@polderlabs/bizar 5.0.2 → 5.2.0

package/bizar-dash/src/server/routes/workspaces.mjs

@@ -33,8 +33,30 @@ import {
   ROLES,
 } from '../workspaces.mjs';
 import { getCurrentUserId, getCurrentWorkspaceId } from '../auth.mjs';
+import { withSpan, setCommonAttributes } from '../otel.mjs';
+import { recordTrace } from '../metrics.mjs';
 import { wrap } from './_shared.mjs';
 
+/**
+ * Common scope helper: extract userId/workspaceId from the request
+ * and bind them to the active span. Returns `null` (and lets the
+ * caller emit a 401) when no user is attached to the request.
+ * Callers decide whether to short-circuit by checking the return
+ * value.
+ *
+ * @param {import('@opentelemetry/api').Span} span
+ * @param {import('express').Request} req
+ * @returns {string|null}
+ */
+function bindUserScope(span, req) {
+  const userId = getCurrentUserId(req);
+  const workspaceId = getCurrentWorkspaceId(req) || null;
+  const ip = req.ip || req.socket?.remoteAddress;
+  const userAgent = req.headers?.['user-agent'];
+  setCommonAttributes(span, { userId, workspaceId, ip, userAgent });
+  return userId || null;
+}
+
 /**
  * @returns {import('express').Router}
  */
@@ -42,163 +64,236 @@ export function createWorkspacesRouter() {
   const router = Router();
 
   // GET /api/workspaces — list user's workspaces
-  router.get('/workspaces', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.get('/workspaces', wrap(withSpan('workspace.list', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.list', { outcome: 'unauthorized' });
+      return;
     }
     const workspaces = await listWorkspacesWithRoles(userId);
+    span.setAttribute('workspace.count', workspaces.length);
     res.json({ workspaces });
-  }));
+    recordTrace('workspace.list', { outcome: 'ok', count_bucket: workspaces.length === 0 ? '0' : workspaces.length < 5 ? '1-4' : '5+' });
+  })));
 
   // POST /api/workspaces — create workspace
-  router.post('/workspaces', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.post('/workspaces', wrap(withSpan('workspace.create', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.create', { outcome: 'unauthorized' });
+      return;
     }
     const { name } = req.body || {};
     if (!name || typeof name !== 'string' || !name.trim()) {
-      return res.status(400).json({ error: 'bad_request', message: 'Workspace name is required' });
+      res.status(400).json({ error: 'bad_request', message: 'Workspace name is required' });
+      recordTrace('workspace.create', { outcome: 'missing_name' });
+      return;
     }
     const workspace = await createWorkspace({ name: name.trim(), ownerId: userId });
+    span.setAttribute('workspace.id', workspace.id);
     res.status(201).json({ workspace });
-  }));
+    recordTrace('workspace.create', { outcome: 'created' });
+  })));
 
   // GET /api/workspaces/:id — get workspace details
-  router.get('/workspaces/:id', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.get('/workspaces/:id', wrap(withSpan('workspace.get', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id } = req.params;
+    span.setAttribute('workspace.id', id);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.get', { outcome: 'unauthorized' });
+      return;
     }
-    const { id } = req.params;
     const workspace = await getWorkspace(id);
     if (!workspace) {
-      return res.status(404).json({ error: 'not_found', message: 'Workspace not found' });
+      res.status(404).json({ error: 'not_found', message: 'Workspace not found' });
+      recordTrace('workspace.get', { outcome: 'not_found' });
+      return;
     }
     const hasAccess = await checkPermission(id, userId, ROLES.VIEWER);
     if (!hasAccess) {
-      return res.status(403).json({ error: 'forbidden', message: 'Not a member of this workspace' });
+      res.status(403).json({ error: 'forbidden', message: 'Not a member of this workspace' });
+      recordTrace('workspace.get', { outcome: 'forbidden' });
+      return;
     }
     const members = await listMembers(id);
+    span.setAttribute('workspace.member_count', members.length);
     res.json({ workspace, members });
-  }));
+    recordTrace('workspace.get', { outcome: 'ok' });
+  })));
 
