@polderlabs/bizar 10.7.2 → 10.11.0

package/.claude/skills/cubesandbox/SKILL.md

@@ -1,148 +0,0 @@
----
-name: cubesandbox
-description: Use TencentCloud CubeSandbox — an E2B-compatible KVM microVM sandbox service for running untrusted AI-generated code with hardware-level isolation. Sub-60ms boot, <5MB overhead. Use when the agent needs to run a script whose side effects should not escape the host, when you want a fresh Linux environment per tool call, or when testing shell scripts that touch secrets.
----
-
-# CubeSandbox — sandboxed command execution
-
-TencentCloud's [CubeSandbox](https://github.com/TencentCloud/CubeSandbox)
-is an E2B-compatible KVM microVM service for AI agents. Each sandbox:
-
-- boots in <60 ms,
-- uses <5 MB overhead,
-- has its own guest OS kernel (no shared-kernel escape),
-- is reachable via the E2B SDK (`pypi install cubesandbox`).
-
-It is the right host for any `bash` call whose side effects should not
-escape the sandbox: file writes, package installs, network probes, etc.
-
-## When to route through CubeSandbox
-
-- Any `bash` call that writes to disk — especially under `~/.config/`,
-  `/tmp/`, or `node_modules/`.
-- Running untrusted user code (third-party repos, eval scripts).
-- Test isolation: each session gets a fresh `/home/agent` filesystem.
-- Reproducible environments — the same template boots identically.
-
-## When NOT to route through CubeSandbox
-
-- Pure read-only inspection (use `read_file` directly).
-- Single-keystroke git plumbing (`git status`, `git diff`, `git log`).
-- Heavy commands that boot a new instance — reuse an open one.
-
-## Installation
-
-```bash
-pip install cubesandbox
-```
-
-Verify:
-
-```bash
-python -c "import cubesandbox; print(cubesandbox.__version__)"
-```
-
-Expected: `0.3.x` or `0.4.x`. Older versions lack AutoPause / Credential
-Vault support (v0.5+).
-
-## Server URL
-
-CubeSandbox ships the same protocol as E2B. Point the SDK at the
-control-node:
-
-```bash
-export CUBESANDBOX_API_KEY="<from cubesandbox web console>"
-export CUBESANDBOX_URL="http://<control-node>:12088"   # default
-```
-
-For Bizar-managed local sandboxes, the Bizar CLI wraps the SDK and
-injects both env vars from `~/.config/bizar/cubesandbox.env`.
-
-## Quick start (raw SDK)
-
-```python
-from cubesandbox import Sandbox
-
-with Sandbox(template="base", timeout=300) as box:
-    r = box.run("echo hello && date")
-    print(r.stdout)
-```
-
-Equivalent via the Bizar CLI:
-
-```bash
-bizar sandbox run bash 'echo hello && date'
-```
-
-## Templates
-
-CubeSandbox boots from OCI templates. The "base" template is preinstalled
-on every control node; install others from the Template Store UI.
-
-For Bizar harness testing, use the `bizar-base` template which pins:
-
-- bun 1.3.x
-- node 20.x
-- python 3.12
-- `git`, `gh`, `ripgrep`
-
-## Snapshot / Clone / Rollback
-
-CubeSandbox 0.3+ supports `snapshot()`, `clone()`, and `rollback()`:
-
-```python
-snap = box.snapshot()         # CoW checkpoint, ~ms
-box2 = snap.clone()          # independent twin
-box.rollback(snap)           # return to earlier state
-```
-
-Bizar uses this for the `bizar_test-gate` runner: each test runs in a
-clone of the base template; failures roll back so the next test starts
-clean.
-
-## Security proxy (Credential Vault)
-
-Since v0.4, CubeSandbox can inject credentials at the egress proxy so
-they never enter the sandbox:
-
-```python
-with Sandbox(template="base", proxy_credentials={
-    "OPENAI_API_KEY": "<user-key>",
-}) as box:
-    box.run("python -c 'import openai; print(openai.api_key)'")
-    # prints OPENAI_API_KEY injected by CubeEgress; never logged
-```
-
-Bizar's `bizar_sandbox_run` tool uses this when `BIZAR_PROXY_CREDS=1`.
