@polderlabs/bizar 4.4.12 → 4.5.0

package/bizar-dash/CHANGELOG.md

@@ -1,288 +1,49 @@
 # @polderlabs/bizar-dash — Changelog
 
-## v3.19.0 — Obsidian vault + browser-harness agent + Plans→Artifacts rename
-
-### Highlights
-
-- **Plans renamed to Artifacts.** The old `Plans` tab is now `Artifacts`. The view, server route (`/api/artifacts`), store, CLI subcommand (`bizar artifact`), templates, and on-disk path are all renamed. Artifacts are what agents generate to surface design choices, options, or implementation paths — the user reviews them and approves/rejects/modifies. Same semantics, new naming.
-- **Per-project Obsidian vault (`/api/obsidian/*`).** Every project now has an `.obsidian/` directory inside its worktree that gets git-tracked. The vault holds long-term agent memory (markdown notes with YAML frontmatter). Standard subdirs: `daily/`, `decisions/`, `patterns/`, `api/`, `tasks/`. Dashboard exposes CRUD + full-text search + auto-rebuild of `INDEX.md`. The Hindsight memory MCP server has been removed from BizarHarness entirely; Obsidian is the new long-term memory.
-- **Ponytail mod** (npm: `@dietrichgebert/ponytail`). Records the active ponytail level (lite/full/ultra/off) in `.obsidian/ponytail/state.json` so any agent that reads the vault at session start picks it up. Dashboard view for switching the level. Install separately: `npx @dietrichgebert/ponytail install --scope=user`.
-- **Impeccable mod** (npm: `impeccable`). Wraps `npx impeccable detect` and stores the last scan report in `.obsidian/impeccable/`. Dashboard view shows findings + stat cards. Install separately: `npx impeccable skills install -y --scope=user`.
-- **`browser-harness` agent** (`config/agents/browser-harness.md`). Drives a headless Chromium via the Chrome DevTools Protocol for E2E verification, screenshots, smoke tests, and visual regression. Never edits code — reports findings with file:line references.
-
-### Files added (1)
-
-- `src/server/obsidian-store.mjs` — vault CRUD + search + init + INDEX rebuild
-
-### Files added (route)
-
-- `src/server/routes/obsidian.mjs` — `GET/POST /api/obsidian`, `GET/POST/DELETE /api/obsidian/notes`, `GET /api/obsidian/search`, `POST /api/obsidian/index`
-
-### Files added (mods)
-
-- `mods-examples/ponytail/{mod.json,route.mjs,web/index.html}` + mirrored in `bizar-mods/mods/ponytail/`
-- `mods-examples/impeccable/{mod.json,route.mjs,web/index.html}` + mirrored in `bizar-mods/mods/impeccable/`
-
-### Files added (agent)
-
-- `config/agents/browser-harness.md`
-
-### Test results
-
-- `vite build`: succeeds; new features present in `dist/`
-- `bun test tests/mod-security.test.mjs`: 26/26 pass (no regression)
-- TypeScript: clean for the routes and mods; one phantom TS warning about a phantom literal that doesn't exist anywhere in source — Vite/esbuild compilation works regardless
-
-## v3.18.0 — Settings tabs work + chat info panel hideable + mod install fix
-
-### Highlights
-
-- **Settings subnav is now a real tab strip** that hides non-matching sections via inline-style `display: none`. The v3.17.0 CSS-attribute-selector approach worked in isolation but a stale scroll-detection useEffect kept resetting the active tab. Now removed. URL hash deep-links (`#settings-theme`) still work.
-- **Mod install from registry fixed.** `installFromRegistry` now accepts the `downloadUrl` field directly, plus tries both `mods/<id>/<version>/` and the flat `mods/<id>/` paths as fallbacks. `installFromUrl` also fetches `web/index.html` so mods with self-contained web views round-trip cleanly. The `bizar-mods` registry.json now includes `downloadUrl` pointing at the flat-path on GitHub.
