groove-dev 0.27.50 → 0.27.52

package/node_modules/@groove-dev/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.50",
+  "version": "0.27.52",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.50",
+  "version": "0.27.52",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/src/api.js

@@ -3866,7 +3866,14 @@ Keep responses concise. Help them think, don't lecture them about the system the
   // so revoked or expired codes lock the feature automatically. Non-blocking.
   daemon.revalidateBetaCode = async function revalidateBetaCode() {
     const cfg = daemon.config?.networkBeta;
-    if (!cfg?.unlocked || !cfg?.code) return;
+    if (!cfg?.unlocked) return;
+    if (!cfg?.code) {
+      daemon.config.networkBeta = { ...cfg, unlocked: false, expiresAt: null, features: [] };
+      await persistConfig();
+      daemon.audit.log('beta.revoked', { reason: 'missing code' });
+      daemon.broadcast({ type: 'config:updated' });
+      return;
+    }
     const remote = await validateCodeWithServer(cfg.code);
     // If we couldn't reach the server, keep the current unlocked state —
     // network failures must not lock out beta users.
@@ -3999,7 +4006,7 @@ Keep responses concise. Help them think, don't lecture them about the system the
     }
 
     const cfg = daemon.config.networkBeta || {};
-    const signal = cfg.signalUrl || 'signal.groovedev.ai';
+    const signal = stripScheme(cfg.signalUrl);
     if (!isAllowedSignalHost(signal)) {
       return res.status(400).json({ error: 'Invalid signal host' });
     }
@@ -4017,18 +4024,22 @@ Keep responses concise. Help them think, don't lecture them about the system the
     if (!existsSync(deployPath)) {
       return res.status(400).json({ error: `Deploy path not found: ${deployPath}` });
     }
+    if (!isInsideGrooveHome(deployPath) && !deployPath.startsWith(resolve(process.env.HOME || '', 'Desktop'))) {
+      return res.status(400).json({ error: 'Deploy path outside allowed directories' });
+    }
 
     const signalFlag = supportsSignalFlag(cfg.version) ? '--signal' : '--relay';
     const args = [
       '-m', 'src.node.server',
       signalFlag, signal,
+      '--tls',
       '--device', device,
       '--max-context', String(maxContext),
     ];
 
     let proc;
     try {
-      proc = spawn(join(deployPath, 'venv', 'bin', 'python3.12'), args, {
+      proc = spawn(join(deployPath, 'venv', 'bin', 'python3'), args, {
         cwd: deployPath,
         env: { ...process.env, PYTHONUNBUFFERED: '1' },
         stdio: ['ignore', 'pipe', 'pipe'],
@@ -4063,7 +4074,33 @@ Keep responses concise. Help them think, don't lecture them about the system the
         stderrBuf = stderrBuf.slice(idx + 1);
         if (!line) continue;
         if (line[0] !== '{') {
+          // Python node emits plain-text logs like "Node identity: abc123",
+          // "shard loaded: layers 0-12", "registered with signal". Parse those
+          // here so the GUI reflects reality even without structured logging.
+          let changed = false;
+          const idMatch = line.match(/Node identity:\s*([A-Za-z0-9_\-:.]+)/i);
+          if (idMatch && idMatch[1] !== daemon.networkNode.nodeId) {
+            daemon.networkNode.nodeId = idMatch[1]; changed = true;
+          }
+          const layerMatch = line.match(/layers?\s*(\d+)\s*[-–to]+\s*(\d+)/i);
+          if (layerMatch) {
+            const start = parseInt(layerMatch[1], 10);
+            const end = parseInt(layerMatch[2], 10);
+            if (Number.isFinite(start) && Number.isFinite(end)) {
+              daemon.networkNode.layers = [start, end]; changed = true;
+            }
+          }
+          const modelMatch = line.match(/model[:\s]+([A-Za-z0-9_\-./]+\/[A-Za-z0-9_\-.]+)/i);
+          if (modelMatch && modelMatch[1] !== daemon.networkNode.model) {
+            daemon.networkNode.model = modelMatch[1]; changed = true;
+          }
+          if (/\bregistered\b/i.test(line) || /\bconnected\b/i.test(line)) {
+            if (daemon.networkNode.status !== 'connected') {
+              daemon.networkNode.status = 'connected'; changed = true;
+            }
+          }
           pushNodeEvent('log', { line });
+          if (changed) broadcastNodeStatus();
           continue;
         }
         let entry;
@@ -4138,10 +4175,18 @@ Keep responses concise. Help them think, don't lecture them about the system the
   });
 
   function isAllowedSignalHost(host) {
-    const h = (host || '').replace(/^https?:\/\//i, '').replace(/\/.*$/, '').toLowerCase();
+    const h = (host || '').replace(/^(wss?|https?):\/\//i, '').replace(/\/.*$/, '').toLowerCase();
     return h === 'signal.groovedev.ai' || h.endsWith('.groovedev.ai');
   }
 
