@polderlabs/bizar 8.1.0 → 9.0.0

package/.claude/worktrees/kanban-overhaul/CLAUDE.md

@@ -0,0 +1,260 @@
+<!-- headroom:rtk-instructions -->
+# RTK (Rust Token Killer) — token-optimized shell commands (always safe to prefix).
+
+<!-- end headroom -->
+
+# CLAUDE.md — Bizar Harness
+
+> **Canonical Claude Code entry point for Bizar Harness.**
+>
+> This file is what Claude Code reads at session start. It is kept in
+> sync with `AGENTS.md` via `make mirror-agents-md`
+> (`scripts/mirror-agents-md.sh`); edits should land in `AGENTS.md`
+> first, then mirrored here. The mirror check fails CI when they
+> diverge.
+
+# AGENTS.md — Bizar Harness
+
+> **Bizar Harness** is a Claude Code-native multi-agent coding harness
+> for the Bizar project. It embeds the Claude Code Agent SDK
+> in-process, ships skills + MCP servers + slash commands under
+> `.claude/`, and ships a TypeScript dashboard with a kanban task
+> board and live agent viewer.
+
+If you are an agent: read this file, then `PROGRESS.md`, then run `make check`.
+
+## Quick commands
+
+```sh
+make setup       # Install dependencies (bun install)
+make dev         # Start dashboard in dev mode
+make check       # Full verification pipeline (typecheck + test)
+make test        # Run all tests (skill + sdk + dashboard)
+make e2e         # End-to-end tests (real plugin load + tool exercise)
+make vcr         # Verify Code Reality check via feature_list.json
+make verify-feature ID=<n>  # Verify feature ID from feature_list.json
+make check-arch  # Architectural constraints (scripts/check-arch.sh)
+make clean-check # 5-dimension clean-state check
+make session-start  # Record session start
+make session-end    # Record session end
+```
+
+## Hard constraints (MUST / MUST NOT)
+
+These rules are not optional. Violations break long sessions.
+
+- **MUST** run `make check` before claiming work is done.
+  # why: TS drift + failing tests are the #1 cause of broken sessions.
+- **MUST** update `PROGRESS.md` before AND after every code change.
+  # why: Cross-session memory lives there.
+- **MUST** keep one logical operation per commit.
+  # why: Bisecting, reverting, reviewing require atomic units.
+- **MUST** keep documentation in sync with code in the same commit.
+  # why: Stale docs are worse than no docs.
+- **MUST** follow the WIP=1 rule: only one feature active at a time.
+  # why: Parallel WIP prevents VCR from reaching 1.0.
+- **MUST NOT** use `claude daemon` or any persistent subprocess for the
+  runtime. Claude Code is in-process by default; if you need a long-running
+  background context, use `claude --bg` per the Claude Code CLI docs.
+  # why: Subprocess hangs in headless test envs.
+- **MUST NOT** call dashboard HTTP from plugin for memory — use the in-process vault.
+  # why: The plugin must work without a dashboard.
+- **MUST NOT** commit `console.log`, `debugger`, or `.only()`.
+  # why: `make clean-check` fails on these.
+- **MUST NOT** skip E2E tests when changes cross component boundaries.
+  # why: Unit tests pass on stubs; only E2E catches drift.
+- **MUST** configure tool access via `.claude/settings.json` (project) or
+  `~/.claude/settings.json` (user). Permission table is expressed as a
+  Claude Code allow/deny list scoped to the Claude Code tool surface:
+  Read, Edit, Write, Bash, Grep, Glob, WebFetch, WebSearch, NotebookEdit,
+  Agent (subagent dispatch with `run_in_background` / `isolation: "worktree"`),
+  Skill, AskUserQuestion, SendMessage.
+
+## Operating Manual (Claude Code-aware)
+
+This harness runs **inside Claude Code**. Its hooks execute in Claude Code's
+event loop (`PreToolUse`, `PostToolUse`, `UserPromptSubmit`,
+`SessionStart`, `SessionEnd`); its skills live under `.claude/skills/` and
+are loaded by name; its agents live under `.claude/agents/` and are
+dispatched via the `Agent` tool; its MCP servers live under
+`.claude/mcp.json` and are spawned at session start. Plugin / agent
+extension logic that previously needed Cline's `AgentPlugin` API is now
+expressed as a Claude Code skill (markdown + optional hooks script) plus,
+when state is needed across sessions, a Claude Code MCP server registered
+via the Agent SDK (`@anthropic-ai/claude-agent-sdk`).
