mergen-server 1.4.0

package/dist/routes/device-auth-stub.js

@@ -0,0 +1,173 @@
+import { Router } from "express";
+import { randomBytes, randomUUID } from "crypto";
+import { PLANS } from "../intelligence/plans.js";
+import logger from "../sensor/logger.js";
+const DEVICE_TTL_MS = 10 * 60 * 1e3;
+const byUserCode = /* @__PURE__ */ new Map();
+const byDeviceCode = /* @__PURE__ */ new Map();
+const issuedKeys = /* @__PURE__ */ new Map();
+function stubPlanId() {
+  const p = process.env.MERGEN_AUTH_STUB_PLAN ?? "team";
+  return PLANS[p] ? p : "team";
+}
+function stubEmail() {
+  return process.env.MERGEN_AUTH_STUB_EMAIL ?? "dev@local.mergen";
+}
+function makeUserCode() {
+  const alphabet = "ABCDEFGHJKLMNPQRSTVWXYZ23456789";
+  const pick = () => Array.from(randomBytes(4)).map((b) => alphabet[b % alphabet.length]).join("");
+  return `${pick()}-${pick()}`;
+}
+function baseUrl(req) {
+  if (process.env.MERGEN_PUBLIC_URL) return process.env.MERGEN_PUBLIC_URL.replace(/\/+$/, "");
+  const proto = req.headers["x-forwarded-proto"] ?? req.protocol ?? "http";
+  const host = req.headers.host ?? "127.0.0.1:3000";
+  return `${proto}://${host}`;
+}
+function reap() {
+  const now = Date.now();
+  for (const [code, rec] of byUserCode) {
+    if (rec.expiresAt < now) {
+      byUserCode.delete(code);
+      byDeviceCode.delete(rec.deviceCode);
+    }
+  }
+}
+function createDeviceAuthStubRouter() {
+  const router = Router();
+  logger.warn(
+    "device-auth stub ENABLED (MERGEN_AUTH_STUB=true) \u2014 approves logins with no auth. Do not enable in production."
+  );
+  router.post("/v1/device/code", (req, res) => {
+    reap();
+    const userCode = makeUserCode();
+    const deviceCode = randomUUID();
+    const rec = {
+      deviceCode,
+      userCode,
+      state: "pending",
+      planId: stubPlanId(),
+      email: stubEmail(),
+      key: null,
+      expiresAt: Date.now() + DEVICE_TTL_MS
+    };
+    byUserCode.set(userCode, rec);
+    byDeviceCode.set(deviceCode, rec);
+    const verificationUri = `${baseUrl(req)}/device`;
+    res.json({
+      device_code: deviceCode,
+      user_code: userCode,
+      verification_uri: verificationUri,
+      verification_uri_complete: `${verificationUri}?code=${encodeURIComponent(userCode)}`,
+      interval: 2,
+      expires_in: Math.round(DEVICE_TTL_MS / 1e3)
+    });
+  });
+  router.post("/v1/device/token", (req, res) => {
+    const deviceCode = req.body?.device_code ?? req.body?.deviceCode;
+    const rec = deviceCode ? byDeviceCode.get(deviceCode) : void 0;
+    if (!rec || rec.expiresAt < Date.now()) {
+      res.status(400).json({ error: "expired_token" });
+      return;
+    }
+    if (rec.state === "denied") {
+      res.status(400).json({ error: "access_denied" });
+      return;
+    }
+    if (rec.state === "pending") {
+      res.status(400).json({ error: "authorization_pending" });
+      return;
+    }
+    res.json({ status: "approved", key: rec.key, planId: rec.planId, email: rec.email });
+  });
+  router.get("/device", (req, res) => {
+    const prefill = typeof req.query.code === "string" ? req.query.code : "";
+    res.type("html").send(approvalPage(prefill));
+  });
+  router.post("/v1/device/approve", (req, res) => {
+    const userCode = String(req.body?.user_code ?? req.body?.userCode ?? "").trim().toUpperCase();
+    const approve = req.body?.approve !== false && req.body?.approve !== "false";
+    const rec = byUserCode.get(userCode);
+    if (!rec || rec.expiresAt < Date.now()) {
+      res.status(404).json({ ok: false, error: "unknown_or_expired_code" });
+      return;
+    }
+    if (!approve) {
+      rec.state = "denied";
+      res.json({ ok: true, state: "denied" });
+      return;
+    }
+    rec.state = "approved";
+    rec.key = `mrgn_live_stub_${randomBytes(16).toString("hex")}`;
