mergen-server 1.4.0

package/dist/routes/safety-test.js

@@ -0,0 +1,174 @@
+import { Router } from "express";
+import {
+  evaluateEnterprisePolicy,
+  loadEnterprisePolicy,
+  DEFAULT_ENTERPRISE_POLICY,
+  _resetPolicyCacheForTesting
+} from "../intelligence/enterprise-policy-engine.js";
+function createSafetyTestRouter() {
+  const router = Router();
+  router.get("/safety-test", (req, res) => {
+    const verbose = req.query.verbose === "1" || req.query.verbose === "true";
+    const results = runSafetyTests();
+    const allPassed = results.every((r) => r.passed);
+    const passed = results.filter((r) => r.passed).length;
+    const failed = results.filter((r) => !r.passed).length;
+    const body = {
+      ok: allPassed,
+      allPassed,
+      passed,
+      failed,
+      total: results.length
+    };
+    if (verbose) body.cases = results;
+    if (!allPassed) {
+      body.failures = results.filter((r) => !r.passed).map((r) => r.name);
+    }
+    res.status(allPassed ? 200 : 500).json(body);
+  });
+  return router;
+}
+const TEST_CASES = [
+  // ── Destructive command patterns ──────────────────────────────────────────
+  {
+    name: "block_rm_rf",
+    description: "rm -rf must be blocked before execution",
+    expectedVerdict: "block",
+    input: { files: [], commands: ["rm -rf /var/data"], actor: "claude", service: "api" }
+  },
+  {
+    name: "block_terraform_destroy",
+    description: "terraform destroy must be blocked",
+    expectedVerdict: "block",
+    input: { files: [], commands: ["terraform destroy prod"], actor: "claude", service: "infra" }
+  },
+  {
+    name: "block_drop_database",
+    description: "DROP DATABASE must be blocked",
+    expectedVerdict: "block",
+    input: { files: [], commands: ["drop database production"], actor: "agent", service: "db" }
+  },
+  {
+    name: "block_drop_table",
+    description: "DROP TABLE must be blocked",
+    expectedVerdict: "block",
+    input: { files: [], commands: ["drop table users"], actor: "claude", service: "db" }
+  },
+  {
+    name: "block_truncate_table",
+    description: "TRUNCATE TABLE must be blocked",
+    expectedVerdict: "block",
+    input: { files: [], commands: ["truncate table events"], actor: "bot", service: "db" }
+  },
+  {
+    name: "block_kubectl_delete",
+    description: "kubectl delete must be blocked",
+    expectedVerdict: "block",
+    input: { files: [], commands: ["kubectl delete namespace production"], actor: "agent", service: "k8s" }
+  },
+  {
+    name: "block_nuke_keyword",
+    description: "nuke keyword at word boundary must be blocked",
+    expectedVerdict: "block",
+    input: { files: [], commands: ["nuke everything in s3"], actor: "claude", service: "s3" }
+  },
+  {
+    name: "block_wipe_keyword",
+    description: "wipe keyword at word boundary must be blocked",
+    expectedVerdict: "block",
+    input: { files: [], commands: ["wipe the database"], actor: "claude", service: "db" }
+  },
+  // ── Case / whitespace normalisation ───────────────────────────────────────
+  {
+    name: "block_mixed_case_terraform",
+    description: "Uppercase TERRAFORM DESTROY must still be blocked",
+    expectedVerdict: "block",
+    input: { files: [], commands: ["TERRAFORM DESTROY"], actor: "claude", service: "infra" }
+  },
+  {
+    name: "block_mixed_case_drop_table",
+    description: "DROP TABLE in mixed case must still be blocked",
+    expectedVerdict: "block",
+    input: { files: [], commands: ["DROP TABLE users"], actor: "bot", service: "db" }
+  },
+  // ── Schema mutation → hold (warn) ─────────────────────────────────────────
+  {
+    name: "hold_alter_table",
+    description: "ALTER TABLE by AI actor must be held for HITL",
+    expectedVerdict: "warn",
+    input: { files: [], commands: ["alter table users add column verified boolean"], actor: "claude", service: "db" }
+  },
+  {
+    name: "hold_prisma_migrate",
+    description: "prisma migrate by AI actor must be held",
