@polderlabs/bizar 10.1.0 → 10.2.0

package/bizar-dash/src/server/routes/artifacts.mjs

@@ -51,18 +51,54 @@ export function createArtifactsRouter({ state, broadcast, projectRoot }) {
     res.json(artifact);
   }));
 
-  // v3.21.0 — Compile the artifact's MDX into a JSON-serializable
-  // glyph structure for the new Glyphs renderer. Returns frontmatter
-  // + a flat list of typed blocks, ready for the client-side block
-  // component map to render.
+  // v3.21.0 — Compile the artifact for the renderer. Dispatches by kind:
+  //   mdx           → JSON glyph blocks (legacy v3-v9 renderer)
+  //   claude-html   → iframe-ready HTML envelope
+  //   claude-svg    → iframe-ready HTML envelope (SVG body)
+  //   claude-react  → iframe-ready HTML envelope (Babel-standalone JSX)
+  // The Claude-* envelope is ready to drop into an iframe `srcdoc`; the
+  // client previewer component (`<ClaudeArtifactView>`) picks the
+  // correct renderer based on `kind` and `html`.
   router.get('/artifacts/:slug/render', wrap(async (req, res) => {
     const artifact = artifactsStore.get(req.params.slug, projectRoot);
     if (!artifact) {
       res.status(404).json({ error: 'not_found' });
       return;
     }
-    const compiled = await compileGlyphMdx(artifact.planMdx || '');
-    res.json({ slug: req.params.slug, ...compiled });
+    const kind = artifact.kind || 'mdx';
+    if (kind === 'mdx') {
+      const compiled = await compileGlyphMdx(artifact.planMdx || '');
+      res.json({ slug: req.params.slug, kind, ...compiled });
+      return;
+    }
+    const compiled = artifactsStore.compile(req.params.slug, projectRoot);
+    if (!compiled) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.json({
+      slug: req.params.slug,
+      kind: compiled.kind,
+      html: compiled.html,
+      warnings: compiled.warnings || [],
+      safeMode: !!compiled.safeMode,
+      compiledAt: compiled.compiledAt,
+    });
+  }));
+
+  // v10.1.0 — Full-screen viewer. Returns the compiled HTML envelope
+  // with `Content-Type: text/html` so a `<a target="_blank">` opens
+  // the artifact on its own page (no dashboard chrome). The iframe
+  // `sandbox` rules from the envelope apply — the page is just the
+  // envelope served as `text/html`.
+  router.get('/artifacts/:slug/view', wrap(async (req, res) => {
+    const compiled = artifactsStore.compile(req.params.slug, projectRoot);
+    if (!compiled) {
+      res.status(404).type('html').send('<h1>Not found</h1>');
+      return;
+    }
+    res.set('Content-Security-Policy', "default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' https://unpkg.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src * data:;");
+    res.type('html').send(compiled.html);
   }));
 
   // v3.1.0 — Full artifact CRUD + canvas editing.

