@polderlabs/bizar 4.5.2 → 4.7.1

package/bizar-dash/src/server/logger.mjs

@@ -0,0 +1,71 @@
+/**
+ * src/server/logger.mjs
+ *
+ * v4.7.0 — Structured JSON logger with level filtering.
+ *
+ * Replaces ad-hoc `console.log('[module] message')` calls across the
+ * server with a single, level-gated logger that emits one JSON object
+ * per line. Output goes to the matching console.* stream (log/warn/
+ * error) so existing terminal capture keeps working, but the body is
+ * machine-parseable.
+ *
+ * Level selection: BIZAR_LOG_LEVEL env var (debug | info | warn | error).
+ * Default `info` matches the existing behaviour — everything but debug
+ * is visible. Set `debug` to surface verbose tracing during development.
+ *
+ * Usage:
+ *   import { info, warn, error, child } from './logger.mjs';
+ *   info('server started', { port: 4317 });
+ *   warn('rate limited', { module: 'lightrag', err: e.message });
+ *   const log = child({ module: 'overview' });
+ *   log.info('snapshot built', { size: 1234 });
+ */
+
+const LEVELS = { debug: 10, info: 20, warn: 30, error: 40 };
+const ENV_LEVEL = process.env.BIZAR_LOG_LEVEL;
+const currentLevel = LEVELS[ENV_LEVEL] !== undefined ? ENV_LEVEL : 'info';
+
+function format(level, msg, ctx) {
+  const entry = {
+    ts: new Date().toISOString(),
+    level,
+    msg,
+    ...(ctx && typeof ctx === 'object' ? ctx : {}),
+  };
+  return JSON.stringify(entry);
+}
+
+function shouldLog(level) {
+  return LEVELS[currentLevel] <= LEVELS[level];
+}
+
+export function debug(msg, ctx) {
+  if (shouldLog('debug')) console.log(format('debug', msg, ctx));
+}
+
+export function info(msg, ctx) {
+  if (shouldLog('info')) console.log(format('info', msg, ctx));
+}
+
+export function warn(msg, ctx) {
+  if (shouldLog('warn')) console.warn(format('warn', msg, ctx));
+}
+
+export function error(msg, ctx) {
+  if (shouldLog('error')) console.error(format('error', msg, ctx));
+}
+
+/**
+ * Build a child logger that binds a context object to every log call.
+ * Useful for tagging a series of related entries with a module/session id.
+ */
+export function child(ctx) {
+  return {
+    debug: (m, c) => debug(m, { ...ctx, ...(c && typeof c === 'object' ? c : {}) }),
+    info: (m, c) => info(m, { ...ctx, ...(c && typeof c === 'object' ? c : {}) }),
+    warn: (m, c) => warn(m, { ...ctx, ...(c && typeof c === 'object' ? c : {}) }),
+    error: (m, c) => error(m, { ...ctx, ...(c && typeof c === 'object' ? c : {}) }),
+  };
+}
+
+export { currentLevel };

package/bizar-dash/src/server/memory-lightrag.mjs

@@ -52,9 +52,32 @@ import https from 'node:https';
 
 import { atomicWriteJson } from './routes/_shared.mjs';
 import { parseFrontmatter } from './yaml.mjs';
+import { warn as logWarn } from './logger.mjs';
 
