@polderlabs/bizar 3.23.1 → 4.0.0

package/bizar-dash/src/server/opencode-runner.mjs

@@ -0,0 +1,279 @@
+/**
+ * bizar-dash/src/server/opencode-runner.mjs
+ *
+ * v3.11.1 — Node child_process version of the opencode-runner.
+ *
+ * The plugin uses Bun.spawn (see plugins/bizar/src/opencode-runner.ts);
+ * the dashboard runs under Node and uses child_process.spawn. This
+ * module keeps the two implementations in sync — same surface, same
+ * log-format parsing, same exit semantics.
+ *
+ * See plugins/bizar/src/opencode-runner.ts for the design rationale
+ * and the structured-log wire format we parse.
+ */
+import { spawn } from 'node:child_process';
+import { createWriteStream, mkdirSync, existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+/**
+ * @typedef {'starting'|'running'|'done'|'failed'|'killed'} AgentState
+ *
+ * @typedef {Object} AgentStatus
+ * @property {AgentState} state
+ * @property {string} [sessionId]
+ * @property {number} processId
+ * @property {number} startedAt
+ * @property {number} [endedAt]
+ * @property {number} [exitCode]
+ * @property {string} [error]
+ *
+ * @typedef {Object} SpawnAgentOptions
+ * @property {string} prompt
+ * @property {string} agent
+ * @property {{ providerID: string, modelID: string }} [model]
+ * @property {string} worktree
+ * @property {string} logPath
+ * @property {string} [title]
+ * @property {Object<string,string>} [env]
+ * @property {number} [sessionIdTimeoutMs]
+ *
+ * @typedef {Object} SpawnAgentResult
+ * @property {boolean} ok
+ * @property {string} [sessionId]
+ * @property {number} [processId]
+ * @property {string} [error]
+ */
+
+/** @type {Map<number, { status: AgentStatus, proc: import('node:child_process').ChildProcess, onExit: Function[], spawnResolvers: Function[] }>} */
+const agents = new Map();
+
+/**
+ * Spawn a single `opencode run` process. Resolves once the opencode
+ * child has reported its session id in the structured log stream
+ * (or once the process exits before that).
+ *
+ * @param {SpawnAgentOptions} opts
+ * @returns {Promise<SpawnAgentResult>}
+ */
+export function spawnAgent(opts) {
+  // 1. Pre-flight: log dir must exist.
+  const logDir = dirname(opts.logPath);
+  if (!existsSync(logDir)) {
+    try {
+      mkdirSync(logDir, { recursive: true });
+    } catch (err) {
+      return Promise.resolve({
+        ok: false,
+        error: `cannot create log dir ${logDir}: ${err.message}`,
+      });
+    }
+  }
+
+  // 2. Build argv.
+  const args = [
+    'run',
+    '--dir', opts.worktree,
+    '--print-logs',
+    '--log-level', 'INFO',
+    '--title', opts.title || `bgr:${opts.agent}:${Date.now()}`,
+  ];
+  if (opts.model) {
+    args.push('--model', `${opts.model.providerID}/${opts.model.modelID}`);
+  }
+  args.push('--', opts.prompt);
+
+  // 3. Spawn the process.
+  let proc;
+  try {
+    proc = spawn('opencode', args, {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, ...(opts.env || {}) },
+    });
+  } catch (err) {
+    return Promise.resolve({
+      ok: false,
+      error: `failed to spawn opencode run: ${err.message}`,
+    });
+  }
+
+  // 4. Track the agent.
+  const rec = {
+    status: { state: 'starting', processId: proc.pid, startedAt: Date.now() },
+    proc,
+    onExit: [],
+    spawnResolvers: [],
+  };
+  agents.set(proc.pid, rec);
+
+  // 5. Pipe stdout+stderr to the log file.
+  const logStream = createWriteStream(opts.logPath, { flags: 'a' });
+  const sessionIdRegex = /message=created id=(ses_[A-Za-z0-9_]+)/;
+  let sessionId;
+
+  const resolveSpawnIfReady = (forceError) => {
+    const resolvers = rec.spawnResolvers.splice(0);
+    if (resolvers.length === 0) return;
+    if (forceError) {
+      for (const r of resolvers) r({ ok: false, processId: proc.pid, error: forceError });
+      return;
+    }
+    if (sessionId) {
+      rec.status.state = 'running';
+      for (const r of resolvers) r({ ok: true, sessionId, processId: proc.pid });
+    }
+  };
+
+  // 6. Stream readers — line-buffered by splitting on newlines. We
+  //    append a [stdout]/[stderr] prefix for human readability.
+  const attachLineReader = (stream, label) => {
+    let buf = '';
+    stream.setEncoding('utf8');
+    stream.on('data', (chunk) => {
+      const text = typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+      logStream.write(`[${label}] ${text}`);
+      if (label === 'stderr' && !sessionId) {
+        buf += text;
+        const m = buf.match(sessionIdRegex);
+        if (m && m[1]) {
+          sessionId = m[1];
+          rec.status.sessionId = sessionId;
+          resolveSpawnIfReady();
+        }
+      }
+    });
+    stream.on('end', () => {
+      // Final flush attempt.
