@polderlabs/bizar 4.8.0 → 5.0.0

package/bizar-dash/src/server/memory-store.mjs

@@ -706,6 +706,127 @@ export {
 export const LIGHTRAG_DEFAULT_LLM = 'opencode/gpt-5-nano';
 export const LIGHTRAG_DEFAULT_EMBEDDING = 'opencode/text-embedding-3-small';
 
+/**
+ * Build a wikilink link graph from all .md notes in the vault.
+ *
+ * Nodes: one per note (id = relPath, label = title or basename).
+ * Edges: one per wikilink [[Target]] found in note bodies.
+ *
+ * @param {{ projectRoot: string, vaultPath?: string|null, limit?: number }} opts
+ * @returns {{ nodes: Array<{id:string,label:string,type:string,size:number,group:string}>, edges: Array<{source:string,target:string,type:string,weight:number}> }}
+ */
+export function getObsidianLinkGraph({ projectRoot, vaultPath = null, limit = 200 }) {
+  const { vaultRoot } = resolveVault(projectRoot);
+  const root = vaultPath || vaultRoot;
+  const nodesMap = new Map(); // id → node
+  const edges = [];
+
+  // Collect all notes.
+  const notes = listNotesForGraph(root);
+  const sliced = notes.slice(0, limit);
+
+  for (const note of sliced) {
+    if (!nodesMap.has(note.relPath)) {
+      nodesMap.set(note.relPath, {
+        id: note.relPath,
+        label: note.frontmatter?.title || note.relPath.split('/').pop()?.replace(/\.md$/i, '') || note.relPath,
+        type: 'note',
+        size: 1,
+        group: note.relPath.split('/')[0] || 'root',
+      });
+    }
+
+    // Extract wikilinks from body.
+    const WIKILINK_RE = /\[\[([^\]\n|]+?)(?:\|[^\]\n]+?)?(?:#[^\]\n]+?)?\]\]/g;
+    const body = note.body || '';
+    let m;
+    WIKILINK_RE.lastIndex = 0;
+    while ((m = WIKILINK_RE.exec(body)) !== null) {
+      const raw = (m[1] || '').trim();
+      if (!raw) continue;
+      const target = raw.split('#')[0].trim().split('/').pop() || raw;
+      // Resolve to a note id (basename match).
+      const targetId = resolveWikilinkTarget(target, notes);
+      if (targetId && targetId !== note.relPath) {
+        edges.push({
+          source: note.relPath,
+          target: targetId,
+          type: 'links_to',
+          weight: 1,
+        });
+        // Ensure target node exists.
+        if (!nodesMap.has(targetId)) {
+          nodesMap.set(targetId, {
+            id: targetId,
+            label: target,
+            type: 'note',
+            size: 1,
+            group: targetId.split('/')[0] || 'root',
+          });
+        }
+      }
+    }
+  }
+
+  return {
+    nodes: [...nodesMap.values()].slice(0, limit),
+    edges: edges.slice(0, limit * 3),
+  };
+}
+
+/**
+ * List notes from a specific root path (not the project vault root).
+ * Used by getObsidianLinkGraph for scanning arbitrary vaults.
+ */
+function listNotesForGraph(scanRoot) {
+  if (!existsSync(scanRoot)) return [];
+  const out = [];
+  function walk(dir, prefix) {
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); }
+    catch { return; }
+    for (const e of entries) {
+      if (e.name.startsWith('.')) continue;
+      const full = join(dir, e.name);
+      const rel = prefix ? `${prefix}/${e.name}` : e.name;
+      if (e.isDirectory()) {
+        walk(full, rel);
+      } else if (e.name.endsWith('.md')) {
+        try {
+          const raw = readFileSync(full, 'utf8');
+          const { frontmatter, body } = parseFrontmatter(raw);
+          out.push({ relPath: rel, frontmatter, body });
+        } catch { /* skip */ }
+      }
+    }
+  }
+  walk(scanRoot, '');
+  return out;
+}
+
+/**
+ * Resolve a wikilink target (e.g. "My Note" or "subdir/My Note") to a note id.
+ * Uses basename matching (Obsidian semantics).
