mergen-server 1.4.0

package/dist/commands/setup.js

@@ -0,0 +1,1218 @@
+import { execSync, spawn, spawnSync } from "child_process";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
+import * as path from "path";
+import { resolve, dirname } from "path";
+import { homedir } from "os";
+import { log, success, error, hr, ask, sleep, SERVER_ENTRY, CLI_ENTRY } from "./shared.js";
+import { connectCommand, backfillCommand } from "./github.js";
+import { guardCommand } from "./policy.js";
+import { watchCommand } from "./incident.js";
+async function seedBuiltinRunbooks() {
+  const { mkdirSync: mkd, copyFileSync, existsSync: ex } = await import("fs");
+  const { join: j, dirname: dirname2, resolve: res } = await import("path");
+  const { homedir: hd } = await import("os");
+  const { fileURLToPath: fileURLToPath2 } = await import("url");
+  const RUNBOOKS_DIR = j(hd(), ".mergen", "runbooks", "_builtin");
+  mkd(RUNBOOKS_DIR, { recursive: true });
+  const __filename = fileURLToPath2(import.meta.url);
+  const pkgRunbooks = res(dirname2(__filename), "..", "runbooks");
+  if (!ex(pkgRunbooks)) return;
+  const { readdirSync } = await import("fs");
+  let seeded = 0;
+  for (const f of readdirSync(pkgRunbooks)) {
+    if (!f.endsWith(".yaml") && !f.endsWith(".yml")) continue;
+    const dest = j(RUNBOOKS_DIR, f);
+    if (!ex(dest)) {
+      copyFileSync(j(pkgRunbooks, f), dest);
+      seeded++;
+    }
+  }
+  if (seeded > 0) {
+    log(`Seeded ${seeded} built-in runbook${seeded !== 1 ? "s" : ""} \u2192 ~/.mergen/runbooks/_builtin/`, "\u2705");
+  }
+}
+async function loginCommand() {
+  const { exec } = await import("child_process");
+  const { activateKey } = await import("../intelligence/license.js");
+  const { getPlan } = await import("../intelligence/plans.js");
+  const { runDeviceAuthorization, DeviceAuthError } = await import("../intelligence/device-auth.js");
+  const CAP_LABELS = {
+    hitlApproval: "HITL approve/deny holds",
+    overrideCorpusEnforce: "override-corpus enforcement",
+    ciGate: "CI/CD blast-radius gate",
+    credentialBrokering: "ephemeral multi-cloud credentials",
+    agentIam: "Agent IAM + SSO federation"
+  };
+  const planSummary = (planId) => {
+    const plan = getPlan(typeof planId === "string" ? planId : void 0);
+    const caps = Object.entries(plan.capabilities).filter(([, on]) => on).map(([cap]) => CAP_LABELS[cap] ?? cap);
+    const suffix = caps.length > 0 ? ` \u2014 unlocks ${caps.join(", ")}` : "";
+    return `${plan.name}${suffix}`;
+  };
+  const activateAndReport = async (key) => {
+    log(`Activating license key: ${key.substring(0, 12)}...`);
+    try {
+      const result = await activateKey(key);
+      success(`License activated! Plan: ${planSummary(result.planId)}`);
+      process.exit(0);
+    } catch (err) {
+      error(`Activation failed: ${err.message}`);
+      process.exit(1);
+    }
+  };
+  const args = process.argv.slice(3);
+  const keyIndex = args.indexOf("--key");
+  if (keyIndex !== -1 && args[keyIndex + 1]) {
+    await activateAndReport(args[keyIndex + 1]);
+  }
+  const apiUrl = process.env.MERGEN_API_URL ?? "https://api.mergen.app";
+  const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  console.log("\u{1F680} Signing in to Mergen...\n");
+  try {
+    const activation = await runDeviceAuthorization(apiUrl, {
+      onPrompt: (code) => {
+        console.log(`Your device code:  ${code.userCode}
+`);
+        console.log("Opening your browser to approve this device:");
+        console.log(`  ${code.verificationUriComplete}
+`);
+        console.log("If it doesn\u2019t open, visit the URL above and confirm the code.");
+        console.log("Waiting for approval...");
+        exec(`${openCmd} "${code.verificationUriComplete}"`).unref();
+      }
+    });
+    await activateAndReport(activation.key);
+  } catch (err) {
+    if (err instanceof DeviceAuthError) {
+      error(`Sign-in failed: ${err.message}`);
+      if (err.reason === "network") {
+        console.log("\nThe activation server was unreachable. If you have a license key, run:");
+        console.log("  mergen-server login --key <your-key>");
+      }
+    } else {
+      error(`Sign-in failed: ${err.message}`);
+    }
+    process.exit(1);
+  }
+}
+function resolveServerEntry() {
+  return SERVER_ENTRY;
+}
+async function quickSetup(ideFlag) {
+  const { exec } = await import("child_process");
+  const { activateKey } = await import("../intelligence/license.js");
+  const { runDeviceAuthorization, DeviceAuthError } = await import("../intelligence/device-auth.js");
+  const start = performance.now();
+  console.log("\n\u{1F680} Mergen\n");
+  const nodeVersion = parseInt(process.versions.node.split(".")[0]);
+  if (nodeVersion < 18) {
+    error(`Node.js 18+ required (you have ${process.versions.node})`);
+    log("Install from: https://nodejs.org/");
+    process.exit(1);
+  }
+  success(`Node.js ${process.versions.node}`);
+  log("Detecting IDE...");
+  if (ideFlag) {
+    await configureIDE(ideFlag);
+    success(`${ideFlag} configured`);
+  } else {
+    const detected = await detectAllIDEs();
+    const targets = detected.length > 0 ? detected : ["claude-code", "cursor", "vscode", "windsurf"];
+    for (const ide of targets) {
+      await configureIDE(ide);
+    }
+    if (detected.length > 0) {
+      success(`IDE(s) configured: ${detected.join(", ")}`);
+    } else {
+      success("No IDE detected \u2014 configured all 4 (Claude Code, Cursor, VS Code, Windsurf)");
+    }
+  }
+  log("Signing in to mergen.app...");
+  const apiUrl = process.env.MERGEN_API_URL ?? "https://api.mergen.app";
+  const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    const activation = await runDeviceAuthorization(apiUrl, {
+      onPrompt: (code) => {
+        console.log(`
+  Device code:  ${code.userCode}`);
+        console.log("  Opening browser to approve \u2014 confirm the code shown above.");
+        console.log(`  If browser doesn't open: ${code.verificationUriComplete}
+`);
+        exec(`${openCmd} "${code.verificationUriComplete}"`).unref();
+      }
+    });
+    await activateKey(activation.key);
+    success("Signed in");
+  } catch (err) {
+    if (err instanceof DeviceAuthError && err.reason === "network") {
+      log("Could not reach api.mergen.app. Continuing offline \u2014 run: mergen-server login", "\u26A0");
+    } else {
+      error(`Sign-in failed: ${err.message}`);
+      log("Run manually after setup: mergen-server login", "\u2139");
+    }
+  }