+    expectedVerdict: "warn",
+    input: { files: [], commands: ["prisma migrate deploy"], actor: "cursor", service: "api" }
+  },
+  {
+    name: "hold_db_migrate",
+    description: "db:migrate by AI actor must be held",
+    expectedVerdict: "warn",
+    input: { files: [], commands: ["db:migrate"], actor: "agent", service: "api" }
+  },
+  // ── False-positive guard: safe commands must pass ─────────────────────────
+  {
+    name: "pass_safe_deploy",
+    description: "Safe deployment command must not be blocked",
+    expectedVerdict: "pass",
+    input: { files: [], commands: ["kubectl rollout status deployment/api"], actor: "claude", service: "k8s" }
+  },
+  {
+    name: "pass_git_commit",
+    description: "git commit must not be blocked",
+    expectedVerdict: "pass",
+    input: { files: [], commands: ['git commit -m "fix: handle null check"'], actor: "claude", service: "api" }
+  },
+  {
+    name: "pass_npm_install",
+    description: "npm install must not be blocked",
+    expectedVerdict: "pass",
+    input: { files: [], commands: ["npm install"], actor: "claude", service: "api" }
+  },
+  // ── Word boundary: must NOT match partial words ────────────────────────────
+  {
+    name: "no_false_positive_destroy_session",
+    description: '"destroy_session" must not trigger block \u2014 "destroy" alone matches, but compound identifiers should be tested',
+    expectedVerdict: "block",
+    // "destroy" is in the policy as standalone word pattern — this IS a known current behavior
+    input: { files: [], commands: ["destroy_session"], actor: "claude", service: "api" }
+  }
+];
+function runSafetyTests() {
+  const saved = loadEnterprisePolicy();
+  _resetPolicyCacheForTesting(DEFAULT_ENTERPRISE_POLICY);
+  try {
+    return TEST_CASES.map((tc) => {
+      let verdict;
+      try {
+        const result = evaluateEnterprisePolicy(tc.input);
+        verdict = result.verdict;
+      } catch (err) {
+        return {
+          name: tc.name,
+          passed: false,
+          expected: tc.expectedVerdict,
+          got: `error: ${err instanceof Error ? err.message : String(err)}`,
+          description: tc.description
+        };
+      }
+      const passed = verdict === tc.expectedVerdict;
+      return {
+        name: tc.name,
+        passed,
+        expected: tc.expectedVerdict,
+        got: verdict,
+        description: tc.description
+      };
+    });
+  } finally {
+    _resetPolicyCacheForTesting(saved);
+  }
+}
+export {
+  createSafetyTestRouter
+};

package/dist/routes/sdk.js

@@ -0,0 +1,222 @@
+import { Router } from "express";
+function createSdkRouter() {
+  const router = Router();
+  router.get("/sdk.js", (req, res) => {
+    const autoInit = req.query["autoInit"] !== "false";
+    const service = typeof req.query["service"] === "string" ? req.query["service"] : null;
+    const endpoint = typeof req.query["endpoint"] === "string" ? req.query["endpoint"] : null;
+    res.setHeader("Content-Type", "application/javascript; charset=utf-8");
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Cache-Control", "public, max-age=60");
+    res.send(buildSdkSource({ autoInit, service, endpoint }));
+  });
+  return router;
+}
+function buildSdkSource(opts) {
+  const serviceExpr = opts.service ? JSON.stringify(opts.service) : `(typeof location !== 'undefined' ? location.hostname : 'browser')`;
+  const endpointExpr = opts.endpoint ? JSON.stringify(opts.endpoint) : `(typeof location !== 'undefined' ? location.origin : 'http://localhost:3000')`;
+  return `
+/* @mergen/browser \u2014 auto-served by Mergen server */
+/* Add to any page: <script src="http://localhost:3000/sdk.js"></script> */
+(function(global) {
+  'use strict';
+  if (global.Mergen && global.Mergen._active) return; // idempotent
+
+  // \u2500\u2500 Utilities \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  function randomHex(n) {
+    var a = new Uint8Array(n);
