mergen-server 1.4.0

package/dist/routes/github-webhook.js

@@ -0,0 +1,364 @@
+import crypto from "crypto";
+import { Router } from "express";
+import { memoryStore } from "../datadog/memory-store.js";
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { commitContextStore, extractLinkedIssues } from "../sensor/commit-context-store.js";
+import { detectAiCommit } from "../intelligence/ai-commit.js";
+import { analyzePRForShadow } from "../intelligence/pr-shadow-analyzer.js";
+import { evaluatePRDiff } from "../intelligence/pr-policy-gate.js";
+import { getActivePlanId } from "../intelligence/license.js";
+import { getPlan } from "../intelligence/plans.js";
+import { maybePostPRComment, hasMergenComment } from "../intelligence/pr-commenter.js";
+import { recordHabituationEvent } from "../sensor/habituation-store.js";
+import logger from "../sensor/logger.js";
+function loadGitHubToken() {
+  if (process.env.GITHUB_TOKEN) return process.env.GITHUB_TOKEN;
+  try {
+    const cfgPath = path.join(os.homedir(), ".mergen", "config.json");
+    const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
+    const gh = cfg.github ?? {};
+    if (typeof gh.token === "string" && gh.token) return gh.token;
+  } catch {
+  }
+  return "";
+}
+async function fetchPRFilesWithPatches(repo, prNumber, token) {
+  const url = `https://api.github.com/repos/${repo}/pulls/${prNumber}/files?per_page=100`;
+  const res = await fetch(url, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${token}`,
+      "X-GitHub-Api-Version": "2022-11-28"
+    }
+  });
+  if (!res.ok) {
+    logger.warn({ repo, prNumber, status: res.status }, "github-webhook: failed to fetch PR files");
+    return [];
+  }
+  const data = await res.json();
+  return data.map((f) => ({ filename: f.filename, patch: f.patch }));
+}
+async function fetchPRFiles(repo, prNumber, token) {
+  const files = await fetchPRFilesWithPatches(repo, prNumber, token);
+  return files.map((f) => f.filename);
+}
+async function maybeCreatePolicyGateCheckRun(gateResult, repo, headSha, token) {
+  if (!token) return;
+  if (gateResult.verdict === "pass") return;
+  const conclusion = gateResult.verdict === "block" ? "failure" : "neutral";
+  const matches = gateResult.verdict === "block" ? gateResult.blockMatches : gateResult.holdMatches;
+  const title = gateResult.verdict === "block" ? "\u{1F6AB} Policy violation: this PR introduces a destructive command/resource" : "\u26A0\uFE0F This PR introduces a change flagged for human review";
+  const summaryLines = matches.slice(0, 10).map((m) => `- \`${m.file}\`: \`${m.line}\` \u2014 ${m.reasons.join("; ")}`);
+  const body = {
+    name: "Mergen Policy Gate",
+    head_sha: headSha,
+    status: "completed",
+    conclusion,
+    output: {
+      title,
+      summary: `${matches.length} line(s) across this PR's diff matched enterprise policy rules.` + (gateResult.truncated ? ` (scan stopped at ${gateResult.linesScanned} lines \u2014 this PR is large enough that not every added line was checked.)` : ""),
+      text: summaryLines.join("\n")
+    }
+  };
+  try {
+    const res = await fetch(`https://api.github.com/repos/${repo}/check-runs`, {
+      method: "POST",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        "X-GitHub-Api-Version": "2022-11-28"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      logger.warn({ repo, status: res.status }, "github-webhook: policy gate check run post failed (need checks:write scope)");
+    } else {
+      logger.info({ repo, conclusion }, "github-webhook: policy gate check run posted");
+    }
+  } catch (err) {
+    logger.warn({ err }, "github-webhook: policy gate check run error (non-fatal)");
+  }
+}
+async function maybeCreateCheckRun(shadowResult, headSha, token) {
+  if (!token) return;
+  const HIGH_RELEVANCE = 0.7;
+  const isWarning = shadowResult.relevanceScore >= HIGH_RELEVANCE;
