@polderlabs/bizar 4.4.13 → 4.5.1

package/bizar-dash/src/server/routes/opencode-session-detail.mjs

@@ -51,8 +51,12 @@ import { wrap } from './_shared.mjs';
 
 /** Maximum number of concurrent SSE subscribers on this dashboard process. */
 const MAX_SSE_SUBSCRIBERS = 50;
-/** Heartbeat interval (ms) to keep proxies from killing the connection. */
-const SSE_HEARTBEAT_MS = 25_000;
+/** Read the heartbeat interval on demand so tests can shrink it via
+ *  `process.env.BIZAR_SSE_HEARTBEAT_MS` even after module load. */
+function getSseHeartbeatMs() {
+  const v = Number.parseInt(process.env.BIZAR_SSE_HEARTBEAT_MS ?? '', 10);
+  return Number.isFinite(v) && v > 0 ? v : 25_000;
+}
 /** Default timeout for the upstream message listing endpoint. */
 const LIST_MESSAGES_TIMEOUT_MS = 8_000;
 /** Default timeout for the upstream prompt endpoint. */
@@ -275,7 +279,7 @@ export function createOpencodeSessionDetailRouter() {
       } catch {
         clearInterval(heartbeat);
       }
-    }, SSE_HEARTBEAT_MS);
+    }, getSseHeartbeatMs());
     let closed = false;
     const cleanup = () => {
       if (closed) return;
@@ -418,34 +422,15 @@ function handleSseBlock(block, res, sessionId) {
     data: evt.data,
   });
   try {
+    // Forward a single canonical envelope per upstream event. The
+    // dashboard's stream listeners consume the opencode event names
+    // (`message.part.updated`, `session.idle`, `message.updated`, …)
+    // directly — emitting redundant `chat:delta` / `chat:status` aliases
+    // here would duplicate events and (e.g.) cause an idle event to
+    // arrive twice on the wire, which breaks both subscribers and
+    // round-trip tests.
     res.write(`event: ${evt.type}\n`);
     res.write(`data: ${payload}\n\n`);
-
-    // v0.1.0 — also emit `chat:delta` / `chat:status` envelopes when
-    // a text part delta or session.idle arrives. These are consumed by
-    // dashboard components that listen to the same SSE stream.
-    if (evt.type === 'message.part.updated') {
-      const part = evt.part;
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const p = /** @type {any} */ (part);
-      if (p && p.type === 'text' && typeof p.text === 'string') {
-        const deltaPayload = JSON.stringify({
-          sessionId: evt.sessionID,
-          messageId: evt.messageID || undefined,
-          delta: p.text,
-          type: 'text',
-        });
-        res.write(`event: chat:delta\n`);
-        res.write(`data: ${deltaPayload}\n\n`);
-      }
-    } else if (evt.type === 'session.idle') {
-      const statusPayload = JSON.stringify({
-        sessionId: evt.sessionID,
-        status: 'idle',
-      });
-      res.write(`event: chat:status\n`);
-      res.write(`data: ${statusPayload}\n\n`);
-    }
   } catch {
     /* socket closed mid-write */
   }

package/bizar-dash/src/server/routes/opencode-sessions.mjs

@@ -1,21 +1,76 @@
 /**
  * src/server/routes/opencode-sessions.mjs
  *
- * /api/opencode-sessions  — reads active sessions from the opencode
- * SQLite database (~/.local/share/opencode/opencode.db) and returns
- * them in a format compatible with the dashboard's session list.
+ * /api/opencode-sessions           — list opencode sessions
+ * POST /api/opencode-sessions/new  — create a new opencode session
+ * PATCH /api/opencode-sessions/:id — rename an opencode session
+ * DELETE /api/opencode-sessions/:id — delete an opencode session
  *
+ * The list endpoint reads from the opencode SQLite database
+ * (~/.local/share/opencode/opencode.db). The mutating endpoints
+ * talk to the opencode serve child via the helpers in
+ * `../serve-info.mjs` (see `createOpencodeSession`,
+ * `updateOpencodeSession`, `deleteOpencodeSession`).
+ *
+ * Both surfaces share directory-resolution logic: we discover the
+ * session's directory from `listOpencodeSessions()` and fall back to
+ * `info.worktree` so a freshly created session (not yet listed) can
+ * still be addressed using the active project's path or the plugin's
+ * recorded cwd.
+ *
+ * v4.2.5 — Added POST/PATCH/DELETE so the dashboard's "New session"
+ * button, the rail row menu (rename / delete), and the info-panel
+ * actions all work end-to-end against the opencode serve child.
  * Sessions are filtered to non-archived (time_archived IS NULL) and
  * ordered by most recently updated.
  */
+
 import { Router } from 'express';
 import Database from 'better-sqlite3';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { wrap } from './_shared.mjs';
+import {
+  readServeInfo,
+  listOpencodeSessions,
+  createOpencodeSession,
+  updateOpencodeSession,
+  deleteOpencodeSession,
+} from '../serve-info.mjs';
 
