linkgravity 1.5.5 → 1.5.7

package/bin/cli.js

@@ -15,6 +15,7 @@ const {
 } = require('./platforms');
 
 const { python: pythonExe, isWin } = require('../npm-scripts/venv-paths');
+const { isEnvironmentReady } = require('../npm-scripts/ensure-env');
 
 const cmd = process.argv[2];
 
@@ -200,6 +201,10 @@ function verifyStartup() {
             finish(false);
         }, 30000);
 
+        const isBenignShutdownNoise = (str) =>
+            str.includes('asyncio.exceptions.CancelledError') &&
+            str.includes('Application.stop() complete');
+
         const checkLog = (data) => {
             if (settled) return;
             const str = data.toString();
@@ -210,7 +215,8 @@ function verifyStartup() {
                 errorDetectionArmed &&
                 (str.includes('Traceback (most recent call last):') ||
                     str.includes('Error:') ||
-                    str.includes('Exception:'))
+                    str.includes('Exception:')) &&
+                !isBenignShutdownNoise(str)
             ) {
                 console.log(`\n\n${color.yellow}❌ Error detected during startup:${color.reset}`);
                 const errorLines = str
@@ -373,6 +379,14 @@ if (cmd === 'version' || cmd === '-v' || cmd === '--version') {
         process.exit(1);
     }
 
+    if (!isEnvironmentReady()) {
+        console.log(
+            `\n${color.yellow}⚠${color.reset} Python environment isn't set up yet - ` +
+                `run ${color.cyan}lgy setup${color.reset} first (it installs everything on its first run).\n`,
+        );
+        process.exit(1);
+    }
+
     info('Starting LinkGravity daemon...');
     runPm2(['start', LGY_SCRIPT_PATH, '--interpreter', pythonExe, '--name', LGY_PM2_NAME]);
     verifyStartup().then((ok) => process.exit(ok ? 0 : 1));

package/bin/setup.js

@@ -446,6 +446,27 @@ async function runSetup() {
     console.log();
     p.intro(`${color.cyan}▶ LinkGravity Setup Wizard${color.reset}`);
 
+    const { ensureEnvironment, isEnvironmentReady } = require('../npm-scripts/ensure-env');
+    if (!isEnvironmentReady()) {
+        console.log();
+        ensureEnvironment();
+        console.log();
+    }
+
+    const registerHook = require('../npm-scripts/register-hook');
+    if (!registerHook.isHookRegistered()) {
+        const consent = await p.confirm({
+            message:
+                "Register LinkGravity's approval hook with agy? (required for tool-call approval - lets LinkGravity gate agy's actions through Discord/Telegram/Slack)",
+            initialValue: true,
+        });
+        if (p.isCancel(consent)) {
+            p.cancel('Setup cancelled.');
+            process.exit(0);
+        }
+        if (consent) registerHook({ allowFirstTimeCreate: true });
+    }
+
     while (true) {
         const settings = getSettings();
         const options = Object.entries(PLATFORMS).map(([key, def]) => {

package/hooks/hook.py

@@ -4,6 +4,17 @@ import os
 import sys
 import urllib.error
 import urllib.request
+from pathlib import Path
+
+LGY_CONFIG_FILE = Path.home() / ".gemini" / "linkgravity" / "lgy.json"
+
+
+def _load_approve_token():
+    try:
+        with open(LGY_CONFIG_FILE, encoding="utf-8") as f:
+            return json.load(f).get("approve_token", "")
+    except Exception:
+        return ""
 
 
 def main():
@@ -34,7 +45,9 @@ def main():
     ).encode("utf-8")
 
     req = urllib.request.Request(
-        "http://localhost:18080/approve", data=payload, headers={"Content-Type": "application/json"}
+        "http://localhost:18080/approve",
+        data=payload,
+        headers={"Content-Type": "application/json", "X-LGY-Token": _load_approve_token()},
     )
 
     try:

