mergen-server 1.4.0

package/dist/intelligence/shell-ast.js

@@ -0,0 +1,145 @@
+import bashParse from "bash-parser";
+const INERT_TEXT_COMMANDS = /* @__PURE__ */ new Set(["echo", "printf", "print"]);
+const RE_INVOKE_COMMANDS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "ksh", "eval"]);
+const MESSAGE_TEXT_COMMANDS = /* @__PURE__ */ new Set(["git", "gh", "glab", "hg", "svn", "jj"]);
+const MESSAGE_FLAGS = /* @__PURE__ */ new Set(["-m", "--message", "-b", "--body", "--description"]);
+function stripMessageFlagValues(cmdName, args) {
+  if (!MESSAGE_TEXT_COMMANDS.has(cmdName.toLowerCase())) return args;
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (/^--(message|body|description)=/.test(a)) continue;
+    if (MESSAGE_FLAGS.has(a)) {
+      i++;
+      continue;
+    }
+    out.push(a);
+  }
+  return out;
+}
+function walkWord(word, result) {
+  for (const exp of word?.expansion ?? []) {
+    if (exp?.type === "CommandExpansion" && typeof exp.command === "string") {
+      const nested = parseShellCommand(exp.command);
+      if (nested) {
+        result.commands.push(...nested);
+      } else {
+        result.incomplete = true;
+      }
+    }
+  }
+}
+function _readsStdinAsScript(cmd) {
+  const name = (cmd?.name?.text ?? "").toLowerCase();
+  if (!RE_INVOKE_COMMANDS.has(name) || name === "eval") return false;
+  const suffix = (cmd.suffix ?? []).filter((w) => w?.type === "Word").map((w) => w.text);
+  return !suffix.includes("-c");
+}
+function walk(node, result, depth = 0, suppressInert = true) {
+  if (!node || depth > 20) return;
+  switch (node.type) {
+    case "Script":
+    case "CompoundList":
+      for (const c of node.commands ?? []) walk(c, result, depth + 1, suppressInert);
+      return;
+    case "LogicalExpression":
+      walk(node.left, result, depth + 1, suppressInert);
+      walk(node.right, result, depth + 1, suppressInert);
+      return;
+    case "Pipeline": {
+      const pipelineSuppress = suppressInert && !(node.commands ?? []).some(_readsStdinAsScript);
+      for (const c of node.commands ?? []) walk(c, result, depth + 1, pipelineSuppress);
+      return;
+    }
+    case "Subshell":
+      walk(node.list, result, depth + 1, suppressInert);
+      return;
+    case "If":
+      walk(node.clause, result, depth + 1, suppressInert);
+      walk(node.then, result, depth + 1, suppressInert);
+      if (node.else) walk(node.else, result, depth + 1, suppressInert);
+      return;
+    case "For":
+      for (const w of node.wordlist ?? []) walkWord(w, result);
+      walk(node.do, result, depth + 1, suppressInert);
+      return;
+    case "While":
+    case "Until":
+      walk(node.clause, result, depth + 1, suppressInert);
+      walk(node.do, result, depth + 1, suppressInert);
+      return;
+    case "Case":
+      walkWord(node.clause, result);
+      for (const item of node.cases ?? []) {
+        for (const w of item.pattern ?? []) walkWord(w, result);
+        walk(item.body, result, depth + 1, suppressInert);
+      }
+      return;
+    case "Function":
+      walk(node.body, result, depth + 1, suppressInert);
+      return;
+    case "Command": {
+      const name = node.name?.text ?? "";
+      walkWord(node.name, result);
+      const prefixWords = (node.prefix ?? []).filter((w) => typeof w?.text === "string");
+      if (prefixWords.length > 0) {
+        result.commands.push({ name: "", args: prefixWords.map((w) => w.text) });
+      }
+      const argWords = (node.suffix ?? []).filter((w) => w?.type === "Word");
+      const args = argWords.map((w) => w.text);
+      for (const w of argWords) walkWord(w, result);