package/bizar-dash/src/server/routes/audit.mjs

@@ -0,0 +1,78 @@
+/**
+ * src/server/routes/audit.mjs
+ *
+ * GET /api/audit — returns latest harness audit score + diff vs prior.
+ *
+ * Reads .harness/audit/latest.json (written by `node scripts/audit.mjs --write`).
+ * Returns the full audit result plus a `diff` object showing which categories
+ * changed score vs the prior run (if any).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {string} deps.projectRoot
+ * @returns {import('express').Router}
+ */
+export function createAuditRouter({ projectRoot }) {
+  const router = require('express').Router();
+  const LATEST = join(projectRoot, '.harness', 'audit', 'latest.json');
+
+  router.get('/audit', wrap(async (_req, res) => {
+    if (!existsSync(LATEST)) {
+      res.status(404).json({
+        error: 'not_ready',
+        message: 'No audit run yet. Run `node scripts/audit.mjs --write` first.',
+      });
+      return;
+    }
+
+    let latest;
+    try {
+      latest = JSON.parse(readFileSync(LATEST, 'utf8'));
+    } catch (err) {
+      res.status(500).json({ error: 'parse_error', message: err.message });
+      return;
+    }
+
+    // Compute diff vs the run before last (if we have history)
+    /** @type {Record<string, {current: number, prior: number, delta: number} | null>} */
+    const diff = {};
+    const priorPath = join(projectRoot, '.harness', 'audit', 'previous.json');
+
+    if (existsSync(priorPath)) {
+      try {
+        const prior = JSON.parse(readFileSync(priorPath, 'utf8'));
+        const priorScores = prior.scores ?? {};
+        for (const [key, weight] of Object.entries(latest.weights ?? {})) {
+          const current = latest.scores?.[key] ?? 0;
+          const priorScore = priorScores[key] ?? 0;
+          if (current !== priorScore) {
+            diff[key] = { current, prior: priorScore, delta: current - priorScore };
+          }
+        }
+        // Also diff total
+        const currentTotal = latest.total ?? 0;
+        const priorTotal = prior.total ?? 0;
+        if (currentTotal !== priorTotal) {
+          diff._total = { current: currentTotal, prior: priorTotal, delta: currentTotal - priorTotal };
+        }
+      } catch {
+        // prior file unreadable — no diff
+      }
+    }
+
+    res.json({
+      latest,
+      diff,
+      _links: {
+        run: 'node scripts/audit.mjs --write',
+        latestPath: LATEST,
+      },
+    });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/decisions.mjs

@@ -0,0 +1,78 @@
+/**
+ * src/server/routes/decisions.mjs
+ *
+ * v10.1.1 — Pillar D: Decisions log API.
+ *
+ * GET /api/decisions
+ *   Returns list of decisions + tamper-evidence status.
+ *
+ * Storage: <projectRoot>/.bizar/learning/decisions.jsonl
+ *   Falls back to BIZAR_HOME if projectRoot is not set.
+ */
+
+'use strict';
+
+import { Router } from 'express';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { wrap } from './_shared.mjs';
+
+/** Default root: projectRoot > cwd > $HOME */
+function resolveRoot(projectRoot) {
+  if (projectRoot && projectRoot !== '.') return projectRoot;
+  try { return process.cwd(); } catch { return homedir(); }
+}
+
+/**
+ * @param {object} deps
+ * @param {string} [deps.projectRoot]
+ * @returns {import('express').Router}
+ */
+export function createDecisionsRouter({ projectRoot } = {}) {
+  const router = Router();
+  const root = projectRoot ?? resolveRoot(projectRoot);
+
+  // Lazy-import SDK to avoid hard coupling at boot time.
+  async function getDecisionsMod() {
+    // Try the published SDK first, then fall back to monorepo dist.
+    try {
+      return await import('@polderlabs/bizar-sdk/learning');
+    } catch {
+      return await import('../../../packages/sdk/dist/learning/index.js');
+    }
+  }
+
+  // GET /decisions — list + tamper status
+  router.get('/decisions', wrap(async (_req, res) => {
+    let mod;
+    try {
+      mod = await getDecisionsMod();
+    } catch (err) {
+      res.status(503).json({ error: 'unavailable', message: 'SDK not loaded', detail: err?.message });
+      return;
+    }
+
+    const decisions = mod.listDecisions ? mod.listDecisions({ project: root }) : [];
+    const verified = mod.verifyChain ? mod.verifyChain({ project: root }) : { ok: true };
+
+    // Apply datamark to all string fields to sanitise surrogates.
+    const sanitised = decisions.map((entry) => {
+      const out = {};
+      for (const [k, v] of Object.entries(entry)) {
+        out[k] = mod.datamark ? mod.datamark(v) : v;
+      }
+      return out;
+    });
+
+    res.json({
+      decisions: sanitised,
+      tamperEvidence: {
+        status: verified.ok ? 'intact' : 'broken',
+        at: verified.at ?? null,
+      },
+    });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/headroom.mjs

