@polderlabs/bizar 4.4.13 → 4.5.1

package/bizar-dash/tests/chat-session-stream.test.mjs

@@ -0,0 +1,308 @@
+/**
+ * tests/chat-session-stream.test.mjs — v4.2.5
+ *
+ * End-to-end tests for the opencode SSE streaming endpoints. The
+ * opencode-session-detail router proxies the upstream
+ * `/event?directory=...` stream and forwards one canonical
+ * envelope per upstream event, filtered by `sessionID`.
+ *
+ * Tests cover three guarantees:
+ *
+ *   1. `message.updated` events for the right session are forwarded,
+ *      and events for other sessions are dropped.
+ *   2. Sync envelopes (the v2 wire format) are unwrapped: the inner
+ *      `syncEvent.type` with version suffix (`.<n>`) becomes the
+ *      canonical event name on the dashboard-side SSE stream.
+ *   3. The proxy emits a heartbeat (`: keepalive`) within the
+ *      configured SSE_HEARTBEAT_MS (default 25s — we set it to 250ms
+ *      via env override so the test runs in well under a second).
+ *
+ * Strategy: stand up a fake opencode serve child on a random port,
+ * point readServeInfo() at it. The fake emits three events then
+ * holds the connection open long enough for the heartbeat to land.
+ */
+
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  mkdtempSync,
+  writeFileSync,
+  rmSync,
+  existsSync,
+  copyFileSync,
+  unlinkSync,
+  readFileSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { createServer } from 'node:http';
+import express from 'express';
+
+import { createOpencodeSessionDetailRouter } from '../src/server/routes/opencode-session-detail.mjs';
+
+// ── fake upstream ─────────────────────────────────────────────────────────
+
+let upstreamServer, upstreamPort;
+const upstream = {
+  streamChunks: [],
+  /** When non-null, hold the SSE connection open this many ms before
+   *  ending it. The heartbeat test uses this. */
+  holdMs: 0,
+};
+
+function startUpstream() {
+  return new Promise((resolve) => {
+    upstreamServer = createServer((req, res) => {
+      const url = new URL(req.url, 'http://127.0.0.1');
+      if (url.pathname === '/event') {
+        res.writeHead(200, {
+          'Content-Type': 'text/event-stream',
+          'Cache-Control': 'no-cache',
+          Connection: 'keep-alive',
+        });
+        for (const c of upstream.streamChunks) res.write(c);
+        const hold = upstream.holdMs;
+        setTimeout(() => res.end(), hold);
+        return;
+      }
+      res.writeHead(404);
+      res.end('not found');
+    });
+    upstreamServer.listen(0, '127.0.0.1', () => {
+      upstreamPort = upstreamServer.address().port;
+      resolve();
+    });
+  });
+}
+
+async function startDashboard() {
+  const app = express();
+  app.use(express.json({ limit: '2mb' }));
+  app.use('/api', createOpencodeSessionDetailRouter());
+  dashboardServer = createServer(app);
+  await new Promise((r) => dashboardServer.listen(0, '127.0.0.1', r));
+  dashboardBaseUrl = `http://127.0.0.1:${dashboardServer.address().port}`;
+}
+
+let dashboardServer, dashboardBaseUrl, tmpDir;
+let SERVE_JSON_PATH;
+let originalServeJson;
+
+before(async () => {
+  // Shrink the SSE heartbeat from 25s → 250ms so the heartbeat test
+  // actually exercises the path within the test runner's timeout.
+  process.env.BIZAR_SSE_HEARTBEAT_MS = '250';
+  // Use a per-PID isolated serve.json path so multiple test files
+  // don't contaminate each other.