+      const isInert = suppressInert && INERT_TEXT_COMMANDS.has(name.toLowerCase());
+      if (isInert) {
+        result.inertText.push(...args);
+      } else {
+        result.commands.push({ name, args: stripMessageFlagValues(name, args) });
+      }
+      if (RE_INVOKE_COMMANDS.has(name.toLowerCase())) {
+        const script = name.toLowerCase() === "eval" ? args.join(" ") : args[args.indexOf("-c") + 1];
+        if (script) {
+          const nested = parseShellCommand(script);
+          if (nested) result.commands.push(...nested);
+          else result.incomplete = true;
+        }
+      }
+      return;
+    }
+    default:
+      result.incomplete = true;
+  }
+}
+function parseShellCommand(cmd) {
+  try {
+    const ast = bashParse(cmd);
+    const result = { commands: [], inertText: [], incomplete: false };
+    walk(ast, result);
+    if (result.incomplete) return null;
+    return result.commands;
+  } catch {
+    return null;
+  }
+}
+function analyzeCommands(commands) {
+  const raw = commands.join(" ");
+  let ast;
+  try {
+    ast = bashParse(raw);
+  } catch {
+    return { haystack: raw, commands: [] };
+  }
+  const result = { commands: [], inertText: [], incomplete: false };
+  walk(ast, result, 0);
+  if (result.incomplete) return { haystack: raw, commands: [] };
+  const executed = result.commands.map((c) => [c.name, ...c.args].join(" ")).join(" ");
+  const inertNames = raw.match(/\b(echo|printf|print)\b/gi) ?? [];
+  const haystack = [executed, ...inertNames].join(" ").trim() || raw;
+  return { haystack, commands: result.commands };
+}
+function buildCommandHaystack(commands) {
+  return analyzeCommands(commands).haystack;
+}
+export {
+  analyzeCommands,
+  buildCommandHaystack,
+  parseShellCommand
+};

package/dist/intelligence/siem-forward.js

@@ -0,0 +1,104 @@
+import logger from "../sensor/logger.js";
+function webhookConfigured() {
+  return !!process.env.MERGEN_SIEM_WEBHOOK_URL;
+}
+function splunkHecConfigured() {
+  return !!(process.env.MERGEN_SPLUNK_HEC_URL && process.env.MERGEN_SPLUNK_HEC_TOKEN);
+}
+function elasticConfigured() {
+  return !!(process.env.MERGEN_ELASTIC_URL && process.env.MERGEN_ELASTIC_API_KEY);
+}
+function siemForwardingConfigured() {
+  return webhookConfigured() || splunkHecConfigured() || elasticConfigured();
+}
+function ledgerVerdictForwarded(verdict) {
+  const raw = process.env.MERGEN_SIEM_LEDGER_VERDICTS ?? "block,hold";
+  return raw.split(",").map((s) => s.trim().toLowerCase()).includes(verdict);
+}
+async function postWebhook(body) {
+  const url = process.env.MERGEN_SIEM_WEBHOOK_URL;
+  const headers = { "Content-Type": "application/json" };
+  if (process.env.MERGEN_SIEM_WEBHOOK_TOKEN) {
+    headers.Authorization = `Bearer ${process.env.MERGEN_SIEM_WEBHOOK_TOKEN}`;
+  }
+  const res = await fetch(url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(5e3)
+  });
+  if (!res.ok) throw new Error(`SIEM webhook POST failed: HTTP ${res.status}`);
+}
+async function postSplunkHec(event, timeMs, sourcetype) {
+  const url = process.env.MERGEN_SPLUNK_HEC_URL;
+  const token = process.env.MERGEN_SPLUNK_HEC_TOKEN;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Splunk ${token}` },
+    body: JSON.stringify({ time: Math.floor(timeMs / 1e3), sourcetype, event }),
+    signal: AbortSignal.timeout(5e3)
+  });
+  if (!res.ok) throw new Error(`Splunk HEC POST failed: HTTP ${res.status}`);
+}
+async function postElastic(event, index, timeMs) {
+  const base = process.env.MERGEN_ELASTIC_URL.replace(/\/$/, "");
+  const apiKey = process.env.MERGEN_ELASTIC_API_KEY;
