groove-dev 0.27.81 → 0.27.85

package/CLAUDE.md

@@ -263,14 +263,3 @@ Audit-driven release. Multi-agent orchestration system with 7 coordination layer
 - Dashboard: routing donut, cache panel, context health gauges
 - Monitor/QC agent mode (stay active, loop)
 - Distribution: demo video, HN launch, Twitter content
-
-<!-- GROOVE:START -->
-## GROOVE Orchestration (auto-injected)
-Active agents: 2
-| Name | Role | Scope |
-|------|------|-------|
-| planner-4 | planner | - |
-| planner-7 | planner | - |
-See AGENTS_REGISTRY.md for full agent state.
-**Memory policy:** GROOVE manages project memory automatically. Do not read or write MEMORY.md or .groove/memory/ files directly.
-<!-- GROOVE:END -->

package/moe-training/package-lock.json

@@ -9,7 +9,7 @@
       "version": "0.1.0",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
-        "better-sqlite3": "^11.0.0",
+        "better-sqlite3": "^12.9.0",
         "express": "^4.18.0",
         "uuid": "^9.0.0"
       }
@@ -54,14 +54,17 @@
       "license": "MIT"
     },
     "node_modules/better-sqlite3": {
-      "version": "11.10.0",
-      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-11.10.0.tgz",
-      "integrity": "sha512-EwhOpyXiOEL/lKzHz9AW1msWFNzGc/z+LzeB3/jnFJpxu+th2yqvzsSWas1v9jgs9+xiXJcD5A8CJxAG2TaghQ==",
+      "version": "12.9.0",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.9.0.tgz",
+      "integrity": "sha512-wqUv4Gm3toFpHDQmaKD4QhZm3g1DjUBI0yzS4UBl6lElUmXFYdTQmmEDpAFa5o8FiFiymURypEnfVHzILKaxqQ==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
         "bindings": "^1.5.0",
         "prebuild-install": "^7.1.1"
+      },
+      "engines": {
+        "node": "20.x || 22.x || 23.x || 24.x || 25.x"
       }
     },
     "node_modules/bindings": {

package/moe-training/package.json

@@ -13,7 +13,7 @@
     "start:server": "node server/index.js"
   },
   "dependencies": {
-    "better-sqlite3": "^11.0.0",
+    "better-sqlite3": "^12.9.0",
     "uuid": "^9.0.0",
     "express": "^4.18.0"
   }

package/node_modules/@groove-dev/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.81",
+  "version": "0.27.85",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.81",
+  "version": "0.27.85",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/src/agent-loop.js

@@ -36,6 +36,7 @@ export class AgentLoop extends EventEmitter {
       agent.workingDir || daemon.projectDir,
       daemon,
       agent.id,
+      daemon.projectDir,
     );
 
     // Session persistence
@@ -57,6 +58,7 @@ export class AgentLoop extends EventEmitter {
 
   async start(initialPrompt) {
     this.running = true;
+    this.isInitialPrompt = true;
     this._writeLog({ type: 'system', event: 'start', model: this.config.model });
 
     if (initialPrompt) {
@@ -78,6 +80,19 @@ export class AgentLoop extends EventEmitter {
       this.emit('error', { message: err.message });
     }
 
+    if (this.running && this.isInitialPrompt && this._shouldAutoComplete()) {
+      this.running = false;
+      const duration = Date.now() - this.startedAt;
+      this.daemon.tokens.recordResult(this.agent.id, { durationMs: duration, turns: this.turns });
+      this.emit('exit', { code: 0, signal: null, status: 'completed' });
+    }
+
+    if (this.running && this.isInitialPrompt && this.turns <= 1 && this.totalTokensIn === 0 && this.totalTokensOut === 0) {
+      this.running = false;
+      this.emit('exit', { code: 1, signal: null, status: 'crashed' });
+    }
+
+    this.isInitialPrompt = false;
     this._saveSession();
     this.idle = true;
   }
@@ -142,14 +157,14 @@ export class AgentLoop extends EventEmitter {
         if (content) {
           this._writeLog({ type: 'assistant', content: content.slice(0, 2000) });
         }
-        this.emit('output', { type: 'result', data: content || 'Turn complete', turns: this.turns });
+        this.emit('output', { type: 'result', subtype: 'assistant', data: content || 'Turn complete', turns: this.turns });
         break;
       }
 
