@polderlabs/bizar 6.2.5 → 6.3.0

package/packages/sdk/tests/fixtures/fetch-mock.ts

@@ -1,152 +0,0 @@
-/**
- * Test fixture: a fetch mock with canned responses + request log.
- *
- * Usage:
- *   const m = makeFetchMock();
- *   m.respondWith("GET", /\/sessions/, { body: [{ id: "ses_1" }] });
- *   const client = createBizarClient({ ..., fetch: m.fetch });
- *   await client.sessions.list();
- *   expect(m.lastRequest.url).toBe("http://127.0.0.1:4098/sessions");
- */
-
-export interface FetchMockRequest {
-  url: string;
-  method: string;
-  headers: Record<string, string>;
-  body: string | undefined;
-}
-
-export interface FetchMockRule {
-  method: string;
-  match: RegExp | string;
-  /** Plain canned response (text/JSON). */
-  response?: {
-    status: number;
-    body?: string;
-    contentType?: string;
-  };
-  /** Streaming response (SSE). Overrides `response` if both set. */
-  stream?: ReadableStream<Uint8Array>;
-  streamStatus?: number;
-  streamContentType?: string;
-}
-
-export interface FetchMock {
-  fetch: typeof fetch;
-  respondWith(method: string, match: RegExp | string, response: FetchMockRule["response"]): void;
-  respondWithStream(
-    method: string,
-    match: RegExp | string,
-    stream: ReadableStream<Uint8Array>,
-    opts?: { status?: number; contentType?: string },
-  ): void;
-  respondWithError(method: string, match: RegExp | string, error: Error): void;
-  lastRequest: FetchMockRequest | null;
-  requests: FetchMockRequest[];
-  reset(): void;
-}
-
-export function makeFetchMock(): FetchMock {
-  const rules: FetchMockRule[] = [];
-  const errorRules: Array<{ method: string; match: RegExp | string; error: Error }> = [];
-  const requests: FetchMockRequest[] = [];
-  let lastRequest: FetchMockRequest | null = null;
-
-  const mockFetch = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
-    const req: FetchMockRequest = {
-      url: typeof input === "string" ? input : input instanceof URL ? input.toString() : (input as Request).url,
-      method: (init?.method ?? "GET").toUpperCase(),
-      headers: parseHeaders(init?.headers),
-      body: init?.body === undefined ? undefined : String(init.body),
-    };
-    requests.push(req);
-    lastRequest = req;
-
-    const errorMatch = errorRules.find(
-      (r) => r.method.toUpperCase() === req.method && matchUrl(r.match, req.url),
-    );
-    if (errorMatch) throw errorMatch.error;
-
-    const rule = rules.find(
-      (r) => r.method.toUpperCase() === req.method && matchUrl(r.match, req.url),
-    );
-    if (!rule) {
-      return new Response(JSON.stringify({ error: "no mock rule" }), { status: 404 });
-    }
-
-    if (rule.stream) {
-      const headers: Record<string, string> = {};
-      headers["Content-Type"] = rule.streamContentType ?? "text/event-stream";
-      return new Response(rule.stream, {
-        status: rule.streamStatus ?? 200,
-        headers,
-      });
-    }
-
-    const r = rule.response ?? { status: 200 };
-    const headers: Record<string, string> = {};
-    if (r.contentType) headers["Content-Type"] = r.contentType;
-    else if (r.body !== undefined) headers["Content-Type"] = "application/json";
-
-    // 204/205/304 MUST NOT have a body per the Fetch spec.
-    if (r.status === 204 || r.status === 205 || r.status === 304) {
-      return new Response(null, { status: r.status, headers });
-    }
-
-    return new Response(r.body ?? "", {
-      status: r.status,
-      headers,
-    });
-  };
-
-  return {
-    fetch: mockFetch as typeof fetch,
-    respondWith(method, match, response) {
-      rules.push({ method: method.toUpperCase(), match, response });
-    },
-    respondWithStream(method, match, stream, opts) {
-      rules.push({
-        method: method.toUpperCase(),
-        match,
-        stream,
-        streamStatus: opts?.status ?? 200,
-        streamContentType: opts?.contentType ?? "text/event-stream",
-      });
-    },
-    respondWithError(method, match, error) {
-      errorRules.push({ method: method.toUpperCase(), match, error });
-    },
-    get lastRequest() {
-      return lastRequest;
-    },
-    requests,
-    reset() {
-      rules.length = 0;
-      errorRules.length = 0;
-      requests.length = 0;
-      lastRequest = null;
-    },
-  };
-}
-
-function matchUrl(match: RegExp | string, url: string): boolean {
-  if (typeof match === "string") return url.endsWith(match) || url.includes(match);
-  return match.test(url);
-}
-
-function parseHeaders(h: HeadersInit | undefined): Record<string, string> {
-  if (!h) return {};
-  if (h instanceof Headers) {
-    const out: Record<string, string> = {};
-    h.forEach((v, k) => {
-      out[k] = v;
-    });
-    return out;
-  }
-  if (Array.isArray(h)) {
-    const out: Record<string, string> = {};
-    for (const [k, v] of h) out[k] = v;
-    return out;
-  }
-  return { ...(h as Record<string, string>) };
-}

