@polderlabs/bizar 4.9.0 → 5.0.0

package/cli/commands/workspace.mjs

@@ -0,0 +1,247 @@
+/**
+ * cli/commands/workspace.mjs
+ *
+ * v5.0.0 — Workspace management CLI — talks to the running dashboard's HTTP API.
+ */
+import chalk from 'chalk';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+const HOME = homedir();
+
+// ── Config dir helper ──────────────────────────────────────────────────────────
+
+function getBizarConfigDir() {
+  if (process.platform === 'win32') {
+    return process.env.APPDATA
+      ? join(process.env.APPDATA, 'bizar')
+      : join(homedir(), '.config', 'bizar');
+  }
+  return process.env.XDG_CONFIG_HOME
+    ? join(process.env.XDG_CONFIG_HOME, 'bizar')
+    : join(homedir(), '.config', 'bizar');
+}
+
+function getDashboardPort() {
+  const portFile = join(getBizarConfigDir(), 'dashboard.port');
+  try {
+    const port = parseInt(readFileSync(portFile, 'utf8').trim(), 10);
+    if (Number.isFinite(port) && port > 0) return port;
+  } catch {
+    /* fall through */
+  }
+  return null;
+}
+
+// ── API helpers ───────────────────────────────────────────────────────────────
+
+async function postJson(baseUrl, path, body) {
+  const res = await fetch(`${baseUrl}${path}`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body || {}),
+  });
+  const text = await res.text();
+  let json = null;
+  try { json = text ? JSON.parse(text) : null; } catch { /* keep raw */ }
+  if (!res.ok) {
+    const msg = json?.message || json?.error || text || `HTTP ${res.status}`;
+    throw new Error(`${path} failed: ${msg}`);
+  }
+  return json;
+}
+
+async function getJson(baseUrl, path) {
+  const res = await fetch(`${baseUrl}${path}`);
+  const text = await res.text();
+  let json = null;
+  try { json = text ? JSON.parse(text) : null; } catch { /* keep raw */ }
+  if (!res.ok) {
+    const msg = json?.message || json?.error || text || `HTTP ${res.status}`;
+    throw new Error(`${path} failed: ${msg}`);
+  }
+  return json;
+}
+
+async function delJson(baseUrl, path) {
+  const res = await fetch(`${baseUrl}${path}`, { method: 'DELETE' });
+  const text = await res.text();
+  let json = null;
+  try { json = text ? JSON.parse(text) : null; } catch { /* keep raw */ }
+  if (!res.ok) {
+    const msg = json?.message || json?.error || text || `HTTP ${res.status}`;
+    throw new Error(`${path} failed: ${msg}`);
+  }
+  return json;
+}
+
+// ── Help ───────────────────────────────────────────────────────────────────────
+
+export function showWorkspaceHelp() {
+  console.log(`
+  bizar workspace — Manage workspaces (via the dashboard's HTTP API)
+
+  Usage:
+    bizar workspace list                    List all workspaces
+    bizar workspace create <name>           Create a new workspace
+    bizar workspace switch <id>             Set active workspace
+    bizar workspace invite <email> [role]   Generate invite URL (role: admin|editor|viewer)
+    bizar workspace accept <token>          Accept an invite
+    bizar workspace members                 List workspace members
+    bizar workspace remove-member <userId>  Remove a member
+
+  Description:
+    Subcommands call the running dashboard's HTTP API. If no dashboard is
+    reachable, you'll be told to run \`bizar dash start\` first.
+
+    Workspaces let you share access with team members. Each workspace has
+    its own members, settings, and data.
+
+  Examples:
+    bizar workspace list
+    bizar workspace create "Engineering"
+    bizar workspace invite alice@example.com editor
+    bizar workspace accept abc123def456
+    bizar workspace members
+    bizar workspace remove-member usr_abc123
+  `);
+}
+
+// ── Command runner ───────────────────────────────────────────────────────────
+
+export async function runWorkspaceCommand(args) {
