@polderlabs/bizar 3.23.1 → 4.2.0

package/bizar-dash/src/server/routes/obsidian.mjs

@@ -0,0 +1,239 @@
+/**
+ * src/server/routes/obsidian.mjs
+ *
+ * v2 — Backward-compatible rewrite. When `.bizar/memory.json` exists, this
+ * router delegates to memory-store.mjs. When memory is not configured, it falls
+ * back to the original obsidian-store.mjs behaviour.
+ *
+ * CRITICAL: Preserve legacy response shapes exactly. Do not change the JSON
+ * structure returned by any endpoint.
+ */
+
+import { Router } from 'express';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SERVER_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// Lazy imports so circular deps are avoided and we only load memory-store.mjs
+// when it is actually needed.
+let _memoryStore = null;
+let _obsidianStore = null;
+let _wrap = null;
+
+async function getMemoryStore() {
+  if (!_memoryStore) {
+    _memoryStore = await import(`${SERVER_ROOT}/memory-store.mjs`).then((m) => m);
+  }
+  return _memoryStore;
+}
+
+async function getObsidianStore() {
+  if (!_obsidianStore) {
+    _obsidianStore = await import(`${SERVER_ROOT}/obsidian-store.mjs`).then((m) => m);
+  }
+  return _obsidianStore;
+}
+
+async function getShared() {
+  if (!_wrap) {
+    const mod = await import('./_shared.mjs').then((m) => m);
+    _wrap = mod.wrap;
+  }
+  return { wrap: _wrap };
+}
+
+/**
+ * Returns true if the project has opted into the memory service via
+ * `.bizar/memory.json`.
+ */
+async function hasMemoryConfig(projectRoot) {
+  const { safeReadJSON } = await import(`${SERVER_ROOT}/yaml.mjs`).then((m) => m);
+  // Use safeReadJSON from yaml.mjs is expensive — use simpler check
+  const { existsSync } = await import('node:fs');
+  const configPath = join(projectRoot, '.bizar', 'memory.json');
+  return existsSync(configPath);
+}
+
+export async function createObsidianRouter({ projectRoot }) {
+  const router = Router();
+  const { wrap } = await getShared();
+  const memoryEnabled = await hasMemoryConfig(projectRoot);
+
+  if (memoryEnabled) {
+    // ── Memory service is active — delegate to memory-store.mjs ──────────────
+    const ms = await getMemoryStore();
+
+    // GET /api/obsidian — vault stats
+    router.get('/obsidian', wrap(async (_req, res) => {
+      const { vaultRoot, mode } = ms.resolveVault(projectRoot);
+      const { existsSync, readdirSync, statSync, readFileSync } = await import('node:fs');
+      if (!existsSync(vaultRoot)) {
+        res.json({ exists: false, vaultDir: vaultRoot, noteCount: 0, totalSize: 0 });
+        return;
+      }
+      const notes = ms.listNotes(projectRoot);
+      const totalSize = notes.reduce((acc, n) => acc + n.size, 0);
+      const folders = new Set(notes.map((n) => n.relPath.split('/')[0]));
+      res.json({
+        exists: true,
+        vaultDir: vaultRoot,
+        noteCount: notes.length,
+        totalSize,
+        folderCount: folders.size,
+        folders: [...folders].sort(),
+        lastModified: notes[0]?.mtime || null,
+      });
+    }));
+
+    // POST /api/obsidian — init vault
+    router.post('/obsidian', wrap(async (_req, res) => {
+      const result = ms.initVault(projectRoot);
+      res.json({ vaultDir: result.vaultRoot, created: result.created });
+    }));
+
+    // GET /api/obsidian/notes — legacy shape: { notes: [{ path, relPath, mtime, size }] }
+    router.get('/obsidian/notes', wrap(async (_req, res) => {
+      const notes = ms.listNotes(projectRoot);
+      // Return legacy shape
+      const legacyNotes = notes.map((n) => ({
+        path: n.relPath,
+        relPath: n.relPath,
+        mtime: n.mtime,
+        size: n.size,
+      }));
+      res.json({ notes: legacyNotes });
+    }));
+
+    // POST /api/obsidian/notes — write note
+    // CRITICAL: returns 201 with FULL note shape { relPath, frontmatter, body, raw, mtime, size }
+    router.post('/obsidian/notes', wrap(async (req, res) => {
+      const { path: relPath, frontmatter, body } = req.body || {};
+      if (!relPath || typeof relPath !== 'string') {
+        res.status(400).json({ error: 'bad_request', message: 'path is required' });
+        return;
+      }
+      if (!relPath.endsWith('.md')) {
+        res.status(400).json({ error: 'bad_request', message: 'path must end in .md' });
+        return;
+      }