+  const meta = JSON.stringify({ index: { _index: index } });
+  const doc = JSON.stringify({ "@timestamp": new Date(timeMs).toISOString(), ...event });
+  const body = `${meta}
+${doc}
+`;
+  const res = await fetch(`${base}/_bulk`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-ndjson",
+      Authorization: `ApiKey ${apiKey}`
+    },
+    body,
+    signal: AbortSignal.timeout(5e3)
+  });
+  if (!res.ok) throw new Error(`Elastic _bulk POST failed: HTTP ${res.status}`);
+}
+function dispatch(env) {
+  if (webhookConfigured()) {
+    postWebhook(env.webhookBody).catch((err) => {
+      logger.warn({ err, id: env.id }, "siem-forward: webhook delivery failed");
+    });
+  }
+  if (splunkHecConfigured()) {
+    postSplunkHec(env.splunkEvent, env.timeMs, env.splunkSourcetype).catch((err) => {
+      logger.warn({ err, id: env.id }, "siem-forward: Splunk HEC delivery failed");
+    });
+  }
+  if (elasticConfigured()) {
+    postElastic(env.splunkEvent, env.elasticIndex, env.timeMs).catch((err) => {
+      logger.warn({ err, id: env.id }, "siem-forward: Elastic delivery failed");
+    });
+  }
+}
+function forwardToSiem(entry) {
+  dispatch({
+    webhookBody: { source: "mergen_agent_blunder_log", ...entry },
+    splunkEvent: entry,
+    splunkSourcetype: "mergen:agent_blunder",
+    elasticIndex: "mergen-blunders",
+    timeMs: entry.recordedAt,
+    id: entry.id
+  });
+}
+function forwardLedgerToSiem(entry) {
+  if (!siemForwardingConfigured() || !ledgerVerdictForwarded(entry.verdict)) return;
+  dispatch({
+    webhookBody: { source: "mergen_action_ledger", ...entry },
+    splunkEvent: entry,
+    splunkSourcetype: "mergen:action_ledger",
+    elasticIndex: "mergen-ledger",
+    timeMs: entry.ts,
+    id: entry.id
+  });
+}
+export {
+  forwardLedgerToSiem,
+  forwardToSiem,
+  siemForwardingConfigured
+};

package/dist/intelligence/slack-digest.js

@@ -0,0 +1,151 @@
+import fs from "fs";
+import path from "path";
+import { DATA_DIR } from "../sensor/paths.js";
+import logger from "../sensor/logger.js";
+import { incidentStore } from "../sensor/incident-store.js";
+import { getStats, getRealVerdictCount, isCorpusSeeded } from "./calibration.js";
+import { getOverrideSummary, getStaleOverrides } from "./override-corpus.js";
+const BOT_TOKEN = process.env.MERGEN_SLACK_BOT_TOKEN ?? "";
+const SLACK_CHANNEL = process.env.MERGEN_SLACK_CHANNEL ?? "";
+async function _post(payload) {
+  if (!BOT_TOKEN || !SLACK_CHANNEL) return;
+  try {
+    const resp = await fetch("https://slack.com/api/chat.postMessage", {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${BOT_TOKEN}`,
+        "Content-Type": "application/json; charset=utf-8"
+      },
+      body: JSON.stringify({ channel: SLACK_CHANNEL, ...payload })
+    });
+    const json = await resp.json();
+    if (!json.ok) logger.warn({ error: json.error }, "slack-digest: postMessage failed");
+  } catch (err) {
+    logger.warn({ err }, "slack-digest: fetch error");
+  }
+}
+async function postDailyDigest() {
+  if (!BOT_TOKEN || !SLACK_CHANNEL) {
+    logger.warn("slack-digest: MERGEN_SLACK_BOT_TOKEN or MERGEN_SLACK_CHANNEL not set \u2014 skipping digest");
+    return;
+  }
+  const now = Date.now();
+  const since24h = now - 24 * 60 * 60 * 1e3;
+  const allIncidents = incidentStore.list();
+  const recent = allIncidents.filter((i) => i.createdAt >= since24h);
+  const resolved = recent.filter((i) => i.status === "resolved");
+  const autonomous = resolved.filter((i) => i.resolvedAutonomously);
+  const avgMttrMin = resolved.length > 0 ? Math.round(
+    resolved.reduce((sum, i) => sum + ((i.resolvedAt ?? now) - i.createdAt), 0) / resolved.length / 6e4
