linkgravity 1.5.6 → 1.5.7

package/bin/cli.js

@@ -15,6 +15,7 @@ const {
 } = require('./platforms');
 
 const { python: pythonExe, isWin } = require('../npm-scripts/venv-paths');
+const { isEnvironmentReady } = require('../npm-scripts/ensure-env');
 
 const cmd = process.argv[2];
 
@@ -378,6 +379,14 @@ if (cmd === 'version' || cmd === '-v' || cmd === '--version') {
         process.exit(1);
     }
 
+    if (!isEnvironmentReady()) {
+        console.log(
+            `\n${color.yellow}⚠${color.reset} Python environment isn't set up yet - ` +
+                `run ${color.cyan}lgy setup${color.reset} first (it installs everything on its first run).\n`,
+        );
+        process.exit(1);
+    }
+
     info('Starting LinkGravity daemon...');
     runPm2(['start', LGY_SCRIPT_PATH, '--interpreter', pythonExe, '--name', LGY_PM2_NAME]);
     verifyStartup().then((ok) => process.exit(ok ? 0 : 1));

package/bin/setup.js

@@ -446,6 +446,13 @@ async function runSetup() {
     console.log();
     p.intro(`${color.cyan}▶ LinkGravity Setup Wizard${color.reset}`);
 
+    const { ensureEnvironment, isEnvironmentReady } = require('../npm-scripts/ensure-env');
+    if (!isEnvironmentReady()) {
+        console.log();
+        ensureEnvironment();
+        console.log();
+    }
+
     const registerHook = require('../npm-scripts/register-hook');
     if (!registerHook.isHookRegistered()) {
         const consent = await p.confirm({

package/hooks/hook.py

@@ -4,6 +4,17 @@ import os
 import sys
 import urllib.error
 import urllib.request
+from pathlib import Path
+
+LGY_CONFIG_FILE = Path.home() / ".gemini" / "linkgravity" / "lgy.json"
+
+
+def _load_approve_token():
+    try:
+        with open(LGY_CONFIG_FILE, encoding="utf-8") as f:
+            return json.load(f).get("approve_token", "")
+    except Exception:
+        return ""
 
 
 def main():
@@ -34,7 +45,9 @@ def main():
     ).encode("utf-8")
 
     req = urllib.request.Request(
-        "http://localhost:18080/approve", data=payload, headers={"Content-Type": "application/json"}
+        "http://localhost:18080/approve",
+        data=payload,
+        headers={"Content-Type": "application/json", "X-LGY-Token": _load_approve_token()},
     )
 
     try:

package/npm-scripts/ensure-env.js

@@ -0,0 +1,40 @@
+'use strict';
+const { execSync } = require('child_process');
+const os = require('os');
+const path = require('path');
+const fs = require('fs');
+const { pip: venvPip, python: venvPython, workspaceDir, repoRoot } = require('./venv-paths');
+
+const isWin = os.platform() === 'win32';
+const pyCmd = isWin ? 'python' : 'python3';
+
+function isEnvironmentReady() {
+    return fs.existsSync(venvPython);
+}
+
+function ensureEnvironment() {
+    if (isEnvironmentReady()) return;
+
+    console.log('⚙️  Setting up Python Virtual Environment...');
+    console.log(
+        `   (in ${path.join(workspaceDir, 'venv')} - not inside this install, so it survives`,
+    );
+    console.log('    package updates/reinstalls and works the same whether this is a global');
+    console.log('    `npm install -g linkgravity` or a local dev clone.)');
+
+    fs.mkdirSync(workspaceDir, { recursive: true });
+    execSync(`${pyCmd} -m venv "${path.join(workspaceDir, 'venv')}"`, { stdio: 'inherit' });
+
+    console.log('📦 Installing Python dependencies...');
+    execSync(`"${venvPip}" install -r requirements.txt`, { stdio: 'inherit', cwd: repoRoot });
+
+    console.log('🎙️  Installing Voice Service dependencies...');
+    execSync('npm install', {
+        stdio: 'inherit',
+        cwd: path.join(repoRoot, 'voice-service'),
+    });
+
+    console.log('✅ Environment ready.');
+}
+
+module.exports = { ensureEnvironment, isEnvironmentReady };

