groove-dev 0.27.8 → 0.27.11

package/node_modules/@groove-dev/daemon/src/tunnel-manager.js

@@ -0,0 +1,504 @@
+// GROOVE — Tunnel Manager (SSH remote access)
+// FSL-1.1-Apache-2.0 — see LICENSE
+
+import { execFileSync, spawn } from 'child_process';
+import { existsSync, writeFileSync, readFileSync, statSync } from 'fs';
+import { resolve } from 'path';
+import { createConnection } from 'net';
+import crypto from 'crypto';
+
+const REMOTE_PORT = 31415;
+const DEFAULT_LOCAL_PORT = 31416;
+const MAX_PORT_ATTEMPTS = 10;
+const HEALTH_INTERVAL = 30000;
+const HEALTH_TIMEOUT = 5000;
+const MAX_FAIL_COUNT = 3;
+
+const INJECTION_CHARS = /[;|&`$(){}[\]<>!#\n\r\\]/;
+
+function validateField(value, name) {
+  if (!value || typeof value !== 'string' || !value.trim()) {
+    throw new Error(`${name} is required`);
+  }
+  if (INJECTION_CHARS.test(value)) {
+    throw new Error(`Invalid characters in ${name}`);
+  }
+}
+
+export class TunnelManager {
+  constructor(daemon) {
+    this.daemon = daemon;
+    this.remotesPath = resolve(daemon.grooveDir, 'remotes.json');
+    this.saved = new Map();
+    this.active = new Map();
+    this._healthInterval = null;
+    this._load();
+  }
+
+  _load() {
+    try {
+      if (existsSync(this.remotesPath)) {
+        const data = JSON.parse(readFileSync(this.remotesPath, 'utf8'));
+        if (Array.isArray(data)) {
+          for (const entry of data) {
+            if (entry && entry.id) this.saved.set(entry.id, entry);
+          }
+        }
+      }
+    } catch { /* ignore corrupt file */ }
+  }
+
+  _save() {
+    writeFileSync(
+      this.remotesPath,
+      JSON.stringify(Array.from(this.saved.values()), null, 2),
+      { mode: 0o600 }
+    );
+  }
+
+  getSaved() {
+    return Array.from(this.saved.values()).map(s => ({
+      ...s,
+      active: this.active.has(s.id),
+      ...(this.active.get(s.id) || {}),
+    }));
+  }
+
+  save({ name, host, user, port, sshKeyPath, autoStart, autoConnect }) {
+    validateField(name, 'name');
+    validateField(host, 'host');
+    validateField(user, 'user');
+
+    const p = port != null ? Number(port) : 22;
+    if (!Number.isInteger(p) || p < 1 || p > 65535) {
+      throw new Error('port must be a number between 1 and 65535');
+    }
+
+    if (sshKeyPath) {
+      if (!existsSync(sshKeyPath)) {
+        throw new Error(`SSH key not found: ${sshKeyPath}`);
+      }
+      if (!statSync(sshKeyPath).isFile()) {
+        throw new Error('sshKeyPath must be a file, not a directory');
+      }
+    }
+
+    const id = crypto.randomUUID().slice(0, 8);
+    const entry = {
+      id,
+      name: name.trim(),
+      host: host.trim(),
+      user: user.trim(),
+      port: p,
+      sshKeyPath: sshKeyPath || null,
+      autoStart: !!autoStart,
+      autoConnect: !!autoConnect,
+      createdAt: new Date().toISOString(),
+    };
+
+    this.saved.set(id, entry);
+    this._save();
+    this.daemon.audit.log('tunnel.save', { id, name: entry.name, host: entry.host });
+    return entry;
+  }
+
+  update(id, config) {
+    const existing = this.saved.get(id);
+    if (!existing) throw new Error(`Remote ${id} not found`);
+
+    const merged = { ...existing };
+
+    if (config.name !== undefined) {
+      validateField(config.name, 'name');
+      merged.name = config.name.trim();
+    }
+    if (config.host !== undefined) {
+      validateField(config.host, 'host');
+      merged.host = config.host.trim();
+    }
+    if (config.user !== undefined) {
+      validateField(config.user, 'user');
+      merged.user = config.user.trim();
+    }
+    if (config.port !== undefined) {
+      const p = Number(config.port);
+      if (!Number.isInteger(p) || p < 1 || p > 65535) {
+        throw new Error('port must be a number between 1 and 65535');
+      }
+      merged.port = p;
+    }
+    if (config.sshKeyPath !== undefined) {
+      if (config.sshKeyPath) {
+        if (!existsSync(config.sshKeyPath)) {
+          throw new Error(`SSH key not found: ${config.sshKeyPath}`);
+        }
+        if (!statSync(config.sshKeyPath).isFile()) {
+          throw new Error('sshKeyPath must be a file, not a directory');
+        }
+        merged.sshKeyPath = config.sshKeyPath;
