@polderlabs/bizar 3.23.1 → 4.2.0

package/bizar-dash/src/server/routes-v2/health.mjs

@@ -0,0 +1,21 @@
+/**
+ * src/server/routes-v2/health.mjs
+ *
+ * v0.7.0-alpha.1 — Public health endpoint (no auth required).
+ */
+
+import express from 'express';
+
+export function createV2HealthRouter({ version, startedAt }) {
+  const router = express.Router();
+
+  router.get('/health', (_req, res) => {
+    res.status(200).json({
+      status: 'ok',
+      uptime: Math.max(0, Math.floor((Date.now() - startedAt) / 1000)),
+      version,
+    });
+  });
+
+  return router;
+}

package/bizar-dash/src/server/routes-v2/index.mjs

@@ -0,0 +1,90 @@
+/**
+ * src/server/routes-v2/index.mjs
+ *
+ * v0.7.0-alpha.1 — Mounts /api/v2/* routes with HTTP basic auth.
+ *
+ * Public:   GET /health
+ * Protected (Basic auth): /sessions, /sessions/:id, /event
+ *
+ * Also exposes GET /doc — the OpenAPI spec served from
+ * `.bizar/research/OPENAPI_SPEC.yaml` (or wherever build copies it).
+ */
+
+import express from 'express';
+import { readFileSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { v2BasicAuth } from './auth.mjs';
+import { createV2HealthRouter } from './health.mjs';
+import { createV2EventsRouter } from './events.mjs';
+import { createV2SessionsRouter } from './sessions.mjs';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+/**
+ * Locate the OpenAPI spec file.
+ * Search order:
+ *   1. <package>/.bizar/research/OPENAPI_SPEC.yaml       (development)
+ *   2. <package>/OPENAPI_SPEC.yaml                       (when copied at build)
+ *   3. <repo-root>/.bizar/research/OPENAPI_SPEC.yaml     (BizarHarness monorepo)
+ *   4. <package>/../.bizar/research/OPENAPI_SPEC.yaml    (workspace dev fallback)
+ */
+function findOpenApiSpec() {
+  const packageRoot = join(__dirname, '..', '..', '..'); // src/server/routes-v2 → package root (bizar-dash)
+  const candidates = [
+    join(packageRoot, '.bizar', 'research', 'OPENAPI_SPEC.yaml'),
+    join(packageRoot, 'OPENAPI_SPEC.yaml'),
+    join(packageRoot, '..', '.bizar', 'research', 'OPENAPI_SPEC.yaml'),
+    join(packageRoot, '..', '..', '.bizar', 'research', 'OPENAPI_SPEC.yaml'),
+  ];
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+export function createV2Router({ eventBus, getPassword, version, startedAt }) {
+  const router = express.Router();
+  const auth = v2BasicAuth(getPassword);
+
+  // v0.7.0-alpha.1 — debug request logger (logs every v2 hit). Comment
+  // out for production. Useful for verifying SDK publish calls land.
+  router.use((req, _res, next) => {
+    console.log(
+      `[v2-req] ${req.method} ${req.originalUrl} auth=${req.headers.authorization ? 'yes' : 'no'}`,
+    );
+    next();
+  });
+
+  // Public health endpoint.
+  router.use(createV2HealthRouter({ version, startedAt }));
+
+  // OpenAPI spec.
+  router.get('/doc', (_req, res) => {
+    const specPath = findOpenApiSpec();
+    if (!specPath) {
+      return res.status(404).json({
+        name: 'DashboardError',
+        data: { statusCode: 404, message: 'OpenAPI spec not found' },
+      });
+    }
+    try {
+      const content = readFileSync(specPath, 'utf8');
+      res.setHeader('Content-Type', 'application/yaml; charset=utf-8');
+      res.status(200).send(content);
+    } catch (err) {
+      res.status(500).json({
+        name: 'DashboardError',
+        data: { statusCode: 500, message: err instanceof Error ? err.message : String(err) },
+      });
+    }
+  });
+
+  // Protected routes.
+  router.use(auth);
+  router.use(createV2EventsRouter({ eventBus }));
+  router.use(createV2SessionsRouter({ eventBus }));
+
+  return router;
+}

package/bizar-dash/src/server/routes-v2/sessions.mjs

@@ -0,0 +1,111 @@
+/**
+ * src/server/routes-v2/sessions.mjs
+ *
+ * v0.7.0-alpha.1 — Sessions CRUD for /api/v2/sessions/*.
