mergen-server 1.4.0

package/dist/intelligence/tools-arch.js

@@ -0,0 +1,152 @@
+import { z } from "zod";
+import path from "path";
+import { existsSync } from "node:fs";
+import { trackCall } from "./tools-state.js";
+import { checkBoundaries, formatBoundaryReport } from "./arch-boundaries.js";
+import { scoreChangeRisk, formatRiskReport } from "./change-risk.js";
+import { buildGraph, queryGraph, invalidateGraph } from "./arch-graph.js";
+import { critiqueImplementation, formatCritiqueReport } from "./impl-critic.js";
+function defaultSrcDir() {
+  const cwd = process.cwd();
+  const candidates = [
+    path.resolve(cwd, "src"),
+    path.resolve(cwd, "server/src"),
+    path.resolve(cwd, "../src")
+  ];
+  for (const c of candidates) {
+    if (existsSync(c)) return c;
+  }
+  return path.resolve(cwd, "src");
+}
+function registerArchTools(server) {
+  server.registerTool(
+    "check_arch_violations",
+    {
+      description: "Scan source files for architectural boundary violations \u2014 e.g. sensor/* importing from routes/*. Run this BEFORE and AFTER any code change. Returns a list of violations with file, zone, and rationale. All violations are errors that must be resolved before merging. Default rules: sensor cannot import routes or intelligence; intelligence cannot import routes; datadog cannot import routes or intelligence.",
+      inputSchema: {
+        files: z.array(z.string()).optional().describe("Specific files to check (absolute paths). Omit to scan the full source tree."),
+        srcDir: z.string().optional().describe("Root of the TypeScript source directory. Defaults to ./src or server/src.")
+      }
+    },
+    async ({ files, srcDir }) => {
+      trackCall("check_arch_violations");
+      const dir = srcDir ?? defaultSrcDir();
+      const result = checkBoundaries({
+        srcDir: dir,
+        singleFile: files?.length === 1 ? files[0] : void 0
+      });
+      return { content: [{ type: "text", text: formatBoundaryReport(result, dir) }] };
+    }
+  );
+  server.registerTool(
+    "score_change_risk",
+    {
+      description: "Compute a change risk score (0\u2013100) for a proposed edit before making it. Factors: files touched, subsystems crossed, public API exposure, test blast radius, untested files, critical entry points. Score \u2265 70 \u2192 HIGH RISK, requires human approval. Score 40\u201369 \u2192 MEDIUM, file a confidence report and rollback plan first. Score < 40 \u2192 LOW, safe to proceed. Call this as part of Phase 0 discovery alongside discover_repo_context and report_confidence.",
+      inputSchema: {
+        files: z.array(z.string()).min(1).describe("Files you plan to modify (absolute or relative paths from srcDir)"),
+        srcDir: z.string().optional().describe("Root of the TypeScript source directory. Defaults to ./src or server/src.")
+      }
+    },
+    async ({ files, srcDir }) => {
+      trackCall("score_change_risk");
+      const dir = srcDir ?? defaultSrcDir();
+      const absoluteFiles = files.map((f) => path.isAbsolute(f) ? f : path.resolve(dir, f));
+      const report = scoreChangeRisk(absoluteFiles, dir);
+      return { content: [{ type: "text", text: formatRiskReport(report) }] };
+    }
+  );
+  server.registerTool(
+    "query_arch_graph",
+    {
+      description: 'Traverse the architectural dependency graph of the codebase. Ask "what depends on rollback.ts?" to find all files that would break if rollback.ts changes. Ask "what does routes/incidents.ts depend on?" to understand its dependencies before refactoring. Also returns a zone-level summary of which architectural layers are involved.',
+      inputSchema: {
+        file: z.string().describe("File to query (filename, relative path, or absolute path)"),
+        direction: z.enum(["depends-on", "depended-by"]).describe('"depends-on": what does this file import? "depended-by": what imports this file?'),
+        maxDepth: z.number().int().min(1).max(6).optional().describe("Traversal depth (default 3). Higher values find more transitive dependents."),
+        srcDir: z.string().optional().describe("Root of the TypeScript source directory. Defaults to ./src or server/src.")
