@polderlabs/bizar 9.0.0 → 10.0.7

package/cli/__tests__/esm-no-require.test.mjs

@@ -0,0 +1,97 @@
+/**
+ * cli/__tests__/esm-no-require.test.mjs
+ *
+ * F-057 — Static guard against `require(...)` calls inside production `.mjs`
+ * files under `cli/`.
+ *
+ * Bug class: ESM source files used `require('node:fs')` etc. as a shortcut.
+ * The bug fires on Node 18/20 LTS (where require is undefined in ESM) and
+ * is silently masked on Node 22+ (which ships a require shim in ESM).
+ *
+ * Scan policy:
+ *   - Only production .mjs files (not in __tests__/, not *.test.mjs).
+ *   - Strip line comments (`// ...`) and block comments before scanning
+ *     so test/source commentary about `require` doesn't trigger.
+ *   - Flag any `\brequire(?:\?)?\s*\(` token outside comments.
+ *
+ * The fix is to use top-level imports instead.
+ */
+import { test, describe } from 'node:test';
+import assert from 'node:assert/strict';
+import { readdirSync, readFileSync } from 'node:fs';
+import { join, relative, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); // cli/
+
+/** Recursively find every .mjs file under ROOT, excluding test files / node_modules / dist. */
+function findProductionMjs(dir) {
+  const out = [];
+  for (const ent of readdirSync(dir, { withFileTypes: true })) {
+    if (ent.name === 'node_modules' || ent.name === 'dist' || ent.name === '__tests__' || ent.name === 'tests') continue;
+    if (ent.name.startsWith('.')) continue;
+    const p = join(dir, ent.name);
+    if (ent.isDirectory()) out.push(...findProductionMjs(p));
+    else if (ent.isFile() && ent.name.endsWith('.mjs') && !ent.name.endsWith('.test.mjs')) {
+      out.push(p);
+    }
+  }
+  return out;
+}
+
+/** Remove line and block comments + string literals from source for safe pattern scanning. */
+function stripCommentsAndStrings(src) {
+  // 1. Strip /* ... */ block comments (non-greedy, multi-line).
+  src = src.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, ' '));
+  // 2. Strip // line comments.
+  src = src.replace(/\/\/[^\n]*/g, (m) => m.replace(/[^\n]/g, ' '));
+  // 3. Strip double-quoted strings (preserve newlines).
+  src = src.replace(/"(?:\\.|[^"\\])*"/g, (m) => m.replace(/[^\n]/g, ' '));
+  // 4. Strip single-quoted strings.
+  src = src.replace(/'(?:\\.|[^'\\])*'/g, (m) => m.replace(/[^\n]/g, ' '));
+  // 5. Strip template literals (backticks) — keep `${...}` expressions intact for scanning.
+  //    Replace backtick segments that have no ${...} with spaces; inside ${...} keep the code.
+  src = src.replace(/`(?:\\.|[^`\\])*`/g, (m) => m.replace(/[^\n]/g, ' '));
+  return src;
+}
+
+describe('ESM no-require guard (F-057)', () => {
+  const files = findProductionMjs(ROOT);
+
+  test('cli/ has at least one production .mjs file to scan', () => {
+    assert.ok(files.length > 0, 'no production .mjs files found under cli/');
+  });
+
+  test('no production .mjs file uses `require(` as a function call', () => {
+    /** @type {Array<{file: string, line: number, snippet: string}>} */
+    const offenders = [];
+    const re = /\brequire(?:\?)?\s*\(/;
+    for (const f of files) {
+      const raw = readFileSync(f, 'utf8');
+      const stripped = stripCommentsAndStrings(raw);
+      const rawLines = raw.split('\n');
+      const strippedLines = stripped.split('\n');
+      for (let i = 0; i < strippedLines.length; i++) {
+        const line = strippedLines[i];
+        if (re.test(line)) {
+          offenders.push({
+            file: relative(ROOT, f),
+            line: i + 1,
+            snippet: rawLines[i].trim().slice(0, 140),
+          });
+        }
+      }
+    }
+
+    if (offenders.length > 0) {
+      const msg = offenders
+        .map((o) => `  ${o.file}:${o.line}  ${o.snippet}`)
+        .join('\n');
+      assert.fail(
+        `Found ${offenders.length} \`require(\` call(s) in production ESM modules.\n` +
+        `These throw ReferenceError on Node 18/20 LTS:\n${msg}\n\n` +
+        `Fix: replace each call with a top-level ESM import.`,
+      );
+    }
+  });
+});

