groove-dev 0.27.59 → 0.27.61

package/packages/gui/src/views/network.jsx

@@ -9,11 +9,11 @@ import { ScrollArea } from '../components/ui/scroll-area';
 import { cn } from '../lib/cn';
 import { NodeToggle } from '../components/network/node-toggle';
 import { ComputeHeader } from '../components/network/compute-header';
-import { FleetTable } from '../components/network/fleet-table';
+import { ActivityChart } from '../components/network/activity-chart';
 import { ActivityStream } from '../components/network/activity-stream';
 import { NetworkHealth } from '../components/network/network-health';
-import { HEX } from '../lib/theme-hex';
-import { Globe, Download, Check, AlertCircle, Loader2, Trash2, ArrowUpCircle } from 'lucide-react';
+import { HEX, hexAlpha } from '../lib/theme-hex';
+import { Globe, Download, Check, AlertCircle, Loader2, Trash2, ArrowUpCircle, Zap } from 'lucide-react';
 
 const REQUIREMENTS = [
   'Python 3.10 or higher',
@@ -312,6 +312,99 @@ function NetworkHeader() {
   );
 }
 
+function IdleHero() {
+  const node = useGrooveStore((s) => s.networkNode);
+  const networkStatus = useGrooveStore((s) => s.networkStatus);
+  const startNetworkNode = useGrooveStore((s) => s.startNetworkNode);
+  const [pending, setPending] = useState(false);
+
+  const hardware = node.hardware || {};
+  const activeNodes = (networkStatus.nodes || []).filter((n) => n.status === 'active').length;
+  const activeSessions = networkStatus.activeSessions || 0;
+
+  async function handleStart() {
+    setPending(true);
+    try { await startNetworkNode(); }
+    catch { /* toasted in store */ }
+    setPending(false);
+  }
+
+  return (
+    <div className="flex flex-col h-full">
+      <NetworkHeader />
+      <div
+        className="flex-1 flex items-center justify-center bg-surface-0"
+        style={{ background: `radial-gradient(ellipse at 50% 40%, ${hexAlpha(HEX.accent, 0.06)} 0%, transparent 70%) ${HEX.surface0}` }}
+      >
+        <div className="max-w-lg w-full px-6 flex flex-col items-center text-center">
+          <div
+            className="w-24 h-24 rounded-full flex items-center justify-center mb-6 mx-auto"
+            style={{
+              background: hexAlpha(HEX.accent, 0.08),
+              border: `1px solid ${hexAlpha(HEX.accent, 0.15)}`,
+              boxShadow: `0 0 40px ${hexAlpha(HEX.accent, 0.1)}`,
+            }}
+          >
+            <Globe size={56} className="text-accent" strokeWidth={1.25} />
+          </div>
+
+          <h2 className="text-xl font-semibold text-text-0 font-sans text-center">
+            Join the Groove Network
+          </h2>
+
+          <p className="text-sm text-text-2 font-sans text-center leading-relaxed mt-2 max-w-sm mx-auto">