       // Has tool calls — broadcast text before executing tools (if model sent text + tools)
       if (content) {
         this._writeLog({ type: 'assistant', content: content.slice(0, 2000) });
-        this.emit('output', { type: 'activity', subtype: 'text', data: content });
+        this.emit('output', { type: 'activity', subtype: 'assistant', data: content });
       }
 
       // Execute each tool call
@@ -168,7 +183,7 @@ export class AgentLoop extends EventEmitter {
 
         // Log + broadcast tool invocation
         this._writeLog({ type: 'tool_use', tool: toolName, input: inputSummary });
-        this.emit('output', { type: 'activity', subtype: 'tool_use', data: `${toolName}: ${inputSummary}` });
+        this.emit('output', { type: 'activity', subtype: 'tool_use', data: [{ type: 'tool_use', name: toolName, input: args }] });
 
         // Feed classifier for adaptive routing
         this.daemon.classifier.addEvent(this.agent.id, {
@@ -188,7 +203,7 @@ export class AgentLoop extends EventEmitter {
         });
         this.emit('output', {
           type: 'activity', subtype: 'tool_result',
-          data: result.success ? `${toolName}: done` : `${toolName}: error — ${result.error}`,
+          data: [{ type: 'tool_result', name: toolName, success: result.success, output: resultPreview }],
         });
 
         if (!result.success) {
@@ -209,11 +224,15 @@ export class AgentLoop extends EventEmitter {
     }
   }
 
+  _shouldAutoComplete() {
+    const lastAssistant = [...this.messages].reverse().find(m => m.role === 'assistant');
+    if (!lastAssistant) return false;
+    return lastAssistant.content && (!lastAssistant.tool_calls || lastAssistant.tool_calls.length === 0) && this.turns >= 1;
+  }
+
   // --- API Communication ---
 
   async _callApi() {
-    this.abortController = new AbortController();
-
     const body = {
       model: this.config.model,
       messages: this.messages,
@@ -223,46 +242,75 @@ export class AgentLoop extends EventEmitter {
       max_tokens: this.config.maxResponseTokens || 4096,
     };
 
-    // Streaming for real-time output
     if (this.config.stream !== false) {
       body.stream = true;
       body.stream_options = { include_usage: true };
     }
 
     const url = `${this.config.apiBase}/chat/completions`;
+    const maxRetries = 3;
+    let lastError = null;
+
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      this.abortController = new AbortController();
+
+      let response;
+      try {
+        response = await fetch(url, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            ...(this.config.apiKey ? { Authorization: `Bearer ${this.config.apiKey}` } : {}),
+            ...this.config.headers,
+          },
+          body: JSON.stringify(body),
+          signal: this.abortController.signal,
+        });
+      } catch (err) {
+        if (err.name === 'AbortError') return null;
+        lastError = `Inference API unreachable: ${err.message}`;
+        if (attempt < 2) {
+          this._writeLog({ type: 'retry', attempt: attempt + 1, reason: lastError, delayMs: 2000 });
+          await new Promise(r => setTimeout(r, 2000));
+          continue;
+        }
+        this._writeLog({ type: 'error', text: `API request failed: ${err.message}` });
+        this.emit('error', { message: lastError });
+        return null;
+      }
 
-    let response;
-    try {
-      response = await fetch(url, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          ...(this.config.apiKey ? { Authorization: `Bearer ${this.config.apiKey}` } : {}),
-          ...this.config.headers,
-        },
-        body: JSON.stringify(body),
-        signal: this.abortController.signal,
-      });
-    } catch (err) {
-      if (err.name === 'AbortError') return null;
-      this._writeLog({ type: 'error', text: `API request failed: ${err.message}` });
-      this.emit('error', { message: `Inference API unreachable: ${err.message}` });
-      return null;
-    }
+      if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        const errMsg = `API error ${response.status}: ${text.slice(0, 500)}`;
 
-    if (!response.ok) {
-      const text = await response.text().catch(() => '');
-      const errMsg = `API error ${response.status}: ${text.slice(0, 500)}`;
-      this._writeLog({ type: 'error', text: errMsg });
-      this.emit('error', { message: errMsg });
-      return null;
-    }
+        if (response.status === 401 || response.status === 403) {
+          this._writeLog({ type: 'error', text: errMsg });
+          this.emit('error', { message: errMsg });
+          return null;
+        }
 
