@polderlabs/bizar 3.23.0 → 4.0.0

package/bizar-dash/src/server/routes/opencode-sessions.mjs

@@ -0,0 +1,55 @@
+/**
+ * src/server/routes/opencode-sessions.mjs
+ *
+ * /api/opencode-sessions  — reads active sessions from the opencode
+ * SQLite database (~/.local/share/opencode/opencode.db) and returns
+ * them in a format compatible with the dashboard's session list.
+ *
+ * Sessions are filtered to non-archived (time_archived IS NULL) and
+ * ordered by most recently updated.
+ */
+import { Router } from 'express';
+import Database from 'better-sqlite3';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { wrap } from './_shared.mjs';
+
+const DB_PATH = join(homedir(), '.local', 'share', 'opencode', 'opencode.db');
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createOpencodeSessionsRouter() {
+  const router = Router();
+
+  router.get('/opencode-sessions', wrap(async (_req, res) => {
+    let db;
+    try {
+      db = new Database(DB_PATH, { readonly: true, fileMustExist: true });
+      const rows = db.prepare(`
+        SELECT id, title, project_id, time_created, time_updated
+        FROM session
+        WHERE time_archived IS NULL
+        ORDER BY time_updated DESC
+        LIMIT 200
+      `).all();
+      return res.json({
+        sessions: rows.map((r) => ({
+          id: r.id,
+          title: r.title,
+          project: r.project_id,
+          created: r.time_created,
+          updated: r.time_updated,
+          mtime: r.time_updated,
+        })),
+      });
+    } catch (err) {
+      // DB might not exist yet, or permissions issue — return empty list
+      return res.json({ sessions: [], error: err.message });
+    } finally {
+      if (db) db.close();
+    }
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/overview.mjs

@@ -0,0 +1,91 @@
+/**
+ * src/server/routes/overview.mjs
+ *
+ * /api/snapshot                          — full snapshot (everything the Overview card needs)
+ * /api/overview                          — overview-only
+ * /api/health                            — { ok: true, ts }
+ * /api/restart (POST)                    — self-respawn
+ */
+import { Router } from 'express';
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { projectsStore } from '../projects-store.mjs';
+import { tasksStore } from '../tasks-store.mjs';
+import { agentsStore } from '../agents-store.mjs';
+import { schedulesStore } from '../schedules-store.mjs';
+import { providersStore, mcpsStore } from '../providers-store.mjs';
+import { modsLoader } from '../mods-loader.mjs';
+import {
+  OPENCODE_JSON,
+  readSettings,
+  safeReadJSON,
+  wrap,
+} from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @returns {import('express').Router}
+ */
+export function createOverviewRouter({ state }) {
+  const router = Router();
+
+  router.get('/snapshot', wrap(async (_req, res) => {
+    res.json(buildSnapshot());
+  }));
+
+  router.get('/overview', wrap(async (_req, res) => {
+    res.json(state.getOverview());
+  }));
+
+  router.get('/health', (_req, res) => res.json({ ok: true, ts: Date.now() }));
+
+  // v3.5.3 — Self-respawn: starts a new dashboard process in the
+  // background and exits this one. The BIZAR_AUTO_RESPAWN=1 env var
+  // marks it as an automated restart (vs a user-initiated one).
+  router.post('/restart', (req, res) => {
+    res.json({ restarting: true });
+    setTimeout(() => {
+      const child = spawn(
+        process.execPath,
+        [process.argv[1], ...process.argv.slice(2)],
+        {
+          detached: true,
+          stdio: 'ignore',
+          env: { ...process.env, BIZAR_AUTO_RESPAWN: '1' },
+        },
+      );
+      child.on('error', (err) => {
+        console.error('[dashboard] restart spawn failed:', err.message);
+      });
+      child.unref();
+      process.exit(0);
+    }, 500);
+  });
+
+  function buildSnapshot() {
+    const cfg = safeReadJSON(OPENCODE_JSON, null);
+    const active = projectsStore.active();
+    return {
+      overview: state.getOverview(),
+      agents: agentsStore.list(),
+      artifacts: state.getArtifacts(),
+      projects: projectsStore.list().projects,
+      activeProject: active,
+      config: {
+        path: OPENCODE_JSON,
+        data: cfg,
+        raw: cfg === null ? '' : JSON.stringify(cfg, null, 2),
+        exists: existsSync(OPENCODE_JSON),
+      },
+      settings: readSettings(),
+      tasks: active ? tasksStore.loadTasks(active.id) : [],
+      mods: modsLoader.list(),
+      schedules: active ? schedulesStore.list(active.id) : [],
+      providers: providersStore.list(),
+      mcps: mcpsStore.list(),
+    };
+  }
+
+  return router;
+}

