@polderlabs/bizar 8.0.0 → 9.0.0

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/memory-obsidian.mjs

@@ -0,0 +1,230 @@
+/**
+ * src/server/memory-obsidian.mjs
+ *
+ * v4.7.0 — Obsidian-flavoured façade for the Bizar Memory Service.
+ *
+ * The Memory tab treats Obsidian as one of four memory sources (alongside
+ * LightRAG, git, and semantic search). This module gives that source a
+ * single import surface that the dashboard can hit without re-deriving the
+ * vault layout or wikilink semantics from raw `memory-store` calls.
+ *
+ * The Obsidian CRUD itself lives in `memory-store.mjs` — re-exporting from
+ * there keeps the schema/secret/git-side-effects behaviour in one place.
+ * This façade adds:
+ *   - tree()         — recursive folder tree for the Memory tab browser
+ *   - listBacklinks() — wikilink reverse index
+ *   - linkGraph()     — node/edge dump for graph visualisation
+ *   - diffVault()     — quick textual diff of two notes
+ *
+ * No new state, no new files on disk — these are all derived from existing
+ * memory-store primitives.
+ */
+
+import { statSync, readdirSync, existsSync } from 'node:fs';
+import { join, basename as pathBasename, relative } from 'node:path';
+import {
+  listNotes,
+  readNote,
+  writeNote,
+  deleteNote,
+  searchVault,
+  findBacklinks as _findBacklinks,
+  vaultStats,
+  resolveVault,
+} from './memory-store.mjs';
+
+// ── Re-exports (verbatim) ──────────────────────────────────────────────────
+
+export {
+  listNotes,
+  readNote,
+  writeNote,
+  deleteNote,
+  searchVault,
+  vaultStats,
+  resolveVault,
+};
+
+// ── Folder tree ────────────────────────────────────────────────────────────
+
+/**
+ * Build a recursive folder tree of the vault, useful for the Memory tab
+ * folder browser. Each node is either a folder (with children) or a leaf
+ * (with size + mtime).
+ *
+ * @param {string} projectRoot
+ * @param {{ maxDepth?: number }} [opts]
+ * @returns {{
+ *   name: string,
+ *   path: string,
+ *   type: 'folder'|'note',
+ *   size?: number,
+ *   mtime?: number,
+ *   children?: Array<ReturnType<typeof tree>>,
+ * }|null}
+ */
+export function tree(projectRoot, { maxDepth = 6 } = {}) {
+  const info = vaultStats(projectRoot);
+  if (!info.exists || !info.vaultRoot || !existsSync(info.vaultRoot)) return null;
+  return buildNode(info.vaultRoot, info.vaultRoot, maxDepth, 0);
+}
+
+function buildNode(absPath, vaultRoot, maxDepth, depth) {
+  const stat = statMaybe(absPath);
+  const name = pathBasename(absPath) || absPath;
+  const rel = relative(vaultRoot, absPath).split('\\').join('/');
+
+  if (stat && stat.isFile()) {
+    return {
+      name: name.replace(/\.md$/i, ''),
+      path: rel || name,
+      type: 'note',
+      size: stat.size,
+      mtime: stat.mtimeMs,
+    };
+  }
+
+  // Directory
+  const children = [];
+  if (depth < maxDepth) {
+    let entries;
+    try {
+      entries = readdirSync(absPath, { withFileTypes: true });
+    } catch {
+      entries = [];
+    }
+    for (const e of entries) {
+      if (e.name.startsWith('.')) continue;
+      const childPath = join(absPath, e.name);
+      children.push(buildNode(childPath, vaultRoot, maxDepth, depth + 1));
+    }
+    children.sort((a, b) => {
+      if (a.type !== b.type) return a.type === 'folder' ? -1 : 1;
+      return a.name.localeCompare(b.name);
+    });
+  }
+
+  return {
+    name,
+    path: rel,
+    type: 'folder',
+    children,
+  };
+}
+
+function statMaybe(p) {
+  try { return statSync(p); } catch { return null; }
+}
+
+// ── Backlinks ──────────────────────────────────────────────────────────────
+
+/**
+ * List notes that link TO `targetRelPath` via wikilinks.
