@polderlabs/bizar 8.1.0 → 9.0.0

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/themes.mjs

@@ -0,0 +1,51 @@
+/**
+ * src/server/routes/themes.mjs
+ *
+ * /api/themes                           — list saved themes
+ * /api/themes (POST)                    — add a named theme
+ * /api/themes/:name (DELETE)            — remove
+ *
+ * Themes live on the state object (not disk) — the registry is
+ * in-memory. The active theme is on settings.json; the named
+ * themes here are the user's saved palette presets.
+ */
+import { Router } from 'express';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @param {object} deps
+ * @param {object} deps.state
+ * @returns {import('express').Router}
+ */
+export function createThemesRouter({ state }) {
+  const router = Router();
+
+  router.get('/themes', wrap(async (_req, res) => {
+    res.json(state.getThemes());
+  }));
+
+  router.post('/themes', wrap(async (req, res) => {
+    const { name, colors } = req.body || {};
+    if (typeof name !== 'string' || !name.trim()) {
+      res.status(400).json({ error: 'bad_request', message: 'name is required' });
+      return;
+    }
+    if (!colors || typeof colors !== 'object') {
+      res.status(400).json({ error: 'bad_request', message: 'colors object is required' });
+      return;
+    }
+    const out = state.addTheme(name.trim().slice(0, 60), colors);
+    res.status(201).json(out);
+  }));
+
+  router.delete('/themes/:name', wrap(async (req, res) => {
+    const out = state.removeTheme(decodeURIComponent(req.params.name));
+    if (!out.removed) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.status(204).end();
+  }));
+
+  return router;
+}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/update.mjs

@@ -0,0 +1,340 @@
+/**
+ * src/server/routes/update.mjs
+ *
+ * v4.6.0 — Dashboard update endpoints.
+ *
+ *   GET    /api/updates/status     — installed package versions only
+ *   GET    /api/updates/check      — installed + latest + hasUpdates
+ *   POST   /api/updates/apply      — trigger install for given packages
+ *                                    Streams progress via WS events:
+ *                                      update:progress { type, pkg, status, error?, newVersion? }
+ *                                      update:log     { type, pkg, line }
+ *                                      update:complete{ type }
+ *
+ * Why these paths (vs. /api/update/*):
+ *   thor-settings wired Settings.tsx to `/updates/status`, `/updates/check`,
+ *   and `/updates/apply` and listens for the WS event shapes above. Aligning
+ *   with that contract is cheaper than rewriting Settings.tsx.
+ *
+ * What this endpoint does NOT do:
+ *   - It does NOT restart the dashboard. The Settings UI displays a
+ *     confirmation prompt before calling, and `bizar update` (the CLI)
+ *     is the restart-aware path. The dashboard stays up; npm replaces
+ *     files in the global install dir while the dashboard runs from its
+ *     own already-loaded module graph. The next `bizar dash start`
+ *     picks up the new code, just like the CLI flow.
+ *   - It does NOT touch the cline plugin in-place. That lives in the
+ *     CLI flow because the plugin path is dev-symlinked in this repo.
+ *
+ * Safety:
+ *   - Concurrency guard: only one apply run at a time. A second call
+ *     returns 409 with `error: 'already_running'`.
+ *   - Network/npm failures emit `update:log` for each stderr/stdout
+ *     line and a final `update:progress` with `status: 'error'`.
+ *   - Whitelist of npm package names; anything else is rejected 400.
+ */
+import { Router } from 'express';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawn, execFileSync } from 'node:child_process';
+import { wrap } from './_shared.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// v4.4.13 — packages the dashboard knows how to update. Aligned with
+// the Settings UI's "Installed / Latest" panels and the CLI's update
+// flow. All three resolve on npmjs.org (bizar-dash and bizar-plugin are
+// deprecated but still resolvable).
+const KNOWN_PACKAGES = [
+  { id: 'bizar',         npmName: '@polderlabs/bizar',         label: 'Bizar CLI' },
+  { id: 'bizar-dash',    npmName: '@polderlabs/bizar-dash',    label: 'Dashboard' },
+  { id: 'bizar-plugin',  npmName: '@polderlabs/bizar-plugin',  label: 'Cline Plugin' },
+];
+
+const KNOWN_BY_ID = new Map(KNOWN_PACKAGES.map((p) => [p.id, p]));
+
+// Cache the latest-version lookup so /api/updates/check is fast on
+// repeated dashboard renders. 1 hour is short enough that a new release
+// shows up within an hour of publishing.
