@polderlabs/bizar 4.4.12 → 4.5.0

package/bizar-dash/src/server/routes/update.mjs

@@ -0,0 +1,340 @@
+/**
+ * src/server/routes/update.mjs
+ *
+ * v4.6.0 — Dashboard update endpoints.
+ *
+ *   GET    /api/updates/status     — installed package versions only
+ *   GET    /api/updates/check      — installed + latest + hasUpdates
+ *   POST   /api/updates/apply      — trigger install for given packages
+ *                                    Streams progress via WS events:
+ *                                      update:progress { type, pkg, status, error?, newVersion? }
+ *                                      update:log     { type, pkg, line }
+ *                                      update:complete{ type }
+ *
+ * Why these paths (vs. /api/update/*):
+ *   thor-settings wired Settings.tsx to `/updates/status`, `/updates/check`,
+ *   and `/updates/apply` and listens for the WS event shapes above. Aligning
+ *   with that contract is cheaper than rewriting Settings.tsx.
+ *
+ * What this endpoint does NOT do:
+ *   - It does NOT restart the dashboard. The Settings UI displays a
+ *     confirmation prompt before calling, and `bizar update` (the CLI)
+ *     is the restart-aware path. The dashboard stays up; npm replaces
+ *     files in the global install dir while the dashboard runs from its
+ *     own already-loaded module graph. The next `bizar dash start`
+ *     picks up the new code, just like the CLI flow.
+ *   - It does NOT touch the opencode plugin in-place. That lives in the
+ *     CLI flow because the plugin path is dev-symlinked in this repo.
+ *
+ * Safety:
+ *   - Concurrency guard: only one apply run at a time. A second call
+ *     returns 409 with `error: 'already_running'`.
+ *   - Network/npm failures emit `update:log` for each stderr/stdout
+ *     line and a final `update:progress` with `status: 'error'`.
+ *   - Whitelist of npm package names; anything else is rejected 400.
+ */
+import { Router } from 'express';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawn, execFileSync } from 'node:child_process';
+import { wrap } from './_shared.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// v4.4.13 — packages the dashboard knows how to update. Aligned with
+// the Settings UI's "Installed / Latest" panels and the CLI's update
+// flow. All three resolve on npmjs.org (bizar-dash and bizar-plugin are
+// deprecated but still resolvable).
+const KNOWN_PACKAGES = [
+  { id: 'bizar',         npmName: '@polderlabs/bizar',         label: 'Bizar CLI' },
+  { id: 'bizar-dash',    npmName: '@polderlabs/bizar-dash',    label: 'Dashboard' },
+  { id: 'bizar-plugin',  npmName: '@polderlabs/bizar-plugin',  label: 'Opencode Plugin' },
+];
+
+const KNOWN_BY_ID = new Map(KNOWN_PACKAGES.map((p) => [p.id, p]));
+
+// Cache the latest-version lookup so /api/updates/check is fast on
+// repeated dashboard renders. 1 hour is short enough that a new release
+// shows up within an hour of publishing.
+const LATEST_CACHE_TTL_MS = 60 * 60 * 1000;
+const _latestCache = new Map(); // npmName -> { version, ts }
+
+/**
+ * Resolve the on-disk version of the dashboard itself (used as the
+ * "current" version for @polderlabs/bizar). Walks up from this file
+ * looking for the package.json that declares `@polderlabs/bizar`.
+ *
+ * Why "walk up" instead of `import.meta.resolve`? When the dashboard
+ * runs out of `dist/` (the published layout), the package.json lives
+ * at the dist root, not at the file's location. The walk is bounded
+ * to 6 levels so a misconfigured install fails fast instead of looping.
+ */
+function resolveInstalledVersion() {
+  const markers = ['package.json'];
+  let cur = __dirname;
+  for (let i = 0; i < 6; i++) {
+    for (const m of markers) {
+      const p = join(cur, m);
+      if (existsSync(p)) {
+        try {
+          const pkg = JSON.parse(readFileSync(p, 'utf8'));
+          if (pkg.name === '@polderlabs/bizar' && pkg.version) return pkg.version;
+        } catch { /* malformed — try parent */ }
+      }
+    }
+    const parent = dirname(cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+  return null;