@@ -0,0 +1,126 @@
+/**
+ * src/server/routes/headroom.mjs
+ *
+ * v1.0.0 — REST endpoints for Headroom management.
+ *
+ * Mounted at /api/headroom/* by api.mjs.
+ */
+import { Router } from 'express';
+import {
+  getHeadroomStatus,
+  getHeadroomStats,
+  installHeadroom,
+  wrapCline,
+  unwrapCline,
+  startProxy,
+  stopProxy,
+  getClineConfig,
+  headroomStartupHook,
+} from '../headroom.mjs';
+import { wrap } from './_shared.mjs';
+
+export function createHeadroomRouter() {
+  const router = Router();
+
+  // GET /api/headroom/status
+  router.get('/status', wrap(async (_req, res) => {
+    const status = await getHeadroomStatus();
+    res.json(status);
+  }));
+
+  // GET /api/headroom/stats?hours=24
+  router.get('/stats', wrap(async (req, res) => {
+    const hours = Math.max(1, Math.min(parseInt(req.query.hours, 10) || 24, 720));
+    const stats = await getHeadroomStats({ hours });
+    res.json(stats);
+  }));
+
+  // POST /api/headroom/install
+  router.post('/install', wrap(async (req, res) => {
+    const { force = false } = req.body || {};
+    const result = await installHeadroom({ force: Boolean(force) });
+    res.json(result);
+  }));
+
+  // POST /api/headroom/wrap
+  router.post('/wrap', wrap(async (req, res) => {
+    const { port } = req.body || {};
+    const result = await wrapCline({
+      port: port ? Math.max(1, Math.min(parseInt(port, 10), 65535)) : 8787,
+    });
+    res.json(result);
+  }));
+
+  // POST /api/headroom/unwrap
+  router.post('/unwrap', wrap(async (_req, res) => {
+    const result = await unwrapCline();
+    res.json(result);
+  }));
+
+  // POST /api/headroom/proxy/start
+  router.post('/proxy/start', wrap(async (req, res) => {
+    const { port, host } = req.body || {};
+    const result = await startProxy({
+      port: port ? Math.max(1, Math.min(parseInt(port, 10), 65535)) : 8787,
+      host: typeof host === 'string' && host ? host : '127.0.0.1',
+    });
+    res.json(result);
+  }));
+
+  // POST /api/headroom/proxy/stop
+  router.post('/proxy/stop', wrap(async (_req, res) => {
+    const result = await stopProxy();
+    res.json(result);
+  }));
+
+  // GET /api/headroom/cline-config
+  router.get('/cline-config', wrap(async (_req, res) => {
+    const config = await getClineConfig();
+    res.json(config);
+  }));
+
+  // POST /api/headroom/auto-route — configure all providers to route through Headroom
+  router.post('/auto-route', wrap(async (_req, res) => {
+    const { loadConfig, saveConfig } = await import('../providers-store.mjs');
+    const cfg = loadConfig();
+    const headroomPort = 8787;
+    const proxyUrl = `http://127.0.0.1:${headroomPort}/v1`;
+
+    // For each provider, prepend the headroom proxy URL to baseURL
+    const providers = cfg.provider || {};
+    let changed = 0;
+    for (const [id, p] of Object.entries(providers)) {
+      if (!p || typeof p !== 'object') continue;
+      const baseURL = p.baseURL || p.options?.baseURL || '';
+      // Only update if not already routed
+      if (baseURL && !baseURL.includes('127.0.0.1:8787') && !baseURL.includes('localhost:8787')) {
+        const newBaseURL = `${proxyUrl}/${baseURL.replace(/^https?:\/\//, '')}`;
+        if (p.options) {
+          providers[id] = { ...p, options: { ...p.options, baseURL: newBaseURL } };
+        } else {
+          providers[id] = { ...p, baseURL: newBaseURL };
+        }
+        changed++;
+      }
+    }
+    cfg.provider = providers;
+    saveConfig(cfg);
+
+    res.json({ ok: true, changed, message: `Updated ${changed} provider(s) to route through Headroom proxy.` });
+  }));
+
+  // POST /api/headroom/startup-hook — trigger the startup hook programmatically
+  router.post('/startup-hook', wrap(async (_req, res) => {
+    const { readSettings } = await import('./_shared.mjs');
+    const settings = readSettings();
+    const headroomSettings = settings?.data?.headroom;
+    if (!headroomSettings) {
+      res.status(400).json({ error: 'bad_request', message: 'Headroom settings not found in settings.json' });
+      return;
+    }
+    const result = await headroomStartupHook(headroomSettings);
+    res.json(result);
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/model-router.mjs