 // ── Helpers ──────────────────────────────────────────────────────────────────
 
+/**
+ * v4.7.0 — Per-site log rate limiter for hot-path catches.
+ *
+ * Several empty catches below sit on stdout/stderr `data` handlers
+ * that can fire dozens of times per second when LightRAG is chatty
+ * (or the disk is slow). Without rate-limiting, a transient disk
+ * hiccup floods the log with thousands of identical warnings and
+ * hides the real problem underneath.
+ *
+ * Returns true the first time it's called for a key within `intervalMs`,
+ * then false until the window passes. Default 60s — matches the
+ * "if it's still broken, say it again a minute later" pattern.
+ */
+const _lastLog = new Map();
+function _rateLimit(key, intervalMs = 60_000) {
+  const now = Date.now();
+  const last = _lastLog.get(key) || 0;
+  if (now - last < intervalMs) return false;
+  _lastLog.set(key, now);
+  return true;
+}
+
 function deepMerge(target, source) {
   const out = { ...target };
   if (source === null || source === undefined) return out;
@@ -444,11 +467,23 @@ export async function startServer(config, { logger } = {}) {
   let fd = -1;
   try {
     fd = openSync(logFile, 'a');
-    child.stdout?.on('data', (d) => { try { writeSync(fd, d); } catch {} });
-    child.stderr?.on('data', (d) => { try { writeSync(fd, d); } catch {} });
+    child.stdout?.on('data', (d) => {
+      try { writeSync(fd, d); } catch (err) {
+        if (_rateLimit('lightrag-write-stdout')) logWarn('lightrag stream write failed (stdout)', { module: 'lightrag', err: err?.message || String(err) });
+      }
+    });
+    child.stderr?.on('data', (d) => {
+      try { writeSync(fd, d); } catch (err) {
+        if (_rateLimit('lightrag-write-stderr')) logWarn('lightrag stream write failed (stderr)', { module: 'lightrag', err: err?.message || String(err) });
+      }
+    });
     child.on('exit', (code, signal) => {
-      try { closeSync(fd); } catch {}
-      try { unlinkSync(pidFile); } catch {}
+      try { closeSync(fd); } catch (err) {
+        if (_rateLimit('lightrag-close-fd')) logWarn('lightrag close fd failed', { module: 'lightrag', err: err?.message || String(err) });
+      }
+      try { unlinkSync(pidFile); } catch (err) {
+        if (_rateLimit('lightrag-exit-unlink')) logWarn('lightrag pid unlink failed', { module: 'lightrag', err: err?.message || String(err) });
+      }
       log(`lightrag-server exited (code=${code}, signal=${signal})`);
     });
   } catch (openErr) {
@@ -483,7 +518,9 @@ export async function stopServer(config, { logger } = {}) {
   const pidFile = join(config.workingDir, 'lightrag.pid');
   const { pid, alive } = readPidAlive(pidFile);
   if (!pid || !alive) {
-    try { unlinkSync(pidFile); } catch {}
+    try { unlinkSync(pidFile); } catch (err) {
+      if (_rateLimit('lightrag-stop-notrunning-unlink')) logWarn('lightrag pid unlink failed (not running)', { module: 'lightrag', err: err?.message || String(err) });
+    }
     return { ok: true, message: 'not running' };
   }
   log(`stopping lightrag-server (pid ${pid})`);
@@ -493,7 +530,9 @@ export async function stopServer(config, { logger } = {}) {
     log(`escalating to SIGKILL (pid ${pid})`);
     killPid(pid, 'SIGKILL');
   }
-  try { unlinkSync(pidFile); } catch {}
+  try { unlinkSync(pidFile); } catch (err) {
+    if (_rateLimit('lightrag-stop-unlink')) logWarn('lightrag pid unlink failed (stop)', { module: 'lightrag', err: err?.message || String(err) });
+  }
   return { ok: true, message: 'stopped' };
 }
 

