groove-dev 0.27.80 → 0.27.84

package/moe-training/package-lock.json

@@ -9,7 +9,7 @@
       "version": "0.1.0",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
-        "better-sqlite3": "^11.0.0",
+        "better-sqlite3": "^12.9.0",
         "express": "^4.18.0",
         "uuid": "^9.0.0"
       }
@@ -54,14 +54,17 @@
       "license": "MIT"
     },
     "node_modules/better-sqlite3": {
-      "version": "11.10.0",
-      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-11.10.0.tgz",
-      "integrity": "sha512-EwhOpyXiOEL/lKzHz9AW1msWFNzGc/z+LzeB3/jnFJpxu+th2yqvzsSWas1v9jgs9+xiXJcD5A8CJxAG2TaghQ==",
+      "version": "12.9.0",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.9.0.tgz",
+      "integrity": "sha512-wqUv4Gm3toFpHDQmaKD4QhZm3g1DjUBI0yzS4UBl6lElUmXFYdTQmmEDpAFa5o8FiFiymURypEnfVHzILKaxqQ==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
         "bindings": "^1.5.0",
         "prebuild-install": "^7.1.1"
+      },
+      "engines": {
+        "node": "20.x || 22.x || 23.x || 24.x || 25.x"
       }
     },
     "node_modules/bindings": {

package/moe-training/package.json

@@ -13,7 +13,7 @@
     "start:server": "node server/index.js"
   },
   "dependencies": {
-    "better-sqlite3": "^11.0.0",
+    "better-sqlite3": "^12.9.0",
     "uuid": "^9.0.0",
     "express": "^4.18.0"
   }

package/node_modules/@groove-dev/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.80",
+  "version": "0.27.84",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.80",
+  "version": "0.27.84",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/src/agent-loop.js

@@ -36,6 +36,7 @@ export class AgentLoop extends EventEmitter {
       agent.workingDir || daemon.projectDir,
       daemon,
       agent.id,
+      daemon.projectDir,
     );
 
     // Session persistence
@@ -57,6 +58,7 @@ export class AgentLoop extends EventEmitter {
 
   async start(initialPrompt) {
     this.running = true;
+    this.isInitialPrompt = true;
     this._writeLog({ type: 'system', event: 'start', model: this.config.model });
 
     if (initialPrompt) {
@@ -78,6 +80,19 @@ export class AgentLoop extends EventEmitter {
       this.emit('error', { message: err.message });
     }
 
+    if (this.running && this.isInitialPrompt && this._shouldAutoComplete()) {
+      this.running = false;
+      const duration = Date.now() - this.startedAt;
+      this.daemon.tokens.recordResult(this.agent.id, { durationMs: duration, turns: this.turns });
+      this.emit('exit', { code: 0, signal: null, status: 'completed' });
+    }
+
+    if (this.running && this.isInitialPrompt && this.turns <= 1 && this.totalTokensIn === 0 && this.totalTokensOut === 0) {
+      this.running = false;
+      this.emit('exit', { code: 1, signal: null, status: 'crashed' });
+    }
+
+    this.isInitialPrompt = false;
     this._saveSession();
     this.idle = true;
   }
@@ -142,14 +157,14 @@ export class AgentLoop extends EventEmitter {
         if (content) {
           this._writeLog({ type: 'assistant', content: content.slice(0, 2000) });
         }
-        this.emit('output', { type: 'result', data: content || 'Turn complete', turns: this.turns });
+        this.emit('output', { type: 'result', subtype: 'assistant', data: content || 'Turn complete', turns: this.turns });
         break;
       }
 
       // Has tool calls — broadcast text before executing tools (if model sent text + tools)
       if (content) {
         this._writeLog({ type: 'assistant', content: content.slice(0, 2000) });
-        this.emit('output', { type: 'activity', subtype: 'text', data: content });
+        this.emit('output', { type: 'activity', subtype: 'assistant', data: content });
       }
 
       // Execute each tool call
@@ -168,7 +183,7 @@ export class AgentLoop extends EventEmitter {
 
         // Log + broadcast tool invocation
         this._writeLog({ type: 'tool_use', tool: toolName, input: inputSummary });
-        this.emit('output', { type: 'activity', subtype: 'tool_use', data: `${toolName}: ${inputSummary}` });
+        this.emit('output', { type: 'activity', subtype: 'tool_use', data: [{ type: 'tool_use', name: toolName, input: args }] });
 