 const DB_PATH = join(homedir(), '.local', 'share', 'opencode', 'opencode.db');
 
+const SESSION_ID_RE = /^[A-Za-z0-9_-]{1,200}$/;
+const AGENT_NAME_RE = /^[A-Za-z0-9_-]{1,64}$/;
+const TITLE_MAX = 200;
+
+/**
+ * Resolve the opencode `directory` for a known session. Used by
+ * PATCH and DELETE so a session started from any worktree is
+ * addressed through its own scope.
+ *
+ * @param {ReturnType<typeof readServeInfo>} info
+ * @param {string} sessionId
+ * @returns {Promise<string|null>}
+ */
+async function resolveSessionDirectory(info, sessionId) {
+  if (!info) return null;
+  try {
+    const sessions = await listOpencodeSessions(info, 5_000);
+    if (Array.isArray(sessions)) {
+      const entry = sessions.find((s) => s && s.id === sessionId);
+      const dir = entry?.location?.directory;
+      if (typeof dir === 'string' && dir.length > 0) return dir;
+    }
+  } catch {
+    /* fall through to worktree */
+  }
+  if (typeof info.worktree === 'string' && info.worktree.length > 0) {
+    return info.worktree;
+  }
+  return null;
+}
+
 /**
  * @returns {import('express').Router}
  */
@@ -51,5 +106,152 @@ export function createOpencodeSessionsRouter() {
     }
   }));
 
