@polderlabs/bizar 4.7.0 → 4.7.2

package/bizar-dash/src/server/routes/backup.mjs

@@ -0,0 +1,112 @@
+/**
+ * src/server/routes/backup.mjs
+ *
+ * v4.8.0 — Backup/restore REST surface.
+ *
+ * Endpoints:
+ *   GET  /api/backup/list              — list available backups
+ *   POST /api/backup/create           — create a new backup
+ *   POST /api/backup/restore          — restore from a backup
+ *   POST /api/backup/verify           — verify backup integrity
+ *   DELETE /api/backup/:path           — delete a backup
+ *   GET  /api/backup/manifest         — get manifest for a backup
+ */
+import { Router } from 'express';
+import { wrap } from './_shared.mjs';
+import {
+  createBackup,
+  listBackups,
+  restoreBackup,
+  deleteBackup,
+  verifyBackup,
+  getManifest,
+} from '../backup-store.mjs';
+
+/**
+ * @param {object} deps
+ * @param {string} deps.projectRoot
+ * @returns {import('express').Router}
+ */
+export function createBackupRouter({ projectRoot }) {
+  const router = Router();
+
+  // GET /api/backup/list
+  router.get('/backup/list', wrap(async (_req, res) => {
+    const backups = await listBackups();
+    res.json({ ok: true, backups });
+  }));
+
+  // POST /api/backup/create
+  router.post('/backup/create', wrap(async (req, res) => {
+    const { label, includeProject } = req.body || {};
+    const result = await createBackup({
+      label: label || null,
+      projectRoot: includeProject ? projectRoot : null,
+    });
+    res.json(result);
+  }));
+
+  // POST /api/backup/restore
+  router.post('/backup/restore', wrap(async (req, res) => {
+    const { backupPath, dryRun, conflictStrategy, includeProject } = req.body || {};
+    if (!backupPath) {
+      const err = new Error('backupPath is required');
+      err.status = 400;
+      err.code = 'bad_request';
+      throw err;
+    }
+    const result = await restoreBackup({
+      backupPath,
+      dryRun: Boolean(dryRun),
+      conflictStrategy: conflictStrategy || 'merge',
+      projectRoot: includeProject ? projectRoot : null,
+    });
+    res.json(result);
+  }));
+
+  // POST /api/backup/verify
+  router.post('/backup/verify', wrap(async (req, res) => {
+    const { backupPath } = req.body || {};
+    if (!backupPath) {
+      const err = new Error('backupPath is required');
+      err.status = 400;
+      err.code = 'bad_request';
+      throw err;
+    }
+    const result = await verifyBackup({ backupPath });
+    res.json(result);
+  }));
+
+  // DELETE /api/backup/:path  (path is url-encoded)
+  router.delete('/backup/:path', wrap(async (req, res) => {
+    const { path: encoded } = req.params;
+    const backupPath = decodeURIComponent(encoded);
+    const result = await deleteBackup({ backupPath });
+    if (!result.ok) {
+      const err = new Error(result.error || 'Delete failed');
+      err.status = 404;
+      throw err;
+    }
+    res.json(result);
+  }));
+
+  // GET /api/backup/manifest
+  router.get('/backup/manifest', wrap(async (req, res) => {
+    const { backupPath } = req.query || {};
+    if (!backupPath) {
+      const err = new Error('backupPath query param is required');
+      err.status = 400;
+      err.code = 'bad_request';
+      throw err;
+    }
+    const result = await getManifest({ backupPath });
+    if (!result.ok) {
+      const err = new Error(result.error || 'Manifest not found');
+      err.status = 404;
+      throw err;
+    }
+    res.json(result);
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/chat.mjs

@@ -44,6 +44,7 @@ import {
   buildAuthHeader,
 } from '../serve-info.mjs';
 import { wrap } from './_shared.mjs';
+import { createRateLimiter } from '../lib/rate-limit.mjs';
 
 const SESSION_ID_RE = /^[A-Za-z0-9_-]{1,120}$/;
 
@@ -95,6 +96,19 @@ function resetChatDeltaCount(chatSessionId) {
 export function createChatRouter({ state, broadcast }) {
   const router = Router();
 
