mergen-server 1.4.0

package/dist/intelligence/behavior-baseline.js

@@ -0,0 +1,134 @@
+import { registerGovernanceHook, clearGovernanceHooks } from "./agent-pipeline.js";
+import { getStores } from "../storage/store-registry.js";
+import logger from "../sensor/logger.js";
+const AGENT_HISTORY_LIMIT = 500;
+const _baselines = /* @__PURE__ */ new Map();
+let _gateEventCount = 0;
+const BASELINE_RECOMPUTE_EVERY = 50;
+function _buildBaseline(agentId, events) {
+  const agentEvents = events.filter((e) => e.agentId === agentId);
+  if (agentEvents.length < 5) {
+    return {
+      agentId,
+      avgCallsPerMin: 0,
+      blockRate: 0,
+      toolDistribution: {},
+      sampleCount: agentEvents.length,
+      computedAt: Date.now()
+    };
+  }
+  const blocks = agentEvents.filter((e) => e.verdict === "block").length;
+  const blockRate = blocks / agentEvents.length;
+  const span = agentEvents[agentEvents.length - 1].ts - agentEvents[0].ts;
+  const avgCallsPerMin = span > 0 ? agentEvents.length / (span / 6e4) : 0;
+  const toolCounts = {};
+  for (const e of agentEvents) {
+    toolCounts[e.toolName] = (toolCounts[e.toolName] ?? 0) + 1;
+  }
+  const toolDistribution = {};
+  for (const [tool, count] of Object.entries(toolCounts)) {
+    toolDistribution[tool] = count / agentEvents.length;
+  }
+  return { agentId, avgCallsPerMin, blockRate, toolDistribution, sampleCount: agentEvents.length, computedAt: Date.now() };
+}
+function detectAnomaly(agentId, recentEvents) {
+  const agentEvents = recentEvents.filter((e) => e.agentId === agentId);
+  if (agentEvents.length < 5) return { anomaly: false, severity: "low", reason: "insufficient data" };
+  const baseline = _baselines.get(agentId);
+  const last10 = agentEvents.slice(-10);
+  const recentBlocks = last10.filter((e) => e.verdict === "block").length;
+  if (recentBlocks > 5) {
+    return {
+      anomaly: true,
+      severity: "high",
+      reason: `Block rate spike: ${recentBlocks}/10 recent calls blocked (baseline: ${baseline ? (baseline.blockRate * 100).toFixed(0) : "?"}%)`
+    };
+  }
+  if (baseline && baseline.sampleCount >= 10) {
+    const last5min = agentEvents.filter((e) => e.ts > Date.now() - 5 * 6e4);
+    const currentRate = last5min.length / 5;
+    if (baseline.avgCallsPerMin > 0 && currentRate > baseline.avgCallsPerMin * 3) {
+      return {
+        anomaly: true,
+        severity: "medium",
+        reason: `Call rate spike: ${currentRate.toFixed(1)}/min vs baseline ${baseline.avgCallsPerMin.toFixed(1)}/min`
+      };
+    }
+    const recentTools = {};
+    for (const e of agentEvents.slice(-20)) {
+      recentTools[e.toolName] = (recentTools[e.toolName] ?? 0) + 1;
+    }
+    for (const [tool, count] of Object.entries(recentTools)) {
+      if (count > 3 && !(tool in baseline.toolDistribution)) {
+        return {
+          anomaly: true,
+          severity: "low",
+          reason: `Unseen tool \`${tool}\` called ${count} times \u2014 not in baseline distribution`
+        };
+      }
+    }
+  }
+  return { anomaly: false, severity: "low", reason: "" };
+}
+async function onGateEvent(agentId, events) {
+  if (!agentId || agentId === "agent") return;
+  _gateEventCount++;
+  if (_gateEventCount % BASELINE_RECOMPUTE_EVERY !== 0) return;
+  const durable = await _loadAgentHistory(agentId);
+  const source = durable.length >= 5 ? durable : events;
+  const baseline = _buildBaseline(agentId, source);
+  _baselines.set(agentId, baseline);
+  const report = detectAnomaly(agentId, source);
+  if (!report.anomaly) return;
+  logger.warn({ agentId, severity: report.severity, reason: report.reason }, "behavior-baseline: anomaly detected");
+  if (report.severity === "high") {
+    const capturedReason = report.reason;
+    registerGovernanceHook(async (_ctx) => {
+      clearGovernanceHooks();
+      return { verdict: "block", reason: `Anomaly block: ${capturedReason}` };
+    });
+    logger.warn({ agentId }, "behavior-baseline: high-severity anomaly \u2014 one-shot governance hook registered");
+  }
+}
+async function _loadAgentHistory(agentId) {
+  try {
+    const rows = await getStores().actionLedger.query({ agentId, limit: AGENT_HISTORY_LIMIT });
+    return rows.map((r) => ({ agentId: r.agentId, verdict: r.verdict, ts: r.ts, toolName: r.tool })).reverse();
+  } catch {
+    return [];
+  }
+}
+async function persistBaseline(agentId, baseline) {
+  try {
+    const { agentContextStore } = await import("../sensor/agent-context-store.js");
+    agentContextStore.store(agentId, "baseline_v1", JSON.stringify(baseline), 0);
+  } catch {
+  }
+}
+async function hydrateBaseline(agentId) {
+  if (!agentId || _baselines.has(agentId)) return;
+  try {
+    const { agentContextStore } = await import("../sensor/agent-context-store.js");
+    const entries = agentContextStore.recall(agentId, "baseline_v1", 1);
+    if (entries.length > 0) {
+      const b = JSON.parse(entries[0].value);
+      _baselines.set(agentId, b);
+    }
+  } catch {
+  }
+}
+function getBaseline(agentId) {
+  return _baselines.get(agentId) ?? null;
+}
+function _resetBaselinesForTesting() {
+  _baselines.clear();
+  _gateEventCount = 0;
+}
+export {
+  _resetBaselinesForTesting,
+  detectAnomaly,
+  getBaseline,
+  hydrateBaseline,
+  onGateEvent,
+  persistBaseline
+};