+  // The Python node/client code prepends the scheme itself from `--tls`.
+  // Daemon must pass a BARE host to --relay/--signal; otherwise the Python
+  // side ends up with a double-scheme URI like wss://wss://host.
+  function stripScheme(url) {
+    if (!url) return 'signal.groovedev.ai';
+    return url.replace(/^wss?:\/\//i, '').replace(/\/.*$/, '');
+  }
+
   app.get('/api/network/status', networkGate, async (req, res) => {
     const cfg = daemon.config.networkBeta || {};
     const signalHost = cfg.signalUrl || 'signal.groovedev.ai';
@@ -4150,9 +4195,8 @@ Keep responses concise. Help them think, don't lecture them about the system the
       return res.status(400).json({ error: 'Invalid signal host' });
     }
 
-    const statusUrl = /^https?:\/\//i.test(signalHost)
-      ? `${signalHost.replace(/\/$/, '')}/status`
-      : `https://${signalHost}/status`;
+    const bareHost = signalHost.replace(/^(wss?|https?):\/\//i, '').replace(/\/.*$/, '');
+    const statusUrl = `https://${bareHost}/status`;
 
     try {
       const controller = new AbortController();
@@ -4161,7 +4205,70 @@ Keep responses concise. Help them think, don't lecture them about the system the
       clearTimeout(timer);
       if (r.ok) {
         const data = await r.json();
-        return res.json(data);
+        // Signal service returns snake_case; GUI expects camelCase.
+        const models = Array.isArray(data.models) ? data.models.map((m) => {
+          if (!m || typeof m !== 'object') return m;
+          const { covered_layers, total_layers, ...rest } = m;
+          return {
+            ...rest,
+            ...(covered_layers !== undefined ? { coveredLayers: covered_layers } : {}),
+            ...(total_layers !== undefined ? { totalLayers: total_layers } : {}),
+          };
+        }) : [];
+        const primaryModel = Array.isArray(data.models) && data.models[0] ? data.models[0] : {};
+
+        // Enrich local node state from signal's authoritative topology.
+        // Signal truncates IDs (e.g. "0xf608fd..."), so match by prefix.
+        if (daemon.networkNode?.active && daemon.networkNode.nodeId) {
+          const selfId = daemon.networkNode.nodeId;
+          const signalNodes = Array.isArray(data.nodes) ? data.nodes : [];
+          const self = signalNodes.find((n) => {
+            const nid = n.node_id || n.nodeId || '';
+            const prefix = nid.replace(/\.{2,}$/, '');
+            return selfId === nid || (prefix.length >= 6 && selfId.startsWith(prefix));
+          });
+          let changed = false;
+          if (self) {
+            if (Array.isArray(self.layers) && self.layers.length === 2) {
+              daemon.networkNode.layers = self.layers;
+              changed = true;
+            }
+            if (self.device) {
+              daemon.networkNode.hardware = {
+                device: self.device,
+                memory: daemon.networkNode.hardware?.memory || null,
+                gpu: daemon.networkNode.hardware?.gpu || null,
+              };
+              changed = true;
+            }
+          }
+          const availModel = Array.isArray(data.models)
+            ? data.models.find((m) => m && m.available !== false)
+            : null;
+          if (availModel && !daemon.networkNode.model) {
+            daemon.networkNode.model = availModel.name || null;
+            changed = true;
+          }
+          if (changed) broadcastNodeStatus();
+        }
+
+        const capStr = (s, max = 200) => (typeof s === 'string' ? s.slice(0, max) : s);
+        const safeNodes = (Array.isArray(data.nodes) ? data.nodes : []).map((n) => ({
+          node_id: capStr(n.node_id || n.nodeId),
+          device: capStr(n.device),
+          layers: Array.isArray(n.layers) ? n.layers.slice(0, 2) : n.layers,
+          status: capStr(n.status, 50),
+          active_sessions: n.active_sessions ?? 0,
+        }));
+
+        return res.json({
+          nodes: safeNodes,
+          models,
+          coverage: data.covered_layers ?? primaryModel.covered_layers ?? data.coverage ?? 0,
+          totalLayers: data.total_layers ?? primaryModel.total_layers ?? data.totalLayers ?? 24,
+          activeSessions: data.active_sessions ?? data.activeSessions ?? 0,
+          totalNodes: data.total_nodes ?? data.totalNodes ?? (Array.isArray(data.nodes) ? data.nodes.length : 0),
+        });
       }
     } catch { /* fall through to local snapshot */ }
 