+ */
+function resolveWikilinkTarget(targetName, notes) {
+  const normalized = targetName.replace(/\.md$/i, '').toLowerCase();
+  // Try exact relPath match first.
+  for (const n of notes) {
+    const base = n.relPath.replace(/\.md$/i, '').toLowerCase();
+    if (base === normalized || base.endsWith('/' + normalized)) {
+      return n.relPath;
+    }
+  }
+  // Fallback: basename-only match.
+  for (const n of notes) {
+    const base = n.relPath.split('/').pop()?.replace(/\.md$/i, '').toLowerCase();
+    if (base === normalized) {
+      return n.relPath;
+    }
+  }
+  return null;
+}
+
 /**
  * Return the effective LightRAG model defaults, applying env-var
  * overrides on top of the built-in opencode-Zen-free defaults.

package/bizar-dash/src/server/ocr.mjs

@@ -0,0 +1,55 @@
+/**
+ * src/server/ocr.mjs
+ *
+ * v5.0.0 — Tesseract.js wrapper for OCR text extraction.
+ *
+ * Provides a single `extractText(imageBuffer, options?)` function.
+ * The worker is created lazily and terminated after each call to avoid
+ * memory leaks in long-running server processes.
+ */
+
+import { createWorker } from 'tesseract.js';
+
+let worker = null;
+
+/**
+ * Extract text from an image buffer using Tesseract.js OCR.
+ *
+ * @param {Buffer} imageBuffer - Raw image data (PNG, JPEG, etc.)
+ * @param {{ lang?: string }} [options] - Recognition options.
+ *   `lang` defaults to 'eng' (English).
+ * @returns {Promise<string>} - The extracted text.
+ */
+export async function extractText(imageBuffer, { lang = 'eng' } = {}) {
+  const w = worker || (worker = await createWorker(lang));
+
+  try {
+    const { data } = await w.recognize(imageBuffer);
+    return (data.text || '').trim();
+  } finally {
+    // Terminate and reset so a new worker picks up any config changes
+    // on the next call. This prevents the worker from accumulating state
+    // across requests in long-running servers.
+    try { await w.terminate(); } catch { /* ignore */ }
+    worker = null;
+  }
+}
+
+/**
+ * Check whether Tesseract.js is available and can be initialised.
+ * Useful for health-check endpoints.
+ *
+ * @returns {Promise<{ ok: boolean, message: string }>}
+ */
+export async function checkOcrHealth() {
+  try {
+    const w = await createWorker('eng');
+    await w.terminate();
+    return { ok: true, message: 'Tesseract.js worker initialised OK' };
+  } catch (err) {
+    return {
+      ok: false,
+      message: `Tesseract.js init failed: ${err instanceof Error ? err.message : String(err)}`,
+    };
+  }
+}

package/bizar-dash/src/server/otel.mjs

@@ -0,0 +1,133 @@
+/**
+ * src/server/otel.mjs
+ *
+ * v4.9.0 — OpenTelemetry distributed tracing for the Bizar dashboard.
+ *
+ * Initialises the NodeSDK with an OTLP HTTP trace exporter and exposes
+ * a single `tracer` instance for ad-hoc spans (chat.send, opencode
+ * session creation, etc). Auto-instrumentation is intentionally not
+ * enabled — the dashboard already has structured logger + Prometheus
+ * for the "what" metrics, so distributed tracing is only interesting
+ * for the multi-step flows where request correlation matters
+ * (chat SSE pump, opencode session creation).
+ *
+ * Off by default. Enable with one of:
+ *   BIZAR_OTEL=1
+ *   OTEL_ENABLED=1
+ *   OTEL_EXPORTER_OTLP_ENDPOINT=http://collector:4318/v1/traces   (also opts in)
+ *
+ * `shutdownOtel()` flushes any pending spans and tears down the SDK.
+ * It is idempotent and safe to call multiple times — subsequent calls
+ * are a no-op once the SDK has been shut down.
+ *
+ * The NodeSDK constructor is wrapped in try/catch so that a malformed
+ * OTLP endpoint or missing optional binding (e.g. test runs that
+ * import this module but never call `initOtel`) does not crash the
+ * dashboard.
