@polderlabs/bizar 5.3.0 → 5.3.1

package/bizar-dash/node_modules/.vite/vitest/da39a3ee5e6b4b0d3255bfef95601890afd80709/results.json

@@ -1 +1 @@
-{"version":"4.1.9","results":[[":tests/lib/utils.test.ts",{"duration":20.318142999999964,"failed":false}],[":tests/components/Button.test.tsx",{"duration":97.09901500000001,"failed":false}],[":tests/components/Card.test.tsx",{"duration":25.56895700000001,"failed":false}],[":tests/hooks/useModal.test.tsx",{"duration":156.274812,"failed":false}],[":tests/components/Toast.test.tsx",{"duration":170.42815400000006,"failed":false}],[":tests/components/Modal.test.tsx",{"duration":189.45819300000005,"failed":false}],[":tests/lib/i18n.test.ts",{"duration":4.330512999999996,"failed":false}],[":tests/components/StatusBadge.test.tsx",{"duration":25.465268000000037,"failed":false}],[":tests/hooks/useToast.test.tsx",{"duration":124.75983200000007,"failed":false}],[":tests/components/Spinner.test.tsx",{"duration":56.78095799999994,"failed":false}],[":tests/backup-restore.test.tsx",{"duration":203.898414,"failed":false}],[":tests/a11y.test.tsx",{"duration":896.8848140000001,"failed":false}],[":tests/lib/search-fuzzy.test.ts",{"duration":6.686229000000026,"failed":false}],[":tests/components/settings-search.test.tsx",{"duration":722.1675959999999,"failed":false}],[":tests/memory-graph-view.test.tsx",{"duration":40.353496000000064,"failed":false}],[":tests/components/workspace-selector.test.tsx",{"duration":143.099331,"failed":false}],[":tests/components/screenshot-ocr.test.tsx",{"duration":30.485972000000004,"failed":false}],[":tests/voice-recorder.test.tsx",{"duration":139.93698299999994,"failed":false}],[":tests/autosave.test.tsx",{"duration":268.4993979999999,"failed":false}],[":tests/settings-layout.test.tsx",{"duration":246.68477299999995,"failed":false}],[":tests/settings-nav.test.tsx",{"duration":330.9125980000001,"failed":false}],[":tests/components/doctor-panel.test.tsx",{"duration":82.28221499999995,"failed":false}],[":tests/chat-composer.test.tsx",{"duration":279.32558600000004,"failed":false}],[":tests/settings-mode-wiring.test.tsx",{"duration":283.47341000000006,"failed":false}],[":tests/minimax-bar.test.ts",{"duration":0,"failed":true}],[":tests/minimax-bar.test.tsx",{"duration":23.41428499999995,"failed":false}],[":tests/components/plugin-permissions.test.tsx",{"duration":127.94786099999999,"failed":false}],[":tests/eval-web-ui.test.tsx",{"duration":147.663952,"failed":false}],[":tests/components/marketplace-plugin-card.test.tsx",{"duration":175.07474200000001,"failed":false}],[":tests/a11y/components.test.tsx",{"duration":128.34057200000007,"failed":false}],[":tests/a11y/forms.test.tsx",{"duration":86.17374700000005,"failed":true}],[":tests/a11y/navigation.test.tsx",{"duration":136.026924,"failed":true}]]}
+{"version":"4.1.9","results":[[":tests/lib/utils.test.ts",{"duration":15.788036999999974,"failed":false}],[":tests/components/Button.test.tsx",{"duration":84.90294800000004,"failed":false}],[":tests/components/Card.test.tsx",{"duration":18.837508999999955,"failed":false}],[":tests/hooks/useModal.test.tsx",{"duration":120.20212400000003,"failed":false}],[":tests/components/Toast.test.tsx",{"duration":161.860364,"failed":false}],[":tests/components/Modal.test.tsx",{"duration":169.36771700000008,"failed":false}],[":tests/lib/i18n.test.ts",{"duration":2.9599100000000362,"failed":false}],[":tests/components/StatusBadge.test.tsx",{"duration":22.451562999999965,"failed":false}],[":tests/hooks/useToast.test.tsx",{"duration":113.03238799999997,"failed":false}],[":tests/components/Spinner.test.tsx",{"duration":56.80167199999994,"failed":false}],[":tests/backup-restore.test.tsx",{"duration":209.892064,"failed":false}],[":tests/a11y.test.tsx",{"duration":679.8717469999999,"failed":false}],[":tests/lib/search-fuzzy.test.ts",{"duration":5.03047799999996,"failed":false}],[":tests/components/settings-search.test.tsx",{"duration":718.4375819999999,"failed":false}],[":tests/memory-graph-view.test.tsx",{"duration":29.26699000000002,"failed":false}],[":tests/components/workspace-selector.test.tsx",{"duration":120.47785299999998,"failed":false}],[":tests/components/screenshot-ocr.test.tsx",{"duration":27.81256400000001,"failed":false}],[":tests/voice-recorder.test.tsx",{"duration":114.61372900000003,"failed":false}],[":tests/autosave.test.tsx",{"duration":254.917053,"failed":false}],[":tests/settings-layout.test.tsx",{"duration":217.68918099999996,"failed":false}],[":tests/settings-nav.test.tsx",{"duration":290.68972699999995,"failed":false}],[":tests/components/doctor-panel.test.tsx",{"duration":70.02781100000004,"failed":false}],[":tests/chat-composer.test.tsx",{"duration":232.71696299999996,"failed":false}],[":tests/settings-mode-wiring.test.tsx",{"duration":276.79545799999994,"failed":false}],[":tests/minimax-bar.test.ts",{"duration":0,"failed":true}],[":tests/minimax-bar.test.tsx",{"duration":22.24368499999997,"failed":false}],[":tests/components/plugin-permissions.test.tsx",{"duration":92.75674500000002,"failed":false}],[":tests/eval-web-ui.test.tsx",{"duration":117.119639,"failed":false}],[":tests/components/marketplace-plugin-card.test.tsx",{"duration":188.3587500000001,"failed":false}],[":tests/a11y/components.test.tsx",{"duration":127.70726300000001,"failed":false}],[":tests/a11y/forms.test.tsx",{"duration":103.14186000000007,"failed":true}],[":tests/a11y/navigation.test.tsx",{"duration":120.83297300000004,"failed":true}]]}