+  // v4.8.0 — Per-IP token bucket. Chat endpoints are the most expensive
+  // thing the dashboard does (each POST kicks off an SSE subscription +
+  // opencode prompt dispatch), so the default budget is conservative:
+  // 60 requests / minute / IP, refilling at 1 token per second.
+  // Operators can tune via BIZAR_RATE_LIMIT_CHAT_CAPACITY /
+  // BIZAR_RATE_LIMIT_CHAT_REFILL.
+  const chatLimiter = createRateLimiter({
+    capacity: parseInt(process.env.BIZAR_RATE_LIMIT_CHAT_CAPACITY || '60', 10),
+    refillPerSecond: parseFloat(process.env.BIZAR_RATE_LIMIT_CHAT_REFILL || '1'),
+    scope: 'chat',
+  });
+  router.use(chatLimiter);
+
   router.get('/chat', wrap(async (req, res) => {
     const sessionId = req.query.session ? String(req.query.session) : null;
     const requestedLimit = req.query.limit ? Number(req.query.limit) : 200;

package/bizar-dash/src/server/routes/digests.mjs

@@ -0,0 +1,82 @@
+/**
+ * src/server/routes/digests.mjs
+ *
+ * /api/digests                          — list digests
+ * /api/digests/generate (POST)          — generate a digest
+ * /api/digests/:path (GET)              — get a specific digest
+ * /api/digests/:path (DELETE)           — delete a digest
+ *
+ * The `:path` parameter is URL-encoded so it survives Express routing.
+ */
+import { Router } from 'express';
+import {
+  generateAndSave,
+  listDigests,
+  getDigest,
+  deleteDigest,
+} from '../digest-store.mjs';
+import { readActiveProjectId, wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} [deps.projectRoot]
+ * @returns {import('express').Router}
+ */
+export function createDigestsRouter({ projectRoot } = {}) {
+  const router = Router();
+
+  // GET /api/digests — list all digests
+  router.get('/digests', wrap(async (req, res) => {
+    const limit = parseInt(req.query.limit, 10) || 20;
+    const digests = await listDigests({ limit });
+    res.json({ digests });
+  }));
+
+  // GET /api/digests/:path — get a single digest by path
+  // The path is double-encoded: first by the client, then by Express.
+  router.get('/digests/*', wrap(async (req, res) => {
+    // Reconstruct the path from the wildcard
+    const rawPath = req.params[0];
+    if (!rawPath) {
+      // This catches /api/digests with no trailing path (should be handled
+      // by the /digests route above, but Express may match this first if the
+      // wildcard is greedy — we handle the list case explicitly).
+      const digests = await listDigests({ limit: 20 });
+      res.json({ digests });
+      return;
+    }
+    const filePath = decodeURIComponent(rawPath);
+    const digest = await getDigest(filePath);
+    if (!digest) {
+      res.status(404).json({ error: 'not_found', message: 'Digest not found' });
+      return;
+    }
+    res.json(digest);
+  }));
+
+  // POST /api/digests/generate — generate a new digest
+  router.post('/digests/generate', wrap(async (req, res) => {
+    const { weekStart, weekEnd, dryRun } = req.body || {};
+    const root = req.body?.projectRoot || projectRoot || process.cwd();
+    const result = await generateAndSave({ weekStart, weekEnd, projectRoot: root, dryRun });
+    res.status(dryRun ? 200 : 201).json(result);
+  }));
+
+  // DELETE /api/digests/* — delete a digest by path
+  router.delete('/digests/*', wrap(async (req, res) => {
+    const rawPath = req.params[0];
+    if (!rawPath) {
+      res.status(400).json({ error: 'bad_request', message: 'Digest path required' });
+      return;
+    }
+    const filePath = decodeURIComponent(rawPath);
+    const result = await deleteDigest(filePath);
+    if (!result.ok) {
+      res.status(404).json({ error: 'not_found', message: result.error || 'Digest not found' });
+      return;
+    }
+    res.status(204).end();
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes-v2/events.mjs

@@ -14,10 +14,24 @@
  */
 
 import express from 'express';
+import { createRateLimiter } from '../lib/rate-limit.mjs';
 
 export function createV2EventsRouter({ eventBus }) {
   const router = express.Router();
 
+  // v4.8.0 — Per-IP token bucket. The v2 event endpoint accepts
+  // arbitrary publishes from the opencode plugin, so we cap it
+  // higher than chat to keep automation pipelines flowing under
+  // burst. Defaults: 120 requests / minute / IP, 2 tokens/sec refill.
+  // Operators can tune via BIZAR_RATE_LIMIT_EVENT_CAPACITY /
+  // BIZAR_RATE_LIMIT_EVENT_REFILL.
+  const eventLimiter = createRateLimiter({
+    capacity: parseInt(process.env.BIZAR_RATE_LIMIT_EVENT_CAPACITY || '120', 10),
+    refillPerSecond: parseFloat(process.env.BIZAR_RATE_LIMIT_EVENT_REFILL || '2'),
+    scope: 'event',
+  });
+  router.use(eventLimiter);
+
   router.get('/event', (req, res) => {
     res.status(200);
     res.setHeader('Content-Type', 'text/event-stream');