+const LATEST_CACHE_TTL_MS = 60 * 60 * 1000;
+const _latestCache = new Map(); // npmName -> { version, ts }
+
+/**
+ * Resolve the on-disk version of the dashboard itself (used as the
+ * "current" version for @polderlabs/bizar). Walks up from this file
+ * looking for the package.json that declares `@polderlabs/bizar`.
+ *
+ * Why "walk up" instead of `import.meta.resolve`? When the dashboard
+ * runs out of `dist/` (the published layout), the package.json lives
+ * at the dist root, not at the file's location. The walk is bounded
+ * to 6 levels so a misconfigured install fails fast instead of looping.
+ */
+function resolveInstalledVersion() {
+  const markers = ['package.json'];
+  let cur = __dirname;
+  for (let i = 0; i < 6; i++) {
+    for (const m of markers) {
+      const p = join(cur, m);
+      if (existsSync(p)) {
+        try {
+          const pkg = JSON.parse(readFileSync(p, 'utf8'));
+          if (pkg.name === '@polderlabs/bizar' && pkg.version) return pkg.version;
+        } catch { /* malformed — try parent */ }
+      }
+    }
+    const parent = dirname(cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+  return null;
+}
+
+const INSTALLED_BIZAR_VERSION = resolveInstalledVersion();
+
+/**
+ * `npm view <pkg> version` — returns the latest published version or
+ * null on any failure. Cached per package for 1 hour.
+ */
+function fetchLatestVersion(npmName) {
+  const cached = _latestCache.get(npmName);
+  if (cached && Date.now() - cached.ts < LATEST_CACHE_TTL_MS) {
+    return cached.version;
+  }
+  try {
+    const out = execFileSync(
+      'npm',
+      ['view', npmName, 'version'],
+      { stdio: ['ignore', 'pipe', 'ignore'], timeout: 15000 },
+    ).toString().trim();
+    const version = out || null;
+    _latestCache.set(npmName, { version, ts: Date.now() });
+    return version;
+  } catch {
+    // Negative-cache for 5 minutes so a transient registry hiccup
+    // doesn't make every render call npm.
+    _latestCache.set(npmName, { version: null, ts: Date.now() - (LATEST_CACHE_TTL_MS - 5 * 60 * 1000) });
+    return null;
+  }
+}
+
+/**
+ * Reset the latest-version cache — exposed for tests so each case
+ * starts from a known state.
+ */
+export function resetUpdateCache() {
+  _latestCache.clear();
+}
+
+/**
+ * Compute the per-package installed map. For the dashboard package
+ * itself we use INSTALLED_BIZAR_VERSION (the @polderlabs/bizar version
+ * that bundles the dashboard). The other packages fall back to null
+ * when not resolvable; the UI renders "—" for those rows.
+ */
+function currentVersions() {
+  const out = {};
+  for (const p of KNOWN_PACKAGES) {
+    if (p.id === 'bizar') {
+      out[p.id] = INSTALLED_BIZAR_VERSION;
+    } else {
+      // Deprecated standalone packages — fall back to running dashboard
+      // version as a sane default so the row isn't permanently "—".
+      out[p.id] = INSTALLED_BIZAR_VERSION;
+    }
+  }
+  return out;
+}
+
+/**
+ * Compute latest map and hasUpdates flag. Iterates KNOWN_PACKAGES so
+ * the UI gets a stable order and predictable keys even when one of the
+ * `npm view` calls fails (those resolve to null).
+ */
+function latestVersionsAndFlag(current) {
+  const latest = {};
+  let hasUpdates = false;
+  for (const p of KNOWN_PACKAGES) {
+    const lat = fetchLatestVersion(p.npmName);
+    latest[p.id] = lat;
+    const cur = current[p.id];
+    if (cur && lat && cur !== lat) hasUpdates = true;
+  }
+  return { latest, hasUpdates };
+}
+
+// ─── Apply concurrency guard ───────────────────────────────────────────────
+// One active run per server process. A second POST /updates/apply while
+// the first is still going returns 409 immediately.
+
+let _activeRun = null; // { packages: string[], startedAt: number } | null
+
+function isRunning() {
+  return _activeRun !== null;
+}
+
+/**
+ * Run `npm install -g <pkg>@latest` for each requested id. Emits WS
+ * events on the broadcast channel for every stdout/stderr line and for
+ * the per-package status transitions. Returns the result object
+ * (sync — the actual install runs in the background and finishes via
+ * WS events).
