@polderlabs/bizar 10.0.7 → 10.2.0

package/bizar-dash/src/server/routes/artifacts.mjs

@@ -51,18 +51,54 @@ export function createArtifactsRouter({ state, broadcast, projectRoot }) {
     res.json(artifact);
   }));
 
-  // v3.21.0 — Compile the artifact's MDX into a JSON-serializable
-  // glyph structure for the new Glyphs renderer. Returns frontmatter
-  // + a flat list of typed blocks, ready for the client-side block
-  // component map to render.
+  // v3.21.0 — Compile the artifact for the renderer. Dispatches by kind:
+  //   mdx           → JSON glyph blocks (legacy v3-v9 renderer)
+  //   claude-html   → iframe-ready HTML envelope
+  //   claude-svg    → iframe-ready HTML envelope (SVG body)
+  //   claude-react  → iframe-ready HTML envelope (Babel-standalone JSX)
+  // The Claude-* envelope is ready to drop into an iframe `srcdoc`; the
+  // client previewer component (`<ClaudeArtifactView>`) picks the
+  // correct renderer based on `kind` and `html`.
   router.get('/artifacts/:slug/render', wrap(async (req, res) => {
     const artifact = artifactsStore.get(req.params.slug, projectRoot);
     if (!artifact) {
       res.status(404).json({ error: 'not_found' });
       return;
     }
-    const compiled = await compileGlyphMdx(artifact.planMdx || '');
-    res.json({ slug: req.params.slug, ...compiled });
+    const kind = artifact.kind || 'mdx';
+    if (kind === 'mdx') {
+      const compiled = await compileGlyphMdx(artifact.planMdx || '');
+      res.json({ slug: req.params.slug, kind, ...compiled });
+      return;
+    }
+    const compiled = artifactsStore.compile(req.params.slug, projectRoot);
+    if (!compiled) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.json({
+      slug: req.params.slug,
+      kind: compiled.kind,
+      html: compiled.html,
+      warnings: compiled.warnings || [],
+      safeMode: !!compiled.safeMode,
+      compiledAt: compiled.compiledAt,
+    });
+  }));
+
+  // v10.1.0 — Full-screen viewer. Returns the compiled HTML envelope
+  // with `Content-Type: text/html` so a `<a target="_blank">` opens
+  // the artifact on its own page (no dashboard chrome). The iframe
+  // `sandbox` rules from the envelope apply — the page is just the
+  // envelope served as `text/html`.
+  router.get('/artifacts/:slug/view', wrap(async (req, res) => {
+    const compiled = artifactsStore.compile(req.params.slug, projectRoot);
+    if (!compiled) {
+      res.status(404).type('html').send('<h1>Not found</h1>');
+      return;
+    }
+    res.set('Content-Security-Policy', "default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' https://unpkg.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src * data:;");
+    res.type('html').send(compiled.html);
   }));
 
   // v3.1.0 — Full artifact CRUD + canvas editing.