+
+The mistake limit follows Claude Code's default of `6` consecutive
+tool-validation failures before a session is aborted; specific agents
+may override this in their `.claude/agents/<agent>.md` `permission`
+frontmatter (or via `isolation: { max_mistakes: 10 }` on the Agent
+tool call). The plugin's previous `clineruntimeMaxConsecutiveMistakes`
+field is renamed `claudeAgentMaxConsecutiveMistakes` in v6.3.0; the
+default is 10 (the floor is always Math.max'd against the runtime's
+default).
+
+The hook shape is the Claude Code event bag: each hook receives a
+typed payload and returns either `{ continue: true }` (pass through),
+`{ continue: false, stopReason: "..." }` (block), or, for `PreToolUse`
+hooks, `{ hookSpecificOutput: { permissionDecision: "allow" | "deny" | "ask", ...}}`
+(matches the previous `decision: allow|require-approval|deny` semantics).
+
+## State files (where the system remembers things)
+
+- `PROGRESS.md` — Current state, In Progress, Next Steps, Blockers
+- `DECISIONS.md` — Architectural decisions log
+- `feature_list.json` — Machine-readable feature state
+- `docs/architecture.md` — Layer model + module map
+- `docs/quality-document.md` — A/B/C/D module health scores
+- `.harness/arch-rules.json` — Architectural rule registry (WHAT/WHY/FIX)
+- `.harness/traces/sessions.jsonl` — Runtime session traces (gitignored)
+- `templates/sprint-contract.md` — Pre-feature negotiation template
+- `templates/evaluator-rubric.md` — Sprint scoring rubric
+- `templates/clean-state-checklist.md` — 5-dimension exit checklist
+- `.claude/settings.json` — Project-scoped Claude Code tool permissions
+- `.claude/agents/*.md` — Bizar agent definitions (Odin, Frigg, ...)
+- `.claude/skills/*/SKILL.md` — Bizar skill packs (auto-loaded by name)
+- `.claude/commands/*.md` — User/project-level slash commands
+- `.claude/hooks/*` — Executable hook scripts (PreToolUse, PostToolUse, ...)
+- `.claude/mcp.json` — MCP server registrations (Semble, Bizar memory, ...)
+
+## Clock-in (start of session)
+
+1. Read `PROGRESS.md` → confirm starting state + last commit.
+2. Read `CLAUDE.md` (Claude Code reads this automatically).
+3. Run `make check` → confirm green baseline.
+4. Read `feature_list.json` → pick next `not_started` feature (WIP=1).
+5. If feature needs negotiation, fill `templates/sprint-contract.md`.
+6. Mark feature `active` in `feature_list.json`, commit.
+7. Run `make session-start`.
+
+## Clock-out (end of session)
+
+1. Update `PROGRESS.md` Current State (commit hash + `make check` result).
+2. Move feature from `active` → `passing` in `feature_list.json`.
+3. Populate `evidence` field with test output / commit hash.
+4. Score against `templates/evaluator-rubric.md` — every dim B+.
+5. Run `make clean-check` — must pass on all 5 dimensions.
+6. Run `make check` — must be green.
+7. Commit with WHY-focused message.
+8. Run `make session-end`.
+
+> **Context anxiety warning:** If running low on context, do NOT rush
+> to finish. Stop, update `PROGRESS.md` Next Steps with concrete actions,
+> commit a clean checkpoint. Claude Code's `/compact` is the safety net;
+> reach for it before panic-editing.
+
+## Definition of Done (L09)
+
+A feature is `passing` only when ALL THREE LAYERS verify:
+
+- **Layer 1 — Compile/typecheck:** `make check` is green.
+- **Layer 2 — Unit tests:** `make test` passes for the touched module.
+- **Layer 3 — E2E:** `make e2e` exercises real plugin load + tools + hooks.
+
+Layer ordering is mandatory. **Do NOT proceed to Layer N+1 if Layer N
+fails.** A typecheck error (Layer 1) means Layers 2 and 3 will also
+fail — fix it first.
+
+Runtime signals include:
+- `bun run /tmp/bh-full-e2e.mjs` exits 0 (22/22 pass)
+- Plugin `setup()` returns in < 1s and registers 19 tools
+- Memory tools round-trip (write → read → list → search)
+- Claude Code agent dispatch wired (Odin → subagents via `Agent` tool)
+- Kanban board renders against `/api/tasks`
+
+## Feature List Rules (L08)
+
+State machine: `not_started` → `active` → `passing` (or back to `active` on failure).