package/npm-scripts/ensure-env.js

@@ -0,0 +1,40 @@
+'use strict';
+const { execSync } = require('child_process');
+const os = require('os');
+const path = require('path');
+const fs = require('fs');
+const { pip: venvPip, python: venvPython, workspaceDir, repoRoot } = require('./venv-paths');
+
+const isWin = os.platform() === 'win32';
+const pyCmd = isWin ? 'python' : 'python3';
+
+function isEnvironmentReady() {
+    return fs.existsSync(venvPython);
+}
+
+function ensureEnvironment() {
+    if (isEnvironmentReady()) return;
+
+    console.log('⚙️  Setting up Python Virtual Environment...');
+    console.log(
+        `   (in ${path.join(workspaceDir, 'venv')} - not inside this install, so it survives`,
+    );
+    console.log('    package updates/reinstalls and works the same whether this is a global');
+    console.log('    `npm install -g linkgravity` or a local dev clone.)');
+
+    fs.mkdirSync(workspaceDir, { recursive: true });
+    execSync(`${pyCmd} -m venv "${path.join(workspaceDir, 'venv')}"`, { stdio: 'inherit' });
+
+    console.log('📦 Installing Python dependencies...');
+    execSync(`"${venvPip}" install -r requirements.txt`, { stdio: 'inherit', cwd: repoRoot });
+
+    console.log('🎙️  Installing Voice Service dependencies...');
+    execSync('npm install', {
+        stdio: 'inherit',
+        cwd: path.join(repoRoot, 'voice-service'),
+    });
+
+    console.log('✅ Environment ready.');
+}
+
+module.exports = { ensureEnvironment, isEnvironmentReady };

package/npm-scripts/prepare.js

@@ -2,9 +2,8 @@
 // Runs at `prepare` time - which npm only triggers for a local `npm
 // install` inside this repo (i.e. a git clone / contributor checkout),
 // never for `npm install -g linkgravity` end users installing the published
-// package from the registry. That's exactly why dev-only setup (git
-// hooks, lint tooling) lives here instead of postinstall.js, which runs
-// for everyone, including end users who don't need any of this.
+// package from the registry. That's why dev-only setup (git hooks, lint
+// tooling) lives here rather than running for every end user.
 'use strict';
 const { execSync } = require('child_process');
 const fs = require('fs');
@@ -13,14 +12,13 @@ const { repoRoot, pip, preCommit } = require('./venv-paths');
 if (!fs.existsSync(pip)) {
     console.warn(
         '⚠️  No venv found yet - skipping dev tooling install and git hook setup. ' +
-            'Run `npm install` again once the venv exists, or set it up manually.',
+            'Run `node bin/cli.js setup` to create it, then `npm install` again.',
     );
     return;
 }
 
-// 1. Dev-only Python tooling into the same venv postinstall.js already
-// created (prepare always runs after postinstall in npm's lifecycle
-// order): ruff (editor/manual use) and pre-commit itself, which is
+// 1. Dev-only Python tooling into the same venv `lgy setup` already
+// created: ruff (editor/manual use) and pre-commit itself, which is
 // what actually runs the hooks declared in .pre-commit-config.yaml.
 try {
     execSync(`"${pip}" install -r requirements-dev.txt`, { stdio: 'inherit', cwd: repoRoot });

package/npm-scripts/register-hook.js

@@ -1,11 +1,5 @@
 'use strict';
-// Registers/fixes this project's agy hooks in ~/.gemini/config/hooks.json
-// (schema: https://antigravity.google/docs/hooks). Runs on every `npm
-// install` so paths stay correct if this checkout moves, identifying its
-// own entries by `name` (not command string) so a stale path gets fixed
-// in place rather than duplicated, leaving any other configured hooks
-// untouched. Only ever overwrites `command` - never `type`/`timeout`,
-// which the user may have customized - logging old/new values on change.
+// Only ever overwrites `command` on an existing entry - never `type`/`timeout`, which the user may have customized.
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -13,11 +7,9 @@ const { repoRoot, python: venvPython } = require('./venv-paths');
 
 const hooksJsonPath = path.join(os.homedir(), '.gemini', 'config', 'hooks.json');
 