package/dist/intelligence/billing.js

@@ -0,0 +1 @@
+export * from '../__stubs__/closed-source.js';

package/dist/intelligence/blast-radius.js

@@ -0,0 +1,224 @@
+import { deriveRollback } from "./rollback.js";
+const RULES = [
+  // kubectl rollout restart deploy/<name>
+  {
+    pattern: /kubectl\s+rollout\s+restart\s+(?:deploy(?:ment)?\/(\S+)|deploy(?:ment)?\s+(\S+))/i,
+    scope: "deployment",
+    estimatedDowntimeMs: 3e4,
+    reversible: true,
+    rollbackLatencyMs: 6e4,
+    dataAtRisk: false,
+    modelConfidence: "high",
+    extractResources: (m) => [`deploy/${m[1] ?? m[2] ?? "unknown"}`]
+  },
+  // kubectl set image deploy/<name>
+  {
+    pattern: /kubectl\s+set\s+image\s+(?:deploy(?:ment)?\/(\S+)|deploy(?:ment)?\s+(\S+))/i,
+    scope: "deployment",
+    estimatedDowntimeMs: 3e4,
+    reversible: true,
+    rollbackLatencyMs: 6e4,
+    dataAtRisk: false,
+    modelConfidence: "high",
+    extractResources: (m) => [`deploy/${m[1] ?? m[2] ?? "unknown"}`]
+  },
+  // kubectl set env deploy/<name>
+  {
+    pattern: /kubectl\s+set\s+env\s+(?:deploy(?:ment)?\/(\S+)|deploy(?:ment)?\s+(\S+))/i,
+    scope: "config-change",
+    estimatedDowntimeMs: 3e4,
+    reversible: true,
+    rollbackLatencyMs: 6e4,
+    dataAtRisk: false,
+    modelConfidence: "high",
+    extractResources: (m) => [`deploy/${m[1] ?? m[2] ?? "unknown"}`]
+  },
+  // kubectl delete deployment/<name>
+  {
+    pattern: /kubectl\s+delete\s+deploy(?:ment)?(?:\/(\S+)|\s+(\S+))/i,
+    scope: "deployment",
+    estimatedDowntimeMs: null,
+    reversible: false,
+    rollbackLatencyMs: null,
+    dataAtRisk: false,
+    modelConfidence: "high",
+    extractResources: (m) => [`deploy/${m[1] ?? m[2] ?? "unknown"}`]
+  },
+  // kubectl delete pod
+  {
+    pattern: /kubectl\s+delete\s+pod/i,
+    scope: "pod",
+    estimatedDowntimeMs: 5e3,
+    reversible: true,
+    rollbackLatencyMs: 1e4,
+    dataAtRisk: false,
+    modelConfidence: "high"
+  },
+  // helm upgrade <release>
+  {
+    pattern: /helm\s+upgrade\s+(\S+)/i,
+    scope: "deployment",
+    estimatedDowntimeMs: 6e4,
+    reversible: true,
+    rollbackLatencyMs: 12e4,
+    dataAtRisk: false,
+    modelConfidence: "high",
+    extractResources: (m) => [`helm-release/${m[1]}`]
+  },
+  // helm rollback <release>
+  {
+    pattern: /helm\s+rollback\s+(\S+)/i,
+    scope: "deployment",
+    estimatedDowntimeMs: 3e4,
+    reversible: true,
+    rollbackLatencyMs: 6e4,
+    dataAtRisk: false,
+    modelConfidence: "high",
+    extractResources: (m) => [`helm-release/${m[1]}`]
+  },
+  // npm install pkg@ver
+  {
+    pattern: /npm\s+install\s+(\S+@\S+)/i,
+    scope: "config-change",
+    estimatedDowntimeMs: 12e4,
+    reversible: true,
+    rollbackLatencyMs: 3e5,
+    dataAtRisk: false,
+    modelConfidence: "medium",
+    extractResources: (m) => [`npm:${m[1]}`]
+  },
+  // pip install pkg==ver
+  {
+    pattern: /pip\s+install\s+(\S+==[^\s]+)/i,
+    scope: "config-change",
+    estimatedDowntimeMs: 12e4,
+    reversible: true,
+    rollbackLatencyMs: 3e5,
+    dataAtRisk: false,
+    modelConfidence: "medium",
+    extractResources: (m) => [`pip:${m[1]}`]
+  },
+  // yarn add pkg@ver
+  {
+    pattern: /yarn\s+add\s+(\S+@\S+)/i,
+    scope: "config-change",
+    estimatedDowntimeMs: 12e4,
+    reversible: true,
+    rollbackLatencyMs: 3e5,
+    dataAtRisk: false,
+    modelConfidence: "medium",
+    extractResources: (m) => [`yarn:${m[1]}`]
+  },
+  // pm2 / systemctl / service restart
+  {
+    pattern: /(?:pm2\s+(?:restart|reload)\s+(\S+)|systemctl\s+(?:restart|reload)\s+(\S+)|service\s+(\S+)\s+(?:restart|reload))/i,
+    scope: "pod",
+    estimatedDowntimeMs: 5e3,
+    reversible: true,
+    rollbackLatencyMs: 1e4,