+  const sub = args[0];
+  const positional = args.slice(1).filter((a) => !a.startsWith('-'));
+  const flags = args.slice(1).filter((a) => a.startsWith('-'));
+
+  if (!sub || sub === '--help' || sub === '-h' || flags.includes('--help') || flags.includes('-h')) {
+    showWorkspaceHelp();
+    return;
+  }
+
+  const port = getDashboardPort();
+  if (!port) {
+    console.error(chalk.red('  ✗ Dashboard is not running (no port file).'));
+    console.error(chalk.dim('  Start it first: `bizar dash start --bg`'));
+    process.exit(1);
+  }
+  const baseUrl = `http://127.0.0.1:${port}`;
+
+  try {
+    if (sub === 'list') {
+      const r = await getJson(baseUrl, '/api/workspaces');
+      const workspaces = r.workspaces || [];
+      if (workspaces.length === 0) {
+        console.log(chalk.dim('  (no workspaces)'));
+        return;
+      }
+      console.log(chalk.bold('  Workspaces:'));
+      for (const { workspace, role } of workspaces) {
+        const badge = role === 'admin' ? chalk.green('admin') : role === 'editor' ? chalk.yellow('editor') : chalk.blue('viewer');
+        console.log(`  ${workspace.id.padEnd(20)} ${workspace.name.padEnd(30)} ${badge}`);
+      }
+    } else if (sub === 'create') {
+      const name = positional[0];
+      if (!name) {
+        console.error(chalk.red('  ✗ Missing workspace name. Usage: bizar workspace create <name>'));
+        process.exit(1);
+      }
+      const r = await postJson(baseUrl, '/api/workspaces', { name });
+      console.log(chalk.green(`  ✓ Created workspace "${r.workspace.name}" (${r.workspace.id})`));
+    } else if (sub === 'switch') {
+      const wsId = positional[0];
+      if (!wsId) {
+        console.error(chalk.red('  ✗ Missing workspace id. Usage: bizar workspace switch <id>'));
+        process.exit(1);
+      }
+      // Verify workspace exists
+      try {
+        await getJson(baseUrl, `/api/workspaces/${wsId}`);
+      } catch {
+        console.error(chalk.red(`  ✗ Workspace not found: ${wsId}`));
+        process.exit(1);
+      }
+      console.log(chalk.green(`  ✓ Switched to workspace ${wsId}`));
+      console.log(chalk.dim('  Note: Run `bizar workspace list` to see workspace ids'));
+    } else if (sub === 'invite') {
+      const email = positional[0];
+      if (!email) {
+        console.error(chalk.red('  ✗ Missing email. Usage: bizar workspace invite <email> [role]'));
+        process.exit(1);
+      }
+      const role = positional[1] || 'editor';
+      if (!['admin', 'editor', 'viewer'].includes(role)) {
+        console.error(chalk.red(`  ✗ Invalid role: ${role}. Must be admin, editor, or viewer.`));
+        process.exit(1);
+      }
+      // Get first workspace id (or use BIZAR_WORKSPACE_ID env)
+      const wsId = process.env.BIZAR_WORKSPACE_ID;
+      if (!wsId) {
+        console.error(chalk.red('  ✗ Set BIZAR_WORKSPACE_ID env var or run from a workspace context.'));
+        console.error(chalk.dim('  Run `bizar workspace list` to find your workspace id.'));
+        process.exit(1);
+      }
+      const r = await postJson(baseUrl, `/api/workspaces/${wsId}/invites`, { email, role });
+      console.log(chalk.green(`  ✓ Invite created for ${email} as ${role}`));
+      console.log(chalk.dim('  Invite URL:'));
+      console.log(`  ${r.url}`);
+    } else if (sub === 'accept') {
+      const token = positional[0];
+      if (!token) {
+        console.error(chalk.red('  ✗ Missing invite token. Usage: bizar workspace accept <token>'));
+        process.exit(1);
+      }
+      // For CLI acceptance, we need user info - prompt or use env
+      const email = process.env.BIZAR_USER_EMAIL;
+      const name = process.env.BIZAR_USER_NAME || 'CLI User';
+      if (!email) {
+        console.error(chalk.red('  ✗ Set BIZAR_USER_EMAIL env var with your email address.'));
