mergen-server 1.4.0

package/dist/intelligence/tools-change-timeline.js

@@ -0,0 +1,154 @@
+import { z } from "zod";
+import { store } from "../sensor/buffer.js";
+import { incidentStore } from "../sensor/incident-store.js";
+import { commitContextStore } from "../sensor/commit-context-store.js";
+import { detectAiCommit } from "./ai-commit.js";
+import { trackCall } from "./tools-state.js";
+function fmtMs(ms) {
+  if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
+  const m = Math.floor(ms / 6e4);
+  const s = Math.round(ms % 6e4 / 1e3);
+  return s > 0 ? `${m}m ${s}s` : `${m}m`;
+}
+function isoDate(ts) {
+  return new Date(ts).toISOString().slice(0, 16).replace("T", " ");
+}
+function registerChangeTimelineTools(server) {
+  server.registerTool(
+    "get_change_timeline",
+    {
+      description: 'Returns a chronological change timeline for a service \u2014 the "what changed?" context dump before diagnosis begins. Pulls deployments, CI runs, incidents, and AI-generated commits from the execution buffer. AI-written commits are flagged so on-call engineers know which changes have no human author to ask. Call this first when a PagerDuty alert fires, before reconstruct_context or triage_incident.',
+      inputSchema: {
+        service: z.string().optional().describe('Service name to filter (e.g. "api", "payments-worker"). Omit to get all services.'),
+        days: z.number().int().min(1).max(30).optional().describe("How many days back to look (default: 7).")
+      }
+    },
+    async ({ service, days = 7 }) => {
+      trackCall("get_change_timeline");
+      const windowMs = days * 24 * 60 * 60 * 1e3;
+      const since = Date.now() - windowMs;
+      const entries = [];
+      const ctxWindow = commitContextStore.listByWindow(since, Date.now(), service);
+      const ctxBySha = new Map(ctxWindow.map((c) => [c.sha.slice(0, 7), c]));
+      const deploys = store.getDeployments(100, void 0, since);
+      for (const d of deploys) {
+        if (service && d.service && d.service !== service) continue;
+        const statusIcon = d.status === "success" ? "\u2705" : d.status === "failure" ? "\u274C" : d.status === "rollback" ? "\u23EA" : "\u25B6";
+        const svcLabel = d.service ? ` [${d.service}]` : "";
+        const aiSignal = d.actor ? detectAiCommit(d.actor, d.actor) : { detected: false, tool: null };
+        const ctx = ctxBySha.get(d.sha.slice(0, 7)) ?? commitContextStore.getBySha(d.sha);
+        const prTag = ctx?.prNumber ? ` PR#${ctx.prNumber}` : "";
+        const approverTag = ctx?.approvers.length ? ` \u2713 ${ctx.approvers.join(", ")}` : "";
+        entries.push({
+          ts: d.timestamp,
+          kind: "deploy",
+          label: `${statusIcon} Deploy${svcLabel} ${d.shortSha ?? d.sha.slice(0, 7)} \u2192 ${d.environment}${d.version ? ` v${d.version}` : ""}${d.actor ? ` by ${d.actor}` : ""}${prTag}${approverTag}`,
+          aiGenerated: aiSignal.detected || ctx?.aiGenerated || void 0,
+          aiTool: aiSignal.tool ?? ctx?.aiTool
+        });
+      }
+      const ciEvents = store.getCIEvents(100, void 0, since);
+      for (const c of ciEvents) {
+        const statusIcon = c.status === "success" ? "\u2705" : c.status === "failure" ? "\u274C" : "\u23F8";
+        const branchLabel = c.branch ? ` (${c.branch})` : "";
+        entries.push({
+          ts: c.timestamp,
+          kind: "ci",
+          label: `${statusIcon} CI ${c.provider.replace("_", " ")} \xB7 ${c.job}${branchLabel} ${c.sha.slice(0, 7)}${c.status === "failure" && c.failedTests?.length ? ` \u2014 ${c.failedTests.length} test(s) failed` : ""}`
+        });
+      }
+      const incidents = incidentStore.list(void 0, 200).filter((i) => {
+        if (i.createdAt < since) return false;
+        if (service && i.service && i.service !== service) return false;