+  await seedBuiltinRunbooks();
+  const elapsed = ((performance.now() - start) / 1e3).toFixed(1);
+  hr();
+  success(`Setup complete in ${elapsed}s
+`);
+  console.log("In your AI IDE, ask:");
+  console.log('  "What is Mergen doing right now?"');
+  console.log('  "Triage the latest incident"');
+  console.log('  "Block the command: terraform destroy --auto-approve"\n');
+  console.log("Add integrations (Slack, PagerDuty, GitHub):");
+  console.log("  mergen-server setup --full\n");
+  const rawArgs = process.argv.slice(3);
+  if (!rawArgs.includes("--no-start")) {
+    log("Starting server...");
+    process.argv = [...process.argv.slice(0, 3), "--then", "doctor"];
+    await startCommand();
+  } else {
+    log("Start when ready: mergen-server start", "\u2139");
+  }
+}
+async function detectAllIDEs() {
+  const found = [];
+  try {
+    execSync("which claude", { stdio: "ignore" });
+    found.push("claude-code");
+  } catch {
+  }
+  const cursorConfig = resolve(homedir(), ".cursor", "mcp.json");
+  const cursorApp = resolve("/Applications", "Cursor.app");
+  if (existsSync(cursorConfig) || existsSync(cursorApp)) found.push("cursor");
+  try {
+    execSync("which code", { stdio: "ignore" });
+    found.push("vscode");
+  } catch {
+  }
+  const windsurfConfig = resolve(homedir(), ".codeium", "windsurf", "mcp_config.json");
+  const windsurfApp = resolve("/Applications", "Windsurf.app");
+  if (existsSync(windsurfConfig) || existsSync(windsurfApp)) found.push("windsurf");
+  return found;
+}
+async function setupCommand() {
+  const rawArgs = process.argv.slice(3);
+  const yes = rawArgs.includes("--yes") || rawArgs.includes("-y");
+  const skipGitHub = yes || rawArgs.includes("--skip-github");
+  const showTiming = rawArgs.includes("--time");
+  const fullMode = rawArgs.includes("--full");
+  const ideFlag = rawArgs.find((a) => a.startsWith("--ide="))?.slice(6) ?? (rawArgs.includes("--ide") ? rawArgs[rawArgs.indexOf("--ide") + 1] : null);
+  if (!fullMode && !yes) {
+    await quickSetup(ideFlag);
+    return;
+  }
+  const _setupStart = performance.now();
+  const _stepTimes = [];
+  let _stepStart = _setupStart;
+  function _markStep(label) {
+    const ms = performance.now() - _stepStart;
+    _stepTimes.push({ label, ms });
+    _stepStart = performance.now();
+  }
+  console.log("\u{1F680} Mergen Setup Wizard\n");
+  if (yes) log("Non-interactive mode (--yes)\n", "\u2139");
+  hr();
+  log("Checking prerequisites...");
+  const nodeVersion = parseInt(process.versions.node.split(".")[0]);
+  if (nodeVersion < 18) {
+    error(`Node.js 18+ required (you have ${process.versions.node})`);
+    log("Install from: https://nodejs.org/");
+    process.exit(1);
+  }
+  success(`Node.js ${process.versions.node}`);
+  _markStep("Prerequisites");
+  log("\nDetecting IDE...");
+  const ide = ideFlag ?? await detectIDE();
+  success(`Found: ${ide}`);
+  _markStep("IDE detection");
+  log(`
+Configuring ${ide}...`);
+  await configureIDE(ide);
+  success(`${ide} configured`);
+  _markStep("MCP configuration");
+  hr();
+  log("\nShadow mode (recommended starting point):");
+  console.log("  Shadow mode runs full diagnosis and posts Slack alerts but never executes fixes.");
+  console.log(`  After 30 days you'll have a track record: "Mergen would have been correct 89% of the time."`);
+  console.log("  That data is what makes enabling autopilot a decision, not a leap of faith.");
+  if (!yes) {
+    const enableShadow = await ask("\nEnable shadow mode now? (y/n): ");
+    if (enableShadow.toLowerCase() === "y") {
+      process.env.MERGEN_SHADOW_MODE = "true";
+      const envPath = path.join(process.cwd(), ".env");
+      try {
+        const existing = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+        if (!existing.includes("MERGEN_SHADOW_MODE")) {
+          writeFileSync(envPath, `${existing}${existing.endsWith("\n") || existing === "" ? "" : "\n"}MERGEN_SHADOW_MODE=true
+`);
+          success("Shadow mode enabled and written to .env");
+        } else {
+          success("Shadow mode enabled (MERGEN_SHADOW_MODE already in .env)");
+        }
+      } catch {
+        log("Set MERGEN_SHADOW_MODE=true in your server environment to persist this.", "\u2139");
+        success("Shadow mode enabled for this session");
+      }
+    } else {
+      log('Skipped \u2014 enable later: echo "MERGEN_SHADOW_MODE=true" >> .env', "\u2139");
+    }
+  }
+  hr();
+  log("\nLocal execution sandbox:");
+  console.log("  Scopes `mergen-server exec` to your workspace: blocks writes outside it and");
+  console.log("  denies network access by default. On macOS this uses the native sandbox-exec");
+  console.log("  tool \u2014 no Docker daemon, no container, near-zero startup overhead.");
+  async function enableSeatbeltInEnv() {
+    const envPath = path.join(process.cwd(), ".env");
+    try {
+      const existing = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+      if (!existing.includes("MERGEN_SANDBOX")) {
+        writeFileSync(envPath, `${existing}${existing.endsWith("\n") || existing === "" ? "" : "\n"}MERGEN_SANDBOX=seatbelt
+`);
+        success("Sandbox execution enabled (MERGEN_SANDBOX=seatbelt), written to .env");
+      } else {
+        success("MERGEN_SANDBOX already set in .env \u2014 left unchanged");
+      }
+    } catch {
+      process.env.MERGEN_SANDBOX = "seatbelt";
+      success("Sandbox execution enabled for this session");
+    }
+  }
+  if (process.platform !== "darwin") {
+    log("Skipped \u2014 sandbox-exec is macOS-only. On Linux, use MERGEN_SANDBOX=docker (needs Docker) or", "\u2139");
+    log("MERGEN_EBPF_VERIFY=true (needs bpftrace) instead.", "\u2139");
+  } else if (yes) {
+    await enableSeatbeltInEnv();
+  } else {
+    const enableSandbox = await ask("\nEnable native sandbox execution now? (y/n): ");
+    if (enableSandbox.toLowerCase() === "y") {
+      await enableSeatbeltInEnv();
+      log("If a wrapped command needs to write outside the workspace (e.g. a package cache),", "\u2139");
+      log("set MERGEN_SANDBOX_EXTRA_WRITE_PATHS=/path/one,/path/two", "\u2139");
+    } else {
+      log('Skipped \u2014 enable later: echo "MERGEN_SANDBOX=seatbelt" >> .env', "\u2139");
+    }
+  }
+  _markStep("Execution sandbox");
+  hr();
+  log("\nSlack alerts (recommended \u2014 where Mergen posts incident analysis):");
+  console.log("  Without Slack, Mergen diagnoses silently. With Slack, every incident fires a");
+  console.log("  thread: root cause, confidence score, proposed fix, and HITL approve/deny buttons.");