package/bizar-dash/src/server/routes/audit.mjs

@@ -0,0 +1,78 @@
+/**
+ * src/server/routes/audit.mjs
+ *
+ * GET /api/audit — returns latest harness audit score + diff vs prior.
+ *
+ * Reads .harness/audit/latest.json (written by `node scripts/audit.mjs --write`).
+ * Returns the full audit result plus a `diff` object showing which categories
+ * changed score vs the prior run (if any).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {string} deps.projectRoot
+ * @returns {import('express').Router}
+ */
+export function createAuditRouter({ projectRoot }) {
+  const router = require('express').Router();
+  const LATEST = join(projectRoot, '.harness', 'audit', 'latest.json');
+
+  router.get('/audit', wrap(async (_req, res) => {
+    if (!existsSync(LATEST)) {
+      res.status(404).json({
+        error: 'not_ready',
+        message: 'No audit run yet. Run `node scripts/audit.mjs --write` first.',
+      });
+      return;
+    }
+
+    let latest;
+    try {
+      latest = JSON.parse(readFileSync(LATEST, 'utf8'));
+    } catch (err) {
+      res.status(500).json({ error: 'parse_error', message: err.message });
+      return;
+    }
+
+    // Compute diff vs the run before last (if we have history)
+    /** @type {Record<string, {current: number, prior: number, delta: number} | null>} */
+    const diff = {};
+    const priorPath = join(projectRoot, '.harness', 'audit', 'previous.json');
+
+    if (existsSync(priorPath)) {
+      try {
+        const prior = JSON.parse(readFileSync(priorPath, 'utf8'));
+        const priorScores = prior.scores ?? {};
+        for (const [key, weight] of Object.entries(latest.weights ?? {})) {
+          const current = latest.scores?.[key] ?? 0;
+          const priorScore = priorScores[key] ?? 0;
+          if (current !== priorScore) {
+            diff[key] = { current, prior: priorScore, delta: current - priorScore };
+          }
+        }
+        // Also diff total
+        const currentTotal = latest.total ?? 0;
+        const priorTotal = prior.total ?? 0;
+        if (currentTotal !== priorTotal) {
+          diff._total = { current: currentTotal, prior: priorTotal, delta: currentTotal - priorTotal };
+        }
+      } catch {
+        // prior file unreadable — no diff
+      }
+    }
+
+    res.json({
+      latest,
+      diff,
+      _links: {
+        run: 'node scripts/audit.mjs --write',
+        latestPath: LATEST,
+      },
+    });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/decisions.mjs

@@ -0,0 +1,78 @@
+/**
+ * src/server/routes/decisions.mjs
+ *
+ * v10.1.1 — Pillar D: Decisions log API.
+ *
+ * GET /api/decisions
+ *   Returns list of decisions + tamper-evidence status.
+ *
+ * Storage: <projectRoot>/.bizar/learning/decisions.jsonl
+ *   Falls back to BIZAR_HOME if projectRoot is not set.
+ */
+
+'use strict';
+
+import { Router } from 'express';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { wrap } from './_shared.mjs';
+
+/** Default root: projectRoot > cwd > $HOME */
+function resolveRoot(projectRoot) {
+  if (projectRoot && projectRoot !== '.') return projectRoot;
+  try { return process.cwd(); } catch { return homedir(); }
+}
+
+/**
+ * @param {object} deps
+ * @param {string} [deps.projectRoot]
+ * @returns {import('express').Router}
+ */
+export function createDecisionsRouter({ projectRoot } = {}) {
+  const router = Router();
+  const root = projectRoot ?? resolveRoot(projectRoot);
+
+  // Lazy-import SDK to avoid hard coupling at boot time.
+  async function getDecisionsMod() {
+    // Try the published SDK first, then fall back to monorepo dist.
+    try {
+      return await import('@polderlabs/bizar-sdk/learning');
+    } catch {
+      return await import('../../../packages/sdk/dist/learning/index.js');
+    }
+  }
+
+  // GET /decisions — list + tamper status
+  router.get('/decisions', wrap(async (_req, res) => {
+    let mod;
+    try {
+      mod = await getDecisionsMod();
+    } catch (err) {
+      res.status(503).json({ error: 'unavailable', message: 'SDK not loaded', detail: err?.message });
+      return;
+    }
+
+    const decisions = mod.listDecisions ? mod.listDecisions({ project: root }) : [];
+    const verified = mod.verifyChain ? mod.verifyChain({ project: root }) : { ok: true };
+
+    // Apply datamark to all string fields to sanitise surrogates.
+    const sanitised = decisions.map((entry) => {
+      const out = {};
+      for (const [k, v] of Object.entries(entry)) {
+        out[k] = mod.datamark ? mod.datamark(v) : v;
+      }
+      return out;
+    });
+
+    res.json({
+      decisions: sanitised,
+      tamperEvidence: {
+        status: verified.ok ? 'intact' : 'broken',
+        at: verified.at ?? null,
+      },
+    });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/model-router.mjs