+        return true;
+      });
+      for (const inc of incidents) {
+        const statusIcon = inc.status === "resolved" ? inc.resolvedAutonomously ? "\u{1F916}" : "\u2705" : "\u{1F534}";
+        const mttr = inc.resolvedAt ? ` MTTR: ${fmtMs(inc.resolvedAt - inc.createdAt)}` : "";
+        const svcLabel = inc.service ? ` [${inc.service}]` : "";
+        entries.push({
+          ts: inc.createdAt,
+          kind: "incident",
+          label: `${statusIcon} Incident${svcLabel} \xB7 ${inc.tag || "unknown"} \xB7 conf ${Math.round(inc.confidence * 100)}%${mttr}`
+        });
+      }
+      const errors = store.getLogs(200, "error", since);
+      const seenShas = /* @__PURE__ */ new Set();
+      for (const e of errors) {
+        const gs = e.gitSuspect;
+        if (!gs || seenShas.has(gs.sha)) continue;
+        if (service && e.url && !e.url.includes(service)) continue;
+        const signal = gs.aiGenerated ? { detected: true, tool: null } : detectAiCommit(gs.summary, gs.author);
+        if (signal.detected) {
+          seenShas.add(gs.sha);
+          entries.push({
+            ts: e.timestamp,
+            kind: "ai_commit",
+            label: `\u{1F916} AI commit ${gs.sha.slice(0, 7)} \u2014 "${gs.summary.slice(0, 80)}" by ${gs.author}${signal.tool ? ` (${signal.tool})` : ""}`,
+            aiGenerated: true,
+            aiTool: signal.tool
+          });
+        }
+      }
+      entries.sort((a, b) => a.ts - b.ts);
+      if (entries.length === 0) {
+        const corpusNote = incidentStore.list(void 0, 1).length === 0 ? "\n\n_No incident history yet \u2014 trigger an incident or run `mergen-server demo` to seed the corpus._" : `
+
+_No events in the last ${days} day${days !== 1 ? "s" : ""}${service ? ` for service "${service}"` : ""}. Try a wider window._`;
+        return {
+          content: [{
+            type: "text",
+            text: `## Change Timeline${service ? ` \u2014 ${service}` : ""}
+
+_No changes recorded in the last ${days} day${days !== 1 ? "s" : ""}._ ${corpusNote}`
+          }]
+        };
+      }
+      const aiCount = entries.filter((e) => e.aiGenerated).length;
+      const incidentCount = entries.filter((e) => e.kind === "incident").length;
+      const deployCount = entries.filter((e) => e.kind === "deploy").length;
+      const header = [
+        `## Change Timeline${service ? ` \u2014 ${service}` : ""} (last ${days} day${days !== 1 ? "s" : ""})`,
+        "",
+        `${deployCount} deploy${deployCount !== 1 ? "s" : ""} \xB7 ${incidentCount} incident${incidentCount !== 1 ? "s" : ""} \xB7 ${aiCount} AI-generated commit${aiCount !== 1 ? "s" : ""} flagged`,
+        ""
+      ];
+      const rows = entries.map((e) => {
+        const aiTag = e.aiGenerated ? " \u26A0\uFE0F AI" : "";
+        return `- \`${isoDate(e.ts)}\` ${e.label}${aiTag}`;
+      });
+      const footer = [];
+      if (aiCount > 0) {
+        footer.push(
+          "",
+          `> \u26A0\uFE0F **${aiCount} AI-generated commit${aiCount !== 1 ? "s" : ""} in this window.** These have no human author to consult during triage.`,
+          `> Call \`reconstruct_context\` for causal analysis or \`explain_service(service: "${service ?? "service-name"}")\` for failure mode history.`
+        );
+      }
+      const prEntries = ctxWindow.filter((c) => c.prTitle && c.prNumber).slice(0, 3);
+      if (prEntries.length > 0) {
+        footer.push("", "### PR Intent Archive");
+        for (const c of prEntries) {
+          const issueRefs = c.linkedIssues.slice(0, 3).map((i) => i.ref).join(", ");
+          const approvers = c.approvers.length ? `Approved by: ${c.approvers.join(", ")}` : "No recorded approvers";
+          const aiTag = c.aiGenerated ? ` \u{1F916} ${c.aiTool ?? "AI"}` : "";
+          footer.push(