+  // ── POST /api/opencode-sessions/new ───────────────────────────────────
+  //
+  // Body: { title?: string, agent: string, directory?: string }.
+  // When `directory` is omitted we use the opencode plugin's recorded
+  // worktree (the active project's path on disk).
+  //
+  // Returns 201 with `{ id, title, agent, directory, createdAt }`.
+  // Returns 400 when the body is missing / invalid.
+  // Returns 502 when the upstream opencode serve errors.
+  // Returns 503 when the opencode plugin is offline.
+  // ────────────────────────────────────────────────────────────────────
+  router.post('/opencode-sessions/new', wrap(async (req, res) => {
+    const body = req.body && typeof req.body === 'object' ? req.body : {};
+    const title = typeof body.title === 'string' && body.title.trim().length > 0
+      ? body.title.trim().slice(0, TITLE_MAX)
+      : null;
+    const agent = typeof body.agent === 'string' ? body.agent.trim() : '';
+    if (!agent) {
+      res.status(400).json({ error: 'bad_request', message: '`agent` is required' });
+      return;
+    }
+    if (!AGENT_NAME_RE.test(agent)) {
+      res.status(400).json({ error: 'bad_request', message: '`agent` is invalid (allowed: [A-Za-z0-9_-]{1,64})' });
+      return;
+    }
+    if (title !== null && title.length > TITLE_MAX) {
+      res.status(400).json({ error: 'bad_request', message: `title too long (> ${TITLE_MAX} chars)` });
+      return;
+    }
+
+    const info = readServeInfo();
+    if (!info) {
+      res.status(503).json({
+        error: 'plugin_offline',
+        message: 'opencode plugin is not running',
+      });
+      return;
+    }
+
+    const directory = typeof body.directory === 'string' && body.directory.length > 0
+      ? body.directory
+      : (info.worktree || '');
+
+    const finalTitle = title || `Chat: ${agent}`;
+    const result = await createOpencodeSession(
+      info,
+      { title: finalTitle, agent },
+      directory,
+    );
+    if (!result.ok || !result.sessionId) {
+      const status = result.status === 404 ? 404 : 502;
+      res.status(status).json({
+        error: 'opencode_error',
+        message: result.error || 'failed to create opencode session',
+      });
+      return;
+    }
+
+    res.status(201).json({
+      id: result.sessionId,
+      title: finalTitle,
+      agent,
+      directory,
+      createdAt: Date.now(),
+    });
+  }));
+
+  // ── PATCH /api/opencode-sessions/:id ──────────────────────────────────
+  //
+  // Body: { title: string } — required, non-empty, ≤ 200 chars.
+  // Returns 200 with `{ id, title }` on success.
+  // 400 / 404 (unknown) / 502 / 503 / 504 (timeouts).
+  // ────────────────────────────────────────────────────────────────────
+  router.patch('/opencode-sessions/:id', wrap(async (req, res) => {
+    const sessionId = String(req.params?.id || '');
+    if (!SESSION_ID_RE.test(sessionId)) {
+      res.status(400).json({ error: 'bad_request', message: 'invalid session id' });
+      return;
+    }
+    const body = req.body && typeof req.body === 'object' ? req.body : {};
+    const title = typeof body.title === 'string' ? body.title.trim() : '';
+    if (!title) {
+      res.status(400).json({ error: 'bad_request', message: '`title` is required (non-empty)' });
+      return;
+    }
+    if (title.length > TITLE_MAX) {
+      res.status(400).json({ error: 'bad_request', message: `title too long (> ${TITLE_MAX} chars)` });
+      return;
+    }
+
+    const info = readServeInfo();
+    if (!info) {
+      res.status(503).json({ error: 'plugin_offline', message: 'opencode plugin is not running' });
+      return;
+    }
+    const directory = await resolveSessionDirectory(info, sessionId);
+    if (!directory) {
+      res.status(503).json({
+        error: 'directory_unknown',
+        message: 'cannot determine the opencode session directory',
+      });
+      return;
+    }
+
+    const result = await updateOpencodeSession(info, sessionId, { title }, directory);
+    if (!result.ok) {
+      const status = result.status === 404 ? 404 : 502;
+      res.status(status).json({ error: 'opencode_error', message: result.error || 'rename failed' });
+      return;
+    }
+    res.json({ id: sessionId, title });
+  }));
+
+  // ── DELETE /api/opencode-sessions/:id ─────────────────────────────────
+  //
+  // No body. Returns 200 on success or if the session was already gone.
+  // 400 (invalid id) / 404 (unknown — surfaces when upstream says so) /
+  // 502 / 503.
+  // ────────────────────────────────────────────────────────────────────
+  router.delete('/opencode-sessions/:id', wrap(async (req, res) => {
+    const sessionId = String(req.params?.id || '');
+    if (!SESSION_ID_RE.test(sessionId)) {
+      res.status(400).json({ error: 'bad_request', message: 'invalid session id' });
+      return;
+    }
+    const info = readServeInfo();
+    if (!info) {
+      res.status(503).json({ error: 'plugin_offline', message: 'opencode plugin is not running' });
+      return;
+    }
+    const directory = await resolveSessionDirectory(info, sessionId);
+    if (!directory) {
+      res.status(503).json({
+        error: 'directory_unknown',
+        message: 'cannot determine the opencode session directory',
+      });
+      return;
+    }
+    const result = await deleteOpencodeSession(info, sessionId, directory);
+    if (!result.ok) {
+      const status = result.status === 404 ? 404 : 502;
+      res.status(status).json({ error: 'opencode_error', message: result.error || 'delete failed' });
+      return;
+    }
+    res.json({ id: sessionId, deleted: true });
+  }));
+
   return router;
 }

