mergen-server 1.4.0

package/dist/intelligence/degradation-watcher.js

@@ -0,0 +1,108 @@
+import { exec } from "child_process";
+import { store } from "../sensor/buffer.js";
+import logger from "../sensor/logger.js";
+const ENABLED = process.env.MERGEN_DEGRADATION_WATCH !== "false";
+const SEVERE_ERR_COUNT = Math.max(1, parseInt(process.env.MERGEN_SEVERE_ERR_COUNT ?? "10", 10));
+const SEVERE_WINDOW_MS = Math.max(6e4, parseInt(process.env.MERGEN_SEVERE_WINDOW_MS ?? "300000", 10));
+const SEVERE_DURATION_MS = Math.max(6e4, parseInt(process.env.MERGEN_SEVERE_DURATION_MS ?? "300000", 10));
+const POLL_INTERVAL_MS = 6e4;
+let _degradedSince = null;
+let _notifiedForDegradedSince = null;
+let _lastState = {
+  degraded: false,
+  degradedSince: null,
+  errorCount: 0,
+  durationLabel: null
+};
+function getDegradationState() {
+  return _lastState;
+}
+function humanDuration(ms) {
+  const minutes = Math.floor(ms / 6e4);
+  if (minutes < 60) return `${minutes} minute${minutes !== 1 ? "s" : ""}`;
+  const hours = Math.floor(minutes / 60);
+  const rem = minutes % 60;
+  return rem > 0 ? `${hours}h ${rem}m` : `${hours} hour${hours !== 1 ? "s" : ""}`;
+}
+function fireNotification(errorCount, durationMs) {
+  const dur = humanDuration(durationMs);
+  const body = `${errorCount} errors in the last window \u2014 sustained for ${dur}. Check Mergen.`;
+  const title = "Mergen \u2014 Degradation Alert";
+  process.stderr.write(`\x07
+[MERGEN] ${title}: ${body}
+`);
+  const platform = process.platform;
+  if (platform === "darwin") {
+    const escaped = body.replace(/'/g, "'\\''");
+    exec(`osascript -e 'display notification "${escaped}" with title "${title}" sound name "Submarine"'`, (err) => {
+      if (err) logger.debug({ err }, "degradation-watcher: osascript notification failed (stderr fallback used)");
+    });
+  } else if (platform === "linux") {
+    const escaped = body.replace(/"/g, '\\"');
+    exec(`notify-send "${title}" "${escaped}" --urgency=critical`, (err) => {
+      if (err) logger.debug({ err }, "degradation-watcher: notify-send failed (stderr fallback used)");
+    });
+  }
+}
+function poll() {
+  const now = Date.now();
+  const blastRadius = store.getBlastRadius({ since: now - SEVERE_WINDOW_MS });
+  const errCount = blastRadius.errorCount;
+  if (errCount >= SEVERE_ERR_COUNT) {
+    if (_degradedSince === null) {
+      _degradedSince = now;
+      logger.debug({ errCount, threshold: SEVERE_ERR_COUNT }, "degradation-watcher: severe degradation started");
+    }
+    const sustainedMs = now - _degradedSince;
+    const label = humanDuration(now - _degradedSince);
+    _lastState = {
+      degraded: true,
+      degradedSince: _degradedSince,
+      errorCount: errCount,
+      durationLabel: label
+    };
+    if (sustainedMs >= SEVERE_DURATION_MS && _notifiedForDegradedSince !== _degradedSince) {
+      _notifiedForDegradedSince = _degradedSince;
+      logger.info({ errCount, sustainedMs, threshold: SEVERE_ERR_COUNT }, "degradation-watcher: sustained severe degradation \u2014 firing notification");
+      fireNotification(errCount, sustainedMs);
+    }
+  } else {
+    if (_degradedSince !== null) {
+      logger.debug({ previousDegradedSince: _degradedSince }, "degradation-watcher: degradation cleared");
+    }
+    _degradedSince = null;
+    _notifiedForDegradedSince = null;
+    _lastState = { degraded: false, degradedSince: null, errorCount: 0, durationLabel: null };
+  }
+}
+let _timer = null;
+function startDegradationWatcher() {
+  if (!ENABLED) {
+    logger.debug("degradation-watcher: disabled via MERGEN_DEGRADATION_WATCH=false");
+    return;
+  }
+  if (_timer !== null) return;
+  logger.debug(
+    { severeErrCount: SEVERE_ERR_COUNT, severeWindowMs: SEVERE_WINDOW_MS, severeDurationMs: SEVERE_DURATION_MS },
+    "degradation-watcher: started"
+  );
+  _timer = setInterval(poll, POLL_INTERVAL_MS);
+  _timer.unref();
+}
+function stopDegradationWatcher() {
+  if (_timer) {
+    clearInterval(_timer);
+    _timer = null;
+  }
+}
+function _resetWatcherForTesting() {
+  _degradedSince = null;
+  _notifiedForDegradedSince = null;
+  _lastState = { degraded: false, degradedSince: null, errorCount: 0, durationLabel: null };
+}
+export {
+  _resetWatcherForTesting,
+  getDegradationState,
+  startDegradationWatcher,
+  stopDegradationWatcher
+};