+
+- **Granularity:** One session per feature. Split if longer.
+- **Pass-state gating:** Only `passing` features count toward VCR.
+- **Evidence:** Required when marking `passing` (test output / commit hash).
+
+## Architecture Boundaries (L10)
+
+- `.claude/skills/` + `.claude/mcp.json` + `.claude/agents/` — Layer 0 (Core). Skills and MCP servers replace the previous plugin layer.
+- `bizar-dash/` — Layer 1 (UI).
+- They communicate via the Claude Code Agent SDK, never via raw HTTP/stdio for memory.
+
+`make check-arch` enforces:
+- Skill must not import from `bizar-dash/` (cross-layer).
+- Skill must not call `fetch('http://127.0.0.1:...')` for memory.
+- Dashboard must not re-implement Claude Code Agent SDK features.
+
+Every code-review finding becomes a rule in `.harness/arch-rules.json`
+with `what` / `why` / `fix` fields.
+
+## Observability (L11)
+
+Per feature:
+
+1. **Pre:** Fill `templates/sprint-contract.md` (scope, DoD, exclusions).
+2. **During:** `make session-start` records session ID.
+3. **During:** Tool invocations logged to `.harness/traces/sessions.jsonl`.
+4. **Post:** Score against `templates/evaluator-rubric.md`.
+
+## Clean State Protocol (L12)
+
+A session is "clean" when ALL FIVE dimensions pass:
+
+1. **Build passes:** `make check` exits 0.
+2. **Tests pass:** `make test` exits 0.
+3. **Feature list updated:** `feature_list.json` reflects actual state.
+4. **No debug artifacts:** No `console.log`, `debugger`, `*.only()`.
+5. **Startup path works:** `make e2e` registers the plugin and runs.
+
+`make clean-check` is the idempotent verifier. Run at every clock-out.
+
+**Dual-mode cleanup:**
+- *Immediate:* Run `make clean-check` at every clock-out.
+- *Periodic (weekly):* Full structural sweep — unused files, stale deps,
+  orphaned tests.
+
+## Topic documents
+
+- [MILESTONES.md](MILESTONES.md) — strategic roadmap (vision, 4 phases)
+- [IMPLEMENTATION_PLAN.md](IMPLEMENTATION_PLAN.md) — tactical plan (current state + sprints)
+- [docs/INDEX.md](docs/INDEX.md) — documentation map (start here)
+- [docs/architecture.md](docs/architecture.md) — layer model, module map
+- [docs/quality-document.md](docs/quality-document.md) — module health (A/B/C/D)
+- [docs/code-review.md](docs/code-review.md) — code review findings + actions
+- [docs/safety.md](docs/safety.md) — DANGEROUS_PATTERNS reference (v6.0.0)
+- [docs/curator.md](docs/curator.md) — Skill curator reference (v6.0.0)
+- [docs/graph-tools.md](docs/graph-tools.md) — Knowledge graph tools (v6.0.0)
+- [docs/migration-guide.md](docs/migration-guide.md) — Claude Code migration (v6.3.0)
+- [docs/decisions/](docs/decisions/) — individual ADRs (see DECISIONS.md)
+- [plugins/bizar/ARCHITECTURE.md](plugins/bizar/ARCHITECTURE.md) — plugin module
+- [plugins/bizar/CONSTRAINTS.md](plugins/bizar/CONSTRAINTS.md) — plugin hard rules
+- [plugins/bizar/tests/README.md](plugins/bizar/tests/README.md) — test reference
+- [bizar-dash/ARCHITECTURE.md](bizar-dash/ARCHITECTURE.md) — dashboard module
+- [packages/sdk/ARCHITECTURE.md](packages/sdk/ARCHITECTURE.md) — SDK module
+
+## Repository structure
+
+```
+BizarHarness/
+├── AGENTS.md               # entry point (canonical)
+├── CLAUDE.md               # mirror of AGENTS.md for Claude Code
+├── PROGRESS.md             # current state, in progress, next steps
+├── DECISIONS.md            # architectural decisions
+├── feature_list.json       # machine-readable features
+├── Makefile                # setup / dev / check / test / e2e / ...
