mergen-server 1.4.0

package/dist/intelligence/hypothesis-history.js

@@ -0,0 +1,93 @@
+import { store } from "../sensor/buffer.js";
+import { buildCausalChain } from "./causal.js";
+const MAX_HISTORY = 50;
+let _entries = [];
+let _pendingRebuild = Promise.resolve();
+function flushPendingRebuild() {
+  return _pendingRebuild;
+}
+function _triggerKey(entry) {
+  return entry.triggerMessage;
+}
+async function _build(reason) {
+  const logs = store.getLogs(50);
+  const network = store.getNetwork(50);
+  const context = store.getContext(10);
+  const errors = logs.filter((e) => e.level === "error");
+  if (reason === "error" || reason === "default" || !reason) {
+    if (errors.length === 0) return null;
+    const latest = errors[errors.length - 1];
+    const triggerMsg = latest.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ");
+    const chain2 = await buildCausalChain(logs, network, context);
+    return {
+      topHypothesis: chain2.hypotheses[0] ?? null,
+      chain: chain2,
+      builtAt: Date.now(),
+      builtAtIso: (/* @__PURE__ */ new Date()).toISOString(),
+      triggerMessage: triggerMsg,
+      reason: reason || "error"
+    };
+  }
+  if (reason === "pageload") {
+    if (network.length === 0 && logs.length === 0) return null;
+    const chain2 = await buildCausalChain(logs, network, context);
+    return {
+      topHypothesis: chain2.hypotheses[0] ?? null,
+      chain: chain2,
+      builtAt: Date.now(),
+      builtAtIso: (/* @__PURE__ */ new Date()).toISOString(),
+      triggerMessage: "Page loaded \u2014 baseline captured",
+      reason: "pageload"
+    };
+  }
+  if (errors.length === 0 && network.length === 0) return null;
+  const chain = await buildCausalChain(logs, network, context);
+  return {
+    topHypothesis: chain.hypotheses[0] ?? null,
+    chain,
+    builtAt: Date.now(),
+    builtAtIso: (/* @__PURE__ */ new Date()).toISOString(),
+    triggerMessage: errors[errors.length - 1] ? errors[errors.length - 1].args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ") : "Periodic baseline",
+    reason
+  };
+}
+const hypothesisHistory = {
+  size() {
+    return _entries.length;
+  },
+  latest() {
+    return _entries[_entries.length - 1] ?? null;
+  },
+  list(limit) {
+    const rows = [..._entries].reverse().slice(0, limit ?? _entries.length);
+    return rows.map(({ chain: _chain, ...rest }) => rest);
+  },
+  clear() {
+    _entries = [];
+  },
+  add(entry) {
+    _entries.push(entry);
+    if (_entries.length > MAX_HISTORY) _entries.shift();
+  },
+  notifyError(_pid, _err) {
+    const p = new Promise((resolve) => setTimeout(resolve, 0)).then(() => this._rebuildNowForTesting("error")).catch(() => {
+    });
+    _pendingRebuild = _pendingRebuild.then(() => p);
+  },
+  async _rebuildNowForTesting(reason = "error") {
+    const entry = await _build(reason);
+    if (!entry) return;
+    const key = _triggerKey(entry);
+    const existingIdx = _entries.findIndex((e) => _triggerKey(e) === key);
+    if (existingIdx >= 0) {
+      _entries[existingIdx] = entry;
+    } else {
+      _entries.push(entry);
+      if (_entries.length > MAX_HISTORY) _entries.shift();
+    }
+  }
+};
+export {
+  flushPendingRebuild,
+  hypothesisHistory
+};

package/dist/intelligence/idp-identity.js

@@ -0,0 +1,83 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+let _oktaJwks = null;
+let _entraJwks = null;
+function _oktaJwksUrl(domain) {
+  return new URL(`https://${domain}/oauth2/v1/keys`);
+}
+function _entraJwksUrl(tenantId) {