+}
+
+const INSTALLED_BIZAR_VERSION = resolveInstalledVersion();
+
+/**
+ * `npm view <pkg> version` — returns the latest published version or
+ * null on any failure. Cached per package for 1 hour.
+ */
+function fetchLatestVersion(npmName) {
+  const cached = _latestCache.get(npmName);
+  if (cached && Date.now() - cached.ts < LATEST_CACHE_TTL_MS) {
+    return cached.version;
+  }
+  try {
+    const out = execFileSync(
+      'npm',
+      ['view', npmName, 'version'],
+      { stdio: ['ignore', 'pipe', 'ignore'], timeout: 15000 },
+    ).toString().trim();
+    const version = out || null;
+    _latestCache.set(npmName, { version, ts: Date.now() });
+    return version;
+  } catch {
+    // Negative-cache for 5 minutes so a transient registry hiccup
+    // doesn't make every render call npm.
+    _latestCache.set(npmName, { version: null, ts: Date.now() - (LATEST_CACHE_TTL_MS - 5 * 60 * 1000) });
+    return null;
+  }
+}
+
+/**
+ * Reset the latest-version cache — exposed for tests so each case
+ * starts from a known state.
+ */
+export function resetUpdateCache() {
+  _latestCache.clear();
+}
+
+/**
+ * Compute the per-package installed map. For the dashboard package
+ * itself we use INSTALLED_BIZAR_VERSION (the @polderlabs/bizar version
+ * that bundles the dashboard). The other packages fall back to null
+ * when not resolvable; the UI renders "—" for those rows.
+ */
+function currentVersions() {
+  const out = {};
+  for (const p of KNOWN_PACKAGES) {
+    if (p.id === 'bizar') {
+      out[p.id] = INSTALLED_BIZAR_VERSION;
+    } else {
+      // Deprecated standalone packages — fall back to running dashboard
+      // version as a sane default so the row isn't permanently "—".
+      out[p.id] = INSTALLED_BIZAR_VERSION;
+    }
+  }
+  return out;
+}
+
+/**
+ * Compute latest map and hasUpdates flag. Iterates KNOWN_PACKAGES so
+ * the UI gets a stable order and predictable keys even when one of the
+ * `npm view` calls fails (those resolve to null).
+ */
+function latestVersionsAndFlag(current) {
+  const latest = {};
+  let hasUpdates = false;
+  for (const p of KNOWN_PACKAGES) {
+    const lat = fetchLatestVersion(p.npmName);
+    latest[p.id] = lat;
+    const cur = current[p.id];
+    if (cur && lat && cur !== lat) hasUpdates = true;
+  }
+  return { latest, hasUpdates };
+}
+
+// ─── Apply concurrency guard ───────────────────────────────────────────────
+// One active run per server process. A second POST /updates/apply while
+// the first is still going returns 409 immediately.
+
+let _activeRun = null; // { packages: string[], startedAt: number } | null
+
+function isRunning() {
+  return _activeRun !== null;
+}
+
+/**
+ * Run `npm install -g <pkg>@latest` for each requested id. Emits WS
+ * events on the broadcast channel for every stdout/stderr line and for
+ * the per-package status transitions. Returns the result object
+ * (sync — the actual install runs in the background and finishes via
+ * WS events).
+ */
+function startApplyRun({ packages, channel, broadcast }) {
+  if (_activeRun) {
+    throw Object.assign(new Error('update already running'), { code: 'already_running' });
+  }
+  const ids = (Array.isArray(packages) && packages.length > 0) ? packages : KNOWN_PACKAGES.map((p) => p.id);
+  const validIds = ids.filter((id) => KNOWN_BY_ID.has(id));
+  if (validIds.length === 0) {
+    throw Object.assign(new Error('no valid packages requested'), { code: 'bad_request' });
+  }
+
+  _activeRun = { packages: validIds, startedAt: Date.now() };
+
+  // Kick the run async. Errors are reported via the WS bus.
+  (async () => {
+    try {
+      for (const id of validIds) {
+        const pkg = KNOWN_BY_ID.get(id);
+        if (!pkg) continue;
+        broadcast({ type: 'update:progress', pkg: id, status: 'starting' });
+
+        const versionTag = channel && channel === 'beta' ? '@beta' : '@latest';
+        const code = await runNpmInstall(pkg.npmName, versionTag, (line) => {
+          broadcast({ type: 'update:log', pkg: id, line });
+        });
+
