mergen-server 1.4.0

package/dist/intelligence/mcp-resources.js

@@ -0,0 +1,171 @@
+import { store } from "../sensor/buffer.js";
+import { getCurrentTraceContext } from "../datadog/otel-trace.js";
+import { registerFileContextResource } from "./resource-file-context.js";
+import { postmortemStore } from "./postmortem-store.js";
+import { incidentStore } from "../sensor/incident-store.js";
+function registerResources(server) {
+  server.registerResource(
+    "mergen-buffer-snapshot",
+    "mergen://buffer/snapshot",
+    {
+      description: "Current ring buffer statistics and session health signals. Read this before calling any tool to get error/warning counts, active signals (auth failures, network bursts, etc.), and the timestamp of the most recent event.",
+      mimeType: "application/json"
+    },
+    async (uri) => ({
+      contents: [{
+        uri: uri.href,
+        mimeType: "application/json",
+        text: JSON.stringify({
+          size: store.size(),
+          counters: store.getCounters(),
+          lastEventAt: store.lastEventAt(),
+          clearedAt: store.clearedAt(),
+          signals: store.getSignals()
+        }, null, 2)
+      }]
+    })
+  );
+  server.registerResource(
+    "mergen-recent-errors",
+    "mergen://buffer/errors",
+    {
+      description: "Most recent console.error events (up to 20). Includes de-minified stack traces and git-blame suspects where available. Use as a quick read before calling reconstruct_context.",
+      mimeType: "application/json"
+    },
+    async (uri) => ({
+      contents: [{
+        uri: uri.href,
+        mimeType: "application/json",
+        text: JSON.stringify(store.getLogs(20, "error"), null, 2)
+      }]
+    })
+  );
+  server.registerResource(
+    "mergen-network-failures",
+    "mergen://buffer/network-failures",
+    {
+      description: "Recent failed network requests: 4xx, 5xx, and connection errors. Includes request/response bodies and W3C trace context (traceId, tracestate, baggage). Read this when diagnosing API failures before calling get_network_activity.",
+      mimeType: "application/json"
+    },
+    async (uri) => ({
+      contents: [{
+        uri: uri.href,
+        mimeType: "application/json",
+        text: JSON.stringify(
+          store.getNetwork(20).filter((e) => e.status >= 400 || e.status === 0 || !!e.error),
+          null,
+          2
+        )
+      }]
+    })
+  );
+  server.registerResource(
+    "mergen-agent-trace-context",
+    "mergen://agent/trace-context",
+    {
+      description: "Current W3C traceparent for this Mergen session. Inject into your own HTTP calls via the traceparent header to extend the trace chain. Changes each time a new MCP tool call starts a server span.",
+      mimeType: "application/json"
+    },
+    async (uri) => {
+      const ctx = getCurrentTraceContext();
+      return {
+        contents: [{
+          uri: uri.href,
+          mimeType: "application/json",
+          text: JSON.stringify({
+            traceparent: ctx.traceparent,
+            traceId: ctx.traceId,
+            spanId: ctx.spanId,
+            usage: "Inject as HTTP header: traceparent: <value>"
+          }, null, 2)
+        }]
+      };
+    }
+  );
+  server.registerResource(
+    "mergen-corpus-postmortems",
+    "mergen://corpus/postmortems",
+    {
+      description: "Recent incident postmortems from the corpus (up to 10). Each entry contains: root cause, fix command, MTTR, confidence, git SHA/branch, and resolution method. Read this before triaging a new incident to check for corpus precedent \u2014 if this failure mode has appeared before, the top postmortem gives you the verified fix immediately. Updated automatically each time an incident is resolved.",