@@ -0,0 +1,158 @@
+/**
+ * src/server/routes/model-router.mjs
+ *
+ * Surfaces the local model-router configuration and live model list.
+ *
+ *   GET /api/model-router                 — full policy + agent→model map
+ *   GET /api/model-router/models          — live model list from the local router
+ *   GET /api/model-router/agents          — agent→model map only
+ *   GET /api/model-router/resolve/:agent  — concrete model + endpoint for an agent
+ *
+ * The local router URL defaults to ANTHROPIC_BASE_URL or
+ * BIZAR_MODEL_ROUTER_URL or `http://localhost:20128/v1`.
+ */
+import { Router } from 'express';
+import { readFile } from 'node:fs/promises';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { wrap } from './_shared.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// .claude/model-router.json — repo root.
+// From src/server/routes/ up to repo root is 3 levels (routes -> server -> src -> repo).
+const ROUTER_POLICY_PATH = resolve(__dirname, '../../../../.claude/model-router.json');
+
+const DEFAULT_ENDPOINT = 'http://localhost:20128/v1';
+
+function resolveEndpoint(state) {
+  const fromEnv =
+    process.env.BIZAR_MODEL_ROUTER_URL ||
+    process.env.ANTHROPIC_BASE_URL ||
+    state?.config?.modelRouterUrl;
+  return (fromEnv || DEFAULT_ENDPOINT).replace(/\/+$/, '');
+}
+
+async function loadPolicy() {
+  try {
+    const raw = await readFile(ROUTER_POLICY_PATH, 'utf8');
+    return JSON.parse(raw);
+  } catch {
+    return {
+      version: '0.0.0',
+      endpoint: DEFAULT_ENDPOINT,
+      tiers: {},
+      agents: {},
+      policies: {},
+    };
+  }
+}
+
+async function fetchLiveModels(endpoint) {
+  try {
+    const res = await fetch(`${endpoint}/models`, {
+      signal: AbortSignal.timeout(2000),
+    });
+    if (!res.ok) return { reachable: false, error: `HTTP ${res.status}` };
+    const body = await res.json();
+    return {
+      reachable: true,
+      endpoint,
+      models: Array.isArray(body?.data) ? body.data : [],
+    };
+  } catch (err) {
+    return {
+      reachable: false,
+      endpoint,
+      error: err instanceof Error ? err.message : String(err),
+    };
+  }
+}
+
+/**
+ * v10.1.0 — Resolve the concrete model + endpoint for a named agent
+ * directly from the on-disk policy. No SDK import needed (keeps the
+ * dashboard route surface lightweight). Used by the front-end's
+ * "agent fleet" view, which renders one card per agent with its
+ * modelId + endpoint badge.
+ */
+function resolveAgentFromPolicy(policy, agent, endpoint) {
+  const agents = policy?.agents || {};
