mergen-server 1.4.0

package/dist/intelligence/unclassified-clusters.js

@@ -0,0 +1,87 @@
+import fs from "fs";
+import path from "path";
+import { createHash } from "crypto";
+import { DATA_DIR } from "../sensor/paths.js";
+const CLUSTERS_FILE = path.join(DATA_DIR, "unclassified-clusters.json");
+const MAX_CLUSTERS = 200;
+let _clusters = /* @__PURE__ */ new Map();
+let _loaded = false;
+function load() {
+  if (_loaded) return;
+  _loaded = true;
+  try {
+    if (!fs.existsSync(CLUSTERS_FILE)) return;
+    const parsed = JSON.parse(fs.readFileSync(CLUSTERS_FILE, "utf8"));
+    if (parsed?.version === 1 && Array.isArray(parsed.clusters)) {
+      for (const c of parsed.clusters) {
+        _clusters.set(c.fingerprint, c);
+      }
+    }
+  } catch {
+  }
+}
+function persist() {
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    const clusters = Array.from(_clusters.values()).sort((a, b) => b.count - a.count).slice(0, MAX_CLUSTERS);
+    fs.writeFileSync(CLUSTERS_FILE, JSON.stringify({ version: 1, clusters }), "utf8");
+  } catch {
+  }
+}
+function computeStructuralFingerprint(chain, networkStatuses) {
+  const kinds = chain.map((e) => e.kind);
+  const statusStr = networkStatuses.slice(0, 6).join(",");
+  const kindStr = kinds.join(",");
+  const input = `${kindStr}|${statusStr}`;
+  const fingerprint = createHash("sha256").update(input).digest("hex").slice(0, 16);
+  const kindCounts = kinds.reduce((acc, k) => {
+    acc[k] = (acc[k] ?? 0) + 1;
+    return acc;
+  }, {});
+  const patternParts = Object.entries(kindCounts).map(([k, n]) => n > 1 ? `${k}\xD7${n}` : k);
+  const pattern = patternParts.join(" \u2192 ") + (statusStr ? ` [${statusStr}]` : "");
+  return { fingerprint, pattern };
+}
+function recordUnclassifiedChain(chain, networkStatuses) {
+  load();
+  const { fingerprint, pattern } = computeStructuralFingerprint(chain, networkStatuses);
+  const now = Date.now();
+  const existing = _clusters.get(fingerprint);
+  if (existing) {
+    existing.count++;
+    existing.lastSeen = now;
+  } else {
+    _clusters.set(fingerprint, {
+      fingerprint,
+      pattern,
+      count: 1,
+      firstSeen: now,
+      lastSeen: now,
+      sample: {
+        chainKinds: chain.map((e) => e.kind),
+        networkStatuses: networkStatuses.slice(0, 6),
+        hasErrors: chain.some((e) => e.kind === "error"),
+        hasNetworkFails: chain.some((e) => e.kind === "network_fail")
+      }
+    });
+  }
+  persist();
+}
+function getClusters(minCount = 3) {
+  load();
+  return Array.from(_clusters.values()).filter((c) => c.count >= minCount).sort((a, b) => b.count - a.count);
+}
+function getAllClusters() {
+  load();
+  return Array.from(_clusters.values()).sort((a, b) => b.count - a.count);
+}
+function _resetClustersForTesting() {
+  _clusters = /* @__PURE__ */ new Map();
+  _loaded = true;
+}
+export {
+  _resetClustersForTesting,
+  getAllClusters,
+  getClusters,
+  recordUnclassifiedChain
+};

package/dist/intelligence/usage.js

@@ -0,0 +1,195 @@
+import fs from "fs/promises";
+import { DATA_DIR, USAGE_FILE } from "../sensor/paths.js";
+import { getActivePlanId, getLicenseState } from "./license.js";
+import { getPlan } from "./plans.js";
+import logger from "../sensor/logger.js";
+import { incidentStore } from "../sensor/incident-store.js";
+const currentMonth = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 7);
+let _state = {
+  month: currentMonth(),
+  used: 0,
+  overageReported: 0,
+  overagePending: 0
+};
+let _mutex = Promise.resolve();
+let _sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const MAX_RETRIES = 3;
+const RETRY_BASE_MS = 1e3;
+function _resetForTesting(partial) {
+  _state = {
+    month: currentMonth(),
+    used: 0,
+    overageReported: 0,