+  if (!yes) {
+    const enableSlack = await ask("\nConnect Slack now? (y/n): ");
+    if (enableSlack.toLowerCase() === "y") {
+      console.log("");
+      console.log("  1. Go to https://api.slack.com/apps \u2192 Create New App \u2192 From manifest");
+      console.log("  2. Grant scopes: chat:write, chat:write.public, incoming-webhook");
+      console.log("  3. Install to your workspace \u2192 copy the Bot User OAuth Token");
+      console.log("");
+      const slackToken = (await ask("  Bot token (xoxb-...): ")).trim();
+      const slackChannel = (await ask("  Channel for alerts (#incidents): ")).trim() || "#incidents";
+      let verifiedToken = slackToken;
+      if (verifiedToken) {
+        process.stdout.write("  Verifying token with Slack... ");
+        try {
+          const res = await fetch("https://slack.com/api/auth.test", {
+            method: "POST",
+            headers: { Authorization: `Bearer ${verifiedToken}` },
+            signal: AbortSignal.timeout(5e3)
+          });
+          const body = await res.json();
+          if (body.ok) {
+            console.log(`\u2713 (workspace: ${body.team ?? "unknown"})`);
+          } else {
+            console.log(`\u2717 (${body.error ?? "invalid token"})`);
+            const saveAnyway = await ask("  Token failed verification \u2014 save it anyway? (y/n): ");
+            if (saveAnyway.toLowerCase() !== "y") verifiedToken = "";
+          }
+        } catch (err) {
+          console.log(`\u2717 (${err instanceof Error ? err.message : "network error"})`);
+          const saveAnyway = await ask("  Could not reach Slack to verify \u2014 save it anyway? (y/n): ");
+          if (saveAnyway.toLowerCase() !== "y") verifiedToken = "";
+        }
+      }
+      if (verifiedToken) {
+        const envPath = path.join(process.cwd(), ".env");
+        try {
+          const existing = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+          let updated = existing;
+          if (!updated.includes("MERGEN_SLACK_BOT_TOKEN")) updated += `
+MERGEN_SLACK_BOT_TOKEN=${verifiedToken}`;
+          if (!updated.includes("MERGEN_SLACK_CHANNEL")) updated += `
+MERGEN_SLACK_CHANNEL=${slackChannel}`;
+          writeFileSync(envPath, updated.trimStart() + "\n", "utf8");
+          success(`Slack configured (channel: ${slackChannel}), written to .env`);
+        } catch {
+          success("Slack configured for this session");
+          log(`Set these in your .env to persist:
+  MERGEN_SLACK_BOT_TOKEN=${verifiedToken}
+  MERGEN_SLACK_CHANNEL=${slackChannel}`, "\u2139");
+        }
+      } else {
+        log("No token saved \u2014 skipped.", "\u2139");
+      }
+    } else {
+      log("Skipped. To add later: set MERGEN_SLACK_BOT_TOKEN and MERGEN_SLACK_CHANNEL in .env", "\u2139");
+    }
+  }
+  _markStep("Slack setup");
+  hr();
+  log("\nPagerDuty webhook (recommended \u2014 where incidents originate):");
+  console.log("  Connecting PagerDuty lets Mergen catch incident.triggered events, fetch traces,");
+  console.log("  and post the diagnosis to Slack. Autopilot (if enabled) runs the fix loop from here.");
+  if (!yes) {
+    const enablePD = await ask("\nConnect PagerDuty now? (y/n): ");
+    if (enablePD.toLowerCase() === "y") {
+      const port = process.env.HTTP_PORT ?? "3000";
+      console.log("");
+      console.log("  1. PagerDuty \u2192 Service \u2192 Integrations \u2192 Add a webhook (v3)");
+      console.log(`  2. Endpoint URL: https://your-host:${port}/webhooks/pagerduty`);
+      console.log('  3. Copy the "Webhook signing secret" shown after creation');
+      console.log("");
+      const pdSecret = (await ask("  Webhook signing secret: ")).trim();
+      if (pdSecret) {
+        if (pdSecret.length < 16) {
+          log("That looks short for a PagerDuty signing secret \u2014 double-check you copied the whole value.", "\u26A0");
+        }
+        const envPath = path.join(process.cwd(), ".env");
+        try {
+          const existing = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+          let updated = existing;
+          if (!updated.includes("MERGEN_PAGERDUTY_SECRET")) updated += `
+MERGEN_PAGERDUTY_SECRET=${pdSecret}`;
+          writeFileSync(envPath, updated.trimStart() + "\n", "utf8");
+          success("PagerDuty configured, written to .env");
+        } catch {
+          success("PagerDuty configured for this session");
+          log(`Set this in your .env to persist:
+  MERGEN_PAGERDUTY_SECRET=${pdSecret}`, "\u2139");
+        }
+        log("Trigger a test event from PagerDuty once the server is running to confirm delivery end-to-end.", "\u2139");
+      } else {
+        log("No secret entered \u2014 skipped.", "\u2139");
+      }
+    } else {
+      log("Skipped. To add later: set MERGEN_PAGERDUTY_SECRET in .env (webhook \u2192 /webhooks/pagerduty)", "\u2139");
+    }
+  }
+  _markStep("PagerDuty setup");
+  hr();
+  log("\nGitHub intent archive (optional \u2014 powers explain_why):");
+  console.log('  Connecting GitHub populates PR history so Mergen can answer "why was this changed?"');
+  console.log("  Skip this if you just want incident triage \u2014 you can add it later.");
+  if (!skipGitHub && !yes) {
+    const connectGh = await ask("Connect GitHub now? (y/n): ");
+    if (connectGh.toLowerCase() === "y") {
+      await connectCommand(["github"]);
+      const doBackfill = await ask("\nBackfill historical PRs? Gives explain_why data on day 1. (y/n): ");
+      if (doBackfill.toLowerCase() === "y") {
+        await backfillCommand(["github"]);
+      }
+    } else {
+      log("Skipped. Run later: mergen-server connect github --repo <owner/repo>", "\u2139");
+    }
+  } else {
+    log("GitHub step skipped. Run later: mergen-server connect github --repo <owner/repo>", "\u2139");
+  }
+  _markStep("GitHub integration");
+  hr();
+  log("\nGit Pre-commit Hook (Recommended):");
+  console.log("  Enforces safety rules before each git commit, protecting your repo from");
+  console.log("  staged file errors regardless of the editor or AI autocomplete tool you use.");
+  if (!yes) {
+    const installHook = await ask("\nInstall Git pre-commit guard hook now? (y/n): ");
+    if (installHook.toLowerCase() === "y") {
+      try {
+        await guardCommand(["--install"]);
+      } catch (err) {
+        error(`Failed to install hook: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  } else {
+    try {
+      await guardCommand(["--install"]);