-// PreToolUse: tool-approval gate, matcher-wrapped per schema.
-// Stop: fires when agy is about to end a turn; if fullyIdle is false
-// (an async run_command is still in flight), stop_hook.py tells agy to
-// keep going instead of ending the turn with that result lost. Flat
-// array per schema (no matcher - nothing to match tool names against).
+// PreToolUse/Stop meanings are agy's own hook contract: Stop fires when agy is about to
+// end a turn, and if fullyIdle is false (an async run_command still in flight), stop_hook.py
+// tells agy to keep going instead of losing that result.
 const HOOK_REGISTRATIONS = [
     {
         eventType: 'PreToolUse',
@@ -35,9 +27,6 @@ const HOOK_REGISTRATIONS = [
     },
 ];
 
-// Hooks retired from HOOK_REGISTRATIONS but listed here so an existing
-// install actually gets the stale entry removed from hooks.json, instead
-// of a zombie entry pointing at a script that no longer exists.
 const RETIRED_HOOKS = [{ eventType: 'PreInvocation', name: 'wait-ms-before-async-reminder' }];
 
 function loadHooksConfig() {
@@ -47,9 +36,6 @@ function loadHooksConfig() {
     try {
         return JSON.parse(fs.readFileSync(hooksJsonPath, 'utf8'));
     } catch (err) {
-        // Back up rather than silently clobbering whatever was there -
-        // it may have other hooks configured that have nothing to do
-        // with this project.
         const backupPath = `${hooksJsonPath}.corrupted-${Date.now()}`;
         fs.copyFileSync(hooksJsonPath, backupPath);
         console.warn(
@@ -76,7 +62,6 @@ function findHookEntry(config, eventType, name, wrapInMatcher) {
         }
         return hookEntry;
     }
-    // Flat array (Stop/PreInvocation/PostInvocation) - no matcher wrapper.
     let hookEntry = config.hooks[eventType].find((h) => h.name === name);
     if (!hookEntry) {
         hookEntry = { name };
@@ -94,8 +79,6 @@ function removeRetiredHooks(config) {
         const nextArr = [];
         for (const entry of arr) {
             if (Array.isArray(entry.hooks)) {
-                // Matcher-wrapped shape - drop the matcher block too if
-                // nothing's left in it.
                 const beforeLen = entry.hooks.length;
                 entry.hooks = entry.hooks.filter((h) => h.name !== retired.name);
                 if (entry.hooks.length !== beforeLen) {
@@ -106,7 +89,6 @@ function removeRetiredHooks(config) {
                 }
                 if (entry.hooks.length > 0) nextArr.push(entry);
             } else {
-                // Flat shape.
                 if (entry.name === retired.name) {
                     removedAny = true;
                     console.log(
@@ -122,9 +104,24 @@ function removeRetiredHooks(config) {
     return removedAny;
 }
 
-function registerHook() {
+function registerHook({ allowFirstTimeCreate = true } = {}) {
     const config = loadHooksConfig();
     config.hooks = config.hooks || {};
+
+    const isFirstTime = HOOK_REGISTRATIONS.some((reg) => {
+        const arr = config.hooks[reg.eventType] || [];
+        return reg.wrapInMatcher
+            ? !arr.some((m) => (m.hooks || []).some((h) => h.name === reg.name))
+            : !arr.some((h) => h.name === reg.name);
+    });
+
+    if (isFirstTime && !allowFirstTimeCreate) {
+        console.log(
+            "ℹ️  LinkGravity's Discord/Telegram/Slack approval hook isn't registered with agy yet - run `lgy setup` to enable it.",
+        );
+        return;
+    }
+
     let wroteChange = false;
     let backedUp = false;
 
@@ -175,7 +172,19 @@ function registerHook() {
     }
 }
 
+function isHookRegistered() {
+    const config = loadHooksConfig();
+    config.hooks = config.hooks || {};
+    return HOOK_REGISTRATIONS.every((reg) => {
+        const arr = config.hooks[reg.eventType] || [];
+        return reg.wrapInMatcher
+            ? arr.some((m) => (m.hooks || []).some((h) => h.name === reg.name))
+            : arr.some((h) => h.name === reg.name);
+    });
+}
+
 module.exports = registerHook;
+module.exports.isHookRegistered = isHookRegistered;
 
 if (require.main === module) {
     registerHook();