+    dataAtRisk: false,
+    modelConfidence: "high",
+    extractResources: (m) => [`service/${m[1] ?? m[2] ?? m[3] ?? "unknown"}`]
+  },
+  // docker restart <container>
+  {
+    pattern: /docker\s+restart\s+(\S+)/i,
+    scope: "pod",
+    estimatedDowntimeMs: 5e3,
+    reversible: true,
+    rollbackLatencyMs: 1e4,
+    dataAtRisk: false,
+    modelConfidence: "high",
+    extractResources: (m) => [`container/${m[1]}`]
+  },
+  // SQL DROP / TRUNCATE
+  {
+    pattern: /(?:DROP\s+(?:TABLE|DATABASE)|TRUNCATE(?:\s+TABLE)?)\s+(\S+)?/i,
+    scope: "data-destructive",
+    estimatedDowntimeMs: 0,
+    reversible: false,
+    rollbackLatencyMs: null,
+    dataAtRisk: true,
+    modelConfidence: "high",
+    extractResources: (m) => m[1] ? [`table/${m[1]}`] : []
+  },
+  // SQL UPDATE / INSERT
+  {
+    pattern: /(?:UPDATE|INSERT\s+INTO)\s+(\S+)/i,
+    scope: "data-write",
+    estimatedDowntimeMs: 0,
+    reversible: true,
+    rollbackLatencyMs: null,
+    dataAtRisk: true,
+    modelConfidence: "medium",
+    extractResources: (m) => [`table/${m[1]}`]
+  }
+];
+function buildSummary(scope, estimatedDowntimeMs, reversible, dataAtRisk) {
+  const dt = estimatedDowntimeMs !== null ? `~${Math.round(estimatedDowntimeMs / 1e3)}s downtime` : "unpredictable downtime";
+  const rev = reversible ? "reversible" : "irreversible";
+  const data = dataAtRisk ? ", data at risk" : "";
+  return `${scope} scope, ${dt}, ${rev}${data}.`;
+}
+function computeBlastRadius(command, context) {
+  for (const rule of RULES) {
+    const match = command.match(rule.pattern);
+    if (!match) continue;
+    const resources = rule.extractResources ? rule.extractResources(match) : [];
+    if (resources.length === 0 && context?.service) resources.push(context.service);
+    const rollbackStrategy2 = deriveRollback(command, "");
+    const rollbackCommand2 = rollbackStrategy2.type === "command" ? rollbackStrategy2.command : null;
+    return {
+      command,
+      scope: rule.scope,
+      affectedResources: resources,
+      estimatedDowntimeMs: rule.estimatedDowntimeMs,
+      reversible: rule.reversible,
+      rollbackCommand: rollbackCommand2,
+      rollbackLatencyMs: rule.rollbackLatencyMs,
+      dataAtRisk: rule.dataAtRisk,
+      modelConfidence: rule.modelConfidence,
+      summary: buildSummary(rule.scope, rule.estimatedDowntimeMs, rule.reversible, rule.dataAtRisk)
+    };
+  }
+  const rollbackStrategy = deriveRollback(command, "");
+  const rollbackCommand = rollbackStrategy.type === "command" ? rollbackStrategy.command : null;
+  return {
+    command,
+    scope: "unknown",
+    affectedResources: context?.service ? [context.service] : [],
+    estimatedDowntimeMs: null,
+    reversible: rollbackCommand !== null,
+    rollbackCommand,
+    rollbackLatencyMs: null,
+    dataAtRisk: false,
+    modelConfidence: "low",
+    summary: buildSummary("unknown", null, rollbackCommand !== null, false)
+  };
+}
+const _SCOPE_SEVERITY = [
+  "unknown",
+  "pod",
+  "deployment",
+  "config-change",
+  "namespace",
+  "data-write",
+  "cluster",
+  "data-destructive"
+];
+function mostSevereBlast(blasts) {
+  if (blasts.length === 0) throw new Error("mostSevereBlast: empty array");
+  return blasts.reduce((worst, current) => {
+    if (!current.reversible && worst.reversible) return current;
+    if (current.reversible && !worst.reversible) return worst;
+    if (current.dataAtRisk && !worst.dataAtRisk) return current;
+    if (!current.dataAtRisk && worst.dataAtRisk) return worst;
+    const cs = _SCOPE_SEVERITY.indexOf(current.scope);
+    const ws = _SCOPE_SEVERITY.indexOf(worst.scope);
+    return cs > ws ? current : worst;
+  });
+}
+export {
+  computeBlastRadius,
+  mostSevereBlast
+};