+    } catch {
+    }
+  }
+  _markStep("Pre-commit hook");
+  await seedBuiltinRunbooks();
+  _markStep("Runbook seed");
+  hr();
+  log("\n\u2728 Setup complete!\n");
+  if (showTiming) {
+    const totalMs = performance.now() - _setupStart;
+    const pad = (s, n) => s + " ".repeat(Math.max(0, n - s.length));
+    console.log("Setup timing:");
+    for (const { label, ms } of _stepTimes) {
+      console.log(`  ${pad(label + ":", 26)} ${(ms / 1e3).toFixed(1)}s`);
+    }
+    console.log(`  ${"Total:".padEnd(26)} ${(totalMs / 1e3).toFixed(1)}s
+`);
+  }
+  console.log("Next steps:");
+  console.log("  1. Start server:     mergen-server start");
+  console.log("  2. Verify it works:  mergen-server start --then doctor");
+  console.log("       (starts server, runs health checks, then keeps server running)");
+  console.log("  3. Check shadow log: mergen-server shadow-report");
+  console.log('  4. Enable autopilot: echo "MERGEN_AUTOPILOT=true" >> .env\n');
+  console.log("If PagerDuty or Datadog aren't set up yet, add to .env then restart:");
+  console.log("  MERGEN_PAGERDUTY_SECRET=<signing-secret>   # webhook \u2192 /webhooks/pagerduty");
+  console.log("  DD_API_KEY=...  DD_APP_KEY=...             # trace fetch + validation\n");
+  console.log("Save your Day-1 baseline (compare at Day 30):");
+  console.log("  mergen-server impact-report --baseline");
+  console.log("  mergen-server impact-report --compare      # at Day 30\n");
+  if (yes) {
+    log('Skipping "start now?" prompt in --yes mode. Run: mergen-server start', "\u2139");
+    return;
+  }
+  const startNow = await ask("Start server now and run doctor to verify? (y/n): ");
+  if (startNow.toLowerCase() === "y") {
+    process.argv = [...process.argv.slice(0, 3), "--then", "doctor"];
+    await startCommand();
+  }
+}
+async function testCommand() {
+  console.log("\u{1F50D} Testing Mergen installation\n");
+  hr();
+  const checks = [
+    { name: "Server binary", fn: checkBinary },
+    { name: "Server starts", fn: checkServerStarts },
+    { name: "Health endpoint", fn: checkHealth },
+    { name: "Event ingestion", fn: checkIngest },
+    { name: "IDE configuration", fn: checkIDEConfig }
+  ];
+  let passed = 0;
+  let failed = 0;
+  for (const check of checks) {
+    process.stdout.write(`${check.name}... `);
+    try {
+      await check.fn();
+      console.log("\u2713");
+      passed++;
+    } catch (err) {
+      console.log("\u2717");
+      error(`  ${err instanceof Error ? err.message : "Unknown error"}`);
+      failed++;
+    }
+  }
+  hr();
+  if (failed === 0) {
+    success(`All checks passed (${passed}/${checks.length})`);
+    console.log("\n\u2728 Mergen is ready to use!\n");
+  } else {
+    error(`${failed} check(s) failed`);
+    console.log("\nRun: mergen-server setup");
+    process.exit(1);
+  }
+}
+async function ciCommand() {
+  const serverPath = SERVER_ENTRY;
+  if (!existsSync(serverPath)) {
+    error("Server binary not found. Run: npm run build");
+    process.exit(1);
+  }
+  console.log("\u{1F916} Mergen CI health check\n");
+  const proc = spawn("node", [serverPath], {
+    stdio: "pipe",
+    env: { ...process.env, NODE_ENV: "production", HTTP_PORT: "3099" }
+  });
+  const BASE = "http://127.0.0.1:3099";
+  let serverReady = false;
+  const stderrLines = [];
+  proc.stderr.on("data", (d) => {
+    stderrLines.push(d.toString().trim());
+    if (d.toString().includes("HTTP ingest listening")) {
+      serverReady = true;
+    }
+  });
+  const startDeadline = Date.now() + 1e4;
+  while (!serverReady && Date.now() < startDeadline) {
+    await sleep(200);
+  }
+  if (!serverReady) {
+    error("Server did not start within 10s");
+    console.error(stderrLines.join("\n"));
+    proc.kill();
+    process.exit(1);
+  }
+  let exitCode = 0;
+  try {
+    process.stdout.write("Health endpoint... ");
+    const health = await fetch(`${BASE}/health`);
+    if (!health.ok) throw new Error(`/health returned ${health.status}`);
+    const hd = await health.json();
+    if (hd.status !== "ok") throw new Error(`status=${hd.status}`);
+    console.log("\u2713");
+    process.stdout.write("Event ingestion... ");
+    const ingest = await fetch(`${BASE}/ingest`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        type: "console",
+        level: "log",
+        args: ["mergen-ci-probe"],
+        url: "http://ci.test",
+        timestamp: Date.now()
+      })
+    });
+    if (!ingest.ok) throw new Error(`/ingest returned ${ingest.status}`);
+    console.log("\u2713");
+    success("All CI checks passed");
+  } catch (err) {
+    error(err instanceof Error ? err.message : String(err));
+    exitCode = 1;
+  } finally {
+    proc.kill();
+  }
+  process.exit(exitCode);
+}
+async function startCommand() {
+  const rawArgs = process.argv.slice(3);
+  const thenIdx = rawArgs.indexOf("--then");
+  const thenCmd = thenIdx !== -1 ? rawArgs[thenIdx + 1] : null;
+  const serverPath = SERVER_ENTRY;
+  if (!existsSync(serverPath)) {
+    error("Server not found. Run: mergen-server setup");
+    process.exit(1);
+  }
+  if (thenCmd) {
+    const mergenHost = process.env.MERGEN_HOST ?? "127.0.0.1";
+    const srv = spawn("node", [serverPath], {
+      stdio: "ignore",
+      detached: true,
+      env: { ...process.env, NODE_ENV: "production" }
+    });
+    srv.unref();
+    process.stdout.write("Starting Mergen server...");
+    let serverPort = 3e3;
+    let ready = false;
+    for (let attempt = 0; attempt < 20 && !ready; attempt++) {
+      await sleep(500);
+      for (let p = 3e3; p <= 3010; p++) {
+        try {
+          const r = await fetch(`http://${mergenHost}:${p}/health`, { signal: AbortSignal.timeout(300) });
+          if (r.ok) {
+            serverPort = p;
+            ready = true;
+            break;
+          }
+        } catch {
+        }
+      }
+    }
+    console.log(ready ? ` ready on :${serverPort}` : " (timeout \u2014 proceeding anyway)");
+    if (ready) {
+      try {
+        const mergenHost2 = process.env.MERGEN_HOST ?? "127.0.0.1";
+        const r = await fetch(`http://${mergenHost2}:${serverPort}/gate/heatmap`, {
+          signal: AbortSignal.timeout(2e3)
+        });
+        if (r.ok) {
+          const heatmap = await r.json();
+          const services = heatmap.services ?? [];
+          if (services.length > 0) {
+            console.log("");
+            console.log("\u2B21 Onboarding snapshot \u2014 what Mergen has observed so far:");
+            for (const svc of services.slice(0, 5)) {