-
-## Bizar integration map
-
-| Layer | Component | Behavior |
-|-------|-----------|----------|
-| CLI | `bizar sandbox run` | Wraps SDK, persists last sandbox across calls |
-| Plugin | `bizar_sandbox_run` | In-session tool — runs a `bash` command in a fresh sandbox |
-| Skill | `cubesandbox` (this) | Discovery + best practices |
-| Agent | `@sandbox-runner` (optional) | Routes risky ops automatically |
-| Hook | `PreToolUse` (v6.3+) | Detects dangerous patterns and forces sandbox routing |
-
-See `cli/commands/sandbox.mjs` and `plugins/bizar/src/tools/sandbox.ts`.
-
-## Benchmarks (from upstream README)
-
-| Metric | Docker | Traditional VM | CubeSandbox |
-|--------|--------|----------------|-------------|
-| Isolation | shared-kernel | dedicated kernel | dedicated kernel + eBPF |
-| Cold start | 200ms | seconds | **<60ms** |
-| Memory overhead | low | high | **<5MB** |
-| Deploy density | high | low | extreme (thousands/node) |
-
-P95: 90 ms. P99: 137 ms. Full agent workload benchmarked against SWE-Bench.
-
-## Troubleshooting
-
-- **`SandboxError: no template`** — install a template from the WebUI
-  Template Store or run `bizar sandbox template install base`.
-- **API key rejected** — check the URL doesn't end with a trailing slash
-  and the key is the long one shown in the WebUI.
-- **Boot takes >5s** — usually means KVM is disabled. Run
-  `kvm-ok` (Debian) or `ls /dev/kvm`.

package/.claude/skills/de-sloppify/cleanup.mjs

@@ -1,253 +0,0 @@
-/**
- * cleanup.mjs — Scan recent git diff for AI-slop patterns.
- *
- * Detects: empty catches, redundant return await, redundant comments,
- * dead code, console.log left in.
- *
- * Outputs a git diff patch for reversible changes.
- *
- * Usage:
- *   node cleanup.mjs [--since=3 days ago] [--pattern=empty-catch|...]
- *   # or pipe a diff:
- *   git diff HEAD~5 | node cleanup.mjs
- */
-
-import { execSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-
-const SINCE = process.argv.includes("--since")
-  ? process.argv[process.argv.indexOf("--since") + 1]
-  : "3 days ago";
-
-// ── pattern matchers ───────────────────────────────────────────────────────────
-
-/** @param {string} line */
-function isEmptyCatch(line) {
-  return /catch\s*\(\s*\)\s*\{/.test(line) || /catch\s*\(\s*\w+\s*\)\s*\{/.test(line);
-}
-
-/** @param {string} line */
-function isRedundantReturnAwait(line) {
-  return /return\s+await\s+/.test(line);
-}
-
-/** @param {string} code */
-function findEmptyCatches(code) {
-  const lines = code.split("\n");
-  const findings = [];
-  for (let i = 0; i < lines.length; i++) {
-    if (isEmptyCatch(lines[i])) {
-      findings.push({
-        type: "empty-catch",
-        line: i + 1,
-        content: lines[i].trim(),
-      });
-    }
-  }
-  return findings;
-}
-
-/** @param {string} code */
-function findRedundantReturnAwait(code) {
-  const lines = code.split("\n");
-  const findings = [];
-  for (let i = 0; i < lines.length; i++) {
-    if (isRedundantReturnAwait(lines[i])) {
-      findings.push({
-        type: "redundant-return-await",
-        line: i + 1,
-        content: lines[i].trim(),
-      });
-    }
-  }
-  return findings;
-}
-
-/** @param {string} code */
-function findConsoleLog(code) {
-  const lines = code.split("\n");
-  const findings = [];
-  const consolePattern = /console\.(log|debug|info|warn|error)/;
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i].trim();
-    // Skip test files and commented-out usages
-    if (line.startsWith("//") || line.startsWith("*") || line.startsWith("/*")) continue;
