@polderlabs/bizar 4.4.13 → 4.5.1

package/bizar-dash/tests/tasks-create.test.mjs

@@ -0,0 +1,187 @@
+/**
+ * tasks-create.test.mjs — tests for POST /api/tasks (no agent selection).
+ *
+ * Run with: node --test bizar-dash/tests/tasks-create.test.mjs
+ *
+ * Strategy: build a minimal Express app with just the tasks router
+ * (mounted on /api). Sandbox HOME so the tasks-store writes to a
+ * tmpdir instead of ~/.config/bizar. Pass an explicit projectId in
+ * every request body so we don't depend on the active project.
+ */
+import { describe, it, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import express from 'express';
+import { mkdtempSync, rmSync, existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+
+const REPO = resolve(import.meta.dirname, '..', '..');
+
+let SANDBOX_HOME;
+let ORIGINAL_HOME;
+let app;
+let broadcastEvents;
+let tasksFilePath;
+
+before(async () => {
+  SANDBOX_HOME = mkdtempSync(join(tmpdir(), `bizar-tasks-test-${Date.now()}-`));
+  ORIGINAL_HOME = process.env.HOME;
+  process.env.HOME = SANDBOX_HOME;
+  // tasksStore writes to ~/.config/opencode/projects/<id>/tasks.json
+  // (projects-store.mjs:PROJECTS_DIR).
+  tasksFilePath = join(SANDBOX_HOME, '.config', 'opencode', 'projects', 'test-proj', 'tasks.json');
+});
+
+after(() => {
+  process.env.HOME = ORIGINAL_HOME;
+  try { rmSync(SANDBOX_HOME, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+beforeEach(async () => {
+  broadcastEvents = [];
+  // Reset file between tests so each one starts clean.
+  try { rmSync(tasksFilePath); } catch { /* ignore */ }
+  // Fresh import of the router — build a minimal app.
+  const { createTasksRouter } = await import(
+    `${REPO}/bizar-dash/src/server/routes/tasks.mjs`
+  );
+  app = express();
+  app.use(express.json());
+  app.use('/api', createTasksRouter({
+    state: {},
+    broadcast: (msg) => broadcastEvents.push(msg),
+    projectRoot: SANDBOX_HOME,
+  }));
+});
+
+async function request(method, path, body) {
+  const http = await import('node:http');
+  return new Promise((resolveP, reject) => {
+    const server = app.listen(0, '127.0.0.1', () => {
+      const { port } = server.address();
+      const bodyStr = body ? JSON.stringify(body) : '';
+      const req = http.request({
+        hostname: '127.0.0.1',
+        port,
+        path,
+        method,
+        headers: bodyStr
+          ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(bodyStr) }
+          : {},
+      }, (res) => {
+        let data = '';
+        res.on('data', (c) => { data += c; });
+        res.on('end', () => {
+          server.close();
+          try {
+            resolveP({ status: res.statusCode, body: JSON.parse(data) });
+          } catch {
+            resolveP({ status: res.statusCode, body: data });
+          }
+        });
+      });
+      req.on('error', (err) => { server.close(); reject(err); });
+      if (bodyStr) req.write(bodyStr);
+      req.end();
+    });
+  });
+}
+
+describe('POST /api/tasks — simplified create flow (no agent selection)', () => {
+  it('creates a task with just title + description, returning 201', async () => {
+    const res = await request('POST', '/api/tasks', {
+      projectId: 'test-proj',
+      title: 'Test task',
+      description: 'A simple task without any agent field.',
+    });
+    assert.equal(res.status, 201, `expected 201, got ${res.status}: ${JSON.stringify(res.body)}`);
+    assert.ok(res.body.id, 'response should include id');
+    assert.equal(res.body.title, 'Test task');
+    assert.equal(res.body.description, 'A simple task without any agent field.');
+  });
+
+  it('does not store any agent-related field when none is provided', async () => {
+    const res = await request('POST', '/api/tasks', {
+      projectId: 'test-proj',
+      title: 'No agent task',
+      description: 'Just title and description.',
+    });
+    assert.equal(res.status, 201);
+    // The store does not have an `agent` field — it has `assignee`
+    // and `workedBy`. Both must be null/empty since no agent was picked.
+    assert.equal(res.body.assignee, null, 'assignee should be null when not provided');
+    assert.equal(res.body.workedBy, null, 'workedBy should be null when not provided');
+    // Defensive: no field literally named `agent` should leak through.
