@polderlabs/bizar 4.0.0 → 4.2.1

package/README.md

@@ -7,7 +7,7 @@
 12 agents across 4 cost tiers. Odin routes, subagents execute, Forseti audits.
 
 [![npm](https://img.shields.io/npm/v/bizar?color=cb3837)](https://www.npmjs.com/package/bizar)
-[![RTK](https://img.shields.io/badge/rtk-integrated-8A2BE2)](https://github.com/rtk-ai/rtk)
+[![Headroom](https://img.shields.io/badge/headroom-integrated-8A2BE2)](https://github.com/headroomlabs-ai/headroom)
 [![Semble](https://img.shields.io/badge/semble-integrated-0ea5e9)](https://github.com/semble-ai/semble)
 [![Skills](https://img.shields.io/badge/skills.sh-integrated-f59e0b)](https://www.skills.sh)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
@@ -201,40 +201,37 @@ bizar graph build
 - The `blessed` TUI library may render with quirks inside Windows Terminal; if you see garbled output in the TUI, use the browser UI via `bizar dash start --bg` and open http://localhost:4321 instead.
 - Some shell scripts under `config/skills/embedded-esp-idf/` are bash-only and require Git Bash (or WSL).
 - The bash `install.sh` does not run on Windows cmd/PowerShell; use the `npm install -g` path above.
-- RTK (Rust Token Killer) ships a bash-only installer. On Windows, install it manually via [Cargo](https://github.com/rtk-ai/rtk#installation) or a [prebuilt binary](https://github.com/rtk-ai/rtk/releases), then run `rtk init -g --opencode`.
+- Headroom ships a Python/npm installer. On Windows, install it manually: `pip install "headroom-ai[all]"` or `npm install -g headroom-ai`, then run `headroom wrap opencode`.
 
 ### Prerequisites
 
 - [opencode CLI](https://opencode.ai) installed and on `$PATH`
 - Provider connections (via `/connect` in opencode TUI)
-- [RTK](https://github.com/rtk-ai/rtk) (recommended) — CLI proxy that reduces LLM token consumption by 60-90%
+- [Headroom](https://github.com/headroomlabs-ai/headroom) (recommended) — CLI proxy that reduces LLM token consumption by 60-90%
 - [Semble](https://github.com/semble-ai/semble) (recommended) — AI-powered code search (used by Mimir agent)
 - [Skills CLI](https://www.skills.sh) (recommended) — Agent skill package manager (`npx skills add <owner/repo>`)
 
-### RTK Setup
+### Headroom Setup
 
-[RTK](https://github.com/rtk-ai/rtk) (Rust Token Killer) filters and compresses command output before it reaches the LLM context. It saves ~80% on common operations like `ls`, `git status`, `cargo test`, and `git diff`.
+[Headroom](https://github.com/headroomlabs-ai/headroom) filters and compresses command output before it reaches the LLM context. It saves ~80% on common operations like `ls`, `git status`, `cargo test`, and `git diff`.
 
 Install:
 
 ```bash
-# Homebrew (macOS)
-brew install rtk
+# Python (recommended)
+pip install "headroom-ai[all]"
 
-# Linux/macOS quick install
-curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh
-
-# Cargo
-cargo install --git https://github.com/rtk-ai/rtk
+# npm
+npm install -g headroom-ai
 ```
 
 Enable for opencode:
 
 ```bash
-rtk init -g --opencode
+headroom wrap opencode
 ```
 
-After setup, all Bash commands are transparently rewritten to their rtk equivalents — `git status` → `rtk git status`, `cargo test` → `rtk cargo test`. The LLM receives compact output, saving 60-90% on token costs.
+After setup, `headroom wrap opencode` injects config into `opencode.json` and starts a proxy. The LLM receives compact output, saving 60-90% on token costs. The wrapping is durable — all subsequent opencode sessions route through the headroom proxy.
 
