@polderlabs/bizar 3.12.2 → 3.12.4

package/cli/doctor.mjs

@@ -92,6 +92,10 @@ async function checkPluginEntryPresent() {
   }
   const hasBizar = plugins.some((p) => {
     if (typeof p === 'string') return p.includes('bizar');
+    if (Array.isArray(p)) {
+      const [path] = p;
+      return typeof path === 'string' && path.includes('bizar');
+    }
     if (p && typeof p === 'object') {
       return (
         (p.name || '').includes('bizar') ||
@@ -112,8 +116,14 @@ async function checkPluginPathResolves() {
   const plugins = Array.isArray(cfg.plugin) ? cfg.plugin : [];
   let lastChecked = null;
   for (const p of plugins) {
-    if (!p || typeof p !== 'object' || !p.path) continue;
-    const entryPath = p.path;
+    let entryPath = null;
+    if (Array.isArray(p)) {
+      const [path] = p;
+      if (typeof path === 'string') entryPath = path;
+    } else if (p && typeof p === 'object' && p.path) {
+      entryPath = p.path;
+    }
+    if (!entryPath) continue;
     const isAbs = entryPath.startsWith('/') || /^[a-z]:[\\/]/i.test(entryPath);
     const resolved = isAbs ? entryPath : join(opencodeConfigDir(), entryPath);
     lastChecked = resolved;

package/cli/doctor.test.mjs

@@ -254,6 +254,31 @@ describe('runDoctor() with fixture HOME', () => {
     assert.equal(r.ok, true, r.message);
   });
 
+  test('plugin-entry-present passes when plugin[] has [path, options] tuple', async () => {
+    writeOpencodeConfig({ plugin: [['./plugins/bizar/index.ts', { loopThresholdWarn: 5 }]] });
+    const result = await runDoctor({ silent: true });
+    const r = findCheck(result, 'plugin-entry-present');
+    assert.equal(r.ok, true, r.message);
+  });
+
+  test('plugin-entry-present fails when tuple path does not contain "bizar"', async () => {
+    writeOpencodeConfig({ plugin: [['./plugins/other/index.ts', {}]] });
+    const result = await runDoctor({ silent: true });
+    const r = findCheck(result, 'plugin-entry-present');
+    assert.equal(r.ok, false);
+  });
+
+  test('plugin-path-resolves passes when tuple path resolves', async () => {
+    const home = process.env.HOME;
+    const pluginsDir = join(home, '.config', 'opencode', 'plugins', 'bizar');
+    mkdirSync(pluginsDir, { recursive: true });
+    writeFileSync(join(pluginsDir, 'index.ts'), '// fake plugin\n', 'utf8');
+    writeOpencodeConfig({ plugin: [['./plugins/bizar/index.ts', {}]] });
+    const result = await runDoctor({ silent: true });
+    const r = findCheck(result, 'plugin-path-resolves');
+    assert.equal(r.ok, true, r.message);
+  });
+
   test('agent-files-installed fails when core agents missing', async () => {
     writeOpencodeConfig({});
     writeAgents('odin.md'); // missing quick, thor, tyr

package/cli/install.mjs

@@ -32,9 +32,22 @@ const AGENT_FILES = [
  * breaking the dev workflow. Pass `{ force: true }` to override (after
  * confirming the user really wants the deployed copy back).
  *
+ * node_modules copy: the plugin imports `@polderlabs/bizar-sdk`, a
+ * workspace-internal package not on the public registry. The npm source
+ * bundles the SDK into its own `node_modules/`. After copying the plugin
+ * files, this function ALSO copies the source's `node_modules/` to the
+ * deployed `node_modules/` so Bun can resolve the import when the plugin
+ * is loaded from `~/.config/opencode/plugins/bizar/`. Without this, the
+ * plugin silently fails to load.
+ *
  * Pass `{ silent: true }` to suppress the warning prints; the function
  * still returns `true` if the dest is already in the desired state.
  *
+ * Pass `{ sourceDir: '/path/to/fake' }` (test seam) to bypass the
+ * `npm root -g` lookup and use a caller-supplied source path. Used by
+ * cli/install.test.mjs to drive the function against a controlled
+ * filesystem without touching the real global npm root.
+ *
  * Returns `true` if the plugin was installed (or already in place),
  * `false` otherwise. Never throws.
  */
@@ -76,17 +89,24 @@ export async function installPluginFromGlobal(opts = {}) {
     rmSync(destDir, { force: true });
   }
 
