mergen-server 1.4.0

package/dist/intelligence/error-fingerprint.js

@@ -0,0 +1 @@
+export * from '../__stubs__/closed-source.js';

package/dist/intelligence/execution-gate.js

@@ -0,0 +1,100 @@
+import fs from "fs";
+import { approvalEvents } from "./approval-events.js";
+import { APPROVALS_FILE, DATA_DIR, zeroRetentionMode } from "../sensor/paths.js";
+import logger from "../sensor/logger.js";
+const APPROVAL_WINDOW_MS = 15 * 60 * 1e3;
+const _pending = /* @__PURE__ */ new Map();
+let _loaded = false;
+let _persistTimer = null;
+function schedulePersist() {
+  if (zeroRetentionMode()) return;
+  if (_persistTimer) clearTimeout(_persistTimer);
+  _persistTimer = setTimeout(() => {
+    _persistTimer = null;
+    _persist();
+  }, 500);
+}
+function _persist() {
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    const payload = { version: 1, pending: [..._pending.entries()] };
+    const tmp = `${APPROVALS_FILE}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(payload), "utf8");
+    fs.renameSync(tmp, APPROVALS_FILE);
+  } catch (err) {
+    logger.warn({ err }, "execution-gate: persist failed");
+  }
+}
+function flushApprovals() {
+  _persist();
+}
+function load() {
+  if (_loaded) return;
+  _loaded = true;
+  if (zeroRetentionMode() || !fs.existsSync(APPROVALS_FILE)) return;
+  try {
+    const raw = JSON.parse(fs.readFileSync(APPROVALS_FILE, "utf8"));
+    if (raw?.version !== 1 || !Array.isArray(raw.pending)) return;
+    const now = Date.now();
+    let restored = 0;
+    for (const [pid, record] of raw.pending) {
+      if (record.expiresAt <= now) continue;
+      _pending.set(pid, record);
+      restored++;
+    }
+    if (restored > 0) {
+      logger.info({ restored }, "execution-gate: restored pending approvals from disk");
+    }
+  } catch (err) {
+    logger.warn({ err }, "execution-gate: failed to load persisted approvals \u2014 starting fresh");
+  }
+}
+function requestApproval(opts) {
+  load();
+  const now = Date.now();
+  _pending.set(opts.pid, { ...opts, requestedAt: now, expiresAt: now + APPROVAL_WINDOW_MS });
+  schedulePersist();
+  logger.info({ pid: opts.pid, tier: opts.tier, command: opts.command }, "execution-gate: awaiting Slack approval");
+}
+function approveExecution(pid) {
+  load();
+  const record = _pending.get(pid);
+  if (!record) return null;
+  _pending.delete(pid);
+  schedulePersist();
+  return record;
+}
+function denyExecution(pid) {
+  load();
+  if (!_pending.has(pid)) return false;
+  _pending.delete(pid);
+  schedulePersist();
+  return true;
+}
+function pruneExpired() {
+  const now = Date.now();
+  for (const [pid, record] of _pending) {
+    if (now <= record.expiresAt) continue;
+    _pending.delete(pid);
+    approvalEvents.emit("approval:expired", pid, "\u23F0 _Approval window expired (15 min). Re-trigger autopilot or apply fix manually._");
+    logger.info({ pid, command: record.command }, "execution-gate: approval window expired");
+  }
+}
+const _expiryHandle = setInterval(pruneExpired, 6e4);
+_expiryHandle.unref();
+function _resetForTesting() {
+  _pending.clear();
+  _loaded = true;
+  if (_persistTimer) {
+    clearTimeout(_persistTimer);
+    _persistTimer = null;
+  }
+}
+export {
+  _resetForTesting,
+  approveExecution,
+  denyExecution,
+  flushApprovals,
+  pruneExpired,
+  requestApproval
+};

package/dist/intelligence/execution-mode.js

@@ -0,0 +1,22 @@
+function isAutopilotEnabled() {
+  return process.env.MERGEN_AUTOPILOT === "true";
+}
+function isShadowMode() {
+  const shadowEnv = process.env.MERGEN_SHADOW_MODE;
+  const autopilot = isAutopilotEnabled();
+  if (shadowEnv === "true") return true;
+  if (autopilot) return shadowEnv !== "false";
+  return false;
+}
+function isLiveExecutionEnabled() {
+  return isAutopilotEnabled() && !isShadowMode();
+}
+function isPolicyDryRun() {
+  return process.env.MERGEN_POLICY_DRY_RUN === "true";
+}
+export {
+  isAutopilotEnabled,
+  isLiveExecutionEnabled,
+  isPolicyDryRun,
+  isShadowMode
+};