package/cli/commands/tailscale.mjs

@@ -8,7 +8,7 @@
  * doesn't need to run `sudo tailscale serve ...` manually.
  */
 import { execFileSync, spawn } from 'node:child_process';
-import { existsSync, writeFileSync, readFileSync } from 'node:fs';
+import { existsSync, writeFileSync, readFileSync, mkdirSync, unlinkSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import chalk from 'chalk';
@@ -18,7 +18,6 @@ const TS_STATE_DIR = process.env.TAILSCALE_STATE_DIR || join(homedir(), '.local'
 const TS_SERVE_CONFIG = join(TS_STATE_DIR, 'serve.json');
 
 function ensureStateDir() {
-  const { mkdirSync } = require('node:fs');
   try {
     mkdirSync(TS_STATE_DIR, { recursive: true });
   } catch { /* ignore */ }
@@ -129,7 +128,6 @@ export function unsetupTailscaleServe() {
     execFileSync('tailscale', ['serve', 'reset'], { encoding: 'utf8', timeout: 10000 });
     // Remove saved config
     if (existsSync(TS_SERVE_CONFIG)) {
-      const { unlinkSync } = require('node:fs');
       try { unlinkSync(TS_SERVE_CONFIG); } catch { /* ignore */ }
     }
     return { ok: true };

package/cli/commands/voice.mjs

@@ -4,7 +4,7 @@
  * v5.0.0 — Voice notes CLI — talks to the running dashboard's HTTP API.
  */
 import chalk from 'chalk';
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 
@@ -103,7 +103,7 @@ function loadConfig() {
 function saveConfig(cfg) {
   const dir = join(getBizarConfigDir());
   if (!existsSync(dir)) {
-    require('node:fs').mkdirSync(dir, { recursive: true });
+    mkdirSync(dir, { recursive: true });
   }
   writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2), 'utf8');
 }