+    overagePending: 0,
+    ...partial
+  };
+}
+function _setSleepForTesting(fn) {
+  _sleep = fn;
+}
+async function persist() {
+  try {
+    await fs.mkdir(DATA_DIR, { recursive: true });
+    await fs.writeFile(USAGE_FILE, JSON.stringify(_state, null, 2));
+  } catch (err) {
+    logger.warn({ err }, "usage: persist failed");
+  }
+}
+async function load() {
+  try {
+    const raw = await fs.readFile(USAGE_FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    _state = {
+      month: parsed.month ?? currentMonth(),
+      used: parsed.used ?? 0,
+      overageReported: parsed.overageReported ?? 0,
+      overagePending: parsed.overagePending ?? 0
+    };
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      logger.warn({ err }, "usage: load failed");
+    }
+  }
+}
+async function maybeRollover() {
+  const now = currentMonth();
+  if (_state.month === now) return;
+  if (_state.overagePending > 0) {
+    await _flushOverage();
+  }
+  const unflushed = _state.overagePending;
+  _state = { month: now, used: 0, overageReported: 0, overagePending: unflushed };
+}
+async function _flushOverage() {
+  const license = getLicenseState();
+  const apiKey = process.env.LS_API_KEY;
+  if (!apiKey || !license?.lsSubscriptionItemId || _state.overagePending <= 0) return;
+  const pending = _state.overagePending;
+  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+    if (attempt > 0) await _sleep(RETRY_BASE_MS * attempt);
+    try {
+      const res = await fetch(
+        `https://api.lemonsqueezy.com/v1/subscription-items/${license.lsSubscriptionItemId}`,
+        {
+          method: "PATCH",
+          headers: {
+            "content-type": "application/json",
+            "authorization": `Bearer ${apiKey}`
+          },
+          body: JSON.stringify({
+            data: {
+              type: "subscription-items",
+              id: license.lsSubscriptionItemId,
+              attributes: { quantity: _state.overageReported + pending }
+            }
+          })
+        }
+      );
+      if (res.ok) {
+        _state.overageReported += pending;
+        _state.overagePending = 0;
+        await persist();
+        logger.info({ credits: pending }, "usage: overage flushed");
+        return;
+      }
+      logger.warn({ status: res.status, attempt }, "usage: overage flush failed, retrying");
+    } catch (err) {
+      logger.warn({ err, attempt }, "usage: overage flush error");
+    }
+  }
+  logger.warn({ pending }, "usage: overage flush gave up after max retries");
+}
+async function flushOverageOnShutdown() {
+  await _flushOverage();
+}
+async function consumeCredit() {
+  return new Promise((resolve, reject) => {
+    _mutex = _mutex.then(() => _consume().then(resolve, reject));
+  });
+}
+async function _consume() {
+  await maybeRollover();
+  const planId = getActivePlanId();
+  const plan = getPlan(planId);
+  const included = plan.analyzeCreditsPerMonth;
+  const overage = plan.overageCentsPerCredit;
+  if (included === 0) {
+    _state.used++;
+    await persist();
+    return { allowed: true };
+  }
+  if (_state.used < included) {
+    _state.used++;
+    await persist();
+    const isLast = overage === 0 && _state.used === included;
+    const notice = isLast ? `You've used your last free credit. Upgrade at https://mergen.app/pricing` : void 0;
+    return { allowed: true, ...notice ? { notice } : {} };
+  }
+  if (overage > 0) {
+    _state.used++;
+    _state.overagePending++;
+    await persist();
+    _flushOverage().catch((err) => logger.warn({ err }, "usage: background flush failed"));
+    return { allowed: true };
+  }
+  return {
+    allowed: false,
+    reason: `Monthly limit of ${included} analyze credits reached. Upgrade at https://mergen.app/pricing`
+  };