package/npm-scripts/prepare.js

@@ -2,9 +2,8 @@
 // Runs at `prepare` time - which npm only triggers for a local `npm
 // install` inside this repo (i.e. a git clone / contributor checkout),
 // never for `npm install -g linkgravity` end users installing the published
-// package from the registry. That's exactly why dev-only setup (git
-// hooks, lint tooling) lives here instead of postinstall.js, which runs
-// for everyone, including end users who don't need any of this.
+// package from the registry. That's why dev-only setup (git hooks, lint
+// tooling) lives here rather than running for every end user.
 'use strict';
 const { execSync } = require('child_process');
 const fs = require('fs');
@@ -13,14 +12,13 @@ const { repoRoot, pip, preCommit } = require('./venv-paths');
 if (!fs.existsSync(pip)) {
     console.warn(
         '⚠️  No venv found yet - skipping dev tooling install and git hook setup. ' +
-            'Run `npm install` again once the venv exists, or set it up manually.',
+            'Run `node bin/cli.js setup` to create it, then `npm install` again.',
     );
     return;
 }
 
-// 1. Dev-only Python tooling into the same venv postinstall.js already
-// created (prepare always runs after postinstall in npm's lifecycle
-// order): ruff (editor/manual use) and pre-commit itself, which is
+// 1. Dev-only Python tooling into the same venv `lgy setup` already
+// created: ruff (editor/manual use) and pre-commit itself, which is
 // what actually runs the hooks declared in .pre-commit-config.yaml.
 try {
     execSync(`"${pip}" install -r requirements-dev.txt`, { stdio: 'inherit', cwd: repoRoot });

package/package.json

@@ -1,9 +1,8 @@
 {
   "name": "linkgravity",
-  "version": "1.5.6",
+  "version": "1.5.7",
   "description": "Discord/Telegram bot bridge for the Antigravity (agy) CLI, with voice interaction support",
   "scripts": {
-    "postinstall": "node npm-scripts/postinstall.js",
     "start": "node npm-scripts/run-dev.js",
     "dev": "node npm-scripts/run-dev.js",
     "format": "prettier --write \"bin/**/*.js\" \"npm-scripts/**/*.js\" \"voice-service/*.js\"",

package/src/api/server.py

@@ -1,6 +1,15 @@
 from aiohttp import web
 
-from config import logger, session_manager
+from config import bot_settings, logger, session_manager
+
+LGY_TOKEN_HEADER = "X-LGY-Token"
+
+
+@web.middleware
+async def auth_middleware(request, handler):
+    if request.headers.get(LGY_TOKEN_HEADER) != bot_settings.get("approve_token"):
+        return web.json_response({"error": "unauthorized"}, status=403)
+    return await handler(request)
 
 
 def is_tool_allowed(tool_name, tool_input):
@@ -20,7 +29,7 @@ def is_tool_allowed(tool_name, tool_input):
 
 
 async def setup_webhook_server(bot):
-    app = web.Application(client_max_size=50 * 1024 * 1024)
+    app = web.Application(client_max_size=50 * 1024 * 1024, middlewares=[auth_middleware])
     app["bot"] = bot
 
     from api.ui_routes import handle_approve_request

package/src/config.py

@@ -1,4 +1,5 @@
 import os
+import secrets
 from pathlib import Path
 
 from core.atomic_io import atomic_write_json, safe_load_json
@@ -30,6 +31,7 @@ DEFAULT_LGY_CONFIG = {
     "tts_enabled": True,
     # Sticky default for /new sessions, set whenever /model succeeds.
     "default_model": "",
+    "approve_token": "",
 }
 
 
@@ -71,6 +73,10 @@ def save_bot_settings(data):
 
 bot_settings = load_bot_settings()
 
+if not bot_settings.get("approve_token"):
+    bot_settings["approve_token"] = secrets.token_hex(24)
+    save_bot_settings(bot_settings)
+
 from core.logger import init_logger
 from core.session_manager import SessionManager
 

package/voice-service/receiver.js

@@ -5,6 +5,7 @@ const { googleSTT } = require('./stt');
 const { getDetectorForUser, feedPCMToDetector, WAKE_MATCH_THRESHOLD } = require('./wakeword');
 const { interruptTTS } = require('./tts');
 const state = require('./state');
+const { aglConfig } = require('./config');
 const { activeStreams, enrollingUsers, isPlaying, wakeWordOptedOut, runtime, isGuildActive } =
     state;
 