+      try {
+        const note = ms.writeNote(projectRoot, relPath, { frontmatter: frontmatter || {}, body: body || '' });
+        // Return FULL note shape (legacy behavior)
+        res.status(201).json(note);
+      } catch (err) {
+        res.status(400).json({ error: 'bad_request', message: err.message });
+      }
+    }));
+
+    // GET /api/obsidian/notes/:path — single note
+    router.get('/obsidian/notes/*', wrap(async (req, res) => {
+      const relPath = req.params[0];
+      const note = ms.readNote(projectRoot, relPath);
+      if (!note) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+      }
+      res.json(note);
+    }));
+
+    // DELETE /api/obsidian/notes/:path
+    router.delete('/obsidian/notes/*', wrap(async (req, res) => {
+      const relPath = req.params[0];
+      const ok = ms.deleteNote(projectRoot, relPath);
+      if (!ok) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+      }
+      res.status(204).end();
+    }));
+
+    // GET /api/obsidian/search?q=...
+    router.get('/obsidian/search', wrap(async (req, res) => {
+      const q = req.query.q || '';
+      const limit = Math.min(parseInt(req.query.limit, 10) || 25, 100);
+      const results = ms.searchVault(projectRoot, q, { limit });
+      res.json({ query: q, results });
+    }));
+
+    // POST /api/obsidian/index — rebuild index
+    router.post('/obsidian/index', wrap(async (_req, res) => {
+      // No-op in memory mode (INDEX.md is not maintained)
+      res.json({ ok: true, indexPath: null });
+    }));
+
+  } else {
+    // ── Legacy obsidian-store.mjs behaviour ───────────────────────────────────
+    const os = await getObsidianStore();
+
+    router.get('/obsidian', wrap(async (_req, res) => {
+      res.json(os.vaultStats(projectRoot));
+    }));
+
+    router.post('/obsidian', wrap(async (_req, res) => {
+      const result = os.initObsidianVault(projectRoot);
+      res.json(result);
+    }));
+
+    router.get('/obsidian/notes', wrap(async (_req, res) => {
+      const notes = os.listVaultNotes(projectRoot);
+      res.json({ notes });
+    }));
+
+    router.post('/obsidian/notes', wrap(async (req, res) => {
+      const { path: relPath, frontmatter, body } = req.body || {};
+      if (!relPath || typeof relPath !== 'string') {
+        res.status(400).json({ error: 'bad_request', message: 'path is required' });
+        return;
+      }
+      if (!relPath.endsWith('.md')) {
+        res.status(400).json({ error: 'bad_request', message: 'path must end in .md' });
+        return;
+      }
+      try {
+        const note = os.writeVaultNote(projectRoot, relPath, { frontmatter, body });
+        res.status(201).json(note);
+      } catch (err) {
+        res.status(400).json({ error: 'bad_request', message: err.message });
+      }
+    }));
+
+    router.get('/obsidian/notes/*', wrap(async (req, res) => {
+      const relPath = req.params[0];
+      const note = os.readVaultNote(projectRoot, relPath);
+      if (!note) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+      }
+      res.json(note);
+    }));
+
+    router.delete('/obsidian/notes/*', wrap(async (req, res) => {
+      const relPath = req.params[0];
+      const ok = os.deleteVaultNote(projectRoot, relPath);
+      if (!ok) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+      }
+      res.status(204).end();
+    }));
+
+    router.get('/obsidian/search', wrap(async (req, res) => {
+      const q = req.query.q;
+      const limit = Math.min(parseInt(req.query.limit, 10) || 25, 100);
+      const results = os.searchVault(projectRoot, q, { limit });
+      res.json({ query: q, results });
+    }));
+
+    router.post('/obsidian/index', wrap(async (_req, res) => {
+      const indexPath = os.rebuildIndex(projectRoot);
+      if (!indexPath) {
+        res.status(404).json({ error: 'not_initialized' });
+        return;
+      }
+      res.json({ ok: true, indexPath });
+    }));
+  }
+
+  return router;
+}

package/bizar-dash/src/server/routes/opencode-sessions.mjs

@@ -0,0 +1,55 @@
+/**
+ * src/server/routes/opencode-sessions.mjs
+ *
+ * /api/opencode-sessions  — reads active sessions from the opencode
+ * SQLite database (~/.local/share/opencode/opencode.db) and returns
+ * them in a format compatible with the dashboard's session list.