package/dist/intelligence/bypass.js

@@ -0,0 +1,157 @@
+import { randomBytes, createHmac, timingSafeEqual } from "crypto";
+import fs from "fs";
+import { recordHitlDecision } from "./gate-analytics.js";
+import { BYPASS_PENDING_FILE, DATA_DIR, zeroRetentionMode } from "../sensor/paths.js";
+import logger from "../sensor/logger.js";
+let _bypassSigningSecret = "";
+function setBypassSecret(secret) {
+  _bypassSigningSecret = secret;
+}
+function _signBypassPayload(payload) {
+  if (!_bypassSigningSecret) return "";
+  return createHmac("sha256", _bypassSigningSecret).update(payload).digest("hex");
+}
+const _pendingBypasses = /* @__PURE__ */ new Map();
+function normalizeCommand(cmd) {
+  if (typeof cmd !== "string") return "";
+  return cmd.trim().replace(/\s+/g, " ");
+}
+function registerBypassBlock(toolName, commandArg, triggeredRules = []) {
+  const normalizedCmd = normalizeCommand(commandArg);
+  const now = Date.now();
+  for (const [token2, b] of _pendingBypasses.entries()) {
+    if (now > b.expiresAt) _pendingBypasses.delete(token2);
+  }
+  for (const [token2, b] of _pendingBypasses.entries()) {
+    if (b.toolName === toolName && b.commandArg === normalizedCmd && !b.approved) {
+      return token2;
+    }
+  }
+  let token;
+  do {
+    token = randomBytes(16).toString("hex");
+  } while (_pendingBypasses.has(token));
+  _pendingBypasses.set(token, {
+    token,
+    toolName,
+    commandArg: normalizedCmd,
+    triggeredRules,
+    registeredAt: now,
+    approved: false,
+    expiresAt: now + 10 * 60 * 1e3
+    // 10 minutes
+  });
+  return token;
+}
+function approveBypass(token) {
+  const b = _pendingBypasses.get(token);
+  if (!b || Date.now() > b.expiresAt) return { ok: false };
+  b.approved = true;
+  recordHitlDecision(b.triggeredRules, "approve", b.registeredAt);
+  return { ok: true, toolName: b.toolName, commandArg: b.commandArg };
+}
+function checkAndConsumeBypass(toolName, commandArg) {
+  const normalizedCmd = normalizeCommand(commandArg);
+  const now = Date.now();
+  for (const [token, b] of _pendingBypasses.entries()) {
+    if (now > b.expiresAt) {
+      _pendingBypasses.delete(token);
+      continue;
+    }
+    if (b.toolName === toolName && b.commandArg === normalizedCmd && b.approved) {
+      _pendingBypasses.delete(token);
+      return true;
+    }
+  }
+  return false;
+}
+function getPendingBypasses() {
+  const now = Date.now();
+  const list = [];
+  for (const [token, b] of _pendingBypasses.entries()) {
+    if (now > b.expiresAt) {
+      _pendingBypasses.delete(token);
+      continue;
+    }
+    if (!b.approved) {
+      list.push({
+        token: b.token,
+        toolName: b.toolName,
+        commandArg: b.commandArg,
+        expiresAt: b.expiresAt
+      });
