mergen-server 1.4.0

package/LICENSE

@@ -0,0 +1,57 @@
+Mergen — Open-Core License
+
+This repository uses a dual-license model:
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ MIT License (open-source layer)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+The following components are MIT-licensed:
+
+  extension/             Chrome and Edge browser extension
+  extension-firefox/     Firefox browser extension
+  vscode-extension/      VS Code sidebar extension
+  packages/              mergen-node and mergen-python SDKs
+  sdk/                   Integration helpers and plugins
+  server/src/sensor/     Ingest, ring buffer, event schemas
+  server/src/routes/     HTTP API routes
+  server/src/app.ts      Express application factory
+  server/src/index.ts    Boot entrypoint
+  scripts/               Setup and tooling scripts
+
+Copyright (c) 2026 Mergen contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ Proprietary License (Hypothesis Engine)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+The following components are proprietary and all rights are reserved:
+
+  server/src/intelligence/   Causal chain reconstruction, hypothesis
+                             detectors, calibration feedback loop,
+                             anomaly baseline, billing, and licensing
+
+These components are distributed in compiled form only as part of the
+mergen-server npm package. They may not be copied, modified, redistributed,
+or used to build a competing service. See server/src/intelligence/LICENSE
+for the full proprietary license terms.
+
+Commercial licenses and pricing: https://mergen.dev/pricing

package/README.md

@@ -0,0 +1,96 @@
+# mergen-server
+
+Claude Code doesn't know what happened in production. Mergen does.
+
+MCP server for your AI IDE. Once connected, ask *"what caused the 3am incident"* and get a causal chain from live telemetry — not a log dump, a structured hypothesis with evidence and a fix command. At ≥85% confidence it executes the fix, validates the result, and posts the audit trail to your Slack thread.
+
+[![npm](https://img.shields.io/npm/v/mergen-server)](https://www.npmjs.com/package/mergen-server)
+[![License](https://img.shields.io/badge/license-MIT%20%2B%20Proprietary-blue)](https://github.com/omertt27/Mergen/blob/main/LICENSE)
+[![MCP](https://img.shields.io/badge/MCP-stdio-black)](https://modelcontextprotocol.io)
+
+---
+
+## Quick start
+
+```bash
+npm install -g mergen-server
+mergen-server setup
+```
+
+Then add to Claude Code:
+
+```bash
+claude mcp add mergen --transport stdio -- mergen-server start
+```
+
+Ask: *"Triage the api-service."*
+
+---
+
+## What it does
+
+```
+PagerDuty fires
+  → Mergen pulls correlated telemetry
+  → Causal analysis (root cause + evidence)
+  → If confidence ≥ 85% → executes fix
+  → Validates result
+  → Posts audit trail to Slack thread
+```
+
+All data stays on your infrastructure. No cloud. No copy-paste.
+
+---
+
+## MCP tools
+
+| Tool | What it does |
+|------|-------------|
+| `triage_incident` | Full autonomous loop — diagnosis + optional fix |
+| `execute_fix` | Execute a specific fix (requires `confirm: true`) |
+| `analyze_runtime` | Causal analysis — root cause + fix hint, no execution |
+| `get_recent_logs` | Console events from the ring buffer |
+| `get_network_activity` | HTTP/fetch events with status, duration, body |
+| `validate_fix` | Compare error counts before/after a fix |
+| `generate_runbook` | Self-updating runbook from your incident corpus |
+| `search_postmortems` | Semantic search over past incidents |
+| `draft_postmortem` | Blameless post-mortem draft in seconds |
+
+---
+
+## Environment variables
+
+```bash
+MERGEN_AUTOPILOT=true              # enable autonomous fix execution
+MERGEN_SLACK_BOT_TOKEN=xoxb-...    # Slack Web API (threads + replies)
+MERGEN_SLACK_CHANNEL=#incidents    # default incident channel
+```
+
+Point your OTLP exporter at `http://127.0.0.1:3000` and PagerDuty webhooks at `/webhooks/pagerduty`.
+
+---
+
+## Node.js SDK (one line)
+
+```js
+import 'mergen-server/sdk/node.js';
+// Captures uncaught exceptions, unhandledRejections, and process exits automatically
+```
+
+---
+
+## Post-mortem from Slack thread
+
+```bash
+curl -X POST http://127.0.0.1:3000/postmortem/from-slack \
+  -H 'Content-Type: application/json' \
+  -d '{"thread_url":"https://yourworkspace.slack.com/archives/C1234567/p1700000000000000","service":"api"}'
+```
+
+Fetches the thread via `conversations.replies`, correlates with telemetry, and returns a blameless post-mortem draft in seconds.
