groove-dev 0.27.217 → 0.27.220

package/node_modules/@groove-dev/gui/dist/index.html

@@ -6,7 +6,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="icon" type="image/png" href="/favicon.png" />
     <title>Groove GUI</title>
-    <script type="module" crossorigin src="/assets/index-DDdFdSWx.js"></script>
+    <script type="module" crossorigin src="/assets/index-BUmxCPjv.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-26L3JoZv.js">
     <link rel="modulepreload" crossorigin href="/assets/reactflow-DoBZjiHE.js">
     <link rel="modulepreload" crossorigin href="/assets/codemirror-BYKpdS2W.js">

package/node_modules/@groove-dev/gui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/gui",
-  "version": "0.27.217",
+  "version": "0.27.220",
   "description": "GROOVE GUI — visual agent control plane",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "groove-dev",
-  "version": "0.27.217",
+  "version": "0.27.220",
   "description": "Open-source agent orchestration layer — the AI company OS. Local model agent engine (GGUF/Ollama/llama-server), HuggingFace model browser, MCP integrations (Slack, Gmail, Stripe, 15+), agent scheduling (cron), business roles (CMO, CFO, EA). GUI dashboard, multi-agent coordination, zero cold-start, infinite sessions. Works with Claude Code, Codex, Gemini CLI, Ollama, any local model.",
   "license": "FSL-1.1-Apache-2.0",
   "author": "Groove Dev <hello@groovedev.ai> (https://groovedev.ai)",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.217",
+  "version": "0.27.220",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.217",
+  "version": "0.27.220",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/packages/daemon/src/providers/claude-code.js

@@ -43,11 +43,12 @@ export class ClaudeCodeProvider extends Provider {
     // FIRST model of a tier. Opus 5 stays first so auto-routing doesn't silently
     // move heavy agents onto the Fable price tier (2× Opus per token) — Fable is
     // an explicit user choice.
-    { id: 'claude-opus-5', name: 'Claude Opus 5', tier: 'heavy', contextWindow: 1_000_000 },
+    { id: 'claude-opus-5-5', name: 'Claude Opus 5.5', tier: 'heavy', contextWindow: 1_000_000 },
     { id: 'claude-fable-5-1', name: 'Claude Fable 5.1', tier: 'heavy', contextWindow: 1_000_000 },
     { id: 'claude-fable-5', name: 'Claude Fable 5', tier: 'heavy', contextWindow: 1_000_000 },
     { id: 'claude-opus-4-8', name: 'Claude Opus 4.8', tier: 'heavy', contextWindow: 1_000_000 },
     { id: 'claude-opus-4-6', name: 'Claude Opus 4.6', tier: 'heavy', contextWindow: 1_000_000 },
+    { id: 'claude-sonnet-5', name: 'Claude Sonnet 5', tier: 'medium', contextWindow: 1_000_000 },
     { id: 'claude-sonnet-4-6', name: 'Claude Sonnet 4.6', tier: 'medium', contextWindow: 200_000 },
     { id: 'claude-haiku-4-5-20251001', name: 'Claude Haiku 4.5', tier: 'light', contextWindow: 200_000 },
   ];

package/packages/daemon/src/terminal-pty.js

@@ -4,6 +4,7 @@
 import { spawn, execFileSync } from 'child_process';
 import { randomUUID } from 'crypto';
 import { existsSync } from 'fs';
+import { StringDecoder } from 'string_decoder';
 