+ *
+ * Sessions are filtered to non-archived (time_archived IS NULL) and
+ * ordered by most recently updated.
+ */
+import { Router } from 'express';
+import Database from 'better-sqlite3';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { wrap } from './_shared.mjs';
+
+const DB_PATH = join(homedir(), '.local', 'share', 'opencode', 'opencode.db');
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createOpencodeSessionsRouter() {
+  const router = Router();
+
+  router.get('/opencode-sessions', wrap(async (_req, res) => {
+    let db;
+    try {
+      db = new Database(DB_PATH, { readonly: true, fileMustExist: true });
+      const rows = db.prepare(`
+        SELECT id, title, project_id, time_created, time_updated
+        FROM session
+        WHERE time_archived IS NULL
+        ORDER BY time_updated DESC
+        LIMIT 200
+      `).all();
+      return res.json({
+        sessions: rows.map((r) => ({
+          id: r.id,
+          title: r.title,
+          project: r.project_id,
+          created: r.time_created,
+          updated: r.time_updated,
+          mtime: r.time_updated,
+        })),
+      });
+    } catch (err) {
+      // DB might not exist yet, or permissions issue — return empty list
+      return res.json({ sessions: [], error: err.message });
+    } finally {
+      if (db) db.close();
+    }
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/overview.mjs

@@ -0,0 +1,91 @@
+/**
+ * src/server/routes/overview.mjs
+ *
+ * /api/snapshot                          — full snapshot (everything the Overview card needs)
+ * /api/overview                          — overview-only
+ * /api/health                            — { ok: true, ts }
+ * /api/restart (POST)                    — self-respawn
+ */
+import { Router } from 'express';
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { projectsStore } from '../projects-store.mjs';
+import { tasksStore } from '../tasks-store.mjs';
+import { agentsStore } from '../agents-store.mjs';
+import { schedulesStore } from '../schedules-store.mjs';
+import { providersStore, mcpsStore } from '../providers-store.mjs';
+import { modsLoader } from '../mods-loader.mjs';
+import {
+  OPENCODE_JSON,
+  readSettings,
+  safeReadJSON,
+  wrap,
+} from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @returns {import('express').Router}
+ */
+export function createOverviewRouter({ state }) {
+  const router = Router();
+
+  router.get('/snapshot', wrap(async (_req, res) => {
+    res.json(buildSnapshot());
+  }));
+
+  router.get('/overview', wrap(async (_req, res) => {
+    res.json(state.getOverview());
+  }));
+
+  router.get('/health', (_req, res) => res.json({ ok: true, ts: Date.now() }));
+
+  // v3.5.3 — Self-respawn: starts a new dashboard process in the
+  // background and exits this one. The BIZAR_AUTO_RESPAWN=1 env var
+  // marks it as an automated restart (vs a user-initiated one).