+  const summary = isWarning ? `Mergen found ${shadowResult.matchedIncidents} past incident(s) and ${shadowResult.matchedContexts} PR context(s) related to this change (relevance ${(shadowResult.relevanceScore * 100).toFixed(0)}%).` : `No high-relevance incidents found for this PR's changes.`;
+  const body = {
+    name: "Mergen Context Gate",
+    head_sha: headSha,
+    status: "completed",
+    conclusion: isWarning ? "action_required" : "success",
+    output: {
+      title: isWarning ? "\u26A0\uFE0F Related past incidents detected" : "\u2705 No related incidents",
+      summary,
+      text: shadowResult.wouldHaveComment ?? ""
+    }
+  };
+  try {
+    const res = await fetch(`https://api.github.com/repos/${shadowResult.repo}/check-runs`, {
+      method: "POST",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        "X-GitHub-Api-Version": "2022-11-28"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      logger.warn(
+        { repo: shadowResult.repo, pr: shadowResult.prNumber, status: res.status },
+        "github-webhook: check run post failed (need checks:write scope)"
+      );
+    } else {
+      logger.info(
+        { repo: shadowResult.repo, pr: shadowResult.prNumber, conclusion: body.conclusion },
+        "github-webhook: check run posted"
+      );
+    }
+  } catch (err) {
+    logger.warn({ err }, "github-webhook: check run error (non-fatal)");
+  }
+}
+function loadWebhookSecret() {
+  if (process.env.GITHUB_WEBHOOK_SECRET) return process.env.GITHUB_WEBHOOK_SECRET;
+  try {
+    const secretFile = path.join(os.homedir(), ".mergen", "github-webhook-secret");
+    return fs.readFileSync(secretFile, "utf8").trim();
+  } catch {
+    return "";
+  }
+}
+const WEBHOOK_SECRET = loadWebhookSecret();
+const REQUIRE_SECRET = process.env.MERGEN_REQUIRE_GITHUB_WEBHOOK_SECRET === "true";
+if (WEBHOOK_SECRET) {
+  logger.info("github-webhook: secret loaded (verification enabled)");
+} else if (REQUIRE_SECRET) {
+  logger.error(
+    "github-webhook: MERGEN_REQUIRE_GITHUB_WEBHOOK_SECRET=true but GITHUB_WEBHOOK_SECRET is not set \u2014 all webhook requests will be rejected until a secret is configured. Set GITHUB_WEBHOOK_SECRET to the secret configured in your GitHub webhook settings."
+  );
+} else {
+  logger.warn(
+    "github-webhook: GITHUB_WEBHOOK_SECRET is not set \u2014 signature verification is DISABLED. Any caller can inject fake PR/push events and poison the commit context corpus. Set GITHUB_WEBHOOK_SECRET to the secret configured in your GitHub webhook settings, or set MERGEN_REQUIRE_GITHUB_WEBHOOK_SECRET=true to reject all webhook requests instead of accepting them unverified."
+  );
+}
+function verifySignature(rawBody, signature) {
+  if (!WEBHOOK_SECRET) return !REQUIRE_SECRET;
+  if (!signature) return false;
+  const expected = "sha256=" + crypto.createHmac("sha256", WEBHOOK_SECRET).update(rawBody).digest("hex");
+  try {
+    return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
+  } catch {
+    return false;
+  }
+}
+const _pendingApprovers = /* @__PURE__ */ new Map();
+function createGitHubWebhookRouter() {
+  const router = Router();
+  router.post("/webhooks/github", (req, res) => {
+    const MAX_BODY_BYTES = 2 * 1024 * 1024;
+    const chunks = [];
+    let totalBytes = 0;
+    req.on("data", (chunk) => {
+      totalBytes += chunk.length;
+      if (totalBytes > MAX_BODY_BYTES) {
+        res.status(413).json({ error: "payload too large" });
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      if (res.headersSent) return;
+      const rawBody = Buffer.concat(chunks);
+      const signature = req.headers["x-hub-signature-256"];
+      const event = req.headers["x-github-event"];
+      if (!verifySignature(rawBody, signature)) {
+        res.status(401).json({ error: "invalid x-hub-signature-256" });
+        return;
+      }
+      let payload;
+      try {
+        payload = JSON.parse(rawBody.toString("utf8"));
+      } catch {
+        res.status(400).json({ error: "malformed JSON" });
