@polderlabs/bizar 6.1.0 → 6.2.0

package/scripts/git-hooks/pre-push

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Pre-push hook — block push of commits that touch per-machine state.
+#
+# Defense-in-depth: even if someone bypasses the pre-commit hook with
+# `git commit --no-verify`, this hook catches .bizar/ or config/cline.json
+# changes before they reach the remote.
+#
+# Bypass: git push --no-verify (NOT recommended).
+
+set -euo pipefail
+
+REMOTE="$1"
+URL="$2"
+
+# Read ref updates from stdin (format: <local-ref> <local-sha> <remote-ref> <remote-sha>)
+# For a force-push or new branch, the "local-sha" may be the new tip.
+# We scan the names of changed files in all commits being pushed.
+COMMITS=""
+while read -r LOCAL_REF LOCAL_SHA REMOTE_REF REMOTE_SHA; do
+  if [ -z "$LOCAL_SHA" ] || [ "$LOCAL_SHA" = "0000000000000000000000000000000000000000" ]; then
+    continue
+  fi
+  if [ -z "$REMOTE_SHA" ] || [ "$REMOTE_SHA" = "0000000000000000000000000000000000000000" ]; then
+    # New branch — scan all commits on the local side
+    RANGE="$LOCAL_SHA"
+  else
+    RANGE="$REMOTE_SHA..$LOCAL_SHA"
+  fi
+  if [ -z "$COMMITS" ]; then
+    COMMITS="$RANGE"
+  else
+    COMMITS="$COMMITS $RANGE"
+  fi
+done
+
+if [ -z "$COMMITS" ]; then
+  exit 0
+fi
+
+BAD=$(git log --name-only --no-merges --pretty=format: $COMMITS 2>/dev/null \
+  | grep -E "(^|/)\.bizar/|config/cline\.json$" \
+  | sort -u || true)
+
+if [ -n "$BAD" ]; then
+  echo "" >&2
+  echo "❌ Refusing to push to $REMOTE — these files in the commit range are per-machine and must not be pushed:" >&2
+  echo "$BAD" | sed 's/^/    /' >&2
+  echo "" >&2
+  echo "  .bizar/ contains per-project state (memory.json, graph/, plans, scripts)." >&2
+  echo "  config/cline.json contains per-user cline config (model API tokens)." >&2
+  echo "" >&2
+  echo "  To override (NOT recommended): git push --no-verify" >&2
+  exit 1
+fi

package/scripts/install-hooks.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Install BizarHarness git hooks
+# Run this once per clone: ./scripts/install-hooks.sh
+
+set -e
+
+HOOKS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/scripts/git-hooks"
+GIT_HOOKS_DIR="$(git rev-parse --git-dir)/hooks"
+
+if [ ! -d "$GIT_HOOKS_DIR" ]; then
+  echo "Error: not in a git repo"
+  exit 1
+fi
+
+cp "$HOOKS_DIR/pre-commit" "$GIT_HOOKS_DIR/pre-commit"
+chmod +x "$GIT_HOOKS_DIR/pre-commit"
+
+cp "$HOOKS_DIR/pre-push" "$GIT_HOOKS_DIR/pre-push"
+chmod +x "$GIT_HOOKS_DIR/pre-push"
+
+echo "✓ Installed pre-commit hook"
+echo "  The hook scans staged changes for likely secrets (Bearer tokens, API keys, etc.)"
+echo "  It also blocks commits touching .bizar/ or config/cline.json (per-machine state)"
+echo "  To bypass in an emergency: git commit --no-verify"
+echo ""
+echo "✓ Installed pre-push hook"
+echo "  Blocks pushes whose commit range includes .bizar/ or config/cline.json changes"
+echo "  Defense-in-depth: catches bypasses of pre-commit via --no-verify"
+echo "  To bypass in an emergency: git push --no-verify"