+      } else {
+        merged.sshKeyPath = null;
+      }
+    }
+    if (config.autoStart !== undefined) merged.autoStart = !!config.autoStart;
+    if (config.autoConnect !== undefined) merged.autoConnect = !!config.autoConnect;
+
+    this.saved.set(id, merged);
+    this._save();
+    this.daemon.audit.log('tunnel.update', { id, keys: Object.keys(config) });
+    return merged;
+  }
+
+  delete(id) {
+    if (!this.saved.has(id)) throw new Error(`Remote ${id} not found`);
+    if (this.active.has(id)) this.disconnect(id);
+    const name = this.saved.get(id).name;
+    this.saved.delete(id);
+    this._save();
+    this.daemon.audit.log('tunnel.delete', { id, name });
+  }
+
+  async test(id) {
+    const config = this.saved.get(id);
+    if (!config) throw new Error(`Remote ${id} not found`);
+
+    const target = `${config.user}@${config.host}`;
+    const keyArgs = config.sshKeyPath ? ['-i', config.sshKeyPath] : [];
+
+    try {
+      const result = execFileSync('ssh', [
+        ...keyArgs,
+        '-p', String(config.port || 22),
+        '-o', 'ConnectTimeout=10',
+        '-o', 'StrictHostKeyChecking=accept-new',
+        '-o', 'BatchMode=yes',
+        target,
+        `curl -sf http://localhost:${REMOTE_PORT}/api/health 2>/dev/null || (which groove >/dev/null 2>&1 && echo __GROOVE_STOPPED__ || echo __GROOVE_NOT_INSTALLED__)`,
+      ], {
+        encoding: 'utf8',
+        timeout: 20000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+
+      if (result.includes('__GROOVE_NOT_INSTALLED__')) {
+        return { reachable: true, daemonRunning: false, grooveInstalled: false };
+      }
+      if (result.includes('__GROOVE_STOPPED__')) {
+        return { reachable: true, daemonRunning: false, grooveInstalled: true };
+      }
+      return { reachable: true, daemonRunning: true, grooveInstalled: true };
+    } catch (err) {
+      const stderr = err.stderr?.toString() || '';
+      if (stderr.includes('Permission denied')) {
+        return { reachable: false, error: 'SSH authentication failed' };
+      }
+      if (stderr.includes('Connection refused') || stderr.includes('Connection timed out') || stderr.includes('No route to host')) {
+        return { reachable: false, error: 'Host unreachable' };
+      }
+      return { reachable: false, error: err.message };
+    }
+  }
+
+  async connect(id) {
+    const config = this.saved.get(id);
+    if (!config) throw new Error(`Remote ${id} not found`);
+
+    if (this.active.has(id)) {
+      const existing = this.active.get(id);
+      return { localPort: existing.localPort, pid: existing.pid };
+    }
+
+    const testResult = await this.test(id);
+    if (!testResult.reachable) {
+      throw new Error(testResult.error || 'Host unreachable');
+    }
+
+    if (!testResult.daemonRunning && !testResult.grooveInstalled) {
+      this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'installing' } });
+      await this.remoteInstall(id);
+    } else if (!testResult.daemonRunning && testResult.grooveInstalled) {
+      this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'starting' } });
+      await this.autoStart(id);
+    }
+
+    const localPort = await this._findAvailablePort();
+    const target = `${config.user}@${config.host}`;
+    const keyArgs = config.sshKeyPath ? ['-i', config.sshKeyPath] : [];
+
+    const sshArgs = [
+      '-N',
+      '-L', `127.0.0.1:${localPort}:localhost:${REMOTE_PORT}`,
+      '-p', String(config.port || 22),
+      '-o', 'ServerAliveInterval=30',
+      '-o', 'ServerAliveCountMax=3',
+      '-o', 'ExitOnForwardFailure=yes',
+      '-o', 'StrictHostKeyChecking=accept-new',
+      ...keyArgs,
+      target,
+    ];
+
+    const tunnel = spawn('ssh', sshArgs, {
+      stdio: ['ignore', 'ignore', 'pipe'],
+      detached: true,
+    });
+
+    let stderrBuf = '';
+    tunnel.stderr.on('data', (chunk) => { stderrBuf += chunk.toString(); });
+
+    await new Promise((r) => setTimeout(r, 2000));
+
+    if (tunnel.exitCode !== null) {
+      throw new Error(`Tunnel failed to start: ${stderrBuf.trim() || 'unknown error'}`);
+    }
+
+    const tunnelUp = await this._isPortInUse(localPort);
+    if (!tunnelUp) {