+      }
+    },
+    async ({ file, direction, maxDepth = 3, srcDir }) => {
+      trackCall("query_arch_graph");
+      const dir = srcDir ?? defaultSrcDir();
+      const graph = buildGraph(dir);
+      let resolvedFile;
+      if (path.isAbsolute(file) && graph.forward.has(file)) {
+        resolvedFile = file;
+      } else {
+        resolvedFile = graph.files.find(
+          (f) => f.endsWith(`/${file}`) || f.endsWith(`/${file}.ts`) || path.basename(f) === file || path.basename(f) === `${file}.ts`
+        );
+      }
+      if (!resolvedFile) {
+        const similar = graph.files.filter((f) => path.basename(f).toLowerCase().includes(path.basename(file).toLowerCase().replace(".ts", ""))).slice(0, 5).map((f) => path.relative(dir, f));
+        return {
+          content: [{
+            type: "text",
+            text: `File not found in graph: \`${file}\`
+
+Did you mean one of these?
+${similar.map((s) => `  - ${s}`).join("\n") || "  (no similar files found)"}`
+          }]
+        };
+      }
+      const result = queryGraph(graph, { file: resolvedFile, direction, maxDepth });
+      const relFile = path.relative(dir, resolvedFile);
+      const { getZone, ZONE_DISPLAY: ZD } = await import("./arch-graph.js");
+      const lines = [
+        `## Dependency Graph: \`${relFile}\``,
+        "",
+        `**Direction:** ${direction}  |  **Depth:** ${maxDepth}`,
+        ""
+      ];
+      if (result.direct.length === 0) {
+        lines.push(`No direct ${direction === "depends-on" ? "imports" : "importers"} found.`);
+      } else {
+        lines.push(`### Direct (${result.direct.length})`);
+        for (const f of result.direct) {
+          lines.push(`  - \`${path.relative(dir, f)}\` _(${getZone(f)})_`);
+        }
+        lines.push("");
+        if (result.transitive.length > 0) {
+          lines.push(`### Transitive up to depth ${maxDepth} (${result.transitive.length})`);
+          for (const f of result.transitive) {
+            lines.push(`  - \`${path.relative(dir, f)}\` _(${getZone(f)})_`);
+          }
+          lines.push("");
+        }
+        const allDeps = [...result.direct, ...result.transitive];
+        const zoneCount = /* @__PURE__ */ new Map();
+        for (const f of allDeps) {
+          const z2 = getZone(f);
+          zoneCount.set(z2, (zoneCount.get(z2) ?? 0) + 1);
+        }
+        lines.push("### By architectural zone");
+        for (const [zone, count] of zoneCount) {
+          lines.push(`  - **${ZD[zone] ?? zone}**: ${count} file(s)`);
+        }
+      }
+      return { content: [{ type: "text", text: lines.join("\n") }] };
+    }
+  );
+  server.registerTool(
+    "critique_implementation",
+    {
+      description: 'Post-implementation critic \u2014 run this after writing or modifying code. Checks for: architectural boundary violations, ADR violations, security anti-patterns (empty catch, eval, XSS, command injection), hard-coded return values, and missing workflow steps (confidence report). Errors must be resolved before merging; warnings should be addressed. This is the "senior staff engineer review" step in the structured agent workflow.',
+      inputSchema: {
+        files: z.array(z.string()).min(1).describe("Files that were modified (absolute or relative paths from srcDir)"),
+        srcDir: z.string().optional().describe("Root of the TypeScript source directory. Defaults to ./src or server/src.")
+      }
+    },
+    async ({ files, srcDir }) => {
+      trackCall("critique_implementation");
+      const dir = srcDir ?? defaultSrcDir();
+      const absoluteFiles = files.map((f) => path.isAbsolute(f) ? f : path.resolve(dir, f));
+      invalidateGraph(dir);
+      const report = critiqueImplementation({ files: absoluteFiles, srcDir: dir });
+      return { content: [{ type: "text", text: formatCritiqueReport(report) }] };
+    }
+  );
+}
+export {
+  registerArchTools
+};

package/dist/intelligence/tools-autonomy.js

@@ -0,0 +1,495 @@
+import { z } from "zod";
+import { store } from "../sensor/buffer.js";
+import { buildCausalChain, fixActionToCommand } from "./causal.js";
+import { getRecords, recordVerdict, classifyVerdict, recordRemediationVerdict, isCorpusSeeded, getRealVerdictCount } from "./calibration.js";
+import { executeRemediation, extractCommand } from "./autonomy.js";
+import { deriveRollback, executeRollback } from "./rollback.js";
+import { getAutopilotLevel, autopilotLevelPermits, classifyCommandRisk, autopilotLevelDescription } from "./action-risk.js";
+import { hasRecentOverride } from "./override-corpus.js";
+import { getStatsForTag } from "./calibration.js";
+import { trackCall, withTierGate, getActivePlanId } from "./tools-state.js";
+import { getTierForTool } from "./tool-manifest.js";
+import { incidentStore } from "../sensor/incident-store.js";