+ */
+import { NodeSDK } from '@opentelemetry/sdk-node';
+import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
+import { Resource } from '@opentelemetry/resources';
+import { SemanticResourceAttributes } from '@opentelemetry/semantic-conventions';
+import { trace } from '@opentelemetry/api';
+import { info as logInfo, warn as logWarn } from './logger.mjs';
+
+const DEFAULT_OTLP_ENDPOINT = 'http://localhost:4318/v1/traces';
+const SERVICE_NAME = 'bizar-dash';
+const TRACER_NAME = 'bizar-dash';
+const TRACER_VERSION = '0.1.0';
+
+let sdk = null;
+let shuttingDown = false;
+
+/**
+ * The shared tracer used by route handlers. Bound to the global
+ * tracer provider — when OTEL is not enabled this resolves to a
+ * no-op tracer (a `startActiveSpan` call still returns a valid span
+ * object whose methods are all no-ops), so route handlers do not
+ * need a feature flag of their own.
+ */
+export const tracer = trace.getTracer(TRACER_NAME, TRACER_VERSION);
+
+/**
+ * Initialise the NodeSDK with an OTLP HTTP trace exporter. Safe to
+ * call multiple times — the second call returns the cached SDK.
+ *
+ * `npm_package_version` is set by `npm run` contexts; in any other
+ * context we fall back to '0.0.0'. The version is informational
+ * (the OTLP collector shows it in the resource panel), so failing to
+ * read it is never a startup blocker.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.serviceName]  Override SERVICE_NAME (default 'bizar-dash')
+ * @param {string} [opts.endpoint]     OTLP HTTP traces endpoint
+ * @returns {object|null}              The NodeSDK instance, or null on failure
+ */
+export function initOtel({
+  serviceName = SERVICE_NAME,
+  endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT || DEFAULT_OTLP_ENDPOINT,
+} = {}) {
+  if (sdk) return sdk;
+  if (shuttingDown) return null;
+  try {
+    sdk = new NodeSDK({
+      resource: new Resource({
+        [SemanticResourceAttributes.SERVICE_NAME]: serviceName,
+        [SemanticResourceAttributes.SERVICE_VERSION]:
+          process.env.npm_package_version || '0.0.0',
+      }),
+      traceExporter: new OTLPTraceExporter({ url: endpoint }),
+    });
+    sdk.start();
+    logInfo('OpenTelemetry initialised', {
+      module: 'otel',
+      serviceName,
+      endpoint,
+    });
+    return sdk;
+  } catch (err) {
+    logWarn('OpenTelemetry init failed; continuing without tracing', {
+      module: 'otel',
+      err: err?.message || String(err),
+    });
+    sdk = null;
+    return null;
+  }
+}
+
+/**
+ * Flush pending spans and shut down the SDK. Idempotent.
+ *
+ * Designed to be wired into the dashboard's SIGTERM/SIGINT handler
+ * so spans in flight at shutdown are not silently dropped. Tests
+ * call this between scenarios to keep registry state clean.
+ *
+ * @returns {Promise<void>}
+ */
+export async function shutdownOtel() {
+  if (!sdk) return;
+  if (shuttingDown) return;
+  shuttingDown = true;
+  try {
+    await sdk.shutdown();
+  } catch (err) {
+    logWarn('OpenTelemetry shutdown failed', {
+      module: 'otel',
+      err: err?.message || String(err),
+    });
+  } finally {
+    sdk = null;
+    shuttingDown = false;
+  }
+}
+
+/**
+ * Test-only: return whether the SDK is currently initialised. Lets
+ * tests assert that initOtel really did instantiate the SDK without
+ * having to introspect private state from outside.
+ *
+ * @returns {boolean}
+ */
+export function isOtelEnabled() {
+  return sdk !== null;
+}

package/bizar-dash/src/server/plugins/registry.mjs

@@ -0,0 +1,363 @@
+/**
+ * src/server/plugins/registry.mjs
+ *
+ * v5.0.0 — Plugin marketplace registry client.
+ *
+ * The marketplace registry is a single JSON document served over HTTP
+ * (default: raw.githubusercontent.com) listing every installable plugin.
