@polderlabs/bizar 3.23.0 → 4.0.0

package/bizar-dash/src/server/routes/artifacts.mjs

@@ -0,0 +1,279 @@
+/**
+ * src/server/routes/artifacts.mjs
+ *
+ * /api/artifacts                              — list
+ * /api/artifacts/:slug                        — read
+ * /api/artifacts (POST)                       — create
+ * /api/artifacts/:slug (PUT)                  — update meta
+ * /api/artifacts/:slug (DELETE)               — remove
+ * /api/artifacts/:slug/canvas (GET)           — read canvas
+ * /api/artifacts/:slug/canvas (PUT)           — save canvas
+ * /api/artifacts/:slug/elements (POST)        — add element
+ * /api/artifacts/:slug/elements/:id (PUT)     — update element
+ * /api/artifacts/:slug/elements/:id (DELETE)  — remove element
+ * /api/artifacts/:slug/position (PUT)         — bulk position update
+ * /api/artifacts/:slug/connections (POST)     — add connection
+ * /api/artifacts/:slug/connections/:id (DELETE) — remove connection
+ * /api/artifacts/:slug/elements/:id/comments (POST) — comment on element
+ * /api/artifacts/:slug/elements/:id/comments/:cid (DELETE) — remove element comment
+ * /api/artifacts/:slug/comments (POST)        — canvas-level comment
+ * /api/artifacts/:slug/comments/:cid (DELETE) — remove canvas-level comment
+ * /api/artifacts/:slug/questions/:qid/respond (POST) — agent answers a question element
+ * /api/artifacts/:slug/submit (POST)                — submit feedback for review (writes feedback.md, sets status=review)
+ * /api/artifacts/:slug/render (GET)              — compile MDX → JSON glyph blocks
+ */
+import { Router } from 'express';
+import { artifactsStore } from '../artifacts-store.mjs';
+import { notificationsStore } from '../notifications-store.mjs';
+import { wrap } from './_shared.mjs';
+import { compileGlyphMdx } from '../glyphs/mdx-compiler.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @param {Function} deps.broadcast
+ * @param {string} deps.projectRoot
+ * @returns {import('express').Router}
+ */
+export function createArtifactsRouter({ state, broadcast, projectRoot }) {
+  const router = Router();
+
+  router.get('/artifacts', wrap(async (_req, res) => {
+    res.json({ artifacts: artifactsStore.list(projectRoot) });
+  }));
+
+  router.get('/artifacts/:slug', wrap(async (req, res) => {
+    const artifact = artifactsStore.get(req.params.slug, projectRoot);
+    if (!artifact) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.json(artifact);
+  }));
+
+  // v3.21.0 — Compile the artifact's MDX into a JSON-serializable
+  // glyph structure for the new Glyphs renderer. Returns frontmatter
+  // + a flat list of typed blocks, ready for the client-side block
+  // component map to render.
+  router.get('/artifacts/:slug/render', wrap(async (req, res) => {
+    const artifact = artifactsStore.get(req.params.slug, projectRoot);
+    if (!artifact) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    const compiled = await compileGlyphMdx(artifact.planMdx || '');
+    res.json({ slug: req.params.slug, ...compiled });
+  }));
+
+  // v3.1.0 — Full artifact CRUD + canvas editing.
+  router.post('/artifacts', wrap(async (req, res) => {
+    const slug = (req.body?.slug || '').trim();
+    try {
+      const artifact = artifactsStore.create(slug, req.body || {}, projectRoot);
+      broadcast({ type: 'artifact:change', slug });
+      res.status(201).json(artifact);
+    } catch (err) {
+      res.status(err.status || 500).json({ error: 'create_failed', message: err.message });
+    }
+  }));
+
+  router.put('/artifacts/:slug', wrap(async (req, res) => {
+    const artifact = artifactsStore.updateMeta(req.params.slug, req.body || {}, projectRoot);
+    if (!artifact) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(artifact);
+  }));
+
+  router.delete('/artifacts/:slug', wrap(async (req, res) => {
+    const ok = artifactsStore.delete(req.params.slug, projectRoot);
+    if (!ok) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug, deleted: true });
+    res.status(204).end();
+  }));
+
+  // ── /api/artifacts/:slug/canvas ──────────────────────────────────────────
+  router.get('/artifacts/:slug/canvas', wrap(async (req, res) => {
+    const canvas = artifactsStore.getCanvas(req.params.slug, projectRoot);
+    if (!canvas) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.json({ canvas });
+  }));
+
+  router.put('/artifacts/:slug/canvas', wrap(async (req, res) => {
+    const artifact = artifactsStore.saveCanvas(req.params.slug, req.body?.canvas, projectRoot);
+    if (!artifact) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(artifact);
+  }));
+
+  // ── /api/artifacts/:slug/elements ────────────────────────────────────────
+  router.post('/artifacts/:slug/elements', wrap(async (req, res) => {
+    const out = artifactsStore.addElement(req.params.slug, req.body || {}, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(201).json(out);
+  }));
+
+  router.put('/artifacts/:slug/elements/:id', wrap(async (req, res) => {