package/dist/intelligence/gate-analytics.js

@@ -0,0 +1,256 @@
+import { resolveAgentIdentity } from "./agent-identity.js";
+const _retryStats = /* @__PURE__ */ new Map();
+const _pendingRetries = [];
+const RETRY_WINDOW_MS = 6e4;
+function _mostRecentRetryIdx(now) {
+  for (let i = _pendingRetries.length - 1; i >= 0; i--) {
+    if (now - _pendingRetries[i].firedAt <= RETRY_WINDOW_MS) return i;
+  }
+  return -1;
+}
+function _ensureRetryStats(ruleId) {
+  if (!_retryStats.has(ruleId)) _retryStats.set(ruleId, { fired: 0, retryPassed: 0, retryBlocked: 0 });
+  return _retryStats.get(ruleId);
+}
+let _totalBlockedCount = 0;
+function getBlockedActionCount() {
+  return _totalBlockedCount;
+}
+function recordGateBlock(triggeredRules) {
+  _totalBlockedCount++;
+  const now = Date.now();
+  const idx = _mostRecentRetryIdx(now);
+  if (idx !== -1) {
+    const pending = _pendingRetries.splice(idx, 1)[0];
+    for (const ruleId of pending.triggeredRules) {
+      _ensureRetryStats(ruleId).retryBlocked++;
+    }
+  }
+  for (const ruleId of triggeredRules) {
+    _ensureRetryStats(ruleId).fired++;
+  }
+  _pendingRetries.push({ triggeredRules, firedAt: now });
+  _schedulePersist();
+}
+function recordGatePass() {
+  const now = Date.now();
+  const idx = _mostRecentRetryIdx(now);
+  if (idx === -1) return;
+  const pending = _pendingRetries.splice(idx, 1)[0];
+  for (const ruleId of pending.triggeredRules) {
+    _ensureRetryStats(ruleId).retryPassed++;
+  }
+}
+function getRetryStats() {
+  return _retryStats;
+}
+const _toolCallCounts = /* @__PURE__ */ new Map();
+const _unguardedCounts = /* @__PURE__ */ new Map();
+const _ruleFirings = /* @__PURE__ */ new Map();
+function recordGateCoverage(toolName, triggeredRules) {
+  _toolCallCounts.set(toolName, (_toolCallCounts.get(toolName) ?? 0) + 1);
+  if (triggeredRules.length === 0) {
+    _unguardedCounts.set(toolName, (_unguardedCounts.get(toolName) ?? 0) + 1);
+  }
+  for (const ruleId of triggeredRules) {
+    _ruleFirings.set(ruleId, (_ruleFirings.get(ruleId) ?? 0) + 1);
+  }
+  _schedulePersist();
+}
+function getToolCallCounts() {
+  return _toolCallCounts;
+}
+function getUnguardedCounts() {
+  return _unguardedCounts;
+}
+function getRuleFirings() {
+  return _ruleFirings;
+}
+const _hitlStats = /* @__PURE__ */ new Map();
+function _ensureHitlStats(ruleId) {
+  if (!_hitlStats.has(ruleId)) {
+    _hitlStats.set(ruleId, { approvals: 0, denials: 0, totalApprovalLatencyMs: 0, totalDenialLatencyMs: 0 });
+  }
+  return _hitlStats.get(ruleId);
+}
+function recordHitlDecision(triggeredRules, decision, heldAt) {
+  const latencyMs = Date.now() - heldAt;
+  for (const ruleId of triggeredRules) {
+    const stats = _ensureHitlStats(ruleId);
+    if (decision === "approve") {
+      stats.approvals++;
+      stats.totalApprovalLatencyMs += latencyMs;
+    } else {
+      stats.denials++;
+      stats.totalDenialLatencyMs += latencyMs;
+    }
+  }
+}
+function getHitlStats() {
+  return _hitlStats;
+}
+const RING_CAP = 500;
+const _gateRing = [];
+const _sseSubscribers = /* @__PURE__ */ new Set();
+function subscribeGateStream(cb) {
+  _sseSubscribers.add(cb);
+  return () => _sseSubscribers.delete(cb);
+}
+function recordGateEvent(event) {
+  _gateRing.push(event);
+  if (_gateRing.length > RING_CAP) _gateRing.shift();
+  for (const sub of _sseSubscribers) {
+    try {
+      sub(event);
+    } catch {
+    }
+  }
+  if (event.agentId) {
+    const events = getGateEvents();
+    void import("./behavior-baseline.js").then(({ onGateEvent }) => onGateEvent(event.agentId, events));
+  }
+  try {
+    const identity = resolveAgentIdentity();
+    if (identity.verified && identity.userId) event.userId = identity.userId;
+  } catch {
+  }
+  void _appendToLedger(event);
+  _schedulePersist();
+}
+async function _appendToLedger(event) {
+  try {
+    const { getStores } = await import("../storage/store-registry.js");
+    const resource = event.resource !== void 0 ? event.resource : await _deriveResource(event.command);
+    await getStores().actionLedger.append({
+      ts: event.ts,
+      agentId: event.agentId,
+      userId: event.userId ?? process.env.MERGEN_USER_ID ?? null,
+      tool: event.toolName,
+      command: event.command,