+ * We fetch + parse + validate the shape, then cache the parsed value
+ * for an hour so a dashboard boot doesn't hammer GitHub.
+ *
+ * Shape (see README for the full schema):
+ *   {
+ *     "version": 1,
+ *     "updatedAt": "2026-...",
+ *     "plugins": [
+ *       {
+ *         "id": "vercel-deploy",
+ *         "name": "Vercel Deploy",
+ *         "version": "1.0.0",
+ *         "description": "...",
+ *         "author": "...",
+ *         "category": "deploy",
+ *         "tags": ["vercel", "deploy"],
+ *         "homepage": "https://...",
+ *         "tarball": "https://.../vercel-deploy-1.0.0.tar.gz",
+ *         "checksum": "sha256:abcdef...",
+ *         "permissions": ["net", "fs:read"],
+ *         "minBizarVersion": "4.9.0"
+ *       }
+ *     ]
+ *   }
+ */
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+
+/**
+ * Default registry URL. Override with `BIZAR_REGISTRY_URL` env var.
+ *
+ * Raw GitHub is intentional: the registry is small, static, and
+ * versioned by commit (we point to `main/registry.json`). For private
+ * deployments, point this at an internal CDN or S3 bucket.
+ */
+const DEFAULT_REGISTRY_URL =
+  'https://raw.githubusercontent.com/DrB0rk/bizar-plugins/main/registry.json';
+
+/** How long a cached registry is considered fresh. */
+const CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
+
+/**
+ * In-memory cache shared across all callers in this process. Tests
+ * can call `__resetCache()` to force a re-fetch.
+ */
+let _cache = null; // { fetchedAt: number, url: string, data: RegistryShape }
+
+/**
+ * Resolve the registry URL: explicit override > env > default.
+ *
+ * @param {string} [override]
+ * @returns {string}
+ */
+export function getRegistryUrl(override) {
+  if (typeof override === 'string' && override.trim()) return override.trim();
+  if (process.env.BIZAR_REGISTRY_URL && process.env.BIZAR_REGISTRY_URL.trim()) {
+    return process.env.BIZAR_REGISTRY_URL.trim();
+  }
+  return DEFAULT_REGISTRY_URL;
+}
+
+/**
+ * Validate the parsed registry JSON shape. Throws a structured Error
+ * (`.code = 'invalid_registry'`) on any required-field violation. We
+ * are deliberately lenient on optional fields — missing `tags`,
+ * `homepage`, etc. are fine.
+ *
+ * @param {unknown} data
+ * @returns {RegistryShape}
+ */
+export function validateRegistry(data) {
+  if (!data || typeof data !== 'object') {
+    const err = new Error('registry root must be an object');
+    err.code = 'invalid_registry';
+    throw err;
+  }
+  const root = /** @type {any} */ (data);
+  if (root.version !== 1) {
+    const err = new Error(`registry.version must be 1 (got ${root.version})`);
+    err.code = 'invalid_registry';
+    throw err;
+  }
+  if (typeof root.updatedAt !== 'string') {
+    const err = new Error('registry.updatedAt must be a string');
+    err.code = 'invalid_registry';
+    throw err;
+  }
+  if (!Array.isArray(root.plugins)) {
+    const err = new Error('registry.plugins must be an array');
+    err.code = 'invalid_registry';
+    throw err;
+  }
+  /** @type {string[]} */
+  const seenIds = new Set();
+  for (let i = 0; i < root.plugins.length; i++) {
+    const p = root.plugins[i];
+    if (!p || typeof p !== 'object') {
+      const err = new Error(`registry.plugins[${i}] must be an object`);
+      err.code = 'invalid_registry';
+      throw err;
+    }
+    if (typeof p.id !== 'string' || !/^[a-z0-9][a-z0-9-]*$/.test(p.id)) {
+      const err = new Error(
+        `registry.plugins[${i}].id must be a kebab-case string (got ${JSON.stringify(p.id)})`,
+      );
+      err.code = 'invalid_registry';
+      throw err;
+    }
+    if (seenIds.has(p.id)) {
+      const err = new Error(`registry.plugins[${i}].id "${p.id}" is duplicated`);