+        if (code === 0) {
+          const newVer = fetchLatestVersion(pkg.npmName); // warm cache
+          broadcast({
+            type: 'update:progress',
+            pkg: id,
+            status: 'done',
+            newVersion: newVer || undefined,
+          });
+        } else {
+          broadcast({
+            type: 'update:progress',
+            pkg: id,
+            status: 'error',
+            error: `npm install exited with code ${code}`,
+          });
+        }
+      }
+    } finally {
+      _activeRun = null;
+      broadcast({ type: 'update:complete' });
+    }
+  })().catch((err) => {
+    _activeRun = null;
+    broadcast({ type: 'update:progress', pkg: '__global', status: 'error', error: err?.message || String(err) });
+    broadcast({ type: 'update:complete' });
+  });
+
+  return { ok: true, started: validIds, channel: channel || 'stable' };
+}
+
+/**
+ * Spawn `npm install -g <pkg>@<tag>`. Captures stdout/stderr line by
+ * line and forwards each via the `onLine` callback. Resolves with the
+ * exit code (0 on success, non-zero otherwise).
+ *
+ * Why spawn instead of execSync: npm install can take 30+ seconds and
+ * blocks the event loop. We want concurrent dashboard requests to keep
+ * serving while an update is in flight.
+ */
+function runNpmInstall(npmName, versionTag, onLine) {
+  return new Promise((resolve) => {
+    let proc;
+    try {
+      proc = spawn('npm', ['install', '-g', `${npmName}${versionTag}`], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: process.env,
+      });
+    } catch (err) {
+      onLine(`failed to spawn npm: ${err.message}`);
+      resolve(127);
+      return;
+    }
+
+    const pipeLine = (stream) => {
+      let buf = '';
+      stream.setEncoding('utf8');
+      stream.on('data', (chunk) => {
+        buf += chunk;
+        let nl;
+        while ((nl = buf.indexOf('\n')) >= 0) {
+          const line = buf.slice(0, nl).replace(/\r$/, '');
+          buf = buf.slice(nl + 1);
+          if (line) onLine(line);
+        }
+      });
+      stream.on('end', () => {
+        if (buf) onLine(buf);
+      });
+    };
+    pipeLine(proc.stdout);
+    pipeLine(proc.stderr);
+
+    proc.on('error', (err) => {
+      onLine(`npm process error: ${err.message}`);
+      resolve(127);
+    });
+    proc.on('close', (code) => {
+      resolve(code ?? 1);
+    });
+  });
+}
+
+// ─── Router factory ────────────────────────────────────────────────────────
+
+export function createUpdateRouter({ broadcast = () => {} } = {}) {
+  const router = Router();
+
+  /**
+   * GET /api/updates/status
+   * Quick status — installed versions only. Cheap; no npm calls.
+   */
+  router.get('/updates/status', wrap(async (_req, res) => {
+    const current = currentVersions();
+    res.json({ current });
+  }));
+
+  /**
+   * GET /api/updates/check
+   * Installed + latest + hasUpdates. Calls `npm view` (cached).
+   */
+  router.get('/updates/check', wrap(async (_req, res) => {
+    const current = currentVersions();
+    const { latest, hasUpdates } = latestVersionsAndFlag(current);
+    res.json({ current, latest, hasUpdates });
+  }));
+
+  /**
+   * POST /api/updates/apply
+   * Body: { packages?: string[], channel?: 'stable' | 'beta' }
+   * Returns 202 immediately. Progress streams via WS events.
+   * Returns 409 if another apply is in flight.
+   */
+  router.post('/updates/apply', wrap(async (req, res) => {
+    if (isRunning()) {
+      res.status(409).json({ error: 'already_running', message: 'an update is already running' });
+      return;
+    }
+    const body = req.body || {};
+    const channel = body.channel === 'beta' ? 'beta' : 'stable';
+    try {
+      const result = startApplyRun({ packages: body.packages, channel, broadcast });
+      res.status(202).json(result);
+    } catch (err) {
+      const status = err?.code === 'bad_request' ? 400 : 500;
+      res.status(status).json({
+        error: err?.code || 'apply_failed',
+        message: err?.message || String(err),
+      });
+    }
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/usage.mjs