-- **Chat info panel (right sidebar) is hideable.** New "Info" button in the chat header toggles the right sidebar (Session info, Agents, Active MCPs, Slash commands). When hidden, a floating "Show info" restore button appears.
-- **Version constant fixed.** The header used to show `v3.6.1` regardless of the actual installed version. Now reads `v3.18.0`.
-
-## v3.17.0 — Settings section filter + graphify removed
-
-### Highlights
-
-- **Settings section filter.** v3.16.0's subnav scrolled to sections; v3.17.0 actually filters — clicking a subnav button shows ONLY that section, with a "Showing only X" banner and a one-click escape. URL hash deep-links (`#settings-theme`) still work.
-- **graphify removed.** Deleted `src/server/routes/graph.mjs`, `src/web/views/Graph.tsx`, and the Graph tab from TABS + VIEW_MAP. Graph is now provided exclusively by the graphify mod (installable from the registry).
-- **`dist/` rebuilt.** This version's UI features (settings filter) are present in the published `dist/` (v3.17.0 fixes the v3.16.0 invisibility regression from v3.16.2).
-
-## v3.16.2 — Rebuild `dist/` so the v3.16.0 UI changes are actually served
-
-> **Critical**: v3.15.0 through v3.16.1 all shipped `src/` changes but the `dist/` build was never regenerated. The dashboard's web UI is served from `dist/` (Vite output), not `src/`. Result: every UI change from v3.15.0 onward (activity log overhaul, settings subnav, chat floating input, mods registry browser, provider auto-detect banner) was invisible in the running dashboard — only the new server-side API routes were live. Fixed by running `vite build` and bumping to v3.16.2.
-
-### Verification
-
-`dist/assets/main-*.css` now contains: `settings-subnav`, `chat-input-floating`, `mods-registry`, `autodetect-banner`, `activity-hidden-banner`, `activity-log-table`. `dist/assets/main-*.js` contains `AutoDetect`, `ActivityLog`, etc.
-
-## v3.16.1 — Hotfix: dashboard crash on `bizar dash start`
-
-> **Critical bug**: `bizar dash start` failed with `The requested module '../state.mjs' does not provide an export named 'state'`. v3.15.0 and v3.16.0 both shipped this regression because `routes/activity.mjs` did `import { state } from '../state.mjs'`. The `state` object is created per-server-instance via `createState()` in `server.mjs:178` and threaded through `api.mjs` as a dependency — it's never a module-level export. Fixed by removing the bogus import and reading `state` from the factory function's argument (matching every other router).
-
-### Files changed (1)
-
-- `src/server/routes/activity.mjs` — removed `import { state } from '../state.mjs'`; uses `{ state }` from the factory parameter; added defensive 503 if state is missing.
-
-## v3.16.0 — UI overhaul: settings subnav, chat floating input, mods registry browser, provider auto-detect
-
-### Highlights
-
-- **Settings subnav** — sticky horizontal nav with 13 sections (Theme, Layout, General, Service, Tailscale, Notifications, Auth, Agents, Dashboard, Background, Updates, Activity, About). Active section auto-highlights on scroll, click-to-scroll smooth-into-view.
-- **Chat floating input** — composer wrapped in a glass-style sticky bottom box with accent border on focus and a backdrop-blur background. No UX changes other than positioning.
-- **Providers moved into Config** — top-level Providers tab removed (lived in Config already).
-- **Mods registry browser** — collapsible card-grid in the Mods tab. Each card shows name, version with upgrade badge, description, author, homepage, permissions, and an Install button that POSTs `{ id }` to `/api/mods`.
-- **Provider auto-detect banner** — `Config → Providers` now has an AutoDetectBanner that scans env vars + opencode.json for 9 known providers (Anthropic, OpenAI, Google, Mistral, Groq, Cohere, OpenRouter, DeepSeek, MiniMax), validates key formats, optionally probes `/models` with 1.5s timeout, and lets you add configured providers to opencode.json with one click.