package/packages/sdk/tests/fixtures/sse-mock.ts

@@ -1,30 +0,0 @@
-/**
- * Test fixture: build an SSE ReadableStream from a list of events.
- */
-
-import type { DashboardEvent } from "../../src/types.js";
-
-export function sseStream(events: DashboardEvent[]): ReadableStream<Uint8Array> {
-  const encoder = new TextEncoder();
-  return new ReadableStream<Uint8Array>({
-    start(controller) {
-      for (const event of events) {
-        const chunk = `event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`;
-        controller.enqueue(encoder.encode(chunk));
-      }
-      controller.close();
-    },
-  });
-}
-
-export function sseRawStream(chunks: string[]): ReadableStream<Uint8Array> {
-  const encoder = new TextEncoder();
-  return new ReadableStream<Uint8Array>({
-    start(controller) {
-      for (const chunk of chunks) {
-        controller.enqueue(encoder.encode(chunk));
-      }
-      controller.close();
-    },
-  });
-}

package/plugins/bizar/ARCHITECTURE.md

@@ -1,142 +0,0 @@
-# plugins/bizar/ — Architecture
-
-> The Cline plugin entry and all 19 tools. This module is Layer 0
-> (Core) and runs inside the Cline host. See
-> [docs/architecture.md](../docs/architecture.md) for the layer
-> model.
-
-## Top-level layout
-
-```
-plugins/bizar/
-├── index.ts                       # AgentPlugin entry; setup() + tools + hooks
-├── src/
-│   ├── clineruntime.ts            # ClineCore wrapper (in-process)
-│   ├── memory-vault.ts            # Obsidian-compatible vault (in-process)
-│   ├── dangerous-patterns.ts      # 36 safety patterns (v6.0.0)
-│   ├── background.ts              # InstanceManager (state tracking)
-│   ├── background-state.ts        # Persisted state shape
-│   ├── plan-fs.ts                 # Plan directory read/write
-│   ├── plan-schema.ts             # Zod schema for plans
-│   ├── settings.ts                # User settings store
-│   ├── state.ts                   # Session state store (loop guard)
-│   ├── settings-store.ts          # Settings file IO
-│   ├── log-writer.ts              # Append-only tool-call log
-│   ├── reasoning-clean.ts         # <think> block stripper for fetch
-│   ├── key-rotation.ts            # API key rotation for fetch
-│   ├── compaction.mjs             # Compaction threshold
-│   ├── commands.ts                # Slash command parser (pure)
-│   ├── commands-impl.ts           # Slash command executor
-│   ├── logger.ts                  # Logger interface
-│   ├── hooks/
-│   │   ├── memory-inject.ts       # beforeModel hook
-│   │   ├── memory-write-on-end.ts # onEvent hook (session.idle/error)
-│   │   ├── skill-curator.ts       # Closed learning loop (v6.0.0)
-│   │   └── memory-flush-on-compact.ts # Pre-compact snapshot (v6.0.0)
-│   └── tools/                     # 19 tools
-│       ├── bg-collect.ts
-│       ├── bg-get-comments.ts
-│       ├── bg-kill.ts
-│       ├── bg-pause.ts
-│       ├── bg-report-progress.ts
-│       ├── bg-resume.ts
-│       ├── bg-send-message.ts
-│       ├── bg-spawn.ts
-│       ├── bg-status.ts
-│       ├── memory-list.ts
-│       ├── memory-read.ts
-│       ├── memory-search.ts
-│       ├── memory-write.ts
-│       ├── open-kb.ts
-│       ├── plan-action.ts
-│       ├── read-glyph-feedback.ts
-│       ├── team-spawn.ts
-│       ├── team-status.ts
-│       ├── wait-for-feedback.ts
-│       ├── graph-query.ts         # Knowledge graph (v6.0.0)
-│       ├── graph-path.ts          # Shortest path (v6.0.0)