package/dist/intelligence/detector-plugins.js

@@ -0,0 +1,70 @@
+import fs from "fs";
+import path from "path";
+import { pathToFileURL } from "url";
+import { DATA_DIR } from "../sensor/paths.js";
+import logger from "../sensor/logger.js";
+const PLUGINS_DIR = path.join(DATA_DIR, "detectors");
+let _plugins = [];
+let _loaded = false;
+async function loadPlugins() {
+  if (_loaded) return;
+  _loaded = true;
+  if (!fs.existsSync(PLUGINS_DIR)) {
+    try {
+      fs.mkdirSync(PLUGINS_DIR, { recursive: true, mode: 448 });
+    } catch {
+    }
+    return;
+  }
+  let files;
+  try {
+    files = fs.readdirSync(PLUGINS_DIR).filter((f) => f.endsWith(".js"));
+  } catch (err) {
+    logger.warn({ err }, "detector-plugins: could not read detectors directory");
+    return;
+  }
+  for (const file of files) {
+    const filePath = path.join(PLUGINS_DIR, file);
+    try {
+      const url = pathToFileURL(filePath).href;
+      const mod = await import(url);
+      const fn = mod.detect ?? mod.default;
+      if (typeof fn !== "function") {
+        logger.warn({ file }, "detector-plugins: no detect function exported \u2014 skipping");
+        continue;
+      }
+      const pluginName = path.basename(file, ".js");
+      const wrapped = Object.assign(
+        (events) => fn(events),
+        { name: `plugin:${pluginName}` }
+      );
+      _plugins.push(wrapped);
+      logger.info({ plugin: pluginName }, "detector-plugins: loaded");
+    } catch (err) {
+      logger.warn({ err, file }, "detector-plugins: failed to load plugin \u2014 skipping");
+    }
+  }
+  if (_plugins.length > 0) {
+    logger.info({ count: _plugins.length, dir: PLUGINS_DIR }, "detector-plugins: plugins ready");
+  }
+}
+function getPluginDetectors() {
+  return _plugins;
+}
+function runPlugins(events) {
+  const results = [];
+  for (const plugin of _plugins) {
+    try {
+      const h = plugin(events);
+      if (h) results.push(h);
+    } catch (err) {
+      logger.warn({ err, plugin: plugin.name ?? "unknown" }, "detector-plugins: plugin threw");
+    }
+  }
+  return results;
+}
+export {
+  getPluginDetectors,
+  loadPlugins,
+  runPlugins
+};

package/dist/intelligence/detectors.js

@@ -0,0 +1 @@
+export * from '../__stubs__/closed-source.js';