+    }
+  }
+  return list;
+}
+function getPendingBypassDetail(token) {
+  const b = _pendingBypasses.get(token);
+  if (!b || Date.now() > b.expiresAt) return null;
+  return b;
+}
+function invalidateBypassToken(token) {
+  _pendingBypasses.delete(token);
+}
+function persistBypasses() {
+  if (zeroRetentionMode()) return;
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    const now = Date.now();
+    const active = [..._pendingBypasses.values()].filter((b) => b.expiresAt > now);
+    const payload = JSON.stringify({ version: 1, bypasses: active });
+    const sig = _signBypassPayload(payload);
+    const final = sig ? JSON.stringify({ version: 1, bypasses: active, sig }) : payload;
+    const tmp = `${BYPASS_PENDING_FILE}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, final, { encoding: "utf8", mode: 384 });
+    fs.renameSync(tmp, BYPASS_PENDING_FILE);
+  } catch (err) {
+    logger.warn({ err }, "tool-guard: bypass persist failed");
+  }
+}
+function loadBypasses() {
+  if (zeroRetentionMode() || !fs.existsSync(BYPASS_PENDING_FILE)) return;
+  try {
+    const fileContent = fs.readFileSync(BYPASS_PENDING_FILE, "utf8");
+    const raw = JSON.parse(fileContent);
+    if (raw?.version !== 1 || !Array.isArray(raw.bypasses)) return;
+    if (_bypassSigningSecret && raw.sig !== void 0) {
+      const { sig, ...rest } = raw;
+      const expectedPayload = JSON.stringify(rest);
+      const expected = _signBypassPayload(expectedPayload);
+      const sigBuf = Buffer.from(sig, "hex");
+      const expectedBuf = Buffer.from(expected, "hex");
+      const valid = sigBuf.length === expectedBuf.length && timingSafeEqual(sigBuf, expectedBuf);
+      if (!valid) {
+        logger.error(
+          { path: BYPASS_PENDING_FILE },
+          "tool-guard: bypass file HMAC mismatch \u2014 file may have been tampered with. Discarding."
+        );
+        try {
+          fs.unlinkSync(BYPASS_PENDING_FILE);
+        } catch {
+        }
+        return;
+      }
+    } else if (_bypassSigningSecret && raw.sig === void 0) {
+      logger.warn({ path: BYPASS_PENDING_FILE }, "tool-guard: bypass file has no signature \u2014 accepting once and re-signing");
+    }
+    const now = Date.now();
+    for (const b of raw.bypasses) {
+      if (b.expiresAt > now) _pendingBypasses.set(b.token, b);
+    }
+    if (_pendingBypasses.size > 0) logger.info({ count: _pendingBypasses.size }, "tool-guard: restored pending bypass tokens");
+  } catch (err) {
+    logger.warn({ err }, "tool-guard: bypass load failed");
+  }
+}
+export {
+  approveBypass,
+  checkAndConsumeBypass,
+  getPendingBypassDetail,
+  getPendingBypasses,
+  invalidateBypassToken,
+  loadBypasses,
+  persistBypasses,
+  registerBypassBlock,
+  setBypassSecret
+};