+  router.post('/restart', (req, res) => {
+    res.json({ restarting: true });
+    setTimeout(() => {
+      const child = spawn(
+        process.execPath,
+        [process.argv[1], ...process.argv.slice(2)],
+        {
+          detached: true,
+          stdio: 'ignore',
+          env: { ...process.env, BIZAR_AUTO_RESPAWN: '1' },
+        },
+      );
+      child.on('error', (err) => {
+        console.error('[dashboard] restart spawn failed:', err.message);
+      });
+      child.unref();
+      process.exit(0);
+    }, 500);
+  });
+
+  function buildSnapshot() {
+    const cfg = safeReadJSON(OPENCODE_JSON, null);
+    const active = projectsStore.active();
+    return {
+      overview: state.getOverview(),
+      agents: agentsStore.list(),
+      artifacts: state.getArtifacts(),
+      projects: projectsStore.list().projects,
+      activeProject: active,
+      config: {
+        path: OPENCODE_JSON,
+        data: cfg,
+        raw: cfg === null ? '' : JSON.stringify(cfg, null, 2),
+        exists: existsSync(OPENCODE_JSON),
+      },
+      settings: readSettings(),
+      tasks: active ? tasksStore.loadTasks(active.id) : [],
+      mods: modsLoader.list(),
+      schedules: active ? schedulesStore.list(active.id) : [],
+      providers: providersStore.list(),
+      mcps: mcpsStore.list(),
+    };
+  }
+
+  return router;
+}

package/bizar-dash/src/server/routes/pair.mjs

@@ -0,0 +1,67 @@
+/**
+ * src/server/routes/pair.mjs
+ *
+ * Companion-app pairing (v3.5.2).
+ *
+ *   /api/pair/start (POST)   — mint a short-lived token, return QR payload
+ *   /api/pair/verify (GET)   — companion confirms a token before persisting
+ *   /api/pair/status (GET)   — count of currently active pair tokens
+ *
+ * The pair token is unrelated to the v3.6.0 dashboard auth token;
+ * it's a separate short-lived bearer that's minted on demand for
+ * the companion QR scan flow.
+ */
+import { Router } from 'express';
+import { pairStore } from '../pair-store.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @param {Function} deps.broadcast
+ * @returns {import('express').Router}
+ */
+export function createPairRouter({ state, broadcast }) {
+  const router = Router();
+
+  router.post('/pair/start', wrap(async (req, res) => {
+    const port = req.app?.get('port') || (req.socket?.server?.address()?.port) || 4321;
+    const publicUrl = pairStore.detectPublicUrl(req, port);
+    const ttlMs = Math.max(30_000, Math.min(15 * 60 * 1000, Number(req.body?.ttlMs) || 5 * 60 * 1000));
+    const entry = pairStore.mint(publicUrl, ttlMs);
+    state.appendActivity({ kind: 'pair.start', publicUrl: entry.publicUrl, expiresAt: entry.expiresAt });
+    broadcast({ type: 'pair:change', publicUrl: entry.publicUrl, expiresAt: entry.expiresAt });
+    res.json({
+      token: entry.token,
+      qrPayload: entry.qrPayload,
+      publicUrl: entry.publicUrl,
+      expiresAt: entry.expiresAt,
+    });
+  }));
+
+  // Used by the companion right after scanning the QR to confirm the token
+  // works before persisting it. Returns { valid: true } on success, 401
+  // { error: 'expired' | 'no_token' } on failure.
+  router.get('/pair/verify', wrap(async (req, res) => {
+    const auth = req.headers.authorization || '';
+    if (!auth.startsWith('Bearer ')) {
+      res.status(401).json({ error: 'no_token', message: 'missing Authorization: Bearer' });
+      return;
+    }
+    const token = auth.slice(7).trim();
+    const entry = pairStore.verify(token);
+    if (!entry) {
+      res.status(401).json({ error: 'expired', message: 'pair token invalid or expired' });
+      return;
+    }
+    res.json({ valid: true, publicUrl: entry.publicUrl, expiresAt: entry.expiresAt });
+  }));
+
+  // Lightweight introspection — useful for the Settings card and the TUI
+  // to show "X tokens active". Always returns { active: <count> }.