+  SERVE_JSON_PATH = `${tmpdir()}/bizar-test-serve-stream-${process.pid}-${Date.now()}.json`;
+  process.env.BIZAR_SERVE_JSON_PATH = SERVE_JSON_PATH;
+  await startUpstream();
+  await startDashboard();
+  tmpDir = mkdtempSync(join(tmpdir(), 'opencode-stream-'));
+  if (existsSync(SERVE_JSON_PATH)) {
+    originalServeJson = readFileSync(SERVE_JSON_PATH, 'utf8');
+  }
+});
+
+after(async () => {
+  if (originalServeJson !== undefined) {
+    writeFileSync(SERVE_JSON_PATH, originalServeJson, 'utf8');
+  } else if (existsSync(SERVE_JSON_PATH)) {
+    rmSync(SERVE_JSON_PATH);
+  }
+  if (dashboardServer) await new Promise((r) => dashboardServer.close(r));
+  if (upstreamServer) await new Promise((r) => upstreamServer.close(r));
+  if (tmpDir) rmSync(tmpDir, { recursive: true, force: true });
+  delete process.env.BIZAR_SSE_HEARTBEAT_MS;
+  delete process.env.BIZAR_SERVE_JSON_PATH;
+});
+
+beforeEach(() => {
+  upstream.streamChunks = [];
+  upstream.holdMs = 0;
+});
+
+function writeServeJson() {
+  writeFileSync(
+    SERVE_JSON_PATH,
+    JSON.stringify({
+      port: upstreamPort,
+      password: 'test-pw',
+      worktree: '/tmp/stream-worktree',
+      pid: 99999,
+      startedAt: Date.now(),
+    }),
+    'utf8',
+  );
+}
+
+function moveServeJsonAside() {
+  if (!existsSync(SERVE_JSON_PATH)) return;
+  const tmp = join(tmpDir, `serve-aside-${Date.now()}-${process.pid}.json`);
+  copyFileSync(SERVE_JSON_PATH, tmp);
+  unlinkSync(SERVE_JSON_PATH);
+}
+
+function parseSseStream(text) {
+  const out = [];
+  let event = null, dataLines = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (line === '') {
+      if (event !== null || dataLines.length > 0) {
+        out.push({ event, data: dataLines.join('\n') });
+      }
+      event = null; dataLines = [];
+      continue;
+    }
+    if (line.startsWith(':')) continue;
+    const colon = line.indexOf(':');
+    if (colon < 0) continue;
+    const field = line.slice(0, colon);
+    let value = line.slice(colon + 1);
+    if (value.startsWith(' ')) value = value.slice(1);
+    if (field === 'event') event = value;
+    else if (field === 'data') dataLines.push(value);
+  }
+  return out;
+}
+
+// ── tests ─────────────────────────────────────────────────────────────────
+
+test('SSE forwards message.updated for the requested session, drops others', async () => {
+  writeServeJson();
+  upstream.streamChunks = [
+    // Direct envelope (older wire format). properties.sessionID.
+    'event: message.updated\ndata: {"type":"message.updated","properties":{"sessionID":"our-id","messageID":"m1"}}\n\n',
+    // Wrong session: must be filtered.
+    'event: message.updated\ndata: {"type":"message.updated","properties":{"sessionID":"OTHER-id","messageID":"m9"}}\n\n',
+    // Sync envelope (newer wire format).
+    'event: sync\ndata: {"type":"sync","syncEvent":{"type":"message.updated.1","data":{"sessionID":"our-id","messageID":"m3"}}}\n\n',
+  ];
+  const res = await fetch(
+    `${dashboardBaseUrl}/api/opencode-sessions/our-id/stream`,
+  );
+  assert.equal(res.status, 200);
+  assert.match(res.headers.get('content-type'), /text\/event-stream/);
+  assert.match(res.headers.get('cache-control'), /no-cache/);
+  assert.equal(res.headers.get('x-accel-buffering'), 'no');
+
+  const events = parseSseStream(await res.text());
+  // 1: message.updated (our-id)
+  // 2: message.updated from sync envelope (our-id)
+  // The OTHER-id message.updated is dropped.
+  assert.equal(events.length, 2);
+  assert.equal(events[0].event, 'message.updated');
+  const d0 = JSON.parse(events[0].data);
+  assert.equal(d0.sessionID, 'our-id');
+  assert.equal(d0.messageID, 'm1');
+  assert.equal(events[1].event, 'message.updated');
+  const d1 = JSON.parse(events[1].data);
+  assert.equal(d1.sessionID, 'our-id');
+  assert.equal(d1.messageID, 'm3');
+});
+
+test('SSE unwraps sync envelopes and strips the version suffix from the event name', async () => {
+  writeServeJson();
+  upstream.streamChunks = [
+    'event: sync\ndata: {"type":"sync","syncEvent":{"type":"session.idle.1","data":{"sessionID":"our-id"}}}\n\n',
+  ];
+  const res = await fetch(
+    `${dashboardBaseUrl}/api/opencode-sessions/our-id/stream`,
+  );
+  assert.equal(res.status, 200);
+  const events = parseSseStream(await res.text());
+  assert.equal(events.length, 1);
+  assert.equal(events[0].event, 'session.idle');
+  const d = JSON.parse(events[0].data);
+  assert.equal(d.sessionID, 'our-id');
+});
+
+test('SSE does NOT emit redundant chat:delta / chat:status aliases (only canonical events)', async () => {
+  // v4.2.5 fix: prior version emitted chat:delta/chat:status aliases
+  // in ADDITION to the canonical event, causing downstream listeners
+  // to see each idle/delta event twice. The proxy now emits one
+  // canonical envelope per upstream event — no aliases.