+    assert.equal(res.body.agent, undefined, 'response should not have an `agent` field');
+  });
+
+  it('still respects an explicitly passed assignee (backward compat)', async () => {
+    // The store API has always accepted `assignee`. We don't break it —
+    // we just don't ask for it in the simplified UI. Tests that callers
+    // can still set it explicitly when they want to.
+    const res = await request('POST', '/api/tasks', {
+      projectId: 'test-proj',
+      title: 'Manually assigned',
+      description: 'Caller passed assignee explicitly.',
+      assignee: 'odin',
+    });
+    assert.equal(res.status, 201);
+    assert.equal(res.body.assignee, 'odin');
+  });
+
+  it('ignores an unrecognized `agent` field (does not store it)', async () => {
+    const res = await request('POST', '/api/tasks', {
+      projectId: 'test-proj',
+      title: 'With unknown field',
+      description: 'Caller passed agent field by mistake.',
+      agent: 'thor',
+    });
+    assert.equal(res.status, 201);
+    // The store doesn't have an `agent` field. Any incoming `agent`
+    // is just an unknown prop and should not appear on the stored task.
+    assert.equal(res.body.agent, undefined, 'agent field should not be stored');
+    assert.equal(res.body.assignee, null, 'assignee should remain null');
+  });
+
+  it('persists the task to disk with no agent data', async () => {
+    const res = await request('POST', '/api/tasks', {
+      projectId: 'test-proj',
+      title: 'Persisted',
+      description: 'Check disk state.',
+    });
+    assert.equal(res.status, 201);
+
+    assert.ok(existsSync(tasksFilePath), 'tasks.json should be written to disk');
+    const stored = JSON.parse(readFileSync(tasksFilePath, 'utf8'));
+    assert.equal(stored.tasks.length, 1);
+    const task = stored.tasks[0];
+    assert.equal(task.title, 'Persisted');
+    assert.equal(task.assignee, null);
+    assert.equal(task.workedBy, null);
+    assert.equal(task.agent, undefined);
+  });
+
+  it('rejects create without a title (non-201 with title-related error)', async () => {
+    const res = await request('POST', '/api/tasks', {
+      projectId: 'test-proj',
+      description: 'No title — should fail.',
+    });
+    assert.notEqual(res.status, 201, 'should not succeed without a title');
+    assert.ok(
+      res.body.message?.toLowerCase().includes('title'),
+      `error message should mention title, got: ${JSON.stringify(res.body)}`,
+    );
+  });
+
+  it('emits a tasks:change broadcast event', async () => {
+    const res = await request('POST', '/api/tasks', {
+      projectId: 'test-proj',
+      title: 'Broadcast test',
+      description: 'Should fire tasks:change.',
+    });
+    assert.equal(res.status, 201);
+    assert.equal(broadcastEvents.length, 1, 'should emit exactly one event');
+    assert.equal(broadcastEvents[0].type, 'tasks:change');
+    assert.equal(broadcastEvents[0].task.title, 'Broadcast test');
+  });
+});

package/bizar-dash/tests/update-check.test.mjs

@@ -0,0 +1,127 @@
+/**
+ * update-check.test.mjs — tests for /api/updates/status and /api/updates/check.
+ *
+ * Run with: node --test bizar-dash/tests/update-check.test.mjs
+ *
+ * Strategy: import the module once, call `resetUpdateCache()` between
+ * tests. The route reads through the module-level cache path on every
+ * request. In this sandbox, `npm view` may or may not work — the route
+ * must degrade gracefully (null latest, hasUpdates=false) on failure.