@@ -4180,13 +4287,14 @@ Keep responses concise. Help them think, don't lecture them about the system the
       coverage,
       totalLayers: 24,
       activeSessions: node.sessions || 0,
+      totalNodes: selfNode.length,
     });
   });
 
   // --- Network package install/uninstall ---
 
   const NETWORK_REPO_URL = 'https://github.com/grooveai-dev/groove-network.git';
-  const NETWORK_VERSION = 'v0.1.0';
+  const NETWORK_VERSION = 'v0.2.0';
 
   function networkRoot() {
     return resolve(homedir(), '.groove', 'network');
@@ -4260,18 +4368,27 @@ Keep responses concise. Help them think, don't lecture them about the system the
       };
 
       try {
-        // Build clone URL with optional PAT
         const pat = daemon.credentials?.getKey?.('github-pat') || null;
-        const cloneUrl = pat
-          ? NETWORK_REPO_URL.replace('https://', `https://${pat}@`)
-          : NETWORK_REPO_URL;
 
-        broadcastInstallProgress('cloning', 'Cloning network package...', 0);
+        let installVersion;
+        try {
+          installVersion = (await getLatestNetworkTag()) || NETWORK_VERSION;
+        } catch {
+          installVersion = NETWORK_VERSION;
+        }
+
+        broadcastInstallProgress('cloning', `Cloning network package ${installVersion}...`, 0);
 
-        const cloneArgs = ['clone', '--branch', NETWORK_VERSION, '--depth', '1', cloneUrl, installPath];
+        const cloneArgs = ['clone', '--branch', installVersion, '--depth', '1', NETWORK_REPO_URL, installPath];
+        const cloneEnv = { ...process.env, GIT_TERMINAL_PROMPT: '0' };
+        if (pat) {
+          cloneEnv.GIT_CONFIG_COUNT = '1';
+          cloneEnv.GIT_CONFIG_KEY_0 = 'http.extraHeader';
+          cloneEnv.GIT_CONFIG_VALUE_0 = `Authorization: token ${pat}`;
+        }
         const clone = spawn('git', cloneArgs, {
           stdio: ['ignore', 'pipe', 'pipe'],
-          env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+          env: cloneEnv,
         });
 
         const stripCredentials = (s) => s.replace(/https:\/\/[^@]+@/g, 'https://***@');
@@ -4344,12 +4461,12 @@ Keep responses concise. Help them think, don't lecture them about the system the
           ...(daemon.config.networkBeta || {}),
           installed: true,
           deployPath: installPath,
-          version: NETWORK_VERSION,
+          version: installVersion,
         };
         await persistConfig();
         daemon.broadcast({ type: 'config:updated' });
-        broadcastInstallProgress('done', 'Network package installed', 100);
-        daemon.audit.log('network.install', { path: installPath, version: NETWORK_VERSION });
+        broadcastInstallProgress('done', `Network package ${installVersion} installed`, 100);
+        daemon.audit.log('network.install', { path: installPath, version: installVersion });
         daemon.networkInstall = { running: false };
       } catch (err) {
         fail(err?.message || 'Install failed');

package/node_modules/@groove-dev/daemon/src/firstrun.js

@@ -155,5 +155,5 @@ export function loadConfig(grooveDir) {
 }
 
 export function saveConfig(grooveDir, config) {
-  writeFileSync(resolve(grooveDir, 'config.json'), JSON.stringify(config, null, 2));
+  writeFileSync(resolve(grooveDir, 'config.json'), JSON.stringify(config, null, 2), { mode: 0o600 });
 }

package/node_modules/@groove-dev/daemon/src/process.js

@@ -740,7 +740,7 @@ For normal file edits within your scope, proceed without review.
     }
 
     const spawnCmd = provider.buildSpawnCommand(spawnConfig);
-    const { command, args, env, stdin: stdinData } = spawnCmd;
+    const { command, args, env, stdin: stdinData, cwd: providerCwd } = spawnCmd;
 
     // Log the spawn command (mask anything that looks like an API key)
     const maskArg = (a) => /^(sk-|AIza|key-|token-)/.test(a) ? '***' : a;
@@ -765,7 +765,7 @@ For normal file edits within your scope, proceed without review.
 