+import { captureSnapshot } from "./incident-replay.js";
+import { postThreadReply } from "./slack.js";
+import { consumeIncident } from "./usage.js";
+import { generatePostmortem } from "./postmortem-store.js";
+import { runAgentPipeline, renderPipelineStages } from "./agent-pipeline.js";
+import { planningGate } from "./planning-gate.js";
+import { isShadowMode } from "./execution-mode.js";
+import { getExecutionThreshold } from "./threshold-optimizer.js";
+import logger from "../sensor/logger.js";
+import { trace, SpanStatusCode } from "@opentelemetry/api";
+const TEAM_UPGRADE_INCIDENT_THRESHOLD = 5;
+const AUTO_EXECUTE_CONFIDENCE_THRESHOLD = () => {
+  const base = getExecutionThreshold();
+  const provisional = isCorpusSeeded() || getRealVerdictCount() < 10;
+  return provisional ? Math.min(0.95, base + 0.05) : base;
+};
+const tracer = trace.getTracer("mergen-agent");
+function registerAutonomyTools(server) {
+  server.registerTool(
+    "execute_fix",
+    {
+      description: "Execute the fix command embedded in a hypothesis fixHint. Requires confirm=true \u2014 always show the user what will be executed before calling this. After execution, automatically validates whether the fix resolved the issue. Returns: the command executed, stdout/stderr, exit code, and RESOLVED/PARTIAL/REGRESSED verdict. Only call this for HIGH-confidence diagnoses (confidence >= 0.85). Set dry_run=true to preview the command without running it.",
+      inputSchema: {
+        pid: z.string().describe("Prediction id from reconstruct_context \u2014 identifies the hypothesis to fix"),
+        confirm: z.boolean().optional().describe("Must be true to proceed. Set true only after showing the user what will be executed."),
+        since: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER).optional().describe("Unix ms timestamp from before the issue \u2014 used to validate the fix. If omitted, uses now - 60s."),
+        dry_run: z.enum(["true", "false"]).optional().describe('Pass "true" to print the command that would be executed without running it.'),
+        cwd: z.string().optional().describe("Working directory for the command. Defaults to process cwd."),
+        actor: z.string().optional().describe("Identity of the engineer executing the fix (email or username). Used for RBAC and audit log."),
+        service: z.string().optional().describe('Service name (e.g. "api", "auth"). Used for override corpus lookup. If omitted, corpus check is skipped.')
+      }
+    },
+    withTierGate(getTierForTool("execute_fix"), async ({ pid, confirm, since, dry_run, cwd, actor, service }) => {
+      trackCall("execute_fix");
+      const isDryRun = dry_run === "true";
+      const isShadow = isShadowMode();
+      if (isShadow && !isDryRun) {
+        return {
+          content: [{
+            type: "text",
+            text: '\u{1F441}\uFE0F **Shadow mode** \u2014 execute_fix is suppressed. No command was run. Pass `dry_run: "true"` to preview the command that would execute.'
+          }]
+        };
+      }
+      if (!confirm) {
+        return {
+          content: [{
+            type: "text",
+            text: [
+              "\u26A0\uFE0F **confirm required**",
+              "",
+              "You must pass `confirm: true` after showing the user what command will be run.",
+              "Check the hypothesis fixHint for the command, then ask the user to confirm, then call again with confirm=true."
+            ].join("\n")
+          }]
+        };
+      }
+      const records = getRecords();
+      const prediction = records.find((r) => r.pid === pid);
+      if (!prediction) {
+        return {
+          content: [{ type: "text", text: `No prediction found for pid \`${pid}\`. Run reconstruct_context first.` }],
+          isError: true
+        };
+      }
+      const tenantId = process.env.MERGEN_TENANT_ID;
+      const logs = store.getLogs(200, void 0, void 0, tenantId);
+      const network = store.getNetwork(200, void 0, void 0, tenantId);
+      const contexts = store.getContext(20, void 0, tenantId);
+      const terminal = store.getTerminalOutput(100, void 0, void 0, tenantId);
+      const processExits = store.getProcessExits(20, void 0, void 0, tenantId);
+      const causal = await buildCausalChain(logs, network, contexts, void 0, terminal, processExits, [], []);
+      const hyp = causal.hypotheses.find((h) => h.tag === prediction.tag);
+      const fixHint = hyp?.fixHint ?? null;
+      if (!fixHint) {
+        return {
+          content: [{
+            type: "text",
+            text: [
+              `No fixHint available for detector \`${prediction.tag}\`.`,
+              "",
+              "This hypothesis does not have an auto-executable fix \u2014 apply the fix manually and call `validate_fix` afterwards."