-    if (consolePattern.test(line) && !line.includes("/// <reference")) {
-      findings.push({
-        type: "console-log",
-        line: i + 1,
-        content: line,
-      });
-    }
-  }
-  return findings;
-}
-
-/** @param {string} code */
-function findRedundantComments(code) {
-  const lines = code.split("\n");
-  const findings = [];
-  // Pattern: comment that just restates the code
-  const redundant = [
-    /^\s*\/\/\s*(increment|decrement|increase|decrease|decrease)\s+\w+/i,
-    /^\s*\/\/\s*(decrement|increase|decrease)\s+/i,
-    /^\s*\/\/\s*(check|check if)\s+/i,
-    /^\s*\/\/\s*(loop|iterate|for each|map over)\s+/i,
-  ];
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i].trim();
-    if (line.startsWith("//")) {
-      for (const pat of redundant) {
-        if (pat.test(line)) {
-          findings.push({ type: "redundant-comment", line: i + 1, content: line });
-          break;
-        }
-      }
-    }
-  }
-  return findings;
-}
-
-/** @param {string} code */
-function findDeadCode(code) {
-  const lines = code.split("\n");
-  const findings = [];
-  // Unreachable code after return/throw/continue/break — look for indented blocks
-  let prevSignificant = null;
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    const trimmed = line.trim();
-    // Skip empty lines and comments
-    if (trimmed === "" || trimmed.startsWith("//") || trimmed.startsWith("/*")) continue;
-    if (
-      prevSignificant &&
-      (trimmed.startsWith("return ") || trimmed.startsWith("throw ") || trimmed.startsWith("break") || trimmed.startsWith("continue"))
-    ) {
-      // Next non-empty line at same or lower indent = dead
-      for (let j = i + 1; j < lines.length; j++) {
-        const next = lines[j].trim();
-        if (next === "") continue;
-        if (next.startsWith("//") || next.startsWith("/*")) continue;
-        const nextIndent = line.search(/\S/);
-        const thisIndent = lines[j].search(/\S/);
-        if (thisIndent <= nextIndent) break;
-        findings.push({ type: "dead-code", line: j + 1, content: next });
-        break;
-      }
-    }
-    if (trimmed !== "") prevSignificant = trimmed;
-  }
-  return findings;
-}
-
-// ── git diff parser ───────────────────────────────────────────────────────────
-
-function getGitDiff() {
-  try {
-    const diff = execSync(`git diff --no-color --since="${SINCE}"`, {
-      encoding: "utf-8",
-      maxBuffer: 10 * 1024 * 1024,
-    });
-    return diff;
-  } catch {
-    // No diff or git not available
-    return "";
-  }
-}
-
-function parseDiff(diff) {
-  const files = [];
-  let currentFile = null;
-  let currentHunk = null;
-
-  for (const line of diff.split("\n")) {
-    if (line.startsWith("diff --git")) {
-      if (currentFile) files.push(currentFile);
-      const nameMatch = line.match(/diff --git a\/(.*?) b\/(.*?)(?:\s|$)/);
-      currentFile = {
-        path: nameMatch ? nameMatch[2] : "unknown",
-        hunks: [],
-      };
-      currentHunk = null;
-    } else if (line.startsWith("@@")) {
-      const m = line.match(/@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/);
-      if (m && currentFile) {
-        currentHunk = {
-          start: parseInt(m[1], 10),
-          additions: [],
-          deletions: [],
-        };
-        currentFile.hunks.push(currentHunk);
-      }
-    } else if (currentHunk) {
-      if (line.startsWith("+") && !line.startsWith("+++")) {
-        currentHunk.additions.push(line.slice(1));
-      } else if (line.startsWith("-") && !line.startsWith("---")) {
-        currentHunk.deletions.push(line.slice(1));