+            Contribute your compute to power decentralized AI inference. Your hardware runs model shards alongside other nodes in the network.
+          </p>
+
+          <div className="mt-8 w-full">
+            <div className="text-2xs font-mono text-text-3 uppercase tracking-widest mb-2 text-left">Your Hardware</div>
+            <div className="grid grid-cols-3 gap-2">
+              <div className="bg-surface-1 rounded-sm border border-border-subtle px-4 py-3">
+                <div className="text-2xs font-mono text-text-4 uppercase tracking-wider">Device</div>
+                <div className="text-sm font-mono text-text-0 mt-1 truncate">{hardware.device || 'auto'}</div>
+              </div>
+              <div className="bg-surface-1 rounded-sm border border-border-subtle px-4 py-3">
+                <div className="text-2xs font-mono text-text-4 uppercase tracking-wider">Memory</div>
+                <div className="text-sm font-mono text-text-0 mt-1 truncate">{hardware.memory || '—'}</div>
+              </div>
+              <div className="bg-surface-1 rounded-sm border border-border-subtle px-4 py-3">
+                <div className="text-2xs font-mono text-text-4 uppercase tracking-wider">GPU</div>
+                <div className="text-sm font-mono text-text-0 mt-1 truncate">{hardware.gpu || 'None'}</div>
+              </div>
+            </div>
+          </div>
+
+          <div className="mt-6 w-full max-w-sm mx-auto">
+            <Button variant="primary" size="lg" onClick={handleStart} disabled={pending} className="w-full">
+              {pending ? (
+                <><Loader2 size={14} className="animate-spin" /> Connecting…</>
+              ) : (
+                <><Zap size={14} /> Start Contributing</>
+              )}
+            </Button>
+          </div>
+
+          <div className="mt-4 text-center text-2xs font-mono text-text-3">
+            {activeNodes > 0 || activeSessions > 0 ? (
+              <span>
+                <span className="text-accent">{activeNodes}</span> node{activeNodes !== 1 ? 's' : ''} online · {activeSessions} active session{activeSessions !== 1 ? 's' : ''}
+              </span>
+            ) : (
+              <span>Checking network status…</span>
+            )}
+          </div>
+
+          {node.nodeId && (
+            <div className="mt-6 text-center text-2xs font-mono text-text-4">
+              Node identity: {node.nodeId.length > 14 ? `${node.nodeId.slice(0, 6)}…${node.nodeId.slice(-4)}` : node.nodeId}
+            </div>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}
+
 export default function NetworkView() {
   const fetchNetworkNodeStatus = useGrooveStore((s) => s.fetchNetworkNodeStatus);
   const fetchNetworkStatus = useGrooveStore((s) => s.fetchNetworkStatus);
@@ -341,18 +434,7 @@ export default function NetworkView() {
   }
 