-    // Parse streaming or non-streaming response
-    if (body.stream) {
-      return this._parseSSE(response);
+        if ((response.status === 429 || response.status === 503) && attempt < maxRetries) {
+          const delay = Math.pow(2, attempt + 1) * 1000;
+          this._writeLog({ type: 'retry', attempt: attempt + 1, reason: errMsg, delayMs: delay });
+          await new Promise(r => setTimeout(r, delay));
+          lastError = errMsg;
+          continue;
+        }
+
+        this._writeLog({ type: 'error', text: errMsg });
+        this.emit('error', { message: errMsg });
+        return null;
+      }
+
+      if (body.stream) {
+        return this._parseSSE(response);
+      }
+      return this._parseJSON(response);
     }
-    return this._parseJSON(response);
+
+    this._writeLog({ type: 'error', text: `API failed after retries: ${lastError}` });
+    this.emit('error', { message: lastError });
+    return null;
   }
 
   async _parseSSE(response) {

package/node_modules/@groove-dev/daemon/src/process.js

@@ -454,6 +454,14 @@ export class ProcessManager {
       );
     }
 
+    // Validate explicit model against provider's supported models
+    if (config.model && config.model !== 'auto' && provider.constructor.models) {
+      const valid = provider.constructor.models.some(m => m.id === config.model);
+      if (!valid) {
+        throw new Error(`Model '${config.model}' is not available for ${provider.constructor.displayName}. Available: ${provider.constructor.models.map(m => m.id).join(', ')}`);
+      }
+    }
+
     // Resolve auto model routing before registering
     // Treat missing/null/empty model as 'auto' — GUI sends empty string for "Auto" option
     let resolvedModel = config.model;
@@ -731,6 +739,22 @@ For normal file edits within your scope, proceed without review.
           });
         }
 
+        if (this.daemon.trajectoryCapture) {
+          try {
+            if (status === 'completed') {
+              this.daemon.trajectoryCapture.onAgentComplete(agent.id, {
+                status: 'SUCCESS', exit_code: code || 0, signal,
+              });
+            } else {
+              this.daemon.trajectoryCapture.onAgentCrash(agent.id,
+                signal ? 'Killed by signal ' + signal : 'Exit status ' + status
+              );
+            }
+            const count = (this.daemon.state.get('training_sessions_captured') || 0) + 1;
+            this.daemon.state.set('training_sessions_captured', count);
+          } catch (e) { /* fail silent */ }
+        }
+
         this.daemon.broadcast({ type: 'agent:exit', agentId: agent.id, code: code || 0, signal, status });
         if (this.daemon.integrations) this.daemon.integrations.refreshMcpJson();
         if (status === 'completed' && this.daemon.journalist) {
@@ -753,12 +777,15 @@ For normal file edits within your scope, proceed without review.
         }
       });
 
-      // Wire errors — broadcast to GUI for display
+      // Wire errors — broadcast to GUI for display, crash on fatal API errors
       loop.on('error', ({ message }) => {
         this.daemon.broadcast({
           type: 'agent:output', agentId: agent.id,
           data: { type: 'activity', subtype: 'error', data: message },
         });
+        if ((message.includes('API error 4') && !message.includes('API error 429')) || message.includes('Inference API unreachable')) {
+          loop.stop();
+        }
       });
 
       // Start the agent loop with the fully assembled prompt
@@ -1833,6 +1860,9 @@ For normal file edits within your scope, proceed without review.
         type: 'agent:output', agentId: newAgent.id,
         data: { type: 'activity', subtype: 'error', data: errMsg },
       });
+      if ((errMsg.includes('API error 4') && !errMsg.includes('API error 429')) || errMsg.includes('Inference API unreachable')) {
+        loop.stop();
+      }
     });
 
     loop.start();
@@ -1874,6 +1904,13 @@ For normal file edits within your scope, proceed without review.
     if (loop) {
       await loop.stop();
       this.handles.delete(agentId);
+      if (this.daemon.trajectoryCapture) {
+        try {
+          this.daemon.trajectoryCapture.onAgentComplete(agentId, { status: 'STOPPED' });
+          const count = (this.daemon.state.get('training_sessions_captured') || 0) + 1;
+          this.daemon.state.set('training_sessions_captured', count);
+        } catch (e) { /* fail silent */ }
+      }
       this.daemon.registry.update(agentId, { status: 'stopped', pid: null });
       return;
     }

package/node_modules/@groove-dev/daemon/src/tool-executor.js

@@ -2,7 +2,7 @@
 // FSL-1.1-Apache-2.0 — see LICENSE
 
 import { readFileSync, writeFileSync, readdirSync, statSync, mkdirSync, existsSync } from 'fs';
-import { execSync, execFileSync } from 'child_process';
+import { execSync } from 'child_process';
 import { resolve, relative, dirname, sep } from 'path';
 import { minimatch } from 'minimatch';
 