+}
+function getUsageSnapshot() {
+  const planId = getActivePlanId();
+  const plan = getPlan(planId);
+  const license = getLicenseState();
+  const included = plan.analyzeCreditsPerMonth;
+  const isUnlimited = included === 0;
+  const isPayAsYouGo = isUnlimited && plan.overageCentsPerCredit > 0;
+  const overage = isPayAsYouGo ? _state.used : isUnlimited ? 0 : Math.max(0, _state.used - included);
+  const remaining = isUnlimited ? null : Math.max(0, included - _state.used);
+  const monthStart = (/* @__PURE__ */ new Date(_state.month + "-01T00:00:00Z")).getTime();
+  const resetsAt = license?.resetsAt ?? monthStart + 31 * 24 * 60 * 60 * 1e3;
+  const lowCredits = remaining !== null && remaining <= 2;
+  const billingStatus = license?.status ?? "active";
+  return {
+    planName: plan.name,
+    planId,
+    month: _state.month,
+    resetsAt,
+    used: _state.used,
+    included: isUnlimited ? null : included,
+    remaining,
+    lowCredits,
+    overage,
+    overagePendingCredits: _state.overagePending,
+    overageConfirmedCredits: _state.overageReported,
+    overageCentsPerCredit: plan.overageCentsPerCredit,
+    estimatedOverageCents: overage * plan.overageCentsPerCredit,
+    billingStatus,
+    helpfulRate7d: null
+  };
+}
+function getIncidentCount() {
+  return incidentStore.list(void 0, 200).length;
+}
+async function recordExplainWhyFeedback(..._args) {
+}
+async function consumeIncident() {
+  return consumeCredit();
+}
+function recordExplainWhy(..._args) {
+}
+async function initUsage() {
+  await load();
+}
+export {
+  _resetForTesting,
+  _setSleepForTesting,
+  consumeCredit,
+  consumeIncident,
+  flushOverageOnShutdown,
+  getIncidentCount,
+  getUsageSnapshot,
+  initUsage,
+  recordExplainWhy,
+  recordExplainWhyFeedback
+};

package/dist/routes/active-authors.js

@@ -0,0 +1,63 @@
+import { Router } from "express";
+import { commitContextStore } from "../sensor/commit-context-store.js";
+import { getHabituationEvents } from "../sensor/habituation-store.js";
+function createActiveAuthorsRouter() {
+  const router = Router();
+  router.get("/billing/active-authors", (req, res) => {
+    const repoFilter = typeof req.query.repo === "string" ? req.query.repo : null;
+    const monthsBack = Math.min(24, Math.max(1, parseInt(String(req.query.months ?? "12"), 10) || 12));
+    const excludeBots = req.query.exclude_bots === "true";
+    const now = /* @__PURE__ */ new Date();
+    const buckets = [];
+    for (let i = 0; i < monthsBack; i++) {
+      const d = new Date(now.getFullYear(), now.getMonth() - i, 1);
+      buckets.push(`${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}`);
+    }
+    function toMonthKey(ts) {
+      const d = new Date(ts);
+      return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}`;
+    }
+    const authorsByMonth = /* @__PURE__ */ new Map();
+    for (const b of buckets) authorsByMonth.set(b, /* @__PURE__ */ new Set());
+    const windowStart = new Date(now.getFullYear(), now.getMonth() - monthsBack + 1, 1).getTime();
+    const windowEnd = Date.now();
+    const commitCtxs = repoFilter ? commitContextStore.listByWindow(windowStart, windowEnd, repoFilter, 5e3) : commitContextStore.listByWindow(windowStart, windowEnd, void 0, 5e3);
+    for (const ctx of commitCtxs) {
+      const key = toMonthKey(ctx.mergedAt ?? ctx.capturedAt);
+      const bucket = authorsByMonth.get(key);
+      if (!bucket) continue;
+      if (ctx.author) {
+        if (!excludeBots || !ctx.author.endsWith("[bot]")) bucket.add(ctx.author);
+      }
+    }
+    const habEvents = getHabituationEvents().filter(
+      (e) => e.recordedAt >= windowStart && e.eventType === "comment_posted" && (!repoFilter || e.repo === repoFilter)
+    );
+    for (const e of habEvents) {