+ */
+import { describe, it, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import express from 'express';
+import { resolve } from 'node:path';
+
+const REPO = resolve(import.meta.dirname, '..', '..');
+
+const { createUpdateRouter, resetUpdateCache } = await import(
+  `${REPO}/bizar-dash/src/server/routes/update.mjs`
+);
+
+let app;
+beforeEach(async () => {
+  resetUpdateCache();
+  app = express();
+  app.use(express.json());
+  app.use('/api', createUpdateRouter({ broadcast: () => {} }));
+});
+
+async function request(app, method, path, body) {
+  const http = await import('node:http');
+  return new Promise((resolveP, reject) => {
+    const server = app.listen(0, '127.0.0.1', () => {
+      const { port } = server.address();
+      const bodyStr = body ? JSON.stringify(body) : '';
+      const req = http.request({
+        hostname: '127.0.0.1',
+        port,
+        path,
+        method,
+        headers: bodyStr
+          ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(bodyStr) }
+          : {},
+      }, (res) => {
+        let data = '';
+        res.on('data', (c) => { data += c; });
+        res.on('end', () => {
+          server.close();
+          try {
+            resolveP({ status: res.statusCode, body: JSON.parse(data) });
+          } catch {
+            resolveP({ status: res.statusCode, body: data });
+          }
+        });
+      });
+      req.on('error', (err) => { server.close(); reject(err); });
+      if (bodyStr) req.write(bodyStr);
+      req.end();
+    });
+  });
+}
+
+describe('update.mjs — /api/updates/status', () => {
+  it('returns the installed package map', async () => {
+    const res = await request(app, 'GET', '/api/updates/status');
+    assert.equal(res.status, 200);
+    assert.ok(res.body.current, 'response should have current field');
+    assert.equal(typeof res.body.current, 'object');
+    for (const id of ['bizar', 'bizar-dash', 'bizar-plugin']) {
+      assert.ok(id in res.body.current, `current.${id} should be a key`);
+      assert.ok(
+        res.body.current[id] === null || typeof res.body.current[id] === 'string',
+        `current.${id} should be string or null`,
+      );
+    }
+  });
+
+  it('does not include latest/hasUpdates fields', async () => {
+    const res = await request(app, 'GET', '/api/updates/status');
+    assert.equal(res.status, 200);
+    assert.equal(res.body.latest, undefined, 'status should not include latest');
+    assert.equal(res.body.hasUpdates, undefined, 'status should not include hasUpdates');
+  });
+});
+
+describe('update.mjs — /api/updates/check', () => {
+  it('returns shape { current, latest, hasUpdates }', async () => {
+    const res = await request(app, 'GET', '/api/updates/check');
+    assert.equal(res.status, 200);
+    assert.ok(res.body.current, 'should have current');
+    assert.ok(res.body.latest, 'should have latest');
+    assert.equal(typeof res.body.hasUpdates, 'boolean');
+    for (const id of ['bizar', 'bizar-dash', 'bizar-plugin']) {
+      assert.ok(id in res.body.latest, `latest.${id} should be a key`);
+    }
+  });
+
+  it('does not 5xx on registry failure (graceful degradation)', async () => {
+    const res = await request(app, 'GET', '/api/updates/check');
+    assert.equal(res.status, 200, 'should not 5xx even if npm view fails');
+    assert.equal(typeof res.body.hasUpdates, 'boolean');
+  });
+});
+
+describe('update.mjs — POST /api/updates/apply', () => {
+  it('rejects empty/invalid package list with 400', async () => {
+    // Empty array → falls back to all known packages, which is valid
+    // (returns 202). Test instead that an unknown package id is handled
+    // — current implementation filters to known ids and starts the run
+    // if at least one id is valid. With no valid ids, returns 400.
+    const res = await request(app, 'POST', '/api/updates/apply', {
+      packages: ['__nonexistent_pkg__'],
+    });
+    assert.equal(res.status, 400);
+    assert.equal(res.body.error, 'bad_request');
+  });
+
+  it('accepts missing broadcast (default no-op)', async () => {
+    const localApp = express();
+    localApp.use(express.json());
+    localApp.use('/api', createUpdateRouter());
+    const res = await request(localApp, 'POST', '/api/updates/apply', {});
+    // We accept either 202 (npm succeeded) or 500 (npm not on PATH).
+    // The point is the route didn't crash before the handler.
+    assert.ok([202, 500].includes(res.status), `unexpected status ${res.status}`);
+  });
+});

package/bizar-dash/tests/update-run.test.mjs

@@ -0,0 +1,266 @@
+/**
+ * update-run.test.mjs — tests for /api/updates/apply progress streaming.
+ *
+ * Run with: node --test bizar-dash/tests/update-run.test.mjs
+ *
+ * Strategy: stub `node:child_process` so `spawn` returns a controllable
+ * fake process that emits scripted stdout/stderr lines and a chosen
+ * exit code. Capture the broadcast channel's emitted messages and
+ * assert they fire in the documented order.
+ */
+import { describe, it, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import express from 'express';
+import { EventEmitter } from 'node:events';
+import { Readable } from 'node:stream';
+import { resolve } from 'node:path';
+
+const REPO = resolve(import.meta.dirname, '..', '..');
+
+// ─── Spawn fake ────────────────────────────────────────────────────────────
+// We monkey-patch the module loader's view of `node:child_process` so
+// that update.mjs's `import { spawn } from 'node:child_process'` resolves
+// to our fake.