+
+---
+
+## Full documentation
+
+[github.com/omertt27/Mergen](https://github.com/omertt27/Mergen)

package/dist/__stubs__/calibration.js

@@ -0,0 +1,471 @@
+import fs from "fs";
+import path from "path";
+import { randomUUID } from "crypto";
+import { calibrationClassifier } from "../intelligence/calibration-classifier.js";
+import { invalidateThresholdCache } from "../intelligence/threshold-optimizer.js";
+import { CALIBRATION_FILE, zeroRetentionMode } from "../sensor/paths.js";
+import { gitSyncCalibration } from "../intelligence/calibration-git-sync.js";
+import logger from "../sensor/logger.js";
+const MIN_SAMPLES = 5;
+const DEMOTE_THRESHOLD = 0.5;
+const SUPPRESS_THRESHOLD = 0.2;
+const PENDING_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+const LABELED_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
+const SEED_TTL_MS = 365 * 24 * 60 * 60 * 1e3;
+let _records = [];
+let _loaded = false;
+let _corpusIsSeeded = false;
+let _persistTimer = null;
+function schedulePersist() {
+  if (zeroRetentionMode()) return;
+  if (_persistTimer) clearTimeout(_persistTimer);
+  _persistTimer = setTimeout(() => {
+    _persistTimer = null;
+    _persist();
+  }, 1e3);
+}
+function _persist() {
+  try {
+    fs.mkdirSync(path.dirname(CALIBRATION_FILE), { recursive: true });
+    const payload = {
+      version: 1,
+      records: _records.map((r) => ({
+        ...r,
+        predictedAt: r.predictedAt.toISOString(),
+        verdictAt: r.verdictAt?.toISOString() ?? null,
+        isBuiltinSeed: r.isBuiltinSeed,
+        remediationVerdict: r.remediationVerdict,
+        remediationVerdictAt: r.remediationVerdictAt?.toISOString() ?? null
+      }))
+    };
+    const tmp = `${CALIBRATION_FILE}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(payload), "utf8");
+    fs.renameSync(tmp, CALIBRATION_FILE);
+  } catch (err) {
+    logger.warn({ err }, "calibration: persist failed");
+  }
+}
+function _trainClassifierFromCorpus() {
+  const tagMap = /* @__PURE__ */ new Map();
+  for (const r of _records) {
+    if (!r.verdict) continue;
+    if (r.isBuiltinSeed) continue;
+    const list = tagMap.get(r.tag) ?? [];
+    list.push(r);
+    tagMap.set(r.tag, list);
+  }
+  const samples = [];
+  for (const recs of tagMap.values()) {
+    const verdicts = recs.length;
+    let correct = 0;
+    for (const r of recs) {
+      if (r.verdict === "correct") correct += 1;
+      else if (r.verdict === "partial") correct += 0.5;
+    }
+    const accuracy = correct / verdicts;
+    const trusted = verdicts >= MIN_SAMPLES;
+    for (const r of recs) {
+      samples.push({
+        confidence: r.confidenceScore,
+        tagAccuracy: accuracy,
+        sampleCount: verdicts,
+        trusted,
+        isCorrect: r.verdict === "correct" || r.verdict === "partial"
+      });
+    }
+  }
+  if (samples.length >= 10) {
+    calibrationClassifier.trainBulk(samples);
+  }
+  logger.debug(
+    { samples: samples.length, totalRecords: _records.length },
+    "calibration: classifier warm-started from real corpus (seeds excluded)"
+  );
+}
+function load() {
+  if (_loaded) return;
+  _loaded = true;
+  if (zeroRetentionMode()) {
+    _seedBuiltInPriors();
+    return;
+  }
+  if (!fs.existsSync(CALIBRATION_FILE)) {
+    _seedBuiltInPriors();
+    schedulePersist();
+    _trainClassifierFromCorpus();
+    return;
+  }
+  try {
+    const raw = JSON.parse(fs.readFileSync(CALIBRATION_FILE, "utf8"));
+    if (raw?.version === 1 && Array.isArray(raw.records)) {
+      const now = Date.now();
+      _records = raw.records.filter((r) => r.expiresAt > now).map((r) => ({
+        pid: r.pid,
+        tag: r.tag,
+        confidence: r.confidence,
+        confidenceScore: r.confidenceScore,
+        predictedAt: new Date(r.predictedAt),
+        verdict: r.verdict,
+        verdictAt: r.verdictAt ? new Date(r.verdictAt) : null,
+        note: r.note,