+        return;
+      }
+      res.json({ status: "accepted", event });
+      void handleEvent(event ?? "", payload).catch((err) => {
+        logger.warn({ err, event }, "github-webhook: handler error");
+      });
+    });
+  });
+  return router;
+}
+async function handleEvent(event, payload) {
+  if (event === "pull_request_review") {
+    handleReviewEvent(payload);
+    return;
+  }
+  if (event === "pull_request") {
+    const prPayload = payload;
+    const { action, pull_request: pr, repository } = prPayload ?? {};
+    if (action === "opened" || action === "synchronize" || action === "ready_for_review") {
+      const headSha = pr?.head?.sha ?? "";
+      const repoFullName = repository?.full_name ?? "";
+      const ghToken = loadGitHubToken();
+      const changedFilesWithPatches = ghToken ? await fetchPRFilesWithPatches(repoFullName, pr?.number ?? 0, ghToken).catch(() => []) : [];
+      const changedFiles = changedFilesWithPatches.map((f) => f.filename);
+      void analyzePRForShadow({
+        repo: repoFullName,
+        prNumber: pr?.number ?? 0,
+        prTitle: pr?.title ?? "",
+        prBody: pr?.body ?? null,
+        author: pr?.user?.login ?? "",
+        branch: pr?.head?.ref ?? "",
+        action,
+        changedFiles
+      }).then(async (shadowResult) => {
+        await maybePostPRComment(shadowResult);
+        await maybeCreateCheckRun(shadowResult, headSha, ghToken);
+      }).catch((err) => {
+        logger.warn({ err }, "pr-shadow/comment/checkrun: error (non-fatal)");
+      });
+      if (getPlan(getActivePlanId()).capabilities.ciGate) {
+        const serviceName = repoFullName.split("/").pop() ?? repoFullName;
+        const gateResult = evaluatePRDiff(changedFilesWithPatches, serviceName);
+        if (gateResult.verdict !== "pass") {
+          logger.warn(
+            { repo: repoFullName, pr: pr?.number, verdict: gateResult.verdict, blockCount: gateResult.blockMatches.length, holdCount: gateResult.holdMatches.length },
+            "github-webhook: PR policy gate found matches"
+          );
+        }
+        void maybeCreatePolicyGateCheckRun(gateResult, repoFullName, headSha, ghToken).catch((err) => {
+          logger.warn({ err }, "pr-policy-gate: check-run post error (non-fatal)");
+        });
+      }
+    }
+    await handlePREvent(prPayload);
+    return;
+  }
+  if (event === "push") {
+    handlePushEvent(payload);
+    return;
+  }
+}
+function handleReviewEvent(payload) {
+  if (payload?.review?.state !== "approved") return;
+  const repo = payload?.repository?.full_name ?? "";
+  const prNum = payload?.pull_request?.number;
+  if (!repo || prNum == null) return;
+  const key = `${repo}#${prNum}`;
+  if (!_pendingApprovers.has(key)) _pendingApprovers.set(key, /* @__PURE__ */ new Set());
+  _pendingApprovers.get(key).add(payload.review.user.login);
+  logger.debug({ repo, prNum, approver: payload.review.user.login }, "github-webhook: approval captured");
+  if (hasMergenComment(key)) {
+    recordHabituationEvent({
+      recordedAt: Date.now(),
+      eventType: "pr_review_submitted",
+      actor: payload.review.user.login,
+      repo,
+      prNumber: prNum
+    });
+  }
+}
+async function handlePREvent(payload) {
+  const { action, pull_request: pr, repository } = payload ?? {};
+  if (!pr || !repository) return;
+  const repo = repository.full_name ?? "";
+  const prKey = `${repo}#${pr.number}`;
+  if (action !== "closed" || !pr.merged) {
+    if ((action === "review_requested" || action === "review_request_removed") && pr.requested_reviewers) {
+    }
+    return;
+  }
+  const mergedAt = pr.merged_at ? new Date(pr.merged_at).getTime() : Date.now();
+  const sha = pr.merge_commit_sha ?? pr.head.sha;
+  const approverSet = _pendingApprovers.get(prKey) ?? /* @__PURE__ */ new Set();
+  _pendingApprovers.delete(prKey);
+  const prText = [pr.title, pr.body ?? ""].join(" ");