+            ].join("\n")
+          }]
+        };
+      }
+      const command = hyp?.fixAction ? fixActionToCommand(hyp.fixAction) : extractCommand(fixHint);
+      if (!command) {
+        return {
+          content: [{
+            type: "text",
+            text: [
+              `**Fix hint:** ${fixHint}`,
+              "",
+              "No executable command found in this fixHint \u2014 the fix must be applied manually.",
+              "Apply the change, then call `validate_fix` to verify."
+            ].join("\n")
+          }]
+        };
+      }
+      const commandTier = classifyCommandRisk(command);
+      if (!isDryRun && !autopilotLevelPermits(command, getAutopilotLevel())) {
+        return {
+          content: [{
+            type: "text",
+            text: `\u26A0\uFE0F **Command blocked** \u2014 tier \`${commandTier}\` exceeds MERGEN_AUTOPILOT_LEVEL=${getAutopilotLevel()}. Apply manually or raise the autopilot level.`
+          }],
+          isError: true
+        };
+      }
+      if (!isDryRun && service) {
+        const now = /* @__PURE__ */ new Date();
+        if (hasRecentOverride(prediction.tag, service, now.getUTCDay(), now.getUTCHours())) {
+          return {
+            content: [{
+              type: "text",
+              text: [
+                `\u{1F6AB} **Blocked by override corpus** \u2014 \`${prediction.tag}\` for service \`${service}\` has been overridden in a similar time window before.`,
+                "",
+                "Review the override history at `GET /override-corpus` and either apply the fix manually or ask an operator to re-review the override at `POST /overrides/:id/review`."
+              ].join("\n")
+            }],
+            isError: true
+          };
+        }
+      }
+      const resolvedActor = actor ?? process.env.MERGEN_MCP_ACTOR ?? "mcp-client";
+      const beforeTs = since ?? Date.now() - 6e4;
+      const execResult = await executeRemediation(command, { cwd, dryRun: isDryRun, actor: resolvedActor });
+      if (execResult.blocked) {
+        return {
+          content: [{
+            type: "text",
+            text: [
+              `\u{1F6AB} **Command blocked by safety filter**`,
+              "",
+              `Command: \`${command}\``,
+              `Reason: ${execResult.blockReason}`,
+              "",
+              "Apply this fix manually and call `validate_fix` afterwards."
+            ].join("\n")
+          }],
+          isError: true
+        };
+      }
+      const lines = [
+        dry_run ? `## Dry Run \u2014 would execute` : `## Fix Executed`,
+        "",
+        `**Command:** \`${command}\``,
+        `**Exit code:** ${execResult.exitCode ?? "killed"}`,
+        `**Duration:** ${execResult.durationMs}ms`,
+        execResult.timedOut ? "\u26A0\uFE0F Command timed out (60s limit)" : "",
+        ""
+      ].filter((l) => l !== void 0);
+      if (execResult.stdout.trim()) {
+        lines.push("**stdout:**", "```", execResult.stdout.trim().slice(0, 2e3), "```", "");
+      }
+      if (execResult.stderr.trim()) {
+        lines.push("**stderr:**", "```", execResult.stderr.trim().slice(0, 1e3), "```", "");
+      }
+      if (isDryRun) {
+        return { content: [{ type: "text", text: lines.join("\n") }] };
+      }
+      if (execResult.ok) {
+        await new Promise((r) => setTimeout(r, 3e3));
+        const windowMs = 6e4;
+        const windowStart = beforeTs - windowMs;
+        const logsBefore = store.getLogs(200, "error", windowStart).filter((e) => e.timestamp < beforeTs);
+        const netBefore = store.getNetwork(200, void 0, windowStart).filter(
+          (e) => e.timestamp < beforeTs && (e.status >= 400 || !!e.error)
+        );
+        const logsAfter = store.getLogs(200, "error", beforeTs);
+        const netAfter = store.getNetwork(200, void 0, beforeTs).filter((e) => e.status >= 400 || !!e.error);
+        const errsBefore = logsBefore.length + netBefore.length;
+        const errsAfter = logsAfter.length + netAfter.length;
+        let verdict;
+        let status;
+        if (errsAfter === 0 && errsBefore > 0) {
+          verdict = "correct";
+          status = "RESOLVED";
+        } else if (errsAfter === 0 && errsBefore === 0) {
+          verdict = "correct";
+          status = "CLEAN";
+        } else if (errsAfter < errsBefore) {
+          verdict = "partial";
+          status = "PARTIAL";
+        } else {
+          verdict = "wrong";
+          status = errsAfter > errsBefore ? "REGRESSED" : "UNRESOLVED";
+        }
+        if (!prediction.verdict) recordVerdict(pid, verdict);
+        lines.push(
+          `## Validation \u2014 ${status}`,
+          "",
+          `| | Before | After |`,
+          `|---|---|---|`,
+          `| Console errors | ${logsBefore.length} | ${logsAfter.length} |`,
+          `| Network errors | ${netBefore.length} | ${netAfter.length} |`,
+          `| **Total** | **${errsBefore}** | **${errsAfter}** |`,
+          "",
+          verdict === "correct" ? "\u2705 Fix confirmed \u2014 issue resolved." : verdict === "partial" ? "\u26A0\uFE0F Partial improvement \u2014 some errors remain." : status === "REGRESSED" ? "\u274C REGRESSED \u2014 more errors after fix than before. Consider reverting." : "\u274C UNRESOLVED \u2014 errors persist. Review the fix and try again."