+            `**PR #${c.prNumber}${aiTag}**: ${c.prTitle}`,
+            `_Author: @${c.author ?? "?"} \xB7 ${approvers}${issueRefs ? ` \xB7 Refs: ${issueRefs}` : ""}_`,
+            c.prBody ? `> ${c.prBody.split("\n").filter((l) => l.trim()).slice(0, 2).join(" ").slice(0, 200)}` : "",
+            ""
+          );
+        }
+      }
+      return {
+        content: [{
+          type: "text",
+          text: [...header, ...rows, ...footer].join("\n")
+        }]
+      };
+    }
+  );
+}
+export {
+  registerChangeTimelineTools
+};

package/dist/intelligence/tools-credentials.js

@@ -0,0 +1,117 @@
+import { z } from "zod";
+import { trackCall, withTierGate } from "./tools-state.js";
+import { getTierForTool } from "./tool-manifest.js";
+import { requestEphemeralCredential } from "./credential-broker.js";
+import { resolveAgentIdentity } from "./agent-identity.js";
+function renderCredential(cred) {
+  const common = [
+    `**Provider:** ${cred.provider}`,
+    `**Scope:** ${cred.scope}`,
+    `**Expires:** ${cred.expiration.toISOString()}`
+  ];
+  switch (cred.provider) {
+    case "aws":
+      return [
+        ...common,
+        `**Role:** ${cred.roleArn}`,
+        "",
+        "```",
+        `AWS_ACCESS_KEY_ID=${cred.accessKeyId}`,
+        `AWS_SECRET_ACCESS_KEY=${cred.secretAccessKey}`,
+        `AWS_SESSION_TOKEN=${cred.sessionToken}`,
+        "```"
+      ];
+    case "gcp":
+      return [
+        ...common,
+        `**Service account:** ${cred.serviceAccountEmail}`,
+        "",
+        "```",
+        `GCP_ACCESS_TOKEN=${cred.gcpAccessToken}`,
+        "```"
+      ];
+    case "azure":
+      return [
+        ...common,
+        `**App (client) id:** ${cred.clientId}`,
+        "",
+        // Unlike AWS/GCP, no raw bearer token is handed out here — the real
+        // Azure token stays server-side so Mergen can actually stop honoring
+        // it at `expiration` (see azure-broker.ts). Route Azure API calls
+        // through the proxy path instead of calling Azure directly.
+        `**Proxy path:** \`${cred.proxyPath}\``,
+        `Route your Azure API calls through this Mergen server at the path above (e.g. \`GET {mergen-server}${cred.proxyPath}/subscriptions/...\`) instead of calling Azure directly \u2014 Mergen forwards the request with the real credential attached, and stops forwarding once this credential expires.`
+      ];
+  }
+}
+function registerCredentialTools(server) {
+  server.registerTool(
+    "request_credential",
+    {
+      description: "Request an ephemeral, task-scoped cloud credential (AWS / GCP / Azure) instead of using a long-lived secret. The credential is minted for THIS verified agent, scoped to a named, operator-defined role/service-account/app (configured in ~/.mergen/credential-scopes.json), and expires automatically. Use it right before a cloud operation and let it expire \u2014 never store it. The scope name maps to a provider + target chosen by an operator; you cannot request arbitrary permissions, only a pre-approved scope. Call `get_status` or GET /credentials/scopes to see which scope names are configured. This request passes through the same policy firewall as every other tool \u2014 an operator can require human approval for prod-scoped requests.",
+      inputSchema: {
+        scope: z.string().min(1).describe('The configured scope name to request (e.g. "deploy-write"). Maps to one provider + role/SA/app.'),
+        task_id: z.string().min(1).describe("A short identifier for the task this credential is for \u2014 recorded in the audit trail and (AWS) the STS session name."),
+        duration_seconds: z.number().int().positive().optional().describe("Requested lifetime in seconds. Clamped to the scope's configured maximum (and the provider's own hard cap).")