-  let globalRoot;
-  try {
-    globalRoot = execSync('npm root -g', { stdio: ['ignore', 'pipe', 'ignore'] })
-      .toString()
-      .trim();
-  } catch {
-    console.log(chalk.yellow('  ⚠ Could not determine npm global root — skipping plugin install'));
-    return false;
+  // ── Resolve source path ─────────────────────────────────────────────────────
+  // Production: `npm root -g` + `@polderlabs/bizar-plugin`. Tests can pass
+  // `opts.sourceDir` to bypass the lookup entirely.
+  let pluginPath;
+  if (opts.sourceDir) {
+    pluginPath = opts.sourceDir;
+  } else {
+    let globalRoot;
+    try {
+      globalRoot = execSync('npm root -g', { stdio: ['ignore', 'pipe', 'ignore'] })
+        .toString()
+        .trim();
+    } catch {
+      console.log(chalk.yellow('  ⚠ Could not determine npm global root — skipping plugin install'));
+      return false;
+    }
+    pluginPath = join(globalRoot, '@polderlabs', 'bizar-plugin');
   }
-
-  const pluginPath = join(globalRoot, '@polderlabs', 'bizar-plugin');
   if (!existsSync(pluginPath)) {
     console.log(chalk.dim('  ℹ Bizar plugin not installed globally. To install it:'));
     console.log(chalk.dim('    npm install -g @polderlabs/bizar-plugin'));
@@ -115,11 +135,75 @@ export async function installPluginFromGlobal(opts = {}) {
     await copyRecursive(pluginPath, destDir);
     console.log(chalk.green(`  ✓ Bizar plugin installed from global package`));
     console.log(chalk.dim(`    ${pluginPath} → ${destDir}`));
-    return true;
   } catch (err) {
     console.log(chalk.yellow(`  ⚠ Failed to copy Bizar plugin: ${err.message}`));
     return false;
   }
+
+  // ── node_modules copy ───────────────────────────────────────────────────────
+  // The plugin imports `@polderlabs/bizar-sdk`, a workspace-internal package
+  // not on the public registry. The npm source bundles the SDK into its
+  // own `node_modules/`, so loading from `$(npm root -g)/...` resolves
+  // correctly. The deployed copy at `~/.config/opencode/plugins/bizar/`
+  // has no `node_modules`, so Bun can't resolve the import — without this
+  // copy the plugin silently fails to load. This used to be papered over
+  // by a manual `cp -r $(npm root -g)/.../node_modules ~/.config/...` step
+  // that got wiped every time `bizar update` re-ran the outer copy. Doing
+  // it here makes the fix durable across updates.
+  //
+  // Semantics: mirror `cp -r` — merge into dest if it exists as a real
+  // directory (overwrite same-named files, don't delete extras), error
+  // if dest is a symlink (don't dereference through it). Idempotent —
+  // running twice never breaks; files whose contents already match are
+  // rewritten byte-identically.
+  try {
+    const srcNmDir = join(pluginPath, 'node_modules');
+    if (existsSync(srcNmDir)) {
+      const dstNmDir = join(destDir, 'node_modules');
+      let dstIsSymlink = false;
+      try {
+        dstIsSymlink = lstatSync(dstNmDir).isSymbolicLink();
+      } catch {
+        // doesn't exist — fine, we'll create it below
+      }
+      if (dstIsSymlink) {
+        console.log(
+          chalk.yellow(
+            `  ⚠ ${dstNmDir} is a symlink — refusing to copy node_modules (remove manually).`,
+          ),
+        );
+      } else {
+        // Top-level entry count (matches `npm ls --depth=0`) — gives the
+        // user a sense of what was bundled. e.g. "copied node_modules
+        // (25 packages) to deployed plugin".
+        const srcEntries = await readdir(srcNmDir, { withFileTypes: true });
+        await mkdir(dstNmDir, { recursive: true });
+        async function copyNodeModules(srcDir, dstDir) {
+          const entries = await readdir(srcDir, { withFileTypes: true });
+          for (const entry of entries) {
+            const src = join(srcDir, entry.name);
+            const dst = join(dstDir, entry.name);
+            if (entry.isDirectory()) {
+              await mkdir(dst, { recursive: true });
+              await copyNodeModules(src, dst);
+            } else {
+              await copyFile(src, dst);
+            }
+          }
+        }
+        await copyNodeModules(srcNmDir, dstNmDir);
+        console.log(
+          chalk.green(
+            `  ✓ copied node_modules (${srcEntries.length} packages) to deployed plugin`,
+          ),
+        );
+      }
+    }
+  } catch (err) {
+    console.log(chalk.yellow(`  ⚠ Failed to copy node_modules: ${err.message}`));
+  }
+
+  return true;
 }
 