+  router.get('/pair/status', wrap(async (_req, res) => {
+    res.json({ active: pairStore._size() });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/projects.mjs

@@ -0,0 +1,175 @@
+/**
+ * src/server/routes/projects.mjs
+ *
+ * /api/projects                           — list
+ * /api/projects  (POST)                   — add by path
+ * /api/projects/:id/activate (POST)       — set active
+ * /api/projects/:id (DELETE)              — remove
+ * /api/projects/refresh (POST)            — re-scan projects.json
+ * /api/projects/auto-detect (POST)        — auto-add the server's cwd
+ * /api/projects/active/tasks              — tasks for the active project
+ * /api/projects/active/schedules          — schedules for the active project
+ * /api/projects/active/mods               — mods for the active project
+ * /api/projects/active/state              — state.json for the active project
+ */
+import { Router } from 'express';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { projectsStore } from '../projects-store.mjs';
+import { tasksStore } from '../tasks-store.mjs';
+import { schedulesStore } from '../schedules-store.mjs';
+import { readActiveProjectId, safeReadJSON, wrap, readSettings } from './_shared.mjs';
+import { buildAllowedRootsFromSettings, resolveSafePath } from '../lib/path-safe.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @param {Function} deps.broadcast
+ * @param {string} deps.projectRoot
+ * @returns {import('express').Router}
+ */
+export function createProjectsRouter({ state, broadcast, projectRoot }) {
+  const router = Router();
+
+  router.get('/projects', wrap(async (_req, res) => {
+    res.json(projectsStore.list());
+  }));
+
+  router.post('/projects', wrap(async (req, res) => {
+    const path = (req.body?.path || '').trim();
+    const name = req.body?.name || null;
+    if (!path) {
+      res.status(400).json({ error: 'bad_request', message: 'path is required' });
+      return;
+    }
+    const project = projectsStore.add(path, name);
+    state.appendActivity({ kind: 'project.add', id: project.id, path: project.path });
+    res.status(201).json(project);
+  }));
+
+  router.post('/projects/:id/activate', wrap(async (req, res) => {
+    const activated = projectsStore.activate(req.params.id);
+    if (!activated) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    state.appendActivity({ kind: 'project.activate', id: activated.id });
+    broadcast({ type: 'project:change', project: activated });
+    res.json(activated);
+  }));
+
+  router.delete('/projects/:id', wrap(async (req, res) => {
+    projectsStore.remove(req.params.id);
+    broadcast({ type: 'project:change' });
+    res.status(204).end();
+  }));
+
+  router.post('/projects/refresh', wrap(async (_req, res) => {
+    res.json(projectsStore.list());
+  }));
+
+  // v3.0.4 — Manual auto-detect trigger for the "Use current directory"
+  // button on the Overview. Auto-detects the server's `projectRoot` and
+  // returns the (possibly updated) registry. Idempotent.
+  router.post('/projects/auto-detect', wrap(async (_req, res) => {
+    const detected = projectsStore.autoDetect({ cwd: projectRoot });
+    if (detected) {
+      state.appendActivity({ kind: 'project.auto-detect', id: detected.id, path: detected.path });
+      broadcast({ type: 'project:change', project: detected });
+    }
+    res.json(projectsStore.list());
+  }));
+
+  // v3.6.0 — Scan a configured `dashboard.projectsDirectory` for
+  // project roots and add any newly-detected ones to the registry.
+  // Idempotent: already-registered paths are skipped silently.
+  //
+  // v3.11.0 — The allow-list now also includes every entry in
+  // `dashboard.allowedRoots` (in addition to home and
+  // `projectsDirectory`). The configured `projectsDirectory` is
+  // re-validated against the full allow-list before scanning — a
+  // tampered settings file can't widen the boundary.