package/bizar-dash/src/server/schedules-runner.mjs

@@ -23,6 +23,7 @@ import { homedir } from 'node:os';
 import { isIP } from 'node:net';
 import { projectsStore } from './projects-store.mjs';
 import { schedulesStore } from './schedules-store.mjs';
+import { Cron } from 'croner';
 
 const HOME = homedir();
 const LOG_DIR = join(HOME, '.config', 'bizar');
@@ -30,6 +31,97 @@ const LOG_FILE = join(LOG_DIR, 'service.log');
 const ALLOW_PRIVATE_WEBHOOKS = process.env.BIZAR_DASHBOARD_ALLOW_PRIVATE_WEBHOOKS === '1';
 const SHELL_META = /[;&|`$<>\n\r]/;
 
+// ── Internal schedules ─────────────────────────────────────────────────────
+//
+// v4.8.0 — Builtin schedules registered at module load. These are NOT
+// persisted in the schedules-store; they live in-memory here and are
+// checked alongside the project schedules during tick(). When a builtin
+// schedule fires, the runner dispatches directly to the handler without
+// going through the task delegator or action runner.
+
+/** @type {Array<{ id: string, name: string, schedule: string, type: string, timezone: string, enabled: boolean, builtin: boolean, handler?: Function, lastRun: string|null, nextRun: string|null }>} */
+const internalSchedules = [];
+
+/**
+ * Register an internal schedule that is evaluated during tick().
+ *
+ * @param {object} spec
+ * @param {string} spec.id
+ * @param {string} spec.name
+ * @param {string} spec.cron      — cron expression
+ * @param {string} [spec.timezone='UTC']
+ * @param {Function} [spec.handler] — optional direct-call handler for builtin schedules
+ */
+export function registerInternalSchedule(spec) {
+  const tz = spec.timezone || 'UTC';
+  let nextRun = null;
+  if (spec.cron) {
+    try {
+      const job = new Cron(spec.cron, { timezone: tz });
+      const n = job.nextRun();
+      nextRun = n ? n.toISOString() : null;
+    } catch { /* invalid cron */ }
+  }
+  // Remove existing entry with same id (for hot-reload)
+  const existing = internalSchedules.findIndex((s) => s.id === spec.id);
+  const entry = {
+    id: spec.id,
+    name: spec.name || spec.id,
+    schedule: spec.cron || '',
+    type: 'cron',
+    timezone: tz,
+    enabled: true,
+    builtin: true,
+    handler: spec.handler || null,
+    lastRun: null,
+    nextRun,
+  };
+  if (existing >= 0) {
+    internalSchedules[existing] = { ...internalSchedules[existing], ...entry };
+  } else {
+    internalSchedules.push(entry);
+  }
+}
+
+/**
+ * Recompute nextRun for all internal schedules (called on system clock
+ * changes or after midnight).
+ */
+export function recomputeInternalSchedules() {
+  for (const s of internalSchedules) {
+    if (s.type === 'cron' && s.schedule) {
+      try {
+        const job = new Cron(s.schedule, { timezone: s.timezone || 'UTC' });
+        const n = job.nextRun();
+        s.nextRun = n ? n.toISOString() : null;
+      } catch {
+        s.nextRun = null;
+      }
+    }
+  }
+}
+
+// v4.8.0 — Auto-register the weekly digest cron at module load.
+registerInternalSchedule({
+  id: 'bizar-internal-weekly-digest',
+  name: 'Weekly digest',
+  cron: '0 0 * * 0',
+  timezone: 'UTC',
+  handler: async () => {
+    logLine('[digest] Weekly digest cron fired — generating…');
+    try {
+      const { generateAndSave } = await import('./digest-store.mjs');
+      const projectRoot = process.env.BIZAR_PROJECT_ROOT || process.cwd();
+      const result = await generateAndSave({ projectRoot });
+      logLine(`[digest] Weekly digest generated: ${result.weekStart} (${result.saveResult.paths.length} file(s))`);
+      return { ok: true, result };
+    } catch (err) {
+      logLine(`[digest] Weekly digest generation failed: ${err.message}`);
+      return { ok: false, error: err.message };
+    }
+  },
+});
+
 function logLine(line) {
   try {
     mkdirSync(LOG_DIR, { recursive: true });
@@ -292,6 +384,8 @@ export const schedulesRunner = {
       console.warn('swallowed in schedules due-list:', err.message);
     }
     let skipped = 0;
+
+    // Project schedules
     for (const projectId of projectIds) {
       const due = schedulesStore.due(projectId, Date.now());
       for (const sched of due) {
@@ -300,6 +394,38 @@ export const schedulesRunner = {
         fired.push({ projectId, scheduleId: sched.id, ...result });
       }
     }
+
+    // v4.8.0 — Internal (builtin) schedules
+    const now = Date.now();
+    for (const sched of internalSchedules) {
+      if (!sched.enabled) continue;
+      if (!sched.nextRun) continue;
+      if (new Date(sched.nextRun).getTime() > now) continue;
+      const startedAt = new Date().toISOString();
+      logLine(`[${startedAt}] run internal ${sched.id} (${sched.name})`);
+      try {
+        if (typeof sched.handler === 'function') {
+          const res = await sched.handler();
+          sched.lastRun = new Date().toISOString();
+          // Recompute nextRun
+          if (sched.schedule) {
+            try {
+              const job = new Cron(sched.schedule, { timezone: sched.timezone || 'UTC' });
+              const n = job.nextRun();
+              sched.nextRun = n ? n.toISOString() : null;
+            } catch {
+              sched.nextRun = null;
+            }
+          }
+          logLine(`[${new Date().toISOString()}] done internal ${sched.id} → ${res.ok ? 'success' : 'error'}`);
+          fired.push({ projectId: 'internal', scheduleId: sched.id, ok: res.ok, runResult: res });
+        }
+      } catch (err) {
+        logLine(`[${new Date().toISOString()}] failed internal ${sched.id}: ${err.message}`);
+        fired.push({ projectId: 'internal', scheduleId: sched.id, ok: false, runResult: { error: err.message } });
+      }
+    }
+
     if (skipped > 0) {
       logLine(`[schedule] tick: ${skipped} skipped by budget pre-flight`);
     }