+      const key = toMonthKey(e.recordedAt);
+      const bucket = authorsByMonth.get(key);
+      if (!bucket) continue;
+      if (!excludeBots || !e.actor.endsWith("[bot]")) bucket.add(e.actor);
+    }
+    const monthly = buckets.map((month) => ({
+      month,
+      activeAuthors: authorsByMonth.get(month)?.size ?? 0,
+      authors: [...authorsByMonth.get(month) ?? []].sort()
+    }));
+    const currentMonth = monthly[0];
+    const prevMonth = monthly[1] ?? null;
+    const mom = prevMonth && prevMonth.activeAuthors > 0 ? Math.round((currentMonth.activeAuthors - prevMonth.activeAuthors) / prevMonth.activeAuthors * 100) : null;
+    res.json({
+      billingUnit: "active_pr_authors_per_month",
+      currentMonth: currentMonth.month,
+      currentCount: currentMonth.activeAuthors,
+      momChangePercent: mom,
+      excludeBots,
+      monthly
+    });
+  });
+  return router;
+}
+export {
+  createActiveAuthorsRouter
+};

package/dist/routes/activity-feed.js

@@ -0,0 +1,21 @@
+import { Router } from "express";
+import { getRecentActivity, subscribeToActivity } from "../intelligence/activity-feed.js";
+function createActivityFeedRouter() {
+  const router = Router();
+  router.get("/activity-feed", (req, res) => {
+    const limit = Math.min(Number(req.query.limit) || 50, 200);
+    res.json({ ok: true, events: getRecentActivity(limit) });
+  });
+  router.get("/activity-feed/stream", (req, res) => {
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection", "keep-alive");
+    res.flushHeaders();
+    const unsubscribe = subscribeToActivity(res);
+    req.on("close", unsubscribe);
+  });
+  return router;
+}
+export {
+  createActivityFeedRouter
+};

package/dist/routes/adr.js

@@ -0,0 +1,117 @@
+import { Router } from "express";
+import { z } from "zod";
+import { adrStore } from "../sensor/adr-store.js";
+import { getStores } from "../storage/store-registry.js";
+import logger from "../sensor/logger.js";
+const NewAdrSchema = z.object({
+  title: z.string().min(1).max(200),
+  status: z.enum(["proposed", "accepted", "deprecated", "superseded"]).default("proposed"),
+  date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).default(() => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)),
+  decision: z.string().min(1).max(2e3),
+  alternatives: z.array(z.string().max(500)).default([]),
+  rationale: z.string().min(1).max(2e3),
+  consequences: z.string().max(2e3).default("")
+});
+async function compileOverrideFromAdr(adr, tenantId) {
+  const text = `${adr.title} ${adr.decision} ${adr.rationale}`.toLowerCase();
+  let incidentTag = "";
+  let proposedCommand = "remediation_command";
+  if (text.includes("oom") || text.includes("memory") || text.includes("limit")) {
+    incidentTag = "infra_oom_kill";
+    proposedCommand = "docker restart web";
+  } else if (text.includes("rate") || text.includes("limit") || text.includes("throttl")) {
+    incidentTag = "infra_rate_limit_cascade";
+    proposedCommand = "iptables -A INPUT -p tcp --dport 80 -m limit";
+  } else if (text.includes("cert") || text.includes("tls") || text.includes("expiry") || text.includes("ssl")) {
+    incidentTag = "infra_certificate_expiry";
+    proposedCommand = "certbot renew";
+  } else if (text.includes("pool") || text.includes("connection") || text.includes("db")) {
+    incidentTag = "infra_db_connection_pool";
+    proposedCommand = "systemctl restart postgresql";
+  } else if (text.includes("disk") || text.includes("space") || text.includes("full")) {
+    incidentTag = "infra_disk_pressure";
+    proposedCommand = "rm -rf /tmp/*";
+  } else if (text.includes("slow") || text.includes("query") || text.includes("latency")) {
+    incidentTag = "infra_slow_query";
+    proposedCommand = "systemctl reload nginx";