+        );
+        if (status === "REGRESSED") {
+          const rollback = deriveRollback(command, execResult.stdout);
+          if (rollback.type === "command") {
+            lines.push("", `**Auto-rollback:** attempting \`${rollback.command}\`\u2026`);
+            const rb = await executeRollback(rollback, { cwd, actor: resolvedActor });
+            lines.push(rb.ok ? `\u21A9\uFE0F Rollback succeeded: \`${rb.message}\`` : `\u{1F534} Rollback failed: ${rb.message} \u2014 manual intervention required`);
+          } else {
+            lines.push("", `**Rollback not available:** ${rollback.reason} \u2014 manual revert required.`);
+          }
+        }
+      } else {
+        lines.push("", `\u274C Command failed (exit ${execResult.exitCode}). Fix was not applied \u2014 no validation run.`);
+      }
+      return { content: [{ type: "text", text: lines.join("\n") }] };
+    })
+  );
+  server.registerTool(
+    "triage_incident",
+    {
+      description: "Full autonomous incident triage loop. Pulls recent errors, runs causal analysis, and \u2014 if auto_execute=true and confidence is HIGH (>=85%) \u2014 executes the fix command and validates the result. Returns a structured incident report suitable for a Slack war room or PagerDuty note. Use this for on-call triage when the engineer is not in the IDE. Set auto_execute=false (default) to get the diagnosis only, without running anything.",
+      inputSchema: {
+        service: z.string().optional().describe('Service name to focus on (e.g. "api", "frontend"). If omitted, analyzes all recent events.'),
+        since: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER).optional().describe("Unix ms \u2014 only look at events after this timestamp. Defaults to now - 5 minutes."),
+        auto_execute: z.enum(["true", "false"]).optional().describe(
+          'Pass "true" to automatically execute the fix command when confidence >= 0.85. Default omitted / "false" \u2014 diagnosis only, nothing executed.'
+        ),
+        cwd: z.string().optional().describe("Working directory for any fix command. Defaults to process cwd."),
+        actor: z.string().optional().describe("Identity of the engineer (email or username). Used for RBAC and audit log."),
+        tenant_id: z.string().optional().describe("Cloud mode: restrict analysis to this tenant's events. Required when MERGEN_CLOUD_MODE=true.")
