@polderlabs/bizar 3.23.0 → 4.0.0

package/bizar-dash/src/server/update-store.mjs

@@ -0,0 +1,168 @@
+/**
+ * src/server/update-store.mjs
+ *
+ * v3.5.3 — Read installed package versions, check npm for latest,
+ * and apply updates for the three core bizarre packages.
+ */
+import { execSync, spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const PACKAGES = [
+  { id: 'bizar', name: '@polderlabs/bizar' },
+  { id: 'bizar-dash', name: '@polderlabs/bizar-dash' },
+  { id: 'bizar-plugin', name: '@polderlabs/bizar-plugin' },
+];
+
+export const updateStore = {
+  /**
+   * Get currently installed versions (read from each package's package.json).
+   * Returns null for any package that's not installed locally.
+   */
+  current() {
+    const out = {};
+    for (const p of PACKAGES) {
+      try {
+        out[p.id] = require(`${p.name}/package.json`).version;
+      } catch {
+        out[p.id] = null;
+      }
+    }
+    return out;
+  },
+
+  /**
+   * Check npm registry for latest published versions.
+   * Uses `npm view <pkg> version` — works without auth.
+   * Returns null for any package that errors (e.g., offline).
+   */
+  async latest() {
+    const out = {};
+    for (const p of PACKAGES) {
+      try {
+        const ver = execSync(`npm view ${p.name} version`, {
+          encoding: 'utf8',
+          timeout: 15000,
+        }).trim();
+        out[p.id] = ver;
+      } catch {
+        out[p.id] = null;
+      }
+    }
+    return out;
+  },
+
+  /**
+   * Determine if updates are available.
+   */
+  hasUpdates(current, latest) {
+    if (!current || !latest) return false;
+    return PACKAGES.some((p) => {
+      if (!current[p.id] || !latest[p.id]) return false;
+      return latest[p.id] !== current[p.id];
+    });
+  },
+
+  /**
+   * Run the update. Installs the specified packages at @latest.
+   * Streams progress via the broadcast callback.
+   */
+  async apply({ packages, broadcast }) {
+    const targets = PACKAGES.filter((p) => packages.includes(p.id));
+    const results = {};
+
+    for (const p of targets) {
+      broadcast?.({ type: 'update:progress', pkg: p.id, status: 'installing' });
+      try {
+        const output = execSync(
+          `npm install -g ${p.name}@latest --ignore-scripts`,
+          {
+            encoding: 'utf8',
+            timeout: 180000,
+          },
+        );
+        results[p.id] = { ok: true, output: output.slice(-500) };
+        broadcast?.({ type: 'update:progress', pkg: p.id, status: 'done' });
+      } catch (err) {
+        results[p.id] = { ok: false, error: err.message };
+        broadcast?.({ type: 'update:progress', pkg: p.id, status: 'error', error: err.message });
+      }
+    }
+
+    return results;
+  },
+
+  /**
+   * Apply updates for specified packages with live progress via broadcast.
+   * Streams events:
+   *   { type: 'update:progress', pkg, status: 'starting' }
+   *   { type: 'update:progress', pkg, status: 'installing' }
+   *   { type: 'update:progress', pkg, status: 'done', newVersion }
+   *   { type: 'update:progress', pkg, status: 'error', error }
+   *   { type: 'update:complete', results, requiresRestart: true }
+   */
+  async applyWithProgress({ packages, broadcast }) {
+    const results = {};
+    let allOk = true;
+
+    for (const pkg of packages) {
+      const pkgDef = PACKAGES.find((p) => p.id === pkg);
+      if (!pkgDef) continue;
+
+      broadcast?.({ type: 'update:progress', pkg, status: 'starting' });
+
+      try {
+        broadcast?.({ type: 'update:progress', pkg, status: 'installing' });
+
+        // Use spawn so we can stream stdout/stderr
+        const child = spawn('npm', ['install', '-g', `${pkgDef.name}@latest`, '--ignore-scripts'], {
+          stdio: ['ignore', 'pipe', 'pipe'],
+        });
+
+        // Stream stdout/stderr to broadcast for live log display
+        child.stdout.on('data', (data) => {
+          const line = data.toString().trim();
+          if (line) broadcast?.({ type: 'update:log', pkg, line });
+        });
+        child.stderr.on('data', (data) => {
+          const line = data.toString().trim();
+          if (line) broadcast?.({ type: 'update:log', pkg, line });
+        });
+
+        const exitCode = await new Promise((resolve) => {
+          child.on('close', resolve);
+        });
+
+        if (exitCode !== 0) {
+          allOk = false;
+          results[pkg] = { ok: false, error: `npm exited with code ${exitCode}` };
+          broadcast?.({ type: 'update:progress', pkg, status: 'error', error: `exit ${exitCode}` });
+          continue;
+        }
+
+        // Get the new version
+        const newVersion = this.getInstalledVersion(pkg);
+        results[pkg] = { ok: true, newVersion };
+        broadcast?.({ type: 'update:progress', pkg, status: 'done', newVersion });
+      } catch (err) {
+        allOk = false;
+        results[pkg] = { ok: false, error: err.message };
+        broadcast?.({ type: 'update:progress', pkg, status: 'error', error: err.message });
+      }
+    }
+
+    broadcast?.({ type: 'update:complete', results, requiresRestart: true, allOk });
+    return { results, requiresRestart: true };
+  },
+
+  getInstalledVersion(pkgId) {
+    const pkgDef = PACKAGES.find((p) => p.id === pkgId);
+    if (!pkgDef) return null;
+    try {
+      return require(`${pkgDef.name}/package.json`).version;
+    } catch {
+      return null;
+    }
+  },
+};