+  const aiSignal = detectAiCommit(prText, pr.user.login);
+  const linkedIssues = extractLinkedIssues(pr.body ?? "");
+  const ctx = {
+    sha,
+    repo,
+    branch: pr.base.ref,
+    prNumber: pr.number,
+    prTitle: pr.title,
+    prBody: pr.body,
+    author: pr.user.login,
+    approvers: [...approverSet],
+    linkedIssues,
+    aiGenerated: aiSignal.detected,
+    aiTool: aiSignal.tool,
+    filesChanged: [],
+    // populated below if file list is available in payload
+    capturedAt: Date.now(),
+    mergedAt
+  };
+  commitContextStore.upsert(ctx);
+  const ghToken = loadGitHubToken();
+  if (ghToken) {
+    void fetchPRFiles(repo, pr.number, ghToken).then((files) => {
+      if (files.length > 0) {
+        commitContextStore.upsert({ ...ctx, filesChanged: files });
+        logger.debug(
+          { sha: sha.slice(0, 7), repo, pr: pr.number, files: files.length },
+          "github-webhook: PR files populated"
+        );
+      }
+    }).catch((err) => {
+      logger.warn({ err }, "github-webhook: fetchPRFiles failed (non-fatal)");
+    });
+  }
+  memoryStore.correlateGitHubPR({ prUrl: pr.html_url, prTitle: pr.title, prSha: sha, mergedAt });
+  logger.info(
+    { sha: sha.slice(0, 7), repo, pr: pr.number, ai: aiSignal.detected, issues: linkedIssues.length },
+    "github-webhook: PR context captured"
+  );
+}
+function handlePushEvent(payload) {
+  const { ref, after: sha, commits, repository, pusher } = payload ?? {};
+  if (!sha || !commits?.length || !repository) return;
+  const repo = repository.full_name ?? "";
+  const branch = ref?.replace("refs/heads/", "") ?? null;
+  for (const commit of commits.slice(0, 20)) {
+    const commitSha = commit.id;
+    const author = commit.author?.username ?? commit.author?.name ?? pusher?.name ?? "";
+    const message = commit.message ?? "";
+    const aiSignal = detectAiCommit(message, author);
+    const changedFiles = [
+      ...commit.added ?? [],
+      ...commit.modified ?? [],
+      ...commit.removed ?? []
+    ];
+    const ctx = {
+      sha: commitSha,
+      repo,
+      branch,
+      prNumber: null,
+      prTitle: message.split("\n")[0].slice(0, 200),
+      prBody: message,
+      author,
+      approvers: [],
+      linkedIssues: extractLinkedIssues(message),
+      aiGenerated: aiSignal.detected,
+      aiTool: aiSignal.tool,
+      filesChanged: changedFiles,
+      capturedAt: Date.now(),
+      mergedAt: null
+    };
+    commitContextStore.upsert(ctx);
+  }
+  logger.info(
+    { sha: sha.slice(0, 7), repo, branch, commits: commits.length },
+    "github-webhook: push commits captured"
+  );
+}
+export {
+  createGitHubWebhookRouter
+};

package/dist/routes/habituation.js

@@ -0,0 +1,30 @@
+import { Router } from "express";
+import { getHabituationEvents, getWeeklyHabituation } from "../sensor/habituation-store.js";
+function createHabituationRouter() {
+  const router = Router();
+  router.get("/habituation", (req, res) => {
+    const windowWeeks = Math.min(26, Math.max(1, Number(req.query.weeks ?? 8)));
+    const weekly = getWeeklyHabituation(windowWeeks);
+    const all = getHabituationEvents();
+    const withComments = new Set(
+      all.filter((e) => e.eventType === "comment_posted").map((e) => e.actor)
+    ).size;
+    const engaged = new Set(
+      all.filter((e) => e.eventType !== "comment_posted").map((e) => e.actor)
+    ).size;
+    res.json({
+      ok: true,
+      windowWeeks,
+      totalPRsCommented: all.filter((e) => e.eventType === "comment_posted").length,
+      uniqueEngineers: new Set(all.map((e) => e.actor)).size,
+      engineersWithComments: withComments,
+      engagedEngineers: engaged,
+      habituationRate: withComments > 0 ? engaged / withComments : null,
+      weekly
+    });
+  });
+  return router;
+}
+export {
+  createHabituationRouter
+};

package/dist/routes/health-integrations.js

@@ -0,0 +1,243 @@
+import { Router } from "express";