+      }
+    },
+    async ({ service, since, auto_execute, cwd, actor, tenant_id }) => {
+      trackCall("triage_incident");
+      const shouldAutoExecute = auto_execute === "true";
+      const tenantId = tenant_id ?? process.env.MERGEN_TENANT_ID;
+      const incidentResult = await consumeIncident();
+      if (!incidentResult.allowed) {
+        return {
+          content: [{
+            type: "text",
+            text: [
+              `\u26D4 ${incidentResult.notice ?? "Monthly incident limit reached."}`,
+              "",
+              "\u2192 https://mergen.app/pricing"
+            ].join("\n")
+          }],
+          isError: true
+        };
+      }
+      const sinceTs = since ?? Date.now() - 5 * 6e4;
+      logger.info({ service, sinceTs, auto_execute, tenantId }, "triage_incident: starting");
+      const span = tracer.startSpan("mergen.triage_incident", {
+        attributes: {
+          "mergen.service": service ?? "all",
+          "mergen.auto_execute": shouldAutoExecute,
+          "mergen.tenant_id": tenantId ?? ""
+        }
+      });
+      try {
+        const logs = store.getLogs(200, void 0, sinceTs, tenantId);
+        const network = store.getNetwork(200, void 0, sinceTs, tenantId);
+        const contexts = store.getContext(20, sinceTs, tenantId);
+        const terminal = store.getTerminalOutput(100, void 0, sinceTs, tenantId);
+        const processExits = store.getProcessExits(20, void 0, sinceTs, tenantId);
+        const ciEvents = store.getCIEvents(20, void 0, sinceTs, tenantId);
+        const deployments = store.getDeployments(10, void 0, sinceTs, tenantId);
+        if (logs.length === 0 && network.filter((n) => n.status >= 400).length === 0) {
+          span.setAttribute("mergen.status", "clean_buffer");
+          return {
+            content: [{
+              type: "text",
+              text: [
+                "## Triage Report \u2014 No Issues Found",
+                "",
+                service ? `No errors found for service \`${service}\` in the last ${Math.round((Date.now() - sinceTs) / 6e4)} minutes.` : `No errors found in the last ${Math.round((Date.now() - sinceTs) / 6e4)} minutes.`,
+                "",
+                "Buffer is clean. If you expected errors, verify the browser extension is connected and capturing events."
+              ].join("\n")
+            }]
+          };
+        }
+        const causal = await buildCausalChain(logs, network, contexts, sinceTs, terminal, processExits, ciEvents, deployments);
+        const topHyp = causal.hypotheses[0];
+        const errorCount = logs.filter((e) => e.level === "error").length;
+        const netErrors = network.filter((n) => n.status >= 400 || n.error).length;
+        if (topHyp) {
+          span.setAttribute("mergen.incident_tag", topHyp.tag ?? "");
+          span.setAttribute("mergen.confidence_score", topHyp.confidenceScore ?? 0);
+          span.setAttribute("mergen.summary", topHyp.summary ?? "");
+          if (topHyp.fixHint) {
+            span.setAttribute("mergen.fix_hint", topHyp.fixHint);
+          }
+          captureSnapshot({
+            pid: topHyp.pid ?? `mcp-${Date.now()}`,
+            capturedAt: Date.now(),
+            firedAt: sinceTs,
+            logs,
+            // `network` is narrowed to the local NetEventView here (see the
+            // TS2589 note above); cast back to captureSnapshot's real element
+            // type — the runtime value is the full NetworkEvent from the buffer.
+            network,
+            contexts,
+            terminal,
+            processExits,
+            ciEvents,
+            deployments,
+            infraEvents: [],
+            originalTag: topHyp.tag ?? null,
+            originalConfidenceScore: topHyp.confidenceScore ?? null,
+            originalFixHint: topHyp.fixHint ?? null
+          });
+        }
+        const lines = [
+          `## Triage Report${service ? ` \u2014 ${service}` : ""}`,
+          "",
+          `**Window:** ${new Date(sinceTs).toISOString()} \u2192 now`,
+          `**Console errors:** ${errorCount}  |  **Network errors:** ${netErrors}`,
+          ""
+        ];
+        if (!topHyp) {
+          span.setAttribute("mergen.status", "no_hypothesis");
+          lines.push("No hypothesis generated. Errors may be unrelated or below detector threshold.");
+          return { content: [{ type: "text", text: lines.join("\n") }] };
+        }
+        const pct = Math.round((topHyp.confidenceScore ?? 0) * 100);
+        const calStats = getStatsForTag(topHyp.tag);
+        const calibrationLabel = calStats?.isEmpirical ? `calibrated \u2014 ${calStats.verdicts} verdicts on this installation` : "estimated \u2014 runs /feedback after resolution to calibrate";