+      mimeType: "application/json"
+    },
+    async (uri) => {
+      const postmortems = postmortemStore.list(10).map((pm) => ({
+        pid: pm.pid,
+        tag: pm.tag,
+        service: pm.service,
+        rootCause: pm.rootCause,
+        fixCommand: pm.fixCommand,
+        confidence: pm.confidence,
+        mttrMs: pm.mttrMs,
+        resolvedAutonomously: pm.resolvedAutonomously,
+        generatedAt: new Date(pm.generatedAt).toISOString(),
+        gitBranch: pm.gitBranch,
+        gitSha: pm.gitSha
+      }));
+      const stats = postmortemStore.tagStats();
+      return {
+        contents: [{
+          uri: uri.href,
+          mimeType: "application/json",
+          text: JSON.stringify({
+            totalPostmortems: postmortemStore.count(),
+            failureModeCoverage: stats.length,
+            recentPostmortems: postmortems
+          }, null, 2)
+        }]
+      };
+    }
+  );
+  server.registerResource(
+    "mergen-corpus-topology",
+    "mergen://corpus/topology",
+    {
+      description: "Service \xD7 failure-mode topology matrix from the incident corpus. Shows which services have recurring failure patterns, incident counts, and MTTR per service. Use this to understand systemic brittleness before triaging a new incident. A service with high incident count and high MTTR is a refactor candidate.",
+      mimeType: "application/json"
+    },
+    async (uri) => {
+      const incidents = incidentStore.list(void 0, 200);
+      const serviceMap = /* @__PURE__ */ new Map();
+      for (const inc of incidents) {
+        const svc = inc.service ?? "unknown";
+        if (!serviceMap.has(svc)) {
+          serviceMap.set(svc, { incidentCount: 0, failureModes: /* @__PURE__ */ new Map(), mttrs: [], lastIncidentAt: 0 });
+        }
+        const entry = serviceMap.get(svc);
+        entry.incidentCount++;
+        if (inc.tag) {
+          entry.failureModes.set(inc.tag, (entry.failureModes.get(inc.tag) ?? 0) + 1);
+        }
+        if (inc.resolvedAt && inc.createdAt) {
+          entry.mttrs.push(inc.resolvedAt - inc.createdAt);
+        }
+        if (inc.createdAt > entry.lastIncidentAt) {
+          entry.lastIncidentAt = inc.createdAt;
+        }
+      }
+      const topology = [...serviceMap.entries()].map(([service, data]) => ({
+        service,
+        incidentCount: data.incidentCount,
+        avgMttrMs: data.mttrs.length > 0 ? Math.round(data.mttrs.reduce((a, b) => a + b, 0) / data.mttrs.length) : null,
+        topFailureModes: [...data.failureModes.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5).map(([tag, count]) => ({ tag, count })),
+        lastIncidentAt: data.lastIncidentAt > 0 ? new Date(data.lastIncidentAt).toISOString() : null
+      })).sort((a, b) => b.incidentCount - a.incidentCount);
+      return {
+        contents: [{
+          uri: uri.href,
+          mimeType: "application/json",
+          text: JSON.stringify({
+            totalServices: topology.length,
+            totalIncidents: incidents.length,
+            topology
+          }, null, 2)
+        }]
+      };
+    }
+  );
+  registerFileContextResource(server);
+}
+export {
+  registerResources
+};

package/dist/intelligence/normalize.js

@@ -0,0 +1,108 @@
+const CONFUSABLES = [
+  // ── r ─────────────────────────────────────────────────────────────────────
+  [/[гԹ𝐫𝑟𝒓𝓻𝔯𝕣𝖗𝗿𝘳𝙧ɼɾᵣ]/gu, "r"],