+import { existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { getAuditHealth } from "../sensor/audit-log.js";
+import { getStaleErrors } from "../sensor/buffer.js";
+import { testConnection as testDatadogConnection } from "../datadog/client.js";
+async function checkSlack() {
+  const token = process.env.MERGEN_SLACK_BOT_TOKEN;
+  const channel = process.env.MERGEN_SLACK_CHANNEL;
+  if (!token) return {
+    id: "slack",
+    name: "Slack",
+    status: "missing",
+    detail: "MERGEN_SLACK_BOT_TOKEN not set \u2014 incident threads and PR comments disabled",
+    fix: "export MERGEN_SLACK_BOT_TOKEN=xoxb-...",
+    docsUrl: "https://api.slack.com/apps"
+  };
+  if (!channel) return {
+    id: "slack",
+    name: "Slack",
+    status: "warn",
+    detail: "Token set but MERGEN_SLACK_CHANNEL not configured",
+    fix: "export MERGEN_SLACK_CHANNEL=#incidents"
+  };
+  try {
+    const r = await fetch("https://slack.com/api/auth.test", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      signal: AbortSignal.timeout(3e3)
+    });
+    const d = await r.json();
+    return d.ok ? { id: "slack", name: "Slack", status: "ok", detail: `Connected \u2014 workspace: ${d.team ?? "unknown"}, channel: ${channel}` } : { id: "slack", name: "Slack", status: "warn", detail: `Auth failed: ${d.error}`, fix: "Check MERGEN_SLACK_BOT_TOKEN \u2014 needs chat:write scope", docsUrl: "https://api.slack.com/apps" };
+  } catch {
+    return { id: "slack", name: "Slack", status: "warn", detail: "Token set but Slack API unreachable", fix: "Check network connectivity" };
+  }
+}
+async function checkPagerDuty() {
+  const secret = process.env.MERGEN_PAGERDUTY_SECRET;
+  if (!secret) return {
+    id: "pagerduty",
+    name: "PagerDuty",
+    status: "missing",
+    detail: "MERGEN_PAGERDUTY_SECRET not set \u2014 webhook signature verification disabled",
+    fix: "export MERGEN_PAGERDUTY_SECRET=...  # from PagerDuty webhook config",
+    docsUrl: "https://developer.pagerduty.com/docs/webhooks"
+  };
+  return { id: "pagerduty", name: "PagerDuty", status: "ok", detail: "Secret configured \u2014 signature verification enabled" };
+}
+async function checkGitHub() {
+  const token = process.env.GITHUB_TOKEN;
+  const secret = process.env.GITHUB_WEBHOOK_SECRET ?? (existsSync(join(homedir(), ".mergen", "github-webhook-secret")) ? "[file]" : null);
+  if (!token && !secret) return {
+    id: "github",
+    name: "GitHub",
+    status: "missing",
+    detail: "GITHUB_TOKEN and GITHUB_WEBHOOK_SECRET not set",
+    fix: "mergen-server connect github --repo owner/repo",
+    docsUrl: "https://github.com/settings/tokens"
+  };
+  if (token) {
+    try {
+      const r = await fetch("https://api.github.com/user", {
+        headers: { Authorization: `Bearer ${token}`, "User-Agent": "mergen" },
+        signal: AbortSignal.timeout(3e3)
+      });
+      const d = await r.json();
+      if (!r.ok) return { id: "github", name: "GitHub", status: "warn", detail: `Token auth failed: ${d.message}`, fix: "Check GITHUB_TOKEN at https://github.com/settings/tokens" };
+      return {
+        id: "github",
+        name: "GitHub",
+        status: "ok",
+        detail: `Connected \u2014 user: ${d.login}${secret ? ", webhook secret set" : ", no webhook secret"}`
+      };
+    } catch {
+      return { id: "github", name: "GitHub", status: "warn", detail: "Token set but GitHub API unreachable", fix: "Check network connectivity" };
+    }
+  }
+  return { id: "github", name: "GitHub", status: "ok", detail: "Webhook secret configured (token not set \u2014 PR commenting disabled)" };
+}
+async function checkDatadog() {
+  const apiKey = process.env.DD_API_KEY;
+  const appKey = process.env.DD_APP_KEY;
+  if (!apiKey) return {
+    id: "datadog",
+    name: "Datadog",
+    status: "missing",
+    detail: "DD_API_KEY not set",
+    fix: "export DD_API_KEY=...  # https://app.datadoghq.com/organization-settings/api-keys"
+  };
+  if (!appKey) return {