 ### Semble Setup
 

package/bizar-dash/CHANGELOG.md

@@ -137,7 +137,7 @@
 
 - **Mod security layer (`src/server/mod-security.mjs`).** Mods declare permissions in `mod.json`; the loader enforces them at every privileged action:
   - **Filesystem sandboxing** — mods get scoped `readFileSync` / `writeFileSync` helpers. Paths outside `fs:read:<scope>` / `fs:write:<scope>` throw. Scope syntax: exact path, directory with implicit recursion, `/*` suffix, or `~/` home-relative.
-  - **Subprocess allowlist** — only whitelisted binaries (`bizar`, `opencode`, `python3`, `git`, `node`, `npm`, `pip`, `uv`, `rtk`, `jq`, `graphify`, `pipx`, `opencode-ai`) can be spawned without an explicit `process:spawn:<bin>` permission. Path-style binaries (`/bin/ls`) require explicit permission.
+   - **Subprocess allowlist** — only whitelisted binaries (`bizar`, `opencode`, `python3`, `git`, `node`, `npm`, `pip`, `uv`, `headroom`, `jq`, `graphify`, `pipx`, `opencode-ai`) can be spawned without an explicit `process:spawn:<bin>` permission. Path-style binaries (`/bin/ls`) require explicit permission.
   - **Integrity hash** — every mod's files are SHA-256-hashed at install time; the hash is stored under `_integrity` in `mod.json`. On every load the hash is recomputed; a mismatch triggers a critical warning and refuses to load the mod's routes until reinstalled.
   - **Audit log** — every privileged action is logged as JSON lines to `~/.cache/bizar/logs/mod-audit.log` with timestamp, mod id, mod version, action, and details. Inspect via `GET /api/mods/audit?mod=<id>&limit=200`.
 - **Public mod registry.** New `bizarre-mods` repo at `DrB0rk/bizarre-mods` is the canonical source of mods. `GET /api/mods/registry` fetches `registry.json` and annotates each entry with installed state and upgrade hints. `POST /api/mods { id }` installs from the registry.

package/bizar-dash/src/server/api.mjs

@@ -59,7 +59,7 @@ import { createMiscRouter } from './routes/misc.mjs';
  * @param {Function} [deps.broadcast]
  * @returns {import('express').Router}
  */
-export function createApiRouter({
+export async function createApiRouter({
   state,
   watcher,
   projectRoot,
@@ -106,7 +106,7 @@ export function createApiRouter({
   router.use(createOpencodeSessionsRouter());
   router.use(createDialogsRouter({ broadcast }));
   router.use(createSkillsRouter({ broadcast }));
-router.use(createObsidianRouter({ projectRoot }));
+  router.use(await createObsidianRouter({ projectRoot }));
   // v3.24.0 — Bizar Memory Service (Phase 1). Lazy-imported so that if Thor's
   // memory routes haven't landed yet, the dashboard still boots.
   const { createMemoryRouter } = await import('./routes/memory.mjs');

package/bizar-dash/src/server/artifacts-store.mjs

@@ -11,7 +11,7 @@
  * edits so the editor never races the markdown regenerator.
  *
  * Storage locations, in order of preference:
- *   1. <projectRoot>/artifacts/<slug>            (worktree, project-scoped)
+ *   1. <projectRoot>/.bizar/artifacts/<slug>      (worktree, project-scoped)
  *   2. ~/.config/opencode/artifacts/<slug>       (global fallback)
  */
 import {
@@ -102,7 +102,7 @@ export const artifactsStore = {
    */
   resolveDir(slug, projectRoot) {
     const candidates = [];
-    if (projectRoot) candidates.push(join(projectRoot, 'artifacts', slug));
+    if (projectRoot) candidates.push(join(projectRoot, '.bizar', 'artifacts', slug));
     candidates.push(join(GLOBAL_PLANS_DIR, slug));
     for (const c of candidates) {
       if (existsSync(c)) return c;
@@ -116,7 +116,7 @@ export const artifactsStore = {
    */
   ensureDir(slug, projectRoot) {
     const target = projectRoot
-      ? join(projectRoot, 'artifacts', slug)
+      ? join(projectRoot, '.bizar', 'artifacts', slug)
       : join(GLOBAL_PLANS_DIR, slug);
     mkdirSync(target, { recursive: true });
     return target;
@@ -126,7 +126,7 @@ export const artifactsStore = {
     const seen = new Set();
     const out = [];
     const dirs = [];
-    if (projectRoot) dirs.push(join(projectRoot, 'artifacts'));
+    if (projectRoot) dirs.push(join(projectRoot, '.bizar', 'artifacts'));
     dirs.push(GLOBAL_PLANS_DIR);
     for (const dir of dirs) {
       if (!existsSync(dir)) continue;