+ *
+ * Stores sessions in-memory (Map). The plugin is the source of truth for
+ * session state (it owns opencode serve); the dashboard reflects what the
+ * plugin publishes via the event bus + REST.
+ *
+ * For v0.7.0-alpha.1 this is a minimal implementation sufficient for the
+ * smoke test. v0.7.1 will integrate with the dashboard's existing
+ * background-store.mjs.
+ */
+
+import express from 'express';
+
+export function createV2SessionsRouter({ eventBus }) {
+  const router = express.Router();
+  const sessions = new Map(); // id → Session
+
+  router.get('/sessions', (req, res) => {
+    const statusFilter = typeof req.query.status === 'string' ? req.query.status : null;
+    const agentFilter = typeof req.query.agent === 'string' ? req.query.agent : null;
+    let limit = 50;
+    if (typeof req.query.limit === 'string') {
+      const n = Number.parseInt(req.query.limit, 10);
+      if (Number.isFinite(n) && n > 0 && n <= 200) limit = n;
+    }
+
+    let list = Array.from(sessions.values());
+    if (statusFilter) list = list.filter((s) => s.status === statusFilter);
+    if (agentFilter) list = list.filter((s) => s.agent === agentFilter);
+    list.sort((a, b) => b.createdAt - a.createdAt);
+    res.status(200).json(list.slice(0, limit));
+  });
+
+  router.post('/sessions', (req, res) => {
+    const body = req.body ?? {};
+    if (typeof body.agent !== 'string' || body.agent.length === 0) {
+      return res.status(400).json({
+        name: 'DashboardError',
+        data: { statusCode: 400, message: '`agent` is required' },
+      });
+    }
+    if (typeof body.prompt !== 'string' || body.prompt.length === 0) {
+      return res.status(400).json({
+        name: 'DashboardError',
+        data: { statusCode: 400, message: '`prompt` is required' },
+      });
+    }
+    const now = Date.now();
+    const id = `bgr_${randomUlid()}`;
+    const session = {
+      id,
+      agent: body.agent,
+      status: 'pending',
+      parentId: typeof body.parentId === 'string' ? body.parentId : undefined,
+      model: typeof body.model === 'string' ? body.model : undefined,
+      toolCallCount: 0,
+      worktree: typeof body.worktree === 'string' ? body.worktree : process.cwd(),
+      createdAt: now,
+      updatedAt: now,
+    };
+    sessions.set(id, session);
+    eventBus.publish({
+      type: 'session.created',
+      properties: { sessionId: id, agent: session.agent },
+    });
+    res.status(201).json(session);
+  });
+
+  router.get('/sessions/:sessionId', (req, res) => {
+    const session = sessions.get(req.params.sessionId);
+    if (!session) {
+      return res.status(404).json({
+        name: 'DashboardError',
+        data: { statusCode: 404, message: 'Session not found' },
+      });
+    }
+    res.status(200).json(session);
+  });
+
+  router.delete('/sessions/:sessionId', (req, res) => {
+    const session = sessions.get(req.params.sessionId);
+    if (!session) {
+      return res.status(404).json({
+        name: 'DashboardError',
+        data: { statusCode: 404, message: 'Session not found' },
+      });
+    }
+    session.status = 'killed';
+    session.updatedAt = Date.now();
+    eventBus.publish({
+      type: 'session.updated',
+      properties: { sessionId: session.id, status: 'killed' },
+    });
+    res.status(204).end();
+  });
+
+  return router;
+}
+
+function randomUlid() {
+  // Lightweight ULID-ish suffix (10 chars base36 of timestamp + random).
+  const ts = Date.now().toString(36).toUpperCase();
+  let rnd = '';
+  for (let i = 0; i < 10; i += 1) {
+    rnd += Math.floor(Math.random() * 36).toString(36).toUpperCase();
+  }
+  return `${ts}${rnd}`;
+}

package/bizar-dash/src/server/schedules-runner.mjs

@@ -0,0 +1,369 @@
+/**
+ * src/server/schedules-runner.mjs
+ *
+ * v3.9.0 — Executes due schedules.
+ *
+ * Called by the service daemon (cli/service.mjs) on a tick. For each due
+ * schedule, this module runs the action and records the result via
+ * schedulesStore.recordRun().
+ *
+ * Action types:
+ *   - command  → spawn a child process
+ *   - agent    → submit via taskDelegator (Odin split-and-dispatch).