+    id: "datadog",
+    name: "Datadog",
+    status: "warn",
+    detail: "DD_API_KEY set but DD_APP_KEY missing",
+    fix: "export DD_APP_KEY=...  # https://app.datadoghq.com/organization-settings/application-keys"
+  };
+  const site = process.env.DATADOG_SITE ?? process.env.DD_SITE ?? "datadoghq.com";
+  try {
+    await testDatadogConnection();
+    return { id: "datadog", name: "Datadog", status: "ok", detail: `Connected \u2014 site: ${site}` };
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    return { id: "datadog", name: "Datadog", status: "warn", detail, fix: "Run: mergen-server init to re-configure" };
+  }
+}
+function checkLinear() {
+  const apiKey = process.env.LINEAR_API_KEY;
+  const teamId = process.env.LINEAR_TEAM_ID;
+  if (!apiKey) return {
+    id: "linear",
+    name: "Linear",
+    status: "missing",
+    detail: "LINEAR_API_KEY not set \u2014 ticket creation disabled",
+    fix: "export LINEAR_API_KEY=lin_api_...",
+    docsUrl: "https://linear.app/settings/api"
+  };
+  if (!teamId) return {
+    id: "linear",
+    name: "Linear",
+    status: "warn",
+    detail: "LINEAR_API_KEY set but LINEAR_TEAM_ID missing",
+    fix: "export LINEAR_TEAM_ID=<team-id>  # from https://linear.app/settings/api"
+  };
+  return { id: "linear", name: "Linear", status: "ok", detail: `Configured \u2014 team: ${teamId}` };
+}
+function checkJira() {
+  const baseUrl = process.env.JIRA_BASE_URL;
+  const email = process.env.JIRA_EMAIL;
+  const token = process.env.JIRA_API_TOKEN;
+  const projKey = process.env.JIRA_PROJECT_KEY;
+  if (!baseUrl) return {
+    id: "jira",
+    name: "Jira",
+    status: "missing",
+    detail: "JIRA_BASE_URL not set \u2014 ticket creation disabled",
+    fix: "export JIRA_BASE_URL=https://yourco.atlassian.net",
+    docsUrl: "https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/"
+  };
+  if (!email || !token) return {
+    id: "jira",
+    name: "Jira",
+    status: "warn",
+    detail: `JIRA_BASE_URL set but ${!email ? "JIRA_EMAIL" : "JIRA_API_TOKEN"} missing`,
+    fix: !email ? "export JIRA_EMAIL=you@company.com" : "export JIRA_API_TOKEN=..."
+  };
+  return {
+    id: "jira",
+    name: "Jira",
+    status: "ok",
+    detail: `Configured \u2014 ${baseUrl}${projKey ? ` \xB7 project: ${projKey}` : " (JIRA_PROJECT_KEY not set \u2014 pass per request)"}`
+  };
+}
+function checkSentry() {
+  const secret = process.env.MERGEN_SENTRY_SECRET;
+  if (!secret) return {
+    id: "sentry",
+    name: "Sentry",
+    status: "missing",
+    detail: "MERGEN_SENTRY_SECRET not set \u2014 Sentry webhooks accepted without verification",
+    fix: "export MERGEN_SENTRY_SECRET=...  # from your Sentry project webhook settings"
+  };
+  return { id: "sentry", name: "Sentry", status: "ok", detail: "Webhook secret configured" };
+}
+function checkRedis() {
+  const url = process.env.MERGEN_REDIS_URL;
+  if (!url) return {
+    id: "redis",
+    name: "Redis",
+    status: "missing",
+    detail: "MERGEN_REDIS_URL not set \u2014 ring buffer is in-memory only (lost on restart)",
+    fix: "export MERGEN_REDIS_URL=redis://localhost:6379"
+  };
+  return { id: "redis", name: "Redis", status: "ok", detail: `Configured \u2014 ${url}` };
+}
+function checkAutopilot() {
+  const enabled = process.env.MERGEN_AUTOPILOT === "true";
+  const shadow = process.env.MERGEN_SHADOW_MODE === "true";
+  if (shadow) return {
+    id: "autopilot",
+    name: "Autopilot",
+    status: "warn",
+    detail: "Shadow mode: Mergen diagnoses but never executes fixes",
+    fix: "Set MERGEN_AUTOPILOT=true and remove MERGEN_SHADOW_MODE to enable autonomous execution"
+  };
+  if (enabled) return { id: "autopilot", name: "Autopilot", status: "ok", detail: "Autonomous execution enabled at \u226585% confidence" };
+  return {
+    id: "autopilot",
+    name: "Autopilot",
+    status: "missing",
+    detail: "MERGEN_AUTOPILOT not set \u2014 diagnosis-only mode",