         // Feed classifier for adaptive routing
         this.daemon.classifier.addEvent(this.agent.id, {
@@ -188,7 +203,7 @@ export class AgentLoop extends EventEmitter {
         });
         this.emit('output', {
           type: 'activity', subtype: 'tool_result',
-          data: result.success ? `${toolName}: done` : `${toolName}: error — ${result.error}`,
+          data: [{ type: 'tool_result', name: toolName, success: result.success, output: resultPreview }],
         });
 
         if (!result.success) {
@@ -209,11 +224,15 @@ export class AgentLoop extends EventEmitter {
     }
   }
 
+  _shouldAutoComplete() {
+    const lastAssistant = [...this.messages].reverse().find(m => m.role === 'assistant');
+    if (!lastAssistant) return false;
+    return lastAssistant.content && (!lastAssistant.tool_calls || lastAssistant.tool_calls.length === 0) && this.turns >= 1;
+  }
+
   // --- API Communication ---
 
   async _callApi() {
-    this.abortController = new AbortController();
-
     const body = {
       model: this.config.model,
       messages: this.messages,
@@ -223,46 +242,75 @@ export class AgentLoop extends EventEmitter {
       max_tokens: this.config.maxResponseTokens || 4096,
     };
 
-    // Streaming for real-time output
     if (this.config.stream !== false) {
       body.stream = true;
       body.stream_options = { include_usage: true };
     }
 
     const url = `${this.config.apiBase}/chat/completions`;
+    const maxRetries = 3;
+    let lastError = null;
+
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      this.abortController = new AbortController();
+
+      let response;
+      try {
+        response = await fetch(url, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            ...(this.config.apiKey ? { Authorization: `Bearer ${this.config.apiKey}` } : {}),
+            ...this.config.headers,
+          },
+          body: JSON.stringify(body),
+          signal: this.abortController.signal,
+        });
+      } catch (err) {
+        if (err.name === 'AbortError') return null;
+        lastError = `Inference API unreachable: ${err.message}`;
+        if (attempt < 2) {
+          this._writeLog({ type: 'retry', attempt: attempt + 1, reason: lastError, delayMs: 2000 });
+          await new Promise(r => setTimeout(r, 2000));
+          continue;
+        }
+        this._writeLog({ type: 'error', text: `API request failed: ${err.message}` });
+        this.emit('error', { message: lastError });
+        return null;
+      }
 
-    let response;
-    try {
-      response = await fetch(url, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          ...(this.config.apiKey ? { Authorization: `Bearer ${this.config.apiKey}` } : {}),
-          ...this.config.headers,
-        },
-        body: JSON.stringify(body),
-        signal: this.abortController.signal,
-      });
-    } catch (err) {
-      if (err.name === 'AbortError') return null;
-      this._writeLog({ type: 'error', text: `API request failed: ${err.message}` });
-      this.emit('error', { message: `Inference API unreachable: ${err.message}` });
-      return null;
-    }
+      if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        const errMsg = `API error ${response.status}: ${text.slice(0, 500)}`;
 
-    if (!response.ok) {
-      const text = await response.text().catch(() => '');
-      const errMsg = `API error ${response.status}: ${text.slice(0, 500)}`;
-      this._writeLog({ type: 'error', text: errMsg });
-      this.emit('error', { message: errMsg });
-      return null;
-    }
+        if (response.status === 401 || response.status === 403) {
+          this._writeLog({ type: 'error', text: errMsg });
+          this.emit('error', { message: errMsg });
+          return null;
+        }
 
-    // Parse streaming or non-streaming response
-    if (body.stream) {
-      return this._parseSSE(response);
+        if ((response.status === 429 || response.status === 503) && attempt < maxRetries) {
+          const delay = Math.pow(2, attempt + 1) * 1000;
+          this._writeLog({ type: 'retry', attempt: attempt + 1, reason: errMsg, delayMs: delay });
+          await new Promise(r => setTimeout(r, delay));
+          lastError = errMsg;
+          continue;
+        }
+
+        this._writeLog({ type: 'error', text: errMsg });
+        this.emit('error', { message: errMsg });
+        return null;
+      }
+
+      if (body.stream) {
+        return this._parseSSE(response);
+      }
+      return this._parseJSON(response);
     }
-    return this._parseJSON(response);
+
+    this._writeLog({ type: 'error', text: `API failed after retries: ${lastError}` });
+    this.emit('error', { message: lastError });
+    return null;
   }
 