package/scripts/install-service.mjs

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+/**
+ * scripts/install-service.mjs
+ *
+ * v3.22.0 — Post-install hook that registers the Bizar background service
+ * via Stream A's `cli/service-controller.mjs`.
+ *
+ * This script is a thin wrapper that handles the case where Stream A has not
+ * yet landed (service-controller.mjs missing) gracefully.
+ *
+ * Design:
+ *   - Imports service-controller.mjs dynamically (runtime dependency).
+ *   - Calls `installService({ force })`.
+ *   - If already installed with matching content, prints a message and exits 0.
+ *   - On Linux without systemd, falls back to running the daemon in a tmux
+ *     session and prints a note.
+ *   - On failure (or missing service-controller.mjs from sibling stream not
+ *     yet landed), prints a friendly error with the manual command and exits 0
+ *     (non-error — install is deliberately split across streams).
+ */
+
+import { existsSync } from 'node:fs';
+import { join, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const REPO_ROOT = resolve(__dirname, '..');
+
+function runCmd(cmd, args, opts = {}) {
+  const r = spawnSync(cmd, args, {
+    encoding: 'utf8',
+    timeout: 15_000,
+    shell: false,
+    windowsHide: true,
+    ...opts,
+  });
+  return {
+    status: r.status,
+    stdout: typeof r.stdout === 'string' ? r.stdout : '',
+    stderr: typeof r.stderr === 'string' ? r.stderr : '',
+    error: r.error || null,
+  };
+}
+
+function hasSystemd() {
+  try {
+    const r = runCmd('systemctl', ['--version']);
+    return r.status === 0;
+  } catch {
+    return false;
+  }
+}
+
+function findTmux() {
+  try {
+    const r = runCmd('which', ['tmux']);
+    return r.status === 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Run the daemon in a tmux session as a fallback for non-systemd Linux.
+ */
+function installViaTmux(projectRoot) {
+  const cliEntry = join(projectRoot, 'cli', 'bin.mjs');
+  if (!existsSync(cliEntry)) {
+    // Fallback to node path
+    return {
+      ok: false,
+      error: `cli entry not found at ${cliEntry}`,
+      note: 'install the BizarHarness repo first, then re-run this script',
+    };
+  }
+
+  if (!findTmux()) {
+    return {
+      ok: false,
+      error: 'tmux not found — cannot start background daemon',
+      note: 'install tmux or run manually: node cli/bin.mjs dash start --bg',
+    };
+  }
+
+  const sessionName = 'bizar-service';
+  // Kill existing session if present (idempotent)
+  runCmd('tmux', ['kill-session', '-t', sessionName]);
+  const r = runCmd('tmux', [
+    'new-session', '-d', '-s', sessionName,
+    'node', cliEntry, 'dash', 'start', '--bg',
+  ], { shell: false, timeout: 10_000 });
+
+  if (r.error || (r.status !== 0 && r.status !== null)) {
+    return {
+      ok: false,
+      error: `tmux new-session failed: ${r.stderr || r.error?.message || `exit ${r.status}`}`,
+      note: `run manually: node "${cliEntry}" dash start --bg`,
+    };
+  }
+
+  return {
+    ok: true,
+    unitPath: null,
+    note: `service started in tmux session "${sessionName}" (non-systemd fallback)`,
+  };
+}
+
+async function installService(opts = {}) {
+  const force = !!opts.force;
+  const projectRoot = resolve(REPO_ROOT);
+
+  // Path to service-controller.mjs (Stream A's file)
+  const controllerPath = join(projectRoot, 'cli', 'service-controller.mjs');
+
+  if (!existsSync(controllerPath)) {
+    // Stream A hasn't landed yet — this is NOT an error.
+    // Print a message and exit 0 so the installation doesn't fail.
+    console.log(JSON.stringify({
+      ok: true,
+      skipped: true,
+      note: 'service-controller.mjs not found (Stream A not yet landed). Install split across streams — service registration will be completed when cli/service-controller.mjs is available.',
+    }));
+    return;
+  }
+
+  // Dynamic import — we want a runtime error only if the module is present
+  // but fails to load.
+  let controller;
+  try {
+    controller = await import(controllerPath);
+  } catch (err) {
+    console.log(JSON.stringify({
+      ok: false,
+      error: `failed to load service-controller.mjs: ${err.message}`,
+      note: `run manually: node "${join(projectRoot, 'cli', 'service-controller.mjs')}" install`,
+    }));
+    return;
+  }
+
+  if (typeof controller.installService !== 'function') {
+    console.log(JSON.stringify({
+      ok: false,
+      error: 'service-controller.mjs does not export installService',
+    }));
+    return;
+  }
+
+  // Platform-specific fallback: on Linux without systemd, use tmux.
+  if (process.platform === 'linux' && !hasSystemd()) {
+    const result = installViaTmux(projectRoot);
+    console.log(JSON.stringify(result));
+    return;
+  }
+
+  try {
+    const result = controller.installService({ force, projectRoot });
+    console.log(JSON.stringify(result));
+  } catch (err) {
+    console.log(JSON.stringify({
+      ok: false,
+      error: `installService threw: ${err.message}`,
+    }));
+  }
+}
+
+// ── CLI entry ──────────────────────────────────────────────────────────────────
+
+const isMain = process.argv[1] && (
+  process.argv[1] === import.meta.filename ||
+  process.argv[1].endsWith('/install-service.mjs')
+);
+
+if (isMain) {
+  const flags = new Set(process.argv.slice(2));
+  const force = flags.has('--force') || flags.has('-f');
+  const opts = { force };
+
+  installService(opts).catch(err => {
+    console.log(JSON.stringify({
+      ok: false,
+      error: err.message,
+      note: 'unexpected error during service installation',
+    }));
+    process.exit(0); // still exit 0 so the overall install script doesn't fail
+  });
+}
+
+export { installService };