+    fix: "export MERGEN_AUTOPILOT=true  (run in MERGEN_SHADOW_MODE=true first for 30 days)"
+  };
+}
+function createHealthIntegrationsRouter() {
+  const router = Router();
+  router.get("/health/integrations", async (_req, res) => {
+    const [slack, pagerduty, github, datadog] = await Promise.all([
+      checkSlack(),
+      checkPagerDuty(),
+      checkGitHub(),
+      checkDatadog()
+    ]);
+    const staleErrors = getStaleErrors();
+    const staleCheck = staleErrors.length > 0 ? {
+      id: "stale_errors",
+      name: "Active Errors",
+      status: "warn",
+      detail: `${staleErrors.length} error pattern${staleErrors.length !== 1 ? "s" : ""} active for >1 hour without triage`,
+      fix: "Run: curl http://127.0.0.1:3000/health/integrations | jq .staleErrors"
+    } : { id: "stale_errors", name: "Active Errors", status: "ok", detail: "No untriaged errors older than 1 hour" };
+    const integrations = [
+      slack,
+      pagerduty,
+      github,
+      datadog,
+      checkLinear(),
+      checkJira(),
+      checkSentry(),
+      checkRedis(),
+      checkAutopilot(),
+      staleCheck
+    ];
+    const ok = integrations.filter((i) => i.status === "ok").length;
+    const warn = integrations.filter((i) => i.status === "warn").length;
+    const missing = integrations.filter((i) => i.status === "missing").length;
+    res.json({
+      ok: true,
+      summary: { ok, warn, missing, total: integrations.length },
+      integrations,
+      staleErrors,
+      staleErrorCount: staleErrors.length
+    });
+  });
+  router.get("/audit-health", (_req, res) => {
+    const health = getAuditHealth();
+    res.status(health.ok ? 200 : 503).json(health);
+  });
+  return router;
+}
+export {
+  createHealthIntegrationsRouter
+};

package/dist/routes/heartbeats.js

@@ -0,0 +1,45 @@
+import { Router } from "express";
+import { ping, getReport, getAllReports, removeHeartbeat } from "../sensor/heartbeat-monitor.js";
+function createHeartbeatsRouter() {
+  const router = Router();
+  router.post("/heartbeat/:name", (req, res) => {
+    const { name } = req.params;
+    if (!/^[a-zA-Z0-9_-]{1,80}$/.test(name)) {
+      res.status(400).json({ ok: false, error: "name must be 1-80 alphanumeric, hyphen, or underscore characters" });
+      return;
+    }
+    const intervalSeconds = Math.max(60, parseInt(String(req.query["interval"] ?? req.body?.interval ?? "86400"), 10) || 86400);
+    const graceSeconds = req.query["grace"] !== void 0 || req.body?.grace !== void 0 ? Math.max(0, parseInt(String(req.query["grace"] ?? req.body?.grace ?? "0"), 10) || 0) : void 0;
+    const description = typeof (req.query["description"] ?? req.body?.description) === "string" ? String(req.query["description"] ?? req.body.description).slice(0, 200) : void 0;
+    const config = ping(name, intervalSeconds, graceSeconds, description);
+    const report = getReport(name);
+    res.json({ ok: true, heartbeat: report, _hint: `curl -s http://localhost:3000/heartbeat/${config.name}` });
+  });
+  router.get("/heartbeats", (_req, res) => {
+    const reports = getAllReports();
+    const missing = reports.filter((r) => r.status === "missing" || r.status === "never-pinged").length;
+    res.json({ ok: true, total: reports.length, missing, heartbeats: reports });
+  });
+  router.get("/heartbeat/:name", (req, res) => {
+    const { name } = req.params;
+    const report = getReport(name);
+    if (!report) {
+      res.status(404).json({ ok: false, error: `no heartbeat named '${name}'` });
+      return;
+    }
+    res.json({ ok: true, heartbeat: report });
+  });
+  router.delete("/heartbeat/:name", (req, res) => {
+    const { name } = req.params;
+    const removed = removeHeartbeat(name);
+    if (!removed) {
+      res.status(404).json({ ok: false, error: `no heartbeat named '${name}'` });
+      return;
+    }
+    res.json({ ok: true, removed: name });
+  });
+  return router;
+}
+export {
+  createHeartbeatsRouter
+};