package/dist/intelligence/device-auth.js

@@ -0,0 +1,138 @@
+const DEFAULT_DEPS = {
+  fetch: (...args) => fetch(...args),
+  sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+  now: () => Date.now()
+};
+const DEFAULT_INTERVAL_SECONDS = 5;
+const MAX_EXPIRES_IN_SECONDS = 30 * 60;
+class DeviceAuthError extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "DeviceAuthError";
+  }
+  reason;
+}
+function normalizeApiUrl(apiUrl) {
+  return apiUrl.replace(/\/+$/, "");
+}
+async function requestDeviceCode(apiUrl, deps = {}) {
+  const d = { ...DEFAULT_DEPS, ...deps };
+  let res;
+  try {
+    res = await d.fetch(`${normalizeApiUrl(apiUrl)}/v1/device/code`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ clientId: "mergen-cli" })
+    });
+  } catch (err) {
+    throw new DeviceAuthError(
+      `Could not reach the activation server at ${apiUrl}: ${err.message}`,
+      "network"
+    );
+  }
+  if (!res.ok) {
+    throw new DeviceAuthError(`Device code request failed (HTTP ${res.status})`, "protocol");
+  }
+  const data = await res.json();
+  const userCode = data.user_code ?? data.userCode;
+  const deviceCode = data.device_code ?? data.deviceCode;
+  const verificationUri = data.verification_uri ?? data.verificationUri;
+  if (!deviceCode || !userCode || !verificationUri) {
+    throw new DeviceAuthError("Malformed device code response from activation server", "protocol");
+  }
+  const complete = data.verification_uri_complete ?? data.verificationUriComplete;
+  const interval = Number(data.interval ?? DEFAULT_INTERVAL_SECONDS) || DEFAULT_INTERVAL_SECONDS;
+  const expiresIn = Math.min(Number(data.expires_in ?? data.expiresIn ?? MAX_EXPIRES_IN_SECONDS) || MAX_EXPIRES_IN_SECONDS, MAX_EXPIRES_IN_SECONDS);
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    verificationUriComplete: complete ?? `${verificationUri}?code=${encodeURIComponent(userCode)}`,
+    interval: Math.max(1, interval),
+    expiresIn: Math.max(1, expiresIn)
+  };
+}
+async function pollDeviceToken(apiUrl, deviceCode, deps = {}) {
+  const d = { ...DEFAULT_DEPS, ...deps };
+  let res;
+  try {
+    res = await d.fetch(`${normalizeApiUrl(apiUrl)}/v1/device/token`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode, grant_type: "urn:ietf:params:oauth:grant-type:device_code" })
+    });
+  } catch (err) {
+    throw new DeviceAuthError(`Poll failed: ${err.message}`, "network");
+  }
+  const data = await res.json().catch(() => ({}));
+  const status = data.status?.toLowerCase();
+  const error = data.error?.toLowerCase();
+  if (status === "approved" || res.ok && (data.key || data.access_token)) {
+    const key = data.key ?? data.access_token;
+    if (!key) throw new DeviceAuthError("Approved but no license key returned", "protocol");
+    return {
+      status: "approved",
+      activation: {
+        key,
+        planId: data.planId ?? data.plan_id,
+        email: data.email ?? void 0
+      }
+    };
+  }
+  if (status === "denied" || error === "access_denied") return { status: "denied" };
+  if (status === "expired" || error === "expired_token") return { status: "expired" };
+  if (error === "slow_down") return { status: "slow_down" };
+  if (error === "authorization_pending" || status === "pending") return { status: "pending" };
+  if (error) throw new DeviceAuthError(`Activation server rejected the request (${error}).`, "protocol");
+  return { status: "pending" };
+}
+async function runDeviceAuthorization(apiUrl, cb = {}, deps = {}) {
+  const d = { ...DEFAULT_DEPS, ...deps };
+  const code = await requestDeviceCode(apiUrl, d);
+  cb.onPrompt?.(code);
+  const startedAt = d.now();
+  const deadline = startedAt + code.expiresIn * 1e3;
+  let intervalMs = code.interval * 1e3;
+  await d.sleep(intervalMs);
+  for (; ; ) {
+    if (d.now() >= deadline) {
+      throw new DeviceAuthError("Login timed out \u2014 the code expired before it was approved.", "expired");
+    }
+    let result;
+    try {
+      result = await pollDeviceToken(apiUrl, code.deviceCode, d);
+    } catch (err) {
+      if (err instanceof DeviceAuthError && err.reason === "network") {
+        cb.onPending?.(d.now() - startedAt);
+        await d.sleep(intervalMs);
+        continue;
+      }
+      throw err;
+    }
+    switch (result.status) {
+      case "approved":
+        return result.activation;
+      case "denied":
+        throw new DeviceAuthError("Login was denied in the browser.", "denied");
+      case "expired":
+        throw new DeviceAuthError("Login timed out \u2014 the code expired before it was approved.", "expired");
+      case "slow_down":
+        intervalMs += 5e3;
+        cb.onPending?.(d.now() - startedAt);
+        await d.sleep(intervalMs);
+        break;
+      case "pending":
+      default:
+        cb.onPending?.(d.now() - startedAt);
+        await d.sleep(intervalMs);
+        break;
+    }
+  }
+}
+export {
+  DeviceAuthError,
+  pollDeviceToken,
+  requestDeviceCode,
+  runDeviceAuthorization
+};