package/dist/intelligence/calibration-classifier.js

@@ -0,0 +1,77 @@
+const LEARNING_RATE = 0.05;
+const L2_LAMBDA = 1e-3;
+const BIAS_IDX = 4;
+function sigmoid(z) {
+  return 1 / (1 + Math.exp(-z));
+}
+class CalibrationClassifier {
+  /** [w0, w1, w2, w3, bias] */
+  w = [0, 0, 0, 0, 0];
+  _trainedOn = 0;
+  get trainedOn() {
+    return this._trainedOn;
+  }
+  /**
+   * Train (or incrementally update) the classifier on a single labelled sample.
+   * @param confidence   Hypothesis confidence score (0–1)
+   * @param tagAccuracy  Empirical accuracy of the detector tag (0–1)
+   * @param sampleCount  Number of verdicts for this tag
+   * @param trusted      Whether the tag has enough samples to be trusted
+   * @param isCorrect    Ground truth: true = correct/partial, false = wrong
+   */
+  update(confidence, tagAccuracy, sampleCount, trusted, isCorrect) {
+    const x = this._features(confidence, tagAccuracy, sampleCount, trusted);
+    const y = isCorrect ? 1 : 0;
+    const p = this._predict(x);
+    const err = y - p;
+    for (let i = 0; i < 4; i++) {
+      this.w[i] = this.w[i] * (1 - LEARNING_RATE * L2_LAMBDA) + LEARNING_RATE * err * x[i];
+    }
+    this.w[BIAS_IDX] += LEARNING_RATE * err;
+    this._trainedOn++;
+  }
+  /**
+   * Predict P(correct | features).
+   * Returns 0.5 (neutral) if the model has fewer than 10 training samples.
+   */
+  predict(confidence, tagAccuracy, sampleCount, trusted) {
+    if (this._trainedOn < 10) return 0.5;
+    const x = this._features(confidence, tagAccuracy, sampleCount, trusted);
+    return this._predict(x);
+  }
+  /**
+   * Bulk-train from an existing record set.
+   * Call this on startup to warm-start from persisted verdicts.
+   */
+  trainBulk(samples) {
+    this.w = [0, 0, 0, 0, 0];
+    this._trainedOn = 0;
+    for (let pass = 0; pass < 2; pass++) {
+      for (const s of samples) {
+        this.update(s.confidence, s.tagAccuracy, s.sampleCount, s.trusted, s.isCorrect);
+      }
+    }
+  }
+  _features(confidence, tagAccuracy, sampleCount, trusted) {
+    return [
+      Math.max(0, Math.min(1, confidence)),
+      Math.max(0, Math.min(1, tagAccuracy)),
+      Math.log(sampleCount + 1) / Math.log(500),
+      trusted ? 1 : 0
+    ];
+  }
+  _predict(x) {
+    let z = this.w[BIAS_IDX];
+    for (let i = 0; i < 4; i++) z += this.w[i] * x[i];
+    return sigmoid(z);
+  }
+  /** Serialise weights for diagnostics / export. */
+  weights() {
+    return { w: [...this.w], trainedOn: this._trainedOn };
+  }
+}
+const calibrationClassifier = new CalibrationClassifier();
+export {
+  CalibrationClassifier,
+  calibrationClassifier
+};