-- **`GET /api/providers/auto-detect`** — JSON endpoint mirroring the banner.
-
-### Files changed (8)
-
-- `src/server/providers-store.mjs` — new `KNOWN_PROVIDERS` + `autoDetect({ probe })`.
-- `src/server/routes/providers.mjs` — new `/providers/auto-detect` route.
-- `src/web/App.tsx` — removed Providers from VIEW_MAP.
-- `src/web/components/Topbar.tsx` — removed Providers tab + Cloud icon.
-- `src/web/views/Chat.tsx` — `.chat-input-floating` wrapper.
-- `src/web/views/Config.tsx` — new `AutoDetectBanner` component.
-- `src/web/views/Mods.tsx` — registry browser state + UI.
-- `src/web/views/Settings.tsx` — section IDs + subnav.
-- `src/web/styles/main.css` — ~7 KB of new CSS.
-
-### Test results
-
-- `tsc --noEmit` passes.
-- `bun test tests/mod-security.test.mjs` — 26/26 pass (no regression from v3.15.0).
-
-## v3.15.0 — Activity log overhaul: hide from overview + full log in Settings
+## v4.5.0 — 2026-07-05
 
 ### Highlights
 
-- **Hide from overview** — every Recent Activity card now has an X button to hide
-  it from the Overview feed. Hiding is **non-destructive**: the entry stays in
-  the full activity log, just out of the feed. A persistent "X items hidden"
-  banner with a one-click "Show them again" link surfaces the hidden set.
-- **Hide all / Show all** — two new buttons in the activity header. "Hide all"
-  hides every currently-visible item; "Show all" restores everything.
-- **Settings → Activity Log** — a new full-history card in Settings with a
-  filter box, "show hidden" toggle, restore-one / restore-all actions, and a
-  tabular log (200 rows visible, scroll for more). Backed by
-  `~/.cache/bizar/activity-hidden.json` for persistence.
-- **New REST surface** — `/api/activity` (full log), `/api/activity/hidden`
-  (list), `/api/activity/hide` (POST + DELETE + DELETE/:key).
-
-### Files added (1)
-
-- `src/server/routes/activity.mjs`
-
-### Files changed (4)
-
-- `src/server/api.mjs` — mounts `createActivityRouter({ state })`.
-- `src/web/views/Overview.tsx` — per-item hide button + banner + hide-all.
-- `src/web/views/Settings.tsx` — new `ActivityLogCard` (filter + restore).
-- `src/web/styles/main.css` — `.overview-feed-head-actions`,
-  `.activity-hidden-banner`, `.activity-feed-row-main`, `.activity-feed-hide-btn`,
-  `.activity-log-toolbar`, `.activity-log-table`, etc.
-
-### Test results
-
-- TypeScript: `tsc --noEmit` passes.
-- Mod-security: 26/26 tests still pass (no regression from v3.14.0).
-
-## v3.14.0 — Mod security layer + public mod registry
-
-> **Security + ecosystem:** Mods now run with permission enforcement, integrity verification, and audit logging. New `/api/mods/registry` endpoint fetches the official mod registry from `DrB0rk/bizarre-mods`. Mods repo template + authoring guide added.
-
-### Highlights
-
-- **Mod security layer (`src/server/mod-security.mjs`).** Mods declare permissions in `mod.json`; the loader enforces them at every privileged action:
-  - **Filesystem sandboxing** — mods get scoped `readFileSync` / `writeFileSync` helpers. Paths outside `fs:read:<scope>` / `fs:write:<scope>` throw. Scope syntax: exact path, directory with implicit recursion, `/*` suffix, or `~/` home-relative.