+    issuedKeys.set(rec.key, { planId: rec.planId, email: rec.email });
+    res.json({ ok: true, state: "approved", plan: rec.planId });
+  });
+  router.post("/v1/validate", (req, res) => {
+    const key = req.body?.key ?? "";
+    const info = issuedKeys.get(key);
+    if (!info) {
+      res.status(401).json({ valid: false, error: "unknown key" });
+      return;
+    }
+    res.json({ valid: true, planId: info.planId, email: info.email, name: "Local Dev" });
+  });
+  router.post("/v1/deactivate", (req, res) => {
+    const key = req.body?.key ?? "";
+    issuedKeys.delete(key);
+    res.json({ ok: true });
+  });
+  return router;
+}
+function approvalPage(prefill) {
+  return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Approve Mergen CLI</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<style>
+  body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#07080e;color:#fff;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}
+  .card{background:#11121a;border:1px solid rgba(255,255,255,.08);border-radius:12px;padding:2.5rem;max-width:420px;width:90%;box-shadow:0 8px 32px rgba(0,0,0,.4)}
+  h1{font-size:1.3rem;margin:0 0 .5rem}
+  p{color:#9aa0ac;font-size:.9rem;line-height:1.5}
+  label{display:block;font-size:.7rem;text-transform:uppercase;letter-spacing:.1em;color:#6b7280;margin:1.25rem 0 .4rem}
+  input{width:100%;box-sizing:border-box;background:#0a0a0a;border:1px solid #2a2d38;border-radius:6px;color:#fff;padding:12px 14px;font-family:ui-monospace,monospace;font-size:1.1rem;letter-spacing:.15em;text-align:center}
+  .row{display:flex;gap:.75rem;margin-top:1.5rem}
+  button{flex:1;padding:12px;border-radius:6px;border:none;font-weight:700;font-size:.85rem;cursor:pointer}
+  .approve{background:#fff;color:#000}
+  .deny{background:transparent;color:#9aa0ac;border:1px solid #2a2d38}
+  .msg{margin-top:1.25rem;font-size:.85rem;padding:.75rem 1rem;border-radius:6px;display:none}
+  .ok{display:block;background:rgba(34,197,94,.1);color:#22c55e;border:1px solid rgba(34,197,94,.2)}
+  .err{display:block;background:rgba(239,68,68,.1);color:#ef4444;border:1px solid rgba(239,68,68,.2)}
+  .badge{font-family:ui-monospace,monospace;font-size:.65rem;color:#f59e0b;letter-spacing:.15em;text-transform:uppercase}
+</style></head><body>
+<div class="card">
+  <span class="badge">Local Auth Stub</span>
+  <h1>Approve Mergen CLI</h1>
+  <p>Confirm the code shown in your terminal to sign this device in. This local stub grants the <b>${escapeHtml(process.env.MERGEN_AUTH_STUB_PLAN ?? "team")}</b> plan.</p>
+  <label for="code">Device code</label>
+  <input id="code" value="${escapeHtml(prefill)}" autocapitalize="characters" autocomplete="off" />
+  <div class="row">
+    <button class="approve" onclick="act(true)">Approve</button>
+    <button class="deny" onclick="act(false)">Deny</button>
+  </div>
+  <div id="msg" class="msg"></div>
+</div>
+<script>
+  async function act(approve){
+    var code=document.getElementById('code').value.trim().toUpperCase();
+    var msg=document.getElementById('msg');
+    if(!code){msg.className='msg err';msg.textContent='Enter the code from your terminal.';return;}
+    try{
+      var r=await fetch('/v1/device/approve',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({user_code:code,approve:approve})});
+      var d=await r.json();
+      if(d.ok&&d.state==='approved'){msg.className='msg ok';msg.textContent='Approved \u2014 return to your terminal. You can close this tab.';}
+      else if(d.ok&&d.state==='denied'){msg.className='msg err';msg.textContent='Login denied.';}
+      else{msg.className='msg err';msg.textContent=d.error||'Unknown or expired code.';}
+    }catch(e){msg.className='msg err';msg.textContent='Request failed: '+e.message;}
+  }
+</script>
+</body></html>`;
+}
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+export {
+  createDeviceAuthStubRouter
+};