+        verdictDimension: r.verdictDimension,
+        expiresAt: r.expiresAt,
+        isBuiltinSeed: r.isBuiltinSeed ?? false,
+        remediationVerdict: r.remediationVerdict ?? null,
+        remediationVerdictAt: r.remediationVerdictAt ? new Date(r.remediationVerdictAt) : null
+      }));
+      if (_records.length > 0) {
+        _corpusIsSeeded = _records.every((r) => r.isBuiltinSeed);
+      }
+      if (_records.length === 0) {
+        _seedBuiltInPriors();
+        schedulePersist();
+      }
+    } else {
+      _seedBuiltInPriors();
+      schedulePersist();
+    }
+  } catch (err) {
+    logger.warn({ err }, "calibration: failed to load \u2014 seeding built-in priors");
+    _seedBuiltInPriors();
+    schedulePersist();
+  }
+  _trainClassifierFromCorpus();
+}
+function _resetForTesting() {
+  _records = [];
+  _loaded = true;
+}
+function recordPrediction(hypotheses) {
+  load();
+  return hypotheses.map((h) => {
+    const existing = h.pid ? _records.find((r) => r.pid === h.pid) : null;
+    if (existing) return h;
+    const pid = randomUUID();
+    _records.push({
+      pid,
+      tag: h.tag,
+      confidence: h.confidence,
+      confidenceScore: h.confidenceScore,
+      predictedAt: /* @__PURE__ */ new Date(),
+      verdict: null,
+      verdictAt: null,
+      note: null,
+      verdictDimension: null,
+      // Pending predictions expire after PENDING_TTL_MS (30 days). If a verdict
+      // is recorded before expiry, recordVerdict() extends expiresAt to
+      // LABELED_TTL_MS (90 days) so the labeled record survives for classifier
+      // training. The two TTLs serve different purposes and must not be merged.
+      expiresAt: Date.now() + PENDING_TTL_MS,
+      isBuiltinSeed: false,
+      remediationVerdict: null,
+      remediationVerdictAt: null
+    });
+    schedulePersist();
+    return { ...h, pid };
+  });
+}
+function recordVerdict(pid, verdict, note, dimension) {
+  load();
+  const rec = _records.find((r) => r.pid === pid);
+  if (!rec) return { found: false, persisted: false };
+  rec.isBuiltinSeed = false;
+  _corpusIsSeeded = false;
+  if (dimension === "remediation") {
+    rec.remediationVerdict = verdict;
+    rec.remediationVerdictAt = /* @__PURE__ */ new Date();
+  } else {
+    rec.verdict = verdict;
+    rec.verdictAt = /* @__PURE__ */ new Date();
+    rec.note = note ?? null;
+    rec.verdictDimension = dimension ?? null;
+  }
+  rec.expiresAt = Date.now() + LABELED_TTL_MS;
+  if (dimension !== "remediation") {
+    const stats = getStatsForTag(rec.tag);
+    calibrationClassifier.update(
+      rec.confidenceScore,
+      stats?.accuracy ?? 0.5,
+      stats?.verdicts ?? 0,
+      stats?.trusted ?? false,
+      verdict === "correct" || verdict === "partial"
+    );
+    invalidateThresholdCache();
+  }
+  schedulePersist();
+  gitSyncCalibration(rec.tag, verdict, pid);
+  return { found: true, persisted: true };
+}
+function getRecords() {
+  load();
+  return [..._records];
+}
+function normalizeNote(s) {
+  return s.toLowerCase().replace(/[^a-z0-9\s]/g, "").trim().replace(/\s+/g, " ");
+}
+function _computeTagStats(tag, recs) {
+  const predictions = recs.length;
+  const withVerdict = recs.filter((r) => r.verdict !== null);
+  const verdicts = withVerdict.length;
+  let correct = 0;
+  for (const r of withVerdict) {
+    if (r.verdict === "correct") correct += 1;
+    else if (r.verdict === "partial") correct += 0.5;
+  }
+  const accuracy = verdicts > 0 ? correct / verdicts : 0;
+  const trusted = verdicts >= MIN_SAMPLES;
+  const cutoff7d = Date.now() - 7 * 24 * 60 * 60 * 1e3;
+  const recent = withVerdict.filter((r) => r.verdictAt && r.verdictAt.getTime() >= cutoff7d);
+  let recentCorrect = 0;
+  for (const r of recent) {
+    if (r.verdict === "correct") recentCorrect += 1;
+    else if (r.verdict === "partial") recentCorrect += 0.5;
+  }