 export async function runInstaller() {

package/cli/install.test.mjs

@@ -0,0 +1,246 @@
+/**
+ * cli/install.test.mjs
+ *
+ * Tests for `installPluginFromGlobal()` in cli/install.mjs — specifically
+ * the node_modules copy step added in the "make the plugin-install fix
+ * durable" change.
+ *
+ * Strategy: mock HOME so opencodeConfigDir() resolves inside a tmpdir,
+ * and pass `opts.sourceDir` to bypass the `npm root -g` lookup with a
+ * caller-supplied fake plugin source.
+ *
+ * Mirrors the HOME-mocking pattern used by cli/dev-link.test.mjs.
+ */
+import { test, describe, beforeEach, afterEach, after } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  rmSync,
+  existsSync,
+  lstatSync,
+  symlinkSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const { installPluginFromGlobal } = await import('./install.mjs');
+
+const ORIG_HOME = process.env.HOME;
+const ORIG_XDG = process.env.XDG_CONFIG_HOME;
+
+/**
+ * Point HOME at a fresh tmpdir so the module's opencodeConfigDir()
+ * resolves inside it (via the fallback `<HOME>/.config/opencode`).
+ * Returns the tmpdir path.
+ *
+ * We deliberately do NOT set XDG_CONFIG_HOME. opencodeConfigDir() treats
+ * a set XDG_CONFIG_HOME as the direct parent (so `~/.config` →
+ * `~/.config/opencode`); setting it to a raw tmpdir would produce
+ * `<tmpdir>/opencode` instead of `<tmpdir>/.config/opencode` and break
+ * path alignment with the rest of the test.
+ */
+function freshHome() {
+  const home = mkdtempSync(join(tmpdir(), 'bizar-install-'));
+  process.env.HOME = home;
+  delete process.env.XDG_CONFIG_HOME;
+  return home;
+}
+
+/** Path to the deployed plugin dir under the mocked HOME. */
+function pluginDest(home) {
+  return join(home, '.config', 'opencode', 'plugins', 'bizar');
+}
+
+/**
+ * Build a fake plugin source tree, optionally including a `node_modules/`
+ * directory with a couple of packages. Used to drive the function under
+ * test without touching the real global npm install.
+ */
+function makeFakeSource({ withNodeModules = true } = {}) {
+  const src = mkdtempSync(join(tmpdir(), 'fake-plugin-src-'));
+  writeFileSync(
+    join(src, 'package.json'),
+    JSON.stringify({
+      name: '@polderlabs/bizar-plugin',
+      version: '0.0.0-test',
+    }),
+  );
+  writeFileSync(join(src, 'index.ts'), '// fake plugin');
+  if (withNodeModules) {
+    // Mimics the real npm install layout:
+    //   node_modules/
+    //     @polderlabs/bizar-sdk/package.json   <-- the workspace-internal import
+    //     some-dep/package.json               <-- a transitive dep
+    //     some-dep/lib/index.js               <-- nested file
+    mkdirSync(join(src, 'node_modules'));
+    mkdirSync(join(src, 'node_modules', '@polderlabs'));
+    mkdirSync(join(src, 'node_modules', '@polderlabs', 'bizar-sdk'));
+    writeFileSync(
+      join(src, 'node_modules', '@polderlabs', 'bizar-sdk', 'package.json'),
+      JSON.stringify({ name: '@polderlabs/bizar-sdk', version: '1.0.0' }),
+    );
+    mkdirSync(join(src, 'node_modules', 'some-dep'));
+    writeFileSync(
+      join(src, 'node_modules', 'some-dep', 'package.json'),
+      JSON.stringify({ name: 'some-dep', version: '2.0.0' }),
+    );
+    mkdirSync(join(src, 'node_modules', 'some-dep', 'lib'));
+    writeFileSync(
+      join(src, 'node_modules', 'some-dep', 'lib', 'index.js'),
+      'module.exports = 1;',
+    );
+  }
+  return src;
+}
+
+/** Restore env at the very end (individual tests restore in afterEach). */
+after(() => {
+  if (ORIG_HOME === undefined) delete process.env.HOME;
+  else process.env.HOME = ORIG_HOME;
+  if (ORIG_XDG === undefined) delete process.env.XDG_CONFIG_HOME;
+  else process.env.XDG_CONFIG_HOME = ORIG_XDG;
+});
+
+// ── installPluginFromGlobal — node_modules copy ───────────────────────────────
+
+describe('installPluginFromGlobal() — node_modules copy', () => {
+  let home;
+  let sourceDir;
+
+  beforeEach(() => {
+    home = freshHome();
+  });
+
+  afterEach(() => {
+    if (home && existsSync(home)) rmSync(home, { recursive: true, force: true });
+    if (sourceDir && existsSync(sourceDir)) rmSync(sourceDir, { recursive: true, force: true });
+    if (ORIG_HOME === undefined) delete process.env.HOME;
+    else process.env.HOME = ORIG_HOME;
+    if (ORIG_XDG === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = ORIG_XDG;
+  });
+
+  test('copies node_modules from source when present', async () => {