   async _parseSSE(response) {

package/node_modules/@groove-dev/daemon/src/conversations.js

@@ -5,7 +5,7 @@ import { readFileSync, writeFileSync, existsSync } from 'fs';
 import { resolve } from 'path';
 import { randomUUID } from 'crypto';
 import { spawn as cpSpawn } from 'child_process';
-import { getProvider, getInstalledProviders, isProviderInstalled } from './providers/index.js';
+import { getProvider, getInstalledProviders, isProviderInstalled, resolveProviderCommand } from './providers/index.js';
 
 export class ConversationManager {
   constructor(daemon) {
@@ -371,7 +371,8 @@ export class ConversationManager {
       });
       return;
     }
-    const { command, args, env, stdin: stdinData, cwd } = headlessCmd;
+    const { command: rawCommand, args, env, stdin: stdinData, cwd } = headlessCmd;
+    const command = resolveProviderCommand(providerName) || rawCommand;
 
     const spawnOpts = {
       env: { ...process.env, ...env },
@@ -382,6 +383,14 @@ export class ConversationManager {
     const proc = cpSpawn(command, args, spawnOpts);
     this._getStreamingProcesses().set(id, proc);
 
+    proc.on('error', (err) => {
+      this._getStreamingProcesses().delete(id);
+      this.daemon.broadcast({
+        type: 'conversation:error',
+        data: { conversationId: id, error: err.message },
+      });
+    });
+
     if (stdinData) {
       proc.stdin.write(stdinData);
       proc.stdin.end();

package/node_modules/@groove-dev/daemon/src/journalist.js

@@ -4,7 +4,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from 'fs';
 import { resolve } from 'path';
 import { execFile, spawn as cpSpawn } from 'child_process';
-import { getProvider, getInstalledProviders } from './providers/index.js';
+import { getProvider, getInstalledProviders, resolveProviderCommand } from './providers/index.js';
 
 const DEFAULT_INTERVAL = 300_000; // 5 minutes (safety-net fallback; event-driven triggers handle the normal case)
 const MAX_LOG_CHARS = 100_000; // ~25k tokens budget for synthesis input (captures 80-90% of recent activity)
@@ -558,7 +558,7 @@ export class Journalist {
       const headlessCmd = provider.buildHeadlessCommand(prompt, modelId);
       if (headlessCmd) {
         try {
-          return await this._execHeadlessCmd(headlessCmd, trackAs, modelId);
+          return await this._execHeadlessCmd(headlessCmd, trackAs, modelId, providerId);
         } catch {
           continue;
         }
@@ -606,8 +606,9 @@ export class Journalist {
     throw new Error('No provider available for synthesis');
   }
 
-  _execHeadlessCmd(headlessCmd, trackAs, modelId) {
-    const { command, args, env, stdin: stdinData } = headlessCmd;
+  _execHeadlessCmd(headlessCmd, trackAs, modelId, providerId) {
+    const { command: rawCommand, args, env, stdin: stdinData } = headlessCmd;
+    const command = (providerId && resolveProviderCommand(providerId)) || rawCommand;
 
     return new Promise((resolve, reject) => {
       if (stdinData) {
@@ -617,6 +618,7 @@ export class Journalist {
           cwd: this.daemon.projectDir,
           stdio: ['pipe', 'pipe', 'pipe'],
         });
+        proc.on('error', (err) => reject(err));
         proc.stdin.write(stdinData);
         proc.stdin.end();
         proc.stdout.on('data', (d) => { stdout += d.toString(); });

package/node_modules/@groove-dev/daemon/src/process.js

@@ -5,7 +5,7 @@ import { spawn as cpSpawn } from 'child_process';
 import { createWriteStream, mkdirSync, chmodSync, existsSync, readFileSync, writeFileSync, unlinkSync, readdirSync, copyFileSync } from 'fs';
 import { resolve, dirname, isAbsolute } from 'path';
 import { fileURLToPath } from 'url';
-import { getProvider, getInstalledProviders } from './providers/index.js';
+import { getProvider, getInstalledProviders, resolveProviderCommand } from './providers/index.js';
 import { AgentLoop } from './agent-loop.js';
 import { validateAgentConfig } from './validate.js';
 