+ */
+function startApplyRun({ packages, channel, broadcast }) {
+  if (_activeRun) {
+    throw Object.assign(new Error('update already running'), { code: 'already_running' });
+  }
+  const ids = (Array.isArray(packages) && packages.length > 0) ? packages : KNOWN_PACKAGES.map((p) => p.id);
+  const validIds = ids.filter((id) => KNOWN_BY_ID.has(id));
+  if (validIds.length === 0) {
+    throw Object.assign(new Error('no valid packages requested'), { code: 'bad_request' });
+  }
+
+  _activeRun = { packages: validIds, startedAt: Date.now() };
+
+  // Kick the run async. Errors are reported via the WS bus.
+  (async () => {
+    try {
+      for (const id of validIds) {
+        const pkg = KNOWN_BY_ID.get(id);
+        if (!pkg) continue;
+        broadcast({ type: 'update:progress', pkg: id, status: 'starting' });
+
+        const versionTag = channel && channel === 'beta' ? '@beta' : '@latest';
+        const code = await runNpmInstall(pkg.npmName, versionTag, (line) => {
+          broadcast({ type: 'update:log', pkg: id, line });
+        });
+
+        if (code === 0) {
+          const newVer = fetchLatestVersion(pkg.npmName); // warm cache
+          broadcast({
+            type: 'update:progress',
+            pkg: id,
+            status: 'done',
+            newVersion: newVer || undefined,
+          });
+        } else {
+          broadcast({
+            type: 'update:progress',
+            pkg: id,
+            status: 'error',
+            error: `npm install exited with code ${code}`,
+          });
+        }
+      }
+    } finally {
+      _activeRun = null;
+      broadcast({ type: 'update:complete' });
+    }
+  })().catch((err) => {
+    _activeRun = null;
+    broadcast({ type: 'update:progress', pkg: '__global', status: 'error', error: err?.message || String(err) });
+    broadcast({ type: 'update:complete' });
+  });
+
+  return { ok: true, started: validIds, channel: channel || 'stable' };
+}
+
+/**
+ * Spawn `npm install -g <pkg>@<tag>`. Captures stdout/stderr line by
+ * line and forwards each via the `onLine` callback. Resolves with the
+ * exit code (0 on success, non-zero otherwise).
+ *
+ * Why spawn instead of execSync: npm install can take 30+ seconds and
+ * blocks the event loop. We want concurrent dashboard requests to keep
+ * serving while an update is in flight.
+ */
+function runNpmInstall(npmName, versionTag, onLine) {
+  return new Promise((resolve) => {
+    let proc;
+    try {
+      proc = spawn('npm', ['install', '-g', `${npmName}${versionTag}`], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: process.env,
+      });
+    } catch (err) {
+      onLine(`failed to spawn npm: ${err.message}`);
+      resolve(127);
+      return;
+    }
+
+    const pipeLine = (stream) => {
+      let buf = '';
+      stream.setEncoding('utf8');
+      stream.on('data', (chunk) => {
+        buf += chunk;
+        let nl;
+        while ((nl = buf.indexOf('\n')) >= 0) {
+          const line = buf.slice(0, nl).replace(/\r$/, '');
+          buf = buf.slice(nl + 1);
+          if (line) onLine(line);
+        }
+      });
+      stream.on('end', () => {
+        if (buf) onLine(buf);
+      });
+    };
+    pipeLine(proc.stdout);
+    pipeLine(proc.stderr);
+
+    proc.on('error', (err) => {
+      onLine(`npm process error: ${err.message}`);
+      resolve(127);
+    });
+    proc.on('close', (code) => {
+      resolve(code ?? 1);
+    });
+  });
+}
+
+// ─── Router factory ────────────────────────────────────────────────────────
+
+export function createUpdateRouter({ broadcast = () => {} } = {}) {
+  const router = Router();
+
+  /**
+   * GET /api/updates/status
+   * Quick status — installed versions only. Cheap; no npm calls.
+   */
+  router.get('/updates/status', wrap(async (_req, res) => {
+    const current = currentVersions();
+    res.json({ current });
+  }));
+
+  /**
+   * GET /api/updates/check
+   * Installed + latest + hasUpdates. Calls `npm view` (cached).
+   */
+  router.get('/updates/check', wrap(async (_req, res) => {
+    const current = currentVersions();
+    const { latest, hasUpdates } = latestVersionsAndFlag(current);
+    res.json({ current, latest, hasUpdates });
+  }));
+
+  /**
+   * POST /api/updates/apply
+   * Body: { packages?: string[], channel?: 'stable' | 'beta' }
+   * Returns 202 immediately. Progress streams via WS events.
+   * Returns 409 if another apply is in flight.