+  // ── m ─────────────────────────────────────────────────────────────────────
+  [/[𝐦𝑚𝒎𝓶𝔪𝕞𝖒𝗺𝘮𝙢ṃɱ]/gu, "m"],
+  // ── d ─────────────────────────────────────────────────────────────────────
+  [/[ԁ𝐝𝑑𝒅𝓭𝔡𝕕𝖉𝗱𝘥𝙙ḋḍ]/gu, "d"],
+  // ── o / 0 ─────────────────────────────────────────────────────────────────
+  [/[оοσ𝐨𝑜𝒐𝓸𝔬𝕠𝖔𝗼𝘰𝙤ọởôöō]/gu, "o"],
+  // ── p ─────────────────────────────────────────────────────────────────────
+  [/[рρ𝐩𝑝𝒑𝓹𝔭𝕡𝖕𝗽𝘱𝙥]/gu, "p"],
+  // ── e ─────────────────────────────────────────────────────────────────────
+  [/[еε𝐞𝑒𝒆𝓮𝔢𝕖𝖊𝗲𝘦𝙚ëēėę]/gu, "e"],
+  // ── t ─────────────────────────────────────────────────────────────────────
+  [/[τ𝐭𝑡𝒕𝓽𝔱𝕥𝖙𝗍𝘵𝙩ţ]/gu, "t"],
+  // ── a ─────────────────────────────────────────────────────────────────────
+  [/[аα𝐚𝑎𝒂𝓪𝔞𝕒𝖆𝗮𝘢𝙖äãāăâ]/gu, "a"],
+  // ── b ─────────────────────────────────────────────────────────────────────
+  [/[Ь𝐛𝑏𝒃𝓫𝔟𝕓𝖇𝗯𝘣𝙗ḃ]/gu, "b"],
+  // ── c ─────────────────────────────────────────────────────────────────────
+  [/[сϲ𝐜𝑐𝒄𝓬𝔠𝕔𝖈𝗰𝘤𝙘çć]/gu, "c"],
+  // ── f ─────────────────────────────────────────────────────────────────────
+  [/[𝐟𝑓𝒇𝓯𝔣𝕗𝖋𝗳𝘧𝙛ḟ]/gu, "f"],
+  // ── g ─────────────────────────────────────────────────────────────────────
+  [/[𝐠𝑔𝒈𝓰𝔤𝕘𝖌𝗴𝘨𝙜ğǧ]/gu, "g"],
+  // ── i ─────────────────────────────────────────────────────────────────────
+  [/[іϊ𝐢𝑖𝒊𝓲𝔦𝕚𝖎𝗶𝘪𝙞ìíîïīįı]/gu, "i"],
+  // ── k ─────────────────────────────────────────────────────────────────────
+  [/[κ𝐤𝑘𝒌𝓴𝔨𝕜𝖐𝗸𝘬𝙠]/gu, "k"],
+  // ── l ─────────────────────────────────────────────────────────────────────
+  [/[ӏ𝐥𝑙𝒍𝓵𝔩𝕝𝖑𝗹𝘭𝙡ļłℓ]/gu, "l"],
+  // ── n ─────────────────────────────────────────────────────────────────────
+  [/[η𝐧𝑛𝒏𝓷𝔫𝕟𝖓𝗻𝘯𝙣ñńņ]/gu, "n"],
+  // ── s ─────────────────────────────────────────────────────────────────────
+  [/[ѕ𝐬𝑠𝒔𝓼𝔰𝕤𝖘𝗌𝘴𝙨śšş]/gu, "s"],
+  // ── u ─────────────────────────────────────────────────────────────────────
+  [/[υ𝐮𝑢𝒖𝓾𝔲𝕦𝖚𝗎𝘶𝙪ùúûüū]/gu, "u"],
+  // ── v ─────────────────────────────────────────────────────────────────────
+  [/[ν𝐯𝑣𝒗𝓿𝔳𝕧𝖛𝗏𝘷𝙫]/gu, "v"],
+  // ── w ─────────────────────────────────────────────────────────────────────
+  [/[ω𝐰𝑤𝒘𝔀𝔴𝕨𝖜𝗐𝘸𝙬]/gu, "w"],
+  // ── x ─────────────────────────────────────────────────────────────────────
+  [/[х×𝐱𝑥𝒙𝔁𝔵𝕩𝖝𝗑𝘹𝙭]/gu, "x"],
+  // ── y ─────────────────────────────────────────────────────────────────────
+  [/[уγ𝐲𝑦𝒚𝔂𝔶𝕪𝖞𝗒𝘺𝙮ýÿ]/gu, "y"],
+  // ── z ─────────────────────────────────────────────────────────────────────
+  [/[𝐳𝑧𝒛𝔃𝔷𝕫𝖟𝗓𝘻𝙯źżž]/gu, "z"]
+];
+function _deconfuse(s) {
+  let out = s;
+  for (const [re, replacement] of CONFUSABLES) {
+    out = out.replace(re, replacement);
+  }
+  return out;
+}
+function _stripInvisible(s) {
+  return s.replace(new RegExp("\\p{Cf}", "gu"), "");
+}
+function _decodeEscapesOnce(s) {
+  return s.replace(
+    /\\x([0-9a-fA-F]{2})|\\u([0-9a-fA-F]{4})|\\([0-7]{1,3})|\\(.)/g,
+    (_m, hex, uni, oct, generic) => {
+      if (hex !== void 0) return String.fromCharCode(parseInt(hex, 16));
+      if (uni !== void 0) return String.fromCharCode(parseInt(uni, 16));
+      if (oct !== void 0) return String.fromCharCode(parseInt(oct, 8));
+      return generic;
+    }
+  );
+}
+function _decodeEscapesFixedPoint(s) {
+  let out = s;
+  for (let i = 0; i < 5; i++) {
+    const next = _decodeEscapesOnce(out);
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+function _unwrapBase64(s) {
+  if (!/base64/i.test(s)) return s;
+  const tokenRe = /[A-Za-z0-9+/]{12,}={0,2}/g;
+  let appended = "";
+  let match;
+  let guard = 0;
+  while ((match = tokenRe.exec(s)) && guard < 10) {
+    guard++;
+    try {