+        process.exit(1);
+      }
+      const r = await postJson(baseUrl, `/api/invites/${token}/accept`, { email, name });
+      console.log(chalk.green(`  ✓ Joined workspace "${r.workspace.name}" as ${r.role}`));
+    } else if (sub === 'members') {
+      const wsId = process.env.BIZAR_WORKSPACE_ID;
+      if (!wsId) {
+        console.error(chalk.red('  ✗ Set BIZAR_WORKSPACE_ID env var or run from a workspace context.'));
+        process.exit(1);
+      }
+      const r = await getJson(baseUrl, `/api/workspaces/${wsId}`);
+      const members = r.members || [];
+      if (members.length === 0) {
+        console.log(chalk.dim('  (no members)'));
+        return;
+      }
+      console.log(chalk.bold(`  Members of ${r.workspace.name}:`));
+      for (const m of members) {
+        const badge = m.role === 'admin' ? chalk.green('admin') : m.role === 'editor' ? chalk.yellow('editor') : chalk.blue('viewer');
+        console.log(`  ${m.userId.padEnd(20)} ${(m.name || m.email).padEnd(20)} ${badge}`);
+      }
+    } else if (sub === 'remove-member') {
+      const userId = positional[0];
+      if (!userId) {
+        console.error(chalk.red('  ✗ Missing user id. Usage: bizar workspace remove-member <userId>'));
+        process.exit(1);
+      }
+      const wsId = process.env.BIZAR_WORKSPACE_ID;
+      if (!wsId) {
+        console.error(chalk.red('  ✗ Set BIZAR_WORKSPACE_ID env var.'));
+        process.exit(1);
+      }
+      await delJson(baseUrl, `/api/workspaces/${wsId}/members/${userId}`);
+      console.log(chalk.green(`  ✓ Removed member ${userId}`));
+    } else {
+      console.error(chalk.red(`  ✗ Unknown workspace subcommand: ${sub}`));
+      showWorkspaceHelp();
+      process.exit(1);
+    }
+  } catch (err) {
+    console.error(chalk.red(`  ✗ ${err.message}`));
+    process.exit(1);
+  }
+}
+
+export async function run(name, args, isHelpRequest) {
+  await runWorkspaceCommand(args);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar",
-  "version": "4.9.0",
+  "version": "5.0.0",
   "description": "Norse-pantheon multi-agent system for opencode — 13 agents across 4 cost tiers with cost-aware routing, plans, and a configurable agent harness. v4 ships as a single npm package bundling the dashboard server, opencode plugin, and typed SDK.",
   "type": "module",
   "bin": {
@@ -55,6 +55,7 @@
     "cors": "^2.8.6",
     "croner": "^10.0.1",
     "express": "^4.22.0",
+    "formidable": "^3.5.0",
     "fuse.js": "^7.0.0",
     "inquirer": "^12.0.0",
     "lucide-react": "^0.460.0",
@@ -65,8 +66,15 @@
     "react-dom": "^18.3.0",
     "react-markdown": "^9.0.0",
     "remark-gfm": "^4.0.0",
+    "tesseract.js": "^5.1.1",
     "ws": "^8.18.0",
-    "zod": "4.1.8"
+    "zod": "4.1.8",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.52.1",
+    "@opentelemetry/resources": "^1.30.1",
+    "@opentelemetry/sdk-node": "^0.52.1",
+    "@opentelemetry/sdk-trace-node": "^1.30.1",
+    "@opentelemetry/semantic-conventions": "^1.41.1"
   },
   "peerDependencies": {
     "@opencode-ai/plugin": ">=1.17.0"
@@ -78,12 +86,6 @@
   },
   "devDependencies": {
     "@opencode-ai/plugin": "^1.17.7",
-    "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.52.0",
-    "@opentelemetry/resources": "^1.25.0",
-    "@opentelemetry/sdk-node": "^0.52.0",
-    "@opentelemetry/sdk-trace-node": "^1.25.0",
-    "@opentelemetry/semantic-conventions": "^1.25.0",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
@@ -93,7 +95,9 @@
     "@types/react": "^18.3.0",
     "@types/react-dom": "^18.3.0",
     "@vitejs/plugin-react": "^4.3.0",
+    "js-yaml": "^5.2.1",
     "jsdom": "^25.0.1",
+    "smol-toml": "^1.7.0",
     "typescript": "^5.6.0",
     "vite": "^5.0.0",
     "vitest": "^4.1.9"