+  const entry = agents[agent];
+  if (entry && typeof entry.model === 'string') {
+    return {
+      agent,
+      modelId: entry.model,
+      tier: typeof entry.tier === 'string' ? entry.tier : 'default',
+      endpoint,
+      rationale: typeof entry.rationale === 'string' ? entry.rationale : '',
+    };
+  }
+  // Fallback: first known entry by name, otherwise the default tier.
+  const fallback = Object.values(agents).find((e) => e && typeof e.model === 'string');
+  if (fallback) {
+    return {
+      agent,
+      modelId: fallback.model,
+      tier: typeof fallback.tier === 'string' ? fallback.tier : 'default',
+      endpoint,
+      rationale: 'fallback (agent not in policy)',
+    };
+  }
+  return {
+    agent,
+    modelId: 'bizar/MiniMax-M3',
+    tier: 'default',
+    endpoint,
+    rationale: 'fallback (no policy)',
+  };
+}
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @returns {import('express').Router}
+ */
+export function createModelRouterRouter({ state }) {
+  const router = Router();
+
+  router.get('/model-router', wrap(async (_req, res) => {
+    const policy = await loadPolicy();
+    const endpoint = resolveEndpoint(state);
+    const live = await fetchLiveModels(endpoint);
+    res.json({
+      endpoint,
+      policy,
+      live,
+      agents: policy.agents || {},
+      tiers: policy.tiers || {},
+    });
+  }));
+
+  router.get('/model-router/models', wrap(async (_req, res) => {
+    const endpoint = resolveEndpoint(state);
+    const live = await fetchLiveModels(endpoint);
+    res.json(live);
+  }));
+
+  router.get('/model-router/agents', wrap(async (_req, res) => {
+    const policy = await loadPolicy();
+    res.json({ agents: policy.agents || {}, tiers: policy.tiers || {} });
+  }));
+
+  // v10.1.0 — Resolve one agent to its concrete model + endpoint.
+  // The front-end's ModelRouter page calls this so it doesn't need to
+  // duplicate the registry logic client-side.
+  router.get('/model-router/resolve/:agent', wrap(async (req, res) => {
+    const agent = String(req.params.agent || '').trim();
+    if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(agent)) {
+      res.status(400).json({ error: 'bad_slug', message: 'agent must match /^[a-z][a-z0-9_-]{0,63}$/' });
+      return;
+    }
+    const policy = await loadPolicy();
+    const endpoint = resolveEndpoint(state);
+    const resolved = resolveAgentFromPolicy(policy, agent, endpoint);
+    res.json(resolved);
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/model-router.test.mjs