+      const decoded = Buffer.from(match[0], "base64").toString("utf8");
+      if (decoded && /^[\t\n\r\x20-\x7E]+$/.test(decoded) && /[a-zA-Z]/.test(decoded)) {
+        appended += " " + decoded;
+      }
+    } catch {
+    }
+  }
+  return appended ? s + appended : s;
+}
+function normalizeForMatching(s) {
+  let out = s.normalize("NFKC");
+  out = _stripInvisible(out);
+  out = _decodeEscapesFixedPoint(out);
+  out = out.replace(/['"]/g, "");
+  out = _unwrapBase64(out);
+  out = out.replace(/\s+/g, " ").toLowerCase();
+  return _deconfuse(out);
+}
+export {
+  normalizeForMatching
+};

package/dist/intelligence/notifications.js

@@ -0,0 +1,83 @@
+import { postThreadReply } from "./slack.js";
+import logger from "../sensor/logger.js";
+const DISCORD_WEBHOOK_URL = process.env.MERGEN_DISCORD_WEBHOOK_URL;
+function stripSlackMarkdown(text) {
+  return text.replace(/\*([^*]+)\*/g, "**$1**").replace(/_([^_]+)_/g, "_$1_").replace(/`([^`]+)`/g, "`$1`");
+}
+async function notifyDiscord(message, opts) {
+  if (!DISCORD_WEBHOOK_URL) return;
+  const content = stripSlackMarkdown(message).slice(0, 2e3);
+  const color = opts?.priority === "urgent" || opts?.priority === "high" ? 15548997 : 5793266;
+  const res = await fetch(DISCORD_WEBHOOK_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      embeds: [{ description: content, color }]
+    }),
+    signal: AbortSignal.timeout(5e3)
+  });
+  if (!res.ok) logger.debug({ status: res.status }, "notifications: Discord non-2xx");
+}
+const NTFY_BASE_URL = process.env.MERGEN_NTFY_URL ?? "https://ntfy.sh";
+const NTFY_TOPIC = process.env.MERGEN_NTFY_TOPIC ?? "";
+const NTFY_PRIORITY_MAP = {
+  low: "2",
+  normal: "3",
+  high: "4",
+  urgent: "5"
+};
+async function notifyNtfy(message, opts) {
+  if (!NTFY_TOPIC) return;
+  const priority = NTFY_PRIORITY_MAP[opts?.priority ?? "normal"];
+  const plainText = message.replace(/[*_`]/g, "").slice(0, 4096);
+  const headers = {
+    "Content-Type": "text/plain; charset=utf-8",
+    "Priority": priority,
+    "Title": "Mergen"
+  };
+  if (opts?.tags?.length) headers["Tags"] = opts.tags.join(",");
+  const ntfyToken = process.env.MERGEN_NTFY_TOKEN;
+  if (ntfyToken) headers["Authorization"] = `Bearer ${ntfyToken}`;
+  const res = await fetch(`${NTFY_BASE_URL}/${NTFY_TOPIC}`, {
+    method: "POST",
+    headers,
+    body: plainText,
+    signal: AbortSignal.timeout(5e3)
+  });
+  if (!res.ok) logger.debug({ status: res.status }, "notifications: ntfy non-2xx");
+}
+async function notify(pid, message, opts) {
+  const tasks = [];
+  if (pid) {
+    tasks.push(
+      postThreadReply(pid, message).catch((err) => {
+        logger.debug({ err }, "notifications: Slack delivery failed");
+      })
+    );
+  }
+  if (DISCORD_WEBHOOK_URL) {
+    tasks.push(
+      notifyDiscord(message, opts).catch((err) => {
+        logger.debug({ err }, "notifications: Discord delivery failed");
+      })
+    );
+  }
+  if (NTFY_TOPIC) {
+    tasks.push(
+      notifyNtfy(message, opts).catch((err) => {
+        logger.debug({ err }, "notifications: ntfy delivery failed");
+      })
+    );
+  }
+  if (tasks.length === 0) {
+    logger.debug({ pid }, "notifications: no channels configured \u2014 message dropped");
+  }
+  await Promise.all(tasks);
+}
+function hasNotificationChannel() {
+  return !!(process.env.MERGEN_SLACK_BOT_TOKEN || DISCORD_WEBHOOK_URL || NTFY_TOPIC);
+}
+export {
+  hasNotificationChannel,
+  notify
+};

package/dist/intelligence/oidc-issuer.js

@@ -0,0 +1,87 @@
+import fs from "fs";