-      }
-    }
-  }
-  if (currentFile) files.push(currentFile);
-  return files;
-}
-
-// ── main ───────────────────────────────────────────────────────────────────────
-
-const diff = getGitDiff();
-
-if (!diff) {
-  console.log("No git diff found (or not a git repo). Nothing to scan.");
-  process.exit(0);
-}
-
-const files = parseDiff(diff);
-const allFindings = [];
-
-for (const file of files) {
-  // Skip binary files and generated files
-  if (file.path.includes("node_modules") || file.path.includes(".lock") || file.path.endsWith(".jsonl")) continue;
-
-  for (const hunk of file.hunks) {
-    const code = hunk.additions.join("\n");
-    const findings = [
-      ...findEmptyCatches(code),
-      ...findRedundantReturnAwait(code),
-      ...findConsoleLog(code),
-      ...findRedundantComments(code),
-    ];
-
-    for (const f of findings) {
-      allFindings.push({ path: file.path, ...f });
-    }
-  }
-}
-
-if (allFindings.length === 0) {
-  console.log("No AI-slop patterns detected.");
-  process.exit(0);
-}
-
-// Group by type
-const byType = {};
-for (const finding of allFindings) {
-  if (!byType[finding.type]) byType[finding.type] = [];
-  byType[finding.type].push(finding);
-}
-
-console.log("\n=== AI-Slop Findings ===\n");
-for (const [type, items] of Object.entries(byType)) {
-  console.log(`\n## ${type} (${items.length} occurrences)\n`);
-  for (const item of items) {
-    console.log(`  ${item.path}:${item.line}`);
-    console.log(`    ${item.content}`);
-  }
-}
-
-console.log("\n=== Proposed git diff patch (empty — add fixes manually) ===\n");
-// We report findings; actual patch generation requires more context.
-// Output is intentionally a report, not a patch, since auto-patching
-// catch blocks and return await could break semantics.
-console.log("  (No auto-patch generated — review findings above and fix manually)");
-console.log("  To auto-fix console.log: grep -rn 'console\\.log' <path> | ...");
-
-process.exit(allFindings.length > 0 ? 1 : 0);

package/.claude/skills/de-sloppify/cleanup.test.mjs

@@ -1,189 +0,0 @@
-/**
- * cleanup.test.mjs — Test de-sloppify cleanup.mjs with sample diffs.
- *
- * 5 test cases:
- *   1. empty catch detected
- *   2. redundant return await detected
- *   3. console.log detected
- *   4. no slop in clean diff → pass
- *   5. multiple patterns in one file → all found
- */
-
-import { writeFileSync, mkdirSync, rmSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const ROOT = join(__dirname, "..", "..", "..");
-const SCRIPT = join(__dirname, "cleanup.mjs");
-
-/** @param {string[]} lines */
-function makeDiff(lines) {
-  return `diff --git a/src/example.ts b/src/example.ts\n` +
-    `@@ -1,3 +1,5 @@\n` +
-    lines.map((l) => (l.startsWith("+") ? l : l.startsWith("-") ? l : ` ${l}`)).join("\n");
-}
-
-/** @param {string} diff */
-async function runCleanup(diff) {
-  // Write diff to temp file and pass path
-  const tmp = join(ROOT, ".tmp-slop-test.diff");
-  writeFileSync(tmp, diff, "utf-8");
-  const proc = Bun.spawn({
-    cmd: ["bash", "-c", `git diff --no-color > ${tmp} && node ${SCRIPT}`],
-    cwd: ROOT,
-  });
-  const stdout = await new Response(proc.stdout).text();
-  const stderr = await new Response(proc.stderr).text();
-  return { stdout, stderr, exitCode: proc.exitCode };
-}
-
-async function runCleanupStdin(diff) {
-  const proc = Bun.spawn({
-    cmd: ["node", SCRIPT],
-    cwd: ROOT,
-    stdin: "pipe",
-  });
-  proc.stdin.write(diff);
-  proc.stdin.end();
-  const stdout = await new Response(proc.stdout).text();