package/cli/service-env.mjs

@@ -18,7 +18,7 @@
  */
 
 import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readSync, closeSync, openSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 
@@ -58,12 +58,11 @@ function generatePassword() {
   } catch {
     // Fallback: rough approximation using /dev/urandom
     try {
-      const { readFileSync } = require?.('node:fs') ?? (() => { throw new Error('no fs'); })();
-      const fd = require?.('node:fs')?.openSync?.('/dev/urandom', 'r');
+      const fd = openSync('/dev/urandom', 'r');
       if (fd !== undefined) {
         const buf = Buffer.alloc(32);
-        require('node:fs').readSync(fd, buf, 0, 32);
-        require('node:fs').closeSync?.(fd);
+        readSync(fd, buf, 0, 32);
+        closeSync(fd);
         return buf.toString('hex');
       }
     } catch { /* ignore */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar",
-  "version": "9.0.0",
+  "version": "10.0.7",
   "description": "Norse-pantheon multi-agent system for Claude Code — 14 agents across 4 cost tiers with cost-aware routing, plans, and a configurable agent harness. Ships as a single npm package with the dashboard server, Claude Code MCP server, and typed SDK.",
   "type": "module",
   "bin": {
@@ -10,10 +10,10 @@
     "cli/",
     "bizar-dash/",
     "packages/sdk/",
-    ".claude/",
     "config/",
     "templates/",
     "scripts/",
+    "plugins/",
     "install.sh"
   ],
   "scripts": {
@@ -23,8 +23,18 @@
     "test:sdk": "node_modules/.bin/vitest run --root packages/sdk",
     "test:web": "cd bizar-dash && npx vitest run",
     "test:sdk:watch": "node_modules/.bin/vitest --root packages/sdk",
-    "test": "npm run typecheck && npm run test:sdk && node --test cli/install.test.mjs cli/provision.test.mjs cli/worker-dispatcher.test.mjs cli/commands/setup-provider.test.mjs cli/commands/rca.test.mjs cli/__tests__/cost-gate.test.mjs cli/__tests__/feature-list-bridge.test.mjs && node --test bizar-dash/tests/path-safe.test.mjs",
+    "test": "npm run typecheck && npm run test:sdk && node --test cli/install.test.mjs cli/provision.test.mjs cli/worker-dispatcher.test.mjs cli/commands/setup-provider.test.mjs cli/commands/rca.test.mjs cli/__tests__/cost-gate.test.mjs cli/__tests__/feature-list-bridge.test.mjs && node --test bizar-dash/tests/path-safe.test.mjs bizar-dash/tests/tasks-patch-routes.test.mjs",
+    "test:e2e:coverage": "node tests/e2e/dashboard-coverage-proof.mjs",
+    "test:e2e:cc": "node tests/e2e/dashboard-cc-bridge.mjs",
+    "test:e2e:crud": "node tests/e2e/dashboard-crud-roundtrip.mjs",
+    "test:e2e:data": "node tests/e2e/dashboard-data-driven.mjs",
+    "test:e2e:matrix": "node tests/e2e/dashboard-surfaces-matrix.mjs",
+    "test:e2e:cc-disk": "node tests/e2e/dashboard-cc-disk-fallback.mjs",
+    "test:e2e:goal-slash": "node tests/e2e/dashboard-cc-goal-slash.mjs",
+    "test:e2e:cfg": "node tests/e2e/dashboard-config-coverage.mjs",
+    "test:e2e:activity-lanes": "node tests/e2e/dashboard-activity-lanes.mjs",
     "build": "npm run build:sdk && npm run build:dash",
+    "prepack": "npm run build",
     "prepublishOnly": "npm run build"
   },
   "keywords": [