+ *               Honors `budgetCheck.skipIfBudgetLow` to skip when too
+ *               many bg tasks are already running.
+ *   - webhook  → POST JSON to the URL
+ *
+ * Errors are caught and recorded; the loop never throws.
+ */
+import { spawn } from 'node:child_process';
+import { writeFileSync, appendFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { isIP } from 'node:net';
+import { projectsStore } from './projects-store.mjs';
+import { schedulesStore } from './schedules-store.mjs';
+
+const HOME = homedir();
+const LOG_DIR = join(HOME, '.config', 'bizar');
+const LOG_FILE = join(LOG_DIR, 'service.log');
+const ALLOW_PRIVATE_WEBHOOKS = process.env.BIZAR_DASHBOARD_ALLOW_PRIVATE_WEBHOOKS === '1';
+const SHELL_META = /[;&|`$<>\n\r]/;
+
+function logLine(line) {
+  try {
+    mkdirSync(LOG_DIR, { recursive: true });
+    appendFileSync(LOG_FILE, line + '\n', 'utf8');
+  } catch {
+    /* ignore */
+  }
+}
+
+function parseCommandTarget(action) {
+  if (action?.command && Array.isArray(action?.args)) {
+    return {
+      command: String(action.command).trim(),
+      args: action.args.map((arg) => String(arg)),
+    };
+  }
+  const target = String(action?.target || '').trim();
+  if (!target) return { error: 'empty command target' };
+  if (SHELL_META.test(target)) {
+    return { error: 'shell metacharacters are not allowed in schedule command targets' };
+  }
+  const parts = target.split(/\s+/).filter(Boolean);
+  if (parts.length === 0) return { error: 'empty command target' };
+  return { command: parts[0], args: parts.slice(1) };
+}
+
+function isPrivateHostname(hostname) {
+  const host = String(hostname || '').replace(/^\[|\]$/g, '').toLowerCase();
+  if (!host) return true;
+  if (host === 'localhost' || host === '::1') return true;
+  const ipVersion = isIP(host);
+  if (ipVersion === 4) {
+    if (host.startsWith('127.')) return true;
+    if (host.startsWith('10.')) return true;
+    if (host.startsWith('192.168.')) return true;
+    if (host.startsWith('169.254.')) return true;
+    const octets = host.split('.').map((part) => Number(part));
+    if (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) return true;
+    return false;
+  }
+  if (ipVersion === 6) {
+    return host === '::1' || host.startsWith('fc') || host.startsWith('fd') || host.startsWith('fe80:');
+  }
+  return host.endsWith('.local');
+}
+
+function validateWebhookTarget(rawUrl) {
+  try {
+    const url = new URL(String(rawUrl || ''));
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+      return { error: 'webhook URL must use http or https' };
+    }
+    if (url.username || url.password) {
+      return { error: 'webhook URL must not embed credentials' };
+    }
+    if (!ALLOW_PRIVATE_WEBHOOKS && isPrivateHostname(url.hostname)) {
+      return { error: 'private, loopback, and .local webhook targets are blocked by default' };
+    }
+    return { url };
+  } catch {
+    return { error: 'invalid webhook URL' };
+  }
+}
+
+async function runAction(action, ctx = {}) {
+  if (!action || typeof action !== 'object') {
+    throw new Error('invalid action');
+  }
+  if (action.type === 'command') {
+    return runCommand(action);
+  }
+  if (action.type === 'webhook') {
+    return runWebhook(action);
+  }
+  if (action.type === 'agent') {
+    return runAgentAction(action, ctx);
+  }
+  throw new Error(`unknown action type: ${action.type}`);
+}
+
+/**
+ * Dispatch an `agent` schedule action via the dashboard's task delegator.
+ * Mirrors the contract used by /api/tasks/submit: Odin analyzes the prompt,
+ * splits into subtasks, and dispatches each to a matched agent.
+ *
+ * The delegator's `submit()` returns `{ main, subtasks, dispatch }`. We
+ * treat the call as successful when `main` was persisted AND Odin
+ * produced at least one subtask. Subtask dispatch errors are surfaced as
+ * the `error` field of the returned shape so the schedule's `lastError`
+ * reflects the dispatch outcome, not just "the task was created".
+ *
+ * Lazy import keeps this module loadable when the task delegator is not
+ * yet initialised (e.g. during unit tests).
+ *
+ * @param {object} action
+ * @param {object} [ctx]  Optional ctx (projectId, broadcast). Passed through.