+    crypto.getRandomValues(a);
+    return Array.from(a, function(b) { return b.toString(16).padStart(2, '0'); }).join('');
+  }
+
+  function msToNano(ms) {
+    return String(BigInt(Math.round(ms)) * 1000000n);
+  }
+
+  function attr(k, v) { return { key: k, value: { stringValue: v } }; }
+
+  function post(url, body, onError) {
+    var json = JSON.stringify(body);
+    try {
+      if (navigator.sendBeacon) {
+        if (navigator.sendBeacon(url, new Blob([json], { type: 'application/json' }))) return;
+      }
+    } catch(e) {}
+    fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: json, keepalive: true })
+      .catch(function() { if (onError) onError(); });
+  }
+
+  // \u2500\u2500 Mergen public API \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  var Mergen = {
+    _active: false,
+    _teardowns: [],
+    _endpoint: ${endpointExpr},
+    _service: ${serviceExpr},
+    _resource: null,
+
+    init: function(cfg) {
+      if (this._active) return this;
+      cfg = cfg || {};
+      this._endpoint = cfg.endpoint || this._endpoint;
+      this._service  = cfg.service  || this._service;
+      this._resource = { attributes: [attr('service.name', this._service)] };
+
+      if (cfg.captureConsole !== false) this._patchConsole();
+      if (cfg.captureNetwork !== false) { this._patchFetch(); this._patchXHR(); }
+      this._active = true;
+      return this;
+    },
+
+    shutdown: function() {
+      this._teardowns.forEach(function(fn) { fn(); });
+      this._teardowns = [];
+      this._active = false;
+    },
+
+    // \u2500\u2500 Console patch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    _patchConsole: function() {
+      var self = this;
+      var levels = ['log', 'warn', 'error'];
+      var originals = {};
+      var severities = { log: 9, warn: 13, error: 17 };
+
+      levels.forEach(function(level) {
+        originals[level] = console[level].bind(console);
+        console[level] = function() {
+          originals[level].apply(console, arguments);
+          try {
+            var args = Array.from(arguments);
+            var body = args.map(function(a) {
+              if (typeof a === 'string') return a;
+              if (a instanceof Error) return a.name + ': ' + a.message;
+              try { return JSON.stringify(a); } catch(e) { return String(a); }
+            }).join(' ');
+            if (body.indexOf('/v1/') !== -1) return;
+            var stack = (level === 'error' && args[0] instanceof Error) ? args[0].stack : null;
+            self._sendLog(severities[level] || 9, level.toUpperCase(), body, stack);
+          } catch(e) {}
+        };
+      });
+
+      this._teardowns.push(function() {
+        levels.forEach(function(level) { console[level] = originals[level]; });
+      });
+    },
+
+    _sendLog: function(severityNumber, severityText, body, stack) {
+      var attrs = [attr('browser.url', typeof location !== 'undefined' ? location.href : '')];
+      if (stack) attrs.push(attr('exception.stacktrace', stack.slice(0, 2000)));
+      post(this._endpoint + '/v1/logs', {
+        resourceLogs: [{ resource: this._resource, scopeLogs: [{ logRecords: [{
+          timeUnixNano: msToNano(Date.now()),
+          severityNumber: severityNumber,
+          severityText: severityText,
+          body: { stringValue: body },
+          attributes: attrs
+        }] }] }]
+      });
+    },
+
+    // \u2500\u2500 Fetch patch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    _patchFetch: function() {
+      if (typeof fetch === 'undefined') return;
+      var self = this;
+      var _orig = window.fetch.bind(window);
+
+      window.fetch = function(input, init) {
+        var url    = typeof input === 'string' ? input : (input instanceof URL ? input.href : (input.url || ''));
+        var method = ((init && init.method) || (input && input.method) || 'GET').toUpperCase();
+        var traceId = randomHex(16);