@@ -0,0 +1,136 @@
+/**
+ * src/server/routes/usage.mjs
+ *
+ * Endpoints for usage analytics:
+ *   GET  /api/usage                          — aggregate usage (range, from, to, providerId, modelId)
+ *   GET  /api/usage/limits                 — live quota limits + usage percent (agents call this)
+ *   GET  /api/usage/recent                  — last N raw records (live tail)
+ *
+ * The agent-awareness path (/api/usage/limits) calls fetchRemains() for
+ * live quota data, then merges with the JSONL rolling totals.
+ */
+import { Router } from 'express';
+import { wrap } from './_shared.mjs';
+import {
+  queryUsage,
+  getUsageLimitsForAgent,
+} from '../minimax-usage-store.mjs';
+
+export function createUsageRouter() {
+  const router = Router();
+
+  // GET /api/usage?range=24h|7d|30d|custom&from=&to=&providerId=&modelId=
+  router.get('/usage', wrap(async (req, res) => {
+    const range      = String(req.query.range      || '24h');
+    const from       = req.query.from        ? Number(req.query.from)       : undefined;
+    const to         = req.query.to          ? Number(req.query.to)         : undefined;
+    const providerId = req.query.providerId  ? String(req.query.providerId)  : undefined;
+    const modelId    = req.query.modelId     ? String(req.query.modelId)    : undefined;
+
+    if (!['24h', '7d', '30d', 'custom'].includes(range)) {
+      return res.status(400).json({ error: 'invalid_range', message: 'range must be 24h, 7d, 30d, or custom' });
+    }
+    if (range === 'custom' && (!from || !to)) {
+      return res.status(400).json({ error: 'missing_dates', message: 'range=custom requires `from` and `to` (unix ms)' });
+    }
+
+    const opts = {
+      range,
+      from,
+      to,
+      providerId,
+      modelId,
+    };
+
+    let result;
+    try {
+      result = queryUsage(opts);
+    } catch (err) {
+      return res.status(400).json({ error: 'query_error', message: String((err).message) });
+    }
+    return res.json(result);
+  }));
+
+  // GET /api/usage/limits
+  // Returns live quota info from fetchRemains() merged with rolling usage totals.
+  router.get('/usage/limits', wrap(async (_req, res) => {
+    // Dynamic import to avoid pulling in the full minimax client bundle on every
+    // dashboard page load. The usage store is lightweight.
+    /** @type {Record<string, unknown>} */
+    let remainsData = { models: [] };
+    try {
+      const { fetchRemains } = await import('../minimax.mjs');
+      const remains = await fetchRemains({ force: false });
+      if (remains.ok) {
+        // Cast through unknown to avoid TypeScript pollution in plain .mjs.
+        remainsData = /** @type {Record<string, unknown>} */ (remains);
+      }
+    } catch { /* best-effort — return zeros */ }
+
+    // Rolling usage from JSONL.
+    const agentSummary = await getUsageLimitsForAgent('minimax');
+
+    // Merge: per-model usage from JSONL + per-model quota from remains.
+    /** @type {Array<{model_name?: string, current_interval_remaining_percent?: number, current_weekly_remaining_percent?: number, intervalResetInHuman?: string, weeklyResetInHuman?: string}>} */
+    const models = (remainsData.models || []);
+
+    // Build per-model percentUsed from the JSONL per-model data.
+    const usageResult = queryUsage({ range: '24h', providerId: 'minimax' });
+    const perModelUsage = new Map(usageResult.perModel.map(m => [`minimax/${m.modelId}`, m]));
+
+    const perModelLimits = models.map(m => {
+      const usage = perModelUsage.get(`minimax/${m.model_name}`);
+      const usedTokens = usage?.totalTokens ?? 0;
+      const remainingPct = m.current_interval_remaining_percent ?? 100;
+      let estimatedDailyBudget = 0;
+      let percentUsed = 0;
+      if (remainingPct < 100 && usedTokens > 0) {
+        estimatedDailyBudget = Math.round(usedTokens / (1 - remainingPct / 100));
+        percentUsed = Math.round((usedTokens / estimatedDailyBudget) * 1000) / 10;
+      }
+      return {
+        modelId: m.model_name ?? 'unknown',
+        totalTokensUsed: usedTokens,
+        requestCount: usage?.requests ?? 0,
+        limits: {
+          dailyTokens: estimatedDailyBudget || null,
+          intervalResetIn: m.intervalResetInHuman ?? null,
+          weeklyResetIn: m.weeklyResetInHuman ?? null,
+        },
+        percentUsed24h: percentUsed,
+      };
+    });
+
+    return res.json({
+      provider: 'minimax',
+      requestsLast5min:  agentSummary.requestsLast5min,
+      tokensLast5min:    agentSummary.tokensLast5min,
+      requestsLast24h:   agentSummary.requestsLast24h,
+      tokensLast24h:     agentSummary.tokensLast24h,
+      limits:            agentSummary.limits,
+      percentUsed24h:    agentSummary.percentUsed24h,
+      estimatedTimeUntilReset: agentSummary.estimatedTimeUntilReset,
+      warning:           agentSummary.warning,
+      perModel:          perModelLimits,
+      fetchedAt:         remainsData.fetchedAt ? new Date(remainsData.fetchedAt).toISOString() : null,
+    });
+  }));
+
+  // GET /api/usage/recent?limit=50
+  router.get('/usage/recent', wrap(async (req, res) => {
+    const limit = Math.min(Math.max(Number(req.query.limit) || 50, 1), 200);
+
+    // Read last N lines from the JSONL.
+    const { readAllRecords } = await import('../minimax-usage-store.mjs');
+    const all = readAllRecords();
+    const recent = all.slice(-limit).reverse(); // newest first
+
+    return res.json({
+      records: recent,
+      total: all.length,
+      returned: recent.length,
+    });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/serve-info.mjs