+    const out = artifactsStore.updateElement(req.params.slug, req.params.id, req.body || {}, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(out);
+  }));
+
+  router.delete('/artifacts/:slug/elements/:id', wrap(async (req, res) => {
+    const out = artifactsStore.deleteElement(req.params.slug, req.params.id, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(204).end();
+  }));
+
+  // ── /api/artifacts/:slug/position — bulk update positions (drag end) ─────
+  router.put('/artifacts/:slug/position', wrap(async (req, res) => {
+    const out = artifactsStore.updatePositions(req.params.slug, req.body?.positions, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(out);
+  }));
+
+  // ── /api/artifacts/:slug/connections ─────────────────────────────────────
+  router.post('/artifacts/:slug/connections', wrap(async (req, res) => {
+    const out = artifactsStore.addConnection(req.params.slug, req.body || {}, projectRoot);
+    if (!out) {
+      res.status(400).json({ error: 'bad_request', message: 'from and to are required' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(201).json(out);
+  }));
+
+  router.delete('/artifacts/:slug/connections/:id', wrap(async (req, res) => {
+    const out = artifactsStore.deleteConnection(req.params.slug, req.params.id, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(204).end();
+  }));
+
+  // ── /api/artifacts/:slug/elements/:id/comments ───────────────────────────
+  router.post('/artifacts/:slug/elements/:id/comments', wrap(async (req, res) => {
+    const out = artifactsStore.addComment(req.params.slug, req.params.id, req.body || {}, projectRoot);
+    if (!out) {
+      res.status(400).json({ error: 'bad_request', message: 'comment text is required' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(201).json(out);
+  }));
+
+  router.delete('/artifacts/:slug/elements/:id/comments/:cid', wrap(async (req, res) => {
+    const out = artifactsStore.deleteComment(req.params.slug, req.params.cid, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(204).end();
+  }));
+
+  // Canvas-level comments (no elementId) — POST /artifacts/:slug/comments
+  router.post('/artifacts/:slug/comments', wrap(async (req, res) => {
+    const out = artifactsStore.addComment(req.params.slug, null, req.body || {}, projectRoot);
+    if (!out) {
+      res.status(400).json({ error: 'bad_request', message: 'comment text is required' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(201).json(out);
+  }));
+
+  router.delete('/artifacts/:slug/comments/:cid', wrap(async (req, res) => {
+    const out = artifactsStore.deleteComment(req.params.slug, req.params.cid, projectRoot);
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.status(204).end();
+  }));
+
+  // ── /api/artifacts/:slug/submit (v3.22.0) ─────────────────────────────
+  // "Submit to agent" — collect free-placed comments + OpenQuestion
+  // answers, write a structured `feedback.md` the agent can read,
+  // mark the artifact `status: review`, and return the summary.
+  router.post('/artifacts/:slug/submit', wrap(async (req, res) => {
+    const result = artifactsStore.submitFeedback(
+      req.params.slug,
+      req.body || {},
+      projectRoot,
+    );
+    if (!result.ok) {
+      res.status(result.error === 'invalid_slug' ? 400 : 404).json({
+        error: result.error || 'not_found',
+      });
+      return;
+    }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(result);
+  }));
+
+  // ── /api/artifacts/:slug/questions/:qid/respond (v3.3.0) ──────────────
+  // Agent-side integration for the question element: an agent posts
+  // a question via the artifact's canvas; the user clicks a choice in
+  // the dashboard, this endpoint records the choice, marks the
+  // question resolved, and broadcasts the answer so the agent
+  // (when its plugin is updated) can pick it up.
+  router.post('/artifacts/:slug/questions/:qid/respond', wrap(async (req, res) => {
+    const { choiceId, text } = req.body || {};
+    const out = artifactsStore.respondToQuestion(
+      req.params.slug,
+      req.params.qid,
+      { choiceId, text },
+      projectRoot,
+    );
+    if (!out) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    // Also drop a notification so the agent can re-poll.
+    try {
+      notificationsStore.add({
+        severity: 'info',
+        source: 'artifact',
+        title: `Artifact: ${req.params.slug}`,
+        message: `Question answered: choice=${choiceId || 'freeform'}`,
+        link: `/artifacts/${req.params.slug}`,
+        meta: { slug: req.params.slug, qid: req.params.qid, choiceId, text },
+      }, { broadcast });
+    } catch { /* best-effort */ }
+    broadcast({ type: 'artifact:change', slug: req.params.slug });
+    res.json(out);
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/auth.mjs

@@ -0,0 +1,69 @@
+/**
+ * src/server/routes/auth.mjs
+ *
+ * v3.6.0 — Auth-related routes: status, reveal, regenerate.