+ *
+ * @param {string} projectRoot
+ * @param {string} targetRelPath
+ * @returns {Array<{ fromRelPath: string, fromTitle: string, snippet: string, mtime: number }>}
+ */
+export function listBacklinks(projectRoot, targetRelPath) {
+  return _findBacklinks(projectRoot, targetRelPath);
+}
+
+// ── Link graph ─────────────────────────────────────────────────────────────
+
+/**
+ * Build a simple node/edge representation of wikilinks across the vault,
+ * suitable for the Memory tab link-graph visualizer.
+ *
+ * Each node is a note (identified by relPath). Each edge is a wikilink
+ * reference from one note to another. Self-links and dangling links
+ * (wikilinks to non-existent notes) are included with `dangling: true`.
+ *
+ * @param {string} projectRoot
+ * @param {{ limit?: number }} [opts]
+ * @returns {{ nodes: Array<{ id: string, label: string, mtime: number }>, edges: Array<{ from: string, to: string, raw: string, dangling: boolean }> }}
+ */
+export function linkGraph(projectRoot, { limit = 500 } = {}) {
+  const notes = listNotes(projectRoot);
+  const known = new Set();
+  for (const n of notes) known.add(n.relPath.replace(/\.md$/i, ''));
+
+  const nodes = notes.slice(0, limit).map((n) => ({
+    id: n.relPath,
+    label: n.frontmatter?.title || pathBasename(n.relPath).replace(/\.md$/i, ''),
+    mtime: n.mtime,
+  }));
+
+  const edges = [];
+  const WIKILINK_RE = /\[\[([^\]\n|#]+?)(?:#[^\]\n|]+?)?(?:\|[^\]\n]+?)?\]\]/g;
+
+  for (const note of notes) {
+    const body = note.body || '';
+    WIKILINK_RE.lastIndex = 0;
+    let m;
+    while ((m = WIKILINK_RE.exec(body)) !== null) {
+      const raw = (m[1] || '').trim();
+      if (!raw) continue;
+      const target = resolveWikilinkTarget(raw, note.relPath);
+      if (!target) continue;
+      const dangling = !known.has(target);
+      edges.push({ from: note.relPath, to: `${target}.md`, raw, dangling });
+      if (edges.length >= limit * 4) break;
+    }
+    if (edges.length >= limit * 4) break;
+  }
+
+  return { nodes, edges };
+}
+
+/**
+ * Resolve a wikilink target string against Obsidian's rules.
+ * Returns the relPath-without-extension if the target exists, or `null` if
+ * the wikilink is empty / unparseable.
+ */
+function resolveWikilinkTarget(raw, fromRelPath) {
+  if (!raw) return null;
+  const stripped = raw.split('#')[0].split('|')[0].trim();
+  if (!stripped) return null;
+  if (stripped.includes('/')) return stripped.replace(/\.md$/i, '');
+  return stripped.replace(/\.md$/i, '');
+}
+
+// ── Diff (textual) ─────────────────────────────────────────────────────────
+
+/**
+ * Lightweight textual diff between two notes. Returns { from, to, lines }.
+ * `lines` is an array of { kind: 'same'|'add'|'del', text } entries.
+ *
+ * Used by the Memory → Git Sync panel to show the working-tree diff of
+ * a single file. Not a full Myers diff — just a sorted-set diff which is
+ * good enough for "what changed?" UI.
+ *
+ * @param {string} projectRoot
+ * @param {string} fromPath — '' for "no previous version"
+ * @param {string} toPath
+ */
+export function diffVault(projectRoot, fromPath, toPath) {
+  const from = fromPath ? readNote(projectRoot, fromPath) : null;
+  const to = toPath ? readNote(projectRoot, toPath) : null;
+  const fromLines = splitLines(from?.body || '');
+  const toLines = splitLines(to?.body || '');
+
+  const fromSet = new Set(fromLines);
+  const toSet = new Set(toLines);
+
+  const lines = [];
+  for (const t of toLines) {
+    if (!fromSet.has(t)) lines.push({ kind: 'add', text: t });
+    else lines.push({ kind: 'same', text: t });
+  }
+  for (const f of fromLines) {
+    if (!toSet.has(f)) lines.push({ kind: 'del', text: f });
+  }
+
+  return { from: fromPath || null, to: toPath || null, lines };
+}
+
+function splitLines(s) {
+  if (!s) return [];
+  return s.split(/\r?\n/).filter((l) => l.length > 0);
+}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/memory-schema.mjs

@@ -0,0 +1,145 @@
+/**
+ * src/server/memory-schema.mjs
+ *
+ * Validates frontmatter against the Bizar Memory Schema. The schema requires
+ * a set of standard fields (memory_id, type, project_id, status, confidence,
+ * created, updated, tags) with enumerated values for type, status, and
+ * confidence.