@@ -454,6 +454,14 @@ export class ProcessManager {
       );
     }
 
+    // Validate explicit model against provider's supported models
+    if (config.model && config.model !== 'auto' && provider.constructor.models) {
+      const valid = provider.constructor.models.some(m => m.id === config.model);
+      if (!valid) {
+        throw new Error(`Model '${config.model}' is not available for ${provider.constructor.displayName}. Available: ${provider.constructor.models.map(m => m.id).join(', ')}`);
+      }
+    }
+
     // Resolve auto model routing before registering
     // Treat missing/null/empty model as 'auto' — GUI sends empty string for "Auto" option
     let resolvedModel = config.model;
@@ -753,12 +761,15 @@ For normal file edits within your scope, proceed without review.
         }
       });
 
-      // Wire errors — broadcast to GUI for display
+      // Wire errors — broadcast to GUI for display, crash on fatal API errors
       loop.on('error', ({ message }) => {
         this.daemon.broadcast({
           type: 'agent:output', agentId: agent.id,
           data: { type: 'activity', subtype: 'error', data: message },
         });
+        if ((message.includes('API error 4') && !message.includes('API error 429')) || message.includes('Inference API unreachable')) {
+          loop.stop();
+        }
       });
 
       // Start the agent loop with the fully assembled prompt
@@ -780,7 +791,8 @@ For normal file edits within your scope, proceed without review.
     }
 
     const spawnCmd = provider.buildSpawnCommand(spawnConfig);
-    const { command, args, env, stdin: stdinData, cwd: providerCwd } = spawnCmd;
+    const { command: rawCommand, args, env, stdin: stdinData, cwd: providerCwd } = spawnCmd;
+    const command = resolveProviderCommand(agent.provider || config.provider) || rawCommand;
 
     // Log the spawn command (mask anything that looks like an API key)
     const maskArg = (a) => /^(sk-|AIza|key-|token-)/.test(a) ? '***' : a;
@@ -804,13 +816,22 @@ For normal file edits within your scope, proceed without review.
     }
 
     // Spawn the process (use pipe for stdin if provider needs to send prompt via stdin)
+    const spawnCwd = [providerCwd, agent.workingDir, this.daemon.projectDir].find(d => d && existsSync(d)) || this.daemon.projectDir;
     const proc = cpSpawn(command, args, {
-      cwd: providerCwd || agent.workingDir || this.daemon.projectDir,
+      cwd: spawnCwd,
       env: { ...process.env, ...env, ...integrationEnv, GROOVE_AGENT_ID: agent.id, GROOVE_AGENT_NAME: agent.name, GROOVE_DAEMON_HOST: this.daemon.host || '127.0.0.1', GROOVE_DAEMON_PORT: String(this.daemon.port || 31415) },
       stdio: [stdinData ? 'pipe' : 'ignore', 'pipe', 'pipe'],
       detached: false,
     });
 
+    proc.on('error', (err) => {
+      if (!logStream.destroyed) logStream.write(`[${new Date().toISOString()}] Spawn error: ${err.message}\n`);
+      if (!logStream.destroyed) logStream.end();
+      this.handles.delete(agent.id);
+      registry.update(agent.id, { status: 'crashed', pid: null });
+      this.daemon.broadcast({ type: 'agent:exit', agentId: agent.id, code: null, signal: null, status: 'crashed', error: err.message });
+    });
+
     // Write prompt via stdin if provider requested it (e.g., Ollama avoids arg length limits)
     if (stdinData && proc.stdin) {
       proc.stdin.write(stdinData);
@@ -820,7 +841,7 @@ For normal file edits within your scope, proceed without review.
     if (!proc.pid) {
       registry.remove(agent.id);
       locks.release(agent.id);
-      logStream.end();
+      if (!logStream.destroyed) logStream.end();
       throw new Error(`Failed to spawn ${command} — process has no PID`);
     }
 
@@ -1568,7 +1589,8 @@ For normal file edits within your scope, proceed without review.
     locks.release(agentId);
 
     // Build resume command
-    const { command, args, env } = provider.buildResumeCommand(sessionId, message, config.model);
+    const { command: rawCommand, args, env } = provider.buildResumeCommand(sessionId, message, config.model);
+    const command = resolveProviderCommand(config.provider || 'claude-code') || rawCommand;
 