   if (!nodeActive) {
-    return (
-      <div className="flex flex-col h-full">
-        <NetworkHeader />
-        <ScrollArea className="flex-1">
-          <div className="flex items-center justify-center min-h-full px-6 py-12">
-            <div className="w-full max-w-md">
-              <NodeToggle />
-            </div>
-          </div>
-        </ScrollArea>
-      </div>
-    );
+    return <IdleHero />;
   }
 
   return (
@@ -361,10 +443,10 @@ export default function NetworkView() {
 
       <ComputeHeader />
 
-      <div className="flex-1 min-h-0 flex flex-col" style={{ background: '#282c34', gap: '1px' }}>
+      <div className="flex-1 min-h-0 flex flex-col" style={{ background: HEX.surface3, gap: '1px' }}>
         <div className="min-h-0 flex-1 grid" style={{ gridTemplateColumns: '3fr 1.5fr', gap: '0 1px' }}>
           <div className="min-w-0 min-h-0 overflow-hidden bg-surface-1">
-            <FleetTable />
+            <ActivityChart />
           </div>
           <div className="min-w-0 min-h-0 overflow-hidden bg-surface-1">
             <NetworkHealth />

package/default/fix-beta-endpoint-deployment.md

@@ -1,68 +0,0 @@
-# BUG: POST /api/beta/validate returns 404 — not deployed
-
-From: Groove UI Team
-To: groovedev.ai Team
-Date: 2026-04-18
-Priority: BLOCKING
-
-## The Problem
-
-The beta invite code validation endpoint is returning 404 from nginx. The route handler was built (routes/beta.js, mounted in server.js) but it's not reachable in production.
-
-```bash
-curl -s https://groovedev.ai/api/beta/validate \
-  -H 'Content-Type: application/json' \
-  -d '{"code":"GROOVE-NET-ALPHA-001","machineId":"test"}'
-```
-
-Returns:
-```html
-<center>nginx/1.24.0 (Ubuntu)</center>
-404
-```
-
-This is an nginx 404, not an app-level 404. The request never reaches the Node.js server.
-
-## What Should Happen
-
-The endpoint should return:
-```json
-{"valid": true, "expiresAt": "2026-07-18T00:00:00Z", "features": ["network-node", "network-consumer"], "message": "Welcome to the Groove Network beta"}
-```
-
-Or for invalid codes:
-```json
-{"valid": false, "message": "Invalid invite code"}
-```
-
-## Likely Causes
-
-1. Nginx isn't proxying /api/beta/* to the Node.js app — needs a location block or the existing proxy_pass doesn't cover this path
-2. The Node.js server isn't running or was restarted without the new routes
-3. The route is mounted at a different path than /api/beta/validate
-
-## What to Check
-
-1. Nginx config — does it proxy /api/* to the Node.js backend? If routes are whitelisted individually, add /api/beta/*
-2. Is the Node.js server running? Check with: `pm2 status` or `systemctl status groovedev` (whatever process manager is used)
-3. Did server.js get deployed with the beta route mount? Verify the deployed code includes: `app.use('/api/beta', betaRoutes)` or equivalent
-4. Test locally on the server: `curl http://localhost:<app-port>/api/beta/validate -H 'Content-Type: application/json' -d '{"code":"test","machineId":"test"}'` — if this works, it's purely an nginx issue
-
-## Impact
-
-Every Groove app trying to activate a beta invite code fails. We have a hardcoded fallback for 5 ALPHA codes, but any codes generated through the admin portal (like GROOVE-NET-SWIFT-899) are completely broken until this is fixed. Beta testers cannot activate.
-
-## Expected Nginx Config
-
-Something like this should work (adjust upstream port):
-```nginx
-location /api/beta/ {
-    proxy_pass http://127.0.0.1:3000;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-}
-```
-
-Or if there's already a catch-all /api/ proxy, make sure it's not being overridden by a more specific location block.