@@ -0,0 +1,104 @@
+/**
+ * Smoke test for /api/model-router. Verifies:
+ *  - the route resolves and returns the agent→model map
+ *  - live model probe gracefully degrades when the endpoint is unreachable
+ *  - the policy file is read from `.claude/model-router.json`
+ *
+ * Run with: bun test src/server/routes/model-router.test.mjs
+ * or:       node --test src/server/routes/model-router.test.mjs
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import express from 'express';
+import { createModelRouterRouter } from './model-router.mjs';
+
+function buildApp() {
+  const app = express();
+  // Mount under /api to match the dashboard's mount prefix.
+  app.use('/api', createModelRouterRouter({ state: {} }));
+  return app;
+}
+
+async function getJson(app, path) {
+  const server = app.listen(0);
+  try {
+    const port = server.address().port;
+    const res = await fetch(`http://127.0.0.1:${port}${path}`);
+    return { status: res.status, body: await res.json() };
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+}
+
+test('GET /api/model-router returns agent→model map from .claude/model-router.json', async () => {
+  const app = buildApp();
+  const { status, body } = await getJson(app, '/api/model-router');
+  assert.equal(status, 200);
+  assert.ok(typeof body.endpoint === 'string' && body.endpoint.length > 0, 'endpoint present');
+  assert.ok(body.policy, 'policy present');
+  assert.ok(body.agents, 'agents map present');
+  // Forseti / Baldr / Vidarr must be GPT (premium tier per the routing rules).
+  assert.match(body.agents.forseti.model, /gpt-5\.6-sol/, 'forseti uses premium GPT');
+  assert.match(body.agents.baldr.model, /gpt-5\.6-sol/, 'baldr uses premium GPT');
+  assert.match(body.agents.vidarr.model, /gpt-5\.6-sol/, 'vidarr uses premium GPT');
+  // Tyr + Odin use the high-tier terra model.
+  assert.match(body.agents.tyr.model, /gpt-5\.6-terra/, 'tyr uses high-tier GPT');
+  assert.match(body.agents.odin.model, /gpt-5\.6-terra/, 'odin uses high-tier GPT');
+  // Everyday default agents use MiniMax-M3.
+  assert.equal(body.agents.frigg.model, 'bizar/MiniMax-M3', 'frigg uses default');
+  assert.equal(body.agents.hermod.model, 'bizar/MiniMax-M3', 'hermod uses default');
+  // Vor uses the budget tier.
+  assert.match(body.agents.vor.model, /mimo|deepseek/, 'vor uses budget tier');
+});
+
+test('GET /api/model-router/agents returns just the agents+tiers map', async () => {
+  const app = buildApp();
+  const { status, body } = await getJson(app, '/api/model-router/agents');
+  assert.equal(status, 200);
+  assert.ok(body.agents.thor, 'thor present');
+  assert.ok(body.tiers.default, 'default tier present');
+});
+
+test('GET /api/model-router/models probe handles unreachable endpoint gracefully', async () => {
+  // Override env to a guaranteed-unreachable port.
+  const prev = process.env.BIZAR_MODEL_ROUTER_URL;
+  process.env.BIZAR_MODEL_ROUTER_URL = 'http://127.0.0.1:1';
+  try {
+    const app = buildApp();
+    const { status, body } = await getJson(app, '/api/model-router/models');
+    assert.equal(status, 200);
+    assert.equal(body.reachable, false);
+    assert.ok(typeof body.error === 'string', 'error string present');
+  } finally {
+    if (prev === undefined) delete process.env.BIZAR_MODEL_ROUTER_URL;
+    else process.env.BIZAR_MODEL_ROUTER_URL = prev;
+  }
+});
+
+test('GET /api/model-router/resolve/:agent returns the concrete model + endpoint', async () => {
+  const app = buildApp();
+  const { status, body } = await getJson(app, '/api/model-router/resolve/tyr');
+  assert.equal(status, 200);
+  assert.equal(body.agent, 'tyr');
+  assert.match(body.modelId, /gpt-5\.6-terra/, 'tyr uses high-tier terra');
+  assert.match(body.endpoint, /^http/, 'endpoint is a URL');
+  assert.equal(typeof body.tier, 'string');
+});
+
+test('GET /api/model-router/resolve/:agent falls back for unknown agents', async () => {
+  const app = buildApp();
+  const { status, body } = await getJson(app, '/api/model-router/resolve/nonexistent-agent-xyz');
+  assert.equal(status, 200);
+  assert.equal(body.agent, 'nonexistent-agent-xyz');
+  assert.match(body.modelId, /[a-z0-9/_.-]+/, 'returns a model id');
+  assert.match(body.endpoint, /^http/, 'endpoint is a URL');
+});
+
+test('GET /api/model-router/resolve/:agent rejects bad slugs', async () => {
+  const app = buildApp();
+  // Express decodes percent-encoded path segments before the handler runs.
+  // Use a slug that's syntactically illegal per the route's regex.
+  const { status, body } = await getJson(app, '/api/model-router/resolve/has spaces');
+  assert.equal(status, 400);
+  assert.equal(body.error, 'bad_slug');
+});