+      }
+    },
+    withTierGate(getTierForTool("request_credential"), async ({ scope, task_id, duration_seconds }) => {
+      trackCall("request_credential");
+      const { agentId, verified } = resolveAgentIdentity();
+      if (!verified || !agentId) {
+        return {
+          content: [{
+            type: "text",
+            text: [
+              "\u{1F6AB} **Credential request refused \u2014 no verified agent identity.**",
+              "",
+              "Ephemeral credentials are only issued to a verified agent. Set `MERGEN_AGENT_TOKEN` for this MCP process (see `mergen-server agent-register`) so Mergen can bind the credential to a known identity."
+            ].join("\n")
+          }],
+          isError: true
+        };
+      }
+      try {
+        const cred = await requestEphemeralCredential({
+          agentId,
+          taskId: task_id,
+          scope,
+          durationSeconds: duration_seconds,
+          // Cloud-mode tenant scoping: MERGEN_TENANT_ID is the process-wide
+          // tenant this MCP server serves. Undefined in local/self-hosted mode,
+          // which is exactly the "available regardless of tenant" default.
+          callerTenantId: process.env.MERGEN_TENANT_ID
+        });
+        return {
+          content: [{
+            type: "text",
+            text: [
+              "## Ephemeral credential issued",
+              "",
+              ...renderCredential(cred),
+              "",
+              "_Task-scoped and short-lived \u2014 use it now and let it expire. Do not persist it._"
+            ].join("\n")
+          }]
+        };
+      } catch (err) {
+        return {
+          content: [{
+            type: "text",
+            text: [
+              "\u{1F6AB} **Credential request failed.**",
+              "",
+              err instanceof Error ? err.message : String(err),
+              "",
+              "Check the scope name against GET /credentials/scopes, and confirm the provider-side federation trust (STS role / GCP Workload Identity Pool / Azure federated credential) is configured."
+            ].join("\n")
+          }],
+          isError: true
+        };
+      }
+    })
+  );
+}
+export {
+  registerCredentialTools
+};

package/dist/intelligence/tools-datadog.js

@@ -0,0 +1,233 @@
+import { z } from "zod";
+import { fetchLatestErrorTrace, fetchSpans, isConfigured } from "../datadog/client.js";
+import { compact } from "../datadog/compactor.js";
+import { getActiveIncident } from "../datadog/incident-state.js";
+import { fingerprintFromFact } from "../datadog/fingerprinter.js";
+import { memoryStore, formatMttr } from "../datadog/memory-store.js";
+import { trackCall, withTierGate } from "./tools-state.js";
+import { getTierForTool } from "./tool-manifest.js";
+function buildPatternHeader(fact) {
+  const fingerprint = fingerprintFromFact(fact);
+  const stats = memoryStore.benchmarkStats(fingerprint);
+  const similar = memoryStore.findSimilar(fingerprint, 3);
+  if (!stats || stats.occurrences < 2) return "";
+  const p50 = stats.p50MttrMs ? formatMttr(stats.p50MttrMs) : "N/A";
+  const lastSeen = stats.lastSeenAt ? `${Math.round((Date.now() - stats.lastSeenAt) / 864e5)}d ago` : "unknown";
+  const lines = [
+    `## Pattern Memory \u2014 seen ${stats.occurrences} time${stats.occurrences !== 1 ? "s" : ""} before`,
+    `**p50 MTTR: ${p50}** \xB7 Most common fix: **${stats.topResolutionType}** (${stats.topResolutionCount}/${stats.occurrences}) \xB7 Last seen: ${lastSeen}`,
+    `Fingerprint: \`${fingerprint}\``
+  ];
+  const withFix = similar.filter((r) => r.fixPrTitle || r.fixSummary).slice(0, 2);
+  if (withFix.length > 0) {
+    lines.push("", "**Previous fixes:**");
+    for (const r of withFix) {
+      const fix = r.fixPrTitle ? `[${r.fixPrTitle}](${r.fixPrUrl ?? "#"})` : r.fixSummary ?? "";
+      const when = `${Math.round((Date.now() - r.firedAt) / 864e5)}d ago`;
+      lines.push(`- ${when} \xB7 ${r.resolutionType} \xB7 ${fix}`);
+    }
+  }
+  lines.push("", "---", "");
+  return lines.join("\n");
+}
+const NOT_CONFIGURED_MSG = [
+  "## Datadog not configured",
+  "",
+  "Run the following to connect Mergen to Datadog:",
+  "```",
+  "mergen-server init",
+  "```",
+  "",
+  "Or set environment variables before starting the server:",