package/bizar-dash/src/server/v2-auth-file.mjs

@@ -0,0 +1,99 @@
+/**
+ * src/server/v2-auth-file.mjs
+ *
+ * v0.7.0-alpha.1 — Manages the dashboard's persistent password file.
+ *
+ * On first start: generate a 32-byte random password (base64), write to
+ * `~/.cache/bizarharness/dash-auth.json` with mode 0600.
+ *
+ * On subsequent starts: read the existing file and reuse the password.
+ *
+ * The plugin reads this same file to authenticate (or accepts
+ * `BIZAR_DASHBOARD_PASSWORD` env var override).
+ *
+ * Discovery paths (mirrors serve-info.mjs pattern):
+ *   - ~/.cache/bizarharness/dash-auth.json   (default)
+ *   - ~/.cache/bizar/dash-auth.json          (legacy, fallback)
+ */
+
+import { randomBytes } from 'node:crypto';
+import { writeFileSync, readFileSync, existsSync, mkdirSync, chmodSync, renameSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+
+const HOME = homedir();
+const DEFAULT_DIR = join(HOME, '.cache', 'bizarharness');
+const DEFAULT_FILE = join(DEFAULT_DIR, 'dash-auth.json');
+const LEGACY_FILE = join(HOME, '.cache', 'bizar', 'dash-auth.json');
+
+export const V2_DEFAULT_PORT = 4098;
+
+/**
+ * Load or create the dashboard auth record.
+ *
+ * @param {object} opts
+ * @param {string} [opts.file=DEFAULT_FILE] - explicit path
+ * @param {number} [opts.port=V2_DEFAULT_PORT] - port to record in auth file
+ * @returns {{ password: string, port: number, baseUrl: string, file: string, createdAt: number }}
+ */
+export function loadOrCreateAuth({ file = DEFAULT_FILE, port = V2_DEFAULT_PORT } = {}) {
+  // Prefer legacy file if it exists and default doesn't (migration).
+  const candidates = [file, LEGACY_FILE];
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) {
+      try {
+        const raw = readFileSync(candidate, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.password === 'string' && parsed.password.length >= 16) {
+          // Reuse the persisted PASSWORD (idempotent auth), but always
+          // use the CURRENT port — the persisted port may be wrong
+          // (from an earlier bug or a different listen port).
+          const result = {
+            password: parsed.password,
+            port,
+            baseUrl: `http://127.0.0.1:${port}`,
+            file: candidate,
+            createdAt: typeof parsed.createdAt === 'number' ? parsed.createdAt : 0,
+          };
+          // Re-write the file to update the port (atomic). The persisted
+          // password and createdAt are preserved.
+          if (typeof parsed.port !== 'number' || parsed.port !== port) {
+            try {
+              writeAuthFile(candidate, result);
+            } catch {
+              // non-fatal — return the in-memory record even if rewrite fails
+            }
+          }
+          return result;
+        }
+      } catch {
+        // fall through to regeneration
+      }
+    }
+  }
+
+  // Generate a new password.
+  const password = randomBytes(24).toString('base64');
+  const createdAt = Date.now();
+  const record = { password, port, baseUrl: `http://127.0.0.1:${port}`, createdAt };
+
+  writeAuthFile(file, record);
+
+  return { ...record, file };
+}
+
+/**
+ * Atomically write the auth file with mode 0600.
+ */
+function writeAuthFile(file, record) {
+  mkdirSync(dirname(file), { recursive: true });
+  const tmpFile = `${file}.tmp`;
+  writeFileSync(tmpFile, JSON.stringify(record, null, 2), { mode: 0o600 });
+  chmodSync(tmpFile, 0o600);
+  renameSync(tmpFile, file);
+  try {
+    chmodSync(file, 0o600);
+  } catch {
+    // non-fatal
+  }
+}