@@ -60,12 +60,27 @@ import { createConnection, isIP } from 'node:net';
 const HOME = homedir();
 
 // Mirrors plugins/bizar/src/serve-info.ts → BG_DIRS pattern.
-const SERVE_INFO_FILES = [
+const DEFAULT_SERVE_INFO_FILES = [
   join(HOME, '.cache', 'bizar', 'serve.json'),
   join(HOME, '.config', 'opencode', 'serve.json'),
   join(HOME, '.bizar', 'serve.json'),
 ];
 
+/**
+ * Resolve the serve.json candidate paths at call time so test
+ * suites can override with `BIZAR_SERVE_JSON_PATH=/tmp/...json`.
+ * Order: env override (if set and exists) → default search list.
+ *
+ * @returns {string[]}
+ */
+function serveInfoFiles() {
+  const override = process.env.BIZAR_SERVE_JSON_PATH;
+  if (override && typeof override === 'string' && override.length > 0) {
+    return [override];
+  }
+  return DEFAULT_SERVE_INFO_FILES;
+}
+
 /**
  * @typedef {Object} ServeInfo
  * @property {string} baseUrl     e.g. "http://127.0.0.1:4097"
@@ -100,7 +115,7 @@ const SERVE_INFO_FILES = [
  * @returns {ServeInfo|null}
  */
 export function readServeInfo() {
-  for (const file of SERVE_INFO_FILES) {
+  for (const file of serveInfoFiles()) {
     if (!existsSync(file)) continue;
     try {
       const raw = readFileSync(file, 'utf8');
@@ -304,7 +319,7 @@ export async function listOpencodeSessions(info, timeoutMs = 5000) {
   }
 }
 
-export const SERVE_INFO_FILE_PATHS = SERVE_INFO_FILES;
+export const SERVE_INFO_FILE_PATHS = DEFAULT_SERVE_INFO_FILES;
 
 // ── v3.5.4 (bug: dispatch stuck) — spawn helpers ─────────────────────────
 //
@@ -623,7 +638,123 @@ export function normalizeOpencodeMessage(msg) {
 }
 