+   */
+  router.post('/updates/apply', wrap(async (req, res) => {
+    if (isRunning()) {
+      res.status(409).json({ error: 'already_running', message: 'an update is already running' });
+      return;
+    }
+    const body = req.body || {};
+    const channel = body.channel === 'beta' ? 'beta' : 'stable';
+    try {
+      const result = startApplyRun({ packages: body.packages, channel, broadcast });
+      res.status(202).json(result);
+    } catch (err) {
+      const status = err?.code === 'bad_request' ? 400 : 500;
+      res.status(status).json({
+        error: err?.code || 'apply_failed',
+        message: err?.message || String(err),
+      });
+    }
+  }));
+
+  return router;
+}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/usage.mjs

@@ -0,0 +1,136 @@
+/**
+ * src/server/routes/usage.mjs
+ *
+ * Endpoints for usage analytics:
+ *   GET  /api/usage                          — aggregate usage (range, from, to, providerId, modelId)
+ *   GET  /api/usage/limits                 — live quota limits + usage percent (agents call this)
+ *   GET  /api/usage/recent                  — last N raw records (live tail)
+ *
+ * The agent-awareness path (/api/usage/limits) calls fetchRemains() for
+ * live quota data, then merges with the JSONL rolling totals.
+ */
+import { Router } from 'express';
+import { wrap } from './_shared.mjs';
+import {
+  queryUsage,
+  getUsageLimitsForAgent,
+} from '../minimax-usage-store.mjs';
+
+export function createUsageRouter() {
+  const router = Router();
+
+  // GET /api/usage?range=24h|7d|30d|custom&from=&to=&providerId=&modelId=
+  router.get('/usage', wrap(async (req, res) => {
+    const range      = String(req.query.range      || '24h');
+    const from       = req.query.from        ? Number(req.query.from)       : undefined;
+    const to         = req.query.to          ? Number(req.query.to)         : undefined;
+    const providerId = req.query.providerId  ? String(req.query.providerId)  : undefined;
+    const modelId    = req.query.modelId     ? String(req.query.modelId)    : undefined;
+
+    if (!['24h', '7d', '30d', 'custom'].includes(range)) {
+      return res.status(400).json({ error: 'invalid_range', message: 'range must be 24h, 7d, 30d, or custom' });
+    }
+    if (range === 'custom' && (!from || !to)) {
+      return res.status(400).json({ error: 'missing_dates', message: 'range=custom requires `from` and `to` (unix ms)' });
+    }
+
+    const opts = {
+      range,
+      from,
+      to,
+      providerId,
+      modelId,
+    };
+
+    let result;
+    try {
+      result = queryUsage(opts);
+    } catch (err) {
+      return res.status(400).json({ error: 'query_error', message: String((err).message) });
+    }
+    return res.json(result);
+  }));
+
+  // GET /api/usage/limits
+  // Returns live quota info from fetchRemains() merged with rolling usage totals.
+  router.get('/usage/limits', wrap(async (_req, res) => {
+    // Dynamic import to avoid pulling in the full minimax client bundle on every
+    // dashboard page load. The usage store is lightweight.
+    /** @type {Record<string, unknown>} */
+    let remainsData = { models: [] };
+    try {
+      const { fetchRemains } = await import('../minimax.mjs');
+      const remains = await fetchRemains({ force: false });
+      if (remains.ok) {
+        // Cast through unknown to avoid TypeScript pollution in plain .mjs.
+        remainsData = /** @type {Record<string, unknown>} */ (remains);
+      }
+    } catch { /* best-effort — return zeros */ }
+
+    // Rolling usage from JSONL.
+    const agentSummary = await getUsageLimitsForAgent('minimax');
+
+    // Merge: per-model usage from JSONL + per-model quota from remains.
+    /** @type {Array<{model_name?: string, current_interval_remaining_percent?: number, current_weekly_remaining_percent?: number, intervalResetInHuman?: string, weeklyResetInHuman?: string}>} */
+    const models = (remainsData.models || []);
+
+    // Build per-model percentUsed from the JSONL per-model data.