+  ) : null;
+  const stats = getStats();
+  const driftingTags = stats.filter(
+    (s) => s.trusted && s.trendDelta != null && s.trendDelta < -0.05
+  );
+  const realVerdicts = getRealVerdictCount();
+  const seeded = isCorpusSeeded();
+  const overrideSummary = getOverrideSummary().slice(0, 3);
+  const staleOverrides = getStaleOverrides(60);
+  const pendingRunbooks = [];
+  try {
+    const libraryFile = path.join(DATA_DIR, "runbooks", "library.json");
+    if (fs.existsSync(libraryFile)) {
+      const all = JSON.parse(fs.readFileSync(libraryFile, "utf8"));
+      pendingRunbooks.push(...all.filter((r) => !r.approved));
+    }
+  } catch {
+  }
+  const blocks = [
+    {
+      type: "header",
+      text: { type: "plain_text", text: "\u{1F4CB} Mergen Daily Digest", emoji: true }
+    },
+    {
+      type: "context",
+      elements: [{ type: "mrkdwn", text: `Last 24h \xB7 ${(/* @__PURE__ */ new Date()).toUTCString()}` }]
+    },
+    { type: "divider" }
+  ];
+  blocks.push({
+    type: "section",
+    text: {
+      type: "mrkdwn",
+      text: [
+        `*Incidents (last 24h)*`,
+        `\u2022 Total fired: *${recent.length}*`,
+        resolved.length > 0 ? `\u2022 Resolved: *${resolved.length}*` : "",
+        autonomous.length > 0 ? `\u2022 Autonomous resolution: *${autonomous.length}/${resolved.length}* (${Math.round(autonomous.length / resolved.length * 100)}%)` : "",
+        avgMttrMin != null ? `\u2022 Avg MTTR: *${avgMttrMin} min*` : "",
+        recent.length === 0 ? "_No incidents in last 24h_ \u2705" : ""
+      ].filter(Boolean).join("\n")
+    }
+  });
+  const calibLines = [
+    `*Calibration*`,
+    seeded ? `\u2022 \u26A0\uFE0F Warm-up phase \u2014 ${realVerdicts}/10 real verdicts recorded` : `\u2022 ${realVerdicts} real verdicts \u2014 confidence is environment-calibrated`,
+    driftingTags.length > 0 ? `\u2022 \u26A0\uFE0F Accuracy regression on: ${driftingTags.map((t) => `\`${t.tag}\``).join(", ")}` : "\u2022 All detectors stable"
+  ];
+  blocks.push({ type: "section", text: { type: "mrkdwn", text: calibLines.join("\n") } });
+  if (overrideSummary.length > 0) {
+    const overrideLines = [
+      `*Recent Override Patterns*`,
+      ...overrideSummary.map(
+        (o) => `\u2022 \`${o.tag}\` \u2014 ${o.dominantReason ?? "on-call-discretion"} (${o.total}\xD7)`
+      )
+    ];
+    blocks.push({ type: "section", text: { type: "mrkdwn", text: overrideLines.join("\n") } });
+  }
+  if (staleOverrides.length > 0) {
+    const topStale = staleOverrides.slice(0, 3);
+    const staleLines = [
+      `*\u26A0\uFE0F Override Corpus \u2014 ${staleOverrides.length} Stale ${staleOverrides.length === 1 ? "Entry" : "Entries"} (>60 days without review)*`,
+      ...topStale.map((e) => {
+        const age = Math.floor((Date.now() - (e.reviewedAt ?? e.recordedAt)) / 864e5);
+        return `\u2022 \`${e.incidentTag}\` \xB7 ${e.service} \xB7 ${e.overrideReason} \u2014 _${age}d since last review_`;
+      }),
+      staleOverrides.length > 3 ? `_\u2026and ${staleOverrides.length - 3} more. Review at_ \`GET /override-corpus/stale\`` : "",
+      `_Re-affirm: \`POST /overrides/{id}/review\`  \xB7  Remove: \`DELETE /overrides/{id}\`_`
+    ].filter(Boolean);
+    blocks.push({ type: "section", text: { type: "mrkdwn", text: staleLines.join("\n") } });
+  }
+  if (pendingRunbooks.length > 0) {
+    blocks.push({
+      type: "section",
+      text: {
+        type: "mrkdwn",
+        text: [
+          `*Runbooks Awaiting Approval*`,
+          ...pendingRunbooks.map(