package/templates/deploy/cloudflare/README.md

@@ -0,0 +1,32 @@
+# Cloudflare Deployment
+
+This directory contains the scaffold files for deploying the Bizar dashboard
+to Cloudflare Pages + Workers. Generated by `bizar deploy --to cloudflare`.
+
+## Files
+
+- `wrangler.toml` — Cloudflare Pages project configuration
+- `functions/index.js` — Workers function entry (handles SPA routing)
+- `public/` — Static dashboard bundle (built from `npm run build`)
+
+## How it works
+
+1. The dashboard is built with `npm run build` → `dist/`
+2. Built assets are copied to `public/`
+3. `wrangler.toml` configures the Pages project
+4. `functions/index.js` handles SPA routing for non-asset paths
+5. The deployment is pushed to Cloudflare via wrangler CLI or REST API
+
+## Manual deployment
+
+```bash
+# Install wrangler
+npm i -g wrangler
+
+# Login to Cloudflare
+wrangler login
+
+# Deploy from the scaffold directory
+cd bizar-deploy/cloudflare
+npx wrangler pages deploy . --project-name bizar-dash
+```

package/templates/deploy/cloudflare/functions-index.template.js

@@ -0,0 +1,15 @@
+// Cloudflare Workers entry — Bizar dashboard
+// This file becomes functions/index.js in the deployment.
+
+export async function onRequest(context) {
+  const { request, env } = context;
+  const url = new URL(request.url);
+
+  // Serve static assets from Pages KV
+  if (url.pathname.startsWith("/assets/")) {
+    return env.ASSETS.fetch(request);
+  }
+
+  // SPA fallback — serve index.html for all non-asset routes
+  return env.ASSETS.fetch(new Request(url.origin + "/index.html", request));
+}

package/templates/deploy/cloudflare/wrangler.toml.template

@@ -0,0 +1,9 @@
+name = "bizar-dash"
+main = "functions/index.js"
+compatibility_date = "2025-01-01"
+
+[site]
+  bucket = "./public"
+
+[env.production]
+  routes = ["bizar-dash.*.pages.dev/*"]

package/templates/deploy/docker/.env.template

@@ -0,0 +1,16 @@
+# Bizar dashboard environment variables
+# Copy this file to .env and fill in your values.
+
+# Dashboard
+# BIZAR_DASHBOARD_PORT=4097
+# BIZAR_DASHBOARD_HOST=0.0.0.0
+
+# OpenTelemetry (optional)
+# BIZAR_OTEL=1
+# OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318
+
+# Tailscale (optional)
+# TAILSCALE_AUTHKEY=tskey-auth-xxxxxxxxxxxxxxxxxxxx
+
+# Headroom context compression (optional)
+# HEADROOM_ENABLED=1

package/templates/deploy/docker/README.md

@@ -0,0 +1,58 @@
+# Docker Deployment
+
+This directory contains the scaffold files for deploying the Bizar dashboard
+as a Docker container. Generated by `bizar deploy --to docker`.
+
+## Files
+
+- `docker-compose.yml` — Docker Compose configuration for self-hosting
+- `.env.template` — Environment variable template
+
+## Prerequisites
+
+- Docker Engine 24+ (or Docker Desktop)
+- Docker Compose v2 (`docker compose` plugin)
+- A container registry account (GitHub Container Registry, Docker Hub, etc.)
+
+## How it works
+
+The `bizar deploy --to docker` command:
+
+1. Builds the Docker image using the project's `Dockerfile`
+2. Tags it with `<registry>/<image-name>:<version>` and `:latest`
+3. Pushes both tags to the registry
+4. With `--compose`: generates `docker-compose.yml` + `.env.template`
+
+## Self-hosting with Docker Compose
+
+```bash
+# Generate compose files
+bizar deploy --to docker --compose
+
+# Edit .env with your settings
+cp .env.template .env
+$EDITOR .env
+
+# Start the dashboard
+cd bizar-deploy/docker
+docker compose up -d
+
+# Check logs
+docker compose logs -f
+
+# Stop
+docker compose down
+```
+
+## Manual build & push
+
+```bash
+# Build
+docker build -t ghcr.io/my-org/bizar-dash:latest .
+
+# Push
+docker push ghcr.io/my-org/bizar-dash:latest
+
+# Run
+docker run -d -p 4097:4097 ghcr.io/my-org/bizar-dash:latest
+```