-   - **Subprocess allowlist** — only whitelisted binaries (`bizar`, `opencode`, `python3`, `git`, `node`, `npm`, `pip`, `uv`, `headroom`, `jq`, `graphify`, `pipx`, `opencode-ai`) can be spawned without an explicit `process:spawn:<bin>` permission. Path-style binaries (`/bin/ls`) require explicit permission.
-  - **Integrity hash** — every mod's files are SHA-256-hashed at install time; the hash is stored under `_integrity` in `mod.json`. On every load the hash is recomputed; a mismatch triggers a critical warning and refuses to load the mod's routes until reinstalled.
-  - **Audit log** — every privileged action is logged as JSON lines to `~/.cache/bizar/logs/mod-audit.log` with timestamp, mod id, mod version, action, and details. Inspect via `GET /api/mods/audit?mod=<id>&limit=200`.
-- **Public mod registry.** New `bizarre-mods` repo at `DrB0rk/bizarre-mods` is the canonical source of mods. `GET /api/mods/registry` fetches `registry.json` and annotates each entry with installed state and upgrade hints. `POST /api/mods { id }` installs from the registry.
-- **Mods repo template.** New `templates/mod-template/` shows the canonical mod structure with `mod.json`, `route.mjs`, and `views/registry.json` examples.
-- **Authoring guide.** New `docs/MOD-AUTHORING.md` covers permissions, route file shape, view registration, frontend-component caveats, and the PR submission checklist.
-
-### Files added (3)
-
-- `bizar-dash/src/server/mod-security.mjs` — permission parsing, fs sandbox, subprocess allowlist, integrity hash, audit writer.
-- `bizar-dash/tests/mod-security.test.mjs` — 26 tests covering parsing, sandbox, allowlist, hashing, integrity verification, context creation.
-
-### Files changed (3)
-
-- `bizar-dash/src/server/mods-loader.mjs` — wires the security context into `loadModRouters`, computes and stores the integrity hash in `installFromPath`, exposes `installFromRegistry` and `fetchRegistry`. Mods whose integrity hash mismatches are refused at load time with a critical warning.
-- `bizar-dash/src/server/routes/mods.mjs` — adds `GET /api/mods/registry`, `GET /api/mods/audit`, and a registry-aware install path on `POST /api/mods` (accepts `{ id }` OR `{ path }`).
-- `bizar-dash/src/server/cli.mjs` — reordered `start` vs `--bg`/`--detach` dispatch (fixes `bizar dash start --bg` actually backgrounding).
-
-### Companion repo (separate git repo)
-
-- `bizarre-mods/` — `DrB0rk/bizarre-mods`. Contains `registry.json` listing available mods, `mods/graphify/` (the extracted graphify mod), `templates/mod-template/` (starter), and `docs/MOD-AUTHORING.md` (full guide). Configured as the default registry URL in `mods-loader.mjs:DEFAULT_REGISTRY_URL`.
-
-### Test results
-
-- New: 26 mod-security tests pass.
-- Total: 282 plugin tests + 19 dashboard smoke tests still pass.
-- TypeScript typecheck clean.
-
-### v1 limitations (transparent)
-
-A malicious mod could still bypass the sandbox by importing `node:fs` / `node:child_process` directly. v2 will close this gap with a `vm`-based sandbox or worker-thread isolation. Until then, the security layer makes the mod's *intent* explicit (declared permissions, audit trail, integrity hash) so users can review what they're installing and detect tampering.
-
-## v3.13.0 — 2026-06-25
-
-### Highlights
-
-- **Knowledge-graph view (Graph tab).** New top-bar entry "Graph" with Network icon. Embeds the project's `.bizar/graph/graph.html` (graphify's interactive vis-network visualization) via an iframe. Shows live node/edge/community counts in the header; has a "Build / Rebuild" button that runs `bizar graph build` detached via the new `/api/graph/build` endpoint and polls `/api/graph/build/:jobId/status` until done. The button works offline — no LLM key required, falls through to the AST-cache path that ships with `@polderlabs/bizar` v3.15.0+.