package/bizar-dash/src/server/v2-event-bus.mjs

@@ -0,0 +1,128 @@
+/**
+ * src/server/v2-event-bus.mjs
+ *
+ * v0.7.0-alpha.1 — In-memory event bus for the v2 SSE protocol.
+ *
+ * Buffers the last N events for late subscribers (replay via `?since=`).
+ * New subscribers get the buffer + live events.
+ *
+ * Replaces the file-based serve.json bridge for plugin→dashboard
+ * communication (the file bridge remains as fallback for v1 consumers).
+ */
+
+import { EventEmitter } from 'node:events';
+
+const BUFFER_LIMIT = 100;
+
+export class V2EventBus {
+  constructor({ bufferLimit = BUFFER_LIMIT, logger = console } = {}) {
+    this.bufferLimit = bufferLimit;
+    this.logger = logger;
+    this.emitter = new EventEmitter();
+    this.emitter.setMaxListeners(0); // unlimited subscribers
+    this.buffer = []; // [{ seq, type, properties, publishedAt }]
+    this.seq = 0;
+  }
+
+  /**
+   * Publish an event. Returns the assigned sequence number.
+   *
+   * @param {{ type: string, properties: object }} event
+   * @returns {number} sequence number
+   */
+  publish(event) {
+    if (!event || typeof event !== 'object' || typeof event.type !== 'string') {
+      throw new TypeError('V2EventBus.publish: event must have a string `type` field');
+    }
+    this.seq += 1;
+    const record = {
+      seq: this.seq,
+      type: event.type,
+      properties: event.properties ?? {},
+      publishedAt: Date.now(),
+    };
+    this.buffer.push(record);
+    if (this.buffer.length > this.bufferLimit) {
+      this.buffer.shift();
+    }
+    this.emitter.emit('event', record);
+    return record.seq;
+  }
+
+  /**
+   * Subscribe to live events.
+   *
+   * @param {object} opts
+   * @param {number} [opts.since] - replay events with seq > since (from buffer)
+   * @param {AbortSignal} [opts.signal] - abort signal to close subscription
+   * @returns {{ events: AsyncIterable, close: () => void }}
+   */
+  subscribe({ since, signal } = {}) {
+    const replay = typeof since === 'number'
+      ? this.buffer.filter((r) => r.seq > since)
+      : [];
+    const queue = [...replay];
+    const liveListeners = [];
+    let closed = false;
+
+    const onAbort = () => close();
+    if (signal) {
+      if (signal.aborted) {
+        // already aborted
+        return { events: emptyAsyncIterable(), close: () => {} };
+      }
+      signal.addEventListener('abort', onAbort, { once: true });
+    }
+
+    const onEvent = (record) => {
+      if (!closed) queue.push(record);
+    };
+    this.emitter.on('event', onEvent);
+    liveListeners.push(() => this.emitter.off('event', onEvent));
+
+    const close = () => {
+      if (closed) return;
+      closed = true;
+      for (const off of liveListeners) off();
+      if (signal) signal.removeEventListener('abort', onAbort);
+    };
+
+    return {
+      events: drainQueue(queue, close),
+      close,
+    };
+  }
+
+  /** Total events published since bus start. */
+  size() {
+    return this.seq;
+  }
+
+  /** Number of buffered events currently held for replay. */
+  bufferSize() {
+    return this.buffer.length;
+  }
+}
+
+async function* drainQueue(queue, onEnd) {
+  try {
+    while (queue.length > 0) {
+      yield queue.shift();
+    }
+    // After replay, switch to live: block until queue has items or close()
+    while (true) {
+      if (queue.length > 0) {
+        yield queue.shift();
+        continue;
+      }
+      // wait briefly then check again
+      await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+  } finally {
+    if (onEnd) onEnd();
+  }
+}
+
+async function* emptyAsyncIterable() {
+  // no-op
+}