package/packages/sdk/dist/agent-registry.d.ts

@@ -0,0 +1,134 @@
+/**
+ * agent-registry.ts — in-process agent lifecycle registry (BizarAgentRegistry).
+ *
+ * F-032 — ported from ruflo `v3/@claude-flow/swarm/src/coordination/agent-registry.ts`
+ * (lines 33, 127, 159, 268, 286). Bizar does not ship a full agent runtime;
+ * the registry is a stateful, in-memory record of agent metadata that the MCP
+ * tools can read/write. The Claude Code Agent SDK is the actual orchestrator;
+ * this registry is a thin coordination surface for `agent_spawn`,
+ * `agent_list`, and `agent_terminate`.
+ *
+ * No subprocess, no event bus. Heartbeat is a no-op stub that updates a
+ * timestamp so downstream observers can poll liveness.
+ *
+ * Persistence is opt-in: pass `{ persistPath }` to the constructor (or
+ * to the `bizarAgentRegistry` singleton via its mutator) and the registry
+ * writes a JSON snapshot to disk after every mutation. This keeps the
+ * in-process test path pure while letting the MCP singleton survive a
+ * Claude Code session restart.
+ */
+export type AgentStatus = "active" | "terminated";
+/**
+ * Bizar's typed-agent allowlist. Mirrors the six typed agents in
+ * `config/agents/` (coder / tester / reviewer / system-architect /
+ * planner / researcher) plus three ruflo-derived typed routes
+ * (performance-engineer / security-auditor / memory-specialist).
+ * `registerAgent` rejects anything outside this set so the MCP tools
+ * surface a typed vocabulary callers can rely on.
+ */
+export declare const AGENT_TYPES: readonly ["coder", "tester", "reviewer", "system-architect", "planner", "researcher", "performance-engineer", "security-auditor", "memory-specialist"];
+export type AllowedAgentType = (typeof AGENT_TYPES)[number];
+export declare function isAllowedAgentType(t: unknown): t is AllowedAgentType;
+export interface AgentRecord {
+    agentId: string;
+    type: AllowedAgentType;
+    name?: string;
+    status: AgentStatus;
+    priority?: "low" | "normal" | "high" | "critical";
+    metadata?: Record<string, unknown>;
+    taskCount: number;
+    createdAt: string;
+    lastHeartbeatAt: string;
+    terminatedAt?: string;
+    terminationReason?: string;
+    gracefulTermination?: boolean;
+}
+export interface RegisterAgentInput {
+    type: string;
+    name?: string;
+    priority?: "low" | "normal" | "high" | "critical";
+    metadata?: Record<string, unknown>;
+}
+export interface RegisterAgentResult {
+    agentId: string;
+    status: AgentStatus;
+}
+export interface ListAgentsInput {
+    status?: AgentStatus | "all";
+    type?: string;
+    limit?: number;
+    offset?: number;
+}
+export interface ListAgentsResult {
+    agents: AgentRecord[];
+    total: number;
+}
+export interface TerminateAgentInput {
+    agentId: string;
+    reason?: string;
+    graceful?: boolean;
+}
+export interface TerminateAgentResult {
+    agentId: string;
+    status: AgentStatus;
+    terminatedAt: string;
+}
+export interface BizarAgentRegistryOpts {
+    /**
+     * When set, the registry loads from this file on construction (if it
+     * exists) and writes a JSON snapshot after every mutation. The parent
+     * directory is created on demand. Path resolution is the caller's
+     * responsibility — the registry treats the value as final.
+     */
+    persistPath?: string;
+}
+export declare class BizarAgentRegistry {
+    private readonly agents;
+    private readonly seenIds;
+    private persistPath?;
+    constructor(opts?: BizarAgentRegistryOpts);
+    /**
+     * Configure (or clear) the persistence path after construction.
+     * The next mutation will write a snapshot to the new location.
+     */
+    setPersistPath(path: string | undefined): void;
+    /**
+     * Generate a unique agent id of the form `agent-<uuid>`. Uses
+     * `crypto.randomUUID()` so the IDs are stable across processes
+     * and there is no retry loop on collision (UUID v4 has a 122-bit
+     * random payload).
+     */
+    private nextAgentId;
+    registerAgent(input: RegisterAgentInput): RegisterAgentResult;
+    listAgents(input?: ListAgentsInput): ListAgentsResult;
+    terminateAgent(input: TerminateAgentInput): TerminateAgentResult;
+    getAgent(agentId: string): AgentRecord | undefined;
+    /**
+     * No-op heartbeat stub. Updates `lastHeartbeatAt` so callers can poll
+     * liveness. Returns true if the agent was found.
+     */
+    heartbeat(agentId: string): boolean;
+    /**
+     * Bump the per-agent task counter (used by orchestration callers).
+     */
+    incrementTaskCount(agentId: string, by?: number): number;
+    /**
+     * Test/dev helper: drop everything. Not exposed via MCP.
+     */
+    reset(): void;
+    /**
+     * Total agents currently tracked (any status).
+     */
+    size(): number;
+    private loadFromDisk;
+    private persist;
+}
+/**
+ * Process-wide singleton used by MCP tools. Persistence defaults to
+ * `.harness/agents.json` in the current working directory so the
+ * registry survives a Claude Code session restart on the same machine.
+ * Tests should construct their own `new BizarAgentRegistry()` to get
+ * an isolated, non-persistent instance.
+ */
+export declare const bizarAgentRegistry: BizarAgentRegistry;
+//# sourceMappingURL=agent-registry.d.ts.map