   // DELETE /api/workspaces/:id — delete workspace (admin only)
-  router.delete('/workspaces/:id', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.delete('/workspaces/:id', wrap(withSpan('workspace.delete', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id } = req.params;
+    span.setAttribute('workspace.id', id);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.delete', { outcome: 'unauthorized' });
+      return;
     }
-    const { id } = req.params;
     const canDelete = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canDelete) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      recordTrace('workspace.delete', { outcome: 'forbidden' });
+      return;
     }
     await deleteWorkspace(id);
     res.json({ ok: true });
-  }));
+    recordTrace('workspace.delete', { outcome: 'ok' });
+  })));
 
   // POST /api/workspaces/:id/invites — create invite
-  router.post('/workspaces/:id/invites', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.post('/workspaces/:id/invites', wrap(withSpan('workspace.invite.create', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id } = req.params;
+    span.setAttribute('workspace.id', id);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.invite.create', { outcome: 'unauthorized' });
+      return;
     }
-    const { id } = req.params;
     const { email, role } = req.body || {};
     if (!email || typeof email !== 'string') {
-      return res.status(400).json({ error: 'bad_request', message: 'Email is required' });
+      res.status(400).json({ error: 'bad_request', message: 'Email is required' });
+      recordTrace('workspace.invite.create', { outcome: 'missing_email' });
+      return;
     }
     if (!role || !Object.values(ROLES).includes(role)) {
-      return res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
+      res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
+      recordTrace('workspace.invite.create', { outcome: 'invalid_role' });
+      return;
     }
     const canInvite = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canInvite) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required to invite' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required to invite' });
+      recordTrace('workspace.invite.create', { outcome: 'forbidden' });
+      return;
     }
+    span.setAttribute('workspace.invite.role', role);
     const result = await createInvite(id, email, role, userId);
     res.status(201).json(result);
-  }));
+    recordTrace('workspace.invite.create', { outcome: 'created', role });
+  })));
 
   // GET /api/workspaces/:id/invites — list pending invites
-  router.get('/workspaces/:id/invites', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.get('/workspaces/:id/invites', wrap(withSpan('workspace.invite.list', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id } = req.params;
+    span.setAttribute('workspace.id', id);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.invite.list', { outcome: 'unauthorized' });
+      return;
     }
-    const { id } = req.params;
     const canView = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canView) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      recordTrace('workspace.invite.list', { outcome: 'forbidden' });
+      return;
     }
     const invites = await listInvites(id);
+    span.setAttribute('workspace.invite.count', invites.length);
     res.json({ invites });
-  }));
+    recordTrace('workspace.invite.list', { outcome: 'ok', count_bucket: invites.length === 0 ? '0' : '1+' });
+  })));
 
   // DELETE /api/workspaces/:id/invites/:token — revoke invite
-  router.delete('/workspaces/:id/invites/:token', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.delete('/workspaces/:id/invites/:token', wrap(withSpan('workspace.invite.revoke', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id, token } = req.params;
+    span.setAttribute('workspace.id', id);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.invite.revoke', { outcome: 'unauthorized' });
+      return;
     }
-    const { id, token } = req.params;
     const canRevoke = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canRevoke) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      recordTrace('workspace.invite.revoke', { outcome: 'forbidden' });
+      return;
     }
     await revokeInvite(id, token);
     res.json({ ok: true });
-  }));
+    recordTrace('workspace.invite.revoke', { outcome: 'ok' });
+  })));
 
   // POST /api/workspaces/:id/members/:userId — update member role
-  router.post('/workspaces/:id/members/:userId', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.post('/workspaces/:id/members/:userId', wrap(withSpan('workspace.member.update', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id, userId: targetUserId } = req.params;
+    span.setAttribute('workspace.id', id);
+    span.setAttribute('workspace.target_user_id', targetUserId);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.member.update', { outcome: 'unauthorized' });
+      return;
     }
-    const { id, userId: targetUserId } = req.params;
     const { role } = req.body || {};
     if (!role || !Object.values(ROLES).includes(role)) {
-      return res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
+      res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
+      recordTrace('workspace.member.update', { outcome: 'invalid_role' });
+      return;
     }
     const canUpdate = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canUpdate) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      recordTrace('workspace.member.update', { outcome: 'forbidden' });
+      return;
     }
+    span.setAttribute('workspace.member.new_role', role);
     await updateMemberRole(id, targetUserId, role);
     res.json({ ok: true, role });
-  }));
+    recordTrace('workspace.member.update', { outcome: 'ok', role });
+  })));
 