-│       └── graph-explain.ts       # Node summary (v6.0.0)
-└── tests/                         # bun:test (45 files)
-```
-
-## Public contract
-
-```ts
-const plugin: AgentPlugin = {
-  name: "bizar",
-  manifest: { capabilities: ["tools", "hooks"] },
-  hooks: {...},  // computed from runtimeCtx
-  async setup(api, ctx) {
-    const { runtimeCtx, tools } = await initRuntime(api, ctx);
-    for (const t of tools) api.registerTool(t);
-  },
-};
-export default plugin;
-```
-
-## Tools (19 total)
-
-| Category | Count | Tools |
-| --- | --- | --- |
-| **Background agents** | 9 | `bizar_spawn_background`, `bizar_status`, `bizar_collect`, `bizar_kill`, `bizar_pause`, `bizar_resume`, `bizar_send_message`, `bizar_get_comments`, `bizar_report_progress` |
-| **Memory** | 4 | `bizar_memory_list`, `bizar_memory_read`, `bizar_memory_write`, `bizar_memory_search` |
-| **Plan / Glyphs** | 4 | `bizar_plan_action`, `bizar_open_kb`, `bizar_wait_for_feedback`, `bizar_read_glyph_feedback` |
-| **Cline agent teams** | 2 | `bizar_spawn_team`, `bizar_team_status` |
-| **Knowledge graph** | 3 | `bizar_graph_query`, `bizar_graph_path`, `bizar_graph_explain` |
-| **Total** | **22** | (19 + 3 graph) |
-
-> Note: 19 was the count before v6.0.0 added the 3 graph tools.
-> Current total: **22 tools**.
-
-## Hooks (4 + 2 safety)
-
-| Hook | Purpose |
-| --- | --- |
-| `beforeTool` | Loop guard + DANGEROUS_PATTERNS gate |
-| `afterTool` | Per-tool-call log to `LogWriter` |
-| `beforeModel` | Pre-compaction memory flush (writes snapshot to vault) |
-| `onEvent` | `message-added` (slash commands) + `run-finished`/`run-failed` (memory write) |
-
-| Safety hook | Purpose |
-| --- | --- |
-| `skill-curator` (manual) | Reports skill usage + flags revisions |
-| `memory-flush-on-compact` (auto) | Writes snapshot to vault when `shouldCompact()` returns true |
-
-## State flow
-
-1. `setup()` builds the runtime context (logger, env flags,
-   stores).
-2. Brings up `ClineRuntime` (best-effort; team tools only if
-   it works).
-3. Brings up `InstanceManager` in bg-only mode (no HTTP).
-4. Builds 22 tools via `buildTools(runtimeCtx, instanceManager,
-   clineRuntime)`.
-5. Each tool uses
-   `createTool({ name, description, inputSchema: z.object({...}).shape, execute })`.
-6. Hooks are computed lazily from the runtime context.
-
-## Key invariants
-
-- **Plugin must NOT import from `bizar-dash/`** (Layer 1).
-- **Memory tools MUST use the in-process vault** (no HTTP).
-- **Tools MUST use `createTool`** (no manual `AgentTool` shapes).
-- **ClineRuntime MUST be used** (no `cline serve` subprocess).
-- **All tool calls MUST pass `checkDangerous()`** in `beforeTool`.
-- **Compaction MUST trigger a flush** in `beforeModel`.
-
-## Verification
-
-- `make check` — TS compile + tests
-- `make e2e` — real plugin load + 27 tool/hook checks
-- `make check-arch` — arch-rules.json enforcement (7 rules)
-- `make clean-check` — 5-dimension clean-state check
-
-## See also
-
-- [plugins/bizar/CONSTRAINTS.md](CONSTRAINTS.md) — module hard rules
-- [docs/architecture.md](../docs/architecture.md) — layer model
-- [docs/safety.md](../docs/safety.md) — DANGEROUS_PATTERNS reference
-- [docs/curator.md](../docs/curator.md) — Skill curator
-- [docs/graph-tools.md](../docs/graph-tools.md) — Graph tools
-- [docs/decisions/DEC-001-cline-rewrite.md](../docs/decisions/DEC-001-cline-rewrite.md)
-  — the OpenCode → Cline rewrite