@@ -120,10 +120,11 @@ export const TOOL_DEFINITIONS = [
 ];
 
 export class ToolExecutor {
-  constructor(workingDir, daemon, agentId) {
+  constructor(workingDir, daemon, agentId, projectDir) {
     this.workingDir = resolve(workingDir);
     this.daemon = daemon;
     this.agentId = agentId;
+    this.projectDir = resolve(projectDir || workingDir);
   }
 
   async execute(name, args) {
@@ -155,6 +156,15 @@ export class ToolExecutor {
     return resolved;
   }
 
+  _resolveReadPath(filePath) {
+    if (!filePath) throw new Error('Path is required');
+    const resolved = resolve(this.workingDir, filePath);
+    if (!resolved.startsWith(this.projectDir + sep) && resolved !== this.projectDir) {
+      throw new Error(`Access denied: path outside project directory`);
+    }
+    return resolved;
+  }
+
   _checkWriteScope(resolvedPath) {
     if (!this.daemon?.locks) return;
     const rel = relative(this.workingDir, resolvedPath);
@@ -171,7 +181,7 @@ export class ToolExecutor {
   // --- Tool Implementations ---
 
   readFile({ path: filePath, offset, limit }) {
-    const resolved = this._resolvePath(filePath);
+    const resolved = this._resolveReadPath(filePath);
     if (!existsSync(resolved)) {
       return { success: false, error: `File not found: ${filePath}` };
     }
@@ -241,16 +251,17 @@ export class ToolExecutor {
     const execCwd = cwd ? this._resolvePath(cwd) : this.workingDir;
     const timeoutMs = Math.min(timeout || 30000, 120000);
 
+    if (/\brm\s+(-\w+\s+)*-rf\s+(\/|~)/.test(command) || /\bsudo\b/.test(command)) {
+      return { success: false, error: 'Command blocked: dangerous shell pattern detected' };
+    }
+
     try {
-      // Split command safely for shell: false — avoids shell injection
-      const parts = command.split(/\s+/);
-      const cmd = parts[0];
-      const cmdArgs = parts.slice(1);
-      const output = execFileSync(cmd, cmdArgs, {
+      const output = execSync(command, {
         cwd: execCwd,
         timeout: timeoutMs,
         maxBuffer: 1024 * 1024,
         encoding: 'utf8',
+        shell: true,
         env: { ...process.env, GROOVE_AGENT_ID: this.agentId },
       });
       // Cap output to prevent context window blowup
@@ -265,7 +276,7 @@ export class ToolExecutor {
   }
 
   searchFiles({ pattern, cwd }) {
-    const searchDir = cwd ? this._resolvePath(cwd) : this.workingDir;
+    const searchDir = cwd ? this._resolveReadPath(cwd) : this.workingDir;
     const results = [];
 
     const walk = (dir, depth) => {
@@ -298,7 +309,7 @@ export class ToolExecutor {
     if (!/^[a-zA-Z0-9_.\-\/\\*?[\]{}()|^$+\s]+$/.test(pattern)) {
       throw new Error('Invalid search pattern');
     }
-    const searchDir = searchPath ? this._resolvePath(searchPath) : this.workingDir;
+    const searchDir = searchPath ? this._resolveReadPath(searchPath) : this.workingDir;
 
     // Prefer ripgrep (faster, respects .gitignore), fall back to grep
     const escapedPattern = pattern.replace(/'/g, "'\\''");
@@ -342,7 +353,7 @@ export class ToolExecutor {
   }
 
   listDirectory({ path: dirPath } = {}) {
-    const resolved = dirPath ? this._resolvePath(dirPath) : this.workingDir;
+    const resolved = dirPath ? this._resolveReadPath(dirPath) : this.workingDir;
 
     if (!existsSync(resolved)) {
       return { success: false, error: `Directory not found: ${dirPath || '.'}` };