package/dist/routes/explain-why.js

@@ -0,0 +1,39 @@
+import path from "path";
+import { Router } from "express";
+import { commitContextStore } from "../sensor/commit-context-store.js";
+function createExplainWhyRouter() {
+  const router = Router();
+  router.get("/explain-why/file", (req, res) => {
+    const rawPath = typeof req.query.path === "string" ? req.query.path.trim() : "";
+    const filePath = path.normalize(rawPath).replace(/^(\.\.[\\/])+/, "");
+    const repo = typeof req.query.repo === "string" && req.query.repo.trim() ? req.query.repo.trim() : void 0;
+    const limit = Math.min(10, Math.max(1, Number(req.query.limit ?? 5)));
+    if (!filePath) {
+      res.status(400).json({ error: '"path" query param is required' });
+      return;
+    }
+    const contexts = commitContextStore.listByFile(filePath, repo, limit);
+    res.json({
+      ok: true,
+      file: filePath,
+      count: contexts.length,
+      contexts: contexts.map((c) => ({
+        sha: c.sha.slice(0, 7),
+        prNumber: c.prNumber,
+        prTitle: c.prTitle,
+        prBody: c.prBody ? c.prBody.slice(0, 500) : null,
+        author: c.author,
+        approvers: c.approvers,
+        linkedIssues: c.linkedIssues,
+        aiGenerated: c.aiGenerated,
+        aiTool: c.aiTool,
+        mergedAt: c.mergedAt,
+        capturedAt: c.capturedAt
+      }))
+    });
+  });
+  return router;
+}
+export {
+  createExplainWhyRouter
+};

package/dist/routes/gate-analytics.js

@@ -0,0 +1,213 @@
+import { Router } from "express";
+import { loadEnterprisePolicy } from "../intelligence/enterprise-policy-engine.js";
+import {
+  getRetryStats,
+  getToolCallCounts,
+  getUnguardedCounts,
+  getRuleFirings,
+  getHitlStats,
+  getReformulationRates,
+  getHitlFatigueStatus,
+  getGateEvents,
+  subscribeGateStream
+} from "../intelligence/gate-analytics.js";
+import { computeBlastRadius } from "../intelligence/blast-radius.js";
+import { computeApprovalAnalytics } from "../intelligence/approval-analytics.js";
+function retryAssessment(passRate) {
+  if (passRate >= 75) return "guidance working \u2014 agent reformulates successfully";
+  if (passRate >= 50) return "guidance partially working \u2014 consider refining the suggested alternative";
+  return "guidance ineffective \u2014 agent cannot reformulate from this hint";
+}
+function hitlRecommendation(approvalRate, avgApprovalLatencyMs) {
+  if (approvalRate >= 90) return "90%+ approval rate \u2014 candidate for auto-approve after corpus validation";
+  if (approvalRate <= 30) return "70%+ denial rate \u2014 consider converting to hard block";
+  if (avgApprovalLatencyMs > 30 * 60 * 1e3) return "avg approval latency >30 min \u2014 consider narrowing the hold condition";
+  return "calibrated \u2014 no action needed";
+}
+function createGateAnalyticsRouter() {
+  const router = Router();
+  router.get("/gate-analytics", (_req, res) => {
+    const policy = loadEnterprisePolicy();
+    const retryStats = getRetryStats();
+    const toolCalls = getToolCallCounts();
+    const ungarded = getUnguardedCounts();
+    const ruleFirings = getRuleFirings();
+    const hitlStats = getHitlStats();
+    const retryByRule = {};
+    for (const [ruleId, stats] of retryStats) {
+      const resolved = stats.retryPassed + stats.retryBlocked;
+      const passRate = resolved > 0 ? Math.round(stats.retryPassed / resolved * 100) : null;
+      retryByRule[ruleId] = {
+        fired: stats.fired,
+        retryPassed: stats.retryPassed,
+        retryBlocked: stats.retryBlocked,
+        retryPassRate: passRate,
+        assessment: passRate !== null ? retryAssessment(passRate) : "no retries yet"
+      };
+    }
+    let totalCalls = 0;
+    let coveredCalls = 0;
+    for (const [toolName, count] of toolCalls) {
+      totalCalls += count;
+      const ungardedCount = ungarded.get(toolName) ?? 0;