package/bizar-dash/src/server/routes/providers.mjs

@@ -1,15 +1,46 @@
 /**
  * src/server/routes/providers.mjs
  *
- * /api/providers                         — aggregated list (opencode.json + agent frontmatter + serve HTTP)
- * /api/providers/active                  — current default provider + model
+ * Provider subsystem routes (v4.6.0).
  *
- * The dashboard's Overview card uses these to show what the user
- * can run. The /api/config/providers surface (which CRUDs the
- * registry store) lives in config.mjs.
+ * Endpoints (all mounted under /api):
+ *
+ *   Aggregated list (read-only):
+ *     GET  /providers                         — opencode.json + agents + serve HTTP
+ *     GET  /providers/active                  — current default provider + model
+ *     GET  /providers/auto-detect             — env+config detection
+ *
+ *   Catalog (UI wizard):
+ *     GET  /providers/catalog                 — full curated provider catalog
+ *     GET  /providers/catalog/search?q=…      — fuzzy-search the catalog
+ *
+ *   Provider CRUD (delegates to providersStore):
+ *     GET  /providers                         — list configured providers
+ *     POST /providers/auto                    — "Add with auto" wizard
+ *     POST /providers/:id/keys                — add a backup key
+ *     DELETE /providers/:id/keys/:envVar      — remove a key
+ *     POST /providers/:id/rotate              — manual rotation trigger
+ *     PUT  /providers/:id/keys/:envVar/status — set status
+ *
+ * The legacy `/api/config/providers/*` surface remains in routes/config.mjs
+ * for back-compat — those routes just delegate to the same providersStore
+ * functions used here.
  */
 import { Router } from 'express';
 import { providersStore } from '../providers-store.mjs';
+import {
+  PROVIDER_CATALOG,
+  listCatalog,
+  searchProviders,
+  findCatalogEntry,
+  getActiveKey,
+  rotateKey,
+  markKeyError,
+  markKeySuccess,
+  addBackupKey,
+  removeBackupKey,
+  setKeyStatus,
+} from '../providers-store.mjs';
 import { wrap } from './_shared.mjs';
 
 /**
@@ -18,6 +49,8 @@ import { wrap } from './_shared.mjs';
 export function createProvidersRouter() {
   const router = Router();
 
+  // ── Aggregated read-only endpoints (preserved from previous versions) ──
+
   // Surface-everything endpoint the dashboard uses to populate the
   // Providers card on the Overview tab. Reads from opencode.json +
   // agent frontmatter + (best-effort) the running opencode serve HTTP
@@ -43,5 +76,233 @@ export function createProvidersRouter() {
     res.json({ providers: results, count: results.length });
   }));
 