package/default/groovedev-beta-auth-endpoint.md

@@ -1,166 +0,0 @@
-# Groove Network Beta — Auth Endpoint Setup
-
-Instructions for setting up the invite code validation endpoint on groovedev.ai.
-
----
-
-## Endpoint
-
-```
-POST https://groovedev.ai/api/beta/validate
-```
-
-## Request
-
-```json
-{
-  "code": "GROOVE-NET-ALPHA-001",
-  "machineId": "sha256-of-hostname-and-mac"
-}
-```
-
-- `code` — the invite code the user entered
-- `machineId` — hashed machine identifier so you can track activations per device (the daemon already generates this for credential encryption)
-
-## Response — Valid Code
-
-```json
-{
-  "valid": true,
-  "expiresAt": "2026-07-18T00:00:00Z",
-  "features": ["network-node", "network-consumer"],
-  "message": "Welcome to the Groove Network beta"
-}
-```
-
-- `expiresAt` — when this code stops working (null = never expires)
-- `features` — which beta features this code unlocks (future-proofs for gating individual features)
-- `message` — optional message shown to the user on activation
-
-## Response — Invalid Code
-
-```json
-{
-  "valid": false,
-  "message": "Invalid invite code"
-}
-```
-
-HTTP 200 for both valid and invalid — don't leak info through status codes.
-
-## Response — Rate Limited
-
-```json
-{
-  "valid": false,
-  "message": "Too many attempts, try again later"
-}
-```
-
-HTTP 429. Rate limit: 5 attempts per IP per hour.
-
----
-
-## Code Management
-
-### Database Schema (or KV store, whatever groovedev.ai uses)
-
-```sql
-CREATE TABLE beta_codes (
-  code        TEXT PRIMARY KEY,
-  created_at  TIMESTAMP DEFAULT NOW(),
-  expires_at  TIMESTAMP,
-  max_uses    INTEGER DEFAULT 1,
-  used_count  INTEGER DEFAULT 0,
-  features    JSONB DEFAULT '["network-node", "network-consumer"]',
-  notes       TEXT
-);
-
-CREATE TABLE beta_activations (
-  id          SERIAL PRIMARY KEY,
-  code        TEXT REFERENCES beta_codes(code),
-  machine_id  TEXT,
-  activated_at TIMESTAMP DEFAULT NOW(),
-  ip_address  TEXT
-);
-```
-
-### Generating Codes
-
-Codes should be human-friendly, uppercase, with dashes. Format: `GROOVE-NET-<WORD>-<3 DIGITS>`
-
-Examples:
-- GROOVE-NET-ALPHA-001
-- GROOVE-NET-BETA-042
-- GROOVE-NET-EARLY-777
-
-Generate a batch to start:
-
-```sql
-INSERT INTO beta_codes (code, expires_at, max_uses, notes) VALUES
-  ('GROOVE-NET-ALPHA-001', '2026-07-18', 1, 'Rok - testing'),
-  ('GROOVE-NET-ALPHA-002', '2026-07-18', 1, 'Tommy'),
-  ('GROOVE-NET-ALPHA-003', '2026-07-18', 1, 'Reserved'),
-  ('GROOVE-NET-ALPHA-004', '2026-07-18', 1, 'Reserved'),
-  ('GROOVE-NET-ALPHA-005', '2026-07-18', 1, 'Reserved');
-```
-
-### Validation Logic
-
-```
-1. Look up code in beta_codes
-2. If not found → { valid: false }
-3. If expires_at < NOW() → { valid: false, message: "Code expired" }
-4. If used_count >= max_uses → { valid: false, message: "Code already used" }
-5. Insert into beta_activations
-6. Increment used_count
-7. Return { valid: true, expiresAt, features, message }
-```
-
-### Admin
-
-You'll want a way to:
-- Generate new codes (one-off or batch)
-- Revoke a code (delete or set expires_at to past)
-- See who activated (query beta_activations)
-- Set max_uses > 1 for codes you want to share more broadly
-
-A simple admin page at groovedev.ai/admin/beta or even just direct DB access works for now.
-
----
-
-## How the Daemon Uses This
-
-The daemon (packages/daemon/src/api.js) calls this endpoint when a user submits an invite code:
-
-```javascript
-// POST /api/beta/activate handler
-const response = await fetch('https://groovedev.ai/api/beta/validate', {
-  method: 'POST',
-  headers: { 'Content-Type': 'application/json' },
-  body: JSON.stringify({ code, machineId: daemon.getMachineId() })
-});
-const result = await response.json();
-
-if (result.valid) {
-  config.set('networkBeta.unlocked', true);
-  config.set('networkBeta.code', code);
-  config.set('networkBeta.features', result.features);
-  config.set('networkBeta.expiresAt', result.expiresAt);
-  daemon.broadcast({ type: 'config:updated' });
-}
-```
-
-Offline fallback: if the daemon can't reach groovedev.ai, it falls back to a hardcoded allowlist (the 5 ALPHA codes). This way beta testers aren't locked out by network issues. The hardcoded list gets removed when the server endpoint is live.
-
-Re-validation: on daemon startup, if networkBeta.unlocked is true, optionally re-validate the stored code against the server. If the code was revoked or expired, lock the feature. Don't block startup on this — do it async.
-
----
-
-## Security Notes
-
-- Never log the full code in server logs — log first 10 chars only
-- Rate limit by IP, not by code (prevents enumeration)
-- Codes are not passwords — they're single-use invites. No hashing needed, but don't expose the full list in any public API
-- The machineId is a hash, not PII — safe to store
-- HTTPS only, obviously