+  const tid = tenantId.includes(".") ? tenantId : tenantId;
+  return new URL(`https://login.microsoftonline.com/${tid}/discovery/v2.0/keys`);
+}
+function _entraIssuer(tenantId) {
+  return `https://login.microsoftonline.com/${tenantId}/v2.0`;
+}
+function _oktaIssuer(domain) {
+  return `https://${domain}`;
+}
+function _extractBearer(req) {
+  const auth = req.headers.authorization;
+  if (!auth || !auth.startsWith("Bearer ")) return null;
+  return auth.slice(7).trim() || null;
+}
+async function _validateOkta(token, domain) {
+  try {
+    if (!_oktaJwks) _oktaJwks = createRemoteJWKSet(_oktaJwksUrl(domain));
+    const { payload } = await jwtVerify(token, _oktaJwks, {
+      issuer: _oktaIssuer(domain)
+    });
+    return payload.email ?? payload.sub ?? null;
+  } catch {
+    return null;
+  }
+}
+async function _validateEntra(token, tenantId) {
+  try {
+    if (!_entraJwks) _entraJwks = createRemoteJWKSet(_entraJwksUrl(tenantId));
+    const { payload } = await jwtVerify(token, _entraJwks, {
+      issuer: _entraIssuer(tenantId)
+    });
+    return payload["preferred_username"] ?? payload.email ?? payload.sub ?? null;
+  } catch {
+    return null;
+  }
+}
+function idpIdentityMiddleware() {
+  const oktaDomain = process.env.MERGEN_OKTA_DOMAIN?.trim() || null;
+  const entraId = process.env.MERGEN_ENTRA_TENANT_ID?.trim() || null;
+  if (!oktaDomain && !entraId) {
+    return (_req, _res, next) => next();
+  }
+  return async (req, _res, next) => {
+    try {
+      const token = _extractBearer(req);
+      if (token) {
+        let userId = null;
+        if (oktaDomain) userId = await _validateOkta(token, oktaDomain);
+        if (!userId && entraId) userId = await _validateEntra(token, entraId);
+        if (userId) req.mergenUserId = userId;
+      }
+    } catch {
+    }
+    next();
+  };
+}
+async function resolveRequestIdentity(authHeader) {
+  if (!authHeader?.startsWith("Bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  if (!token) return null;
+  const oktaDomain = process.env.MERGEN_OKTA_DOMAIN?.trim() || null;
+  const entraId = process.env.MERGEN_ENTRA_TENANT_ID?.trim() || null;
+  if (oktaDomain) {
+    const id = await _validateOkta(token, oktaDomain);
+    if (id) return id;
+  }
+  if (entraId) {
+    const id = await _validateEntra(token, entraId);
+    if (id) return id;
+  }
+  return null;
+}
+export {
+  idpIdentityMiddleware,
+  resolveRequestIdentity
+};

package/dist/intelligence/impl-critic.js

@@ -0,0 +1,216 @@
+import fs from "fs";
+import path from "path";
+import { checkBoundaries } from "./arch-boundaries.js";
+import { confidenceStore } from "./confidence-report.js";
+const SECURITY_PATTERNS = [
+  {
+    re: /catch\s*\([^)]*\)\s*\{\s*\}/,
+    message: "Empty catch block silently swallows errors",
+    suggestion: "Log the error to the Mergen logger or rethrow. Never use bare catch {}.",
+    severity: "error"
+  },
+  {
+    re: /catch\s*\([^)]*\)\s*\{\s*\/\//,
+    message: "Catch block contains only a comment \u2014 error is still silently dropped",
+    suggestion: "Log via logger.warn/error or rethrow the exception.",
+    severity: "warning"
+  },
+  {
+    re: /['"`][A-Za-z0-9+/]{20,}={0,2}['"`]/,
+    message: "Possible hardcoded credential or token",
+    suggestion: "Use environment variables. Check this is not an accidentally committed secret.",
+    severity: "warning"
+  },
+  {
+    re: /eval\s*\(/,
+    message: "eval() is forbidden \u2014 arbitrary code execution risk",