+              const blast = svc.avgBlastScore != null ? ` (avg blast-radius: ${Math.round((svc.avgBlastScore ?? 0) * 100)}%)` : "";
+              console.log(`  \u2022 ${svc.service}: ${svc.calls} gate calls${blast}`);
+            }
+            console.log("  Run: mergen-server shadow-report   for the full picture");
+            console.log("");
+          }
+        }
+      } catch {
+      }
+    }
+    const thenParts = thenCmd.split(/\s+/);
+    const thenProc = spawn(thenParts[0], thenParts.slice(1), { stdio: "inherit" });
+    await new Promise((res) => thenProc.on("exit", () => res()));
+    const fgSrv = spawn("node", [serverPath], { stdio: "inherit", env: { ...process.env, NODE_ENV: "production" } });
+    fgSrv.on("error", (err) => {
+      error(`Server error: ${err.message}`);
+      process.exit(1);
+    });
+    fgSrv.on("exit", (code) => {
+      process.exit(code || 0);
+    });
+    process.on("SIGINT", () => {
+      fgSrv.kill("SIGINT");
+    });
+    return;
+  }
+  log("Starting Mergen server...\n");
+  const server = spawn("node", [serverPath], {
+    stdio: "inherit",
+    env: { ...process.env, NODE_ENV: "production" }
+  });
+  server.on("error", (err) => {
+    error(`Failed to start: ${err.message}`);
+    process.exit(1);
+  });
+  server.on("exit", (code) => {
+    if (code !== 0) {
+      error(`Server exited with code ${code}`);
+    }
+    process.exit(code || 0);
+  });
+  process.on("SIGINT", () => {
+    log("Stopping server...");
+    server.kill("SIGINT");
+  });
+}
+async function detectIDE() {
+  try {
+    execSync("which claude", { stdio: "ignore" });
+    return "claude-code";
+  } catch {
+  }
+  const cursorConfig = resolve(homedir(), ".cursor", "mcp.json");
+  if (existsSync(cursorConfig)) {
+    return "cursor";
+  }
+  try {
+    execSync("which code", { stdio: "ignore" });
+    return "vscode";
+  } catch {
+  }
+  const windsurfConfig = resolve(homedir(), ".codeium", "windsurf", "mcp_config.json");
+  if (existsSync(windsurfConfig)) {
+    return "windsurf";
+  }
+  return "unknown";
+}
+async function configureIDE(ide) {
+  const mcpEntry = {
+    command: "npx",
+    args: ["mergen-server", "start"]
+  };
+  function mergeMcpConfig(configPath) {
+    let existing = {};
+    if (existsSync(configPath)) {
+      try {
+        existing = JSON.parse(readFileSync(configPath, "utf8"));
+      } catch {
+      }
+    }
+    const mcpServers = existing.mcpServers ?? {};
+    mcpServers["mergen"] = mcpEntry;
+    existing.mcpServers = mcpServers;
+    mkdirSync(dirname(configPath), { recursive: true });
+    writeFileSync(configPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+  }
+  switch (ide) {
+    case "claude-code":
+      try {
+        spawnSync("claude", ["mcp", "add", "mergen", "--transport", "stdio", "--", "npx", "mergen-server", "start"], {
+          stdio: "inherit",
+          shell: false
+        });
+      } catch {
+        log("Run manually:", "\u2139");
+        console.log("  claude mcp add mergen --transport stdio -- npx mergen-server start");
+      }
+      installClaudeCodePreToolUseHook();
+      break;
+    case "cursor": {
+      const configPath = resolve(homedir(), ".cursor", "mcp.json");
+      mergeMcpConfig(configPath);
+      log(`Cursor config updated: ${configPath}`);
+      break;
+    }
+    case "vscode": {
+      const configPath = resolve(homedir(), ".vscode", "mcp.json");
+      mergeMcpConfig(configPath);
+      log(`VS Code config updated: ${configPath}`);
+      break;
+    }
+    case "windsurf": {
+      const configPath = resolve(homedir(), ".codeium", "windsurf", "mcp_config.json");
+      mergeMcpConfig(configPath);
+      log(`Windsurf config updated: ${configPath}`);
+      break;
+    }
+    default:
+      log(`Manual setup required for ${ide}`, "\u26A0");
+      console.log(`  Add to your IDE MCP config: { "command": "npx", "args": ["mergen-server", "start"] }`);
+  }
+}
+function installClaudeCodePreToolUseHook(settingsPath = resolve(homedir(), ".claude", "settings.json")) {
+  try {
+    let settings = {};
+    if (existsSync(settingsPath)) {
+      try {
+        settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+      } catch {
+        log(`~/.claude/settings.json exists but is not valid JSON \u2014 skipping automatic hook install. Add it manually (see: mergen-server --help).`, "\u26A0");
+        return;
+      }
+    }
+    const hookCommand = `node "${CLI_ENTRY}" gate-check`;
+    const hooks = settings.hooks ?? {};
+    const preToolUse = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
+    const alreadyInstalled = preToolUse.some((entry) => {
+      const entryHooks = Array.isArray(entry.hooks) ? entry.hooks : [];
+      return entryHooks.some((h) => h.type === "command" && h.command === hookCommand);
+    });
+    if (alreadyInstalled) {
+      log("Claude Code PreToolUse hook already installed.");
+      return;
+    }
+    preToolUse.push({
+      matcher: "Bash",
+      hooks: [{ type: "command", command: hookCommand }]
+    });
+    settings.hooks = { ...hooks, PreToolUse: preToolUse };
+    mkdirSync(dirname(settingsPath), { recursive: true });
+    writeFileSync(settingsPath, JSON.stringify(settings, null, 2), "utf8");
+    log(`Installed a PreToolUse hook for the Bash tool \u2192 ${settingsPath}`);
+    log("This covers Claude Code's Bash tool specifically \u2014 it does not extend MCP gate coverage to other IDEs or raw terminal use outside Claude Code.", "\u2139");
+  } catch (err) {
+    log(`Could not install the Claude Code PreToolUse hook automatically: ${err instanceof Error ? err.message : String(err)}`, "\u26A0");
+  }
+}
+async function checkBinary() {
+  const serverPath = SERVER_ENTRY;
+  if (!existsSync(serverPath)) {
+    throw new Error(`Server not found at ${serverPath}`);
+  }
+}
+async function checkServerStarts() {
+  const serverPath = SERVER_ENTRY;
+  const proc = spawn("node", [serverPath], { stdio: "pipe" });
+  await new Promise((resolve2, reject) => {
+    const timeout = setTimeout(() => {
+      proc.kill();
+      reject(new Error("Server did not start within 5s"));
+    }, 5e3);
+    proc.stderr.on("data", (data) => {
+      if (data.toString().includes("HTTP ingest listening")) {
+        proc.kill();
+        clearTimeout(timeout);
+        resolve2();
+      }
+    });
+    proc.on("error", (err) => {
+      clearTimeout(timeout);
+      reject(err);
+    });
+  });
+}
+async function checkHealth() {
+  const serverPath = SERVER_ENTRY;