-  const stderr = await new Response(proc.stderr).text();
-  const exitCode = proc.exitCode;
-  return { stdout, stderr, exitCode };
-}
-
-let passed = 0;
-let failed = 0;
-
-async function assert(name, got, expected) {
-  if (got === expected) {
-    console.log(`  PASS ${name}`);
-    passed++;
-  } else {
-    console.error(`  FAIL ${name}: expected ${expected}, got ${got}`);
-    failed++;
-  }
-}
-
-// ── test 1: empty catch ────────────────────────────────────────────────────────
-
-const diff1 = makeDiff([
-  "function foo() {",
-  "+  try { x++ } catch (e) {}",
-  "  return x;",
-]);
-
-// Simulate by running the pattern matcher directly
-function testFindEmptyCatch() {
-  const { findEmptyCatches } = await import(join(__dirname, "cleanup.mjs"));
-  const code = "try { x++ } catch (e) {}";
-  const findings = findEmptyCatches(code);
-  if (findings.length === 1 && findings[0].type === "empty-catch") {
-    console.log("  PASS test_1: empty catch detected");
-    passed++;
-  } else {
-    console.error("  FAIL test_1: empty catch not detected", findings);
-    failed++;
-  }
-}
-
-// ── test 2: redundant return await ────────────────────────────────────────────
-
-const diff2 = makeDiff([
-  "async function bar() {",
-  "+  return await Promise.resolve(1);",
-  "}",
-]);
-
-// ── test 3: console.log ────────────────────────────────────────────────────────
-
-const diff3 = makeDiff([
-  "function baz() {",
-  "+  console.log('debug', x);",
-  "}",
-]);
-
-// ── test 4: clean diff → pass ─────────────────────────────────────────────────
-
-const diff4 = makeDiff([
-  "function clean() {",
-  "+  return x + 1;",
-  "}",
-]);
-
-// ── test 5: multiple patterns ─────────────────────────────────────────────────
-
-const diff5 = makeDiff([
-  "async function multi() {",
-  "+  try { x++ } catch {}",
-  "+  return await Promise.resolve(x);",
-  "+  console.log(x);",
-  "}",
-]);
-
-// Run via direct import of pattern functions (since git diff is hard to mock)
-// The script has module-level functions; we test them by evaluating inline patterns.
-
-const testCode = `
-function testFindEmptyCatch(code) {
-  const findings = [];
-  const lines = code.split('\\n');
-  for (let i = 0; i < lines.length; i++) {
-    if (/catch\\s*\\(\\s*\\w*\\s*\\)\\{/.test(lines[i])) {
-      findings.push({ type: 'empty-catch', line: i + 1 });
-    }
-  }
-  return findings;
-}
-
-function testFindConsoleLog(code) {
-  const findings = [];
-  const lines = code.split('\\n');
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i].trim();
-    if (/console\\.(log|debug|info|warn|error)/.test(line) && !line.startsWith('//')) {
-      findings.push({ type: 'console-log', line: i + 1 });
-    }
-  }
-  return findings;
-}
-`;
-
-// Evaluate tests directly
-const emptyCatchCode = "try { x++ } catch (e) {}";
-const emptyCatchFound = /catch\s*\(\s*\w*\s*\)\{/.test(emptyCatchCode);
-if (emptyCatchFound) { console.log("  PASS test_1: empty catch pattern detected"); passed++; }
-else { console.error("  FAIL test_1"); failed++; }
-
-const consoleLogCode = "  console.log('debug', x);";
-const consoleLogFound = /console\.(log|debug|info|warn|error)/.test(consoleLogCode);
-if (consoleLogFound) { console.log("  PASS test_3: console.log pattern detected"); passed++; }
-else { console.error("  FAIL test_3"); failed++; }
-
-// test_2: return await
-const returnAwaitCode = "return await Promise.resolve(1);";
-const returnAwaitFound = /return\s+await\s+/.test(returnAwaitCode);
-if (returnAwaitFound) { console.log("  PASS test_2: redundant return await detected"); passed++; }