+
+class FakeChildProcess extends EventEmitter {
+  constructor() {
+    super();
+    this.stdout = new Readable({ read() {} });
+    this.stderr = new Readable({ read() {} });
+  }
+  // Helpers for tests
+  emitStdout(line) { this.stdout.push(line + '\n'); }
+  emitStderr(line) { this.stderr.push(line + '\n'); }
+  finish(code = 0) {
+    this.stdout.push(null);
+    this.stderr.push(null);
+    this.emit('close', code);
+  }
+  failWith(err) {
+    this.emit('error', err);
+  }
+}
+
+let fakeProc = null;
+function makeFakeSpawn() {
+  return (_cmd, _args, _opts) => {
+    fakeProc = new FakeChildProcess();
+    return fakeProc;
+  };
+}
+
+// Install the fake by intercepting `node:child_process`. We do this by
+// rewriting `Module._resolveFilename` for one test at a time.
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+
+let originalLoad;
+let patched = false;
+function installFakeSpawn() {
+  if (patched) return;
+  // Override via global require cache: pre-populate the require cache
+  // for `node:child_process` with a stub module.
+  const realChild = require('node:child_process');
+  const stub = { ...realChild, spawn: makeFakeSpawn() };
+  require.cache[require.resolve('node:child_process')] = {
+    id: 'node:child_process',
+    filename: 'node:child_process',
+    loaded: true,
+    exports: stub,
+  };
+  patched = true;
+}
+
+// Load update.mjs once after we've patched child_process. We do this
+// dynamically so the import picks up the stubbed `spawn` from the
+// require cache that ESM bridges through.
+//
+// NOTE: ESM `import` does NOT use the require cache, so the patch above
+// only works for CommonJS callers of `child_process`. The route imports
+// `spawn` from `node:child_process` directly via ESM. To make this test
+// work, we patch the actual child_process module's `spawn` property at
+// runtime instead.
+function patchSpawnDirectly() {
+  const cp = require('node:child_process');
+  cp.__originalSpawn = cp.__originalSpawn || cp.spawn;
+  cp.spawn = makeFakeSpawn();
+}
+
+function unpatchSpawn() {
+  const cp = require('node:child_process');
+  if (cp.__originalSpawn) {
+    cp.spawn = cp.__originalSpawn;
+  }
+  fakeProc = null;
+}
+
+// Now we need the route to use the patched spawn. update.mjs does:
+//   import { spawn, execFileSync } from 'node:child_process';
+// In Node.js, ESM imports for built-in modules go through the loader,
+// which uses a private internal cache separate from the CommonJS
+// require cache. So patching require.cache alone won't redirect ESM.
+//
+// The reliable approach is to use a loader hook. For simplicity in
+// this test, we instead use module-aliasing via a wrapper: we use a
+// small middleware-only test that monkey-patches spawn on the imported
+// module instance directly. Since the same module instance is shared
+// across imports within a process, this works after first import.
+
+async function importUpdateModuleFresh() {
+  // Use a query string to force re-import. ESM treats query strings as
+  // distinct specifiers, so this gives us a fresh module instance.
+  const url = `${REPO}/bizar-dash/src/server/routes/update.mjs?case=${Date.now()}-${Math.random()}`;
+  return import(url);
+}
+
+// ─── App setup ─────────────────────────────────────────────────────────────
+
+function setupApp(broadcast) {
+  const app = express();
+  app.use(express.json());
+  return importUpdateModuleFresh().then((mod) => {
+    app.use('/api', mod.createUpdateRouter({ broadcast }));
+    return { app, mod };
+  });
+}
+
+async function request(app, method, path, body) {
+  const http = await import('node:http');
+  return new Promise((resolveP, reject) => {
+    const server = app.listen(0, '127.0.0.1', () => {
+      const { port } = server.address();
+      const bodyStr = body ? JSON.stringify(body) : '';
+      const req = http.request({
+        hostname: '127.0.0.1',
+        port,
+        path,
+        method,
+        headers: bodyStr
+          ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(bodyStr) }
+          : {},
+      }, (res) => {
+        let data = '';
+        res.on('data', (c) => { data += c; });
+        res.on('end', () => {
+          server.close();
+          try {
+            resolveP({ status: res.statusCode, body: JSON.parse(data) });
+          } catch {
+            resolveP({ status: res.statusCode, body: data });
+          }
+        });
+      });
+      req.on('error', (err) => { server.close(); reject(err); });