+  router.post('/projects/scan', wrap(async (_req, res) => {
+    const settings = readSettings().data || {};
+    const configured = settings.dashboard?.projectsDirectory;
+    if (typeof configured !== 'string' || !configured.trim()) {
+      res.status(400).json({
+        error: 'bad_request',
+        message: 'dashboard.projectsDirectory is not configured',
+      });
+      return;
+    }
+    const allowedRoots = buildAllowedRootsFromSettings({ settings, home: homedir() });
+    const safeRoot = resolveSafePath(configured, allowedRoots);
+    if (!safeRoot) {
+      res.status(403).json({
+        error: 'forbidden',
+        message: 'projectsDirectory is outside the allowed roots',
+      });
+      return;
+    }
+    let result;
+    try {
+      result = await projectsStore.scanDirectory(safeRoot);
+    } catch (err) {
+      res.status(500).json({ error: 'scan_failed', message: err?.message || String(err) });
+      return;
+    }
+    if (result.error) {
+      // scanDirectory returns `{ error }` on a soft failure (bad
+      // root, etc.). Surface as 400 so the client can show it.
+      res.status(400).json({ error: 'scan_failed', message: result.error });
+      return;
+    }
+    // Broadcast each newly added project so connected clients refresh.
+    for (const p of result.added) {
+      state.appendActivity({ kind: 'project.scan', id: p.id, path: p.path });
+      broadcast({ type: 'project:change', kind: 'added', project: p });
+    }
+    res.json({
+      added: result.added,
+      skipped: result.skipped,
+      scanned: result.scanned,
+    });
+  }));
+
+  // ── /api/projects/active/<entity> ──────────────────────────────────────
+  router.get('/projects/active/tasks', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ tasks: [], projectId: null });
+      return;
+    }
+    res.json({ tasks: tasksStore.loadTasks(active.id), projectId: active.id });
+  }));
+
+  router.get('/projects/active/schedules', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ schedules: [], projectId: null });
+      return;
+    }
+    res.json({ schedules: schedulesStore.list(active.id), projectId: active.id });
+  }));
+
+  router.get('/projects/active/mods', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ mods: [], projectId: null });
+      return;
+    }
+    res.json({ mods: [], projectId: active.id });
+  }));
+
+  router.get('/projects/active/state', wrap(async (_req, res) => {
+    const active = projectsStore.active();
+    if (!active) {
+      res.json({ state: {}, projectId: null });
+      return;
+    }
+    const stateFile = join(projectsStore.projectDir(active.id), 'state.json');
+    res.json({ state: safeReadJSON(stateFile, {}) || {}, projectId: active.id });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/providers.mjs

@@ -0,0 +1,47 @@
+/**
+ * src/server/routes/providers.mjs
+ *
+ * /api/providers                         — aggregated list (opencode.json + agent frontmatter + serve HTTP)
+ * /api/providers/active                  — current default provider + model
+ *
+ * The dashboard's Overview card uses these to show what the user
+ * can run. The /api/config/providers surface (which CRUDs the
+ * registry store) lives in config.mjs.
+ */
+import { Router } from 'express';
+import { providersStore } from '../providers-store.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createProvidersRouter() {
+  const router = Router();
+
+  // Surface-everything endpoint the dashboard uses to populate the
+  // Providers card on the Overview tab. Reads from opencode.json +
+  // agent frontmatter + (best-effort) the running opencode serve HTTP
+  // API, so the list is non-empty even on installs that don't declare
+  // a top-level `provider` key in opencode.json.
+  router.get('/providers', wrap(async (_req, res) => {
+    const providers = await providersStore.listAll();
+    res.json({ providers, count: providers.length });
+  }));
+
+  // Active default provider + model. null when nothing is configured.
+  router.get('/providers/active', wrap(async (_req, res) => {
+    const active = await providersStore.getActive();
+    res.json(active || { providerId: null, modelId: null, source: null });
+  }));
+
+  // v3.16.0 — Auto-detect providers from env + config. Best-effort;
+  // a timeout/failure on one provider does not block the others.
+  // Query: ?probe=0 to skip the /models probe (faster, less informative).
+  router.get('/providers/auto-detect', wrap(async (req, res) => {
+    const probe = req.query.probe !== '0';
+    const results = await providersStore.autoDetect({ probe });
+    res.json({ providers: results, count: results.length });
+  }));
+
+  return router;
+}