package/bizar-dash/src/server/auth.mjs

@@ -484,7 +484,20 @@ function extractToken(req) {
  */
 export function getCurrentUserId(req) {
   const token = extractToken(req);
-  if (!token) return null;
+  if (!token) {
+    // v5.3.1 — Tailscale trust: when the dashboard is reached via
+    // tailscale serve and the operator has opted in to trust tailnet
+    // clients, derive a deterministic userId from the tailnet hostname
+    // so the rest of the v5.0 multi-user code paths (workspaces, etc.)
+    // work without requiring an explicit token.
+    if (process.env.BIZAR_DASHBOARD_TRUST_TAILSCALE === '1' && isLoopback(req)) {
+      const hostname = String(req?.headers?.host || '').split(':')[0];
+      if (hostname && hostname.endsWith('.ts.net')) {
+        return 'usr_ts_' + createHash('sha256').update(hostname).digest('hex').slice(0, 12);
+      }
+    }
+    return null;
+  }
 
   const secret = getOrCreateSecret();
 

package/bizar-dash/src/server/routes/users.mjs

@@ -26,7 +26,25 @@ export function createUsersRouter() {
       return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
     }
     const user = await getUser(userId);
+    // v5.3.1 — Tailscale-trust: when getCurrentUserId returns a derived
+    // userId (usr_ts_*) that doesn't exist in the store, synthesize a
+    // minimal user record from the request Host header so the dashboard
+    // can render a profile without needing a full signup.
     if (!user) {
+      if (userId.startsWith('usr_ts_')) {
+        const host = String(req.headers?.host || '').split(':')[0] || 'tailnet';
+        const tailnetName = host.split('.')[0] || 'tailnet';
+        const workspaces = await listWorkspacesWithRoles(userId);
+        return res.json({
+          user: {
+            id: userId,
+            email: `${tailnetName}@tailscale.local`,
+            name: `Tailnet user (${tailnetName})`,
+            tailnet: true
+          },
+          workspaces
+        });
+      }
       return res.status(404).json({ error: 'not_found', message: 'User not found' });
     }
     const workspaces = await listWorkspacesWithRoles(userId);

package/cli/commands/dash.mjs

@@ -138,6 +138,11 @@ export async function runDash(dashArgs) {
             const serveResult = await setupTailscaleServe({ dashboardPort: usePort });
             if (serveResult.ok) {
               console.log(chalk.green(`  ✓ Tailscale serve: ${serveResult.url}`));
+              // v5.3.1 — Auto-trust Tailscale clients so they don't need
+              // a bearer token. Tailscale users are already authenticated
+              // on the tailnet before they reach the dashboard.
+              process.env.BIZAR_DASHBOARD_TRUST_TAILSCALE = '1';
+              console.log(chalk.dim('  ✓ Tailscale clients auto-trusted (BIZAR_DASHBOARD_TRUST_TAILSCALE=1)'));
             }
           }
         } catch (err) {

package/cli/commands/tailscale.mjs

@@ -83,9 +83,16 @@ export async function setupTailscaleServe({ dashboardPort = 4097, path = '/', ht
   } catch { /* ignore — might not have existing config */ }
 
   // Set up new serve config
+  // v5.3.1 — Use --set-x-forwarded-for=trailing so the dashboard sees
+  // the original client IP (a 100.x Tailscale address) in X-Forwarded-For.
+  // Without this, the dashboard can't tell that the request came from
+  // a trusted tailnet client and demands a bearer token.
   try {
     execFileSync('tailscale', [
-      'serve', '--bg', `--https=${https}`, `--set-path=${path}`,
+      'serve', '--bg',
+      `--https=${https}`,
+      `--set-path=${path}`,
+      '--set-x-forwarded-for=trailing',
       `http://localhost:${dashboardPort}`,
     ], { encoding: 'utf8', timeout: 30000 });
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar",
-  "version": "5.3.0",
+  "version": "5.3.1",
   "description": "Norse-pantheon multi-agent system for opencode — 13 agents across 4 cost tiers with cost-aware routing, plans, and a configurable agent harness. v4 ships as a single npm package bundling the dashboard server, opencode plugin, and typed SDK.",
   "type": "module",
   "bin": {