+├── package.json            # bun workspace root
+├── .nvmrc                  # pinned runtime version
+├── .claude/
+│   ├── settings.json       # scoped tool access
+│   ├── agents/             # Odin, Frigg, ... (one .md per agent)
+│   ├── skills/             # auto-loaded SKILL.md packs
+│   ├── commands/           # user-level slash commands
+│   ├── hooks/              # executable hook scripts
+│   └── mcp.json            # MCP server registrations
+├── .harness/
+│   ├── arch-rules.json
+│   └── traces/             # gitignored
+├── docs/                   # architecture, quality, decisions
+├── templates/              # sprint contract, rubric, clean-state
+├── scripts/                # verify-feature, check-arch, clean-state, session-trace
+├── plugins/bizar/          # Bizar MCP server + 19 tools
+├── packages/sdk/           # SDK wrapper around Claude Code Agent SDK
+└── bizar-dash/             # dashboard server + UI
+```

package/.claude/worktrees/kanban-overhaul/CURRENT_ISSUES_ AND_NEW_FEATURES.md

@@ -0,0 +1,18 @@
+implement:
+- full agent orchestrations system implementation in Claude Code, i want to prompt odin and odin should delegate and spawn agents. maybe this can be done with Claude Code agent teams?
+- i want a full /loop integration. inspiration: https://github.com/cobusgreyling/loop-engineering https://github.com/rudy2steiner/awesome-agent-loops. i want a fully custom integration in bizar that integrates into Claude Code with the Bizar MCP server (was 'bizar plugin' pre-v6.3.0).
+- implement and enable all slash commands from the old bizar into the new Claude Code based bizar.
+- fully integrate bizar memory system into the Claude Code MCP server / plugin.
+- bizar memory now has error that we have uninitialized memory vault, but i wnt to pull a repo i  already have data in, this is not possible now. fix this. fully implement and update the dash too.
+
+fully research and fully implement all of these items.
+
+sources to find info:
+https://docs.claude.com/claude-code
+https://docs.claude.com/en/docs/claude-code/agent-sdk/mcp
+https://docs.claude.com/en/docs/claude-code/agent-sdk/tools
+https://docs.claude.com/en/docs/claude-code/agent-sdk/agents
+
+keep the implementation plan and roadmap up to date.
+
+keep going untill done, dont ask for user input, finish on your own. when done, commit push and publish.

package/.claude/worktrees/kanban-overhaul/DECISIONS.md

@@ -0,0 +1,66 @@
+# DECISIONS.md — Architectural Decision Log
+
+> ADRs (Architecture Decision Records) for the Bizar Harness. New
+> decisions append to `docs/decisions/DEC-NNN-<slug>.md`. Each
+> decision gets a unique ID, date, status, and a short rationale.
+
+## Index
+
+| ID | Date | Status | Title | File |
+| --- | --- | --- | --- | --- |
+| DEC-011 | 2026-07-11 | Accepted | Cline → Claude Code migration | [docs/decisions/DEC-011-claude-code-migration.md](docs/decisions/DEC-011-claude-code-migration.md) |
+| DEC-001 | 2026-07-07 | Accepted | OpenCode → Cline rewrite (superseded by DEC-011; the OpenCode→Cline migration was only temporary — Claude Code is the runtime as of v6.3.0) | [docs/decisions/DEC-001-cline-rewrite.md](docs/decisions/DEC-001-cline-rewrite.md) |
+| DEC-002 | 2026-07-07 | Accepted | In-process ClineCore (no `cline serve` subprocess — now no `claude daemon` subprocess; spirit preserved by DEC-011) | [docs/decisions/DEC-002-in-process-clinecore.md](docs/decisions/DEC-002-in-process-clinecore.md) |
+| DEC-003 | 2026-07-07 | Accepted | In-process memory vault (no dashboard HTTP) | [docs/decisions/DEC-003-in-process-memory-vault.md](docs/decisions/DEC-003-in-process-memory-vault.md) |
+| DEC-004 | 2026-07-07 | Accepted | Cline agent teams integration (`bizar_spawn_team`) | [docs/decisions/DEC-004-cline-agent-teams.md](docs/decisions/DEC-004-cline-agent-teams.md) |
+| DEC-005 | 2026-07-07 | Accepted | Background agents via dashboard HTTP + in-process Cline | [docs/decisions/DEC-005-bg-agents-via-dashboard.md](docs/decisions/DEC-005-bg-agents-via-dashboard.md) |
+| DEC-006 | 2026-07-07 | Accepted | Kanban board (Tasks.tsx + `/api/tasks`) | [docs/decisions/DEC-006-kanban-board.md](docs/decisions/DEC-006-kanban-board.md) |
+| DEC-007 | 2026-07-07 | Accepted | Tool approval gate (DANGEROUS_PATTERNS) | [docs/decisions/DEC-007-tool-approval-gate.md](docs/decisions/DEC-007-tool-approval-gate.md) |
+| DEC-008 | 2026-07-07 | Accepted | Skill curator (closed learning loop) | [docs/decisions/DEC-008-skill-curator.md](docs/decisions/DEC-008-skill-curator.md) |
+| DEC-009 | 2026-07-07 | Accepted | Pre-compaction memory flush | [docs/decisions/DEC-009-pre-compaction-flush.md](docs/decisions/DEC-009-pre-compaction-flush.md) |
+| DEC-010 | 2026-07-07 | Accepted | Knowledge graph query tools (`bizar_graph_*`) | [docs/decisions/DEC-010-knowledge-graph-tools.md](docs/decisions/DEC-010-knowledge-graph-tools.md) |
+
+## How to write a new ADR
+
+1. Create `docs/decisions/DEC-NNN-<slug>.md` where `NNN` is the
+   next number and `<slug>` is a short kebab-case description.