package/dist/intelligence/diff-size.js

@@ -0,0 +1,42 @@
+const LARGE_DIFF_LINES = 500;
+const LARGE_FILE_COUNT = 20;
+function evaluateDiffSize(stats, context) {
+  const factors = [];
+  let score = 0;
+  const totalLines = Math.max(0, stats.additions) + Math.max(0, stats.deletions);
+  const filesChanged = Math.max(0, stats.filesChanged);
+  if (totalLines > LARGE_DIFF_LINES) {
+    const over = totalLines - LARGE_DIFF_LINES;
+    const delta = Math.min(60, 20 + Math.floor(over / 100) * 10);
+    score += delta;
+    factors.push({ label: "Large diff", delta, detail: `${totalLines} changed lines (threshold: ${LARGE_DIFF_LINES})` });
+  }
+  if (filesChanged > LARGE_FILE_COUNT) {
+    const delta = Math.min(30, (filesChanged - LARGE_FILE_COUNT) * 2);
+    score += delta;
+    factors.push({ label: "Many files touched", delta, detail: `${filesChanged} files (threshold: ${LARGE_FILE_COUNT})` });
+  }
+  if (context.actorIsAi && totalLines > LARGE_DIFF_LINES) {
+    const delta = 20;
+    score += delta;
+    factors.push({ label: "AI-authored large diff", delta, detail: "Agent-authored changes above the size threshold get extra scrutiny" });
+  }
+  const clampedScore = Math.min(100, score);
+  const level = clampedScore >= 70 ? "HIGH" : clampedScore >= 40 ? "MEDIUM" : "LOW";
+  const requiresApproval = clampedScore >= 70;
+  const recommendation = requiresApproval ? "This diff is unusually large for a single PR \u2014 split it into smaller, independently reviewable changes, or get explicit human sign-off before merging." : level === "MEDIUM" ? "This diff is larger than typical \u2014 a closer review is recommended before merging." : "Diff size is within normal range.";
+  return {
+    score: clampedScore,
+    level,
+    requiresApproval,
+    filesChanged,
+    additions: Math.max(0, stats.additions),
+    deletions: Math.max(0, stats.deletions),
+    totalLines,
+    factors,
+    recommendation
+  };
+}
+export {
+  evaluateDiffSize
+};

package/dist/intelligence/ebpf-verify.js

@@ -0,0 +1,45 @@
+import { execFile } from "child_process";
+import { promisify } from "util";
+import logger from "../sensor/logger.js";
+const execFileAsync = promisify(execFile);
+function isEbpfVerifyRequested() {
+  return process.env.MERGEN_EBPF_VERIFY === "true";
+}
+function getEbpfCapability() {
+  const requested = isEbpfVerifyRequested();
+  return { requested, platform: process.platform, supported: requested && process.platform === "linux" };
+}
+async function isBpftraceAvailable() {
+  try {
+    await execFileAsync("bpftrace", ["--version"], { timeout: 3e3 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function bpftraceStringLiteral(s) {
+  return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+async function verifyNoExecve(commandHint, windowMs = 2e3) {
+  if (!isEbpfVerifyRequested()) return "disabled";
+  if (process.platform !== "linux") return "unsupported-platform";
+  if (!await isBpftraceAvailable()) return "unavailable";
+  const needle = bpftraceStringLiteral(commandHint);
+  const script = `tracepoint:syscalls:sys_enter_execve /strcontains(str(args->filename), "${needle}")/ { printf("MATCH\\n"); exit(); }`;
+  try {
+    const { stdout } = await execFileAsync(
+      "timeout",
+      [`${Math.ceil(windowMs / 1e3)}s`, "bpftrace", "-e", script],
+      { timeout: windowMs + 1e3 }
+    );
+    return stdout.includes("MATCH") ? "verified-executed" : "verified-not-executed";
+  } catch (err) {
+    logger.warn({ err, commandHint }, "ebpf-verify: bpftrace trace failed or timed out \u2014 treating as unverified");
+    return "unavailable";
+  }
+}
+export {
+  getEbpfCapability,
+  isEbpfVerifyRequested,
+  verifyNoExecve
+};