package/package.json

@@ -1,9 +1,8 @@
 {
   "name": "linkgravity",
-  "version": "1.5.5",
+  "version": "1.5.7",
   "description": "Discord/Telegram bot bridge for the Antigravity (agy) CLI, with voice interaction support",
   "scripts": {
-    "postinstall": "node npm-scripts/postinstall.js",
     "start": "node npm-scripts/run-dev.js",
     "dev": "node npm-scripts/run-dev.js",
     "format": "prettier --write \"bin/**/*.js\" \"npm-scripts/**/*.js\" \"voice-service/*.js\"",

package/src/api/server.py

@@ -1,6 +1,15 @@
 from aiohttp import web
 
-from config import logger, session_manager
+from config import bot_settings, logger, session_manager
+
+LGY_TOKEN_HEADER = "X-LGY-Token"
+
+
+@web.middleware
+async def auth_middleware(request, handler):
+    if request.headers.get(LGY_TOKEN_HEADER) != bot_settings.get("approve_token"):
+        return web.json_response({"error": "unauthorized"}, status=403)
+    return await handler(request)
 
 
 def is_tool_allowed(tool_name, tool_input):
@@ -20,7 +29,7 @@ def is_tool_allowed(tool_name, tool_input):
 
 
 async def setup_webhook_server(bot):
-    app = web.Application(client_max_size=50 * 1024 * 1024)
+    app = web.Application(client_max_size=50 * 1024 * 1024, middlewares=[auth_middleware])
     app["bot"] = bot
 
     from api.ui_routes import handle_approve_request
@@ -41,6 +50,6 @@ async def setup_webhook_server(bot):
 
     runner = web.AppRunner(app)
     await runner.setup()
-    site = web.TCPSite(runner, "0.0.0.0", 18080)
+    site = web.TCPSite(runner, "127.0.0.1", 18080)
     await site.start()
     logger.info("Webhook / STT Server started on port 18080")

package/src/config.py

@@ -1,4 +1,5 @@
 import os
+import secrets
 from pathlib import Path
 
 from core.atomic_io import atomic_write_json, safe_load_json
@@ -30,6 +31,7 @@ DEFAULT_LGY_CONFIG = {
     "tts_enabled": True,
     # Sticky default for /new sessions, set whenever /model succeeds.
     "default_model": "",
+    "approve_token": "",
 }
 
 
@@ -71,6 +73,10 @@ def save_bot_settings(data):
 
 bot_settings = load_bot_settings()
 
+if not bot_settings.get("approve_token"):
+    bot_settings["approve_token"] = secrets.token_hex(24)
+    save_bot_settings(bot_settings)
+
 from core.logger import init_logger
 from core.session_manager import SessionManager
 

package/voice-service/receiver.js

@@ -5,6 +5,7 @@ const { googleSTT } = require('./stt');
 const { getDetectorForUser, feedPCMToDetector, WAKE_MATCH_THRESHOLD } = require('./wakeword');
 const { interruptTTS } = require('./tts');
 const state = require('./state');
+const { aglConfig } = require('./config');
 const { activeStreams, enrollingUsers, isPlaying, wakeWordOptedOut, runtime, isGuildActive } =
     state;
 
@@ -108,7 +109,10 @@ function setupReceiver(connection, guildId, client) {
             partialSent = true;
             fetch('http://127.0.0.1:18080/stt_partial', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-LGY-Token': aglConfig.approve_token,
+                },
                 body: JSON.stringify({ guild_id: guildId, text }),
             }).catch((err) =>
                 console.error(`[STT] Failed to send partial text to Python:`, err.message),
@@ -248,7 +252,10 @@ function setupReceiver(connection, guildId, client) {
                         `http://127.0.0.1:18080/enroll_sample?user_id=${encodeURIComponent(userId)}`,
                         {
                             method: 'POST',
-                            headers: { 'Content-Type': 'application/octet-stream' },
+                            headers: {
+                                'Content-Type': 'application/octet-stream',
+                                'X-LGY-Token': aglConfig.approve_token,
+                            },
                             body: wavBuffer,
                         },
                     );
@@ -263,7 +270,10 @@ function setupReceiver(connection, guildId, client) {
                 if (partialSent) {
                     fetch('http://127.0.0.1:18080/stt_partial_cancel', {
                         method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'X-LGY-Token': aglConfig.approve_token,
+                        },
                         body: JSON.stringify({ guild_id: guildId }),
                     }).catch(() => {});
                 }
@@ -277,7 +287,10 @@ function setupReceiver(connection, guildId, client) {
                 if (partialSent) {
                     fetch('http://127.0.0.1:18080/stt_partial_cancel', {
                         method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'X-LGY-Token': aglConfig.approve_token,
+                        },
                         body: JSON.stringify({ guild_id: guildId }),
                     }).catch(() => {});
                 }
@@ -291,7 +304,10 @@ function setupReceiver(connection, guildId, client) {
             try {
                 await fetch('http://127.0.0.1:18080/stt_input', {
                     method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'X-LGY-Token': aglConfig.approve_token,
+                    },
                     body: JSON.stringify({
                         user_id: userId,
                         guild_id: guildId,