+  }
+  if (!incidentTag) return null;
+  let reason = "on-call-discretion";
+  let note = `Auto-compiled from ADR: ${adr.id} (${adr.title})`;
+  if (text.includes("window") || text.includes("settlement") || text.includes("friday") || text.includes("batch")) {
+    reason = "batch-window";
+  } else if (text.includes("cost") || text.includes("budget") || text.includes("scale") || text.includes("expensive")) {
+    reason = "cost-constraint";
+  } else if (text.includes("cab") || text.includes("freeze") || text.includes("compliance") || text.includes("security")) {
+    reason = "compliance-hold";
+  } else if (text.includes("replica") || text.includes("read") || text.includes("primary")) {
+    reason = "prefer-read-replica";
+  } else if (text.includes("maintenance") || text.includes("scheduled")) {
+    reason = "maintenance-window";
+  }
+  try {
+    const event = await getStores().overrides.recordOverride({
+      incidentTag,
+      proposedCommand,
+      overrideReason: reason,
+      note,
+      service: "all",
+      environment: "production",
+      actor: `ADR Compiler (${adr.id})`
+    }, tenantId);
+    return event;
+  } catch (err) {
+    logger.warn({ err, adrId: adr.id }, "adr-compiler: failed to record override from ADR");
+    return null;
+  }
+}
+function createAdrRouter() {
+  const router = Router();
+  router.get("/adrs", (req, res) => {
+    const q = typeof req.query.q === "string" ? req.query.q : void 0;
+    res.json({ ok: true, adrs: adrStore.list(q) });
+  });
+  router.get("/adrs/:id", (req, res) => {
+    const adr = adrStore.get(req.params.id);
+    if (!adr) {
+      res.status(404).json({ error: "ADR not found" });
+      return;
+    }
+    res.json({ ok: true, adr });
+  });
+  router.post("/adrs", async (req, res) => {
+    const parsed = NewAdrSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "validation failed", details: parsed.error.issues });
+      return;
+    }
+    const adr = adrStore.add(parsed.data);
+    const override = await compileOverrideFromAdr(adr, req.tenantId);
+    res.status(201).json({
+      ok: true,
+      adr,
+      overrideCompiled: override ? true : false,
+      overrideId: override?.id
+    });
+  });
+  router.post("/ci/adr", async (req, res) => {
+    const parsed = NewAdrSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "validation failed", details: parsed.error.issues });
+      return;
+    }
+    const adr = adrStore.add(parsed.data);
+    const override = await compileOverrideFromAdr(adr, req.tenantId);
+    res.status(201).json({
+      ok: true,
+      adr,
+      overrideCompiled: override ? true : false,
+      overrideId: override?.id
+    });
+  });
+  return router;
+}
+export {
+  compileOverrideFromAdr,
+  createAdrRouter
+};

package/dist/routes/agent-activity.js

@@ -0,0 +1,184 @@
+import { randomUUID } from "crypto";
+import { Router } from "express";
+function createAgentActivityRouter() {
+  const router = Router();
+  router.get("/agent-activity", (_req, res) => {
+    const nonce = randomUUID().replace(/-/g, "");
+    res.setHeader("Content-Type", "text/html; charset=utf-8");
+    res.setHeader(
+      "Content-Security-Policy",
+      `default-src 'self'; style-src 'unsafe-inline'; script-src 'nonce-${nonce}'; connect-src 'self'`
+    );
+    res.send(buildActivityHtml(nonce));
+  });
+  return router;
+}
+function buildActivityHtml(nonce) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Agent Activity \xB7 Mergen</title>
+<style>
+  :root{--bg:#0f1117;--surface:#1a1d26;--border:#2a2d3a;--text:#e2e8f0;--muted:#64748b;
+    --green:#22c55e;--yellow:#f59e0b;--red:#ef4444;--blue:#3b82f6;--purple:#a78bfa;}
+  *{box-sizing:border-box;margin:0;padding:0}