     // Set up log capture
     const logDir = resolve(this.daemon.grooveDir, 'logs');
@@ -1603,17 +1625,26 @@ For normal file edits within your scope, proceed without review.
     }
 
     // Spawn the resumed process
+    const resumeCwd = [config.workingDir, this.daemon.projectDir].find(d => d && existsSync(d)) || this.daemon.projectDir;
     const proc = cpSpawn(command, args, {
-      cwd: config.workingDir || this.daemon.projectDir,
+      cwd: resumeCwd,
       env: { ...process.env, ...env, GROOVE_AGENT_ID: newAgent.id, GROOVE_AGENT_NAME: newAgent.name, GROOVE_DAEMON_HOST: this.daemon.host || '127.0.0.1', GROOVE_DAEMON_PORT: String(this.daemon.port || 31415) },
       stdio: ['ignore', 'pipe', 'pipe'],
       detached: false,
     });
 
+    proc.on('error', (err) => {
+      if (!logStream.destroyed) logStream.write(`[${new Date().toISOString()}] Resume spawn error: ${err.message}\n`);
+      if (!logStream.destroyed) logStream.end();
+      this.handles.delete(newAgent.id);
+      registry.update(newAgent.id, { status: 'crashed', pid: null });
+      this.daemon.broadcast({ type: 'agent:exit', agentId: newAgent.id, code: null, signal: null, status: 'crashed', error: err.message });
+    });
+
     if (!proc.pid) {
       registry.remove(newAgent.id);
       locks.release(newAgent.id);
-      logStream.end();
+      if (!logStream.destroyed) logStream.end();
       throw new Error(`Failed to resume — process has no PID`);
     }
 
@@ -1813,6 +1844,9 @@ For normal file edits within your scope, proceed without review.
         type: 'agent:output', agentId: newAgent.id,
         data: { type: 'activity', subtype: 'error', data: errMsg },
       });
+      if ((errMsg.includes('API error 4') && !errMsg.includes('API error 429')) || errMsg.includes('Inference API unreachable')) {
+        loop.stop();
+      }
     });
 
     loop.start();

package/node_modules/@groove-dev/daemon/src/providers/index.js

@@ -41,6 +41,22 @@ export function getProviderPath(id) {
 (function augmentPath() {
   const isWin = process.platform === 'win32';
   const extra = isWin ? [] : ['/usr/local/bin', '/opt/homebrew/bin'];
+
+  // Electron forked processes may not inherit the user's full shell PATH.
+  // Try to resolve it from a login shell (non-interactive to avoid compinit noise).
+  if (!isWin) {
+    try {
+      const shell = process.env.SHELL || '/bin/zsh';
+      const shellPath = execSync(`${shell} -lc 'echo $PATH'`, { encoding: 'utf8', timeout: 5000 }).trim();
+      if (shellPath && shellPath.includes('/')) {
+        const last = shellPath.split('\n').pop();
+        for (const dir of last.split(pathDelimiter)) {
+          if (dir && !extra.includes(dir)) extra.push(dir);
+        }
+      }
+    } catch { /* login shell unavailable — fall through to static paths */ }
+  }
+
   try {
     const suppressErr = isWin ? '2>NUL' : '2>/dev/null';
     const npmPrefix = execSync(`npm config get prefix ${suppressErr}`, { encoding: 'utf8', timeout: 5000 }).trim();
@@ -77,6 +93,23 @@ const providers = {
 };
 
 const installCache = new Map();
+const _resolvedCommands = new Map();
+
+export function resolveProviderCommand(providerId) {
+  if (_resolvedCommands.has(providerId)) return _resolvedCommands.get(providerId);
+  const custom = getProviderPath(providerId);
+  if (custom) { _resolvedCommands.set(providerId, custom); return custom; }
+  const p = providers[providerId];
+  if (!p) return null;
+  const command = p.constructor.command;
+  if (!command) return null;
+  try {
+    const cmd = process.platform === 'win32' ? `where ${command}` : `which ${command}`;
+    const resolved = execSync(cmd, { encoding: 'utf8', timeout: 5000 }).trim().split('\n')[0];
+    if (resolved) { _resolvedCommands.set(providerId, resolved); return resolved; }
+  } catch { /* not found — fall through */ }
+  return command;
+}
 
 export function isProviderInstalled(providerId) {
   if (installCache.has(providerId)) return installCache.get(providerId);

package/node_modules/@groove-dev/daemon/src/tool-executor.js

@@ -2,7 +2,7 @@
 // FSL-1.1-Apache-2.0 — see LICENSE
 
 import { readFileSync, writeFileSync, readdirSync, statSync, mkdirSync, existsSync } from 'fs';
-import { execSync, execFileSync } from 'child_process';
+import { execSync } from 'child_process';
 import { resolve, relative, dirname, sep } from 'path';
 import { minimatch } from 'minimatch';
 