   // DELETE /api/workspaces/:id/members/:userId — remove member
-  router.delete('/workspaces/:id/members/:userId', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.delete('/workspaces/:id/members/:userId', wrap(withSpan('workspace.member.remove', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id, userId: targetUserId } = req.params;
+    span.setAttribute('workspace.id', id);
+    span.setAttribute('workspace.target_user_id', targetUserId);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.member.remove', { outcome: 'unauthorized' });
+      return;
     }
-    const { id, userId: targetUserId } = req.params;
     const canRemove = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canRemove) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      recordTrace('workspace.member.remove', { outcome: 'forbidden' });
+      return;
     }
     await removeMember(id, targetUserId);
     res.json({ ok: true });
-  }));
+    recordTrace('workspace.member.remove', { outcome: 'ok' });
+  })));
 
   // POST /api/invites/:token/accept — accept invite
-  router.post('/invites/:token/accept', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.post('/invites/:token/accept', wrap(withSpan('workspace.invite.accept', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { token } = req.params;
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.invite.accept', { outcome: 'unauthorized' });
+      return;
     }
-    const { token } = req.params;
     const { email, name } = req.body || {};
     if (!email || !name) {
-      return res.status(400).json({ error: 'bad_request', message: 'Email and name are required' });
+      res.status(400).json({ error: 'bad_request', message: 'Email and name are required' });
+      recordTrace('workspace.invite.accept', { outcome: 'missing_fields' });
+      return;
     }
     const result = await acceptInvite(token, userId, email, name);
+    if (result?.workspace?.id) span.setAttribute('workspace.id', result.workspace.id);
+    if (result?.role) span.setAttribute('workspace.member.role', result.role);
     res.json({ ok: true, workspace: result.workspace, role: result.role });
-  }));
+    recordTrace('workspace.invite.accept', { outcome: 'ok' });
+  })));
 
   return router;
 }

package/bizar-dash/src/server/server.mjs

@@ -41,7 +41,7 @@ import { loadOrCreateAuth, V2_DEFAULT_PORT } from './v2-auth-file.mjs';
 import { createV2Router } from './routes-v2/index.mjs';
 import { counter, gauge, render as renderMetrics } from './metrics.mjs';
 import { warn } from './logger.mjs';
-import { initOtel, shutdownOtel } from './otel.mjs';
+import { initOtel, shutdownOtel, tracer } from './otel.mjs';
 