+      err.code = 'invalid_registry';
+      throw err;
+    }
+    seenIds.add(p.id);
+    for (const required of ['name', 'version', 'tarball', 'checksum']) {
+      if (typeof p[required] !== 'string' || !p[required]) {
+        const err = new Error(
+          `registry.plugins[${i}].${required} must be a non-empty string`,
+        );
+        err.code = 'invalid_registry';
+        throw err;
+      }
+    }
+    if (typeof p.tarball !== 'string' || !/^https?:\/\//.test(p.tarball)) {
+      const err = new Error(
+        `registry.plugins[${i}].tarball must be an http(s) URL (got ${JSON.stringify(p.tarball)})`,
+      );
+      err.code = 'invalid_registry';
+      throw err;
+    }
+    if (typeof p.checksum !== 'string' || !/^sha256:[a-f0-9]{64}$/.test(p.checksum)) {
+      const err = new Error(
+        `registry.plugins[${i}].checksum must be sha256:<64-hex> (got ${JSON.stringify(p.checksum)})`,
+      );
+      err.code = 'invalid_registry';
+      throw err;
+    }
+    if (!Array.isArray(p.permissions)) {
+      const err = new Error(
+        `registry.plugins[${i}].permissions must be an array`,
+      );
+      err.code = 'invalid_registry';
+      throw err;
+    }
+  }
+  return /** @type {RegistryShape} */ (root);
+}
+
+/**
+ * Fetch the registry, returning the validated parsed shape.
+ *
+ * Cache: in-memory for 1 hour per URL. A `force: true` option bypasses
+ * the cache (used by the `update` CLI subcommand).
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.url]   override the URL (default: env/default)
+ * @param {boolean} [opts.force] skip the cache
+ * @param {typeof globalThis.fetch} [opts.fetch] fetch override (tests)
+ * @returns {Promise<RegistryShape>}
+ */
+export async function fetchRegistry({ url, force = false, fetch: fetchImpl } = {}) {
+  const resolvedUrl = getRegistryUrl(url);
+  const now = Date.now();
+  if (
+    !force &&
+    _cache &&
+    _cache.url === resolvedUrl &&
+    now - _cache.fetchedAt < CACHE_TTL_MS
+  ) {
+    return _cache.data;
+  }
+  const fetchFn = fetchImpl || globalThis.fetch;
+  if (typeof fetchFn !== 'function') {
+    throw new Error('fetch is not available in this runtime');
+  }
+  let res;
+  try {
+    res = await fetchFn(resolvedUrl, {
+      headers: { 'User-Agent': 'bizar-registry-client/5.0' },
+    });
+  } catch (err) {
+    const wrap = new Error(
+      `registry fetch failed for ${resolvedUrl}: ${err.message}`,
+    );
+    wrap.code = 'registry_unreachable';
+    wrap.cause = err;
+    throw wrap;
+  }
+  if (!res.ok) {
+    const err = new Error(
+      `registry fetch returned ${res.status} ${res.statusText} from ${resolvedUrl}`,
+    );
+    err.code = 'registry_unreachable';
+    err.status = res.status;
+    throw err;
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch (err) {
+    const wrap = new Error(
+      `registry at ${resolvedUrl} is not valid JSON: ${err.message}`,
+    );
+    wrap.code = 'invalid_registry';
+    wrap.cause = err;
+    throw wrap;
+  }
+  const validated = validateRegistry(json);
+  _cache = { fetchedAt: now, url: resolvedUrl, data: validated };
+  return validated;
+}
+
+/**
+ * Reset the in-memory cache. Tests use this to force a re-fetch after
+ * stubbing globalThis.fetch. Production code shouldn't need it.
+ */
+export function __resetCache() {
+  _cache = null;
+}
+
+/**
+ * Normalize a string for fuzzy search comparison. Lowercases, strips
+ * punctuation, collapses whitespace.
+ *
+ * @param {string} s
+ */
+function normalize(s) {
+  return String(s || '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, ' ')
+    .trim();
+}
+
+/**
+ * Does the plugin match the query? Match is by substring on name +
+ * description + id, after normalization. Empty query matches all.