+      if (label === 'stderr' && !sessionId && buf) {
+        const m = buf.match(sessionIdRegex);
+        if (m && m[1]) {
+          sessionId = m[1];
+          rec.status.sessionId = sessionId;
+          resolveSpawnIfReady();
+        }
+      }
+    });
+    stream.on('error', (err) => {
+      logStream.write(`[${label}] <stream error: ${err.message}>\n`);
+    });
+  };
+
+  if (proc.stdout) attachLineReader(proc.stdout, 'stdout');
+  if (proc.stderr) attachLineReader(proc.stderr, 'stderr');
+
+  // 7. Exit handler.
+  proc.on('exit', (exitCode, signal) => {
+    rec.status.exitCode = exitCode ?? undefined;
+    rec.status.endedAt = Date.now();
+    if (rec.status.state !== 'killed') {
+      if (signal) {
+        rec.status.state = 'killed';
+      } else if (exitCode === 0) {
+        rec.status.state = 'done';
+      } else {
+        rec.status.state = 'failed';
+        rec.status.error = rec.status.error || `opencode run exited with code ${exitCode}`;
+      }
+    }
+    if (!sessionId) {
+      resolveSpawnIfReady(rec.status.error || 'opencode run exited before reporting session id');
+    }
+    const cbs = rec.onExit.splice(0);
+    for (const cb of cbs) {
+      try { cb({ ...rec.status }); } catch { /* ignore */ }
+    }
+    try { logStream.end(); } catch { /* ignore */ }
+  });
+  proc.on('error', (err) => {
+    rec.status.error = err.message;
+    rec.status.endedAt = Date.now();
+    rec.status.state = 'failed';
+    if (!sessionId) resolveSpawnIfReady(err.message);
+    const cbs = rec.onExit.splice(0);
+    for (const cb of cbs) try { cb({ ...rec.status }); } catch { /* ignore */ }
+  });
+
+  // 8. Race against a timeout.
+  const sessionIdTimeoutMs = opts.sessionIdTimeoutMs ?? 10_000;
+  return new Promise((resolve) => {
+    rec.spawnResolvers.push(resolve);
+    setTimeout(() => {
+      if (!sessionId) {
+        resolveSpawnIfReady(
+          `opencode run did not report a session id within ${sessionIdTimeoutMs}ms`,
+        );
+      }
+    }, sessionIdTimeoutMs);
+  });
+}
+
+/**
+ * Snapshot the current status of an agent.
+ * @param {number} processId
+ * @returns {AgentStatus | null}
+ */
+export function getStatus(processId) {
+  const rec = agents.get(processId);
+  if (!rec) return null;
+  return { ...rec.status };
+}
+
+/**
+ * Subscribe to the exit event. Callback fires exactly once when
+ * the process exits.
+ * @param {number} processId
+ * @param {(status: AgentStatus) => void} cb
+ * @returns {() => void} unsubscribe
+ */
+export function onExit(processId, cb) {
+  const rec = agents.get(processId);
+  if (!rec) return () => undefined;
+  rec.onExit.push(cb);
+  if (rec.status.endedAt !== undefined) {
+    queueMicrotask(() => {
+      try { cb({ ...rec.status }); } catch { /* ignore */ }
+    });
+  }
+  return () => {
+    const i = rec.onExit.indexOf(cb);
+    if (i >= 0) rec.onExit.splice(i, 1);
+  };
+}
+
+/**
+ * Kill the agent. Sends SIGTERM, waits up to 5s, then SIGKILL.
+ * @param {number} processId
+ * @param {'SIGTERM'|'SIGKILL'} [signal]
+ * @returns {{ ok: boolean, error?: string }}
+ */
+export function killAgent(processId, signal = 'SIGTERM') {
+  const rec = agents.get(processId);
+  if (!rec) return { ok: true, error: 'no such process tracked' };
+  if (rec.status.endedAt !== undefined) {
+    return { ok: true, error: 'process already exited' };
+  }
+  rec.status.state = 'killed';
+  try {
+    rec.proc.kill(signal);
+  } catch (err) {
+    return { ok: false, error: `kill(${signal}) failed: ${err.message}` };
+  }
+  setTimeout(() => {
+    if (rec.status.endedAt === undefined) {
+      try { rec.proc.kill('SIGKILL'); } catch { /* ignore */ }
+    }
+  }, 5_000);
+  return { ok: true };
+}
+
+/**
+ * List every tracked agent.
+ * @returns {AgentStatus[]}
+ */
+export function list() {
+  return Array.from(agents.values()).map((r) => ({ ...r.status }));
+}
+
+/** For tests: clear the in-memory registry. */
+export function _resetForTests() {
+  agents.clear();
+}

package/bizar-dash/src/server/pair-store.mjs

@@ -0,0 +1,138 @@
+/**
+ * src/server/pair-store.mjs
+ *
+ * v3.5.2 — Pairing token store for the Bizar Companion mobile app.