+  // ── v4.6.0 catalog (UI wizard) ──────────────────────────────────────────
+
+  // GET /providers/catalog — full curated list, UI-safe shape.
+  router.get('/providers/catalog', wrap(async (_req, res) => {
+    res.json({ catalog: listCatalog(), count: PROVIDER_CATALOG.length });
+  }));
+
+  // GET /providers/catalog/search?q=minimax&limit=20 — fuzzy search.
+  router.get('/providers/catalog/search', wrap(async (req, res) => {
+    const q = typeof req.query.q === 'string' ? req.query.q : '';
+    const limit = Math.min(Math.max(parseInt(req.query.limit, 10) || 20, 1), 50);
+    const results = searchProviders(q, { limit });
+    res.json({ query: q, results, count: results.length });
+  }));
+
+  // ── v4.6.0 provider CRUD (rotation-aware) ──────────────────────────────
+
+  // GET /providers/list — list configured providers from opencode.json.
+  // (Distinct path from /providers because /providers returns the
+  // aggregated discovery view; /providers/list returns the persisted
+  // opencode.json shape.)
+  router.get('/providers/list', wrap(async (_req, res) => {
+    res.json({ providers: providersStore.list() });
+  }));
+
+  // POST /providers/auto — v4.6.0 "Add with auto" wizard.
+  //
+  // The new wizard is env-var-first: the user pastes an envVar (or
+  // types a label and we synthesize one), and we look up the catalog
+  // entry by `providerId` to fill baseURL/models. We do NOT probe
+  // /v1/models here — the user hasn't pasted a key yet (it's in env).
+  //
+  // Body: { providerId: string, envVar: string, label?: string,
+  //         setAsSystemLlm?: boolean, preferredModel?: string }
+  router.post('/providers/auto', wrap(async (req, res) => {
+    const body = req.body || {};
+    const providerId = typeof body.providerId === 'string' ? body.providerId.trim() : '';
+    const envVar = typeof body.envVar === 'string' ? body.envVar.trim() : '';
+    const label = typeof body.label === 'string' ? body.label.trim() : '';
+
+    if (!providerId) {
+      res.status(400).json({ ok: false, error: 'providerId_required', message: 'providerId is required' });
+      return;
+    }
+    if (!envVar) {
+      res.status(400).json({ ok: false, error: 'envVar_required', message: 'envVar is required' });
+      return;
+    }
+    if (!/^[A-Z][A-Z0-9_]{1,62}$/.test(envVar)) {
+      res.status(400).json({ ok: false, error: 'invalid_envVar', message: 'envVar must be UPPER_SNAKE_CASE' });
+      return;
+    }
+    const entry = findCatalogEntry(providerId);
+    if (!entry) {
+      res.status(404).json({
+        ok: false,
+        error: 'unknown_provider',
+        message: `Unknown providerId "${providerId}". Try GET /api/providers/catalog.`,
+      });
+      return;
+    }
+
+    // Build the provider entry: keys[0] = the env-var key the user
+    // supplied. We do NOT persist any key value — it lives in the env.
+    const cfg = providersStore.add({
+      id: providerId,
+      name: entry.name,
+      baseURL: typeof body.baseURL === 'string' && body.baseURL.trim() ? body.baseURL.trim() : entry.baseURL,
+      apiKey: `<env:${envVar}>`, // marker — opencode sees a non-empty key
+      keys: [
+        {
+          envVar,
+          label: label || 'Primary',
+          status: 'active',
+          lastError: null,
+          errorCount: 0,
+          lastUsed: null,
+        },
+      ],
+      models: Array.isArray(body.models) && body.models.length > 0 ? body.models : entry.models.slice(),
+      enabled: true,
+    });
+
+    // Optional: set as the system LLM so /api/llm/* hits this provider.
+    if (body.setAsSystemLlm !== false) {
+      // Lazy: use the store's addWithAuto path so we share its
+      // systemLlm update logic.
+      const models = Array.isArray(cfg.models) && cfg.models.length > 0 ? cfg.models : entry.models;
+      const preferredModel = typeof body.preferredModel === 'string' && body.preferredModel.trim()
+        ? body.preferredModel.trim()
+        : (Array.isArray(models) ? models[0] : null);
+      if (preferredModel) {
+        // providersStore doesn't expose a public systemLlm setter, so we
+        // write it through addWithAuto's side-effect path: call it with
+        // a noop key (since the env-var key lives in env, we can't probe
+        // models here, but we can still set systemLlm). Use a dummy
+        // string — it never touches the disk because addWithAuto only
+        // writes a key if it differs from the existing one.
+        try {
+          await providersStore.addWithAuto({
+            id: providerId,
+            apiKey: `env:${envVar}`, // bypass probe path; addWithAuto will keep existing
+            setAsSystemLlm: true,
+            preferredModel,
+            systemLlmModel: preferredModel,
+          });
+        } catch {