+  const accuracy7d = recent.length >= 3 ? recentCorrect / recent.length : null;
+  const trendDelta = accuracy7d !== null ? accuracy7d - accuracy : null;
+  const noteGroups = /* @__PURE__ */ new Map();
+  for (const r of withVerdict) {
+    if (r.note && r.verdict === "wrong") {
+      const key = normalizeNote(r.note);
+      const ex = noteGroups.get(key);
+      if (ex) ex.count++;
+      else noteGroups.set(key, { canonical: r.note, count: 1 });
+    }
+  }
+  const commonFailureModes = [...noteGroups.values()].sort((a, b) => b.count - a.count).map(({ canonical, count }) => ({ note: canonical, count }));
+  const remediationRecs = recs.filter((r) => r.remediationVerdict !== null);
+  let remediationCorrect = 0;
+  for (const r of remediationRecs) {
+    if (r.remediationVerdict === "correct") remediationCorrect += 1;
+    else if (r.remediationVerdict === "partial") remediationCorrect += 0.5;
+  }
+  const remediationAccuracy = remediationRecs.length > 0 ? remediationCorrect / remediationRecs.length : null;
+  return {
+    tag,
+    predictions,
+    verdicts,
+    accuracy,
+    trusted,
+    isEmpirical: trusted,
+    shouldInterrupt: trusted && accuracy < SUPPRESS_THRESHOLD,
+    diagnosisAccuracy: accuracy,
+    remediationAccuracy,
+    trendDelta,
+    accuracy7d,
+    commonFailureModes
+  };
+}
+function getStats() {
+  load();
+  const tagMap = /* @__PURE__ */ new Map();
+  for (const r of _records) {
+    const list = tagMap.get(r.tag) ?? [];
+    list.push(r);
+    tagMap.set(r.tag, list);
+  }
+  return [...tagMap.entries()].map(([tag, recs]) => _computeTagStats(tag, recs));
+}
+function getGlobalStats() {
+  return null;
+}
+function classifyVerdict(beforeCount, afterCount) {
+  if (afterCount === 0) return beforeCount > 0 ? "correct" : "partial";
+  if (afterCount < beforeCount) return "partial";
+  return "wrong";
+}
+function recordRemediationVerdict(pid, verdict) {
+  return recordVerdict(pid, verdict, void 0, "remediation");
+}
+function isCorpusSeeded() {
+  load();
+  return _corpusIsSeeded;
+}
+function getStatsForTag(tag) {
+  load();
+  const recs = _records.filter((r) => r.tag === tag);
+  if (recs.length === 0) return void 0;
+  return _computeTagStats(tag, recs);
+}
+function applyCalibration(hypotheses) {
+  load();
+  const active = [];
+  const suppressed = [];
+  for (const h of hypotheses) {
+    const stats = getStatsForTag(h.tag);
+    if (!stats || !stats.trusted) {
+      active.push({ ...h, calibrationAction: "passed" });
+      continue;
+    }
+    if (stats.accuracy >= DEMOTE_THRESHOLD) {
+      active.push({ ...h, calibrationAction: "passed" });
+    } else if (stats.accuracy >= SUPPRESS_THRESHOLD) {
+      const demoted = {
+        ...h,
+        confidence: h.confidence === "HIGH" ? "MEDIUM" : h.confidence === "MEDIUM" ? "LOW" : "LOW",
+        confidenceScore: h.confidenceScore * 0.5,
+        calibrationAction: "demoted"
+      };
+      active.push(demoted);
+    } else {
+      suppressed.push({ ...h, calibrationAction: "suppressed" });
+    }
+  }
+  return { active, suppressed };
+}
+function updateCalibrationNote(pid, note) {
+  load();
+  const rec = _records.find((r) => r.pid === pid);
+  if (!rec) return false;
+  rec.note = note.slice(0, 500);
+  schedulePersist();
+  return true;
+}
+function getRealVerdictCount() {
+  load();
+  return _records.filter((r) => !r.isBuiltinSeed && r.verdict !== null).length;
+}
+function getPendingFeedback() {
+  load();
+  const now = Date.now();
+  return _records.filter((r) => r.verdict === null && r.expiresAt > now).map((r) => ({ pid: r.pid, tag: r.tag, expiresAt: r.expiresAt }));
+}
+function seedCalibration(tag, counts) {
+  load();
+  const { correct = 0, wrong = 0, partial = 0 } = counts;
+  const addRecords = (count, verdict) => {
+    for (let i = 0; i < count; i++) {
+      _records.push({
+        pid: randomUUID(),
+        tag,
+        confidence: "HIGH",