package/bizar-dash/src/server/metrics.mjs

@@ -0,0 +1,193 @@
+/**
+ * src/server/metrics.mjs
+ *
+ * v4.7.0 — Tiny Prometheus-style metrics registry.
+ *
+ * Implements the three primitive metric types we actually use:
+ *   - counter(name, help)        → { inc(labels) }
+ *   - gauge(name, help)          → { set(value, labels) }
+ *   - histogram(name, help, opts) → { observe(value, labels) }
+ *
+ * Storage is in-process: counters/gauges/histograms are kept in Maps
+ * keyed by metric name → label-set signature → values. Labels are
+ * JSON-stringified to produce a stable key (sorted-keys would be
+ * nicer but JSON.stringify of a literal object preserves insertion
+ * order, which is good enough for our use — every caller writes the
+ * same label shape for the same metric).
+ *
+ * `render()` returns the Prometheus text exposition format
+ * (Content-Type: text/plain; version=0.0.4) so it can be scraped by
+ * Prometheus or read by humans. The output includes the `# HELP` and
+ * `# TYPE` headers for every metric.
+ *
+ * `reset()` clears the registry — only intended for tests.
+ */
+
+const counters = new Map();
+const gauges = new Map();
+const histograms = new Map();
+
+// Default Prometheus-style histogram buckets in seconds (suitable for
+// HTTP latency). Override per-metric via opts.buckets.
+const DEFAULT_BUCKETS = [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10];
+
+function labelsKey(labels) {
+  if (!labels || typeof labels !== 'object') return '{}';
+  const keys = Object.keys(labels);
+  if (keys.length === 0) return '{}';
+  const ordered = {};
+  for (const k of keys.sort()) ordered[k] = labels[k];
+  return JSON.stringify(ordered);
+}
+
+function labelsToString(labels) {
+  if (!labels || typeof labels !== 'object') return '';
+  const keys = Object.keys(labels);
+  if (keys.length === 0) return '';
+  return keys
+    .sort()
+    .map((k) => `${k}="${escapeLabelValue(String(labels[k]))}"`)
+    .join(',');
+}
+
+function escapeLabelValue(v) {
+  return v.replace(/\\/g, '\\\\').replace(/\n/g, '\\n').replace(/"/g, '\\"');
+}
+
+export function counter(name, help) {
+  if (!name) throw new Error('counter(name, help): name is required');
+  return {
+    inc(labels = {}) {
+      const key = labelsKey(labels);
+      let entry = counters.get(name);
+      if (!entry) {
+        entry = { help: help || '', values: new Map() };
+        counters.set(name, entry);
+      }
+      const v = entry.values.get(key) || { labels, value: 0 };
+      v.value += 1;
+      entry.values.set(key, v);
+    },
+  };
+}
+
+export function gauge(name, help) {
+  if (!name) throw new Error('gauge(name, help): name is required');
+  return {
+    set(value, labels = {}) {
+      const key = labelsKey(labels);
+      let entry = gauges.get(name);
+      if (!entry) {
+        entry = { help: help || '', values: new Map() };
+        gauges.set(name, entry);
+      }
+      entry.values.set(key, { labels, value: Number(value) });
+    },
+  };
+}
+
+export function histogram(name, help, opts = {}) {
+  if (!name) throw new Error('histogram(name, help, opts): name is required');
+  const buckets = Array.isArray(opts.buckets) && opts.buckets.length > 0
+    ? [...opts.buckets].sort((a, b) => a - b)
+    : DEFAULT_BUCKETS;
+  return {
+    observe(value, labels = {}) {
+      const key = labelsKey(labels);
+      let entry = histograms.get(name);
+      if (!entry) {
+        entry = {
+          help: help || '',
+          buckets,
+          values: new Map(),
+        };
+        histograms.set(name, entry);
+      }
+      const v = entry.values.get(key) || {
+        labels,
+        count: 0,
+        sum: 0,
+        bucketCounts: buckets.map(() => 0),
+      };
+      v.count += 1;
+      v.sum += Number(value);
+      for (let i = 0; i < buckets.length; i += 1) {
+        if (Number(value) <= buckets[i]) v.bucketCounts[i] += 1;
+      }
+      entry.values.set(key, v);
+    },
+  };
+}
+
+function renderCounters() {
+  const lines = [];
+  for (const [name, entry] of counters) {
+    lines.push(`# HELP ${name} ${entry.help}`);
+    lines.push(`# TYPE ${name} counter`);
+    for (const v of entry.values.values()) {
+      const labels = labelsToString(v.labels);
+      lines.push(`${name}${labels ? '{' + labels + '}' : ''} ${v.value}`);
+    }
+  }
+  return lines;
+}
+
+function renderGauges() {
+  const lines = [];
+  for (const [name, entry] of gauges) {
+    lines.push(`# HELP ${name} ${entry.help}`);
+    lines.push(`# TYPE ${name} gauge`);
+    for (const v of entry.values.values()) {
+      const labels = labelsToString(v.labels);
+      lines.push(`${name}${labels ? '{' + labels + '}' : ''} ${v.value}`);
+    }
+  }
+  return lines;
+}
+
+function renderHistograms() {
+  const lines = [];
+  for (const [name, entry] of histograms) {
+    lines.push(`# HELP ${name} ${entry.help}`);
+    lines.push(`# TYPE ${name} histogram`);
+    for (const v of entry.values.values()) {
+      const baseLabels = labelsToString(v.labels);
+      for (let i = 0; i < entry.buckets.length; i += 1) {
+        const le = entry.buckets[i];
+        const bucketLabels = baseLabels
+          ? `${baseLabels},le="${le}"`
+          : `le="${le}"`;
+        lines.push(`${name}_bucket{${bucketLabels}} ${v.bucketCounts[i]}`);
+      }
+      const infLabels = baseLabels ? `${baseLabels},le="+Inf"` : 'le="+Inf"';
+      lines.push(`${name}_bucket{${infLabels}} ${v.count}`);
+      const sumLabels = baseLabels;
+      lines.push(
+        `${name}_sum${sumLabels ? '{' + sumLabels + '}' : ''} ${v.sum}`,
+      );
+      lines.push(
+        `${name}_count${sumLabels ? '{' + sumLabels + '}' : ''} ${v.count}`,
+      );
+    }
+  }
+  return lines;
+}
+
+export function render() {
+  const parts = [
+    ...renderCounters(),
+    ...renderGauges(),
+    ...renderHistograms(),
+  ];
+  return parts.length === 0 ? '' : `${parts.join('\n')}\n`;
+}
+
+/**
+ * Reset every metric. Intended for tests — never call this from a
+ * long-running server.
+ */
+export function reset() {
+  counters.clear();
+  gauges.clear();
+  histograms.clear();
+}