+  "```",
+  "export DD_API_KEY=<your-api-key>",
+  "export DD_APP_KEY=<your-app-key>",
+  "mergen-server start",
+  "```"
+].join("\n");
+function registerGetIncidentContext(server) {
+  registerDatadogTools(server, { onlyGetIncidentContext: true });
+}
+function registerDatadogTools(server, opts) {
+  server.registerTool(
+    "get_incident_context",
+    {
+      description: "PRIMARY on-call tool. Fetches the current production incident from Datadog, compacts raw trace telemetry (500KB \u2192 1KB Runtime Fact), and maps the error to your local source code so the AI can propose an immediate fix. If a PagerDuty alert fired recently the context is pre-fetched and returned instantly. Call this first whenever a production error is reported.",
+      inputSchema: {
+        service: z.string().optional().describe(
+          'Datadog service name (e.g. "payment-gateway"). Auto-detected from active PagerDuty alert if omitted.'
+        ),
+        since_minutes: z.number().int().min(1).max(60).optional().describe("Look-back window in minutes (default 10)")
+      }
+    },
+    async ({ service, since_minutes = 10 }) => {
+      trackCall("get_incident_context");
+      if (!isConfigured()) {
+        return { content: [{ type: "text", text: NOT_CONFIGURED_MSG }] };
+      }
+      const active = getActiveIncident();
+      if (active?.runtimeFact) {
+        const ageMin = Math.round((Date.now() - active.firedAt) / 6e4);
+        const parts = [
+          `## Active Incident: ${active.alertTitle}`,
+          `*Fired ${ageMin}m ago \xB7 Service: \`${active.service}\`*`,
+          active.alertUrl ? `*PagerDuty: ${active.alertUrl}*` : "",
+          ""
+        ];
+        const blame = active.blameAttribution;
+        if (blame?.topCandidate) {
+          const sha8 = blame.topCandidate.sha.slice(0, 8);
+          const pct = Math.round(blame.confidence * 100);
+          const label = blame.confidenceLabel;
+          parts.push("### Causal Attribution");
+          parts.push(
+            `**Deploy \`${sha8}\` \u2014 ${pct}% confidence [${label}]**  ` + (blame.lowConfidence ? "\u26A0\uFE0F Below threshold \u2014 investigate before acting." : "")
+          );
+          parts.push("");
+          parts.push("**Signal breakdown:**");
+          for (const [name, sig] of Object.entries(blame.signals)) {
+            const bar = sig.available ? `${Math.round(sig.score * 100)}%` : "n/a";
+            parts.push(`- **${name}** (${bar} \xD7 ${sig.weight} = +${sig.contribution.toFixed(2)}): ${sig.detail}`);
+          }
+          parts.push("");
+          parts.push(`> ${blame.explanation}`);
+          if (blame.changedFiles.length > 0) {
+            parts.push("");
+            parts.push(`**Files in deploy:** ${blame.changedFiles.slice(0, 8).join(", ")}${blame.changedFiles.length > 8 ? ` (+${blame.changedFiles.length - 8} more)` : ""}`);
+          }
+          if (blame.topCandidate.prUrl) parts.push(`**PR:** ${blame.topCandidate.prUrl}`);
+          parts.push("", "---", "");
+        }
+        parts.push(active.runtimeFact);
+        return {
+          content: [{
+            type: "text",
+            text: parts.filter(Boolean).join("\n")
+          }]
+        };
+      }
+      const configuredServices = (process.env.MERGEN_SERVICES ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+      const targetService = service ?? active?.service;
+      if (!targetService && configuredServices.length === 0) {
+        return {
+          content: [{
+            type: "text",
+            text: [
+              "## No active incident detected",
+              "",
+              "Provide a `service` name to query Datadog directly:",
+              "```",
+              'get_incident_context(service: "payment-gateway")',
+              "```",
+              "",
+              "Or configure monitored services with:",
+              "`MERGEN_SERVICES=payment-gateway,auth-service node dist/index.js`",
+              "",
+              "Or connect PagerDuty by adding this webhook URL to your PagerDuty service:",
+              "`POST http://127.0.0.1:3000/webhooks/pagerduty`",
+              "",
+              "PagerDuty will then auto-trigger context fetching on every new incident."