package/bizar-dash/src/server/routes/pair.mjs

@@ -0,0 +1,67 @@
+/**
+ * src/server/routes/pair.mjs
+ *
+ * Companion-app pairing (v3.5.2).
+ *
+ *   /api/pair/start (POST)   — mint a short-lived token, return QR payload
+ *   /api/pair/verify (GET)   — companion confirms a token before persisting
+ *   /api/pair/status (GET)   — count of currently active pair tokens
+ *
+ * The pair token is unrelated to the v3.6.0 dashboard auth token;
+ * it's a separate short-lived bearer that's minted on demand for
+ * the companion QR scan flow.
+ */
+import { Router } from 'express';
+import { pairStore } from '../pair-store.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @param {Function} deps.broadcast
+ * @returns {import('express').Router}
+ */
+export function createPairRouter({ state, broadcast }) {
+  const router = Router();
+
+  router.post('/pair/start', wrap(async (req, res) => {
+    const port = req.app?.get('port') || (req.socket?.server?.address()?.port) || 4321;
+    const publicUrl = pairStore.detectPublicUrl(req, port);
+    const ttlMs = Math.max(30_000, Math.min(15 * 60 * 1000, Number(req.body?.ttlMs) || 5 * 60 * 1000));
+    const entry = pairStore.mint(publicUrl, ttlMs);
+    state.appendActivity({ kind: 'pair.start', publicUrl: entry.publicUrl, expiresAt: entry.expiresAt });
+    broadcast({ type: 'pair:change', publicUrl: entry.publicUrl, expiresAt: entry.expiresAt });
+    res.json({
+      token: entry.token,
+      qrPayload: entry.qrPayload,
+      publicUrl: entry.publicUrl,
+      expiresAt: entry.expiresAt,
+    });
+  }));
+
+  // Used by the companion right after scanning the QR to confirm the token
+  // works before persisting it. Returns { valid: true } on success, 401
+  // { error: 'expired' | 'no_token' } on failure.
+  router.get('/pair/verify', wrap(async (req, res) => {
+    const auth = req.headers.authorization || '';
+    if (!auth.startsWith('Bearer ')) {
+      res.status(401).json({ error: 'no_token', message: 'missing Authorization: Bearer' });
+      return;
+    }
+    const token = auth.slice(7).trim();
+    const entry = pairStore.verify(token);
+    if (!entry) {
+      res.status(401).json({ error: 'expired', message: 'pair token invalid or expired' });
+      return;
+    }
+    res.json({ valid: true, publicUrl: entry.publicUrl, expiresAt: entry.expiresAt });
+  }));
+
+  // Lightweight introspection — useful for the Settings card and the TUI
+  // to show "X tokens active". Always returns { active: <count> }.
+  router.get('/pair/status', wrap(async (_req, res) => {
+    res.json({ active: pairStore._size() });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/projects.mjs