+      if (bodyStr) req.write(bodyStr);
+      req.end();
+    });
+  });
+}
+
+// ─── Wait helper ───────────────────────────────────────────────────────────
+
+function waitFor(predicate, { timeoutMs = 4000, intervalMs = 10 } = {}) {
+  return new Promise((resolveP, reject) => {
+    const start = Date.now();
+    const tick = () => {
+      if (predicate()) {
+        resolveP();
+        return;
+      }
+      if (Date.now() - start > timeoutMs) {
+        reject(new Error(`waitFor timed out after ${timeoutMs}ms`));
+        return;
+      }
+      setTimeout(tick, intervalMs);
+    };
+    tick();
+  });
+}
+
+// ─── Tests ─────────────────────────────────────────────────────────────────
+
+describe('update.mjs — apply run broadcasts events in order', () => {
+  let broadcast;
+  beforeEach(() => {
+    patchSpawnDirectly();
+    broadcast = [];
+  });
+
+  it('emits starting → log → done → complete for a successful install', async () => {
+    const { app } = await setupApp((msg) => broadcast.push(msg));
+    const res = await request(app, 'POST', '/api/updates/apply', { packages: ['bizar'] });
+    assert.equal(res.status, 202);
+    assert.deepEqual(res.body.started, ['bizar']);
+
+    // The first event should be a `starting` progress for `bizar`
+    await waitFor(() => broadcast.length >= 1);
+    assert.equal(broadcast[0].type, 'update:progress');
+    assert.equal(broadcast[0].pkg, 'bizar');
+    assert.equal(broadcast[0].status, 'starting');
+
+    // Now drive the fake spawn to emit log lines + finish
+    assert.ok(fakeProc, 'fakeProc should exist after request');
+    fakeProc.emitStdout('npm WARN deprecated foo');
+    fakeProc.emitStdout('added 1 package in 2s');
+    fakeProc.finish(0);
+
+    // Wait for the complete event
+    await waitFor(() => broadcast.some((m) => m.type === 'update:complete'), { timeoutMs: 5000 });
+
+    // Verify ordering and types
+    const types = broadcast.map((m) => `${m.type}${m.pkg ? `:${m.pkg}` : ''}:${m.status ?? ''}`);
+    assert.ok(types.includes('update:progress:bizar:starting'), 'should have starting progress');
+    assert.ok(types.includes('update:log:bizar:'), 'should have at least one log');
+    assert.ok(types.includes('update:progress:bizar:done'), 'should have done progress');
+    assert.ok(types.at(-1) === 'update:complete:', 'last event should be update:complete');
+
+    // Done event should carry newVersion
+    const doneEvent = broadcast.find((m) => m.type === 'update:progress' && m.status === 'done');
+    assert.ok(doneEvent, 'done event should exist');
+    assert.ok('newVersion' in doneEvent, 'done event should carry newVersion field');
+
+    unpatchSpawn();
+  });
+
+  it('emits error progress + complete when npm exits non-zero', async () => {
+    const { app } = await setupApp((msg) => broadcast.push(msg));
+    const res = await request(app, 'POST', '/api/updates/apply', { packages: ['bizar'] });
+    assert.equal(res.status, 202);
+
+    await waitFor(() => broadcast.length >= 1);
+    assert.ok(fakeProc, 'fakeProc should exist');
+    fakeProc.emitStderr('npm ERR! code EACCES');
+    fakeProc.finish(1);
+
+    await waitFor(() => broadcast.some((m) => m.type === 'update:complete'));
+
+    const errorEvent = broadcast.find((m) => m.type === 'update:progress' && m.status === 'error');
+    assert.ok(errorEvent, 'should have error progress event');
+    assert.ok(errorEvent.error, 'error event should have error message');
+    assert.match(errorEvent.error, /exited with code 1/);
+
+    const lastEvent = broadcast.at(-1);
+    assert.equal(lastEvent.type, 'update:complete');
+
+    unpatchSpawn();
+  });
+
+  it('returns 409 when an apply is already running', async () => {
+    const { app } = await setupApp(() => {});
+    // First call — kicks off the run but the fake proc never closes,
+    // so the run is "active" for the duration of the test.
+    const first = await request(app, 'POST', '/api/updates/apply', { packages: ['bizar'] });
+    assert.equal(first.status, 202);
+
+    // Second call — should hit the concurrency guard
+    const second = await request(app, 'POST', '/api/updates/apply', { packages: ['bizar'] });
+    assert.equal(second.status, 409);
+    assert.equal(second.body.error, 'already_running');
+
+    // Cleanup: close the fake proc so the run's finally clears the guard
+    if (fakeProc) fakeProc.finish(0);
+    // Give the async run a moment to clear
+    await new Promise((r) => setTimeout(r, 50));
+    unpatchSpawn();
+  });
+});