package/bizar-dash/src/server/memory-git.mjs

@@ -247,3 +247,145 @@ export function addAll(dir) {
     return { ok: false, error: err.message };
   }
 }
+
+/**
+ * Set the URL of a git remote, idempotently.
+ *
+ * @param {string} repoDir — the git repository root
+ * @param {string} remoteName — name of the remote (e.g. 'origin')
+ * @param {string} url — the remote URL
+ * @param {{ overwrite?: boolean }} [opts]
+ * @returns {{ ok: true, action: 'added' | 'updated' | 'unchanged' }}
+ * @throws if the remote already exists with a different URL and overwrite is false,
+ *         or if the underlying git command fails.
+ */
+export function addRemote(repoDir, remoteName, url, { overwrite = false } = {}) {
+  let existing = null;
+  try {
+    existing = execFileSync('git', ['remote', 'get-url', remoteName], {
+      cwd: repoDir,
+      encoding: 'utf8',
+      timeout: 5000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+  } catch (err) {
+    // exit code 2 or 128 means remote doesn't exist; anything else is a real error
+    if (err.status !== 2 && err.status !== 128) {
+      throw new Error(`failed to query remote '${remoteName}': ${err.message}`);
+    }
+  }
+
+  if (existing && existing === url) {
+    return { ok: true, action: 'unchanged' };
+  }
+
+  if (existing && !overwrite) {
+    throw new Error(
+      `remote '${remoteName}' already exists with URL ${existing}.\n` +
+      `  To update it, call addRemote(dir, name, url, { overwrite: true }).`,
+    );
+  }
+
+  if (existing) {
+    execFileSync('git', ['remote', 'set-url', remoteName, url], {
+      cwd: repoDir,
+      timeout: 5000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    return { ok: true, action: 'updated' };
+  }
+
+  execFileSync('git', ['remote', 'add', remoteName, url], {
+    cwd: repoDir,
+    timeout: 5000,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+  return { ok: true, action: 'added' };
+}
+
+/**
+ * Test whether a git remote is reachable.
+ *
+ * @param {string} repoDir — the git repository root
+ * @param {string} remoteName — name of the remote (e.g. 'origin')
+ * @param {{ timeoutMs?: number }} [opts]
+ * @returns {string} the trimmed stdout from `git ls-remote` on success,
+ *                   or '' on any failure (network, auth, timeout).
+ *                   Does NOT throw.
+ */
+export function lsRemote(repoDir, remoteName, { timeoutMs = 5000 } = {}) {
+  try {
+    const stdout = execFileSync('git', ['ls-remote', remoteName], {
+      cwd: repoDir,
+      timeout: timeoutMs,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    return stdout.trim();
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * Ensure the current branch tracks `<remote>/<branch>`. Idempotent.
+ *
+ * Some workflows create a managed vault before `origin` exists (or before
+ * the user pushes for the first time). Without an upstream, `git pull`
+ * fails with "There is no tracking information for the current branch."
+ * This helper detects that case and sets the upstream, or returns a
+ * structured result if it can't.
+ *
+ * Behaviour:
+ *   - Upstream already set to <remote>/<branch>  → { ok: true, action: 'unchanged' }
+ *   - Upstream missing                           → set it, return { ok: true, action: 'set' }
+ *   - Upstream set to a DIFFERENT remote/branch  → set it to the requested one,
+ *                                                  return { ok: true, action: 'set' }
+ *   - <remote> does not exist                    → { ok: false, error: 'remote "<remote>" does not exist' }
+ *   - git not installed                          → { ok: false, error: 'git not installed' }
+ *
+ * @param {string} cwd — git working directory
+ * @param {string} branch — local branch name (e.g. 'main')
+ * @param {string} [remote='origin'] — remote name
+ * @returns {{ ok: boolean, action?: 'unchanged'|'set', error?: string }}
+ */
+export function ensureUpstream(cwd, branch, remote = 'origin') {
+  if (!isGitInstalled()) return { ok: false, error: 'git not installed' };
+
+  // Current upstream — empty string means none configured.
+  let current = '';
+  try {
+    current = execFileSync('git', ['rev-parse', '--abbrev-ref', '@{upstream}'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+  } catch {
+    // No upstream set — fall through.
+  }
+
+  if (current && current === `${remote}/${branch}`) {
+    return { ok: true, action: 'unchanged' };
+  }
+
+  // Verify the remote exists before trying to set upstream to it.
+  try {
+    execFileSync('git', ['rev-parse', '--verify', remote], {
+      cwd,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  } catch {
+    return { ok: false, error: `remote '${remote}' does not exist` };
+  }
+
+  try {
+    execFileSync('git', ['branch', '--set-upstream-to', `${remote}/${branch}`], {
+      cwd,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    return { ok: true, action: 'set' };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}