 // v4.7.0 — Prometheus-style HTTP metrics. Bound to the server-wide
 // registry; render() emits the text exposition format consumed by
@@ -238,25 +238,54 @@ export async function createServer({
   // limiter middleware (chat / event); if no scope header is
   // present, log the 429 with scope=unknown (it may be an upstream
   // 429 proxied from the opencode plugin).
+  //
+  // v5.1.0 — Also opens an HTTP-server root span on every request
+  // via the OpenTelemetry tracer. The span is created inside
+  // `startActiveSpan` so the per-route spans below automatically
+  // parent under it (the OTel SDK's AsyncHooksContextManager is
+  // installed by NodeSDK.start()). HTTP semantic convention
+  // attributes (`http.request.method`, `url.path`, `http.route`,
+  // `http.response.status_code`, `http.user_agent`) are added up
+  // front / on finish. Cost when OTEL is off: zero — the no-op
+  // tracer does nothing.
   app.use((req, res, next) => {
-    res.on('finish', () => {
-      const route = req.route?.path ? `${req.baseUrl || ''}${req.route.path}` : 'unmatched';
-      httpRequestsTotal.inc({
-        method: req.method,
-        route,
-        status: String(res.statusCode),
-      });
-      if (res.statusCode === 429) {
-        const scope = res.getHeader('X-RateLimit-Scope') || 'unknown';
-        warn('rate_limit_exceeded', {
-          ip: req.ip || (req.socket && req.socket.remoteAddress) || 'unknown',
-          scope,
+    tracer.startActiveSpan('http.request', { attributes: {
+      'http.request.method': req.method,
+      'url.path': req.originalUrl || req.url || '',
+      'url.scheme': req.protocol || 'http',
+      'http.user_agent': (req.headers && req.headers['user-agent']) || '',
+      'http.client_ip': req.ip || (req.socket && req.socket.remoteAddress) || '',
+      'http.host': req.headers?.host || '',
+    } }, (rootSpan) => {
+      res.on('finish', () => {
+        const route = req.route?.path ? `${req.baseUrl || ''}${req.route.path}` : 'unmatched';
+        httpRequestsTotal.inc({
           method: req.method,
           route,
+          status: String(res.statusCode),
         });
-      }
+        try {
+          rootSpan.setAttribute('http.route', route);
+          rootSpan.setAttribute('http.response.status_code', res.statusCode);
+          if (res.statusCode >= 500) {
+            rootSpan.setStatus({ code: 2 /* ERROR */, message: `HTTP ${res.statusCode}` });
+          } else {
+            rootSpan.setStatus({ code: 1 /* OK */ });
+          }
+        } catch { /* never throw from OTel helpers */ }
+        try { rootSpan.end(); } catch { /* ignore */ }
+        if (res.statusCode === 429) {
+          const scope = res.getHeader('X-RateLimit-Scope') || 'unknown';
+          warn('rate_limit_exceeded', {
+            ip: req.ip || (req.socket && req.socket.remoteAddress) || 'unknown',
+            scope,
+            method: req.method,
+            route,
+          });
+        }
+      });
+      next();
     });
-    next();
   });
 
   // v4.7.0 — Cache-Control headers for live JSON endpoints. The
@@ -444,6 +473,19 @@ export async function createServer({
     console.warn('[bizar-dash] headroom startup hook skipped:', err?.message || err);
   }
 
+  // v5.2 — Background transcription worker for voice notes. Uploads
+  // save audio immediately and enqueue the noteId here; the worker
+  // drains the queue, calls Whisper (or BIZAR_WHISPER_ENDPOINT), and
+  // broadcasts a `voice:updated` event so the dashboard updates in
+  // place. Errors here MUST NOT block boot — the worker is best-effort
+  // and a missing transcribe just leaves the note with no transcript.
+  try {
+    const { startTranscriptionWorker } = await import('./workers/transcription-worker.mjs');
+    startTranscriptionWorker({ broadcast: localBroadcast });
+  } catch (err) {
+    console.warn('[bizar-dash] transcription worker failed to start:', err?.message || err);
+  }
+
   // All /api/* routes go through apiRouter (after mod routes are checked).
   // IMPORTANT: mount v2 router FIRST so `/api/v2/*` matches before
   // apiRouter's internal 404 catch-all (api.mjs line ~109) can swallow it.

package/bizar-dash/src/server/voice-store.mjs

@@ -168,6 +168,33 @@ export function getVoiceNote(id) {
   return loadIndex().find((n) => n.id === id);
 }
 
+/**
+ * v5.2 — Patch an existing note in place. Used by the background
+ * transcription worker to attach the transcript after Whisper returns.
+ *
+ * Atomic write via the same `atomicWriteJson` helper as `saveVoiceNote`.
+ * `updatedAtMs` is refreshed on every call so callers / the UI can see
+ * when the note last changed. `createdAtMs` is preserved.
+ *
+ * If the id is unknown, returns null without touching the index. Callers
+ * (e.g. the worker) treat null as "skip and log".
+ *
+ * @param {string} id
+ * @param {Partial<VoiceNote>} patch
+ * @returns {VoiceNote|null}
+ */
+export function updateVoiceNote(id, patch) {
+  if (!id || !patch || typeof patch !== 'object') return null;
+  const notes = loadIndex();
+  const note = notes.find((n) => n.id === id);
+  if (!note) return null;
+
+  Object.assign(note, patch, { updatedAtMs: Date.now() });
+  saveIndex(notes);
+  log.info('voice note updated', { id, fields: Object.keys(patch) });
+  return note;
+}
+
 /**
  * @param {string} id
  * @returns {boolean}