@@ -0,0 +1,175 @@
+/**
+ * src/server/routes/projects.mjs
+ *
+ * /api/projects                           — list
+ * /api/projects  (POST)                   — add by path
+ * /api/projects/:id/activate (POST)       — set active
+ * /api/projects/:id (DELETE)              — remove
+ * /api/projects/refresh (POST)            — re-scan projects.json
+ * /api/projects/auto-detect (POST)        — auto-add the server's cwd
+ * /api/projects/active/tasks              — tasks for the active project
+ * /api/projects/active/schedules          — schedules for the active project
+ * /api/projects/active/mods               — mods for the active project
+ * /api/projects/active/state              — state.json for the active project
+ */
+import { Router } from 'express';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { projectsStore } from '../projects-store.mjs';
+import { tasksStore } from '../tasks-store.mjs';
+import { schedulesStore } from '../schedules-store.mjs';
+import { readActiveProjectId, safeReadJSON, wrap, readSettings } from './_shared.mjs';
+import { buildAllowedRootsFromSettings, resolveSafePath } from '../lib/path-safe.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @param {Function} deps.broadcast
+ * @param {string} deps.projectRoot
+ * @returns {import('express').Router}
+ */
+export function createProjectsRouter({ state, broadcast, projectRoot }) {
+  const router = Router();
+
+  router.get('/projects', wrap(async (_req, res) => {
+    res.json(projectsStore.list());
+  }));
+
+  router.post('/projects', wrap(async (req, res) => {
+    const path = (req.body?.path || '').trim();
+    const name = req.body?.name || null;
+    if (!path) {
+      res.status(400).json({ error: 'bad_request', message: 'path is required' });
+      return;
+    }
+    const project = projectsStore.add(path, name);
+    state.appendActivity({ kind: 'project.add', id: project.id, path: project.path });
+    res.status(201).json(project);
+  }));
+
+  router.post('/projects/:id/activate', wrap(async (req, res) => {
+    const activated = projectsStore.activate(req.params.id);
+    if (!activated) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    state.appendActivity({ kind: 'project.activate', id: activated.id });
+    broadcast({ type: 'project:change', project: activated });
+    res.json(activated);
+  }));
+
+  router.delete('/projects/:id', wrap(async (req, res) => {
+    projectsStore.remove(req.params.id);
+    broadcast({ type: 'project:change' });
+    res.status(204).end();
+  }));
+
+  router.post('/projects/refresh', wrap(async (_req, res) => {
+    res.json(projectsStore.list());
+  }));
+
+  // v3.0.4 — Manual auto-detect trigger for the "Use current directory"
+  // button on the Overview. Auto-detects the server's `projectRoot` and
+  // returns the (possibly updated) registry. Idempotent.
+  router.post('/projects/auto-detect', wrap(async (_req, res) => {
+    const detected = projectsStore.autoDetect({ cwd: projectRoot });
+    if (detected) {
+      state.appendActivity({ kind: 'project.auto-detect', id: detected.id, path: detected.path });
+      broadcast({ type: 'project:change', project: detected });
+    }
+    res.json(projectsStore.list());
+  }));
+
+  // v3.6.0 — Scan a configured `dashboard.projectsDirectory` for
+  // project roots and add any newly-detected ones to the registry.
+  // Idempotent: already-registered paths are skipped silently.
+  //
+  // v3.11.0 — The allow-list now also includes every entry in
+  // `dashboard.allowedRoots` (in addition to home and
+  // `projectsDirectory`). The configured `projectsDirectory` is
+  // re-validated against the full allow-list before scanning — a
+  // tampered settings file can't widen the boundary.
+  router.post('/projects/scan', wrap(async (_req, res) => {
+    const settings = readSettings().data || {};
+    const configured = settings.dashboard?.projectsDirectory;
+    if (typeof configured !== 'string' || !configured.trim()) {
+      res.status(400).json({
+        error: 'bad_request',
+        message: 'dashboard.projectsDirectory is not configured',
+      });
+      return;
+    }
+    const allowedRoots = buildAllowedRootsFromSettings({ settings, home: homedir() });
+    const safeRoot = resolveSafePath(configured, allowedRoots);
+    if (!safeRoot) {
+      res.status(403).json({
+        error: 'forbidden',
+        message: 'projectsDirectory is outside the allowed roots',
+      });
+      return;
+    }
+    let result;
+    try {
+      result = await projectsStore.scanDirectory(safeRoot);
+    } catch (err) {
+      res.status(500).json({ error: 'scan_failed', message: err?.message || String(err) });
+      return;
+    }
+    if (result.error) {
+      // scanDirectory returns `{ error }` on a soft failure (bad
+      // root, etc.). Surface as 400 so the client can show it.
+      res.status(400).json({ error: 'scan_failed', message: result.error });
+      return;
+    }
+    // Broadcast each newly added project so connected clients refresh.
+    for (const p of result.added) {
+      state.appendActivity({ kind: 'project.scan', id: p.id, path: p.path });
+      broadcast({ type: 'project:change', kind: 'added', project: p });
+    }
+    res.json({
+      added: result.added,
+      skipped: result.skipped,
+      scanned: result.scanned,
+    });
+  }));
+
+  // ── /api/projects/active/<entity> ──────────────────────────────────────
+  router.get('/projects/active/tasks', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ tasks: [], projectId: null });
+      return;
+    }
+    res.json({ tasks: tasksStore.loadTasks(active.id), projectId: active.id });
+  }));
+
+  router.get('/projects/active/schedules', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ schedules: [], projectId: null });
+      return;
+    }
+    res.json({ schedules: schedulesStore.list(active.id), projectId: active.id });
+  }));
+
+  router.get('/projects/active/mods', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ mods: [], projectId: null });
+      return;
+    }
+    res.json({ mods: [], projectId: active.id });
+  }));
+
+  router.get('/projects/active/state', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ state: {}, projectId: null });
+      return;
+    }
+    const stateFile = join(projectsStore.projectDir(active.id), 'state.json');
+    res.json({ state: safeReadJSON(stateFile, {}) || {}, projectId: active.id });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/providers.mjs