+    suggestion: "Remove eval(). Use explicit logic or JSON.parse for data.",
+    severity: "error"
+  },
+  {
+    re: /innerHTML\s*=/,
+    message: "innerHTML assignment is an XSS vector",
+    suggestion: "Use textContent or a sanitiser library.",
+    severity: "warning"
+  },
+  {
+    re: /exec\s*\(\s*`[^`]*\$\{/,
+    message: "Shell command contains template literal interpolation \u2014 command injection risk",
+    suggestion: "Use execFile() with an array of arguments instead of string interpolation.",
+    severity: "error"
+  }
+];
+function scanSecurityPatterns(source, file, relFile) {
+  const findings = [];
+  const lines = source.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const p of SECURITY_PATTERNS) {
+      if (p.re.test(line)) {
+        findings.push({
+          severity: p.severity,
+          category: "security",
+          file: relFile,
+          line: i + 1,
+          message: p.message,
+          suggestion: p.suggestion
+        });
+      }
+    }
+  }
+  return findings;
+}
+const HARDCODED_RETURN_RE = /return\s+(true|false|0|1|null|\[\]|\{\})\s*;/g;
+const MOCK_BYPASS_RE = /mockReturnValue\(|mockResolvedValue\(/;
+function scanHardcodedReturns(source, relFile) {
+  if (relFile.endsWith(".test.ts")) return [];
+  const findings = [];
+  const lines = source.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    HARDCODED_RETURN_RE.lastIndex = 0;
+    if (HARDCODED_RETURN_RE.test(lines[i]) && !lines[i].trim().startsWith("//")) {
+      const context = lines.slice(Math.max(0, i - 5), i).join("\n");
+      if (/function|=>|\basync\b/.test(context)) {
+        findings.push({
+          severity: "warning",
+          category: "hardcoded-return",
+          file: relFile,
+          line: i + 1,
+          message: "Function returns a hardcoded literal \u2014 may be an incomplete implementation",
+          suggestion: "Verify this is intentional, not a stub left after test-driving."
+        });
+      }
+    }
+  }
+  return findings;
+}
+function checkAdrViolations(source, relFile) {
+  const findings = [];
+  if (/MERGEN_BUFFER_SIZE|bufferSize|capacity/.test(source)) {
+    const m = source.match(/(?:bufferSize|capacity|MERGEN_BUFFER_SIZE)\D*(\d{5,})/);
+    if (m && Number(m[1]) > 1e4) {
+      findings.push({
+        severity: "warning",
+        category: "adr-violation",
+        file: relFile,
+        message: `ADR-001: ring buffer capacity set to ${m[1]} \u2014 this may cause OOM. The default is 2 000.`,
+        suggestion: "Review ADR-001 before increasing the buffer cap. Use SQLite history for older events."
+      });
+    }
+  }
+  if (/res\.json\(|res\.send\(/.test(source) && relFile.includes("intelligence/")) {
+    findings.push({
+      severity: "warning",
+      category: "adr-violation",
+      file: relFile,
+      message: "ADR-002: intelligence/* file appears to use Express res.json() \u2014 tools must return MCP result objects, not HTTP responses.",
+      suggestion: 'Return { content: [{ type: "text", text: "..." }] } from MCP tool handlers. Route handling belongs in routes/*.'
+    });
+  }
+  if (/0\.0\.0\.0/.test(source) && !source.includes("CLOUD_MODE") && !source.includes("MERGEN_HOST")) {
+    findings.push({
+      severity: "warning",
+      category: "adr-violation",
+      file: relFile,
+      message: "ADR-004: binding to 0.0.0.0 without CLOUD_MODE or MERGEN_HOST guard.",
+      suggestion: "Wrap in a CLOUD_MODE or MERGEN_HOST check. Default binding must remain 127.0.0.1."