+  writeServeJson();
+  upstream.streamChunks = [
+    'event: message.part.updated\ndata: {"type":"message.part.updated.1","properties":{"sessionID":"our-id","messageID":"m1","part":{"type":"text","text":"hello"}}}\n\n',
+    'event: sync\ndata: {"type":"sync","syncEvent":{"type":"session.idle.1","data":{"sessionID":"our-id"}}}\n\n',
+  ];
+  const res = await fetch(
+    `${dashboardBaseUrl}/api/opencode-sessions/our-id/stream`,
+  );
+  const events = parseSseStream(await res.text());
+  // Only 2 events expected — one part.updated and one session.idle.
+  // We do NOT want chat:delta or chat:status emitted here.
+  assert.equal(events.length, 2);
+  const evNames = events.map((e) => e.event);
+  assert.ok(evNames.includes('message.part.updated'));
+  assert.ok(evNames.includes('session.idle'));
+  assert.equal(evNames.filter((n) => n === 'chat:status').length, 0);
+  assert.equal(evNames.filter((n) => n === 'chat:delta').length, 0);
+});
+
+test('SSE emits a heartbeat (": keepalive") within BIZAR_SSE_HEARTBEAT_MS', async () => {
+  // Override forces a 250ms heartbeat (set in `before`). We hold
+  // the upstream connection open for 600ms so the heartbeat fires
+  // at least once after the initial chunks land.
+  writeServeJson();
+  upstream.holdMs = 600;
+  upstream.streamChunks = [
+    'event: message.updated\ndata: {"type":"message.updated","properties":{"sessionID":"our-id","messageID":"m1"}}\n\n',
+  ];
+  const t0 = Date.now();
+  const res = await fetch(
+    `${dashboardBaseUrl}/api/opencode-sessions/our-id/stream`,
+  );
+  const text = await res.text();
+  const elapsed = Date.now() - t0;
+  // Body should be at least one blank line-separated chunk containing
+  // a `: keepalive` heartbeat comment. We assert the raw body has
+  // `: keepalive` somewhere and the total wait was longer than the
+  // heartbeat interval (250ms).
+  assert.ok(
+    text.includes(': keepalive'),
+    `expected ": keepalive" in body — got: ${text.slice(0, 500)}`,
+  );
+  assert.ok(elapsed >= 250, `expected >= 250ms elapsed, got ${elapsed}ms`);
+});
+
+test('SSE returns the response in <50ms when upstream immediately errors (plugin offline)', async () => {
+  // Move serve.json aside so the proxy sees `plugin_offline`.
+  moveServeJsonAside();
+  try {
+    const t0 = Date.now();
+    const res = await fetch(
+      `${dashboardBaseUrl}/api/opencode-sessions/our-id/stream`,
+    );
+    const elapsed = Date.now() - t0;
+    assert.equal(res.status, 200);
+    assert.match(res.headers.get('content-type'), /text\/event-stream/);
+    const text = await res.text();
+    assert.ok(text.includes('plugin_offline'));
+    assert.ok(elapsed < 200, `expected < 200ms, got ${elapsed}ms`);
+  } finally {
+    if (originalServeJson !== undefined) {
+      writeFileSync(SERVE_JSON_PATH, originalServeJson, 'utf8');
+    } else {
+      writeServeJson();
+    }
+  }
+});
+
+test('SSE handles whitespace-only session id gracefully (no 500 crash)', async () => {
+  writeServeJson();
+  // Whitespace session id: server resolves `decodeURIComponent('%20')`
+  // to a single space, which is non-empty; the proxy tries to filter
+  // events and never matches → empty stream, but never 5xx.
+  const res = await fetch(
+    `${dashboardBaseUrl}/api/opencode-sessions/%20/stream`,
+  );
+  // The handler may return 200 (empty stream) or 503 (directory
+  // unknown because the worktree doesn't contain ` ` session).
+  // Critically it must NOT 5xx or return undefined.
+  assert.ok(
+    res.status === 200 || res.status === 503,
+    `unexpected ${res.status} for whitespace session id`,
+  );
+});

package/bizar-dash/tests/env-vars-store.test.mjs

@@ -0,0 +1,216 @@
+/**
+ * env-vars-store.test.mjs — tests for the env-vars route and loadEnvJson.