+            ].join("\n")
+          }]
+        };
+      }
+      const servicesToTry = targetService ? [targetService] : configuredServices;
+      try {
+        const to = /* @__PURE__ */ new Date();
+        const from = new Date(to.getTime() - since_minutes * 60 * 1e3);
+        let result = null;
+        let resolvedService = servicesToTry[0] ?? "unknown";
+        for (const svc of servicesToTry) {
+          const r = await fetchLatestErrorTrace(svc, since_minutes);
+          if (r) {
+            result = r;
+            resolvedService = svc;
+            break;
+          }
+        }
+        const checkedServices = servicesToTry.join(", ");
+        if (!result) {
+          return {
+            content: [{
+              type: "text",
+              text: `No error traces found for service(s) \`${checkedServices}\` in the last ${since_minutes} minutes.
+
+Either the service is healthy or the service name doesn't match Datadog exactly.
+Check your Datadog APM service list at: https://app.datadoghq.com/apm/services
+
+` + (servicesToTry.length > 1 ? `Checked ${servicesToTry.length} services. Add more with MERGEN_SERVICES=svc1,svc2.` : `Set MERGEN_SERVICES=svc1,svc2 to auto-scan multiple services.`)
+            }]
+          };
+        }
+        const { fact } = await compact({
+          spans: result.spans,
+          traceId: result.traceId,
+          timeWindow: { from, to }
+        });
+        const patternHeader = buildPatternHeader(fact);
+        return { content: [{ type: "text", text: patternHeader + fact.markdown }] };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+          content: [{ type: "text", text: `Failed to fetch Datadog data: ${msg}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  if (opts?.onlyGetIncidentContext) return;
+  server.registerTool(
+    "get_datadog_trace",
+    {
+      description: "Fetches and compacts a specific Datadog trace by trace ID. Use this when you already have a trace ID from a Datadog URL, a log line, or a Sentry event. Returns the same 1KB Runtime Fact as get_incident_context.",
+      inputSchema: {
+        trace_id: z.string().describe("Datadog trace ID (from a URL like /apm/traces?query=trace_id:XXX)"),
+        service: z.string().optional().describe("Service name to scope the search (improves speed)"),
+        since_minutes: z.number().int().min(1).max(60).optional().describe("How far back to look for this trace (default 15 minutes)")
+      }
+    },
+    withTierGate(getTierForTool("get_datadog_trace"), async ({ trace_id, service, since_minutes = 15 }) => {
+      trackCall("get_datadog_trace");
+      if (!isConfigured()) {
+        return {
+          content: [{ type: "text", text: NOT_CONFIGURED_MSG }],
+          isError: true
+        };
+      }
+      try {
+        const to = /* @__PURE__ */ new Date();
+        const from = new Date(to.getTime() - since_minutes * 60 * 1e3);
+        const allSpans = await fetchSpans({ service, from, to, limit: 200 });
+        const traceSpans = allSpans.filter(
+          (s) => s.traceId === trace_id || s.traceId.endsWith(trace_id) || trace_id.endsWith(s.traceId)
+        );
+        if (traceSpans.length === 0) {
+          return {
+            content: [{
+              type: "text",
+              text: `No spans found for trace \`${trace_id}\` in the last ${since_minutes} minutes.
+
+Try increasing \`since_minutes\` or verify the trace ID is correct.`
+            }]
+          };
+        }
+        const { fact } = await compact({
+          spans: traceSpans,
+          traceId: trace_id,
+          timeWindow: { from, to }
+        });
+        return { content: [{ type: "text", text: fact.markdown }] };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+          content: [{ type: "text", text: `Failed to fetch trace: ${msg}` }],
+          isError: true
+        };
+      }
+    })
+  );
+}
+export {
+  registerDatadogTools,
+  registerGetIncidentContext
+};