@@ -0,0 +1,47 @@
+/**
+ * src/server/routes/providers.mjs
+ *
+ * /api/providers                         — aggregated list (opencode.json + agent frontmatter + serve HTTP)
+ * /api/providers/active                  — current default provider + model
+ *
+ * The dashboard's Overview card uses these to show what the user
+ * can run. The /api/config/providers surface (which CRUDs the
+ * registry store) lives in config.mjs.
+ */
+import { Router } from 'express';
+import { providersStore } from '../providers-store.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createProvidersRouter() {
+  const router = Router();
+
+  // Surface-everything endpoint the dashboard uses to populate the
+  // Providers card on the Overview tab. Reads from opencode.json +
+  // agent frontmatter + (best-effort) the running opencode serve HTTP
+  // API, so the list is non-empty even on installs that don't declare
+  // a top-level `provider` key in opencode.json.
+  router.get('/providers', wrap(async (_req, res) => {
+    const providers = await providersStore.listAll();
+    res.json({ providers, count: providers.length });
+  }));
+
+  // Active default provider + model. null when nothing is configured.
+  router.get('/providers/active', wrap(async (_req, res) => {
+    const active = await providersStore.getActive();
+    res.json(active || { providerId: null, modelId: null, source: null });
+  }));
+
+  // v3.16.0 — Auto-detect providers from env + config. Best-effort;
+  // a timeout/failure on one provider does not block the others.
+  // Query: ?probe=0 to skip the /models probe (faster, less informative).
+  router.get('/providers/auto-detect', wrap(async (req, res) => {
+    const probe = req.query.probe !== '0';
+    const results = await providersStore.autoDetect({ probe });
+    res.json({ providers: results, count: results.length });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/schedules.mjs

@@ -0,0 +1,104 @@
+/**
+ * src/server/routes/schedules.mjs
+ *
+ * /api/schedules                          — list
+ * /api/schedules (POST)                   — add
+ * /api/schedules/:id (PUT)                — full update
+ * /api/schedules/:id (PATCH)              — partial update (toggle fields)
+ * /api/schedules/:id/run (POST)           — run once now
+ * /api/schedules/:id/trigger (POST)       — alias for /run (mobile uses this)
+ * /api/schedules/:id (DELETE)             — remove
+ *
+ * PATCH exists because the desktop UI's "toggle enabled" and the mobile
+ * UI's edit flow both want to send partial payloads without losing the
+ * rest of the schedule.
+ */
+import { Router } from 'express';
+import { schedulesStore } from '../schedules-store.mjs';
+import { schedulesRunner } from '../schedules-runner.mjs';
+import { readActiveProjectId, wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {Function} deps.broadcast
+ * @returns {import('express').Router}
+ */
+export function createSchedulesRouter({ broadcast }) {
+  const router = Router();
+
+  router.get('/schedules', wrap(async (req, res) => {
+    const projectId = req.query.projectId || readActiveProjectId();
+    res.json(schedulesStore.list(projectId || 'default'));
+  }));
+
+  router.post('/schedules', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const sched = schedulesStore.add(projectId, req.body || {});
+    broadcast({ type: 'schedules:change' });
+    res.status(201).json(sched);
+  }));
+
+  router.put('/schedules/:id', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const sched = schedulesStore.update(projectId, req.params.id, req.body || {});
+    if (!sched) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'schedules:change' });
+    res.json(sched);
+  }));
+
+  // v3.9.0 — Partial update. The mobile UI PATCHes a single field at a
+  // time (toggle enabled, rename, etc.) so a PUT that required the full
+  // shape was impractical. PATCH is semantically correct here.
+  router.patch('/schedules/:id', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const sched = schedulesStore.update(projectId, req.params.id, req.body || {});
+    if (!sched) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'schedules:change' });
+    res.json(sched);
+  }));
+
+  router.post('/schedules/:id/run', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const sched = schedulesStore.get(projectId, req.params.id);
+    if (!sched) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    const result = await schedulesRunner.runOne(projectId, sched);
+    broadcast({ type: 'schedules:change' });
+    res.json(result);
+  }));
+
+  // v3.9.0 — Mobile uses /trigger; keep it as an alias of /run so
+  // desktop and mobile share the same handler.
+  router.post('/schedules/:id/trigger', wrap(async (req, res) => {
+    const projectId = req.body?.projectId || readActiveProjectId() || 'default';
+    const sched = schedulesStore.get(projectId, req.params.id);
+    if (!sched) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    const result = await schedulesRunner.runOne(projectId, sched);
+    broadcast({ type: 'schedules:change' });
+    res.json(result);
+  }));
+
+  router.delete('/schedules/:id', wrap(async (req, res) => {
+    const projectId = req.query.projectId || readActiveProjectId() || 'default';
+    const ok = schedulesStore.remove(projectId, req.params.id);
+    if (!ok) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    broadcast({ type: 'schedules:change' });
+    res.status(204).end();
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/settings.mjs