package/voice-service/tts.js

@@ -1,6 +1,7 @@
 const { Readable } = require('stream');
 const { createAudioPlayer, createAudioResource, AudioPlayerStatus } = require('@discordjs/voice');
 const { players, audioQueues, isPlaying, connections, suppressNotifyMap } = require('./state');
+const { aglConfig } = require('./config');
 
 function interruptTTS(guildId) {
     const player = players.get(guildId);
@@ -25,7 +26,7 @@ async function notifyTtsFinished(guild_id) {
     try {
         await fetch('http://127.0.0.1:18080/tts_finished', {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
+            headers: { 'Content-Type': 'application/json', 'X-LGY-Token': aglConfig.approve_token },
             body: JSON.stringify({ guild_id }),
         });
     } catch (err) {

package/npm-scripts/postinstall.js

@@ -1,62 +0,0 @@
-const { execSync } = require('child_process');
-const os = require('os');
-const path = require('path');
-const fs = require('fs');
-const { pip: venvPip, workspaceDir } = require('./venv-paths');
-
-console.log('⚙️  Setting up Python Virtual Environment...');
-console.log(`   (in ${path.join(workspaceDir, 'venv')} - not inside this install, so it survives`);
-console.log('    package updates/reinstalls and works the same whether this is a global');
-console.log('    `npm install -g linkgravity` or a local dev clone.)');
-
-// Use python on Windows, python3 on Mac/Linux - this is the *system*
-// python used only to create the venv below; once it exists, every
-// other script (this one included) goes through venv-paths.js instead.
-const isWin = os.platform() === 'win32';
-const pyCmd = isWin ? 'python' : 'python3';
-
-async function main() {
-    try {
-        // 1. Create Python virtual environment (venv) in the fixed
-        // workspace dir, not in cwd - see venv-paths.js for why.
-        fs.mkdirSync(workspaceDir, { recursive: true });
-        execSync(`${pyCmd} -m venv "${path.join(workspaceDir, 'venv')}"`, { stdio: 'inherit' });
-
-        // 2. Install Python packages
-        console.log('📦 Installing Python dependencies...');
-        execSync(`"${venvPip}" install -r requirements.txt`, { stdio: 'inherit' });
-
-        // 3. Install Node.js voice service packages (includes
-        // rustpotter-web, which handles both wake-word detection AND
-        // building .rpw reference files in-process - no separate
-        // binary download needed for either).
-        console.log('🎙️  Installing Voice Service dependencies...');
-        execSync('npm install', {
-            stdio: 'inherit',
-            cwd: path.join(__dirname, '..', 'voice-service'),
-        });
-
-        // 4. Register this install's location with agy as its
-        // tool-approval hook (~/.gemini/config/hooks.json) - always
-        // re-run so the registered path self-heals if this checkout
-        // gets moved/renamed later, instead of silently going stale.
-        // Guarded on its own: agy may not be installed/configured yet
-        // on a brand new machine, and that shouldn't fail the rest of
-        // the install - just means the hook needs registering once agy
-        // itself is set up (re-running `npm install` after does it).
-        try {
-            require('./register-hook')();
-        } catch (err) {
-            console.warn(
-                `⚠️  Couldn't register the agy tool-approval hook: ${err.message.split('\n')[0]}`,
-            );
-        }
-
-        console.log('✅ Installation complete!');
-    } catch (error) {
-        console.error('❌ Installation failed. Please ensure Python 3.10+ is installed.');
-        process.exit(1);
-    }
-}
-
-main();