package/plugins/bizar/CONSTRAINTS.md

@@ -1,67 +0,0 @@
-# plugins/bizar/ — Hard Rules
-
-> Module-specific hard rules. These complement the root
-> [AGENTS.md](../../AGENTS.md) constraints. Violations break the
-> plugin's portability or safety guarantees.
-
-## Hard rules
-
-- **MUST** use `createTool` from `@cline/sdk` for every tool.
-  # why: Ensures the `AgentTool` shape is correct and the host can
-  # validate the inputSchema.
-- **MUST** use the in-process `ClineRuntime` (no `cline serve` subprocess).
-  # why: The subprocess hangs in headless test environments.
-- **MUST** use the in-process `memory-vault.ts` for memory operations.
-  # why: The plugin must work without the dashboard.
-- **MUST** run the `InstanceManager` in bg-only mode (http=null).
-  # why: No HTTP server means no background-agent controls via HTTP.
-  # The dashboard owns the actual Cline session lifecycle.
-- **MUST NOT** import from `bizar-dash/`.
-  # why: Cross-layer violation. Use `@cline/sdk` or `packages/sdk/`.
-- **MUST NOT** use `fetch('http://127.0.0.1:...')` for memory.
-  # why: The plugin must work in-process without a dashboard.
-- **MUST NOT** return `{ output: JSON.stringify(...) }` from tool `execute()`.
-  # why: Use the structured `AgentToolResult` shape (`{ ok, ... }`).
-- **MUST NOT** hand-roll `AgentTool` shapes (use `createTool`).
-  # why: Hand-rolled tools drift from the Cline contract.
-- **MUST** pass every tool call through `checkDangerous()` in `beforeTool`.
-  # why: 36 dangerous patterns must be checked before the call
-  # reaches the host. Deny decisions stop the call.
-- **MUST** call `createMemoryFlushOnCompact().maybeFlush()` in
-  `beforeModel` when usage crosses the compaction threshold.
-  # why: Compaction drops context before persistence; the flush
-  # writes a durable snapshot first.
-- **MUST NOT** spawn subagents with `rm -rf`, `sudo`, SSRF, or
-  prompt-injection content. (Enforced by `checkDangerous()`.)
-  # why: Defense in depth — even legitimate agents sometimes
-  # generate bad tool calls.
-
-## Soft rules
-
-- Prefer `bun:test` over `vitest` for new tests.
-- Prefer `Bun.file().text()` over `fs.readFileSync` for async reads.
-- Use `logger.debug()` not `console.debug()`.
-- Use `process.env.BIZAR_*` for environment-driven config.
-- The plugin's `setup()` should not block. Use `try/catch` for
-  ClineRuntime setup; fall back gracefully.
-
-## Anti-patterns
-
-- ❌ Adding new tool types via the old OpenCode `tool()` factory
-  → Use `createTool()`.
-- ❌ Putting state in the plugin entry's module scope
-  → Use `ctx.stateStore` for per-session state.
-- ❌ Calling `process.exit()` from a hook
-  → Return `{ stop: true, reason: '...' }` to the host.
-- ❌ Spawning long-lived side effects in `beforeTool`
-  → Use the `afterTool` hook for post-call actions.
-- ❌ Skipping `checkDangerous()` for "trusted" tools
-  → All tool calls go through the gate, no exceptions.
-
-## When in doubt
-
-1. Read [docs/architecture.md](../../docs/architecture.md) for the layer model.
-2. Check [.harness/arch-rules.json](../../.harness/arch-rules.json) for enforced rules.
-3. Run `make check-arch` before committing.
-4. Read [docs/decisions/DEC-007-tool-approval-gate.md](../../docs/decisions/DEC-007-tool-approval-gate.md)
-   for the safety gate.

package/plugins/bizar/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 DrB0rk
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.