+    sourceDir = makeFakeSource({ withNodeModules: true });
+    const dest = pluginDest(home);
+
+    const ok = await installPluginFromGlobal({ sourceDir });
+    assert.equal(ok, true);
+
+    // Plugin file copied.
+    assert.equal(existsSync(join(dest, 'index.ts')), true);
+    assert.equal(existsSync(join(dest, 'package.json')), true);
+
+    // node_modules copied (the actual fix).
+    const destNm = join(dest, 'node_modules');
+    assert.equal(existsSync(destNm), true);
+    assert.equal(
+      existsSync(join(destNm, 'some-dep', 'package.json')),
+      true,
+      'top-level dep copied',
+    );
+    assert.equal(
+      existsSync(join(destNm, 'some-dep', 'lib', 'index.js')),
+      true,
+      'nested file inside top-level dep copied',
+    );
+    assert.equal(
+      existsSync(join(destNm, '@polderlabs', 'bizar-sdk', 'package.json')),
+      true,
+      'scoped @polderlabs/bizar-sdk copied (the actual bug fix)',
+    );
+  });
+
+  test('no-op for node_modules when source has none', async () => {
+    sourceDir = makeFakeSource({ withNodeModules: false });
+    const dest = pluginDest(home);
+
+    const ok = await installPluginFromGlobal({ sourceDir });
+    assert.equal(ok, true);
+
+    // Plugin file copied.
+    assert.equal(existsSync(join(dest, 'index.ts')), true);
+
+    // node_modules should NOT exist — we don't create empty dirs.
+    const destNm = join(dest, 'node_modules');
+    assert.equal(existsSync(destNm), false);
+  });
+
+  test('idempotent: running twice does not error and preserves extras', async () => {
+    sourceDir = makeFakeSource({ withNodeModules: true });
+    const dest = pluginDest(home);
+
+    const ok1 = await installPluginFromGlobal({ sourceDir });
+    assert.equal(ok1, true);
+
+    // Drop a marker that simulates a user adding their own package.
+    // After a second run, this marker must STILL be present (cp -r
+    // semantics — don't delete, just overwrite/add).
+    const destNm = join(dest, 'node_modules');
+    mkdirSync(join(destNm, 'user-added'), { recursive: true });
+    writeFileSync(join(destNm, 'user-added', 'marker.json'), '{}');
+
+    const ok2 = await installPluginFromGlobal({ sourceDir });
+    assert.equal(ok2, true, 'second call should still return true');
+
+    // User's marker is still there.
+    assert.equal(
+      existsSync(join(destNm, 'user-added', 'marker.json')),
+      true,
+      'user-added extras preserved across re-runs',
+    );
+
+    // And the npm-bundled contents are still there.
+    assert.equal(
+      existsSync(join(destNm, '@polderlabs', 'bizar-sdk', 'package.json')),
+      true,
+      '@polderlabs/bizar-sdk still present after second run',
+    );
+    assert.equal(
+      existsSync(join(destNm, 'some-dep', 'lib', 'index.js')),
+      true,
+      'nested file still present after second run',
+    );
+  });
+
+  test('refuses to overwrite a symlinked node_modules', async () => {
+    sourceDir = makeFakeSource({ withNodeModules: true });
+    const dest = pluginDest(home);
+
+    // Pre-create dest as a real dir (the outer copy needs a real dest)
+    // AND pre-create dest/node_modules as a symlink to some unrelated
+    // location. The fix must NOT dereference through the symlink and
+    // must leave it intact.
+    mkdirSync(dest, { recursive: true });
+    const linkTarget = mkdtempSync(join(tmpdir(), 'nm-link-target-'));
+    const destNm = join(dest, 'node_modules');
+    symlinkSync(linkTarget, destNm);
+
+    try {
+      const ok = await installPluginFromGlobal({ sourceDir });
+      // Outer install succeeds (the file copy still works — it doesn't
+      // touch node_modules at the dest).
+      assert.equal(ok, true);
+
+      // The symlink must still be a symlink — we refused to dereference.
+      assert.equal(
+        lstatSync(destNm).isSymbolicLink(),
+        true,
+        'node_modules symlink preserved (not dereferenced)',
+      );
+
+      // SDK NOT copied into the link target (we skipped the copy).
+      assert.equal(
+        existsSync(join(linkTarget, '@polderlabs')),
+        false,
+        'refused copy did not leak into link target',
+      );
+    } finally {
+      rmSync(linkTarget, { recursive: true, force: true });
+    }
+  });
+});
+
+console.log('  install.mjs tests loaded — run with: node --test cli/install.test.mjs');