+ */
+
+export const REQUIRED_FIELDS = [
+  'memory_id',
+  'type',
+  'project_id',
+  'status',
+  'confidence',
+  'created',
+  'updated',
+  'tags',
+];
+
+export const VALID_TYPES = [
+  'project_overview',
+  'architecture_decision',
+  'coding_convention',
+  'bug_pattern',
+  'command',
+  'api_contract',
+  'dependency_note',
+  'environment_fact',
+  'task_summary',
+  'session_summary',
+  'user_preference',
+];
+
+export const VALID_STATUSES = [
+  'active',
+  'superseded',
+  'stale',
+  'conflict',
+  'draft',
+  'archived',
+];
+
+export const VALID_CONFIDENCES = ['verified', 'inferred', 'speculative'];
+
+/**
+ * Validate a note's frontmatter and body against the schema.
+ *
+ * @param {Record<string, unknown>} frontmatter
+ * @param {string} body
+ * @returns {{ valid: boolean, errors: string[], warnings: string[] }}
+ */
+export function validateNote(frontmatter, body) {
+  const errors = [];
+  const warnings = [];
+
+  if (!frontmatter || typeof frontmatter !== 'object') {
+    errors.push('frontmatter must be a plain object');
+    return { valid: false, errors, warnings };
+  }
+
+  // Required fields
+  for (const field of REQUIRED_FIELDS) {
+    if (!(field in frontmatter) || frontmatter[field] === undefined || frontmatter[field] === null || frontmatter[field] === '') {
+      errors.push(`missing required field: ${field}`);
+    }
+  }
+
+  // Type enum
+  if (frontmatter.type && !VALID_TYPES.includes(frontmatter.type)) {
+    errors.push(`invalid type: '${frontmatter.type}'. Must be one of: ${VALID_TYPES.join(', ')}`);
+  }
+
+  // Status enum
+  if (frontmatter.status && !VALID_STATUSES.includes(frontmatter.status)) {
+    errors.push(`invalid status: '${frontmatter.status}'. Must be one of: ${VALID_STATUSES.join(', ')}`);
+  }
+
+  // Confidence enum
+  if (frontmatter.confidence && !VALID_CONFIDENCES.includes(frontmatter.confidence)) {
+    errors.push(`invalid confidence: '${frontmatter.confidence}'. Must be one of: ${VALID_CONFIDENCES.join(', ')}`);
+  }
+
+  // Tags must be an array
+  if (frontmatter.tags !== undefined && !Array.isArray(frontmatter.tags)) {
+    errors.push('tags must be an array');
+  }
+
+  // memory_id format check: should be non-empty string
+  if (frontmatter.memory_id && typeof frontmatter.memory_id !== 'string') {
+    errors.push('memory_id must be a string');
+  }
+
+  // project_id format check
+  if (frontmatter.project_id && typeof frontmatter.project_id !== 'string') {
+    errors.push('project_id must be a string');
+  }
+
+  // ISO-8601 date fields
+  for (const dateField of ['created', 'updated']) {
+    if (frontmatter[dateField]) {
+      const val = String(frontmatter[dateField]);
+      if (!/^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}:\d{2}(\.\d{3})?(Z|[+-]\d{2}:\d{2})?)?$/.test(val)) {
+        warnings.push(`${dateField} is not a valid ISO-8601 date: '${val}'`);
+      }
+    }
+  }
+
+  // Body presence check
+  if (!body || !body.trim()) {
+    warnings.push('body is empty — notes should have substantive content');
+  }
+
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings,
+  };
+}
+
+/**
+ * Build a default frontmatter object from a partial override.
+ * Fills in all missing required fields with sensible defaults.
+ *
+ * @param {Partial<Record<string, unknown>>} partial
+ * @returns {Record<string, unknown>}
+ */
+export function defaultFrontmatter(partial = {}) {
+  const now = new Date().toISOString();
+  const timestamp = Date.now();
+  const type = partial.type || 'session_summary';
+  const memoryId = partial.memory_id || `${type}_${timestamp}`;
+
+  return {
+    memory_id: memoryId,
+    type: type,
+    project_id: partial.project_id || '',
+    status: partial.status || 'draft',
+    confidence: partial.confidence || 'inferred',
+    created: partial.created || now,
+    updated: partial.updated || now,
+    tags: Array.isArray(partial.tags) ? partial.tags : [],
+    ...partial,
+  };
+}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/memory-secrets.mjs

@@ -0,0 +1,84 @@
+/**
+ * src/server/memory-secrets.mjs
+ *
+ * Regex-based secret scanner for structured long-term memory notes.