+      resource,
+      verdict: event.verdict,
+      policyMatched: event.triggeredRules,
+      reason: event.reason ?? event.guidedAlternative ?? null,
+      credentialIssued: event.credentialIssued ?? false,
+      credentialScope: event.credentialScope ?? null,
+      environment: event.environment ?? null,
+      traceId: event.traceId ?? null
+    });
+  } catch {
+  }
+}
+async function _deriveResource(command) {
+  if (!command) return null;
+  try {
+    const [{ parseShellCommand }, { extractResourcesFromHaystack }] = await Promise.all([
+      import("./shell-ast.js"),
+      import("./resource-extractors.js")
+    ]);
+    const parsed = parseShellCommand(command);
+    if (!parsed) return null;
+    return extractResourcesFromHaystack(parsed)[0] ?? null;
+  } catch {
+    return null;
+  }
+}
+function getGateEvents() {
+  return [..._gateRing];
+}
+function getReformulationRates() {
+  const result = /* @__PURE__ */ new Map();
+  for (const [ruleId, stats] of _retryStats) {
+    const reformulated = stats.retryPassed;
+    result.set(ruleId, {
+      fired: stats.fired,
+      reformulated,
+      rate: stats.fired > 0 ? reformulated / stats.fired : 0
+    });
+  }
+  return result;
+}
+const FATIGUE_WINDOW_MS = 60 * 60 * 1e3;
+const FATIGUE_THRESHOLD = 5;
+const _holdTimestamps = [];
+function recordHitlHold() {
+  const now = Date.now();
+  _holdTimestamps.push(now);
+  const cutoff = now - FATIGUE_WINDOW_MS;
+  while (_holdTimestamps.length > 0 && _holdTimestamps[0] < cutoff) _holdTimestamps.shift();
+}
+function getHitlFatigueStatus() {
+  const now = Date.now();
+  const cutoff = now - FATIGUE_WINDOW_MS;
+  const holdsLastHour = _holdTimestamps.filter((t) => t >= cutoff).length;
+  const fatigued = holdsLastHour >= FATIGUE_THRESHOLD;
+  return {
+    holdsLastHour,
+    fatigued,
+    threshold: FATIGUE_THRESHOLD,
+    recommendation: fatigued ? `${holdsLastHour} HITL holds in the last hour \u2014 consider tightening the policy to auto-block these patterns rather than holding them for approval.` : null
+  };
+}
+let _persistTimer = null;
+function persistGateAnalytics() {
+  import("../sensor/agent-context-store.js").then(({ agentContextStore }) => {
+    const snapshot = {
+      version: 1,
+      retryStats: [..._retryStats.entries()],
+      toolCallCounts: [..._toolCallCounts.entries()],
+      unguardedCounts: [..._unguardedCounts.entries()],
+      ruleFirings: [..._ruleFirings.entries()],
+      hitlStats: [..._hitlStats.entries()],
+      events: _gateRing.slice(-500)
+    };
+    agentContextStore.store("__gate", "gate_analytics_v1", JSON.stringify(snapshot), 0);
+  }).catch(() => {
+  });
+}
+function _schedulePersist() {
+  if (_persistTimer) return;
+  _persistTimer = setTimeout(() => {
+    _persistTimer = null;
+    persistGateAnalytics();
+  }, 6e4);
+  if (_persistTimer && typeof _persistTimer === "object" && "unref" in _persistTimer) {
+    _persistTimer.unref();
+  }
+}
+async function hydrateGateAnalytics() {
+  try {
+    const { agentContextStore } = await import("../sensor/agent-context-store.js");
+    const entries = agentContextStore.recall("__gate", "gate_analytics_v1", 1);
+    if (entries.length === 0) return;
+    const snap = JSON.parse(entries[0].value);
+    if (snap?.version !== 1) return;
+    for (const [k, v] of snap.retryStats ?? []) _retryStats.set(k, v);
+    for (const [k, v] of snap.toolCallCounts ?? []) _toolCallCounts.set(k, v);
+    for (const [k, v] of snap.unguardedCounts ?? []) _unguardedCounts.set(k, v);
+    for (const [k, v] of snap.ruleFirings ?? []) _ruleFirings.set(k, v);
+    for (const [k, v] of snap.hitlStats ?? []) _hitlStats.set(k, v);
+    if (Array.isArray(snap.events)) {
+      _gateRing.length = 0;
+      _gateRing.push(...snap.events.slice(-RING_CAP));
+    }
+  } catch {
+  }
+}
+export {
+  getBlockedActionCount,
+  getGateEvents,
+  getHitlFatigueStatus,
+  getHitlStats,
+  getReformulationRates,
+  getRetryStats,
+  getRuleFirings,
+  getToolCallCounts,
+  getUnguardedCounts,
+  hydrateGateAnalytics,
+  persistGateAnalytics,
+  recordGateBlock,
+  recordGateCoverage,
+  recordGateEvent,
+  recordGatePass,
+  recordHitlDecision,
+  recordHitlHold,
+  subscribeGateStream
+};