+      try { process.kill(tunnel.pid); } catch { /* ignore */ }
+      throw new Error('Tunnel started but port forward not active');
+    }
+
+    tunnel.unref();
+
+    this.active.set(id, {
+      pid: tunnel.pid,
+      localPort,
+      startedAt: new Date().toISOString(),
+      lastPing: Date.now(),
+      latencyMs: null,
+      healthy: true,
+      failCount: 0,
+    });
+
+    const url = `http://localhost:${localPort}?instance=${encodeURIComponent(config.name)}`;
+
+    this.daemon.audit.log('tunnel.connect', { id, name: config.name, host: config.host, localPort });
+    this.daemon.broadcast({ type: 'tunnel.connected', data: { id, name: config.name, localPort, host: config.host, url } });
+
+    if (!this._healthInterval) {
+      this._healthInterval = setInterval(() => this._healthCheckAll(), HEALTH_INTERVAL);
+    }
+
+    return { localPort, pid: tunnel.pid, name: config.name, url };
+  }
+
+  async disconnect(id) {
+    const conn = this.active.get(id);
+    if (!conn) return;
+
+    const { pid } = conn;
+    try {
+      const cmd = execFileSync('ps', ['-p', String(pid), '-o', 'command='], {
+        encoding: 'utf8',
+        timeout: 3000,
+      }).trim();
+      if (cmd.includes('ssh')) {
+        process.kill(pid, 'SIGTERM');
+      }
+    } catch { /* process already dead */ }
+
+    this.active.delete(id);
+
+    const config = this.saved.get(id);
+    this.daemon.audit.log('tunnel.disconnect', { id, name: config?.name });
+    this.daemon.broadcast({ type: 'tunnel.disconnected', data: { id, name: config?.name } });
+
+    if (this.active.size === 0 && this._healthInterval) {
+      clearInterval(this._healthInterval);
+      this._healthInterval = null;
+    }
+  }
+
+  async autoStart(id) {
+    const config = this.saved.get(id);
+    if (!config) throw new Error(`Remote ${id} not found`);
+
+    const target = `${config.user}@${config.host}`;
+    const keyArgs = config.sshKeyPath ? ['-i', config.sshKeyPath] : [];
+
+    try {
+      const result = execFileSync('ssh', [
+        ...keyArgs,
+        '-p', String(config.port || 22),
+        '-o', 'ConnectTimeout=10',
+        '-o', 'BatchMode=yes',
+        target,
+        `bash -lc 'nohup groove start > /tmp/groove-daemon.log 2>&1 < /dev/null & disown; sleep 4; curl -sf http://localhost:${REMOTE_PORT}/api/health > /dev/null && echo __DAEMON_OK__ || echo __DAEMON_FAIL__'`,
+      ], {
+        encoding: 'utf8',
+        timeout: 45000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+
+      if (result.includes('__DAEMON_FAIL__')) {
+        throw new Error('Daemon process started but health check failed — check /tmp/groove-daemon.log on remote');
+      }
+    } catch (err) {
+      if (err.message.includes('Daemon process started')) throw err;
+      const output = err.stdout?.toString() || err.stderr?.toString() || err.message;
+      throw new Error(`Failed to start remote daemon: ${output.slice(-300)}`);
+    }
+  }
+
+  async remoteInstall(id) {
+    const config = this.saved.get(id);
+    if (!config) throw new Error(`Remote ${id} not found`);
+
+    const target = `${config.user}@${config.host}`;
+    const keyArgs = config.sshKeyPath ? ['-i', config.sshKeyPath] : [];
+    const sshBase = [
+      ...keyArgs,
+      '-p', String(config.port || 22),
+      '-o', 'ConnectTimeout=10',
+      '-o', 'BatchMode=yes',
+      target,
+    ];
+
+    // Non-interactive SSH doesn't source shell profiles, so npm/node may not be on PATH.
+    // Use a login shell (-l) to get the user's full environment.
+    const remoteCmd = (cmd) => `bash -lc '${cmd}'`;
+
+    // Step 1: Check if node/npm are available
+    try {
+      const check = execFileSync('ssh', [
+        ...sshBase,
+        remoteCmd('which node && which npm || echo __NO_NODE__'),
+      ], {
+        encoding: 'utf8',
+        timeout: 20000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+
+      if (check.includes('__NO_NODE__')) {
+        throw new Error('Node.js is not installed on the remote server. Install Node.js 20+ first, then retry.');
+      }
+    } catch (err) {
+      if (err.message.includes('Node.js is not installed')) throw err;
+      throw new Error(`Failed to check remote environment: ${err.message}`);