+    });
+  }
+  return findings;
+}
+function checkMissingWorkflow(files) {
+  const findings = [];
+  const hasNonTestFiles = files.some((f) => !f.endsWith(".test.ts") && !f.endsWith(".d.ts"));
+  if (!hasNonTestFiles) return findings;
+  const recent = confidenceStore.list(5);
+  if (recent.length === 0) {
+    findings.push({
+      severity: "warning",
+      category: "missing-workflow",
+      file: "(session)",
+      message: "No confidence report filed before this implementation.",
+      suggestion: "Call report_confidence before making changes to declare assumptions and unknowns."
+    });
+  }
+  return findings;
+}
+function critiqueImplementation(opts) {
+  const { files, srcDir } = opts;
+  const allFindings = [];
+  for (const file of files) {
+    if (!file.endsWith(".ts") || file.endsWith(".d.ts")) continue;
+    const result = checkBoundaries({ srcDir, singleFile: file });
+    for (const v of result.violations) {
+      allFindings.push({
+        severity: "error",
+        category: "boundary-violation",
+        file: v.relativeFile,
+        message: `Imports \`${v.relativeImport}\` \u2014 ${v.fromZone} cannot import ${v.importedZone}`,
+        suggestion: v.rule.rationale
+      });
+    }
+  }
+  for (const file of files) {
+    if (!file.endsWith(".ts") || file.endsWith(".d.ts")) continue;
+    let source;
+    try {
+      source = fs.readFileSync(file, "utf8");
+    } catch {
+      continue;
+    }
+    const relFile = path.relative(srcDir, file);
+    allFindings.push(...scanSecurityPatterns(source, file, relFile));
+    allFindings.push(...scanHardcodedReturns(source, relFile));
+    allFindings.push(...checkAdrViolations(source, relFile));
+  }
+  allFindings.push(...checkMissingWorkflow(files));
+  const errors = allFindings.filter((f) => f.severity === "error").length;
+  const warnings = allFindings.filter((f) => f.severity === "warning").length;
+  const passed = errors === 0;
+  const summary = passed ? `Critique passed \u2014 ${warnings} warning(s), 0 errors across ${files.length} file(s).` : `Critique failed \u2014 ${errors} error(s) and ${warnings} warning(s) across ${files.length} file(s). Fix errors before merging.`;
+  return { files, findings: allFindings, errors, warnings, passed, summary };
+}
+function formatCritiqueReport(r) {
+  const icon = r.passed ? "\u2705" : "\u274C";
+  const lines = [
+    `## Post-Implementation Critique: ${r.passed ? "PASS" : "FAIL"} ${icon}`,
+    "",
+    r.summary,
+    ""
+  ];
+  if (r.findings.length === 0) {
+    lines.push("No findings. Implementation looks clean.");
+    return lines.join("\n");
+  }
+  const byCategory = /* @__PURE__ */ new Map();
+  for (const f of r.findings) {
+    const arr = byCategory.get(f.category) ?? [];
+    arr.push(f);
+    byCategory.set(f.category, arr);
+  }
+  const categoryLabels = {
+    "boundary-violation": "Architectural Boundary Violations",
+    "adr-violation": "ADR Violations",
+    "missing-workflow": "Missing Workflow Steps",
+    "security": "Security Issues",
+    "test-erasure": "Test Erasure",
+    "hardcoded-return": "Hard-Coded Returns",
+    "duplication": "Duplication Signals"
+  };
+  for (const [cat, findings] of byCategory) {
+    lines.push(`### ${categoryLabels[cat] ?? cat}`, "");
+    for (const f of findings) {
+      const icon2 = f.severity === "error" ? "\u{1F534}" : f.severity === "warning" ? "\u{1F7E1}" : "\u{1F535}";
+      const loc = f.line ? `\`${f.file}:${f.line}\`` : `\`${f.file}\``;
+      lines.push(`${icon2} **${f.severity.toUpperCase()}** ${loc}`);
+      lines.push(`   ${f.message}`);
+      lines.push(`   > ${f.suggestion}`);
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+export {
+  critiqueImplementation,
+  formatCritiqueReport
+};