+            (r) => r ? `\u2022 \`${r.name}\` (\`${r.incidentTag}\`) \u2014 ${r.approvals.length}/${r.requiredApprovers} approvals` : ""
+          )
+        ].filter(Boolean).join("\n")
+      }
+    });
+  }
+  blocks.push({
+    type: "context",
+    elements: [{ type: "mrkdwn", text: "Mergen Operational Digest \xB7 <http://127.0.0.1:3000/dashboard|Dashboard> \xB7 <http://127.0.0.1:3000/incidents/impact-report|Impact Report>" }]
+  });
+  await _post({ blocks });
+  logger.info({ incidents: recent.length, resolved: resolved.length }, "slack-digest: posted daily digest");
+}
+function msUntilNext9amUtc() {
+  const now = /* @__PURE__ */ new Date();
+  const next = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), 9, 0, 0, 0));
+  if (next.getTime() <= now.getTime()) next.setUTCDate(next.getUTCDate() + 1);
+  return next.getTime() - now.getTime();
+}
+function startSlackDailyDigest() {
+  const delay = msUntilNext9amUtc();
+  logger.info({ nextDigestIn: `${Math.round(delay / 6e4)}min` }, "slack-digest: scheduled daily digest at 09:00 UTC");
+  setTimeout(() => {
+    void postDailyDigest();
+    setInterval(() => {
+      void postDailyDigest();
+    }, 24 * 60 * 60 * 1e3).unref();
+  }, delay).unref();
+}
+export {
+  postDailyDigest,
+  startSlackDailyDigest
+};

package/dist/intelligence/slack-override-loop.js

@@ -0,0 +1,217 @@
+import fs from "fs";
+import path from "path";
+import { DATA_DIR } from "../sensor/paths.js";
+import logger from "../sensor/logger.js";
+import { synthesizeRulesFromCorpus } from "./corpus-to-policy.js";
+import { getStores } from "../storage/store-registry.js";
+const BOT_TOKEN = process.env.MERGEN_SLACK_BOT_TOKEN ?? "";
+const SLACK_CHANNEL = process.env.MERGEN_SLACK_CHANNEL ?? "";
+const SYSTEM_TENANT = process.env.MERGEN_SYSTEM_TENANT_ID;
+const POLL_INTERVAL_MS = 6 * 60 * 60 * 1e3;
+const STATE_FILE = path.join(DATA_DIR, "slack-override-loop.json");
+const POSTMORTEM_SIGNALS = [
+  "postmortem",
+  "post-mortem",
+  "post mortem",
+  "root cause",
+  "rca",
+  "fixed by",
+  "incident resolved",
+  "outage resolved",
+  "mitigation",
+  "this was caused by",
+  "we resolved",
+  "issue resolved",
+  "marked resolved",
+  "runbook",
+  "we decided",
+  "going forward",
+  // Negative decision patterns — often appear without a formal postmortem header
+  "don't",
+  "do not",
+  "avoid",
+  "should not",
+  "we learned",
+  "lesson learned",
+  "constraint:",
+  "action item",
+  "takeaway",
+  "going forward",
+  "next time"
+];
+function loadState() {
+  try {
+    if (fs.existsSync(STATE_FILE)) {
+      return JSON.parse(fs.readFileSync(STATE_FILE, "utf8"));
+    }
+  } catch {
+  }
+  return { processedTs: [], lastPollAt: 0 };
+}
+function saveState(state) {
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    const tmp = `${STATE_FILE}.tmp`;
+    state.processedTs = state.processedTs.slice(-5e3);
+    fs.writeFileSync(tmp, JSON.stringify(state, null, 2), "utf8");
+    fs.renameSync(tmp, STATE_FILE);
+  } catch (err) {
+    logger.warn({ err }, "slack-override-loop: failed to persist state");
+  }
+}
+async function _get(path2) {
+  if (!BOT_TOKEN) return null;
+  try {
+    const resp = await fetch(`https://slack.com${path2}`, {
+      headers: { "Authorization": `Bearer ${BOT_TOKEN}` }
+    });
+    return await resp.json();
+  } catch {
+    return null;
+  }
+}
+async function _resolveChannel(nameOrId) {
+  if (/^[CG][A-Z0-9]{6,}$/i.test(nameOrId)) return nameOrId;
+  const clean = nameOrId.replace(/^#/, "").toLowerCase();
+  let cursor;
+  for (let page = 0; page < 3; page++) {
+    const qs = new URLSearchParams({
+      limit: "200",