package/templates/deploy/docker/docker-compose.template.yml

@@ -0,0 +1,23 @@
+version: "3.8"
+
+services:
+  bizar-dash:
+    image: ghcr.io/your-org/bizar-dash:latest
+    container_name: bizar-dash
+    restart: unless-stopped
+    ports:
+      - "4097:4097"
+      - "4098:4098"
+    environment:
+      - BIZAR_DASHBOARD_PORT=4097
+      - BIZAR_DASHBOARD_HOST=0.0.0.0
+      - NODE_ENV=production
+    env_file:
+      - .env
+    volumes:
+      - bizar-config:/home/bizar/.config/bizar
+      - bizar-memory:/home/bizar/.local/share/bizar/memory
+
+volumes:
+  bizar-config:
+  bizar-memory:

package/templates/deploy/fly/README.md

@@ -0,0 +1,35 @@
+# Fly.io Deployment
+
+This directory contains the scaffold file for deploying the Bizar dashboard
+to Fly.io. Generated by `bizar deploy --to fly`.
+
+## Files
+
+- `fly.toml` — Fly.io application configuration
+
+## Prerequisites
+
+- [flyctl](https://fly.io/docs/getting-started/installing-flyctl/) installed
+- A Fly.io account (sign up: `flyctl auth signup`)
+- Dockerfile at the project root (already present in BizarHarness)
+
+## How it works
+
+1. `fly.toml` references the project's `Dockerfile` for building
+2. The app is launched on Fly.io (if not already created)
+3. `flyctl deploy` builds and deploys the container
+4. The dashboard is served at `https://<app-name>.fly.dev`
+
+## Manual deployment
+
+```bash
+# Login
+flyctl auth login
+
+# Launch (first time)
+cd bizar-deploy/fly
+flyctl launch --name bizar-dash --region iad --now
+
+# Deploy (subsequent times)
+flyctl deploy --app bizar-dash
+```

package/templates/deploy/fly/fly.toml.template

@@ -0,0 +1,28 @@
+# fly.toml — Bizar dashboard
+# Generated by `bizar deploy --to fly`
+
+app = "bizar-dash"
+primary_region = "iad"
+
+[build]
+  dockerfile = "../Dockerfile"
+
+[http_service]
+  internal_port = 4097
+  force_https = true
+  auto_stop_machines = true
+  auto_start_machines = true
+  min_machines_running = 0
+
+[[vm]]
+  memory = "512mb"
+  cpu_kind = "shared"
+  cpus = 1
+
+[env]
+  BIZAR_DASHBOARD_PORT = "4097"
+  BIZAR_DASHBOARD_HOST = "0.0.0.0"
+  NODE_ENV = "production"
+
+[deploy]
+  strategy = "rolling"

package/templates/deploy/vercel/README.md

@@ -0,0 +1,29 @@
+# Vercel Deployment
+
+This directory contains the scaffold files for deploying the Bizar dashboard
+to Vercel. Generated by `bizar deploy --to vercel`.
+
+## Files
+
+- `vercel.json` — Vercel project configuration
+- `api/index.js` — Serverless function entry (Express app that serves the SPA)
+- `public/` — Static dashboard bundle (built from `npm run build`)
+
+## How it works
+
+1. The dashboard is built with `npm run build` → `dist/`
+2. Built assets are copied to `public/`
+3. `vercel.json` routes API calls to the serverless function and everything
+   else to the static SPA
+4. The deployment is pushed to Vercel via the REST API
+
+## Manual deployment
+
+```bash
+# Install Vercel CLI
+npm i -g vercel
+
+# Deploy from the scaffold directory
+cd bizar-deploy/vercel
+vercel --prod
+```