+2. Use the standard format:
+   ```markdown
+   # DEC-NNN — <title>
+
+   **Date:** YYYY-MM-DD
+   **Status:** Proposed | Accepted | Deprecated | Superseded
+   **Deciders:** @author
+   **Related:** DEC-NNN
+
+   ## Context
+   ## Decision
+   ## Consequences
+   ```
+3. Update this index with the new row.
+4. Commit the ADR in the same commit as the code change.
+
+## How to find an ADR
+
+Each ADR is also referenced in:
+
+- `AGENTS.md` (high-level summary)
+- `CHANGELOG.md` (chronological log)
+- `feature_list.json` (the feature this ADR enables, if any)
+- `.harness/arch-rules.json` (the rule this ADR enables, if any)
+
+## See also
+
+- `docs/architecture.md` — layer model and module map
+- `docs/quality-document.md` — per-module A/B/C/D scores
+- `feature_list.json` — features and their state
+
+## How decisions evolve
+
+ADRs are immutable once accepted; superseded decisions are marked
+with a banner and a "Superseded by DEC-NNN" cross-reference rather
+than rewritten in place. Historical DECs (001, 002) were partially
+superseded by DEC-011 (v6.3.0, Claude Code migration) — their
+underlying *spirit* still applies (in-process, single runtime per
+session, plugin-as-MCP-server) but the references to Cline-specific
+subprocesses and tool shapes are rewritten in v6.3.0.

package/.claude/worktrees/kanban-overhaul/Dockerfile

@@ -0,0 +1,48 @@
+# ── Bizar Dashboard — multi-stage Docker build ──────────────────────────────
+#
+# Stage 1: Build the dashboard (Vite React SPA + TypeScript SDK)
+FROM node:22-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm install --no-audit --no-fund
+COPY . .
+RUN npm run build
+
+# Stage 2: Production runtime
+FROM node:22-alpine AS runtime
+ENV BIZAR_SKIP_INSTALL=1
+WORKDIR /app
+
+# Runtime dependencies: git for memory sync, python3 for graphify/browser-harness
+RUN apk add --no-cache git python3 py3-pip
+
+# Install production dependencies first (layer caching)
+COPY package*.json ./
+RUN npm install --omit=dev --no-audit --no-fund
+
+# Copy build artifacts and runtime assets
+COPY --from=builder /app/bizar-dash/dist ./dist
+COPY --from=builder /app/bizar-dash ./bizar-dash
+COPY plugins ./plugins
+COPY cli ./cli
+COPY config ./config
+COPY templates ./templates
+COPY install.sh ./
+RUN chmod +x install.sh
+
+# Runtime environment defaults
+ENV BIZAR_HOME=/home/bizar/.config/bizar
+ENV BIZAR_DASHBOARD_PORT=4097
+ENV BIZAR_DASHBOARD_BIND=0.0.0.0
+ENV NODE_ENV=production
+
+# Dashboard HTTP port + WebSocket port
+EXPOSE 4097
+EXPOSE 4098
+
+# Healthcheck — hits the public v2 health endpoint
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:4097/api/v2/health || exit 1
+
+# Default: start the dashboard on all interfaces
+CMD ["node", "cli/bin.mjs", "dash", "start", "--port", "4097", "--host", "0.0.0.0"]