+ *
+ * /api/auth/status   — UNAUTHED. Returns { required: true } so a
+ *                      client can detect that auth is on and ask the
+ *                      operator to paste a token.
+ * /api/auth/reveal   — AUTHED. Returns the current token. Only useful
+ *                      to someone who already has it (chicken-and-egg
+ *                      by design — initial token comes from server
+ *                      stderr on first boot).
+ * /api/auth/regenerate — AUTHED. Mints a new token, invalidating the
+ *                      old one immediately. The response body carries
+ *                      the new token ONCE — the caller must persist
+ *                      it client-side.
+ */
+import { Router } from 'express';
+import {
+  getDirectPeerAddress,
+  getOrCreateSecret,
+  isAuthRequired,
+  isLoopback,
+  regenerateSecret,
+} from '../auth.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createAuthRouter() {
+  const router = Router();
+
+  // Unauthed status probe. Tells the client whether auth is required
+  // and whether the current connection is loopback (in which case
+  // the server is auto-trusting it and the client doesn't need to
+  // send a token). This is how the dashboard "just works" in a
+  // browser on the same machine as the server. Reverse-proxy access
+  // still reports the direct peer so operators can tell whether a
+  // bearer token will be required.
+  router.get('/auth/status', (req, res) => {
+    const trusted = isLoopback(req);
+    res.json({
+      required: isAuthRequired(req),
+      loopback: trusted,
+      // Surface the direct peer for the Settings UI to display
+      // (helps the operator debug if the auto-trust isn't kicking
+      // in as expected — e.g. they're hitting a different bind).
+      peer: getDirectPeerAddress(req),
+    });
+  });
+
+  // AUTHED — returns the current token. The caller is presumed to
+  // already have it (that's why the auth middleware let them in);
+  // we just hand it back so the UI can render a "Copy token" button.
+  router.get('/auth/reveal', wrap((_req, res) => {
+    res.json({ token: getOrCreateSecret() });
+  }));
+
+  // AUTHED — rotate the token. Anything still holding the old token
+  // will start getting 401s immediately. The new token is in the
+  // response body; the caller MUST save it.
+  router.post('/auth/regenerate', wrap((_req, res) => {
+    const newToken = regenerateSecret();
+    res.json({ token: newToken });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/background.mjs

@@ -0,0 +1,165 @@
+/**
+ * src/server/routes/background.mjs
+ *
+ * /api/background                          — list
+ * /api/background/:id                      — single instance
+ * /api/background/:id/output               — tail captured output
+ * /api/background/:id/tmux                 — tmux attach metadata
+ * /api/background/:id/message (POST)       — send a follow-up message
+ * /api/background/:id/retry (POST)         — manual unstick (v3.11.0)
+ * /api/background/:id (DELETE)             — kill
+ *
+ * Backed by the opencode-plugin's bg instance store. Imports the
+ * store lazily so this module loads even when the plugin is offline.
+ */
+import { Router } from 'express';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {Function} deps.broadcast
+ * @returns {import('express').Router}
+ */
+export function createBackgroundRouter({ broadcast }) {
+  const router = Router();
+
+  router.get('/background', wrap(async (_req, res) => {
+    const { backgroundStore } = await import('../background-store.mjs');
+    const instances = await backgroundStore.list();
+    res.json({ instances, status: backgroundStore.status() });
+  }));
+
+  router.get('/background/:id', wrap(async (req, res) => {
+    const { backgroundStore } = await import('../background-store.mjs');
+    const inst = backgroundStore.get(req.params.id);
+    if (!inst) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.json(inst);
+  }));
+
+  router.get('/background/:id/output', wrap(async (req, res) => {
+    const { backgroundStore } = await import('../background-store.mjs');
+    const lines = Math.min(500, Math.max(1, parseInt(req.query.lines || '50', 10) || 50));
+    const result = backgroundStore.captureOutput(req.params.id, lines);
+    res.json(result);
+  }));
+
+  // v3.5.5 — Tmux session metadata. The UI uses this to render an
+  // "Attach" button next to a running bg instance. Returns the
+  // computed session name, the local attach command, and whether
+  // the session actually exists right now. Always 200 — the caller
+  // can tell `exists: false` apart from a missing instance.