+        lines.push(
+          `### Root Cause \u2014 ${topHyp.confidence} (${pct}%)`,
+          `_Confidence source: ${calibrationLabel}_`,
+          "",
+          topHyp.summary,
+          ""
+        );
+        if (topHyp.evidence?.length) {
+          lines.push("**Evidence:**");
+          topHyp.evidence.slice(0, 4).forEach((e) => lines.push(`- ${e}`));
+          lines.push("");
+        }
+        if (topHyp.fixHint) {
+          lines.push(`**Fix:** ${topHyp.fixHint}`, "");
+        }
+        const pipeline = runAgentPipeline(causal, {
+          service,
+          executionThreshold: AUTO_EXECUTE_CONFIDENCE_THRESHOLD()
+        });
+        lines.push("", renderPipelineStages(pipeline.stages), "");
+        const command = pipeline.plan?.command ?? (topHyp.fixAction ? fixActionToCommand(topHyp.fixAction) : null) ?? (topHyp.fixHint ? extractCommand(topHyp.fixHint) : null);
+        const execConfidence = topHyp.remediationConfidence ?? topHyp.confidenceScore ?? 0;
+        const execPct = Math.round(execConfidence * 100);
+        const autopilotLevel = getAutopilotLevel();
+        const levelPermits = !command || autopilotLevelPermits(command, autopilotLevel);
+        const isShadow = isShadowMode();
+        const gate = planningGate(topHyp, service ?? "unknown", AUTO_EXECUTE_CONFIDENCE_THRESHOLD());
+        const canAutoExecute = shouldAutoExecute && !isShadow && command && pipeline.verdict === "proceed" && gate.execute && levelPermits;
+        span.setAttribute("mergen.pipeline.verdict", pipeline.verdict ?? "");
+        if (command) {
+          span.setAttribute("mergen.command", command);
+        }
+        if (isShadow && shouldAutoExecute && command) {
+          lines.push(`\u{1F441}\uFE0F **Shadow mode** \u2014 would execute \`${command}\` (remediation: ${execPct}%). No action taken.`, "");
+        }
+        if (shouldAutoExecute && !canAutoExecute && !isShadow) {
+          if (!command) {
+            lines.push("\u26A0\uFE0F Auto-execute skipped \u2014 no executable command found in fixHint.");
+          } else if (pipeline.verdict === "block") {
+            lines.push(`\u26A0\uFE0F Auto-execute blocked by governance pipeline: ${pipeline.blockReason ?? "see pipeline stages above"}`);
+          } else if (!gate.execute) {
+            lines.push(`\u26A0\uFE0F Auto-execute blocked by planning gate: ${gate.reason}`);
+          } else if (!levelPermits) {
+            const commandTier = classifyCommandRisk(command);
+            lines.push(`\u26A0\uFE0F Auto-execute skipped \u2014 MERGEN_AUTOPILOT_LEVEL=${autopilotLevel} permits ${autopilotLevelDescription(autopilotLevel)}. This command is \`${commandTier}\` tier. Set MERGEN_AUTOPILOT_LEVEL=full to enable.`);
+          } else if (topHyp.remediationConfidence !== void 0 && topHyp.remediationConfidence < AUTO_EXECUTE_CONFIDENCE_THRESHOLD()) {
+            lines.push(`\u26A0\uFE0F Auto-execute skipped \u2014 remediation confidence ${execPct}% is below the 85% threshold (diagnosis: ${pct}%). The root cause is identified with high confidence but the fix has variable reliability \u2014 apply manually.`);
+          } else {
+            lines.push(`\u26A0\uFE0F Auto-execute skipped \u2014 confidence ${pct}% is below the 85% threshold for autonomous action.`);
+          }
+          lines.push("");
+        }
+        if (canAutoExecute && command) {
+          span.setAttribute("mergen.execution.attempted", true);
+          lines.push(`### Auto-Execute`, "", `Running: \`${command}\``, "");
+          if (topHyp.pid) {
+            void postThreadReply(topHyp.pid, `\u2699\uFE0F *Mergen auto-executing fix* (diagnosis: ${pct}%, remediation: ${execPct}%)
+\`${command}\``);
+          }
+          const resolvedActor = actor ?? process.env.MERGEN_MCP_ACTOR ?? "mcp-client";
+          const execResult = await executeRemediation(command, { cwd, actor: resolvedActor });
+          if (execResult.blocked) {
+            span.setAttribute("mergen.execution.blocked", true);
+            span.setAttribute("mergen.execution.block_reason", execResult.blockReason ?? "");
+            lines.push(`\u{1F6AB} **Blocked:** ${execResult.blockReason}`, "", "Apply manually and validate.");
+          } else if (!execResult.ok) {
+            span.setAttribute("mergen.execution.ok", false);
+            span.setAttribute("mergen.execution.exit_code", execResult.exitCode ?? -1);
+            lines.push(`\u274C Command failed (exit ${execResult.exitCode}).`);
+            if (execResult.stderr.trim()) {
+              lines.push("", "```", execResult.stderr.trim().slice(0, 500), "```");