+    }
+
+    // Step 2: Install groove-dev globally (use sudo if not root)
+    const installCmd = config.user === 'root'
+      ? 'npm i -g groove-dev'
+      : 'sudo npm i -g groove-dev';
+
+    try {
+      execFileSync('ssh', [
+        ...sshBase,
+        remoteCmd(installCmd),
+      ], {
+        encoding: 'utf8',
+        timeout: 120000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+    } catch (err) {
+      const output = err.stdout?.toString() || err.stderr?.toString() || err.message;
+      throw new Error(`npm install failed: ${output.slice(-400)}`);
+    }
+
+    // Step 3: Start the daemon in background
+    try {
+      const result = execFileSync('ssh', [
+        ...sshBase,
+        remoteCmd(`nohup groove start > /tmp/groove-daemon.log 2>&1 < /dev/null & disown; sleep 4; curl -sf http://localhost:${REMOTE_PORT}/api/health > /dev/null && echo __DAEMON_OK__ || echo __DAEMON_FAIL__`),
+      ], {
+        encoding: 'utf8',
+        timeout: 45000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+
+      if (result.includes('__DAEMON_FAIL__')) {
+        throw new Error('Groove installed but daemon failed to start — check /tmp/groove-daemon.log on remote');
+      }
+    } catch (err) {
+      if (err.message.includes('Groove installed')) throw err;
+      const output = err.stdout?.toString() || err.stderr?.toString() || err.message;
+      throw new Error(`Groove installed but failed to start: ${output.slice(-300)}`);
+    }
+
+    const verify = await this.test(id);
+    return { installed: verify.grooveInstalled, daemonRunning: verify.daemonRunning };
+  }
+
+  getStatus(id) {
+    const saved = this.saved.get(id);
+    if (!saved) return null;
+    const active = this.active.get(id);
+    return { ...saved, active: !!active, ...(active || {}) };
+  }
+
+  getActive() {
+    return Array.from(this.active.entries()).map(([id, conn]) => ({
+      ...conn,
+      ...(this.saved.get(id) || {}),
+      id,
+    }));
+  }
+
+  async _healthCheckAll() {
+    for (const [id, conn] of this.active) {
+      try {
+        const start = Date.now();
+        const res = await fetch(`http://localhost:${conn.localPort}/api/health`, {
+          signal: AbortSignal.timeout(HEALTH_TIMEOUT),
+        });
+        if (res.ok) {
+          conn.latencyMs = Date.now() - start;
+          conn.lastPing = Date.now();
+          conn.healthy = true;
+          conn.failCount = 0;
+        } else {
+          throw new Error('unhealthy response');
+        }
+      } catch {
+        conn.failCount = (conn.failCount || 0) + 1;
+        if (conn.failCount >= MAX_FAIL_COUNT) {
+          conn.healthy = false;
+          this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
+        }
+      }
+      this.daemon.broadcast({
+        type: 'tunnel.health',
+        data: { id, latencyMs: conn.latencyMs, healthy: conn.healthy },
+      });
+    }
+  }
+
+  _isPortInUse(port) {
+    return new Promise((resolve) => {
+      const conn = createConnection({ host: '127.0.0.1', port });
+      conn.setTimeout(3000);
+      conn.on('connect', () => { conn.destroy(); resolve(true); });
+      conn.on('error', () => resolve(false));
+      conn.on('timeout', () => { conn.destroy(); resolve(false); });
+    });
+  }
+
+  async _findAvailablePort() {
+    for (let port = DEFAULT_LOCAL_PORT; port < DEFAULT_LOCAL_PORT + MAX_PORT_ATTEMPTS; port++) {
+      if (!(await this._isPortInUse(port))) return port;
+    }
+    throw new Error(`No available local port found (tried ${DEFAULT_LOCAL_PORT}-${DEFAULT_LOCAL_PORT + MAX_PORT_ATTEMPTS - 1})`);
+  }
+
+  shutdown() {
+    if (this._healthInterval) {
+      clearInterval(this._healthInterval);
+      this._healthInterval = null;
+    }
+    for (const [id] of this.active) {
+      try {
+        const conn = this.active.get(id);
+        if (conn?.pid) {
+          const cmd = execFileSync('ps', ['-p', String(conn.pid), '-o', 'command='], {
+            encoding: 'utf8',
+            timeout: 3000,
+          }).trim();
+          if (cmd.includes('ssh')) {
+            process.kill(conn.pid, 'SIGTERM');
+          }
+        }
+      } catch { /* ignore */ }
+    }
+    this.active.clear();
+  }
+}