-else { console.error("  FAIL test_2"); failed++; }
-
-// test_4: clean code
-const cleanCode = "return x + 1;";
-const cleanFindings = [];
-if (/catch\s*\(\s*\w*\s*\)\{/.test(cleanCode)) cleanFindings.push("catch");
-if (/return\s+await\s+/.test(cleanCode)) cleanFindings.push("return-await");
-if (/console\.(log|debug|info|warn|error)/.test(cleanCode)) cleanFindings.push("console");
-if (cleanFindings.length === 0) { console.log("  PASS test_4: clean code → no findings"); passed++; }
-else { console.error("  FAIL test_4: false positives in clean code:", cleanFindings); failed++; }
-
-// test_5: multiple
-const multiCode = "try { x++ } catch {}\nreturn await Promise.resolve(x);\nconsole.log(x);";
-const mFindings = [];
-if (/catch\s*\(\s*\w*\s*\)\{/.test(multiCode)) mFindings.push("empty-catch");
-if (/return\s+await\s+/.test(multiCode)) mFindings.push("return-await");
-if (/console\.(log|debug|info|warn|error)/.test(multiCode)) mFindings.push("console-log");
-if (mFindings.length === 3) { console.log("  PASS test_5: all 3 patterns in multi-pattern file detected"); passed++; }
-else { console.error("  FAIL test_5: expected 3 patterns, got:", mFindings); failed++; }
-
-console.log(`\nResults: ${passed} passed, ${failed} failed`);
-if (failed > 0) process.exit(1);
-else process.exit(0);

package/.claude/skills/embedded-esp-idf/README.md

@@ -1,41 +0,0 @@
-# Embedded ESP-IDF Skill
-
-ESP-IDF v5.x C++ firmware patterns for Claude Code. Covers the `idf.py` workflow, FreeRTOS, IRAM/DRAM/PSRAM memory model, packed binary protocols with `static_assert`, Kconfig, drivers (I2C/SPI/GPIO/ADC/NVS/BLE/ESP-NOW), power management, and host-side tests that compile firmware headers without `idf.py`.
-
-## What it provides
-
-- **SKILL.md** — pam start + 7 deep-dive references + 2 helper scripts
-- **references/idf-py-commands.md** — every `idf.py` subcommand + exit codes
-- **references/freertos-patterns.md** — task lifecycle, ISR-to-task handoff, ringbuffer streams
-- **references/memory-and-iram.md** — IRAM/DRAM/PSRAM model, `IRAM_ATTR`, `MALLOC_CAP_*`
-- **references/kconfig.md** — `depends on` / `select` / `imply` / `range` / `choice`
-- **references/packed-structs.md** — `__attribute__((packed))` + `static_assert(sizeof == N)`
-- **references/logging-discipline.md** — `ESP_LOG*` + low-rate aggregate lines
-- **references/host-tests.md** — host tests without `idf.py`
-- **scripts/idf_env.sh** — sources the vendored ESP-IDF env, validates `idf.py` is reachable
-- **scripts/size_check.sh** — runs the project size budget check (AMS7-aware) or falls back to `idf.py size`
-
-## When it triggers
-
-- Writing, reviewing, or debugging ESP-IDF C++ firmware
-- Working with `idf.py build`/`flash`/`monitor`/`menuconfig`/`size`
-- FreeRTOS task/queue/semaphore/mutex/ISR work
-- IRAM/DRAM/PSRAM budgeting
-- Packed binary protocols with `static_assert` on `sizeof`
-- NVS, BLE/NimBLE, ESP-NOW
-- Deep-sleep / light-sleep
-- Adding Kconfig options
-- Host-side C++ unit tests that compile firmware headers without `idf.py`
-
-## AMS7-specific extensions
-
-This skill was first authored for the AMS7 ambulatory-monitoring firmware at `/projects/ams7_esp32`. Rules tagged `(AMS7)` are project-specific — do not silently generalize them to other ESP-IDF projects. Universal ESP-IDF rules are the default.
-
-## Manual install
-
-```bash
-cp -R SKILL.md references scripts ~/.claude/skills/embedded-esp-idf/
-chmod +x ~/.claude/skills/embedded-esp-idf/scripts/*.sh
-```
-
-The BizarHarness installer can also install this automatically — select the **Embedded ESP-IDF** component.