+  router.get('/background/:id/tmux', wrap(async (req, res) => {
+    const { backgroundStore } = await import('../background-store.mjs');
+    const info = backgroundStore.tmuxAttachInfo(req.params.id);
+    res.json(info);
+  }));
+
+  router.post('/background/:id/message', wrap(async (req, res) => {
+    const { backgroundStore } = await import('../background-store.mjs');
+    const message = (req.body?.message || '').toString();
+    if (!message.trim()) {
+      res.status(400).json({ error: 'bad_request', message: 'message required' });
+      return;
+    }
+    const result = backgroundStore.sendMessage(req.params.id, message);
+    res.json(result);
+  }));
+
+  // v3.11.0 — Manual unstick for a bg instance stuck in
+  // `dispatchPending: true`. The periodic retry loop covers most
+  // cases, but operators (and the UI) sometimes want to recover a
+  // specific instance immediately without waiting for the next tick.
+  //
+  // Behavior:
+  //   - Resets `dispatchPending: true`, `retryCount: 0` so the
+  //     instance qualifies for a fresh retry.
+  //   - Calls `retryDispatchOnce(instanceId)` synchronously.
+  //   - Returns the same shape the periodic loop logs:
+  //     `{ ok, reason?, retryCount?, sessionId?, logPath? }`.
+  //
+  // This endpoint NEVER deletes the bg state file. A failed retry
+  // leaves the instance in a recoverable state.
+  router.post('/background/:id/retry', wrap(async (req, res) => {
+    const id = req.params.id;
+    const { readBgInstance, listBgInstances } = await import('../task-delegator.mjs');
+    const inst = readBgInstance(id);
+    if (!inst) {
+      res.status(404).json({ ok: false, error: 'not_found', message: `bg instance ${id} not found` });
+      return;
+    }
+    // Reset retry bookkeeping so a manual retry starts from a clean
+    // slate. The atomic rewrite goes through the same path the
+    // periodic loop uses; failures here are reported back to the
+    // caller.
+    try {
+      const fs = await import('node:fs');
+      const file = inst._file;
+      if (file && fs.existsSync(file)) {
+        const fresh = { ...inst, dispatchPending: true, retryCount: 0, lastRetryAt: Date.now() };
+        delete fresh._file;
+        delete fresh._bgDir;
+        delete fresh._mtime;
+        const tmp = `${file}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(fresh, null, 2), 'utf8');
+        try {
+          fs.renameSync(tmp, file);
+        } catch {
+          fs.writeFileSync(file, JSON.stringify(fresh, null, 2), 'utf8');
+        }
+      }
+    } catch {
+      /* best-effort reset; retryDispatchOnce still runs */
+    }
+    const { retryDispatchOnce } = await import('../bg-retry.mjs');
+    const result = await retryDispatchOnce(id);
+    if (result.ok) {
+      broadcast({ type: 'background:change', action: 'retry', id, sessionId: result.sessionId });
+      // Re-list so the UI snapshot picks up the new sessionId.
+      const refreshed = (listBgInstances() || []).find((i) => i.instanceId === id) || null;
+      res.json({ ...result, instance: refreshed });
+      return;
+    }
+    res.json({ ...result, instance: inst });
+  }));
+
+  router.delete('/background/:id', wrap(async (req, res) => {
+    const { backgroundStore } = await import('../background-store.mjs');
+    // v3.5.4 (bug #3) — `kill()` is now async (it awaits the abortSession
+    // HTTP call to opencode serve, then deletes the state file, then
+    // best-effort tmux). The result includes a `steps[]` array so the UI
+    // can report exactly what happened.
+    //
+    // We always return 200 — the result body's `ok` distinguishes
+    // success from partial failure (e.g. abort succeeded but tmux kill
+    // did not). Returning 502 would force the fetch wrapper into its
+    // error branch and we'd lose the `steps[]` diagnostic.
+    const result = await backgroundStore.kill(req.params.id);
+    if (result.ok) {
+      broadcast({ type: 'background:change', action: 'kill', id: req.params.id });
+    }
+    res.json(result);
+  }));
+
+  // v0.5.5 — Cleanup old terminal instances. The UI calls this from
+  // the Settings "Background Agents" card.
+  router.post('/background/cleanup', wrap(async (req, res) => {
+    const { backgroundStore } = await import('../background-store.mjs');
+    const maxAgeDays = Number(req.body?.maxAgeDays) || 7;
+    const result = backgroundStore.cleanup(maxAgeDays);
+    broadcast({ type: 'background:cleanup', deleted: result.deleted });
+    res.json(result);
+  }));
+
+  // v0.5.5 — Summary with status counts. The UI calls this for the
+  // Background Agents overview in Settings.
+  router.get('/background/summary', wrap(async (_req, res) => {
+    const { backgroundStore } = await import('../background-store.mjs');
+    const summary = backgroundStore.listWithStatusCounts();
+    res.json(summary);
+  }));
+
+  return router;
+}