package/bizar-dash/src/server/server.mjs

@@ -40,6 +40,7 @@ import { V2EventBus } from './v2-event-bus.mjs';
 import { loadOrCreateAuth, V2_DEFAULT_PORT } from './v2-auth-file.mjs';
 import { createV2Router } from './routes-v2/index.mjs';
 import { counter, gauge, render as renderMetrics } from './metrics.mjs';
+import { warn } from './logger.mjs';
 
 // v4.7.0 — Prometheus-style HTTP metrics. Bound to the server-wide
 // registry; render() emits the text exposition format consumed by
@@ -190,6 +191,13 @@ export async function createServer({
   // `unmatched` for 404s so the cardinality stays bounded. Hooked off
   // `finish` so the final status code is captured even after error
   // handlers run.
+  //
+  // v4.8.0 — When the status is 429, also emit a structured warning
+  // so operators can see when an IP is being throttled. The scope
+  // comes from the X-RateLimit-Scope header set by the per-route
+  // limiter middleware (chat / event); if no scope header is
+  // present, log the 429 with scope=unknown (it may be an upstream
+  // 429 proxied from the opencode plugin).
   app.use((req, res, next) => {
     res.on('finish', () => {
       const route = req.route?.path ? `${req.baseUrl || ''}${req.route.path}` : 'unmatched';
@@ -198,6 +206,15 @@ export async function createServer({
         route,
         status: String(res.statusCode),
       });
+      if (res.statusCode === 429) {
+        const scope = res.getHeader('X-RateLimit-Scope') || 'unknown';
+        warn('rate_limit_exceeded', {
+          ip: req.ip || (req.socket && req.socket.remoteAddress) || 'unknown',
+          scope,
+          method: req.method,
+          route,
+        });
+      }
     });
     next();
   });

package/bizar-dash/src/web/App.tsx

@@ -715,6 +715,13 @@ function Shell() {
 
   return (
     <div className="app" data-layout={layout} data-active-tab={activeTab}>
+      {/* v4.8.0 — WCAG 2.2 AA: skip-to-main-content link. Hidden visually
+          until focused; clicking moves keyboard focus past the nav into
+          the active view. Screen readers and keyboard users can jump
+          past the topbar + sidebar without tabbing through every tab. */}
+      <a className="skip-to-main" href="#main-content">
+        Skip to main content
+      </a>
       {showHeader && (
         <Topbar
           activeTab={activeTab}
@@ -769,7 +776,7 @@ function Shell() {
             onTabChange={setActiveTab}
           />
         )}
-        <main className="content">
+        <main className="content" id="main-content" tabIndex={-1}>
           {bootError && (
             <div className="boot-error">
               <h2>Dashboard unavailable</h2>