+            }
+          } else {
+            span.setAttribute("mergen.execution.ok", true);
+            span.setAttribute("mergen.execution.exit_code", 0);
+            lines.push(`\u2705 Executed (${execResult.durationMs}ms, exit 0)`);
+            if (execResult.stdout.trim()) {
+              lines.push("", "```", execResult.stdout.trim().slice(0, 500), "```");
+            }
+            lines.push("");
+            await new Promise((r) => setTimeout(r, 3e3));
+            const logsAfter = store.getLogs(200, "error", sinceTs, tenantId);
+            const netAfter = store.getNetwork(200, void 0, sinceTs, tenantId).filter((n) => n.status >= 400 || n.error);
+            const afterCount = logsAfter.length + netAfter.length;
+            const beforeCount = errorCount + netErrors;
+            const verdict = classifyVerdict(beforeCount, afterCount);
+            span.setAttribute("mergen.execution.verdict", verdict);
+            if (topHyp.pid) {
+              const existing = getRecords().find((r) => r.pid === topHyp.pid);
+              if (existing && !existing.verdict) recordVerdict(topHyp.pid, verdict);
+              recordRemediationVerdict(topHyp.pid, verdict);
+              if (verdict === "correct") {
+                const resolvedAt = Date.now();
+                const inc = incidentStore.upsert(topHyp.pid, {
+                  status: "resolved",
+                  resolvedAt,
+                  resolvedAutonomously: true,
+                  causallyCorrect: true
+                });
+                generatePostmortem({
+                  pid: topHyp.pid,
+                  tag: topHyp.tag ?? "unknown",
+                  service: service ?? "unknown",
+                  rootCause: topHyp.summary ?? "",
+                  fixCommand: command,
+                  confidence: topHyp.confidenceScore ?? 0,
+                  mttrMs: inc.createdAt ? resolvedAt - inc.createdAt : null,
+                  resolvedAutonomously: true,
+                  evidence: topHyp.evidence,
+                  fixHint: topHyp.fixHint
+                });
+              }
+            }
+            if (afterCount === 0) {
+              lines.push("### Validation \u2014 RESOLVED", "", "\u2705 Zero errors after fix.");
+              if (topHyp.pid) void postThreadReply(topHyp.pid, "\u2705 *RESOLVED* \u2014 zero errors after autonomous fix.");
+            } else if (afterCount < beforeCount) {
+              lines.push("### Validation \u2014 PARTIAL", "", `\u26A0\uFE0F ${afterCount} errors remain (down from ${beforeCount}).`);
+              if (topHyp.pid) void postThreadReply(topHyp.pid, `\u26A0\uFE0F *PARTIAL* \u2014 ${afterCount} errors remain (down from ${beforeCount}).`);
+            } else if (afterCount > beforeCount) {
+              lines.push("### Validation \u2014 REGRESSED", "", `\u274C ${afterCount} errors (up from ${beforeCount}). Consider reverting.`);
+              if (topHyp.pid) void postThreadReply(topHyp.pid, `\u274C *REGRESSED* \u2014 ${afterCount} errors (up from ${beforeCount}). Consider reverting.`);
+            } else {
+              lines.push("### Validation \u2014 UNRESOLVED", "", `\u274C ${afterCount} errors remain (same as before).`);
+              if (topHyp.pid) void postThreadReply(topHyp.pid, `\u274C *UNRESOLVED* \u2014 ${afterCount} errors remain.`);
+            }
+          }
+        } else if (command) {
+          lines.push(`**Command to run:** \`${command}\``);
+          lines.push("", `Call \`execute_fix(pid: "${topHyp.pid ?? "unknown"}", confirm: true)\` to execute, or run manually.`);
+        }
+        const analyzedCount = incidentStore.list(void 0, 200).length;
+        if (getActivePlanId() === "free" && analyzedCount >= TEAM_UPGRADE_INCIDENT_THRESHOLD) {
+          lines.push(
+            "",
+            "---",
+            `> **You've analyzed ${analyzedCount} incidents with Mergen.** The override corpus you've built is your team's most valuable asset \u2014 it prevents repeat failures automatically. The **Team plan ($2,500/mo, 20 seats included)** shares it across your on-call rotation, adds incident replay, and unlocks the shadow analytics PDF your CISO needs before approving autopilot.`,
+            `> \u2192 https://mergen.app/pricing`
+          );
+        }
+        return { content: [{ type: "text", text: lines.join("\n") }] };
+      } catch (err) {
+        span.recordException(err);
+        span.setStatus({ code: SpanStatusCode.ERROR, message: err.message });
+        throw err;
+      } finally {
+        span.end();
+      }
+    }
+  );
+}
+export {
+  registerAutonomyTools
+};