package/bizar-dash/src/server/watcher.mjs

@@ -0,0 +1,81 @@
+/**
+ * cli/dashboard/watcher.mjs
+ *
+ * chokidar-backed file watcher. Translates low-level fs events into the
+ * shape the dashboard's WebSocket layer expects.
+ *
+ * The watcher ignores initial add events (the UI doesn't need a "you just
+ * started, here are 200 files that already existed" flood on connect).
+ */
+import chokidar from 'chokidar';
+
+/**
+ * @param {object} opts
+ * @param {string[]} opts.paths - files or directories to watch
+ * @param {(event: 'add'|'change'|'unlink', path: string) => void} opts.onChange
+ * @param {object} [opts.options] - extra chokidar options
+ */
+export function createWatcher({ paths, onChange, options = {} }) {
+  if (!Array.isArray(paths) || paths.length === 0) {
+    throw new Error('createWatcher requires a non-empty paths array');
+  }
+  if (typeof onChange !== 'function') {
+    throw new Error('createWatcher requires an onChange callback');
+  }
+
+  const watcher = chokidar.watch(paths, {
+    ignoreInitial: true,
+    persistent: true,
+    awaitWriteFinish: { stabilityThreshold: 100, pollInterval: 50 },
+    // Ignore: any path segment named `node_modules` (anywhere), and any
+    // file/dir whose IMMEDIATE basename starts with `.` (covers .DS_Store,
+    // .swp, .bak, etc.). We must NOT walk the whole path — the watched
+    // root `~/.config/opencode/agents` contains the segment `.config`
+    // which would otherwise match and silently disable the watch.
+    ignored: (p) => {
+      const s = String(p);
+      const parts = s.split(/[\\/]/);
+      // Walk all segments — `node_modules` is fine to match anywhere.
+      if (parts.includes('node_modules')) return true;
+      // Last segment is the basename — check that ONLY, so `.config`
+      // in parent dirs doesn't disqualify the watched root.
+      const basename = parts[parts.length - 1] || '';
+      return basename.startsWith('.');
+    },
+    ...options,
+  });
+
+  const safe = (event, p) => {
+    try {
+      onChange(event, p);
+    } catch (err) {
+      // A faulty onChange must not crash the watcher
+      console.error('[dashboard watcher] onChange error:', err);
+    }
+  };
+
+  watcher.on('add', (p) => safe('add', p));
+  watcher.on('change', (p) => safe('change', p));
+  watcher.on('unlink', (p) => safe('unlink', p));
+  watcher.on('error', (err) => {
+    console.error('[dashboard watcher] chokidar error:', err);
+  });
+
+  return {
+    /** @returns {chokidar.FSWatcher} */
+    start() {
+      return watcher;
+    },
+    async stop() {
+      try {
+        await watcher.close();
+      } catch {
+        /* ignore */
+      }
+    },
+    /** Force a synthetic broadcast — useful after a self-mutation. */
+    poke(event = 'change', path = '<synthetic>') {
+      safe(event, path);
+    },
+  };
+}