+  const proc = spawn("node", [serverPath], { stdio: "pipe" });
+  await sleep(2e3);
+  try {
+    const response = await fetch("http://127.0.0.1:3000/health");
+    if (!response.ok) {
+      throw new Error(`Health check returned ${response.status}`);
+    }
+    const data = await response.json();
+    if (data.status !== "ok") {
+      throw new Error(`Health status: ${data.status}`);
+    }
+  } finally {
+    proc.kill();
+  }
+}
+async function checkIngest() {
+  const serverPath = SERVER_ENTRY;
+  const proc = spawn("node", [serverPath], { stdio: "pipe" });
+  await sleep(2e3);
+  try {
+    const response = await fetch("http://127.0.0.1:3000/ingest", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        type: "console",
+        level: "log",
+        args: ["Mergen test"],
+        url: "http://test",
+        timestamp: Date.now()
+      })
+    });
+    if (!response.ok) {
+      throw new Error(`Ingest returned ${response.status}`);
+    }
+  } finally {
+    proc.kill();
+  }
+}
+async function checkIDEConfig() {
+  const ide = await detectIDE();
+  let configPath;
+  switch (ide) {
+    case "cursor":
+      configPath = resolve(homedir(), ".cursor", "mcp.json");
+      break;
+    case "vscode":
+      configPath = resolve(homedir(), ".vscode", "mcp.json");
+      break;
+    case "windsurf":
+      configPath = resolve(homedir(), ".codeium", "windsurf", "mcp_config.json");
+      break;
+    case "claude-code":
+      try {
+        const output = execSync("claude mcp list", { encoding: "utf8" });
+        if (!output.includes("mergen")) {
+          throw new Error("mergen not in claude mcp list");
+        }
+        return;
+      } catch {
+        throw new Error("Claude Code not configured");
+      }
+    default:
+      throw new Error(`Unknown IDE: ${ide}`);
+  }
+  if (!existsSync(configPath)) {
+    throw new Error(`Config not found: ${configPath}`);
+  }
+  const config = JSON.parse(readFileSync(configPath, "utf8"));
+  if (!config.mcpServers?.mergen) {
+    throw new Error("mergen not in IDE config");
+  }
+}
+async function doctorCommand() {
+  console.log("\u{1FA7A} Mergen Doctor\n");
+  hr();
+  const checks = [];
+  let passed = 0;
+  let warned = 0;
+  let failed = 0;
+  async function runCheck(name, fn) {
+    process.stdout.write(`  ${name}... `);
+    try {
+      const { ok, detail, fix, warn } = await fn();
+      if (ok) {
+        console.log(`\u2713  ${detail}`);
+        passed++;
+      } else if (warn) {
+        console.log(`\u26A0  ${detail}`);
+        if (fix) console.log(`     \u2192 ${fix}`);
+        warned++;
+      } else {
+        console.log(`\u2717  ${detail}`);
+        if (fix) console.log(`     \u2192 ${fix}`);
+        failed++;
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.log(`\u2717  ${msg}`);
+      failed++;
+    }
+  }
+  await runCheck("Node.js version", async () => {
+    const ver = parseInt(process.versions.node.split(".")[0]);
+    return ver >= 18 ? { ok: true, detail: `Node.js ${process.versions.node}` } : { ok: false, detail: `Node.js ${process.versions.node} (need \u226518)`, fix: "Install from https://nodejs.org/" };
+  });
+  await runCheck("Server binary", async () => {
+    const p = SERVER_ENTRY;
+    return existsSync(p) ? { ok: true, detail: p } : { ok: false, detail: "dist/index.js not found", fix: "cd server && npm run build" };
+  });
+  await runCheck("Server health", async () => {
+    for (let port = 3e3; port <= 3010; port++) {
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/health`, { signal: AbortSignal.timeout(1e3) });
+        if (r.ok) {
+          const d = await r.json();
+          return { ok: true, detail: `running on :${port} \u2014 ${d.buffered ?? 0} events buffered, ${d.errors ?? 0} errors` };
+        }
+      } catch {
+      }
+    }
+    return { ok: false, detail: "server not reachable on :3000\u20133010", fix: "mergen-server start" };
+  });
+  await runCheck("IDE configuration", async () => {
+    const ides = [];
+    try {
+      execSync("claude mcp list 2>&1", { encoding: "utf8" }).includes("mergen") && ides.push("Claude Code");
+    } catch {
+    }
+    const cursorCfg = resolve(homedir(), ".cursor", "mcp.json");
+    if (existsSync(cursorCfg)) {
+      try {
+        const c = JSON.parse(readFileSync(cursorCfg, "utf8"));
+        if (c?.mcpServers?.mergen) ides.push("Cursor");
+      } catch {
+      }
+    }
+    const windsurfCfg = resolve(homedir(), ".codeium", "windsurf", "mcp_config.json");
+    if (existsSync(windsurfCfg)) {
+      try {
+        const c = JSON.parse(readFileSync(windsurfCfg, "utf8"));
+        if (c?.mcpServers?.mergen) ides.push("Windsurf");
+      } catch {
+      }
+    }
+    const wsSettings = resolve(homedir(), ".vscode", "settings.json");
+    if (existsSync(wsSettings)) {
+      try {
+        const c = JSON.parse(readFileSync(wsSettings, "utf8"));
+        if (c?.["mcp.servers"]?.mergen) ides.push("VS Code");
+      } catch {
+      }
+    }
+    return ides.length > 0 ? { ok: true, detail: ides.join(", ") } : { ok: false, detail: "no IDE configured", fix: "mergen-server setup" };
+  });
+  await runCheck("Telemetry receiving", async () => {
+    for (let port = 3e3; port <= 3010; port++) {
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/health`, { signal: AbortSignal.timeout(800) });
+        if (!r.ok) continue;
+        const d = await r.json();
+        const lastMs = d.lastEventAt;
+        if (lastMs && Date.now() - lastMs < 24 * 60 * 60 * 1e3) {
+          return { ok: true, detail: `${d.buffered ?? 0} events buffered \u2014 last received ${Math.round((Date.now() - lastMs) / 1e3)}s ago` };
+        }
+        return { ok: false, warn: true, detail: "no telemetry in the last 24h", fix: "point your OTLP exporter at http://127.0.0.1:3000 \u2014 or run: mergen-server demo" };
+      } catch {
+      }
+    }
+    return { ok: false, warn: true, detail: "server not reachable \u2014 skipping telemetry check", fix: "start the server first" };
+  });
+  await runCheck("Slack integration", async () => {
+    const token = process.env.MERGEN_SLACK_BOT_TOKEN;
+    const channel = process.env.MERGEN_SLACK_CHANNEL;
+    if (!token) return { ok: false, warn: true, detail: "MERGEN_SLACK_BOT_TOKEN not set", fix: "set MERGEN_SLACK_BOT_TOKEN=xoxb-... for autonomous incident thread replies" };
+    if (!channel) return { ok: false, warn: true, detail: "MERGEN_SLACK_CHANNEL not set", fix: "set MERGEN_SLACK_CHANNEL=#incidents" };
+    try {