+ *
+ * Run with: node --test bizar-dash/tests/env-vars-store.test.mjs
+ */
+import { describe, it, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync, chmodSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+
+const REPO = resolve(import.meta.dirname, '..', '..');
+
+// Sandbox process.env for isolation
+let SANDBOX_HOME;
+let ORIGINAL_HOME;
+let BIZAR_DIR;
+let ENV_FILE;
+
+before(() => {
+  SANDBOX_HOME = mkdtempSync(join(tmpdir(), `bizar-env-vars-test-${Date.now()}-`));
+  ORIGINAL_HOME = process.env.HOME;
+  process.env.HOME = SANDBOX_HOME;
+  BIZAR_DIR = join(SANDBOX_HOME, '.config', 'bizar');
+  ENV_FILE = join(BIZAR_DIR, 'env.json');
+});
+
+after(() => {
+  process.env.HOME = ORIGINAL_HOME;
+  // Clean up any lingering BIZAR_* test vars
+  for (const k of Object.keys(process.env)) {
+    if (k.startsWith('BIZAR_TEST_')) delete process.env[k];
+  }
+  try { rmSync(SANDBOX_HOME, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+// Helper to create a supertest-like request helper via native http
+async function request(app, method, path, body) {
+  const http = await import('node:http');
+  return new Promise((resolve, reject) => {
+    const server = app.listen(0, '127.0.0.1', () => {
+      const { port } = server.address();
+      const bodyStr = body ? JSON.stringify(body) : '';
+      const opts = {
+        hostname: '127.0.0.1',
+        port,
+        path,
+        method,
+        headers: {
+          'Content-Type': 'application/json',
+          'Content-Length': Buffer.byteLength(bodyStr),
+        },
+      };
+      const req = http.request(opts, (res) => {
+        let data = '';
+        res.on('data', (chunk) => { data += chunk; });
+        res.on('end', () => {
+          server.close();
+          try {
+            const parsed = data ? JSON.parse(data) : {};
+            resolve({ status: res.statusCode, body: parsed, raw: data });
+          } catch {
+            resolve({ status: res.statusCode, body: data, raw: data });
+          }
+        });
+      });
+      req.on('error', (err) => { server.close(); reject(err); });
+      if (bodyStr) req.write(bodyStr);
+      req.end();
+    });
+  });
+}
+
+describe('env-vars.mjs', () => {
+  // Build a minimal express app with just the env-vars router
+  let app;
+  beforeEach(async () => {
+    // Reset module state between tests by deleting the env file
+    try { rmSync(ENV_FILE); } catch { /* ignore */ }
+    // Force-reload the module for fresh state
+    const express = (await import('express')).default;
+    const { createEnvVarsRouter, loadEnvJson, resetStore } = await import(`${REPO}/bizar-dash/src/server/routes/env-vars.mjs`);
+    resetStore();
+    app = express();
+    app.use(express.json());
+    app.use('/api', createEnvVarsRouter());
+    // Clear any BIZAR_TEST_ vars left from previous tests
+    for (const k of Object.keys(process.env)) {
+      if (k.startsWith('BIZAR_TEST_')) delete process.env[k];
+    }
+    app.use(createEnvVarsRouter());
+  });
+
+  it('GET /api/env-vars returns empty list when file does not exist', async () => {
+    const res = await request(app, 'GET', '/api/env-vars');
+    assert.equal(res.status, 200);
+    assert.ok(Array.isArray(res.body), 'response should be an array');
+    assert.equal(res.body.length, 0);
+  });
+
+  it('POST creates entry, GET lists it with masked value', async () => {
+    const create = await request(app, 'POST', '/api/env-vars', {
+      name: 'BIZAR_TEST_KEY',
+      value: 'super-secret-value-123',
+    });
+    assert.equal(create.status, 201);
+    assert.equal(create.body.name, 'BIZAR_TEST_KEY');
+    assert.ok(create.body.value.includes('*'), 'value should be masked');
+    assert.ok(create.body.value.endsWith('-123'), 'masked value should include last 4 chars');
+    assert.ok(create.body.createdAt, 'should have createdAt');
+
+    const list = await request(app, 'GET', '/api/env-vars');
+    assert.equal(list.status, 200);
+    const entry = list.body.find((e) => e.name === 'BIZAR_TEST_KEY');
+    assert.ok(entry, 'entry should be in list');
+    assert.equal(entry.value, create.body.value, 'value should be masked on list');