+  body{background:var(--bg);color:var(--text);font-family:'SF Mono',ui-monospace,monospace;font-size:12px;line-height:1.5;height:100vh;display:flex;flex-direction:column;overflow:hidden}
+  header{padding:12px 20px;border-bottom:1px solid var(--border);display:flex;align-items:center;gap:16px;flex-shrink:0;background:var(--surface)}
+  header h1{font-size:14px;font-weight:700;letter-spacing:.02em}
+  .dot{width:8px;height:8px;border-radius:50%;background:var(--green);animation:pulse 2s infinite}
+  @keyframes pulse{0%,100%{opacity:1}50%{opacity:.4}}
+  .stats{display:flex;gap:16px;margin-left:auto;font-size:11px}
+  .stat{display:flex;align-items:center;gap:6px;color:var(--muted)}
+  .stat b{color:var(--text)}
+  .nav{display:flex;gap:12px;font-size:11px;padding:0 20px;border-bottom:1px solid var(--border);background:var(--surface)}
+  .nav a{color:var(--muted);text-decoration:none;padding:8px 0;display:block}
+  .nav a:hover{color:var(--blue)}
+  .filters{padding:10px 20px;border-bottom:1px solid var(--border);display:flex;gap:12px;flex-shrink:0;background:#13151e}
+  .filter-btn{padding:3px 10px;border-radius:10px;border:1px solid var(--border);background:transparent;color:var(--muted);font-size:10px;font-weight:700;cursor:pointer;letter-spacing:.04em}
+  .filter-btn.active{border-color:currentColor}
+  .filter-btn.all.active{color:var(--text);border-color:var(--text)}
+  .filter-btn.pass.active{color:var(--green);border-color:var(--green)}
+  .filter-btn.block.active{color:var(--red);border-color:var(--red)}
+  .filter-btn.hold.active{color:var(--yellow);border-color:var(--yellow)}
+  #feed{flex:1;overflow-y:auto;padding:0}
+  .event{display:grid;grid-template-columns:120px 60px 160px 1fr 80px;align-items:center;gap:12px;padding:8px 20px;border-bottom:1px solid rgba(42,45,58,.4);cursor:default;transition:.1s}
+  .event:hover{background:rgba(255,255,255,.03)}
+  .event.new{animation:slideIn .25s ease-out}
+  @keyframes slideIn{from{opacity:0;transform:translateY(-4px)}to{opacity:1;transform:none}}
+  .ts{color:var(--muted);font-size:10px}
+  .verdict{font-size:10px;font-weight:700;letter-spacing:.06em;padding:2px 8px;border-radius:8px;text-align:center}
+  .verdict.PASS{background:rgba(34,197,94,.12);color:var(--green)}
+  .verdict.BLOCK{background:rgba(239,68,68,.12);color:var(--red)}
+  .verdict.HOLD{background:rgba(245,158,11,.12);color:var(--yellow)}
+  .tool{color:var(--purple);font-size:11px}
+  .cmd{color:var(--text);font-size:11px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .rules{color:var(--muted);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .empty{text-align:center;color:var(--muted);padding:60px 20px;font-size:13px}
+  .conn-badge{font-size:10px;font-weight:700;padding:2px 8px;border-radius:8px;background:rgba(34,197,94,.1);color:var(--green)}
+  .conn-badge.disconnected{background:rgba(239,68,68,.1);color:var(--red)}
+  .header-row{display:grid;grid-template-columns:120px 60px 160px 1fr 80px;gap:12px;padding:6px 20px;font-size:10px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--muted);border-bottom:1px solid var(--border);flex-shrink:0;background:#13151e}
+</style>
+</head>
+<body>
+<header>
+  <div class="dot" id="status-dot"></div>
+  <h1>Agent Activity \u2014 Live</h1>
+  <div class="stats">
+    <div class="stat">PASS <b id="cnt-pass">0</b></div>
+    <div class="stat">BLOCK <b id="cnt-block">0</b></div>
+    <div class="stat">HOLD <b id="cnt-hold">0</b></div>
+  </div>
+  <span class="conn-badge" id="conn-badge">CONNECTING</span>
+</header>
+<div class="nav">
+  <a href="/dashboard">\u2190 Dashboard</a>
+  <a href="/policies">Policy Editor</a>
+  <a href="/agent-blunders">Blunder Log</a>
+  <a href="/agent-activity">Live Activity</a>
+</div>
+<div class="filters">