+      const r = await fetch("https://slack.com/api/auth.test", {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+        signal: AbortSignal.timeout(3e3)
+      });
+      const d = await r.json();
+      return d.ok ? { ok: true, detail: `connected \u2014 workspace: ${d.team ?? "unknown"}, channel: ${channel}` } : { ok: false, warn: true, detail: `Slack auth failed: ${d.error}`, fix: "check MERGEN_SLACK_BOT_TOKEN \u2014 needs chat:write scope" };
+    } catch {
+      return { ok: false, warn: true, detail: "could not reach Slack API", fix: "check network connectivity" };
+    }
+  });
+  await runCheck("PagerDuty webhook", async () => {
+    for (let port = 3e3; port <= 3010; port++) {
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/health`, { signal: AbortSignal.timeout(800) });
+        if (r.ok) {
+          return { ok: true, warn: true, detail: `webhook URL: http://your-server:${port}/webhooks/pagerduty`, fix: "copy this URL into PagerDuty: Services \u2192 Integrations \u2192 Webhooks" };
+        }
+      } catch {
+      }
+    }
+    return { ok: false, warn: true, detail: "server not reachable", fix: "start the server first" };
+  });
+  await runCheck("Autopilot", async () => {
+    const enabled = process.env.MERGEN_AUTOPILOT === "true";
+    return enabled ? { ok: true, detail: "MERGEN_AUTOPILOT=true \u2014 autonomous execution enabled at \u226585% confidence" } : { ok: false, warn: true, detail: "MERGEN_AUTOPILOT not set \u2014 diagnosis-only mode", fix: "set MERGEN_AUTOPILOT=true to enable autonomous fix execution" };
+  });
+  console.log("\n\u2500\u2500 Optional integrations \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  await runCheck("GitHub token", async () => {
+    const token = process.env.GITHUB_TOKEN;
+    if (!token) return { ok: false, warn: true, detail: "GITHUB_TOKEN not set", fix: "export GITHUB_TOKEN=ghp_...  # required for PR commenting and backfill" };
+    try {
+      const r = await fetch("https://api.github.com/user", {
+        headers: { Authorization: `Bearer ${token}`, "User-Agent": "mergen-doctor" },
+        signal: AbortSignal.timeout(3e3)
+      });
+      const d = await r.json();
+      return r.ok ? { ok: true, detail: `connected \u2014 user: ${d.login ?? "unknown"}` } : { ok: false, warn: true, detail: `GitHub auth failed: ${d.message ?? r.status}`, fix: "check GITHUB_TOKEN at https://github.com/settings/tokens" };
+    } catch {
+      return { ok: false, warn: true, detail: "could not reach GitHub API", fix: "check network connectivity" };
+    }
+  });
+  await runCheck("GitHub webhook secret", async () => {
+    const secret = process.env.GITHUB_WEBHOOK_SECRET;
+    if (!secret) return { ok: false, warn: true, detail: "GITHUB_WEBHOOK_SECRET not set \u2014 PR/push events unauthenticated", fix: "run: mergen-server connect github --repo <owner/repo>" };
+    return { ok: true, detail: "GITHUB_WEBHOOK_SECRET set \u2014 signature verification enabled" };
+  });
+  await runCheck("Datadog", async () => {
+    const apiKey = process.env.DD_API_KEY;
+    const appKey = process.env.DD_APP_KEY;
+    if (!apiKey) return { ok: false, warn: true, detail: "DD_API_KEY not set", fix: "export DD_API_KEY=...  # from https://app.datadoghq.com/organization-settings/api-keys" };
+    if (!appKey) return { ok: false, warn: true, detail: "DD_APP_KEY not set", fix: "export DD_APP_KEY=...  # from https://app.datadoghq.com/organization-settings/application-keys" };
+    const site = process.env.DATADOG_SITE ?? "datadoghq.com";
+    try {
+      const r = await fetch(`https://api.${site}/api/v1/validate`, {
+        headers: { "DD-API-KEY": apiKey, "DD-APPLICATION-KEY": appKey },
+        signal: AbortSignal.timeout(4e3)
+      });
+      return r.ok ? { ok: true, detail: `connected \u2014 site: ${site}` } : { ok: false, warn: true, detail: `Datadog auth failed (${r.status})`, fix: "check DD_API_KEY and DD_APP_KEY \u2014 run: mergen-server init" };
+    } catch {
+      return { ok: false, warn: true, detail: `could not reach api.${site}`, fix: "check network connectivity" };
+    }
+  });
+  await runCheck("Linear", async () => {
+    const apiKey = process.env.LINEAR_API_KEY;
+    const teamId = process.env.LINEAR_TEAM_ID;
+    if (!apiKey) return { ok: false, warn: true, detail: "LINEAR_API_KEY not set", fix: "export LINEAR_API_KEY=lin_api_...  # from https://linear.app/settings/api" };
+    if (!teamId) return { ok: false, warn: true, detail: "LINEAR_TEAM_ID not set", fix: "export LINEAR_TEAM_ID=<team-id>  # from https://linear.app/settings/api" };
+    return { ok: true, detail: `LINEAR_API_KEY set, team: ${teamId}` };
+  });
+  await runCheck("Jira", async () => {
+    const baseUrl = process.env.JIRA_BASE_URL;
+    const email = process.env.JIRA_EMAIL;
+    const token = process.env.JIRA_API_TOKEN;
+    const projKey = process.env.JIRA_PROJECT_KEY;
+    if (!baseUrl) return { ok: false, warn: true, detail: "JIRA_BASE_URL not set", fix: "export JIRA_BASE_URL=https://yourco.atlassian.net" };
+    if (!email) return { ok: false, warn: true, detail: "JIRA_EMAIL not set", fix: "export JIRA_EMAIL=you@company.com" };
+    if (!token) return { ok: false, warn: true, detail: "JIRA_API_TOKEN not set", fix: "create a token at https://id.atlassian.com/manage-profile/security/api-tokens" };
+    return projKey ? { ok: true, detail: `${baseUrl} \xB7 project: ${projKey}` } : { ok: false, warn: true, detail: "JIRA_PROJECT_KEY not set", fix: "export JIRA_PROJECT_KEY=ENG  # default project; can be overridden per request" };
+  });
+  await runCheck("Sentry webhook", async () => {
+    const secret = process.env.MERGEN_SENTRY_SECRET;
+    if (!secret) return { ok: false, warn: true, detail: "MERGEN_SENTRY_SECRET not set \u2014 Sentry webhooks unauthenticated", fix: "export MERGEN_SENTRY_SECRET=...  # from your Sentry webhook config" };
+    return { ok: true, detail: "MERGEN_SENTRY_SECRET set \u2014 signature verification enabled" };
+  });
+  await runCheck("Execution sandbox", async () => {
+    const backend = process.env.MERGEN_SANDBOX;
+    if (backend !== "docker" && backend !== "seatbelt") {
+      const hint = process.platform === "darwin" ? "export MERGEN_SANDBOX=seatbelt  # native macOS sandbox, near-zero overhead" : "export MERGEN_SANDBOX=docker    # or MERGEN_EBPF_VERIFY=true on Linux";
+      return { ok: false, warn: true, detail: "MERGEN_SANDBOX not set \u2014 mergen-server exec runs unsandboxed on the host", fix: hint };
+    }