@@ -108,7 +109,10 @@ function setupReceiver(connection, guildId, client) {
             partialSent = true;
             fetch('http://127.0.0.1:18080/stt_partial', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-LGY-Token': aglConfig.approve_token,
+                },
                 body: JSON.stringify({ guild_id: guildId, text }),
             }).catch((err) =>
                 console.error(`[STT] Failed to send partial text to Python:`, err.message),
@@ -248,7 +252,10 @@ function setupReceiver(connection, guildId, client) {
                         `http://127.0.0.1:18080/enroll_sample?user_id=${encodeURIComponent(userId)}`,
                         {
                             method: 'POST',
-                            headers: { 'Content-Type': 'application/octet-stream' },
+                            headers: {
+                                'Content-Type': 'application/octet-stream',
+                                'X-LGY-Token': aglConfig.approve_token,
+                            },
                             body: wavBuffer,
                         },
                     );
@@ -263,7 +270,10 @@ function setupReceiver(connection, guildId, client) {
                 if (partialSent) {
                     fetch('http://127.0.0.1:18080/stt_partial_cancel', {
                         method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'X-LGY-Token': aglConfig.approve_token,
+                        },
                         body: JSON.stringify({ guild_id: guildId }),
                     }).catch(() => {});
                 }
@@ -277,7 +287,10 @@ function setupReceiver(connection, guildId, client) {
                 if (partialSent) {
                     fetch('http://127.0.0.1:18080/stt_partial_cancel', {
                         method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'X-LGY-Token': aglConfig.approve_token,
+                        },
                         body: JSON.stringify({ guild_id: guildId }),
                     }).catch(() => {});
                 }
@@ -291,7 +304,10 @@ function setupReceiver(connection, guildId, client) {
             try {
                 await fetch('http://127.0.0.1:18080/stt_input', {
                     method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'X-LGY-Token': aglConfig.approve_token,
+                    },
                     body: JSON.stringify({
                         user_id: userId,
                         guild_id: guildId,

package/voice-service/tts.js

@@ -1,6 +1,7 @@
 const { Readable } = require('stream');
 const { createAudioPlayer, createAudioResource, AudioPlayerStatus } = require('@discordjs/voice');
 const { players, audioQueues, isPlaying, connections, suppressNotifyMap } = require('./state');
+const { aglConfig } = require('./config');
 
 function interruptTTS(guildId) {
     const player = players.get(guildId);
@@ -25,7 +26,7 @@ async function notifyTtsFinished(guild_id) {
     try {
         await fetch('http://127.0.0.1:18080/tts_finished', {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
+            headers: { 'Content-Type': 'application/json', 'X-LGY-Token': aglConfig.approve_token },
             body: JSON.stringify({ guild_id }),
         });
     } catch (err) {

package/npm-scripts/postinstall.js

@@ -1,48 +0,0 @@
-const { execSync } = require('child_process');
-const os = require('os');
-const path = require('path');
-const fs = require('fs');
-const { pip: venvPip, workspaceDir } = require('./venv-paths');
-
-console.log('⚙️  Setting up Python Virtual Environment...');
-console.log(`   (in ${path.join(workspaceDir, 'venv')} - not inside this install, so it survives`);
-console.log('    package updates/reinstalls and works the same whether this is a global');
-console.log('    `npm install -g linkgravity` or a local dev clone.)');
-
-// System python (not the venv's) - only used to create the venv below; every other
-// script goes through venv-paths.js instead.
-const isWin = os.platform() === 'win32';
-const pyCmd = isWin ? 'python' : 'python3';
-
-async function main() {
-    try {
-        // Fixed workspace dir, not cwd - see venv-paths.js for why.
-        fs.mkdirSync(workspaceDir, { recursive: true });
-        execSync(`${pyCmd} -m venv "${path.join(workspaceDir, 'venv')}"`, { stdio: 'inherit' });
-
-        console.log('📦 Installing Python dependencies...');
-        execSync(`"${venvPip}" install -r requirements.txt`, { stdio: 'inherit' });
-
-        console.log('🎙️  Installing Voice Service dependencies...');
-        execSync('npm install', {
-            stdio: 'inherit',
-            cwd: path.join(__dirname, '..', 'voice-service'),
-        });
-
-        // Own try/catch: agy may not be installed yet on a brand new machine, and that shouldn't fail the rest of the install.
-        try {
-            require('./register-hook')({ allowFirstTimeCreate: false });
-        } catch (err) {
-            console.warn(
-                `⚠️  Couldn't register the agy tool-approval hook: ${err.message.split('\n')[0]}`,
-            );
-        }
-
-        console.log('✅ Installation complete!');
-    } catch (error) {
-        console.error('❌ Installation failed. Please ensure Python 3.10+ is installed.');
-        process.exit(1);
-    }
-}
-
-main();