+ * @returns {Promise<{ ok: boolean, taskId?: string, subtaskCount?: number, error?: string }>}
+ */
+async function runAgentAction(action, ctx = {}) {
+  const title =
+    action.title ||
+    action.name ||
+    (typeof action.target === 'string' && action.target.trim()) ||
+    'Scheduled task';
+  const prompt =
+    action.prompt ||
+    (action.body && typeof action.body === 'object' && action.body.prompt) ||
+    (typeof action.target === 'string' ? action.target.trim() : '') ||
+    'Run scheduled task.';
+  const projectId = ctx.projectId || null;
+  try {
+    const { taskDelegator } = await import('./task-delegator.mjs');
+    const result = await taskDelegator.submit(
+      {
+        title,
+        description: prompt,
+        tags: ['scheduled'],
+        priority: 'normal',
+      },
+      {
+        projectId,
+        broadcast: ctx.broadcast || (() => {}),
+      },
+    );
+    const mainOk = !!(result && result.main && result.main.id);
+    const subtaskCount = (result && Array.isArray(result.subtasks)) ? result.subtasks.length : 0;
+    const dispatchErrors = result && result.dispatch && Array.isArray(result.dispatch.errors)
+      ? result.dispatch.errors
+      : [];
+    const dispatchErrMsg = dispatchErrors.length > 0
+      ? dispatchErrors.map((e) => e && e.message).filter(Boolean).join('; ') || 'dispatch error'
+      : null;
+    if (!mainOk) {
+      return { ok: false, error: 'task delegator did not persist a main task' };
+    }
+    if (subtaskCount === 0) {
+      return { ok: false, taskId: result.main.id, error: 'no subtasks produced' };
+    }
+    return {
+      ok: dispatchErrors.length === 0,
+      taskId: result.main.id,
+      subtaskCount,
+      error: dispatchErrMsg || undefined,
+    };
+  } catch (err) {
+    return { ok: false, error: err && err.message ? err.message : String(err) };
+  }
+}
+
+/**
+ * Budget pre-flight: count in-flight bg tasks (running + pending) and
+ * skip the schedule if the count meets or exceeds `maxConcurrent`.
+ * Returns `{ skip: true, reason }` to skip, or `{ skip: false }` to
+ * continue with the run.
+ *
+ * Lazy-imports backgroundStore so this module can be loaded even when
+ * the bg subsystem hasn't booted yet.
+ *
+ * @param {{ skipIfBudgetLow?: boolean, maxConcurrent?: number }|undefined} budgetCheck
+ * @returns {Promise<{ skip: boolean, reason?: string, running?: number, cap?: number }>}
+ */
+async function checkBudget(budgetCheck) {
+  if (!budgetCheck || !budgetCheck.skipIfBudgetLow) {
+    return { skip: false };
+  }
+  const cap = Number.isFinite(budgetCheck.maxConcurrent) ? budgetCheck.maxConcurrent : 6;
+  let running = 0;
+  try {
+    const { backgroundStore } = await import('./background-store.mjs');
+    const list = backgroundStore.list();
+    running = list.filter(
+      (b) => b && (b.status === 'running' || b.status === 'pending'),
+    ).length;
+  } catch (err) {
+    // If the bg subsystem is unreachable we treat that as "no tasks
+    // running" — better to over-fire a schedule than to silently skip.