package/bizar-dash/src/server/routes/backup.mjs

@@ -0,0 +1,112 @@
+/**
+ * src/server/routes/backup.mjs
+ *
+ * v4.8.0 — Backup/restore REST surface.
+ *
+ * Endpoints:
+ *   GET  /api/backup/list              — list available backups
+ *   POST /api/backup/create           — create a new backup
+ *   POST /api/backup/restore          — restore from a backup
+ *   POST /api/backup/verify           — verify backup integrity
+ *   DELETE /api/backup/:path           — delete a backup
+ *   GET  /api/backup/manifest         — get manifest for a backup
+ */
+import { Router } from 'express';
+import { wrap } from './_shared.mjs';
+import {
+  createBackup,
+  listBackups,
+  restoreBackup,
+  deleteBackup,
+  verifyBackup,
+  getManifest,
+} from '../backup-store.mjs';
+
+/**
+ * @param {object} deps
+ * @param {string} deps.projectRoot
+ * @returns {import('express').Router}
+ */
+export function createBackupRouter({ projectRoot }) {
+  const router = Router();
+
+  // GET /api/backup/list
+  router.get('/backup/list', wrap(async (_req, res) => {
+    const backups = await listBackups();
+    res.json({ ok: true, backups });
+  }));
+
+  // POST /api/backup/create
+  router.post('/backup/create', wrap(async (req, res) => {
+    const { label, includeProject } = req.body || {};
+    const result = await createBackup({
+      label: label || null,
+      projectRoot: includeProject ? projectRoot : null,
+    });
+    res.json(result);
+  }));
+
+  // POST /api/backup/restore
+  router.post('/backup/restore', wrap(async (req, res) => {
+    const { backupPath, dryRun, conflictStrategy, includeProject } = req.body || {};
+    if (!backupPath) {
+      const err = new Error('backupPath is required');
+      err.status = 400;
+      err.code = 'bad_request';
+      throw err;
+    }
+    const result = await restoreBackup({
+      backupPath,
+      dryRun: Boolean(dryRun),
+      conflictStrategy: conflictStrategy || 'merge',
+      projectRoot: includeProject ? projectRoot : null,
+    });
+    res.json(result);
+  }));
+
+  // POST /api/backup/verify
+  router.post('/backup/verify', wrap(async (req, res) => {
+    const { backupPath } = req.body || {};
+    if (!backupPath) {
+      const err = new Error('backupPath is required');
+      err.status = 400;
+      err.code = 'bad_request';
+      throw err;
+    }
+    const result = await verifyBackup({ backupPath });
+    res.json(result);
+  }));
+
+  // DELETE /api/backup/:path  (path is url-encoded)
+  router.delete('/backup/:path', wrap(async (req, res) => {
+    const { path: encoded } = req.params;
+    const backupPath = decodeURIComponent(encoded);
+    const result = await deleteBackup({ backupPath });
+    if (!result.ok) {
+      const err = new Error(result.error || 'Delete failed');
+      err.status = 404;
+      throw err;
+    }
+    res.json(result);
+  }));
+
+  // GET /api/backup/manifest
+  router.get('/backup/manifest', wrap(async (req, res) => {
+    const { backupPath } = req.query || {};
+    if (!backupPath) {
+      const err = new Error('backupPath query param is required');
+      err.status = 400;
+      err.code = 'bad_request';
+      throw err;
+    }
+    const result = await getManifest({ backupPath });
+    if (!result.ok) {
+      const err = new Error(result.error || 'Manifest not found');
+      err.status = 404;
+      throw err;
+    }
+    res.json(result);
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/chat.mjs

@@ -22,6 +22,7 @@
  *   - Upstream SSE error: clean up and return without crashing.
  */
 import { Router } from 'express';
+import { warn as logWarn } from '../logger.mjs';
 import {
   existsSync,
   mkdirSync,
@@ -43,6 +44,7 @@ import {
   buildAuthHeader,
 } from '../serve-info.mjs';
 import { wrap } from './_shared.mjs';
+import { createRateLimiter } from '../lib/rate-limit.mjs';
 
 const SESSION_ID_RE = /^[A-Za-z0-9_-]{1,120}$/;
 