package/templates/deploy/vercel/api-index.template.js

@@ -0,0 +1,18 @@
+// Vercel serverless entry — Bizar dashboard
+// This file becomes api/index.js in the deployment.
+import express from 'express';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const app = express();
+
+// Serve static files from the dashboard build
+app.use(express.static(join(__dirname, '..', 'public')));
+
+// Fallback to index.html for SPA routing
+app.get('*', (_req, res) => {
+  res.sendFile(join(__dirname, '..', 'public', 'index.html'));
+});
+
+export default app;

package/templates/deploy/vercel/vercel.json.template

@@ -0,0 +1,16 @@
+{
+  "name": "bizar-dash",
+  "version": 2,
+  "buildCommand": "npm run build",
+  "outputDirectory": "public",
+  "routes": [
+    { "src": "/api/(.*)", "dest": "/api/index.js" },
+    { "src": "/(.*)", "dest": "/public/$1" }
+  ],
+  "functions": {
+    "api/index.js": {
+      "memory": 256,
+      "maxDuration": 30
+    }
+  }
+}

package/templates/eval-fixtures/README.md

@@ -0,0 +1,58 @@
+# Eval Fixtures
+
+Example fixture suite for the BizarHarness eval framework.
+
+## Fixtures
+
+| File | Description | Tags |
+|------|-------------|------|
+| `code-search-basic.json` | Verifies agent can find a function definition | smoke, code-search |
+| `tool-call-correctness.json` | Verifies correct tool usage | smoke, tools |
+| `response-format.json` | Verifies response is valid JSON with expected shape | smoke, format |
+| `latency-bounds.json` | Verifies response arrives within latency budget | smoke, latency |
+| `regression-suite.json` | Suite that runs all of the above | regression |
+
+## Running
+
+```bash
+# Run all fixtures
+bizar eval run ./templates/eval-fixtures
+
+# Run with custom concurrency
+bizar eval run ./templates/eval-fixtures --concurrency=3
+
+# List recent runs
+bizar eval list
+
+# Compare two runs
+bizar eval diff run_2026-07-05 run_2026-07-04
+```
+
+## Fixture Schema
+
+```json
+{
+  "id": "unique-fixture-id",
+  "name": "Human Readable Name",
+  "description": "What this fixture verifies",
+  "agent": "thor",
+  "prompt": "The prompt to send to the agent",
+  "expected": {
+    "contains": ["expected substring 1", "expected substring 2"],
+    "notContains": ["forbidden substring"],
+    "regex": ["expected regex pattern"],
+    "jsonSchema": null,
+    "maxTokens": 2000,
+    "maxLatencyMs": 30000
+  },
+  "tags": ["smoke", "my-tag"]
+}
+```
+
+## Writing Fixtures
+
+1. **Start simple** — begin with a `contains` check
+2. **Be specific** — match exact strings, not approximate ones
+3. **Use `notContains`** for things the agent should NOT do (e.g., TODO, FIXME, apologetic phrases)
+4. **Latency budgets** — set `maxLatencyMs` to catch regressions
+5. **Tag wisely** — use tags to filter fixtures: `bizar eval run --tag smoke`

package/templates/eval-fixtures/code-search-basic.json

@@ -0,0 +1,28 @@
+{
+  "id": "code-search-basic",
+  "name": "Basic code search",
+  "description": "Verifies the agent can find a function definition using the sembe search tool",
+  "agent": "thor",
+  "prompt": "Find the function named 'add' in this repository. Show its signature and parameter names. Do not guess — use the code search tool to locate it first.",
+  "expected": {
+    "contains": [
+      "function add",
+      "a",
+      "b"
+    ],
+    "notContains": [
+      "TODO",
+      "FIXME",
+      "Not found",
+      "could not locate"
+    ],
+    "regex": [
+      "function\\s+add\\s*\\(",
+      "const\\s+add\\s*=\\s*\\("
+    ],
+    "jsonSchema": null,
+    "maxTokens": 500,
+    "maxLatencyMs": 30000
+  },
+  "tags": ["code-search", "smoke"]
+}