+  <button class="filter-btn all active" onclick="setFilter('all',this)">ALL</button>
+  <button class="filter-btn pass" onclick="setFilter('PASS',this)">PASS</button>
+  <button class="filter-btn block" onclick="setFilter('BLOCK',this)">BLOCK</button>
+  <button class="filter-btn hold" onclick="setFilter('HOLD',this)">HOLD</button>
+</div>
+<div class="header-row">
+  <span>TIME</span><span>VERDICT</span><span>TOOL</span><span>COMMAND / ARGS</span><span>RULES</span>
+</div>
+<div id="feed"><div class="empty" id="empty-msg">Waiting for agent activity\u2026<br><span style="font-size:11px;margin-top:8px;display:block">Tool calls will appear here in real time as agents make them.</span></div></div>
+
+<script nonce="${nonce}">
+let filter = 'all';
+let counts = {PASS:0, BLOCK:0, HOLD:0};
+const MAX_ROWS = 200;
+
+function setFilter(f, btn) {
+  filter = f;
+  document.querySelectorAll('.filter-btn').forEach(b => b.classList.remove('active'));
+  btn.classList.add('active');
+  document.querySelectorAll('.event').forEach(row => {
+    row.style.display = (filter === 'all' || row.dataset.verdict === filter) ? '' : 'none';
+  });
+}
+
+function fmtTime(ts) {
+  const d = new Date(ts);
+  return d.toLocaleTimeString('en-US', {hour12:false,hour:'2-digit',minute:'2-digit',second:'2-digit'}) +
+    '.' + String(d.getMilliseconds()).padStart(3,'0');
+}
+
+function esc(s) {
+  return String(s||'').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
+}
+
+function addEvent(ev) {
+  const empty = document.getElementById('empty-msg');
+  if (empty) empty.remove();
+
+  counts[ev.verdict] = (counts[ev.verdict]||0) + 1;
+  document.getElementById('cnt-pass').textContent  = counts['PASS']  || 0;
+  document.getElementById('cnt-block').textContent = counts['BLOCK'] || 0;
+  document.getElementById('cnt-hold').textContent  = counts['HOLD']  || 0;
+
+  const feed = document.getElementById('feed');
+  const row = document.createElement('div');
+  row.className = 'event new';
+  row.dataset.verdict = ev.verdict;
+  if (filter !== 'all' && ev.verdict !== filter) row.style.display = 'none';
+
+  const rulesText = (ev.ruleNames||[]).join(', ') || (ev.triggeredRules||[]).join(', ') || '\u2014';
+  row.innerHTML = \`
+    <span class="ts">\${fmtTime(ev.timestamp)}</span>
+    <span class="verdict \${esc(ev.verdict)}">\${esc(ev.verdict)}</span>
+    <span class="tool">\${esc(ev.toolName)}</span>
+    <span class="cmd" title="\${esc(ev.commandArg)}">\${esc(ev.commandArg||'\u2014')}</span>
+    <span class="rules" title="\${esc(rulesText)}">\${esc(rulesText)}</span>
+  \`;
+  feed.insertBefore(row, feed.firstChild);
+
+  // Prune old rows
+  const rows = feed.querySelectorAll('.event');
+  if (rows.length > ${200}) rows[rows.length-1].remove();
+}
+
+function connect() {
+  const badge = document.getElementById('conn-badge');
+  const dot   = document.getElementById('status-dot');
+  const es = new EventSource('/activity-feed/stream');
+
+  es.onopen = () => {
+    badge.textContent = 'LIVE';
+    badge.className = 'conn-badge';
+    dot.style.background = 'var(--green)';
+  };
+
+  es.onmessage = (e) => {
+    try { addEvent(JSON.parse(e.data)); } catch {}
+  };
+
+  es.onerror = () => {
+    badge.textContent = 'RECONNECTING';
+    badge.className = 'conn-badge disconnected';
+    dot.style.background = 'var(--red)';
+    es.close();
+    setTimeout(connect, 3000);
+  };
+}
+
+// Also hydrate with recent events
+fetch('/activity-feed?limit=50').then(r=>r.json()).then(d => {
+  if (d.events && d.events.length > 0) {
+    // events are newest-first; add oldest first so they stack correctly
+    [...d.events].reverse().forEach(addEvent);
+  }
+}).catch(()=>{});
+
+connect();
+</script>
+</body>
+</html>`;
+}
+export {
+  createAgentActivityRouter
+};