package/dist/intelligence/gate-decision.js

@@ -0,0 +1,64 @@
+import { normalizeForMatching } from "./normalize.js";
+function extractAllStrings(obj, depth = 0) {
+  if (depth > 6) return [];
+  if (typeof obj === "string") return obj.length > 0 ? [obj] : [];
+  if (Array.isArray(obj)) return obj.flatMap((v) => extractAllStrings(v, depth + 1));
+  if (obj !== null && typeof obj === "object") {
+    return Object.values(obj).flatMap((v) => extractAllStrings(v, depth + 1));
+  }
+  return [];
+}
+const INJECTION_PATTERNS = [
+  /ignore\s+(all\s+)?previous\s+instructions?/i,
+  /disregard\s+(the\s+)?(above|previous|prior)/i,
+  /forget\s+(all\s+)?previous\s+instructions?/i,
+  /you\s+are\s+now\s+(?:a|an)\s+/i,
+  /new\s+system\s+prompt/i,
+  /\bjailbreak\b/i,
+  /\bdan\s+mode\b/i,
+  /override\s+(all\s+)?(?:safety|security|policy)\s+(rules?|constraints?|restrictions?)/i,
+  // Additional paraphrase variants
+  /act\s+as\s+(?:if\s+)?(?:you\s+(?:have\s+no|are\s+without)\s+(?:restrictions?|guidelines?|rules?))/i,
+  /from\s+now\s+on\s+(?:you\s+(?:are|will|must|should))/i,
+  /pretend\s+(?:you\s+(?:have\s+no|are\s+without)|that\s+(?:safety|policy|rules?))/i,
+  /(?:ignore|bypass|circumvent|disable)\s+(?:your\s+)?(?:safety|security|policy|guidelines?|restrictions?)/i,
+  /(?:system|instruction|prompt)\s+(?:override|injection|hijack)/i,
+  /<\s*(?:system|instructions?)\s*>/i
+];
+function detectInjection(text) {
+  const normalized = normalizeForMatching(text);
+  for (const pattern of INJECTION_PATTERNS) {
+    if (pattern.test(normalized)) return pattern.source;
+  }
+  return null;
+}
+const COMMAND_ALTERNATIVES = [
+  [/terraform destroy/i, "Run `terraform plan -destroy` to preview the blast radius and share the plan output, then request human approval before proceeding."],
+  [/kubectl delete/i, "Run `kubectl describe <resource>` to confirm the target and current state, then request HITL approval before deletion."],
+  [/drop (table|database)/i, "Export a schema snapshot, confirm row counts, then create a reversible migration with a rollback path and request HITL approval."],
+  [/truncate table/i, "Confirm row count with `SELECT count(*) FROM <table>` and back up the data, then request approval to truncate."],
+  [/rm -rf/i, "List the target first with `ls -la <path>` to confirm scope, then request human approval before deleting."],
+  [/(destroy|nuke|wipe)\b/i, "Describe the specific resource and intended outcome, then request human approval \u2014 this action is irreversible."]
+];
+const RULE_ALTERNATIVES = {
+  policy_auth_batch_window: "Auth changes are locked during the Friday settlement window (12:00\u201324:00 UTC). Schedule this for after Saturday 00:00 UTC, or submit a change request via HITL for manual override.",