@@ -0,0 +1,51 @@
+/**
+ * src/server/routes/settings.mjs
+ *
+ * /api/settings                          — read settings.json
+ * /api/settings (PUT)                    — write (merged with defaults)
+ * /api/settings/reset (POST)             — reset to defaults
+ */
+import { Router } from 'express';
+import { DEFAULT_SETTINGS, readSettings, writeSettings, wrap } from './_shared.mjs';
+import { readPluginOptions, writePluginOptions } from '../settings-store.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @param {Function} deps.broadcast
+ * @returns {import('express').Router}
+ */
+export function createSettingsRouter({ state, broadcast }) {
+  const router = Router();
+
+  router.get('/settings', wrap(async (_req, res) => {
+    res.json(readSettings());
+  }));
+
+  router.put('/settings', wrap(async (req, res) => {
+    const updated = writeSettings(req.body || {});
+    state.appendActivity({ kind: 'settings.update' });
+    broadcast({ type: 'settings:change', settings: updated.data });
+    res.json(updated);
+  }));
+
+  router.post('/settings/reset', wrap(async (_req, res) => {
+    const updated = writeSettings(DEFAULT_SETTINGS);
+    broadcast({ type: 'settings:change', settings: updated.data });
+    res.json(updated);
+  }));
+
+  // --- Plugin-options persistence for the Background Agents card ----------
+
+  router.get('/settings/plugin-options', wrap(async (_req, res) => {
+    res.json(readPluginOptions() || {});
+  }));
+
+  router.put('/settings/plugin-options', wrap(async (req, res) => {
+    const result = writePluginOptions(req.body || {});
+    if (broadcast) broadcast({ type: 'settings:plugin-options:changed' });
+    res.json(result);
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/skills.mjs

@@ -0,0 +1,76 @@
+/**
+ * src/server/routes/skills.mjs
+ *
+ * /api/skills                           — list (?category=foo to filter)
+ * /api/skills/search                    — fuzzy search by name/description
+ * /api/skills/install (POST)            — install by name or source URL
+ * /api/skills/:id/disable (POST)        — disable
+ * /api/skills/:id/enable (POST)         — enable
+ */
+import { Router } from 'express';
+import { skillsStore } from '../skills-store.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {Function} deps.broadcast
+ * @returns {import('express').Router}
+ */
+export function createSkillsRouter({ broadcast }) {
+  const router = Router();
+
+  // v3.3.0 — `?category=foo` filters the list server-side. The
+  // frontend uses this to power the collapsible categories view
+  // (the old "all in one list" mode is now the default "Show all"
+  // toggle in the UI).
+  router.get('/skills', wrap(async (req, res) => {
+    const skills = await skillsStore.list();
+    let out = skills;
+    if (req.query.category) {
+      const wanted = String(req.query.category).toLowerCase();
+      if (wanted !== 'all') {
+        out = skills.filter((s) => (s.category || '').toLowerCase() === wanted);
+      }
+    }
+    res.json({ skills: out, categories: skillsStore.CATEGORIES, total: skills.length });
+  }));
+
+  router.get('/skills/search', wrap(async (req, res) => {
+    const q = (req.query.q || '').toString();
+    const results = await skillsStore.search(q);
+    res.json({ results, query: q, categories: skillsStore.CATEGORIES });
+  }));
+
+  router.post('/skills/install', wrap(async (req, res) => {
+    const { name, source } = req.body || {};
+    if (!name && !source) {
+      res.status(400).json({ error: 'bad_request', message: 'name or source is required' });
+      return;
+    }
+    try {
+      const result = await skillsStore.install(name, source);
+      if (!result.ok) {
+        res.status(502).json({ error: 'install_failed', message: result.error || 'skills CLI install failed' });
+        return;
+      }
+      broadcast({ type: 'skills:change' });
+      res.status(202).json(result);
+    } catch (err) {
+      res.status(500).json({ error: 'install_failed', message: err.message });
+    }
+  }));
+
+  router.post('/skills/:id/disable', wrap(async (req, res) => {
+    const out = skillsStore.disable(req.params.id);
+    broadcast({ type: 'skills:change' });
+    res.json(out);
+  }));
+
+  router.post('/skills/:id/enable', wrap(async (req, res) => {
+    const out = skillsStore.enable(req.params.id);
+    broadcast({ type: 'skills:change' });
+    res.json(out);
+  }));
+
+  return router;
+}