package/default/security-review-prompt.md

@@ -1,98 +0,0 @@
-# Security Review: Groove Network Integration
-
-You are auditing the Groove Network feature — a decentralized LLM inference network integrated into the Groove desktop app. This feature is beta-gated behind invite codes. Review all network-related code for security vulnerabilities and attack vectors.
-
-## Scope
-
-All code added in these commits (newest first):
-- daemon: switch network from relay to signal service
-- gui: handle signal_connected and matched WS events in network feed
-- daemon: spawn Python from venv so msgpack/torch are available
-- daemon: use python3.12 for brew Python
-- network: wire install/uninstall endpoints with progress broadcast
-- network: gate view on network package install
-- beta: validate invite codes against groovedev.ai with offline fallback
-- settings: hide groove-network provider from Settings UI
-- provider: default claude-code to Opus 4.6
-- network: add beta-gated Groove Network integration
-
-## Files to Review
-
-Daemon (packages/daemon/src/):
-- api.js — search for "Network" section (~lines 3720-4200): beta gate, invite code validation, node start/stop, install/uninstall, network status, version check/update endpoints
-- providers/groove-network.js — provider that spawns Python consumer subprocess
-- providers/index.js — provider registration
-- index.js — networkNode state, startup re-validation
-- firstrun.js — networkBeta config defaults
-
-GUI (packages/gui/src/):
-- views/network.jsx — install gate, main network view
-- views/settings.jsx — Early Access invite code section
-- stores/groove.js — networkUnlocked state, install/update progress, WebSocket handlers
-- components/network/* — NodeToggle, NetworkStatus, NodeDetails
-- components/layout/activity-bar.jsx — conditional Globe icon
-
-## Threat Model
-
-The feature involves:
-1. An invite code system validating against a remote server (groovedev.ai)
-2. Cloning a GitHub repo to the user's machine and running a setup script
-3. Spawning Python subprocesses that connect outbound to a signal service (signal.groovedev.ai)
-4. WebSocket connections to an external service carrying msgpack-encoded inference data
-5. Ethereum-style keypair stored at ~/.groove/node_key.json
-6. Config persistence with unlocked state, codes, and paths
-
-## Attack Vectors to Investigate
-
-### Code Execution & Injection
-- Can the install endpoint be tricked into cloning a malicious repo? (repo URL hardcoded or configurable?)
-- Does setup.sh run with proper sandboxing? What if the repo contents are compromised?
-- Are Python spawn commands safe from injection? (check all spawn() calls use array args, not shell strings)
-- Can the deployPath config value be manipulated to point outside ~/.groove/?
-- Is the git clone --depth 1 safe from git-specific attacks?
-
-### Authentication & Authorization
-- Can the beta gate be bypassed? (check all /api/network/* endpoints go through networkGate)
-- Is the hardcoded fallback code list a risk? (codes visible in source)
-- Can invite codes be brute-forced? (rate limiting — daemon side and server side)
-- Is the machineId derivation stable and non-spoofable?
-- Can a deactivated user re-activate by manipulating local config?
-
-### Network Security
-- Is the WebSocket connection to signal.groovedev.ai using TLS? (wss:// vs ws://)
-- Can a MITM intercept inference data between node and signal?
-- Is the signal URL validated? Can it be pointed to a malicious server via config manipulation?
-- Are there SSRF risks from the network status fetch?
-- Does the daemon properly validate responses from groovedev.ai and signal.groovedev.ai?
-
-### Data Security
-- Is the node keypair (~/.groove/node_key.json) properly protected? (file permissions)
-- Is the private key ever exposed via API endpoints or logs?
-- Are invite codes logged in full or truncated?
-- Can the API credentials endpoint leak the beta code?
-- Is config.networkBeta.code exposed in GET /api/config?
-
-### Denial of Service
-- Can the install/update endpoints be called repeatedly to exhaust disk?
-- Is there a limit on networkEvents array growth?
-- Can the node process be spawned multiple times simultaneously?
-- Does the version check cache actually prevent GitHub API abuse?
-
-### Filesystem Safety
-- Does uninstall properly scope deletion to ~/.groove/network/?
-- Can path traversal in deployPath escape the intended directory?
-- Are there symlink attacks possible in the install path?
-- Does rmSync with recursive: true risk deleting unintended files?
-
-### Supply Chain
-- The install clones from GitHub — is the repo URL hardcoded or injectable?
-- Is the tag pinned or can an attacker push a malicious tag?
-- setup.sh runs arbitrary shell — what if the repo is compromised?
-
-## Deliverables
-
-1. List every vulnerability found with severity (critical/high/medium/low)
-2. For each: describe the attack, the affected file and line number, and the fix
-3. Flag any patterns that are risky even if not immediately exploitable
-4. Confirm which security measures are already in place and working correctly
-5. Commit all fixes