-
-- **`bizar dash start --bg` now actually backgrounds.** Previously the CLI dispatch checked `args.includes('--bg')` AFTER the `args[0] === 'start'` branch, so `bizar dash start --bg` always fell through to the foreground `startDashboard` and blocked. v3.13.0 checks `--bg` inside the `start` branch first and uses `startDashboard({ bg: true })` which returns after writing the PID/PORT files instead of blocking on a signal handler. The launching shell gets immediate control back; the dashboard keeps running in the spawned node process. Same fix for `--detach`.
-
-### Files added (6)
-
-- `bizar-dash/src/server/routes/graph.mjs` — `GET /status`, `GET /html`, `GET /report`, `POST /build`, `GET /build/:jobId/status`. Resolves `.bizar/graph/` from the active project (via `projectsStore.active()`), not from a request-controlled path.
-- `bizar-dash/src/web/views/Graph.tsx` — view with stats header, "Build / Rebuild" button, build-poll loop, empty state for projects without a graph yet, and iframe-based rendering of `graph.html` via `/api/graph/html`.
-
-### Files changed (4)
-
-- `bizar-dash/src/server/api.mjs` — wires `createGraphRouter` into the v1 router.
-- `bizar-dash/src/web/App.tsx` — adds `graph: Graph` to VIEW_MAP.
-- `bizar-dash/src/web/components/Topbar.tsx` — adds `Graph` to TABS (Network icon, between `background` and `skills`).
-- `bizar-dash/src/web/styles/main.css` — `.graph-building-banner`, `.graph-iframe-wrap`, `.graph-iframe`, `.graph-meta`, `.graph-empty-actions` (~60 lines).
-- `bizar-dash/src/cli.mjs` — reordered `start` vs `--bg`/`--detach` dispatch; `startDashboard` accepts `bg` option and returns without blocking when set; added `detachAfterBoot()`.
-
-### Compatibility
-
-- Same wire format as v3.12.x — all existing endpoints unchanged.
-- Requires `@polderlabs/bizar` v3.15.0+ for the `bizar graph build` CLI invoked by the Build button (older versions still work but don't have the offline cache fallback).
-
-## v3.11.0 — 2026-06-23
-
-### Added
-- **Interactive file browser in the Add Project dialog.** New `GET /api/fs?path=<absolute>` endpoint returns a structured listing (`{ path, parent, entries[] }`) for the file picker. Server-side allow-list enforces `os.homedir()` + the configured `dashboard.projectsDirectory`; first-level dotdirs under home (`.ssh`, `.aws`, …) are blocked as roots and silently filtered from listings. All filesystem errors map to structured JSON (`not_found` / `permission_denied` / `not_a_directory` / `forbidden`).
-- **New setting: `dashboard.projectsDirectory`** (string, default `''`). When set, the server will scan it for project roots on startup and the `POST /api/projects/scan` endpoint will rescan on demand. Detection: a directory counts as a project if it contains any of `.git/`, `.bizar/`, `package.json`, `Cargo.toml`, `pyproject.toml`, `go.mod`, `pom.xml`, `build.gradle`, `build.gradle.kts`. One-level scan only — won't recurse into detected projects.
-- **`projectsStore.scanDirectory(rootDir)`** — public method that walks one level deep, stats each marker per child (catching per-file errors), and adds detected projects via the existing `add()` path. Idempotent. Returns `{ added, skipped, scanned, error? }`.
-- **`POST /api/projects/scan`** — validates that the configured `projectsDirectory` lives under home (rejects with `forbidden` otherwise), runs `scanDirectory()`, and broadcasts a `project:change` event with `kind: 'added'` for each newly registered project so connected clients refresh immediately.
+- **Settings page is now the single home for all configuration.** Config tab merged into Settings; restructured with section nav (General, Env Vars, Providers, Memory, System LLM, Updates, Skills, Dashboard). Add a settings search that finds individual settings by name/value and scrolls to them.