package/packages/sdk/dist/agent-registry.js

@@ -0,0 +1,228 @@
+/**
+ * agent-registry.ts — in-process agent lifecycle registry (BizarAgentRegistry).
+ *
+ * F-032 — ported from ruflo `v3/@claude-flow/swarm/src/coordination/agent-registry.ts`
+ * (lines 33, 127, 159, 268, 286). Bizar does not ship a full agent runtime;
+ * the registry is a stateful, in-memory record of agent metadata that the MCP
+ * tools can read/write. The Claude Code Agent SDK is the actual orchestrator;
+ * this registry is a thin coordination surface for `agent_spawn`,
+ * `agent_list`, and `agent_terminate`.
+ *
+ * No subprocess, no event bus. Heartbeat is a no-op stub that updates a
+ * timestamp so downstream observers can poll liveness.
+ *
+ * Persistence is opt-in: pass `{ persistPath }` to the constructor (or
+ * to the `bizarAgentRegistry` singleton via its mutator) and the registry
+ * writes a JSON snapshot to disk after every mutation. This keeps the
+ * in-process test path pure while letting the MCP singleton survive a
+ * Claude Code session restart.
+ */
+import { randomUUID } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+/**
+ * Bizar's typed-agent allowlist. Mirrors the six typed agents in
+ * `config/agents/` (coder / tester / reviewer / system-architect /
+ * planner / researcher) plus three ruflo-derived typed routes
+ * (performance-engineer / security-auditor / memory-specialist).
+ * `registerAgent` rejects anything outside this set so the MCP tools
+ * surface a typed vocabulary callers can rely on.
+ */
+export const AGENT_TYPES = [
+    "coder",
+    "tester",
+    "reviewer",
+    "system-architect",
+    "planner",
+    "researcher",
+    "performance-engineer",
+    "security-auditor",
+    "memory-specialist",
+];
+export function isAllowedAgentType(t) {
+    return typeof t === "string" && AGENT_TYPES.includes(t);
+}
+export class BizarAgentRegistry {
+    agents = new Map();
+    seenIds = new Set();
+    persistPath;
+    constructor(opts = {}) {
+        this.persistPath = opts.persistPath;
+        if (this.persistPath)
+            this.loadFromDisk();
+    }
+    /**
+     * Configure (or clear) the persistence path after construction.
+     * The next mutation will write a snapshot to the new location.
+     */
+    setPersistPath(path) {
+        this.persistPath = path;
+        if (path)
+            this.loadFromDisk();
+    }
+    /**
+     * Generate a unique agent id of the form `agent-<uuid>`. Uses
+     * `crypto.randomUUID()` so the IDs are stable across processes
+     * and there is no retry loop on collision (UUID v4 has a 122-bit
+     * random payload).
+     */
+    nextAgentId() {
+        const id = `agent-${randomUUID()}`;
+        this.seenIds.add(id);
+        return id;
+    }
+    registerAgent(input) {
+        if (!input || typeof input.type !== "string" || input.type.trim().length === 0) {
+            throw new Error("registerAgent: `type` is required and must be a non-empty string");
+        }
+        if (!isAllowedAgentType(input.type)) {
+            throw new Error(`registerAgent: \`type\` must be one of ${AGENT_TYPES.join(", ")}; got: ${input.type}`);
+        }
+        const agentId = this.nextAgentId();
+        const now = new Date().toISOString();
+        const record = {
+            agentId,
+            type: input.type,
+            name: input.name,
+            status: "active",
+            priority: input.priority,
+            metadata: input.metadata,
+            taskCount: 0,
+            createdAt: now,
+            lastHeartbeatAt: now,
+        };
+        this.agents.set(agentId, record);
+        this.persist();
+        return { agentId, status: record.status };
+    }
+    listAgents(input = {}) {
+        const status = input.status ?? "all";
+        const type = input.type;
+        let filtered = Array.from(this.agents.values()).filter((a) => {
+            if (status !== "all" && a.status !== status)
+                return false;
+            if (type && a.type !== type)
+                return false;
+            return true;
+        });
+        const total = filtered.length;
+        const offset = Math.max(0, input.offset ?? 0);
+        const limit = input.limit !== undefined ? Math.max(0, Math.min(1000, input.limit)) : 100;