+      coveredCalls += count - ungardedCount;
+    }
+    const ungardedTools = [...ungarded.entries()].filter(([, n]) => n > 0).sort((a, b) => b[1] - a[1]).map(([toolName, calls]) => ({ toolName, calls }));
+    const allRuleIds = policy.rules.map((r) => r.id);
+    const deadRules = allRuleIds.filter((id) => !ruleFirings.has(id));
+    const liveRuleFirings = {};
+    for (const [ruleId, count] of ruleFirings) liveRuleFirings[ruleId] = count;
+    const hitlByRule = {};
+    for (const [ruleId, stats] of hitlStats) {
+      const total = stats.approvals + stats.denials;
+      const approvalRate = total > 0 ? Math.round(stats.approvals / total * 100) : null;
+      const avgApprovalMs = stats.approvals > 0 ? Math.round(stats.totalApprovalLatencyMs / stats.approvals) : null;
+      const avgDenialMs = stats.denials > 0 ? Math.round(stats.totalDenialLatencyMs / stats.denials) : null;
+      hitlByRule[ruleId] = {
+        approvals: stats.approvals,
+        denials: stats.denials,
+        approvalRate,
+        avgApprovalLatencyMs: avgApprovalMs,
+        avgDenialLatencyMs: avgDenialMs,
+        recommendation: approvalRate !== null ? hitlRecommendation(approvalRate, avgApprovalMs ?? 0) : "no decisions recorded yet"
+      };
+    }
+    const reformRates = getReformulationRates();
+    const reformByRule = {};
+    for (const [ruleId, data] of reformRates) {
+      reformByRule[ruleId] = {
+        fired: data.fired,
+        reformulated: data.reformulated,
+        rate: Math.round(data.rate * 100),
+        assessment: data.rate >= 0.75 ? "guided alternative is working \u2014 agent reformulates successfully" : data.rate >= 0.4 ? "partial success \u2014 consider refining the suggested alternative text" : "guided alternative ineffective \u2014 agent cannot reformulate from this hint"
+      };
+    }
+    const fatigue = getHitlFatigueStatus();
+    res.json({
+      note: "In-memory since last restart.",
+      retrySuccessRate: {
+        description: "After a BLOCK, did the agent reformulate and pass on the next call? (60s attribution window)",
+        byRule: retryByRule
+      },
+      guidedAlternativeEffectiveness: {
+        description: 'What fraction of blocked calls resulted in a successful reformulation? Measures whether the "what to do instead" hint is actionable.',
+        byRule: reformByRule
+      },
+      policyCoverage: {
+        description: "Tool calls with no matching policy rule (unguarded) and rules that have never fired (dead).",
+        totalCalls,
+        coveredCalls,
+        coverageRate: totalCalls > 0 ? Math.round(coveredCalls / totalCalls * 100) : null,
+        ungardedTools,
+        deadRules,
+        liveRuleFirings
+      },
+      hitlPatterns: {
+        description: "Approve/deny ratios and latency per rule. High approval rate \u2192 candidate for auto-approve. High denial rate \u2192 candidate for hard block.",
+        byRule: hitlByRule
+      },
+      hitlFatigue: {
+        description: "Approval fatigue detection \u2014 when too many HOLDs fire in a short window, engineers stop responding promptly.",
+        ...fatigue
+      }
+    });
+  });
+  router.get("/gate/stream", (req, res) => {
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection", "keep-alive");
+    res.setHeader("X-Accel-Buffering", "no");
+    res.flushHeaders();
+    const recent = getGateEvents().slice(-20);
+    for (const ev of recent) {
+      res.write(`event: gate_decision
+data: ${JSON.stringify(ev)}
+
+`);
+    }
+    res.write(`event: connected
+data: {"note":"Streaming live gate decisions","recentSent":${recent.length}}
+
+`);
+    const heartbeat = setInterval(() => {
+      res.write(`: heartbeat ${Date.now()}
+
+`);
+    }, 3e4);
+    const unsubscribe = subscribeGateStream((event) => {
+      res.write(`event: gate_decision
+data: ${JSON.stringify(event)}