+ *
+ * Generates short-lived bearer tokens that the dashboard issues when a user
+ * taps "Pair Device" in the Settings view (or runs the TUI / pair CLI).
+ * The companion app scans a QR code containing:
+ *
+ *   bizar://pair?url=<publicUrl>&token=<token>
+ *
+ * …then calls `GET /api/pair/verify` with the token. On success the
+ * companion stores the URL + token in expo-secure-store and uses it as a
+ * Bearer header for all subsequent API + WebSocket calls.
+ *
+ * Tokens are stored in memory only — a server restart invalidates all
+ * outstanding tokens. The TTL is 5 minutes, which is enough for the user
+ * to open the app, scan, and verify.
+ */
+import { randomBytes } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+/** @typedef {{ token: string, expiresAt: number, publicUrl: string }} PairToken */
+
+/** @type {Map<string, PairToken>} */
+const tokens = new Map();
+
+const DEFAULT_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+function gc() {
+  const now = Date.now();
+  for (const [tok, entry] of tokens) {
+    if (entry.expiresAt <= now) tokens.delete(tok);
+  }
+}
+
+/**
+ * Mint a fresh pairing token bound to a public URL.
+ * @param {string} publicUrl - URL the companion app should hit (https://... or http://localhost:...)
+ * @param {number} [ttlMs] - milliseconds until expiry
+ * @returns {PairToken & { qrPayload: string }}
+ */
+export function mint(publicUrl, ttlMs = DEFAULT_TTL_MS) {
+  gc();
+  const token = `pair_${randomBytes(24).toString('base64url')}`;
+  const expiresAt = Date.now() + ttlMs;
+  const entry = { token, expiresAt, publicUrl };
+  tokens.set(token, entry);
+  return {
+    ...entry,
+    qrPayload: `bizar://pair?url=${encodeURIComponent(publicUrl)}&token=${encodeURIComponent(token)}`,
+  };
+}
+
+/**
+ * Verify a Bearer token. Returns the entry on success, null on failure.
+ * @param {string | null | undefined} token
+ * @returns {PairToken | null}
+ */
+export function verify(token) {
+  if (!token || typeof token !== 'string') return null;
+  const entry = tokens.get(token);
+  if (!entry) return null;
+  if (entry.expiresAt <= Date.now()) {
+    tokens.delete(token);
+    return null;
+  }
+  return entry;
+}
+
+/**
+ * Express middleware: if the request carries a valid Bearer pair token,
+ * set `req.pairToken` and `req.pairEntry`. Does NOT block unauthenticated
+ * requests — the dashboard itself doesn't require auth; this middleware
+ * just enriches the request so other handlers can recognize paired clients.
+ */
+export function pairTokenMiddleware(req, _res, next) {
+  const auth = req.headers.authorization;
+  if (!auth || !auth.startsWith('Bearer ')) {
+    req.pairToken = null;
+    req.pairEntry = null;
+    return next();
+  }
+  const token = auth.slice(7).trim();
+  const entry = verify(token);
+  req.pairToken = entry ? token : null;
+  req.pairEntry = entry;
+  next();
+}
+
+/**
+ * Detect the URL the companion app should hit. Preference order:
+ *   1. Tailscale MagicDNS hostname from `tailscale.json` (if enabled)
+ *   2. The Host header from the current request (so localhost works in dev)
+ *   3. localhost on the configured port
+ *
+ * @param {import('express').Request} req
+ * @param {number} port
+ * @returns {string}
+ */
+export function detectPublicUrl(req, port) {
+  // 1. Tailscale config (best for phone-over-WiFi)
+  try {
+    const cfgPath = join(homedir(), '.config', 'bizar', 'tailscale.json');
+    if (existsSync(cfgPath)) {
+      const cfg = JSON.parse(readFileSync(cfgPath, 'utf8'));
+      if (cfg?.enabled && cfg?.hostname) {
+        const proto = cfg.https === false ? 'http' : 'https';
+        return `${proto}://${cfg.hostname}`;
+      }
+    }
+  } catch {
+    /* fall through */
+  }
+
+  // 2. Host header from the current request
+  const host = (req?.headers?.host || '').toString().trim();
+  if (host && /^[A-Za-z0-9.:[\]-]+$/.test(host) && !host.startsWith('127.0.0.1') && !host.startsWith('localhost')) {
+    const rawProto = (req?.headers?.['x-forwarded-proto'] || req?.protocol || 'http').toString().split(',')[0].trim().toLowerCase();
+    const proto = rawProto === 'https' ? 'https' : 'http';
+    return `${proto}://${host}`;
+  }
+
+  // 3. localhost fallback
+  return `http://localhost:${port}`;
+}
+
+export const pairStore = {
+  mint,
+  verify,
+  detectPublicUrl,
+  middleware: pairTokenMiddleware,
+  /** For tests / introspection only. */
+  _size: () => tokens.size,
+  _clear: () => tokens.clear(),
+};