+    const { isDockerAvailable, isDockerRuntimeAvailable, isMacSandboxAvailable } = await import("../intelligence/sandbox.js");
+    if (backend === "docker") {
+      const available2 = await isDockerAvailable();
+      if (!available2) return { ok: false, warn: true, detail: "MERGEN_SANDBOX=docker but Docker is not reachable \u2014 exec falls back to unsandboxed", fix: "start Docker Desktop" };
+      const runtime = process.env.MERGEN_SANDBOX_DOCKER_RUNTIME;
+      if (runtime) {
+        const runtimeOk = await isDockerRuntimeAvailable(runtime);
+        return runtimeOk ? { ok: true, detail: `MERGEN_SANDBOX=docker \u2014 daemon reachable, runtime '${runtime}' registered` } : { ok: false, warn: true, detail: `MERGEN_SANDBOX_DOCKER_RUNTIME=${runtime} not registered with this daemon \u2014 falling back to runc`, fix: `install ${runtime} and register it as a Docker runtime` };
+      }
+      return { ok: true, detail: "MERGEN_SANDBOX=docker \u2014 daemon reachable (default runc runtime)" };
+    }
+    if (process.platform !== "darwin") {
+      return { ok: false, warn: true, detail: "MERGEN_SANDBOX=seatbelt set but this is not macOS \u2014 exec falls back to unsandboxed", fix: "unset MERGEN_SANDBOX or set MERGEN_SANDBOX=docker" };
+    }
+    const available = await isMacSandboxAvailable();
+    return available ? { ok: true, detail: "MERGEN_SANDBOX=seatbelt \u2014 sandbox-exec available" } : { ok: false, warn: true, detail: "MERGEN_SANDBOX=seatbelt but sandbox-exec is not usable on this machine \u2014 exec falls back to unsandboxed", fix: "check that /usr/bin/sandbox-exec exists and is not blocked by MDM policy" };
+  });
+  await runCheck("Redis persistence", async () => {
+    const url = process.env.MERGEN_REDIS_URL;
+    if (!url) return { ok: false, warn: true, detail: "MERGEN_REDIS_URL not set \u2014 ring buffer lost on restart", fix: "export MERGEN_REDIS_URL=redis://localhost:6379  # optional but recommended for production" };
+    return { ok: true, detail: `MERGEN_REDIS_URL set \u2014 buffer persisted at ${url}` };
+  });
+  await runCheck("Docker containers", async () => {
+    try {
+      const { execSync: exec2 } = await import("child_process");
+      const raw = exec2('docker ps --format "{{.Names}}" 2>/dev/null', { encoding: "utf8", timeout: 3e3 });
+      const names = raw.split("\n").map((s) => s.trim()).filter(Boolean);
+      if (names.length === 0) {
+        return { ok: false, warn: true, detail: "Docker running but no containers found", fix: "Start your app containers, then stream logs: curl -X POST http://127.0.0.1:3000/watchers/docker" };
+      }
+      const label = names.slice(0, 3).join(", ") + (names.length > 3 ? ` +${names.length - 3} more` : "");
+      return {
+        ok: false,
+        warn: true,
+        detail: `${names.length} container(s) running (${label}) \u2014 not yet streaming to Mergen`,
+        fix: `Activate log streaming: curl -X POST http://127.0.0.1:3000/watchers/docker`
+      };
+    } catch {
+      return { ok: false, warn: true, detail: "Docker not detected (not installed or not running)", fix: "Install Docker if you use containers \u2014 streaming logs gives Mergen live backend context" };
+    }
+  });
+  hr();
+  const total = passed + warned + failed;
+  if (failed === 0 && warned === 0) {
+    success(`All ${total} checks passed \u2014 Mergen is healthy \u2728`);
+  } else if (failed === 0) {
+    console.log(`
+${passed}/${total} passed, ${warned} warning(s) \u2014 Mergen is functional`);
+  } else {
+    console.log(`
+${passed}/${total} passed, ${failed} failure(s)`);
+    console.log("\nRun: mergen-server setup   to reconfigure");
+    process.exit(1);
+  }
+}
+async function quickstartCommand() {
+  console.log("\n\u2B21 Mergen \u2014 Quick Start\n");
+  hr();
+  log("From zero to your first real insight. Under 2 minutes.");
+  console.log("");
+  const cmd = (await ask("What command starts your app? (e.g. npm start, python app.py): ")).trim();
+  if (!cmd) {
+    error("No command provided.");
+    process.exit(1);
+  }
+  const mergenHost = process.env.MERGEN_HOST ?? "127.0.0.1";
+  let serverPort = 3e3;
+  let serverFound = false;
+  for (let p = 3e3; p <= 3010; p++) {
+    try {
+      const r = await fetch(`http://${mergenHost}:${p}/health`, { signal: AbortSignal.timeout(500) });
+      if (r.ok) {
+        serverPort = p;
+        serverFound = true;
+        break;
+      }
+    } catch {
+    }
+  }
+  if (!serverFound) {
+    const serverPath = SERVER_ENTRY;
+    if (existsSync(serverPath)) {
+      process.stdout.write("\nStarting Mergen server...");
+      const { spawn: spawnSrv } = await import("child_process");
+      const srv = spawnSrv("node", [serverPath], {
+        stdio: "ignore",
+        detached: true,
+        env: { ...process.env, NODE_ENV: "production" }
+      });
+      srv.unref();
+      for (let attempt = 0; attempt < 16 && !serverFound; attempt++) {
+        await sleep(500);
+        for (let p = 3e3; p <= 3010; p++) {
+          try {
+            const r = await fetch(`http://${mergenHost}:${p}/health`, { signal: AbortSignal.timeout(300) });
+            if (r.ok) {
+              serverPort = p;
+              serverFound = true;
+              break;
+            }
+          } catch {
+          }
+        }
+      }
+      console.log(serverFound ? ` \u2713  :${serverPort}` : " \u2717");
+    }
+  } else {
+    success(`Server already running on :${serverPort}`);
+  }
+  const ide = await detectIDE().catch(() => null);
+  if (ide) {
+    console.log("");
+    const doIde = await ask(`Add Mergen to ${ide}? Your AI IDE will see live errors without copy-paste. (y/n): `);
+    if (doIde.toLowerCase() === "y") {
+      await configureIDE(ide).catch(() => {
+      });
+      success(`${ide} configured \u2014 restart your IDE for the MCP tools to appear`);
+    }
+  }
+  hr();
+  console.log(`
+Starting: ${cmd}`);
+  const div = "\u2500".repeat(58);
+  console.log(div);
+  log("Mergen is watching. Trigger an error in your app.");
+  log("When it appears, Mergen will analyze it inline \u2014 no IDE needed.");
+  log("Press Ctrl+C when done.\n");
+  const parts = cmd.split(/\s+/);
+  await watchCommand(["watch", ...parts]);
+}
+export {
+  checkBinary,
+  checkHealth,
+  checkIDEConfig,
+  checkIngest,
+  checkServerStarts,
+  ciCommand,
+  configureIDE,
+  detectIDE,
+  doctorCommand,
+  installClaudeCodePreToolUseHook,
+  loginCommand,
+  quickstartCommand,
+  seedBuiltinRunbooks,
+  setupCommand,
+  startCommand,
+  testCommand
+};