+
+`);
+    });
+    req.on("close", () => {
+      clearInterval(heartbeat);
+      unsubscribe();
+    });
+  });
+  router.get("/gate/heatmap", (req, res) => {
+    const windowMs = Math.max(6e4, Number(req.query.windowMs ?? 60 * 60 * 1e3));
+    const cutoff = Date.now() - windowMs;
+    const events = getGateEvents().filter((e) => e.ts >= cutoff);
+    const serviceMap = /* @__PURE__ */ new Map();
+    for (const ev of events) {
+      const svc = ev.service ?? "unknown";
+      let row = serviceMap.get(svc);
+      if (!row) {
+        row = { calls: 0, blocked: 0, held: 0, passed: 0, blastScores: [], blastScopes: [], agents: /* @__PURE__ */ new Map(), tools: /* @__PURE__ */ new Map() };
+        serviceMap.set(svc, row);
+      }
+      row.calls++;
+      if (ev.verdict === "block") row.blocked++;
+      else if (ev.verdict === "hold") row.held++;
+      else row.passed++;
+      if (ev.command) {
+        const blast = computeBlastRadius(ev.command);
+        const scopeScore = {
+          "data-destructive": 100,
+          "cluster": 90,
+          "namespace": 70,
+          "data-write": 60,
+          "deployment": 50,
+          "config-change": 40,
+          "pod": 20,
+          "unknown": 10
+        };
+        row.blastScores.push(scopeScore[blast.scope] ?? 10);
+        row.blastScopes.push(blast.scope);
+      }
+      const agentKey = ev.agentId ?? ev.actor ?? "unknown";
+      row.agents.set(agentKey, (row.agents.get(agentKey) ?? 0) + 1);
+      row.tools.set(ev.toolName, (row.tools.get(ev.toolName) ?? 0) + 1);
+    }
+    const heatmap = [...serviceMap.entries()].map(([service, row]) => ({
+      service,
+      totalCalls: row.calls,
+      blocked: row.blocked,
+      held: row.held,
+      passed: row.passed,
+      avgBlastScore: row.blastScores.length > 0 ? Math.round(row.blastScores.reduce((a, b) => a + b, 0) / row.blastScores.length) : 0,
+      maxBlastScope: row.blastScopes.reduce((max, s) => {
+        const order = ["data-destructive", "cluster", "namespace", "data-write", "deployment", "config-change", "pod", "unknown"];
+        return order.indexOf(s) < order.indexOf(max) ? s : max;
+      }, "unknown"),
+      topAgents: [...row.agents.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([a]) => a),
+      topTools: [...row.tools.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([t]) => t)
+    })).sort((a, b) => b.avgBlastScore - a.avgBlastScore);
+    res.json({
+      ok: true,
+      windowMs,
+      eventsAnalyzed: events.length,
+      services: heatmap,
+      note: "Services sorted by average blast-radius score. High score + high call frequency = over-privileged agent."
+    });
+  });
+  router.get("/analytics/approvals", async (_req, res) => {
+    const analytics = await computeApprovalAnalytics();
+    res.json({ ok: true, ...analytics });
+  });
+  return router;
+}
+export {
+  createGateAnalyticsRouter
+};

package/dist/routes/gate.js

@@ -0,0 +1,28 @@
+import { Router } from "express";
+import { z } from "zod";
+import { applyGate } from "../intelligence/tool-guard.js";
+const EvaluateSchema = z.object({
+  toolName: z.string().min(1).optional(),
+  command: z.string().min(1)
+});
+function createGateRouter(port) {
+  const router = Router();
+  router.post("/gate/evaluate", async (req, res) => {
+    const parsed = EvaluateSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "command is required", details: parsed.error.flatten() });
+      return;
+    }
+    const { toolName, command } = parsed.data;
+    const next = async () => ({ content: [{ type: "text", text: "pass" }] });
+    const result = await applyGate(toolName ?? "cli_exec", { command }, next, port);
+    res.json({
+      isError: result.isError === true,
+      text: result.content[0]?.text ?? ""
+    });
+  });
+  return router;
+}
+export {
+  createGateRouter
+};