package/scripts/session-trace.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# session-trace.sh — Record structured session events to JSONL.
+#
+# Usage:
+#   ./scripts/session-trace.sh start    # record session start
+#   ./scripts/session-trace.sh end      # record session end
+#   ./scripts/session-trace.sh event <type> <data>   # record arbitrary event
+#
+# Output: .harness/traces/sessions.jsonl (gitignored)
+#
+# Per session, records:
+#   - start time, branch, commit
+#   - features touched (read from feature_list.json state transitions)
+#   - end time, files changed, tests run
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+TRACE_DIR="$ROOT/.harness/traces"
+TRACE_FILE="$TRACE_DIR/sessions.jsonl"
+
+mkdir -p "$TRACE_DIR"
+
+ACTION="${1:-}"
+NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+BRANCH=$(git -C "$ROOT" rev-parse --abbrev-ref HEAD 2>/dev/null || echo "no-branch")
+COMMIT=$(git -C "$ROOT" rev-parse --short HEAD 2>/dev/null || echo "no-commit")
+
+write_event() {
+  echo "$1" >> "$TRACE_FILE"
+}
+
+case "$ACTION" in
+  start)
+    write_event "{\"event\":\"session.start\",\"timestamp\":\"$NOW\",\"branch\":\"$BRANCH\",\"commit\":\"$COMMIT\"}"
+    echo "✓ Session started — recorded to $TRACE_FILE"
+    ;;
+  end)
+    write_event "{\"event\":\"session.end\",\"timestamp\":\"$NOW\",\"branch\":\"$BRANCH\",\"commit\":\"$COMMIT\"}"
+    echo "✓ Session ended — recorded to $TRACE_FILE"
+    ;;
+  event)
+    TYPE="${2:-unknown}"
+    DATA="${3:-}"
+    write_event "{\"event\":\"$TYPE\",\"timestamp\":\"$NOW\",\"branch\":\"$BRANCH\",\"commit\":\"$COMMIT\",\"data\":\"$DATA\"}"
+    echo "✓ Event '$TYPE' recorded"
+    ;;
+  *)
+    echo "Usage: $0 {start|end|event <type> <data>}"
+    exit 1
+    ;;
+esac