@@ -6,6 +6,7 @@
  *   GET /api/model-router                 — full policy + agent→model map
  *   GET /api/model-router/models          — live model list from the local router
  *   GET /api/model-router/agents          — agent→model map only
+ *   GET /api/model-router/resolve/:agent  — concrete model + endpoint for an agent
  *
  * The local router URL defaults to ANTHROPIC_BASE_URL or
  * BIZAR_MODEL_ROUTER_URL or `http://localhost:20128/v1`.
@@ -67,6 +68,45 @@ async function fetchLiveModels(endpoint) {
   }
 }
 
+/**
+ * v10.1.0 — Resolve the concrete model + endpoint for a named agent
+ * directly from the on-disk policy. No SDK import needed (keeps the
+ * dashboard route surface lightweight). Used by the front-end's
+ * "agent fleet" view, which renders one card per agent with its
+ * modelId + endpoint badge.
+ */
+function resolveAgentFromPolicy(policy, agent, endpoint) {
+  const agents = policy?.agents || {};
+  const entry = agents[agent];
+  if (entry && typeof entry.model === 'string') {
+    return {
+      agent,
+      modelId: entry.model,
+      tier: typeof entry.tier === 'string' ? entry.tier : 'default',
+      endpoint,
+      rationale: typeof entry.rationale === 'string' ? entry.rationale : '',
+    };
+  }
+  // Fallback: first known entry by name, otherwise the default tier.
+  const fallback = Object.values(agents).find((e) => e && typeof e.model === 'string');
+  if (fallback) {
+    return {
+      agent,
+      modelId: fallback.model,
+      tier: typeof fallback.tier === 'string' ? fallback.tier : 'default',
+      endpoint,
+      rationale: 'fallback (agent not in policy)',
+    };
+  }
+  return {
+    agent,
+    modelId: 'bizar/MiniMax-M3',
+    tier: 'default',
+    endpoint,
+    rationale: 'fallback (no policy)',
+  };
+}
+
 /**
  * @param {object} deps
  * @param {object} deps.state
@@ -99,5 +139,20 @@ export function createModelRouterRouter({ state }) {
     res.json({ agents: policy.agents || {}, tiers: policy.tiers || {} });
   }));
 
+  // v10.1.0 — Resolve one agent to its concrete model + endpoint.
+  // The front-end's ModelRouter page calls this so it doesn't need to
+  // duplicate the registry logic client-side.
+  router.get('/model-router/resolve/:agent', wrap(async (req, res) => {
+    const agent = String(req.params.agent || '').trim();
+    if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(agent)) {
+      res.status(400).json({ error: 'bad_slug', message: 'agent must match /^[a-z][a-z0-9_-]{0,63}$/' });
+      return;
+    }
+    const policy = await loadPolicy();
+    const endpoint = resolveEndpoint(state);
+    const resolved = resolveAgentFromPolicy(policy, agent, endpoint);
+    res.json(resolved);
+  }));
+
   return router;
 }