package/bizar-dash/src/server/routes/sessions.mjs

@@ -0,0 +1,80 @@
+/**
+ * src/server/routes/sessions.mjs
+ *
+ * Pillar A — Session heartbeat list + stop.
+ *
+ * GET  /api/sessions        — list live sessions from .harness/traces/heartbeat.jsonl
+ * POST /api/sessions/:id/stop — mark a session as done
+ */
+
+import { Router } from "express";
+import { existsSync, readFileSync, appendFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { wrap } from "./_shared.mjs";
+
+const HEARTBEAT_FILE = ".harness/traces/heartbeat.jsonl";
+
+function resolveHeartbeatPath(repoRoot) {
+  return join(repoRoot ?? process.cwd(), HEARTBEAT_FILE);
+}
+
+/**
+ * @param {string} repoRoot
+ * @returns {Array<{session_id: string, started_at: string, last_heartbeat_at: string, status: string}>}
+ */
+function readSessions(repoRoot) {
+  const fp = resolveHeartbeatPath(repoRoot);
+  if (!existsSync(fp)) return [];
+  try {
+    const raw = readFileSync(fp, "utf-8");
+    const lines = raw.split("\n").filter(Boolean);
+    // Deduplicate by session_id, keeping the last record per session
+    const map = new Map();
+    for (const line of lines) {
+      try {
+        const rec = JSON.parse(line);
+        if (rec?.session_id) map.set(rec.session_id, rec);
+      } catch {
+        // skip malformed lines
+      }
+    }
+    return Array.from(map.values());
+  } catch {
+    return [];
+  }
+}
+
+export function createSessionsRouter({ projectRoot = process.cwd() } = {}) {
+  const router = Router();
+
+  // GET /api/sessions
+  router.get("/sessions", wrap(async (_req, res) => {
+    const sessions = readSessions(projectRoot);
+    res.json({ sessions });
+  }));
+
+  // POST /api/sessions/:id/stop
+  router.post("/sessions/:id/stop", wrap(async (req, res) => {
+    const id = String(req.params?.id ?? "").trim();
+    if (!id) {
+      res.status(400).json({ error: "bad_request", message: "session id is required" });
+      return;
+    }
+    const fp = resolveHeartbeatPath(projectRoot);
+    // Ensure parent dir exists
+    const dir = join(fp, "..");
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+    const record = {
+      session_id: id,
+      started_at: new Date().toISOString(),
+      last_heartbeat_at: new Date().toISOString(),
+      status: "done",
+    };
+    appendFileSync(fp, JSON.stringify(record) + "\n", "utf-8");
+    res.json({ session_id: id, status: "done" });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/server.mjs

@@ -436,32 +436,6 @@ export async function createServer({
     broadcast: localBroadcast,
   });
 
-  // v5.0.0 — Headroom startup hook. Runs after api.mjs is loaded so the
-  // headroom routes are registered. Errors are caught and logged — startup
-  // must not fail if Headroom has issues.
-  //
-  // v10-S9 — opt-out via BIZAR_HEADROOM_AUTOSTART=0. The hook runs
-  // `npm install` + a child process spawn which can take 2-5s on cold
-  // boot. Real users hit this on every dashboard launch; tests hit it
-  // too. Setting the env var skips the install + child-process spawn
-  // entirely. Default behaviour is unchanged (settings.json
-  // `headroom.enabled` still controls).
-  if (/^(0|false|no|off)$/i.test((process.env.BIZAR_HEADROOM_AUTOSTART || '').trim())) {
-    console.log('[bizar-dash] headroom startup skipped (BIZAR_HEADROOM_AUTOSTART=0)');
-  } else {
-    const { headroomStartupHook } = await import('./headroom.mjs');
-    try {
-      const settings = readSettings();
-      if (settings?.data?.headroom) {
-        headroomStartupHook(settings.data.headroom).catch((err) => {
-          console.warn('[bizar-dash] headroomStartupHook error:', err?.message || err);
-        });
-      }
-    } catch (err) {
-      console.warn('[bizar-dash] headroom startup hook skipped:', err?.message || err);
-    }
-  }
-
   // v5.5.2 — Auto-migrate legacy git.repoPath from the old vault location
   // to the new default. Runs before the lightrag hook so git-dependent
   // checks are already correct.
@@ -479,7 +453,7 @@ export async function createServer({
     console.warn('[bizar-dash] git.repoPath migration check failed:', err?.message || err);
   }
 
-  // v5.x — LightRAG startup hook (issue #6). Mirrors the headroom hook:
+  // v5.x — LightRAG startup hook (issue #6).
   // reads config from .bizar/memory.json + env vars, then calls
   // lightragStartupHook() which respects `lightrag.enabled` and the
   // BIZAR_LIGHTRAG_AUTOSTART env override. All errors are caught — the