+    logLine(`[schedule] budget check failed: ${err.message || err}`);
+    return { skip: false };
+  }
+  if (running >= cap) {
+    return {
+      skip: true,
+      reason: `budget: ${running} concurrent >= ${cap}`,
+      running,
+      cap,
+    };
+  }
+  return { skip: false, running, cap };
+}
+
+function runCommand(action) {
+  return new Promise((resolve) => {
+    const parsed = parseCommandTarget(action);
+    if (parsed.error) {
+      resolve({ ok: false, error: parsed.error });
+      return;
+    }
+    try {
+      const child = spawn(parsed.command, parsed.args, {
+        shell: false,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: process.env,
+      });
+      let stdout = '';
+      let stderr = '';
+      child.stdout.on('data', (b) => (stdout += b.toString()));
+      child.stderr.on('data', (b) => (stderr += b.toString()));
+      child.on('error', (err) => {
+        resolve({ ok: false, error: err.message, stdout, stderr });
+      });
+      child.on('close', (code) => {
+        resolve({
+          ok: code === 0,
+          error: code === 0 ? null : `exit ${code}`,
+          stdout: stdout.slice(-2000),
+          stderr: stderr.slice(-2000),
+        });
+      });
+    } catch (err) {
+      resolve({ ok: false, error: err.message });
+    }
+  });
+}
+
+async function runWebhook(action) {
+  const validated = validateWebhookTarget(action.target);
+  if (validated.error) return { ok: false, error: validated.error };
+  const method = String(action.method || 'POST').toUpperCase();
+  const allowedMethods = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD']);
+  if (!allowedMethods.has(method)) {
+    return { ok: false, error: `unsupported webhook method: ${method}` };
+  }
+  try {
+    const r = await fetch(validated.url, {
+      method,
+      headers: { 'Content-Type': 'application/json' },
+      body: action.body && method !== 'GET' && method !== 'HEAD' ? JSON.stringify(action.body) : undefined,
+      redirect: 'manual',
+    });
+    if (r.status >= 300 && r.status < 400) {
+      return { ok: false, status: r.status, error: 'redirect responses are blocked for webhooks' };
+    }
+    return { ok: r.ok, status: r.status };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}
+
+export const schedulesRunner = {
+  LOG_FILE,
+
+  /** Run all currently-due schedules for every project. */
+  async tick() {
+    const reg = projectsStore.list();
+    const fired = [];
+    const projectIds = new Set(reg.projects.map((project) => project.id));
+    try {
+      if (schedulesStore.list('default').length > 0) projectIds.add('default');
+    } catch {
+      /* ignore */
+    }
+    let skipped = 0;
+    for (const projectId of projectIds) {
+      const due = schedulesStore.due(projectId, Date.now());
+      for (const sched of due) {
+        const result = await this.runOne(projectId, sched);
+        if (result && result.skipped) skipped += 1;
+        fired.push({ projectId, scheduleId: sched.id, ...result });
+      }
+    }
+    if (skipped > 0) {
+      logLine(`[schedule] tick: ${skipped} skipped by budget pre-flight`);
+    }
+    return fired;
+  },
+
+  /** Run a single schedule immediately and record the result. */
+  async runOne(projectId, sched) {
+    const startedAt = new Date().toISOString();
+    logLine(
+      `[${startedAt}] run ${projectId}/${sched.id} (${sched.type}: ${sched.schedule})`,
+    );
+    // Budget pre-flight — only applies to agent actions with a budget
+    // gate. A skip records a `skipped` result and does NOT advance
+    // `nextRun` (the schedule keeps firing on the same cadence).
+    if (sched && sched.action && sched.action.type === 'agent') {
+      try {
+        const budget = await checkBudget(sched.budgetCheck);
+        if (budget.skip) {
+          logLine(`[schedule] budget check: ${budget.reason}, skipping ${sched.id}`);
+          const updated = schedulesStore.recordRun(projectId, sched.id, {
+            result: 'skipped',
+            error: budget.reason || 'budget exhausted',
+          });
+          return { ok: true, skipped: true, schedule: updated, runResult: { skipped: true, ...budget } };
+        }
+      } catch (err) {
+        // A failing budget check must NOT block the schedule — log and
+        // proceed with the action.
+        logLine(`[schedule] budget check threw: ${err.message || err}`);
+      }
+    }
+    try {
+      const res = await runAction(sched.action, { projectId });
+      // The runner distinguishes "ran but skipped by budget" (ok:true,
+      // skipped:true) from "ran successfully" (ok:true, no skip) and
+      // "ran and errored" (ok:false).
+      const result = res && res.skipped
+        ? 'skipped'
+        : res.ok
+          ? 'success'
+          : 'error';
+      const updated = schedulesStore.recordRun(projectId, sched.id, {
+        result,
+        error: res.error || null,
+      });
+      const suffix = result === 'success'
+        ? 'success'
+        : result === 'skipped'
+          ? `skipped: ${res.error || 'budget'}`
+          : `error: ${res.error}`;
+      logLine(
+        `[${new Date().toISOString()}] done ${projectId}/${sched.id} → ${suffix}`,
+      );
+      return { ok: res.ok, skipped: result === 'skipped', schedule: updated, runResult: res };
+    } catch (err) {
+      const updated = schedulesStore.recordRun(projectId, sched.id, {
+        result: 'error',
+        error: err.message || String(err),
+      });
+      logLine(
+        `[${new Date().toISOString()}] failed ${projectId}/${sched.id}: ${err.message}`,
+      );
+      return { ok: false, schedule: updated, runResult: { error: err.message } };
+    }
+  },
+};