package/node_modules/@groove-dev/daemon/src/validate.js

@@ -75,10 +75,21 @@ export function validateAgentConfig(config) {
     integrations = config.integrations.filter((s) => typeof s === 'string' && s.length > 0 && s.length <= 100);
   }
 
+  // Validate repos (array of import IDs)
+  let repos = [];
+  if (config.repos !== undefined && config.repos !== null) {
+    if (!Array.isArray(config.repos)) {
+      throw new Error('Repos must be an array');
+    }
+    repos = config.repos.filter((s) => typeof s === 'string' && s.length > 0 && s.length <= 100);
+  }
+
   // Validate integration approval mode
   const validApprovalModes = ['auto', 'manual'];
   const integrationApproval = validApprovalModes.includes(config.integrationApproval) ? config.integrationApproval : 'manual';
 
+  const personality = (typeof config.personality === 'string' && config.personality.length > 0 && config.personality.length <= 64 && NAME_PATTERN.test(config.personality)) ? config.personality : undefined;
+
   // Return sanitized config (only known fields)
   return {
     role: config.role,
@@ -93,6 +104,8 @@ export function validateAgentConfig(config) {
     skills,
     integrations,
     integrationApproval,
+    repos,
+    personality,
   };
 }
 

package/node_modules/@groove-dev/daemon/test/journalist.test.js

@@ -45,11 +45,12 @@ describe('Journalist', () => {
         },
       });
 
-      const entries = journalist.filterLog(logLine, { name: 'test' });
+      const { entries, explorationEntries } = journalist.filterLog(logLine, { name: 'test' });
       assert.equal(entries.length, 1);
       assert.equal(entries[0].type, 'tool');
       assert.equal(entries[0].tool, 'Write');
       assert.equal(entries[0].input, 'src/api/auth.js');
+      assert.equal(explorationEntries.length, 0);
     });
 
     it('should skip non-JSON lines (transient errors are noise)', () => {
@@ -57,7 +58,7 @@ describe('Journalist', () => {
       const journalist = new Journalist(daemon);
 
       // Non-JSON error lines are dropped to prevent context degradation
-      const entries = journalist.filterLog('Error: something broke\nTypeError: undefined is not a function', {});
+      const { entries } = journalist.filterLog('Error: something broke\nTypeError: undefined is not a function', {});
       assert.equal(entries.length, 0);
     });
 
@@ -73,7 +74,7 @@ describe('Journalist', () => {
         total_cost_usd: 0.15,
       });
 
-      const entries = journalist.filterLog(logLine, {});
+      const { entries } = journalist.filterLog(logLine, {});
       assert.equal(entries.length, 1);
       assert.equal(entries[0].type, 'result');
       assert.ok(entries[0].text.includes('Task completed'));
@@ -84,7 +85,7 @@ describe('Journalist', () => {
       const { daemon } = createMockDaemon();
       const journalist = new Journalist(daemon);
 
-      const entries = journalist.filterLog(
+      const { entries } = journalist.filterLog(
         '[2026-04-04] GROOVE spawning: claude ...\n\nnot json\n',
         {}
       );

package/node_modules/@groove-dev/daemon/test/rotator.test.js

@@ -26,10 +26,13 @@ describe('Rotator', () => {
         async spawn(config) { return { id: 'new-' + config.role, name: config.name, ...config }; },
       },
       journalist: {
-        async generateHandoffBrief(agent) {
+        async generateHandoffBrief(agent, options = {}) {
           return `Handoff brief for ${agent.name}`;
         },
       },
+      memory: {
+        appendHandoffBrief() { return true; },
+      },
       adaptive: {
         extractSignals() { return { errorCount: 0, repetitions: 0, scopeViolations: 0, toolCalls: 0, toolFailures: 0, filesWritten: 0 }; },
         recordSession() { return { score: 70, threshold: 0.75, converged: false }; },