package/dist/intelligence/calibration-git-sync.js

@@ -0,0 +1,74 @@
+import { execFile, spawn } from "child_process";
+import fs from "fs";
+import path from "path";
+import { DATA_DIR } from "../sensor/paths.js";
+import logger from "../sensor/logger.js";
+const GIT_DIR = DATA_DIR;
+const GIT_LOCK = path.join(GIT_DIR, ".git");
+const GITIGNORE = path.join(GIT_DIR, ".gitignore");
+const GITIGNORE_CONTENT = [
+  "# Mergen data directory \u2014 only calibration and override corpus are tracked",
+  "secret",
+  "session.json",
+  "license.json",
+  "telemetry.json",
+  "*.db",
+  "*.db-wal",
+  "*.db-shm",
+  "*.tmp.*"
+].join("\n") + "\n";
+function isEnabled() {
+  return process.env.MERGEN_GIT_SYNC === "true";
+}
+function ensureRepo() {
+  return new Promise((resolve) => {
+    if (fs.existsSync(GIT_LOCK)) {
+      resolve();
+      return;
+    }
+    fs.mkdirSync(GIT_DIR, { recursive: true });
+    if (!fs.existsSync(GITIGNORE)) {
+      fs.writeFileSync(GITIGNORE, GITIGNORE_CONTENT, "utf8");
+    }
+    execFile("git", ["-C", GIT_DIR, "init", "-b", "main"], (err) => {
+      if (err) {
+        execFile("git", ["-C", GIT_DIR, "init"], (err2) => {
+          if (err2) {
+            logger.warn({ err: err2 }, "calibration-git-sync: git init failed");
+            resolve();
+            return;
+          }
+          execFile("git", ["-C", GIT_DIR, "checkout", "-b", "main"], () => resolve());
+        });
+        return;
+      }
+      resolve();
+    });
+  });
+}
+function gitSyncCalibration(tag, verdict, pid) {
+  if (!isEnabled()) return;
+  const commit = async () => {
+    try {
+      await ensureRepo();
+      const msg = `calibration: ${tag} \u2192 ${verdict} (pid: ${pid.slice(0, 8)})`;
+      const files = ["calibration.json", "override-corpus.json", "shadow-log.json"].map((f) => path.join(GIT_DIR, f)).filter((f) => fs.existsSync(f)).map((f) => path.relative(GIT_DIR, f));
+      if (files.length === 0) return;
+      spawn("git", ["-C", GIT_DIR, "add", "--", ...files], { stdio: "ignore" }).on("close", (addCode) => {
+        if (addCode !== 0) return;
+        spawn("git", ["-C", GIT_DIR, "commit", "--allow-empty-message", "-m", msg, "--author", "Mergen <mergen@localhost>"], {
+          stdio: "ignore",
+          env: { ...process.env, GIT_AUTHOR_NAME: "Mergen", GIT_COMMITTER_NAME: "Mergen", GIT_AUTHOR_EMAIL: "mergen@localhost", GIT_COMMITTER_EMAIL: "mergen@localhost" }
+        });
+      });
+    } catch (err) {
+      logger.debug({ err }, "calibration-git-sync: commit skipped");
+    }
+  };
+  setTimeout(() => {
+    void commit();
+  }, 1500);
+}
+export {
+  gitSyncCalibration
+};

package/dist/intelligence/calibration.js

@@ -0,0 +1 @@
+export * from '../__stubs__/calibration.js';