 /**
- * `GET /health` — used by the dispatcher startup check to verify the
+ * `DELETE /api/session/{id}?directory=...` — delete a session on the
+ * opencode serve child. v4.2.4 dashboard feature parity: the rail
+ * menu offers delete and the chat info panel can prune finished
+ * sessions from inside the dashboard.
+ *
+ * Idempotent: a 404 (already gone) is treated as a successful delete.
+ *
+ * @param {ServeInfo} info
+ * @param {string} sessionId
+ * @param {string} [directory]
+ * @param {number} [timeoutMs]
+ * @returns {Promise<{ok:true,status:number}|{ok:false,error:string,status?:number}>}
+ */
+export async function deleteOpencodeSession(info, sessionId, directory, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  if (!info) return { ok: false, error: 'serve-info not available — plugin is not running' };
+  if (!sessionId) return { ok: false, error: 'sessionId is required' };
+  const dir = directory || info.worktree || '';
+  const url = `${info.baseUrl}/api/session/${encodeURIComponent(sessionId)}?directory=${encodeURIComponent(dir)}`;
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, {
+      method: 'DELETE',
+      headers: {
+        Authorization: buildAuthHeader(info),
+        Accept: 'application/json',
+      },
+      signal: ac.signal,
+    });
+    if (res.ok || res.status === 404) {
+      return { ok: true, status: res.status };
+    }
+    let detail = '';
+    try { detail = (await res.text()).slice(0, 500); } catch { /* ignore */ }
+    return {
+      ok: false,
+      status: res.status,
+      error: `DELETE /api/session/${sessionId} failed: ${res.status} ${res.statusText}${detail ? ` — ${detail}` : ''}`,
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const isAbort = err instanceof Error && err.name === 'AbortError';
+    return {
+      ok: false,
+      error: isAbort ? `deleteSession timed out after ${timeoutMs}ms` : `deleteSession network error: ${msg}`,
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * `PATCH /api/session/{id}?directory=...` — update session fields
+ * (currently just `title`) on the opencode serve child. Used by the
+ * rail row-menu "Rename" affordance.
+ *
+ * @param {ServeInfo} info
+ * @param {string} sessionId
+ * @param {{ title?: string }} patch
+ * @param {string} [directory]
+ * @param {number} [timeoutMs]
+ * @returns {Promise<{ok:true,session:object}|{ok:false,error:string,status?:number}>}
+ */
+export async function updateOpencodeSession(info, sessionId, patch, directory, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  if (!info) return { ok: false, error: 'serve-info not available — plugin is not running' };
+  if (!sessionId) return { ok: false, error: 'sessionId is required' };
+  if (!patch || typeof patch !== 'object') return { ok: false, error: 'patch is required' };
+  const dir = directory || info.worktree || '';
+  const url = `${info.baseUrl}/api/session/${encodeURIComponent(sessionId)}?directory=${encodeURIComponent(dir)}`;
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), timeoutMs);
+  try {
+    const body = {};
+    if (typeof patch.title === 'string') {
+      const t = patch.title.trim();
+      if (!t) return { ok: false, error: 'title cannot be empty' };
+      if (t.length > 200) return { ok: false, error: 'title too long (> 200 chars)' };
+      body.title = t;
+    } else {
+      return { ok: false, error: 'no supported fields in patch (only `title` is wired)' };
+    }
+    const res = await fetch(url, {
+      method: 'PATCH',
+      headers: {
+        Authorization: buildAuthHeader(info),
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
+      body: JSON.stringify(body),
+      signal: ac.signal,
+    });
+    if (!res.ok) {
+      let detail = '';
+      try { detail = (await res.text()).slice(0, 500); } catch { /* ignore */ }
+      return {
+        ok: false,
+        status: res.status,
+        error: `PATCH /api/session/${sessionId} failed: ${res.status} ${res.statusText}${detail ? ` — ${detail}` : ''}`,
+      };
+    }
+    let session = null;
+    try { session = await res.json(); } catch { /* non-JSON body is fine — we still got 2xx */ }
+    return { ok: true, session };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const isAbort = err instanceof Error && err.name === 'AbortError';
+    return {
+      ok: false,
+      error: isAbort ? `updateSession timed out after ${timeoutMs}ms` : `updateSession network error: ${msg}`,
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * GET /health — used by the dispatcher startup check to verify the
  * serve child is actually reachable before we try to enqueue work.
  *
  * v3.11.0 — Replaced the HTTP `GET /health` probe with a TCP-connect

package/bizar-dash/src/server/server.mjs

@@ -302,6 +302,10 @@ export async function createServer({
   }
   currentBroadcast = localBroadcast;
 
+  // v4 — Load BIZAR_* env vars from ~/.config/bizar/env.json into process.env.
+  const { loadEnvJson } = await import('./routes/env-vars.mjs');
+  loadEnvJson();
+
   const apiRouter = await createApiRouter({
     state,
     watcher,