+        var spanId  = randomHex(8);
+        var startMs = Date.now();
+        var tp = '00-' + traceId + '-' + spanId + '-01';
+
+        var headers = new Headers((init && init.headers) || (input && !(typeof input === 'string') && !(input instanceof URL) ? input.headers : null) || {});
+        headers.set('traceparent', tp);
+        var pInit = Object.assign({}, init || {}, { headers: headers });
+        var pInput = (typeof input === 'string' || input instanceof URL) ? input : new Request(input, pInit);
+
+        return _orig(pInput, typeof pInput === 'string' || pInput instanceof URL ? pInit : undefined).then(
+          function(resp) {
+            self._sendSpan(traceId, spanId, method, url, startMs, Date.now(), resp.status, resp.ok ? null : (resp.statusText || 'HTTP ' + resp.status));
+            return resp;
+          },
+          function(err) {
+            self._sendSpan(traceId, spanId, method, url, startMs, Date.now(), 0, err.message || 'NetworkError');
+            throw err;
+          }
+        );
+      };
+
+      this._teardowns.push(function() { window.fetch = _orig; });
+    },
+
+    _sendSpan: function(traceId, spanId, method, url, startMs, endMs, status, error) {
+      var isErr = status >= 400 || !!error;
+      try {
+        var pathname = new URL(url, typeof location !== 'undefined' ? location.href : undefined).pathname;
+        post(this._endpoint + '/v1/traces', {
+          resourceSpans: [{ resource: this._resource, scopeSpans: [{ spans: [{
+            traceId: traceId, spanId: spanId,
+            name: method + ' ' + pathname,
+            kind: 3, // CLIENT
+            startTimeUnixNano: msToNano(startMs),
+            endTimeUnixNano:   msToNano(endMs),
+            status: { code: isErr ? 2 : 1, message: error || '' },
+            attributes: [
+              attr('http.method', method),
+              attr('http.url', url),
+              attr('http.status_code', String(status))
+            ]
+          }] }] }]
+        });
+      } catch(e) {}
+    },
+
+    // \u2500\u2500 XHR patch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    _patchXHR: function() {
+      if (typeof XMLHttpRequest === 'undefined') return;
+      var self = this;
+      var _origOpen = XMLHttpRequest.prototype.open;
+      var _origSend = XMLHttpRequest.prototype.send;
+      var _origSetHeader = XMLHttpRequest.prototype.setRequestHeader;
+      var meta = new WeakMap();
+
+      XMLHttpRequest.prototype.open = function(method, url) {
+        meta.set(this, { method: method.toUpperCase(), url: String(url), traceId: randomHex(16), spanId: randomHex(8), startMs: 0 });
+        return _origOpen.apply(this, arguments);
+      };
+
+      XMLHttpRequest.prototype.send = function(body) {
+        var m = meta.get(this);
+        if (m) {
+          m.startMs = Date.now();
+          try { _origSetHeader.call(this, 'traceparent', '00-' + m.traceId + '-' + m.spanId + '-01'); } catch(e) {}
+          var xhr = this;
+          this.addEventListener('loadend', function() {
+            self._sendSpan(m.traceId, m.spanId, m.method, m.url, m.startMs, Date.now(),
+              xhr.status, xhr.status >= 400 ? (xhr.statusText || 'HTTP ' + xhr.status) : null);
+          }, { once: true });
+        }
+        return _origSend.call(this, body);
+      };
+
+      this._teardowns.push(function() {
+        XMLHttpRequest.prototype.open = _origOpen;
+        XMLHttpRequest.prototype.send = _origSend;
+      });
+    }
+  };
+
+  global.Mergen = Mergen;
+
+${opts.autoInit ? `  // Auto-init with defaults (pass ?autoInit=false to disable)
+  Mergen.init({ endpoint: ${endpointExpr}, service: ${serviceExpr} });` : `  // Auto-init disabled \u2014 call Mergen.init() manually`}
+
+})(typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : this);
+/* Mergen SDK loaded. Type Mergen in the console to inspect the instance. */
+`.trim();
+}
+export {
+  createSdkRouter
+};