+import { generateKeyPair, exportJWK, exportPKCS8, importPKCS8, SignJWT } from "jose";
+import { randomUUID, createHash } from "crypto";
+import { OIDC_SIGNING_KEY_FILE, DATA_DIR } from "../sensor/paths.js";
+import logger from "../sensor/logger.js";
+const ALG = "RS256";
+let _cached = null;
+async function loadOrGenerateKey() {
+  if (_cached) return _cached;
+  const envKey = process.env.MERGEN_OIDC_SIGNING_KEY;
+  if (envKey) {
+    const pkcs8 = envKey.includes("\\n") ? envKey.replace(/\\n/g, "\n") : envKey;
+    const privateKey2 = await importPKCS8(pkcs8, ALG, { extractable: true });
+    const publicJwk2 = await exportJWK(privateKey2);
+    delete publicJwk2.d;
+    delete publicJwk2.p;
+    delete publicJwk2.q;
+    delete publicJwk2.dp;
+    delete publicJwk2.dq;
+    delete publicJwk2.qi;
+    const kid2 = createHash("sha256").update(String(publicJwk2.n)).digest("hex").slice(0, 16);
+    _cached = { kid: kid2, privateKey: privateKey2, publicJwk: { ...publicJwk2, kid: kid2, alg: ALG, use: "sig" } };
+    return _cached;
+  }
+  try {
+    const raw = fs.readFileSync(OIDC_SIGNING_KEY_FILE, "utf8");
+    const persisted = JSON.parse(raw);
+    const privateKey2 = await importPKCS8(persisted.pkcs8, ALG, { extractable: true });
+    const publicJwk2 = await exportJWK(privateKey2);
+    delete publicJwk2.d;
+    delete publicJwk2.p;
+    delete publicJwk2.q;
+    delete publicJwk2.dp;
+    delete publicJwk2.dq;
+    delete publicJwk2.qi;
+    _cached = { kid: persisted.kid, privateKey: privateKey2, publicJwk: { ...publicJwk2, kid: persisted.kid, alg: ALG, use: "sig" } };
+    return _cached;
+  } catch {
+  }
+  const { publicKey, privateKey } = await generateKeyPair(ALG, { extractable: true });
+  const kid = randomUUID();
+  const publicJwk = { ...await exportJWK(publicKey), kid, alg: ALG, use: "sig" };
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true, mode: 448 });
+    const pkcs8 = await exportPKCS8(privateKey);
+    fs.writeFileSync(OIDC_SIGNING_KEY_FILE, JSON.stringify({ kid, pkcs8 }), { encoding: "utf8", mode: 384 });
+  } catch (err) {
+    logger.warn({ err }, "oidc-issuer: could not persist signing key \u2014 using an ephemeral in-process key. Tokens issued before a restart will fail verification against the JWKS this process now exposes.");
+  }
+  _cached = { kid, privateKey, publicJwk };
+  return _cached;
+}
+function getIssuerUrl() {
+  return process.env.MERGEN_PUBLIC_URL ?? null;
+}
+function isOidcIssuerConfigured() {
+  return getIssuerUrl() !== null;
+}
+async function getPublicJwks() {
+  const { publicJwk } = await loadOrGenerateKey();
+  return { keys: [publicJwk] };
+}
+const DEFAULT_TTL_SECONDS = 300;
+const MAX_TTL_SECONDS = 3600;
+async function issueFederationToken(request) {
+  const issuer = getIssuerUrl();
+  if (!issuer) {
+    throw new Error("oidc-issuer: MERGEN_PUBLIC_URL must be set to issue federation tokens \u2014 the target cloud provider needs a reachable issuer URL to fetch JWKS from.");
+  }
+  const { kid, privateKey } = await loadOrGenerateKey();
+  const ttl = Math.min(request.ttlSeconds ?? DEFAULT_TTL_SECONDS, MAX_TTL_SECONDS);
+  return new SignJWT({ sub: `agent:${request.agentId}` }).setProtectedHeader({ alg: ALG, kid }).setIssuedAt().setIssuer(issuer).setAudience(request.audience).setExpirationTime(`${ttl}s`).sign(privateKey);
+}
+function _resetOidcIssuerForTesting() {
+  _cached = null;
+  try {
+    fs.unlinkSync(OIDC_SIGNING_KEY_FILE);
+  } catch {
+  }
+}
+export {
+  _resetOidcIssuerForTesting,
+  getIssuerUrl,
+  getPublicJwks,
+  isOidcIssuerConfigured,
+  issueFederationToken
+};