 // Python helper that creates a real PTY and relays I/O through stdin/stdout pipes.
 // The shell sees a genuine TTY — prompts, colors, line editing, tab completion all work.
@@ -64,12 +65,22 @@ try:
             bel_pos = stdin_buf.find(ESC_END)
             if bel_pos == -1:
                 break
-            params = stdin_buf[4:bel_pos].decode().split(';')
-            if len(params) == 2:
-                r, c = int(params[0]), int(params[1])
-                fcntl.ioctl(master, termios.TIOCSWINSZ, struct.pack('HHHH', r, c, 0, 0))
-                os.kill(pid, signal.SIGWINCH)
+            # Only OUR resize command lives on this channel — no real terminal
+            # sends OSC 7 as keyboard input. A malformed one used to raise
+            # inside this loop, escape it, and take the whole shell down; now
+            # it is simply dropped (forwarding it would feed the shell's line
+            # editor a garbage key chord).
+            raw = stdin_buf[:bel_pos+1]
             stdin_buf = stdin_buf[bel_pos+1:]
+            try:
+                params = raw[4:-1].decode().split(';')
+                if len(params) == 2:
+                    r, c = int(params[0]), int(params[1])
+                    if 0 < r < 1000 and 0 < c < 1000:
+                        fcntl.ioctl(master, termios.TIOCSWINSZ, struct.pack('HHHH', r, c, 0, 0))
+                        os.kill(pid, signal.SIGWINCH)
+            except (ValueError, UnicodeDecodeError, OSError):
+                pass
         if master in rlist:
             try:
                 data = os.read(master, 4096)
@@ -128,16 +139,23 @@ export class TerminalManager {
     const session = { proc, ws, id, label: options.label || '' };
     this.sessions.set(id, session);
 
+    // The PTY relay hands us arbitrary 4096-byte slices, and a multi-byte UTF-8
+    // character (box drawing, emoji — TUI apps are full of them) can straddle a
+    // slice. Buffer.toString() on each slice independently turns every such
+    // character into U+FFFD garbage; a StringDecoder carries the partial byte
+    // sequence across chunks.
+    const outDecoder = new StringDecoder('utf8');
+    const errDecoder = new StringDecoder('utf8');
     proc.stdout.on('data', (data) => {
-      if (ws.readyState === 1) {
-        ws.send(JSON.stringify({ type: 'terminal:output', id, data: data.toString('utf8') }));
-      }
+      if (ws.readyState !== 1) return;
+      const text = outDecoder.write(data);
+      if (text) ws.send(JSON.stringify({ type: 'terminal:output', id, data: text }));
     });
 
     proc.stderr.on('data', (data) => {
-      if (ws.readyState === 1) {
-        ws.send(JSON.stringify({ type: 'terminal:output', id, data: data.toString('utf8') }));
-      }
+      if (ws.readyState !== 1) return;
+      const text = errDecoder.write(data);
+      if (text) ws.send(JSON.stringify({ type: 'terminal:output', id, data: text }));
     });
 
     proc.on('exit', (code) => {

package/packages/daemon/src/tunnel-manager.js

@@ -15,6 +15,20 @@ function getLocalVersion() {
   } catch { return '0.0.0'; }
 }
 
+// True only when `a` is strictly older than `b` (numeric x.y.z; any suffix such
+// as "-local" is ignored). Auto-upgrade must never move a remote BACKWARDS: a
+// box running a newer local build (promote-local.sh) than npm's latest would
+// otherwise be "upgraded" down to the published release on every connect.
+export function isOlderVersion(a, b) {
+  const parse = (v) => String(v || '').split('-')[0].split('.').map((n) => parseInt(n, 10) || 0);
+  const pa = parse(a), pb = parse(b);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0);
+    if (d !== 0) return d < 0;
+  }
+  return false;
+}
+
 const REMOTE_PORT = 31415;
 
 // Every remote `groove start` must run from the directory of the daemon's
@@ -665,13 +679,13 @@ export class TunnelManager {
         }).trim();
       } catch { return; }
 
-      if (!npmVer || npmVer === remoteVer) {
+      if (!npmVer || !isOlderVersion(remoteVer, npmVer)) {
         const localVer = getLocalVersion();
         this.daemon.broadcast({ type: 'tunnel.version-info', data: { id, localVersion: localVer, remoteVersion: remoteVer, match: remoteVer === localVer } });
         return;
       }
 
-      // Remote is behind npm — upgrade
+      // Remote is strictly behind npm — upgrade
       this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'upgrading', from: remoteVer, to: npmVer } });
 
       const target = `${config.user}@${config.host}`;