+      this.emit('connected', { ip: this.ip, peerId: this.peerId });
+    });
+
+    this.ws.on('message', (raw) => {
+      try {
+        const msg = JSON.parse(raw);
+        if (msg.type === 'pong') return;
+        this.emit('message', msg);
+      } catch { /* ignore malformed */ }
+    });
+
+    this.ws.on('close', () => {
+      this._cleanup();
+      if (!this._destroyed) {
+        this._setState(STATES.MUTUAL);
+        this.emit('disconnected', { ip: this.ip, peerId: this.peerId });
+        this._scheduleReconnect();
+      }
+    });
+
+    this.ws.on('error', () => {
+      // close event will fire after error
+    });
+  }
+
+  _makeAuthHeader() {
+    const federation = this.manager.federation;
+    const envelope = federation.sign({ type: 'ws-auth', daemonId: federation._daemonId() });
+    return Buffer.from(JSON.stringify(envelope)).toString('base64');
+  }
+
+  send(message) {
+    if (this.state !== STATES.CONNECTED || !this.ws || this.ws.readyState !== WebSocket.OPEN) {
+      return false;
+    }
+    try {
+      this.ws.send(JSON.stringify(message));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  _startHeartbeat() {
+    this._stopHeartbeat();
+    this._heartbeatTimer = setInterval(() => {
+      if (this.ws?.readyState === WebSocket.OPEN) {
+        this.ws.send(JSON.stringify({ type: 'ping', ts: Date.now() }));
+      }
+    }, HEARTBEAT_INTERVAL);
+  }
+
+  _stopHeartbeat() {
+    if (this._heartbeatTimer) {
+      clearInterval(this._heartbeatTimer);
+      this._heartbeatTimer = null;
+    }
+  }
+
+  _scheduleReconnect() {
+    if (this._destroyed || this._reconnectTimer) return;
+    this._reconnectTimer = setTimeout(() => {
+      this._reconnectTimer = null;
+      if (!this._destroyed && this.state === STATES.MUTUAL) {
+        this.initiateKnock();
+      }
+    }, this._reconnectDelay);
+    this._reconnectDelay = Math.min(this._reconnectDelay * 2, MAX_RECONNECT_DELAY);
+  }
+
+  _cleanup() {
+    this._stopHeartbeat();
+    if (this.ws) {
+      try { this.ws.terminate(); } catch { /* */ }
+      this.ws = null;
+    }
+  }
+
+  destroy() {
+    this._destroyed = true;
+    clearTimeout(this._reconnectTimer);
+    clearTimeout(this._knockTimeout);
+    this._reconnectTimer = null;
+    this._knockTimeout = null;
+    this._cleanup();
+    this._setState(STATES.DISCONNECTED);
+    this.removeAllListeners();
+  }
+}
+
+export class ConnectionManager extends EventEmitter {
+  constructor(federation) {
+    super();
+    this.federation = federation;
+    this.daemon = federation.daemon;
+    this.connections = new Map(); // ip -> PeerConnection
+    this.inbound = new Map(); // daemonId -> ws (incoming connections from peers)
+  }
+
+  onMutual(ip, port, remoteDaemonId) {
+    if (this.connections.has(ip)) {
+      const existing = this.connections.get(ip);
+      if (existing.state === STATES.CONNECTED) return;
+      if (existing.state === STATES.KNOCKING) return;
+    }
+
+    const conn = this._getOrCreate(ip, port, remoteDaemonId);
+    conn.initiateKnock();
+  }
+
+  _getOrCreate(ip, port, remoteDaemonId) {
+    if (this.connections.has(ip)) {
+      const existing = this.connections.get(ip);
+      if (remoteDaemonId) existing.remoteDaemonId = remoteDaemonId;
+      return existing;
+    }
+
+    const conn = new PeerConnection(this, ip, port, remoteDaemonId);
+
+    conn.on('state-change', (info) => {
+      this.emit('state-change', info);
+      this.daemon.broadcast({ type: 'federation:connection', data: info });
+    });
+
+    conn.on('connected', (info) => {
+      this.federation.whitelist.setConnected(ip);
+      this.emit('connected', info);
+      this.daemon.audit.log('federation.connected', { ip, peerId: info.peerId });
+    });
+
+    conn.on('disconnected', (info) => {
+      this.federation.whitelist.setDisconnected(ip);
+      this.emit('disconnected', info);
+    });
+
+    conn.on('message', (msg) => {
+      this.emit('message', { ip, peerId: conn.peerId, message: msg });
+    });
+
+    this.connections.set(ip, conn);
+    return conn;
+  }
+
+  handleInboundConnection(ws, daemonId) {
+    this.inbound.set(daemonId, ws);
+    this.emit('inbound-connected', { daemonId });
+    this.daemon.audit.log('federation.inbound', { daemonId });
+
+    ws.on('message', (raw) => {
+      try {
+        const msg = JSON.parse(raw);
+        if (msg.type === 'ping') {
+          ws.send(JSON.stringify({ type: 'pong', ts: Date.now() }));
+          return;
+        }
+        this.emit('message', { daemonId, message: msg, inbound: true });
+      } catch { /* ignore */ }
+    });
+
+    ws.on('close', () => {
+      this.inbound.delete(daemonId);
+      this.emit('inbound-disconnected', { daemonId });
+    });
+  }
+
+  sendTo(peerIdentifier, message) {
+    // Try outbound first (by IP)
+    for (const [ip, conn] of this.connections) {
+      if (ip === peerIdentifier || conn.remoteDaemonId === peerIdentifier || conn.peerId === peerIdentifier) {
+        if (conn.send(message)) return true;
+      }
+    }
+    // Try inbound (by daemonId)
+    const inboundWs = this.inbound.get(peerIdentifier);
+    if (inboundWs?.readyState === WebSocket.OPEN) {
+      try {
+        inboundWs.send(JSON.stringify(message));
+        return true;
+      } catch { /* */ }
+    }
+    return false;
+  }
+
+  getStatus() {
+    const connections = [];
+    for (const [ip, conn] of this.connections) {
+      connections.push({
+        ip,
+        port: conn.port,
+        peerId: conn.peerId,
+        remoteDaemonId: conn.remoteDaemonId,
+        state: conn.state,
+        direction: 'outbound',
+      });
+    }
+    for (const [daemonId] of this.inbound) {
+      if (!connections.some(c => c.remoteDaemonId === daemonId)) {
+        connections.push({
+          peerId: daemonId,
+          remoteDaemonId: daemonId,
+          state: 'connected',
+          direction: 'inbound',
+        });
+      }
+    }
+    return connections;
+  }
+
+  destroy() {
+    for (const conn of this.connections.values()) {
+      conn.destroy();
+    }
+    this.connections.clear();
+    for (const ws of this.inbound.values()) {
+      try { ws.terminate(); } catch { /* */ }
+    }
+    this.inbound.clear();
+    this.removeAllListeners();
+  }
+}