+      types: "public_channel,private_channel",
+      exclude_archived: "true",
+      ...cursor ? { cursor } : {}
+    });
+    const r = await _get(`/api/conversations.list?${qs}`);
+    if (!r?.ok || !Array.isArray(r.channels)) break;
+    const match = r.channels.find((c) => c.name?.toLowerCase() === clean);
+    if (match?.id) return match.id;
+    if (!r.response_metadata?.next_cursor) break;
+    cursor = r.response_metadata.next_cursor;
+  }
+  return null;
+}
+async function _fetchHistory(channelId, oldest) {
+  const qs = new URLSearchParams({ channel: channelId, oldest, limit: "100" });
+  const r = await _get(`/api/conversations.history?${qs}`);
+  if (!r?.ok || !Array.isArray(r.messages)) return [];
+  return r.messages;
+}
+async function _fetchThread(channelId, threadTs) {
+  const messages = [];
+  let cursor;
+  for (let page = 0; page < 5; page++) {
+    const qs = new URLSearchParams({
+      channel: channelId,
+      ts: threadTs,
+      limit: "100",
+      ...cursor ? { cursor } : {}
+    });
+    const r = await _get(`/api/conversations.replies?${qs}`);
+    if (!r?.ok || !Array.isArray(r.messages)) break;
+    for (const msg of r.messages) {
+      if (msg.text) {
+        const d = new Date(parseFloat(msg.ts) * 1e3);
+        const time = `${d.getUTCHours().toString().padStart(2, "0")}:${d.getUTCMinutes().toString().padStart(2, "0")}`;
+        messages.push(`[${time}] ${msg.text.slice(0, 500)}`);
+      }
+    }
+    if (!r.response_metadata?.next_cursor) break;
+    cursor = r.response_metadata.next_cursor;
+  }
+  return messages.length > 0 ? messages.join("\n") : null;
+}
+async function _postSynthesizedRules(channelId, threadTs) {
+  if (!BOT_TOKEN) return;
+  const newRules = synthesizeRulesFromCorpus();
+  if (newRules.length === 0) return;
+  const lines = newRules.slice(0, 3).map(
+    (s) => `\u2022 *${s.rule.name}* (${s.sourceOccurrences} overrides, action: \`${s.rule.action}\`)`
+  );
+  const payload = {
+    channel: channelId,
+    thread_ts: threadTs,
+    text: `\u{1F4CB} Mergen detected ${newRules.length} new policy pattern${newRules.length !== 1 ? "s" : ""} from this thread.`,
+    blocks: [
+      {
+        type: "section",
+        text: {
+          type: "mrkdwn",
+          text: [
+            `\u{1F4CB} *Mergen detected ${newRules.length} new policy pattern${newRules.length !== 1 ? "s" : ""} from this postmortem.*`,
+            ``,
+            lines.join("\n"),
+            ``,
+            `Review and activate: \`GET /policy-suggestions\` \u2192 \`POST /policies/rules\``
+          ].join("\n")
+        }
+      }
+    ]
+  };
+  try {
+    await fetch("https://slack.com/api/chat.postMessage", {
+      method: "POST",
+      headers: { "Content-Type": "application/json; charset=utf-8", Authorization: `Bearer ${BOT_TOKEN}` },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(8e3)
+    });
+  } catch (err) {
+    logger.warn({ err }, "slack-override-loop: failed to post synthesized rules notification");
+  }
+}
+async function poll() {
+  if (!BOT_TOKEN || !SLACK_CHANNEL) return;
+  const state = loadState();
+  const channelId = await _resolveChannel(SLACK_CHANNEL);
+  if (!channelId) {
+    logger.warn({ channel: SLACK_CHANNEL }, "slack-override-loop: could not resolve channel ID");
+    return;
+  }
+  const oldestTs = String((Date.now() - 7 * 60 * 60 * 1e3) / 1e3);
+  const messages = await _fetchHistory(channelId, oldestTs);
+  let newOverrides = 0;
+  const processedSet = new Set(state.processedTs);
+  for (const msg of messages) {
+    const ts = msg.thread_ts ?? msg.ts;
+    if (processedSet.has(ts)) continue;