+        filtered = filtered.slice(offset, offset + limit);
+        return { agents: filtered, total };
+    }
+    terminateAgent(input) {
+        if (!input || typeof input.agentId !== "string") {
+            throw new Error("terminateAgent: `agentId` is required");
+        }
+        const record = this.agents.get(input.agentId);
+        if (!record) {
+            throw new Error(`terminateAgent: agent not found: ${input.agentId}`);
+        }
+        const terminatedAt = new Date().toISOString();
+        record.status = "terminated";
+        record.terminatedAt = terminatedAt;
+        record.terminationReason = input.reason;
+        record.gracefulTermination = input.graceful ?? true;
+        record.lastHeartbeatAt = terminatedAt;
+        this.persist();
+        return { agentId: record.agentId, status: record.status, terminatedAt };
+    }
+    getAgent(agentId) {
+        return this.agents.get(agentId);
+    }
+    /**
+     * No-op heartbeat stub. Updates `lastHeartbeatAt` so callers can poll
+     * liveness. Returns true if the agent was found.
+     */
+    heartbeat(agentId) {
+        const record = this.agents.get(agentId);
+        if (!record)
+            return false;
+        if (record.status === "terminated")
+            return false;
+        record.lastHeartbeatAt = new Date().toISOString();
+        this.persist();
+        return true;
+    }
+    /**
+     * Bump the per-agent task counter (used by orchestration callers).
+     */
+    incrementTaskCount(agentId, by = 1) {
+        const record = this.agents.get(agentId);
+        if (!record)
+            return 0;
+        record.taskCount += by;
+        this.persist();
+        return record.taskCount;
+    }
+    /**
+     * Test/dev helper: drop everything. Not exposed via MCP.
+     */
+    reset() {
+        this.agents.clear();
+        this.seenIds.clear();
+        // Persistence: a reset should also wipe the file when configured,
+        // so the next loadFromDisk starts clean.
+        if (this.persistPath && existsSync(this.persistPath)) {
+            try {
+                writeFileSync(this.persistPath, JSON.stringify({ version: 1, agents: [] }, null, 2), "utf-8");
+            }
+            catch { /* best-effort */ }
+        }
+    }
+    /**
+     * Total agents currently tracked (any status).
+     */
+    size() {
+        return this.agents.size;
+    }
+    // ── Persistence ───────────────────────────────────────────────────────
+    loadFromDisk() {
+        if (!this.persistPath || !existsSync(this.persistPath))
+            return;
+        try {
+            const raw = readFileSync(this.persistPath, "utf-8");
+            const data = JSON.parse(raw);
+            if (Array.isArray(data.agents)) {
+                for (const a of data.agents) {
+                    if (!a || typeof a.agentId !== "string")
+                        continue;
+                    this.agents.set(a.agentId, a);
+                    this.seenIds.add(a.agentId);
+                }
+            }
+        }
+        catch {
+            // Corrupt or partial file — start fresh. A stale snapshot is
+            // never worse than refusing to boot.
+        }
+    }
+    persist() {
+        if (!this.persistPath)
+            return;
+        try {
+            mkdirSync(dirname(this.persistPath), { recursive: true });
+            const data = {
+                version: 1,
+                agents: Array.from(this.agents.values()),
+            };
+            writeFileSync(this.persistPath, JSON.stringify(data, null, 2), "utf-8");
+        }
+        catch {
+            // Persistence is best-effort. The registry remains correct
+            // in memory even if the disk write fails.
+        }
+    }
+}
+/**
+ * Process-wide singleton used by MCP tools. Persistence defaults to
+ * `.harness/agents.json` in the current working directory so the
+ * registry survives a Claude Code session restart on the same machine.
+ * Tests should construct their own `new BizarAgentRegistry()` to get
+ * an isolated, non-persistent instance.
+ */
+export const bizarAgentRegistry = new BizarAgentRegistry({
+    persistPath: ".harness/agents.json",
+});
+//# sourceMappingURL=agent-registry.js.map