     // Spawn the process (use pipe for stdin if provider needs to send prompt via stdin)
     const proc = cpSpawn(command, args, {
-      cwd: agent.workingDir || this.daemon.projectDir,
+      cwd: providerCwd || agent.workingDir || this.daemon.projectDir,
       env: { ...process.env, ...env, ...integrationEnv, GROOVE_AGENT_ID: agent.id, GROOVE_AGENT_NAME: agent.name, GROOVE_DAEMON_HOST: this.daemon.host || '127.0.0.1', GROOVE_DAEMON_PORT: String(this.daemon.port || 31415) },
       stdio: [stdinData ? 'pipe' : 'ignore', 'pipe', 'pipe'],
       detached: false,

package/node_modules/@groove-dev/daemon/src/providers/groove-network.js

@@ -58,10 +58,23 @@ function signalFlagName() {
   return supportsSignalFlag(cfg.version) ? '--signal' : '--relay';
 }
 
+// The Python client prepends the scheme itself — daemon passes a bare host
+// and adds `--tls` to request wss://. Strip any ws:// or wss:// a user may
+// have left in the stored signalUrl (e.g. from an older daemon default).
+function stripScheme(url) {
+  if (!url) return 'signal.groovedev.ai';
+  return url.replace(/^wss?:\/\//i, '').replace(/\/.*$/, '');
+}
+
+function isAllowedSignalHost(host) {
+  const h = (host || '').replace(/^(wss?|https?):\/\//i, '').replace(/\/.*$/, '').toLowerCase();
+  return h === 'signal.groovedev.ai' || h.endsWith('.groovedev.ai');
+}
+
 export class GrooveNetworkProvider extends Provider {
   static name = 'groove-network';
   static displayName = 'Groove Network';
-  static command = 'python3.12';
+  static command = 'python3';
   static authType = 'none';
 
   static models = [
@@ -79,7 +92,8 @@ export class GrooveNetworkProvider extends Provider {
 
   buildSpawnCommand(agent) {
     const cfg = getConfig() || {};
-    const signal = cfg.signalUrl || 'signal.groovedev.ai';
+    const signal = stripScheme(cfg.signalUrl);
+    if (!isAllowedSignalHost(signal)) throw new Error('Invalid signal host');
     const model = agent.model || GrooveNetworkProvider.models[0].id;
     const maxTokens = agent.maxTokens || 500;
     const prompt = agent.prompt || '';
@@ -89,6 +103,7 @@ export class GrooveNetworkProvider extends Provider {
     const args = [
       '-m', 'src.consumer.client',
       signalFlagName(), signal,
+      '--tls',
       '--model', model,
       '--prompt', prompt,
       '--max-tokens', String(maxTokens),
@@ -96,7 +111,7 @@ export class GrooveNetworkProvider extends Provider {
     ];
 
     return {
-      command: join(deployPath, 'venv', 'bin', 'python3.12'),
+      command: join(deployPath, 'venv', 'bin', 'python3'),
       args,
       env: { PYTHONUNBUFFERED: '1' },
       cwd: deployPath,
@@ -105,14 +120,16 @@ export class GrooveNetworkProvider extends Provider {
 
   buildHeadlessCommand(prompt, model) {
     const cfg = getConfig() || {};
-    const signal = cfg.signalUrl || 'signal.groovedev.ai';
+    const signal = stripScheme(cfg.signalUrl);
+    if (!isAllowedSignalHost(signal)) throw new Error('Invalid signal host');
     const m = model || GrooveNetworkProvider.models[0].id;
     const deployPath = expandHome(cfg.deployPath) || resolve(homedir(), 'Desktop/groove-deploy');
     return {
-      command: join(deployPath, 'venv', 'bin', 'python3.12'),
+      command: join(deployPath, 'venv', 'bin', 'python3'),
       args: [
         '-m', 'src.consumer.client',
         signalFlagName(), signal,
+        '--tls',
         '--model', m,
         '--prompt', prompt,
         '--max-tokens', '500',