package/scripts/verify-feature.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# verify-feature.sh — Verify a feature from feature_list.json by ID.
+#
+# Usage: ./scripts/verify-feature.sh F-001
+#
+# Multi-layer validation in strict order (Layer 1 → Layer 2 → Layer 3).
+# On layer failure, prints the `repair` instruction from feature_list.json
+# so the agent knows exactly what to fix.
+#
+# On success, marks the feature `passing` and recomputes VCR.
+
+set -euo pipefail
+
+FEATURE_ID="${1:-}"
+if [[ -z "$FEATURE_ID" ]]; then
+  echo "Usage: $0 <feature-id>"
+  exit 1
+fi
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+FL="$ROOT/feature_list.json"
+
+if [[ ! -f "$FL" ]]; then
+  echo "FAIL: feature_list.json not found at $FL"
+  exit 1
+fi
+
+echo "▶ Verifying feature $FEATURE_ID..."
+echo "──────────────────────────────────────"
+
+# Run layers in order. Read the layers array from feature_list.json.
+# Stop on first failure; print repair instructions.
+
+# Layer 1: Compile (always runs)
+echo "Layer 1: TypeScript compile"
+if ! (cd "$ROOT" && bunx tsc --noEmit 2>&1 | tail -3); then
+  echo "FAIL: Layer 1 (compile) failed"
+  echo "REPAIR: Run 'make check' and fix TypeScript errors. Common issues:"
+  echo "        - Missing type annotation"
+  echo "        - Wrong zod shape passed to createTool"
+  echo "        - Missing import from @cline/sdk or @cline/core"
+  exit 1
+fi
+echo "  PASS"
+
+# Layers 2-N: Read from feature_list.json
+LAYERS=$(bun -e "
+const f = JSON.parse(await Bun.file('$FL').text());
+const x = f.features.find(y => y.id === '$FEATURE_ID');
+if (x && x.layers) {
+  for (const l of x.layers.slice(1)) {  // skip compile (already run)
+    console.log(JSON.stringify(l));
+  }
+}
+" 2>/dev/null || echo "")
+
+while IFS= read -r LAYER_JSON; do
+  [[ -z "$LAYER_JSON" ]] && continue
+  LABEL=$(echo "$LAYER_JSON" | bun -e "const d = JSON.parse(await Bun.stdin.text()); console.log(d.label);" 2>/dev/null)
+  CMD=$(echo "$LAYER_JSON" | bun -e "const d = JSON.parse(await Bun.stdin.text()); console.log(d.cmd);" 2>/dev/null)
+  REPAIR=$(echo "$LAYER_JSON" | bun -e "const d = JSON.parse(await Bun.stdin.text()); console.log(d.repair);" 2>/dev/null)
+
+  echo "Layer ($LABEL): $CMD"
+  set +e
+  OUTPUT=$(cd "$ROOT" && eval "$CMD" 2>&1)
+  RC=$?
+  set -e
+  if [[ $RC -eq 0 ]]; then
+    echo "  PASS"
+  else
+    echo "FAIL: Layer ($LABEL) failed (exit $RC)"
+    echo "REPAIR: $REPAIR"
+    echo "OUTPUT: $(echo "$OUTPUT" | tail -5)"
+    echo ""
+    echo "Do NOT proceed to the next layer. Fix this one first."
+    exit 1
+  fi
+done <<< "$LAYERS"
+
+# All layers passed — mark the feature `passing`
+COMMIT=$(cd "$ROOT" && git rev-parse --short HEAD 2>/dev/null || echo "no-commit")
+NOW=$(date -u +%Y-%m-%d)
+
+echo "▶ Marking $FEATURE_ID as passing..."
+bun -e "
+const f = JSON.parse(await Bun.file('$FL').text());
+const x = f.features.find(y => y.id === '$FEATURE_ID');
+if (x) {
+  x.state = 'passing';
+  x.passed = '$NOW';
+  x.commit = '$COMMIT';
+  x.evidence = 'make verify-feature $FEATURE_ID — all layers green ($NOW)';
+  const activated = f.features.filter(y => y.state !== 'not_started').length;
+  const passing = f.features.filter(y => y.state === 'passing').length;
+  f.vcr = { passing, activated, ratio: activated === 0 ? 1.0 : +(passing / activated).toFixed(3) };
+  await Bun.write('$FL', JSON.stringify(f, null, 2));
+  console.log('VCR:', passing + '/' + activated, '=', f.vcr.ratio);
+}
+"
+
+echo "──────────────────────────────────────"
+echo "✓ Feature $FEATURE_ID verified"