+ * Detects HIGH and MEDIUM severity patterns (API keys, tokens, private keys,
+ * absolute paths, private IPv4 addresses). Designed to run before every
+ * commit to prevent accidental secret leakage.
+ */
+
+/**
+ * All secret patterns. severity is 'HIGH' or 'MEDIUM'.
+ *
+ * @type {Array<{ id: string, severity: 'HIGH' | 'MEDIUM', pattern: RegExp }>}
+ */
+export const SECRET_PATTERNS = [
+  // HIGH severity
+  { id: 'private_key_pem',    severity: 'HIGH', pattern: /-----BEGIN (RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY-----/ },
+  { id: 'aws_access_key',    severity: 'HIGH', pattern: /\bAKIA[0-9A-Z]{16}\b/ },
+  { id: 'aws_secret_key',    severity: 'HIGH', pattern: /\baws_secret_access_key\s*[:=]\s*[A-Za-z0-9\/+=]{40}\b/ },
+  { id: 'github_pat_classic', severity: 'HIGH', pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/ },
+  { id: 'github_pat_fine',   severity: 'HIGH', pattern: /\bgithub_pat_[A-Za-z0-9_]{82}\b/ },
+  { id: 'slack_token',       severity: 'HIGH', pattern: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/ },
+  { id: 'stripe_live',       severity: 'HIGH', pattern: /\bsk_live_[0-9a-zA-Z]{24,}\b/ },
+  { id: 'stripe_test',       severity: 'HIGH', pattern: /\bsk_test_[0-9a-zA-Z]{24,}\b/ },
+  // Bearer token: refined to require base64-like chars after "Bearer "
+  // and terminate on whitespace, punctuation, or end-of-string
+  {
+    id: 'bearer_token',
+    severity: 'HIGH',
+    pattern: /\bBearer\s+[A-Za-z0-9+\/=_\-]{20,}(?:\s|$|[,;.])/,
+  },
+  // MEDIUM severity
+  {
+    id: 'api_key_assignment',
+    severity: 'MEDIUM',
+    // Non-greedy {16,}? so the end-of-line assertion has something to match
+    pattern: /\b(api[_-]?key|apikey|secret)\s*[:=]\s*['"]?[A-Za-z0-9_\-]{16,}?['"]?(?:\s*$|[,;.\n])/im,
+  },
+  { id: 'absolute_path',     severity: 'MEDIUM', pattern: /\/(Users|home)\/[A-Za-z0-9._-]+/ },
+  { id: 'private_ipv4',      severity: 'MEDIUM', pattern: /\b(10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+)\b/ },
+];
+
+/**
+ * Scan text for secret patterns. Returns a structured scan result.
+ *
+ * @param {string} text — raw text to scan (usually the full body of a note)
+ * @returns {{ safe: boolean, findings: Array<{ id: string, severity: 'HIGH' | 'MEDIUM', line: number, snippet: string }> }}
+ */
+export function scan(text) {
+  if (typeof text !== 'string') return { safe: true, findings: [] };
+
+  const findings = [];
+  const lines = text.split('\n');
+
+  for (const { id, severity, pattern } of SECRET_PATTERNS) {
+    // Reset lastIndex each iteration for global patterns
+    pattern.lastIndex = 0;
+    for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+      const line = lines[lineNum];
+      pattern.lastIndex = 0;
+      const match = pattern.exec(line);
+      if (match) {
+        const snippet = line.slice(Math.max(0, match.index - 20), match.index + match[0].length + 20);
+        findings.push({ id, severity, line: lineNum + 1, snippet });
+        // Only report first match per pattern per line
+      }
+    }
+  }
+
+  return {
+    safe: findings.filter((f) => f.severity === 'HIGH').length === 0,
+    findings,
+  };
+}
+
+/**
+ * Returns true if the scan result contains any HIGH-severity findings.
+ *
+ * @param {{ safe: boolean, findings: Array<{ severity: string }> }} result
+ * @returns {boolean}
+ */
+export function hasHighFindings(result) {
+  return result.findings.some((f) => f.severity === 'HIGH');
+}