+    const usageResult = queryUsage({ range: '24h', providerId: 'minimax' });
+    const perModelUsage = new Map(usageResult.perModel.map(m => [`minimax/${m.modelId}`, m]));
+
+    const perModelLimits = models.map(m => {
+      const usage = perModelUsage.get(`minimax/${m.model_name}`);
+      const usedTokens = usage?.totalTokens ?? 0;
+      const remainingPct = m.current_interval_remaining_percent ?? 100;
+      let estimatedDailyBudget = 0;
+      let percentUsed = 0;
+      if (remainingPct < 100 && usedTokens > 0) {
+        estimatedDailyBudget = Math.round(usedTokens / (1 - remainingPct / 100));
+        percentUsed = Math.round((usedTokens / estimatedDailyBudget) * 1000) / 10;
+      }
+      return {
+        modelId: m.model_name ?? 'unknown',
+        totalTokensUsed: usedTokens,
+        requestCount: usage?.requests ?? 0,
+        limits: {
+          dailyTokens: estimatedDailyBudget || null,
+          intervalResetIn: m.intervalResetInHuman ?? null,
+          weeklyResetIn: m.weeklyResetInHuman ?? null,
+        },
+        percentUsed24h: percentUsed,
+      };
+    });
+
+    return res.json({
+      provider: 'minimax',
+      requestsLast5min:  agentSummary.requestsLast5min,
+      tokensLast5min:    agentSummary.tokensLast5min,
+      requestsLast24h:   agentSummary.requestsLast24h,
+      tokensLast24h:     agentSummary.tokensLast24h,
+      limits:            agentSummary.limits,
+      percentUsed24h:    agentSummary.percentUsed24h,
+      estimatedTimeUntilReset: agentSummary.estimatedTimeUntilReset,
+      warning:           agentSummary.warning,
+      perModel:          perModelLimits,
+      fetchedAt:         remainsData.fetchedAt ? new Date(remainsData.fetchedAt).toISOString() : null,
+    });
+  }));
+
+  // GET /api/usage/recent?limit=50
+  router.get('/usage/recent', wrap(async (req, res) => {
+    const limit = Math.min(Math.max(Number(req.query.limit) || 50, 1), 200);
+
+    // Read last N lines from the JSONL.
+    const { readAllRecords } = await import('../minimax-usage-store.mjs');
+    const all = readAllRecords();
+    const recent = all.slice(-limit).reverse(); // newest first
+
+    return res.json({
+      records: recent,
+      total: all.length,
+      returned: recent.length,
+    });
+  }));
+
+  return router;
+}

package/.claude/worktrees/kanban-overhaul/bizar-dash/src/server/routes/users.mjs

@@ -0,0 +1,102 @@
+/**
+ * src/server/routes/users.mjs
+ *
+ * v5.0.0 — User management REST API.
+ *
+ * Endpoints:
+ *   GET    /api/users/me        — current user info
+ *   PATCH  /api/users/me        — update profile (name, email)
+ *   GET    /api/users/:id       — get user (workspace member only)
+ */
+import { Router } from 'express';
+import { getUser, updateUser, listWorkspacesWithRoles } from '../workspaces.mjs';
+import { getCurrentUserId } from '../auth.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createUsersRouter() {
+  const router = Router();
+
+  // GET /api/users/me — current user info
+  router.get('/users/me', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const user = await getUser(userId);
+    // v5.3.1 — Tailscale-trust: when getCurrentUserId returns a derived
+    // userId (usr_ts_*) that doesn't exist in the store, synthesize a
+    // minimal user record from the request Host header so the dashboard
+    // can render a profile without needing a full signup.
+    if (!user) {
+      if (userId.startsWith('usr_ts_')) {
+        const host = String(req.headers?.host || '').split(':')[0] || 'tailnet';
+        const tailnetName = host.split('.')[0] || 'tailnet';
+        const workspaces = await listWorkspacesWithRoles(userId);
+        return res.json({
+          user: {
+            id: userId,
+            email: `${tailnetName}@tailscale.local`,
+            name: `Tailnet user (${tailnetName})`,
+            tailnet: true
+          },
+          workspaces
+        });
+      }
+      return res.status(404).json({ error: 'not_found', message: 'User not found' });
+    }
+    const workspaces = await listWorkspacesWithRoles(userId);
+    res.json({
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+      },
+      workspaces,
+    });
+  }));
+
+  // PATCH /api/users/me — update profile
+  router.patch('/users/me', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { name, email } = req.body || {};
+    if (!name && !email) {
+      return res.status(400).json({ error: 'bad_request', message: 'name or email required' });
+    }
+    const updates = {};
+    if (name !== undefined) updates.name = name;
+    if (email !== undefined) updates.email = email;
+    const user = await updateUser(userId, updates);
+    res.json({ user });
+  }));
+
+  // GET /api/users/:id — get user (workspace member only)
+  router.get('/users/:id', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { id } = req.params;
+    const user = await getUser(id);
+    if (!user) {
+      return res.status(404).json({ error: 'not_found', message: 'User not found' });
+    }
+    // Only return user if both are members of at least one common workspace
+    // For simplicity, we check if the requesting user exists (they're authenticated)
+    // In a real implementation, we'd check shared workspace membership
+    res.json({
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+      },
+    });
+  }));
+
+  return router;
+}