package/bizar-dash/src/server/routes/model-router.test.mjs

@@ -73,4 +73,32 @@ test('GET /api/model-router/models probe handles unreachable endpoint gracefully
     if (prev === undefined) delete process.env.BIZAR_MODEL_ROUTER_URL;
     else process.env.BIZAR_MODEL_ROUTER_URL = prev;
   }
+});
+
+test('GET /api/model-router/resolve/:agent returns the concrete model + endpoint', async () => {
+  const app = buildApp();
+  const { status, body } = await getJson(app, '/api/model-router/resolve/tyr');
+  assert.equal(status, 200);
+  assert.equal(body.agent, 'tyr');
+  assert.match(body.modelId, /gpt-5\.6-terra/, 'tyr uses high-tier terra');
+  assert.match(body.endpoint, /^http/, 'endpoint is a URL');
+  assert.equal(typeof body.tier, 'string');
+});
+
+test('GET /api/model-router/resolve/:agent falls back for unknown agents', async () => {
+  const app = buildApp();
+  const { status, body } = await getJson(app, '/api/model-router/resolve/nonexistent-agent-xyz');
+  assert.equal(status, 200);
+  assert.equal(body.agent, 'nonexistent-agent-xyz');
+  assert.match(body.modelId, /[a-z0-9/_.-]+/, 'returns a model id');
+  assert.match(body.endpoint, /^http/, 'endpoint is a URL');
+});
+
+test('GET /api/model-router/resolve/:agent rejects bad slugs', async () => {
+  const app = buildApp();
+  // Express decodes percent-encoded path segments before the handler runs.
+  // Use a slug that's syntactically illegal per the route's regex.
+  const { status, body } = await getJson(app, '/api/model-router/resolve/has spaces');
+  assert.equal(status, 400);
+  assert.equal(body.error, 'bad_slug');
 });

package/bizar-dash/src/server/routes/sessions.mjs

@@ -0,0 +1,80 @@
+/**
+ * src/server/routes/sessions.mjs
+ *
+ * Pillar A — Session heartbeat list + stop.
+ *
+ * GET  /api/sessions        — list live sessions from .harness/traces/heartbeat.jsonl
+ * POST /api/sessions/:id/stop — mark a session as done
+ */
+
+import { Router } from "express";
+import { existsSync, readFileSync, appendFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { wrap } from "./_shared.mjs";
+
+const HEARTBEAT_FILE = ".harness/traces/heartbeat.jsonl";
+
+function resolveHeartbeatPath(repoRoot) {
+  return join(repoRoot ?? process.cwd(), HEARTBEAT_FILE);
+}
+
+/**
+ * @param {string} repoRoot
+ * @returns {Array<{session_id: string, started_at: string, last_heartbeat_at: string, status: string}>}
+ */
+function readSessions(repoRoot) {
+  const fp = resolveHeartbeatPath(repoRoot);
+  if (!existsSync(fp)) return [];
+  try {
+    const raw = readFileSync(fp, "utf-8");
+    const lines = raw.split("\n").filter(Boolean);
+    // Deduplicate by session_id, keeping the last record per session
+    const map = new Map();
+    for (const line of lines) {
+      try {
+        const rec = JSON.parse(line);
+        if (rec?.session_id) map.set(rec.session_id, rec);
+      } catch {
+        // skip malformed lines
+      }
+    }
+    return Array.from(map.values());
+  } catch {
+    return [];
+  }
+}
+
+export function createSessionsRouter({ projectRoot = process.cwd() } = {}) {
+  const router = Router();
+
+  // GET /api/sessions
+  router.get("/sessions", wrap(async (_req, res) => {
+    const sessions = readSessions(projectRoot);
+    res.json({ sessions });
+  }));
+
+  // POST /api/sessions/:id/stop
+  router.post("/sessions/:id/stop", wrap(async (req, res) => {
+    const id = String(req.params?.id ?? "").trim();
+    if (!id) {
+      res.status(400).json({ error: "bad_request", message: "session id is required" });
+      return;
+    }
+    const fp = resolveHeartbeatPath(projectRoot);
+    // Ensure parent dir exists
+    const dir = join(fp, "..");
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+    const record = {
+      session_id: id,
+      started_at: new Date().toISOString(),
+      last_heartbeat_at: new Date().toISOString(),
+      status: "done",
+    };
+    appendFileSync(fp, JSON.stringify(record) + "\n", "utf-8");
+    res.json({ session_id: id, status: "done" });
+  }));
+
+  return router;
+}