@@ -70,9 +72,11 @@ const chatDeltaCounts = new Map(); // chatSessionId -> count since idle
 function noteChatDelta(chatSessionId) {
   const cur = chatDeltaCounts.get(chatSessionId) || 0;
   if (cur >= CHAT_DELTA_BUFFER_CAP) {
-    console.warn(
-      `[chat] dropped delta for session ${chatSessionId}: per-session cap (${CHAT_DELTA_BUFFER_CAP}) exceeded; client is too slow`,
-    );
+    logWarn('dropped delta for session: per-session cap exceeded; client is too slow', {
+      module: 'chat',
+      sessionId: chatSessionId,
+      cap: CHAT_DELTA_BUFFER_CAP,
+    });
     return false;
   }
   chatDeltaCounts.set(chatSessionId, cur + 1);
@@ -92,6 +96,19 @@ function resetChatDeltaCount(chatSessionId) {
 export function createChatRouter({ state, broadcast }) {
   const router = Router();
 
+  // v4.8.0 — Per-IP token bucket. Chat endpoints are the most expensive
+  // thing the dashboard does (each POST kicks off an SSE subscription +
+  // opencode prompt dispatch), so the default budget is conservative:
+  // 60 requests / minute / IP, refilling at 1 token per second.
+  // Operators can tune via BIZAR_RATE_LIMIT_CHAT_CAPACITY /
+  // BIZAR_RATE_LIMIT_CHAT_REFILL.
+  const chatLimiter = createRateLimiter({
+    capacity: parseInt(process.env.BIZAR_RATE_LIMIT_CHAT_CAPACITY || '60', 10),
+    refillPerSecond: parseFloat(process.env.BIZAR_RATE_LIMIT_CHAT_REFILL || '1'),
+    scope: 'chat',
+  });
+  router.use(chatLimiter);
+
   router.get('/chat', wrap(async (req, res) => {
     const sessionId = req.query.session ? String(req.query.session) : null;
     const requestedLimit = req.query.limit ? Number(req.query.limit) : 200;

package/bizar-dash/src/server/routes/digests.mjs

@@ -0,0 +1,82 @@
+/**
+ * src/server/routes/digests.mjs
+ *
+ * /api/digests                          — list digests
+ * /api/digests/generate (POST)          — generate a digest
+ * /api/digests/:path (GET)              — get a specific digest
+ * /api/digests/:path (DELETE)           — delete a digest
+ *
+ * The `:path` parameter is URL-encoded so it survives Express routing.
+ */
+import { Router } from 'express';
+import {
+  generateAndSave,
+  listDigests,
+  getDigest,
+  deleteDigest,
+} from '../digest-store.mjs';
+import { readActiveProjectId, wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} [deps.projectRoot]
+ * @returns {import('express').Router}
+ */
+export function createDigestsRouter({ projectRoot } = {}) {
+  const router = Router();
+
+  // GET /api/digests — list all digests
+  router.get('/digests', wrap(async (req, res) => {
+    const limit = parseInt(req.query.limit, 10) || 20;
+    const digests = await listDigests({ limit });
+    res.json({ digests });
+  }));
+
+  // GET /api/digests/:path — get a single digest by path
+  // The path is double-encoded: first by the client, then by Express.
+  router.get('/digests/*', wrap(async (req, res) => {
+    // Reconstruct the path from the wildcard
+    const rawPath = req.params[0];
+    if (!rawPath) {
+      // This catches /api/digests with no trailing path (should be handled
+      // by the /digests route above, but Express may match this first if the
+      // wildcard is greedy — we handle the list case explicitly).
+      const digests = await listDigests({ limit: 20 });
+      res.json({ digests });
+      return;
+    }
+    const filePath = decodeURIComponent(rawPath);
+    const digest = await getDigest(filePath);
+    if (!digest) {
+      res.status(404).json({ error: 'not_found', message: 'Digest not found' });
+      return;
+    }
+    res.json(digest);
+  }));
+
+  // POST /api/digests/generate — generate a new digest
+  router.post('/digests/generate', wrap(async (req, res) => {
+    const { weekStart, weekEnd, dryRun } = req.body || {};
+    const root = req.body?.projectRoot || projectRoot || process.cwd();
+    const result = await generateAndSave({ weekStart, weekEnd, projectRoot: root, dryRun });
+    res.status(dryRun ? 200 : 201).json(result);
+  }));
+
+  // DELETE /api/digests/* — delete a digest by path
+  router.delete('/digests/*', wrap(async (req, res) => {
+    const rawPath = req.params[0];
+    if (!rawPath) {
+      res.status(400).json({ error: 'bad_request', message: 'Digest path required' });
+      return;
+    }
+    const filePath = decodeURIComponent(rawPath);
+    const result = await deleteDigest(filePath);
+    if (!result.ok) {
+      res.status(404).json({ error: 'not_found', message: result.error || 'Digest not found' });
+      return;
+    }
+    res.status(204).end();
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/lightrag.mjs