+  });
+
+  it('PUT updates entry, DELETE removes it', async () => {
+    await request(app, 'POST', '/api/env-vars', { name: 'BIZAR_TEST_PUT', value: 'original' });
+    const update = await request(app, 'PUT', '/api/env-vars/BIZAR_TEST_PUT', { value: 'updated-value' });
+    assert.equal(update.status, 200);
+    assert.ok(update.body.value.endsWith('lue'), 'updated value should be masked');
+
+    // Verify in list
+    const list = await request(app, 'GET', '/api/env-vars');
+    const entry = list.body.find((e) => e.name === 'BIZAR_TEST_PUT');
+    assert.ok(entry);
+
+    // Delete
+    const del = await request(app, 'DELETE', '/api/env-vars/BIZAR_TEST_PUT');
+    assert.equal(del.status, 200);
+    assert.ok(del.body.ok);
+
+    // Verify gone
+    const listAfter = await request(app, 'GET', '/api/env-vars');
+    const gone = listAfter.body.find((e) => e.name === 'BIZAR_TEST_PUT');
+    assert.equal(gone, undefined, 'entry should be deleted');
+  });
+
+  it('rejects invalid name (must match /^BIZAR_[A-Z0-9_]+$/)', async () => {
+    const r1 = await request(app, 'POST', '/api/env-vars', { name: 'INVALID', value: 'x' });
+    assert.equal(r1.status, 400);
+    assert.ok(r1.body.error === 'invalid_name');
+
+    const r2 = await request(app, 'POST', '/api/env-vars', { name: 'bizar_lowercase', value: 'x' });
+    assert.equal(r2.status, 400);
+
+    const r3 = await request(app, 'POST', '/api/env-vars', { name: 'BIZAR HAS_SPACE', value: 'x' });
+    assert.equal(r3.status, 400);
+  });
+
+  it('creates env.json with mode 0600', async () => {
+    await request(app, 'POST', '/api/env-vars', { name: 'BIZAR_TEST_PERM', value: 'perm-check' });
+    const mode = statSync(ENV_FILE).mode & 0o777;
+    assert.equal(mode, 0o600, `expected 0o600, got ${octal(mode)}`);
+  });
+
+  it('loadEnvJson sets process.env', async () => {
+    // Create an env var
+    await request(app, 'POST', '/api/env-vars', { name: 'BIZAR_TEST_LOADENV', value: 'env-loaded-value' });
+
+    // Delete from process.env to simulate fresh start
+    delete process.env.BIZAR_TEST_LOADENV;
+
+    // Call loadEnvJson
+    const { loadEnvJson } = await import(`${REPO}/bizar-dash/src/server/routes/env-vars.mjs`);
+    loadEnvJson();
+
+    assert.equal(process.env.BIZAR_TEST_LOADENV, 'env-loaded-value',
+      'process.env should be set after loadEnvJson');
+  });
+
+  it('DELETE removes from process.env', async () => {
+    // Create
+    await request(app, 'POST', '/api/env-vars', { name: 'BIZAR_TEST_DELPROCESS', value: 'to-be-deleted' });
+    assert.equal(process.env.BIZAR_TEST_DELPROCESS, 'to-be-deleted');
+
+    // Delete via API
+    await request(app, 'DELETE', '/api/env-vars/BIZAR_TEST_DELPROCESS');
+
+    assert.equal(process.env.BIZAR_TEST_DELPROCESS, undefined,
+      'process.env should be cleared after DELETE');
+  });
+
+  it('POST /api/env-vars/:name/test returns referenced and inProcessEnv', async () => {
+    // Not in process.env yet
+    const r1 = await request(app, 'POST', '/api/env-vars', { name: 'BIZAR_TEST_REFS', value: 'refs-val' });
+    assert.equal(r1.status, 201);
+
+    const test = await request(app, 'POST', '/api/env-vars/BIZAR_TEST_REFS/test');
+    assert.equal(test.status, 200);
+    assert.ok(typeof test.body.referenced === 'boolean');
+    assert.ok(typeof test.body.inProcessEnv === 'boolean');
+    assert.equal(test.body.inProcessEnv, true, 'should be in process.env after creation');
+  });
+
+  it('409 on duplicate POST', async () => {
+    await request(app, 'POST', '/api/env-vars', { name: 'BIZAR_TEST_DUP', value: 'first' });
+    const r = await request(app, 'POST', '/api/env-vars', { name: 'BIZAR_TEST_DUP', value: 'second' });
+    assert.equal(r.status, 409);
+    assert.ok(r.body.error === 'already_exists');
+  });
+
+  it('404 on PUT/DELETE non-existent var', async () => {
+    const put = await request(app, 'PUT', '/api/env-vars/BIZAR_NONEXISTENT', { value: 'x' });
+    assert.equal(put.status, 404);
+
+    const del = await request(app, 'DELETE', '/api/env-vars/BIZAR_NONEXISTENT');
+    assert.equal(del.status, 404);
+  });
+});
+
+function octal(n) {
+  return '0o' + n.toString(8);
+}