+  hold_schema_mutations: "Schema mutations require operator approval. Describe the migration intent, submit it for HITL review, and await the operator response before proceeding.",
+  policy_prod_database_warn: "Database migrations should run via automated pipelines. Open a PR to trigger the migration workflow rather than running it directly."
+};
+function getSuggestedAlternative(triggeredRules, commandArg) {
+  for (const ruleId of triggeredRules) {
+    const ruleAlt = RULE_ALTERNATIVES[ruleId];
+    if (ruleAlt) return ruleAlt;
+  }
+  const haystack = commandArg.toLowerCase();
+  for (const [pattern, alt] of COMMAND_ALTERNATIVES) {
+    if (pattern.test(haystack)) return alt;
+  }
+  return "Describe the intended outcome and the specific resource, then request human approval before executing irreversible actions.";
+}
+export {
+  INJECTION_PATTERNS,
+  detectInjection,
+  extractAllStrings,
+  getSuggestedAlternative
+};

package/dist/intelligence/gcp-broker.js

@@ -0,0 +1,50 @@
+import { issueFederationToken } from "./oidc-issuer.js";
+const STS_TOKEN_URL = "https://sts.googleapis.com/v1/token";
+const IAM_CREDENTIALS_URL = (saEmail) => `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(saEmail)}:generateAccessToken`;
+async function postJson(url, body, bearer) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...bearer ? { Authorization: `Bearer ${bearer}` } : {}
+    },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`gcp-broker: ${url} returned ${res.status}: ${text.slice(0, 500)}`);
+  }
+  return res.json();
+}
+async function requestGcpCredential(agentId, scopeName, scopeConfig, requestedDurationSeconds) {
+  const federationToken = await issueFederationToken({
+    agentId,
+    audience: scopeConfig.workloadIdentityAudience
+  });
+  const stsResponse = await postJson(STS_TOKEN_URL, {
+    audience: scopeConfig.workloadIdentityAudience,
+    grantType: "urn:ietf:params:oauth:grant-type:token-exchange",
+    requestedTokenType: "urn:ietf:params:oauth:token-type:access_token",
+    subjectToken: federationToken,
+    subjectTokenType: "urn:ietf:params:oauth:token-type:jwt",
+    scope: "https://www.googleapis.com/auth/cloud-platform"
+  });
+  const lifetimeSeconds = Math.min(requestedDurationSeconds ?? scopeConfig.maxDurationSeconds, scopeConfig.maxDurationSeconds, 3600);
+  const impersonated = await postJson(
+    IAM_CREDENTIALS_URL(scopeConfig.serviceAccountEmail),
+    { scope: ["https://www.googleapis.com/auth/cloud-platform"], lifetime: `${lifetimeSeconds}s` },
+    stsResponse.access_token
+  );
+  return {
+    provider: "gcp",
+    gcpAccessToken: impersonated.accessToken,
+    serviceAccountEmail: scopeConfig.serviceAccountEmail,
+    expiration: new Date(impersonated.expireTime),
+    scope: scopeName,
+    durationEnforced: true
+  };
+}
+export {
+  requestGcpCredential
+};