package/config/AGENTS.md

@@ -347,6 +347,20 @@ This section is the single source of truth for every Bizar agent's behavior. It
 > | `task` (subagent dispatch) | `task` — same — used by Odin to dispatch subagents |
 > | MCP servers | `semble` (codebase search), `hindsight` (memory), and any user-added servers in `config/opencode.json` |
 
+### Simplicity Rule — do not overcomplicate
+
+**This is the most important rule in this baseline. Every agent, every time, no exceptions.**
+
+- **Match the work to the ask.** If the user asked one question, answer one question. If they asked for one change, make one change. Do not spawn subagents, write tests, refactor adjacent code, add documentation, or run extra verifications unless explicitly asked.
+- **No speculative features.** Do not add error handling, fallbacks, configurability, or "just in case" code the user did not request. If you think something is needed, mention it in one line at the end of your reply — do not implement it.
+- **No speculative questions.** If the request is clear enough to act, act. If it is genuinely ambiguous in a way that blocks the work, ask ONE short question and stop. Do not list three options, do not write a decision matrix, do not draft both versions.
+- **No over-explanation.** Short answer for a short question. The first sentence should contain the outcome. Skip preamble ("Great question!"), skip postamble ("Let me know if you need anything else!"), skip recap. The work is the work; the words around it are noise.
+- **Tools only when they earn their keep.** A tool call that returns nothing the user wanted is a waste. If you can answer from context, answer from context. If you must search, search once and decisively.
+- **Subagents are expensive.** Delegating to a subagent costs 5–30 seconds and several model calls. Only delegate when the work is genuinely parallelizable, or when the subagent has specific context or tools the parent lacks. A single agent doing the work end-to-end is almost always faster than a fan-out for tasks under a few hundred lines.
+- **Short replies are good replies.** "Done." "Fixed." "The bug was X." A short, correct answer beats a long, hedging one. If the user wants depth, they will ask.
+
+**When in doubt: do the smallest thing that solves the actual problem, then stop.**
+
 ### Identity preamble
 