+- **Bizar env-var manager.** First-class UI for managing `BIZAR_*` env vars at `~/.config/bizar/env.json` (mode 0600). When configuring any provider or LLM, the user can pick an existing env var OR create a new one — never paste plaintext keys.
+- **Provider subsystem overhaul.** New `PROVIDER_CATALOG` with 13 well-known providers, fuzzy search, single-key auto-add wizard (`POST /api/providers/auto` probes `/v1/models` and fills in baseURL/models/pattern). Backup keys per provider with automatic rotation on auth/quota/rate-limit/429/5xx errors. Key cooldown tracking, status management (active|standby|disabled|cooldown).
+- **LightRAG defaults to free OpenCode Zen models** (`opencode/gpt-5-nano` for LLM, `opencode/text-embedding-3-small` for embeddings). Configurable via `BIZAR_LIGHTRAG_LLM` / `BIZAR_LIGHTRAG_EMBEDDING` env vars.
+- **Memory settings in Settings → Memory.** LightRAG URL, Obsidian vault path, git repo config, sync interval. New `/api/memory/config/global` endpoint persists to `~/.config/bizar/memory-config.json`. `/api/memory/test-git` validates the configured repo.
+- **Usage monitoring and analytics.** New JSONL usage store at `~/.local/share/bizar/usage.jsonl`. Tracks prompt/completion/cached/reasoning tokens, requests, errors, latency per call. New `GET /api/usage?range=24h|7d|30d|custom` returns totals + per-day + per-model + per-key + error breakdowns. MiniMax Usage view rewritten with hand-rolled SVG chart, sortable per-model table, time-range chips, recent-activity feed.
+- **Agents know their limits.** New `getUsageLimitsForAgent(providerId)` returns last-5min + last-24h request/token counts, percent used, time-until-reset. Wired into opencode plugin's prompt context so agents stay aware of quota while working.
+- **Chat overhaul + opencode session fixes.** Fixed "can't open an opencode session" (SSE reconnect + per-session event gating) and "can't create a new session" (Chat.tsx used bare `fetch('/chat/sessions')` which 404'd; now uses `POST /api/opencode-sessions/new`). New `useChat.ts` with SSE reconnect-with-backoff, optimistic-send dedupe, clean unmount lifecycle. `POST/PATCH/DELETE /api/opencode-sessions[/...]` for create/rename/delete. MobileChat.tsx overhaul at mobile size.
+- **Tasks.tsx simplified.** Agent picker removed from task creation; user just types title + description, Odin decides routing and priority. Backlog / Todo / In progress / Done / Failed board with move/retry/edit/delete actions. Submit-to-Odin re-delegates.
+- **Skills tab + toolset refresh.** Skills tab shows Bizar skills (the old code only queried the `skills` CLI which ignored local SKILL.md files). Search output fixed (no more terminal ASCII garbage in titles — old code fell back to text-mode parsing). 11 shipped skills under `bizar-dash/skills/`: bizar, agent-baseline, self-improvement, obsidian, minimax, providers, chat, usage, skills-cli, lightrag, sdk.
+- **Update flow overhaul.** New `/api/updates/{status,check,apply}` endpoints with WS `update:progress` events. `bizar update` gains `--check`, `--channel=stable|beta`, `--no-restart`. Settings → Updates section wired end-to-end.
+- **UI consistency pass.** Standardized spacing tokens (`--spacing-xs/-sm/-md/-lg/-xl`) added to main.css with compact-mode overrides.
+- **CLI.** New `bizar usage [range]` subcommand proxies `/api/usage`.
 
 ### Files
-- `bizar-dash/src/server/routes/fs.mjs` — **new** — `createFsRouter({ state })` factory; `GET /api/fs` handler.