@@ -27,6 +27,7 @@ import {
   LIGHTRAG_DEFAULT_EMBEDDING,
 } from '../memory-store.mjs';
 import { resolveLightRAGConfig } from '../memory-lightrag.mjs';
+import { warn as logWarn } from '../logger.mjs';
 import { wrap } from './_shared.mjs';
 
 /**
@@ -128,7 +129,7 @@ export function createLightragRouter({ projectRoot }) {
         const lines = content.split('\n');
         logTail.push(...lines.slice(-30));
       } catch (err) {
-        console.warn('swallowed in lightrag log tail:', err.message);
+        logWarn('swallowed in lightrag log tail', { module: 'lightrag', err: err.message });
       }
     }
 
@@ -136,7 +137,7 @@ export function createLightragRouter({ projectRoot }) {
     try {
       if (existsSync(logFile)) logSize = statSync(logFile).size;
     } catch (err) {
-      console.warn('swallowed in lightrag log stat:', err.message);
+      logWarn('swallowed in lightrag log stat', { module: 'lightrag', err: err.message });
     }
 
     res.json({

package/bizar-dash/src/server/routes/memory.mjs

@@ -14,6 +14,7 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { existsSync, mkdirSync, readFileSync, statSync, readdirSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
+import { warn as logWarn } from '../logger.mjs';
 
 const SERVER_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const memoryStore = await import(`${SERVER_ROOT}/memory-store.mjs`).then((m) => m);
@@ -79,7 +80,7 @@ export function createMemoryRouter({ projectRoot }) {
         const data = JSON.parse(readFileSync(reindexMarker, 'utf8'));
         lastSecretScan = data.attemptedAt || null;
       } catch (err) {
-        console.warn('swallowed in memory reindex marker read:', err.message);
+        logWarn('swallowed in memory reindex marker read', { module: 'memory', err: err.message });
       }
     }
 
@@ -489,7 +490,7 @@ export function createMemoryRouter({ projectRoot }) {
         }
       }
     } catch (err) {
-      console.warn('swallowed in memory conflict scan:', err.message);
+      logWarn('swallowed in memory conflict scan', { module: 'memory', err: err.message });
     }
 
     res.json({ conflicts });
@@ -528,7 +529,7 @@ export function createMemoryRouter({ projectRoot }) {
       const { recordQuery } = await getMemoryLightrag();
       recordQuery(projectRoot, Date.now() - startedAt);
     } catch (err) {
-      console.warn('swallowed in memory recordQuery:', err.message);
+      logWarn('swallowed in memory recordQuery', { module: 'memory', err: err.message });
     }
     res.json({ ok: true, q, lexical, semantic });
   }));
@@ -612,7 +613,7 @@ export function createMemoryRouter({ projectRoot }) {
         const lines = content.split('\n');
         logTail.push(...lines.slice(-30));
       } catch (err) {
-        console.warn('swallowed in memory log tail:', err.message);
+        logWarn('swallowed in memory log tail', { module: 'memory', err: err.message });
       }
     }
 

package/bizar-dash/src/server/routes/misc.mjs

@@ -18,6 +18,7 @@ import { searchStore } from '../search-store.mjs';
 import { tailscaleStore } from '../tailscale-store.mjs';
 import { updateStore } from '../update-store.mjs';
 import { projectsStore } from '../projects-store.mjs';
+import { error as logError } from '../logger.mjs';
 import { wrap } from './_shared.mjs';
 
 /**
@@ -81,7 +82,7 @@ export function createMiscRouter({ state, broadcast }) {
     updateStore.applyWithProgress({
       packages,
       broadcast,
-    }).catch((err) => console.error('[updates] error:', err));
+    }).catch((err) => logError('updates error', { module: 'updates', err: err?.message || String(err) }));
     res.json({ started: true, packages });
   });