+        confidenceScore: 0.9,
+        predictedAt: new Date(Date.now() - 6e4),
+        verdict,
+        verdictAt: /* @__PURE__ */ new Date(),
+        note: null,
+        verdictDimension: null,
+        expiresAt: Date.now() + LABELED_TTL_MS,
+        // already labeled — use retention TTL
+        isBuiltinSeed: false,
+        remediationVerdict: null,
+        remediationVerdictAt: null
+      });
+    }
+  };
+  addRecords(correct, "correct");
+  addRecords(wrong, "wrong");
+  addRecords(partial, "partial");
+  schedulePersist();
+}
+import { createHash } from "crypto";
+function csvQuote(s) {
+  if (s === null || s === void 0) return "";
+  if (!/[",\n\r]/.test(s)) return s;
+  return '"' + s.replace(/"/g, '""') + '"';
+}
+function exportCsv() {
+  load();
+  const header = "pid,tag,confidence,predictedAt,verdict,verdictAt,note,verdictDimension";
+  const rows = _records.map((r) => [
+    r.pid,
+    r.tag,
+    r.confidence,
+    r.predictedAt.toISOString(),
+    r.verdict ?? "",
+    r.verdictAt ? r.verdictAt.toISOString() : "",
+    csvQuote(r.note),
+    r.verdictDimension ?? ""
+  ].join(","));
+  const dataBlock = rows.length > 0 ? rows.join("\n") : "";
+  const sha256 = createHash("sha256").update(dataBlock).digest("hex");
+  const comment = `# rows: ${rows.length}, sha256: ${sha256}`;
+  if (rows.length === 0) return `${comment}
+${header}`;
+  return `${comment}
+${header}
+${dataBlock}
+`;
+}
+const CALIBRATION_CONFIG = {};
+function _seedBuiltInPriors() {
+  if (_records.length > 0) return;
+  _corpusIsSeeded = true;
+  const DAY = 24 * 60 * 60 * 1e3;
+  const seeds = [
+    ["auth_token_not_persisted", 17, 3],
+    ["disk_full", 19, 1],
+    ["memory_leak_oom", 23, 2],
+    ["deployment_induced_regression", 22, 3],
+    ["missing_env_var", 20, 2],
+    ["unhandled_promise_rejection", 22, 2],
+    ["connection_refused", 19, 3],
+    ["rate_limit_silent", 18, 4],
+    ["cors_preflight_failure", 20, 4],
+    ["jwt_expiry", 21, 3],
+    ["n_plus_one_query", 15, 6],
+    ["health_check_degraded", 18, 5],
+    ["stale_cache", 14, 6],
+    ["cascading_timeout", 17, 6],
+    ["connection_pool_exhausted", 19, 5],
+    ["session_fixation", 15, 7],
+    ["db_migration_lock", 16, 6],
+    ["failed_migration", 20, 3],
+    ["slow_api_silent", 16, 7],
+    ["empty_response_silent", 14, 8]
+  ];
+  for (const [tag, correct, wrong] of seeds) {
+    for (let i = 0; i < correct; i++) {
+      _records.push({
+        pid: randomUUID(),
+        tag,
+        confidence: "HIGH",
+        confidenceScore: 0.88,
+        predictedAt: new Date(Date.now() - Math.floor(Math.random() * 60) * DAY),
+        verdict: "correct",
+        verdictAt: new Date(Date.now() - Math.floor(Math.random() * 59) * DAY),
+        note: null,
+        verdictDimension: null,
+        expiresAt: Date.now() + SEED_TTL_MS,
+        isBuiltinSeed: true,
+        remediationVerdict: null,
+        remediationVerdictAt: null
+      });
+    }
+    for (let i = 0; i < wrong; i++) {
+      _records.push({
+        pid: randomUUID(),
+        tag,
+        confidence: "HIGH",
+        confidenceScore: 0.88,
+        predictedAt: new Date(Date.now() - Math.floor(Math.random() * 60) * DAY),
+        verdict: "wrong",
+        verdictAt: new Date(Date.now() - Math.floor(Math.random() * 59) * DAY),
+        note: null,
+        verdictDimension: null,
+        expiresAt: Date.now() + SEED_TTL_MS,
+        isBuiltinSeed: true,
+        remediationVerdict: null,
+        remediationVerdictAt: null
+      });
+    }
+  }
+}
+export {
+  CALIBRATION_CONFIG,
+  _resetForTesting,
+  applyCalibration,
+  classifyVerdict,
+  exportCsv,
+  getGlobalStats,
+  getPendingFeedback,
+  getRealVerdictCount,
+  getRecords,
+  getStats,
+  getStatsForTag,
+  isCorpusSeeded,
+  recordPrediction,
+  recordRemediationVerdict,
+  recordVerdict,
+  seedCalibration,
+  updateCalibrationNote
+};