-- `bizar-dash/src/server/lib/path-safe.mjs` — **new** — `resolveSafePath`, `defaultAllowedRoots`, `isDotRoot` helpers shared between `fs.mjs` and the scan route.
-- `bizar-dash/src/server/routes/_shared.mjs` — `DEFAULT_SETTINGS.dashboard` gains `projectsDirectory: ''` (default value is empty so existing installs see no change).
-- `bizar-dash/src/server/routes/projects.mjs` — adds `POST /api/projects/scan`.
-- `bizar-dash/src/server/projects-store.mjs` — adds `PROJECT_ROOT_MARKERS` const + `scanDirectory(rootDir, { maxDepth })` method; adds `node:fs/promises` import.
-- `bizar-dash/src/server/api.mjs` — mounts `createFsRouter` immediately after the projects router.
-- `bizar-dash/src/server/server.mjs` — fires a one-shot `scanDirectory()` on startup when the setting is set; logs added/skipped/scanned counts; never blocks boot.
 
-### Verified
-- `node --check` passes for every modified/new server file.
-- TypeScript (no server-side changes affect frontend types).
-
-### Security hardening
-
-- Added `dashboard.allowedRoots: string[]` setting — operators can
-  declare additional filesystem roots (e.g., `/workspace`,
-  `/srv/projects`) beyond `os.homedir()` for the file browser and
-  project scanner. Each entry must itself be inside home; entries
-  that escape are silently dropped server-side.
-- Added `POST /api/fs/mkdir` to allow creating project directories
-  from the file browser. Parent must be in the allow-list; name is
-  validated against a denylist of unsafe characters; returns 409 if
-  the entry already exists.
-- `GET /api/fs` now caps responses at 500 entries and reports a
-  `truncated` flag plus `totalEntries` so huge directories
-  (`node_modules`, Go module cache) don't OOM the browser.
-- `PUT /api/settings` now validates `dashboard.projectsDirectory`
-  and `dashboard.allowedRoots` server-side, rejecting unsafe values
-  with a structured 400 instead of writing them to disk.
-- **Frontend:** live warnings on the `allowedRoots` textarea mirror the server's validation; pre-flight path check in the Add Project dialog prevents 404s on stale selections.
-
-### Background agent dispatch fix
-
-- Fixed root cause: `pingOpencodeServe` was returning false for a
-  live opencode serve instance because (a) it pings an HTTP
-  endpoint that requires Basic auth and any auth-quirk (stale
-  password file, version mismatch, wrong realm) made the probe
-  fail with 401 even though the opencode process was perfectly
-  healthy and answering other requests, AND (b) `readServeInfo`
-  had a strict 6-field schema that returned `null` when the
-  on-disk `serve.json` only contained `{password, pid, port}` —
-  which is what the current plugin build actually writes. The
-  null then cascaded into `dispatchToBackground` short-circuiting
-  on the `if (serveInfo && serveReachable)` guard at
-  `task-delegator.mjs:563`, marking every new bg instance as
-  `dispatchPending: true` and never creating a tmux session.
-  Now uses a TCP-connect port-open check via
-  `net.createConnection` (so the probe does not depend on HTTP
-  auth or endpoint shape) and the read schema derives `baseUrl`
-  from `port` when missing, with `worktree`/`startedAt`
-  defaulting to empty/`0` rather than failing the read.
-- Fixed path-concatenation fragility for the bg `worktree`
-  fallback: `task-delegator.mjs` now uses `projectRoot` as a
-  fallback for the opencode serve's `?directory=` query param
-  when serve-info omits `worktree`, so spawns succeed even on
-  installs where the plugin has not yet written a full serve.json.
-- Added `lib/path-safe.mjs` helpers (`deriveAbsoluteBgLogPath`,
-  `isBrokenBgLogPath`) that always produce an absolute path
-  (falling back to `~/.cache/bizar/logs/<id>.log`) and detect the
-  `//.opencode/log/...` shape produced when an older plugin build
-  concatenated an empty `worktree` to the logPath.