+    const text = (msg.text ?? "").toLowerCase();
+    const isPostmortem = POSTMORTEM_SIGNALS.some((s) => text.includes(s));
+    if (!isPostmortem) continue;
+    const threadText = await _fetchThread(channelId, ts);
+    if (!threadText) {
+      processedSet.add(ts);
+      continue;
+    }
+    const overrides = await getStores().overrides.compileOverridesFromSlackThread(threadText, "unknown", SYSTEM_TENANT);
+    if (overrides.length > 0) {
+      newOverrides += overrides.length;
+      logger.info(
+        { count: overrides.length, tag: overrides[0].incidentTag, reason: overrides[0].overrideReason, ts },
+        "slack-override-loop: extracted override patterns from Slack thread"
+      );
+      void _postSynthesizedRules(channelId, ts);
+    }
+    processedSet.add(ts);
+  }
+  state.processedTs = [...processedSet];
+  state.lastPollAt = Date.now();
+  saveState(state);
+  if (newOverrides > 0) {
+    logger.info({ newOverrides }, "slack-override-loop: poll complete \u2014 new patterns added to corpus");
+  } else {
+    logger.debug("slack-override-loop: poll complete \u2014 no new patterns found");
+  }
+}
+function startSlackOverrideLoop() {
+  if (!BOT_TOKEN || !SLACK_CHANNEL) {
+    logger.warn("slack-override-loop: MERGEN_SLACK_BOT_TOKEN or MERGEN_SLACK_CHANNEL not set \u2014 loop disabled");
+    return;
+  }
+  void poll();
+  setInterval(() => {
+    void poll();
+  }, POLL_INTERVAL_MS).unref();
+  logger.info({ intervalHours: 6, channel: SLACK_CHANNEL }, "slack-override-loop: scheduled \u2014 scanning for postmortem patterns every 6h");
+}
+export {
+  startSlackOverrideLoop
+};

package/dist/intelligence/slack-routing.js

@@ -0,0 +1,67 @@
+import fs from "fs";
+import path from "path";
+import { DATA_DIR } from "../sensor/paths.js";
+import logger from "../sensor/logger.js";
+const ROUTING_FILE = path.join(DATA_DIR, "slack-routing.json");
+let _rules = [];
+let _loaded = false;
+function load() {
+  if (_loaded) return;
+  _loaded = true;
+  if (!fs.existsSync(ROUTING_FILE)) return;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(ROUTING_FILE, "utf8"));
+    if (parsed?.version === 1 && Array.isArray(parsed.rules)) {
+      _rules = parsed.rules;
+    }
+  } catch (err) {
+    logger.warn({ err }, "slack-routing: failed to load config, starting empty");
+  }
+}
+function persist() {
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    const tmp = `${ROUTING_FILE}.tmp.${process.pid}.${Date.now()}`;
+    fs.writeFileSync(tmp, JSON.stringify({ version: 1, rules: _rules }, null, 2), "utf8");
+    fs.renameSync(tmp, ROUTING_FILE);
+  } catch (err) {
+    logger.warn({ err }, "slack-routing: failed to persist config");
+  }
+}
+function getRules() {
+  load();
+  return [..._rules];
+}
+function getRoutingForService(service) {
+  load();
+  const exact = _rules.find((r) => r.service === service);
+  if (exact) return exact;
+  return _rules.find((r) => r.service === "*") ?? null;
+}
+function upsertRule(input) {
+  load();
+  const id = input.id ?? `rule-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+  const rule = { ...input, id };
+  const existingIdx = _rules.findIndex((r) => r.id === id || r.service === input.service);
+  if (existingIdx >= 0) {
+    _rules[existingIdx] = rule;
+  } else {
+    _rules.push(rule);
+  }
+  persist();
+  return rule;
+}
+function deleteRule(id) {
+  load();
+  const before = _rules.length;
+  _rules = _rules.filter((r) => r.id !== id);
+  if (_rules.length === before) return false;
+  persist();
+  return true;
+}
+export {
+  deleteRule,
+  getRoutingForService,
+  getRules,
+  upsertRule
+};