 - Bizar is a Norse-pantheon multi-agent system for opencode. Odin is the default primary agent; Frigg, Vör, Mimir, Heimdall, Hermod, Thor, Baldr, Tyr, Vidarr, and Forseti are the subagents.

package/config/commands/audit.md

@@ -1 +1,5 @@
+---
+description: Run bizar audit to scan agent configuration for security issues.
+agent: forseti
+---
 Run bizar audit to scan agent configuration for security issues.

package/config/commands/bizar.md

@@ -1,3 +1,7 @@
+---
+description: Bizar Plugin Menu — route to the right Bizar action based on the user's request.
+agent: odin
+---
 # Bizar Dashboard
 
 The `/bizar` command launches the Bizar dashboard in your browser — a fully integrated workspace with Overview, Chat, Agents, Plans, Projects, Config, and Settings panels. The dashboard binds to `127.0.0.1` only and runs as a local Express + WebSocket server on a free port (preferred: 4321).

package/config/commands/explain.md

@@ -1 +1,5 @@
+---
+description: Route to @frigg for read-only codebase Q&A. She will explore the code and answer without making any changes.
+agent: frigg
+---
 Route to @frigg for read-only codebase Q&A. She will explore the code and answer without making any changes.

package/config/commands/init.md

@@ -1,3 +1,7 @@
+---
+description: Run bizar init to detect project stack, install relevant skills, and create .bizar/PROJECT.md.
+agent: heimdall
+---
 Run `bizar init` from the project root to:
 1. Detect the project stack (language, framework, database, tools)
 2. Install relevant skills from the opencode skills registry

package/config/commands/learn.md

@@ -1 +1,5 @@
+---
+description: Route to @heimdall. Extract patterns from the current session and append to .bizar/AGENTS_SELF_IMPROVEMENT.md.
+agent: heimdall
+---
 Route to @heimdall. Extract patterns from the current session and append to .bizar/AGENTS_SELF_IMPROVEMENT.md.

package/config/commands/plan.md

@@ -1,3 +1,7 @@
+---
+description: Open the Bizar visual plan canvas or manage existing plans.
+agent: odin
+---
 Open or manage a Bizar visual plan. Plans are collaborative canvases for structuring work across agents.
 
 ## Usage

package/config/commands/pr-review.md

@@ -1 +1,5 @@
+---
+description: Route to @hermod for PR review mode. Launches @mimir (research) and @forseti (audit) in parallel, then posts the combined review as a PR comment.
+agent: hermod
+---
 Route to @hermod for PR review mode. Launches @mimir (research) and @forseti (audit) in parallel, then posts the combined review as a PR comment.

package/config/commands/tailscale-serve.md

@@ -1,5 +1,6 @@
 ---
 description: Authenticate Tailscale Serve and expose a local port on your tailnet
+agent: heimdall
 ---
 
 # Tailscale Serve Command

package/config/commands/visual-plan.md

@@ -1,3 +1,7 @@
+---
+description: Toggle the Bizar visual plan canvas or check its current status.
+agent: odin
+---
 Toggle the Bizar visual plan canvas or check its current status.
 
 ## Usage

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar",
-  "version": "3.12.2",
+  "version": "3.12.4",
   "description": "Norse-pantheon multi-agent system for opencode — 13 agents across 4 cost tiers with cost-aware routing, plans, and a configurable agent harness.",
   "type": "module",
   "bin": {