+ *
+ * @param {RegistryPlugin} plugin
+ * @param {string} query
+ */
+function matchesQuery(plugin, query) {
+  if (!query) return true;
+  const n = normalize(query);
+  const haystack = `${plugin.id} ${plugin.name} ${plugin.description || ''} ${(plugin.tags || []).join(' ')}`;
+  const h = normalize(haystack);
+  // Substring match is enough for a v1 marketplace. v2 can swap in fuse.js.
+  return h.includes(n);
+}
+
+/**
+ * Search the registry. Returns the matching plugins in registry order.
+ *
+ * @param {string} [query]
+ * @param {object} [opts]
+ * @param {string} [opts.category] filter by exact category
+ * @param {string} [opts.tag]      filter by tag (exact)
+ * @param {string} [opts.url]      registry URL override
+ * @returns {Promise<RegistryPlugin[]>}
+ */
+export async function searchPlugins(query = '', opts = {}) {
+  const registry = await fetchRegistry({ url: opts.url });
+  const { category, tag } = opts;
+  return registry.plugins.filter((p) => {
+    if (category && p.category !== category) return false;
+    if (tag && !(Array.isArray(p.tags) && p.tags.includes(tag))) return false;
+    if (!matchesQuery(p, query)) return false;
+    return true;
+  });
+}
+
+/**
+ * Get a single plugin by id from the registry. Returns null if not found.
+ *
+ * @param {string} id
+ * @param {object} [opts]
+ * @param {string} [opts.url]
+ * @param {typeof globalThis.fetch} [opts.fetch]  override fetch (tests)
+ * @returns {Promise<RegistryPlugin | null>}
+ */
+export async function getPlugin(id, opts = {}) {
+  if (!id || typeof id !== 'string') return null;
+  const registry = await fetchRegistry({ url: opts.url, fetch: opts.fetch });
+  return registry.plugins.find((p) => p.id === id) || null;
+}
+
+/**
+ * Stream a file from disk, compute its SHA-256, and compare against the
+ * expected `<algo>:<hex>` string. Returns true on match, false on
+ * mismatch. Throws on unsupported algorithm or file-read error.
+ *
+ * The expected format is `sha256:<64-lowercase-hex>`. Other algorithms
+ * are rejected up front rather than silently miscomputed.
+ *
+ * @param {string} filePath
+ * @param {string} expected  e.g. "sha256:abc..."
+ * @returns {Promise<boolean>}
+ */
+export function verifyChecksum(filePath, expected) {
+  return new Promise((resolveP, rejectP) => {
+    if (typeof expected !== 'string' || !expected.includes(':')) {
+      rejectP(new Error(`checksum must be <algo>:<hex> (got ${JSON.stringify(expected)})`));
+      return;
+    }
+    const [algo, expectedHex] = expected.split(':', 2);
+    if (algo !== 'sha256') {
+      rejectP(new Error(`only sha256 checksums are supported (got "${algo}")`));
+      return;
+    }
+    if (!/^[a-f0-9]{64}$/.test(expectedHex)) {
+      rejectP(new Error(`sha256 checksum must be 64 lowercase hex chars`));
+      return;
+    }
+    const hash = createHash('sha256');
+    const stream = createReadStream(filePath);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('error', (err) => rejectP(err));
+    stream.on('end', () => {
+      const actual = hash.digest('hex');
+      resolveP(actual === expectedHex);
+    });
+  });
+}
+
+/**
+ * @typedef {{
+ *   id: string,
+ *   name: string,
+ *   version: string,
+ *   description?: string,
+ *   author?: string,
+ *   category?: string,
+ *   tags?: string[],
+ *   homepage?: string,
+ *   tarball: string,
+ *   checksum: string,
+ *   permissions: string[],
+ *   minBizarVersion?: string
+ * }} RegistryPlugin
+ *
+ * @typedef {{
+ *   version: number,
+ *   updatedAt: string,
+ *   plugins: RegistryPlugin[]
+ * }} RegistryShape
+ */
+
+// Export the symbol type aliases for downstream tooling.
+export const __types = /** @type {{
+  RegistryPlugin: null,
+  RegistryShape: null,
+}} */ ({});
+
+export const __testing = {
+  CACHE_TTL_MS,
+  DEFAULT_REGISTRY_URL,
+};