@@ -120,10 +120,11 @@ export const TOOL_DEFINITIONS = [
 ];
 
 export class ToolExecutor {
-  constructor(workingDir, daemon, agentId) {
+  constructor(workingDir, daemon, agentId, projectDir) {
     this.workingDir = resolve(workingDir);
     this.daemon = daemon;
     this.agentId = agentId;
+    this.projectDir = resolve(projectDir || workingDir);
   }
 
   async execute(name, args) {
@@ -155,6 +156,15 @@ export class ToolExecutor {
     return resolved;
   }
 
+  _resolveReadPath(filePath) {
+    if (!filePath) throw new Error('Path is required');
+    const resolved = resolve(this.workingDir, filePath);
+    if (!resolved.startsWith(this.projectDir + sep) && resolved !== this.projectDir) {
+      throw new Error(`Access denied: path outside project directory`);
+    }
+    return resolved;
+  }
+
   _checkWriteScope(resolvedPath) {
     if (!this.daemon?.locks) return;
     const rel = relative(this.workingDir, resolvedPath);
@@ -171,7 +181,7 @@ export class ToolExecutor {
   // --- Tool Implementations ---
 
   readFile({ path: filePath, offset, limit }) {
-    const resolved = this._resolvePath(filePath);
+    const resolved = this._resolveReadPath(filePath);
     if (!existsSync(resolved)) {
       return { success: false, error: `File not found: ${filePath}` };
     }
@@ -241,16 +251,17 @@ export class ToolExecutor {
     const execCwd = cwd ? this._resolvePath(cwd) : this.workingDir;
     const timeoutMs = Math.min(timeout || 30000, 120000);
 
+    if (/\brm\s+(-\w+\s+)*-rf\s+(\/|~)/.test(command) || /\bsudo\b/.test(command)) {
+      return { success: false, error: 'Command blocked: dangerous shell pattern detected' };
+    }
+
     try {
-      // Split command safely for shell: false — avoids shell injection
-      const parts = command.split(/\s+/);
-      const cmd = parts[0];
-      const cmdArgs = parts.slice(1);
-      const output = execFileSync(cmd, cmdArgs, {
+      const output = execSync(command, {
         cwd: execCwd,
         timeout: timeoutMs,
         maxBuffer: 1024 * 1024,
         encoding: 'utf8',
+        shell: true,
         env: { ...process.env, GROOVE_AGENT_ID: this.agentId },
       });
       // Cap output to prevent context window blowup
@@ -265,7 +276,7 @@ export class ToolExecutor {
   }
 
   searchFiles({ pattern, cwd }) {
-    const searchDir = cwd ? this._resolvePath(cwd) : this.workingDir;
+    const searchDir = cwd ? this._resolveReadPath(cwd) : this.workingDir;
     const results = [];
 
     const walk = (dir, depth) => {
@@ -298,7 +309,7 @@ export class ToolExecutor {
     if (!/^[a-zA-Z0-9_.\-\/\\*?[\]{}()|^$+\s]+$/.test(pattern)) {
       throw new Error('Invalid search pattern');
     }
-    const searchDir = searchPath ? this._resolvePath(searchPath) : this.workingDir;
+    const searchDir = searchPath ? this._resolveReadPath(searchPath) : this.workingDir;
 
     // Prefer ripgrep (faster, respects .gitignore), fall back to grep
     const escapedPattern = pattern.replace(/'/g, "'\\''");
@@ -342,7 +353,7 @@ export class ToolExecutor {
   }
 
   listDirectory({ path: dirPath } = {}) {
-    const resolved = dirPath ? this._resolvePath(dirPath) : this.workingDir;
+    const resolved = dirPath ? this._resolveReadPath(dirPath) : this.workingDir;
 
     if (!existsSync(resolved)) {
       return { success: false, error: `Directory not found: ${dirPath || '.'}` };