-- Added a periodic retry loop (`bg-retry.mjs`, every 30s, started
-  by `server.mjs` on boot) that re-runs dispatch for any bg
-  instance stuck in `dispatchPending: true` with
-  `toolCallCount === 0` for more than 30 seconds. Caps each
-  instance at 10 retries before marking it as `failed` with
-  `error: "exceeded max dispatch retries"`. Repairs broken
-  logPath values atomically before re-dispatching.
-- Added `POST /api/background/:id/retry` for manual unstick —
-  resets `retryCount: 0`, `dispatchPending: true`, and calls
-  `retryDispatchOnce` immediately without waiting for the next
-  periodic tick.
+- `bizar-dash/src/web/views/Settings.tsx` — full rewrite
+- `bizar-dash/src/web/views/Config.tsx` — collapsed (Settings is canonical)
+- `bizar-dash/src/web/views/MiniMaxUsage.tsx` — full rewrite (interactive SVG chart, sortable table)
+- `bizar-dash/src/web/views/Chat.tsx` + `MobileChat.tsx` + `hooks/useChat.ts` — overhaul
+- `bizar-dash/src/web/views/Tasks.tsx` — agent picker removed, kanban board
+- `bizar-dash/src/web/views/Skills.tsx` — full rewrite (source tabs, fuzzy search)
+- `bizar-dash/src/server/providers-store.mjs` — backup keys, catalog, rotation
+- `bizar-dash/src/server/routes/{providers,env-vars,usage,update,memory,lightrag,opencode-sessions,opencode-session-detail,config,skills}.mjs` — new + extended endpoints
+- `bizar-dash/src/server/minimax.mjs` — `chatCompletion` records usage
+- `bizar-dash/src/server/minimax-usage-store.mjs` (NEW) — JSONL store
+- `bizar-dash/src/server/skills-store.mjs` — scans local SKILL.md directly
+- `bizar-dash/src/server/serve-info.mjs` — session rename/delete helpers
+- `bizar-dash/src/web/components/{EnvVarManager,SettingsSearch,UsageChart,UsageTable}.tsx` (NEW)
+- `bizar-dash/src/web/styles/{settings,skills,tasks,chat,minimax-usage}.css` — scoped styles
+- `bizar-dash/skills/{bizar,agent-baseline,self-improvement,obsidian,minimax,providers,chat,usage,skills-cli,lightrag,sdk}/SKILL.md` — 11 shipped skills
+- `cli/bin.mjs`, `cli/provision.mjs` — `bizar update` flags + `bizar usage`
+- `config/agents/_shared/SKILLS.md` — skills reference doc
+- `~/.opencode/skills/bizar/` — copy of canonical bizar skill
+
+### Tests
+
+All 200+ tests pass; `npx tsc --noEmit` reports 0 errors in scope.
 
-### Files
-- `bizar-dash/src/server/routes/_shared.mjs` — `DEFAULT_SETTINGS.dashboard` gains `allowedRoots: []`; new `validateDashboardSettings()` + `writeSettings()` now validates before persisting.
-- `bizar-dash/src/server/lib/path-safe.mjs` — new `buildAllowedRootsFromSettings({ settings, home })` helper.
-- `bizar-dash/src/server/routes/fs.mjs` — `POST /api/fs/mkdir`; `GET /api/fs` now caps at 500 entries and reports `truncated` / `totalEntries`; switched to the new `buildAllowedRootsFromSettings` helper.
-- `bizar-dash/src/server/routes/projects.mjs` — `POST /api/projects/scan` uses the expanded allow-list.
-- `bizar-dash/src/server/server.mjs` — startup scan rebuilds and logs the allow-list, re-validates the configured `projectsDirectory`.
+## v3.19.0 — Obsidian vault + browser-harness agent + Plans→Artifacts rename
 
 ## v3.5.4 — 2026-06-19