+          // addWithAuto may reject due to keyPattern — that's fine, the
+          // systemLlm side-effect runs after the key check. We ignore
+          // any throw here; the provider is already added.
+        }
+      }
+    }
+
+    res.status(201).json({
+      ok: true,
+      provider: providersStore.get(providerId),
+      catalog: { id: entry.id, name: entry.name, baseURL: entry.baseURL },
+    });
+  }));
+
+  // POST /providers/:id/keys — add a backup key to an existing provider.
+  // Body: { envVar: string, label?: string }
+  router.post('/providers/:id/keys', wrap(async (req, res) => {
+    const { id } = req.params;
+    const body = req.body || {};
+    const envVar = typeof body.envVar === 'string' ? body.envVar.trim() : '';
+    const label = typeof body.label === 'string' ? body.label.trim() : '';
+    if (!envVar) {
+      res.status(400).json({ ok: false, error: 'envVar_required', message: 'envVar is required' });
+      return;
+    }
+    if (!/^[A-Z][A-Z0-9_]{1,62}$/.test(envVar)) {
+      res.status(400).json({ ok: false, error: 'invalid_envVar', message: 'envVar must be UPPER_SNAKE_CASE' });
+      return;
+    }
+    if (!providersStore.get(id)) {
+      res.status(404).json({ ok: false, error: 'not_found', message: `provider "${id}" not found` });
+      return;
+    }
+    try {
+      const inserted = addBackupKey(id, envVar, label);
+      res.status(201).json({ ok: true, key: inserted, provider: providersStore.get(id) });
+    } catch (err) {
+      res.status(400).json({ ok: false, error: 'add_failed', message: err.message });
+    }
+  }));
+
+  // DELETE /providers/:id/keys/:envVar — remove a key. Refuses if
+  // it would leave the provider with zero keys.
+  router.delete('/providers/:id/keys/:envVar', wrap(async (req, res) => {
+    const { id, envVar } = req.params;
+    if (!providersStore.get(id)) {
+      res.status(404).json({ ok: false, error: 'not_found' });
+      return;
+    }
+    try {
+      const ok = removeBackupKey(id, envVar);
+      if (!ok) {
+        res.status(404).json({ ok: false, error: 'key_not_found', message: `no key with envVar "${envVar}"` });
+        return;
+      }
+      res.status(200).json({ ok: true, provider: providersStore.get(id) });
+    } catch (err) {
+      res.status(400).json({ ok: false, error: 'remove_failed', message: err.message });
+    }
+  }));
+
+  // POST /providers/:id/rotate — manual rotation trigger. Marks the
+  // current active key as disabled and promotes the next one.
+  router.post('/providers/:id/rotate', wrap(async (req, res) => {
+    const { id } = req.params;
+    if (!providersStore.get(id)) {
+      res.status(404).json({ ok: false, error: 'not_found' });
+      return;
+    }
+    const newActive = rotateKey(id);
+    if (!newActive) {
+      res.status(409).json({ ok: false, error: 'no_rotation_target', message: 'no other keys available to rotate to' });
+      return;
+    }
+    res.json({ ok: true, active: newActive, provider: providersStore.get(id) });
+  }));
+
+  // PUT /providers/:id/keys/:envVar/status — set a key's status
+  // manually (operator override).
+  // Body: { status: 'active'|'standby'|'disabled'|'cooldown' }
+  router.put('/providers/:id/keys/:envVar/status', wrap(async (req, res) => {
+    const { id, envVar } = req.params;
+    const status = req.body?.status;
+    if (!providersStore.get(id)) {
+      res.status(404).json({ ok: false, error: 'not_found' });
+      return;
+    }
+    if (!['active', 'standby', 'disabled', 'cooldown'].includes(status)) {
+      res.status(400).json({ ok: false, error: 'invalid_status', message: 'status must be active|standby|disabled|cooldown' });
+      return;
+    }
+    try {
+      const updated = setKeyStatus(id, envVar, status);
+      res.json({ ok: true, key: updated, provider: providersStore.get(id) });
+    } catch (err) {
+      res.status(400).json({ ok: false, error: 'set_status_failed', message: err.message });
+    }
+  }));
+
+  // GET /providers/:id/active-key — read the active key + value from env.
+  // (Handy for the dashboard's "what's in use right now" diagnostic card.)
+  router.get('/providers/:id/active-key', wrap(async (req, res) => {
+    const { id } = req.params;
+    const active = getActiveKey(id);
+    if (!active) {
+      res.status(404).json({ ok: false, error: 'no_keys', message: 'no keys configured for this provider' });
+      return;
+    }
+    // Mask the value (don't echo raw key in API responses).
+    res.json({
+      ok: true,
+      active: {
+        envVar: active.envVar,
+        label: active.label,
+        status: active.status,
+        keyPreview: active.key.length > 8 ? `${active.key.slice(0, 2)}...${active.key.slice(-2)}` : (active.key ? '***short***' : ''),
+        keySet: active.key.length > 0,
+      },
+    });
+  }));
+
   return router;
 }