mergen-server 1.4.0

package/dist/routes/sensor.js

@@ -0,0 +1,819 @@
+import { Router } from "express";
+import { store } from "../sensor/buffer.js";
+import { getMetricCounters } from "../sensor/otel-exporter.js";
+import { startProcessWatcher, stopProcessWatcher, listProcessWatchers } from "../sensor/process-watcher.js";
+import { startDockerLogStream, stopDockerLogStream, listStreamedContainers } from "../sensor/docker-log-stream.js";
+import { saveSessionToHistory } from "../sensor/session-history.js";
+import { historyStore } from "../sensor/sqlite-store.js";
+import { getStores } from "../storage/store-registry.js";
+import { buildCausalChain } from "../intelligence/causal.js";
+import { buildCausalGraph } from "../intelligence/causal-graph.js";
+import { serviceTopology } from "../sensor/service-topology.js";
+import { hypothesisHistory } from "../intelligence/hypothesis-history.js";
+import { getCostGuardStats } from "../intelligence/incident-autopilot.js";
+import { getUsageSnapshot, recordExplainWhyFeedback } from "../intelligence/usage.js";
+import { toolCallCounts, lastMcpCallAt, firstAnalyzeAt, lastTimeToFirstAnalysisMs } from "../intelligence/tools.js";
+import { listActiveSessions } from "../intelligence/debug-sessions.js";
+import { getTeamState, isTeamEnabled } from "../intelligence/team.js";
+import { getStats } from "../intelligence/calibration.js";
+import { getDegradationState } from "../intelligence/degradation-watcher.js";
+import { getPendingBypasses } from "../intelligence/tool-guard.js";
+import { getPendingHolds } from "../intelligence/hitl-hold.js";
+import { getGateHeartbeatStatus } from "../sensor/gate-heartbeat.js";
+import { getRecentActivity } from "../intelligence/activity-feed.js";
+import { loadEnterprisePolicy, IMMUTABLE_RULE_IDS, getGateCoverageSummary, getLastEvalLatencyMs } from "../intelligence/enterprise-policy-engine.js";
+import { getRuleFirings, getBlockedActionCount } from "../intelligence/gate-analytics.js";
+import { agentCallCount } from "../intelligence/tools-state.js";
+import { getBypassStats } from "../sensor/bypass-tracker.js";
+import { getEbpfCapability } from "../intelligence/ebpf-verify.js";
+import { getMacSandboxCapability } from "../intelligence/sandbox.js";
+function createSensorRouter(serverVersion) {
+  const router = Router();
+  router.get("/health", async (req, res) => {
+    const tid = req.tenantId;
+    const teamState = getTeamState();
+    const counters = store.getCounters(tid);
+    const buffered = store.size(tid);
+    const signals = store.getSignals(tid);
+    const allClear = counters.errors === 0 && counters.networkErrors === 0 && signals.length === 0 && buffered > 0;
+    res.json({
+      ok: true,
+      buffered,
+      errors: counters.errors,
+      warnings: counters.warnings,
+      networkErrors: counters.networkErrors,
+      websocketConnections: store.getWebSocketCount(tid),
+      lastEventAt: store.lastEventAt(tid),
+      clearedAt: store.clearedAt(),
+      mcpLastCallAt: lastMcpCallAt,
+      firstAnalyzeAt,
+      lastTimeToFirstAnalysisMs,
+      metrics: getMetricCounters(),
+      signals,
+      allClear,
+      allClearMessage: allClear ? `\u2705 0 errors in the last session (${buffered} events captured)` : null,
+      allClearSince: allClear ? store.clearedAt() ?? store.lastEventAt() : null,
+      name: "mergen",
+      version: serverVersion,
+      teamSync: isTeamEnabled() ? { enabled: true, memberName: teamState?.memberName, connectedPeers: 0 } : { enabled: false },
+      costGuard: getCostGuardStats(),
+      degradation: getDegradationState(),
+      gateHeartbeat: getGateHeartbeatStatus(),
+      pendingBypassesCount: (getPendingBypasses() ?? []).length + getPendingHolds().length,
+      blockedActionsCount: getBlockedActionCount(),
+      // Linux-only, opt-in (MERGEN_EBPF_VERIFY=true) syscall-level BLOCK
+      // verification — explicit here so a team relying on it can see at a
+      // glance whether it's actually active on this host, not silently no-op.
+      ebpfCapability: getEbpfCapability(),
+      // macOS-only, opt-in (MERGEN_SANDBOX=seatbelt) native sandbox-exec
+      // execution guard — surfaced for the same reason as ebpfCapability
+      // above: a team relying on it should be able to see at a glance
+      // whether it's actually active on this host.
+      macSandboxCapability: getMacSandboxCapability()
+    });
+  });
+  router.post("/clear", (req, res) => {
+    const tid = req.tenantId;
+    const was = store.size(tid);
+    const events = store.serialize(tid);
+    saveSessionToHistory(events, "manual-clear");
+    store.clear();
+    historyStore.clear();
+    hypothesisHistory.clear();
+    res.json({ ok: true, cleared: was });
+  });
+  router.post("/checkpoint", (req, res) => {
+    const { label } = req.body ?? {};
+    const name = typeof label === "string" && label.trim() ? label.trim().slice(0, 120) : "checkpoint";
+    store.push({
+      type: "console",
+      level: "log",
+      args: [`[mergen:checkpoint] ${name}`],
+      url: "mergen://checkpoint",
+      timestamp: Date.now()
+    }, req.tenantId);
+    const signals = store.getSignals(req.tenantId);
+    res.json({
+      ok: true,
+      label: name,
+      buffered: store.size(req.tenantId),
+      signals: signals.length,
+      topSignal: signals[0] ?? null
+    });
+  });
+  router.get("/diagnose", async (req, res) => {
+    const tid = req.tenantId;
+    const logs = store.getLogs(200, void 0, void 0, tid);
+    const network = store.getNetwork(200, void 0, void 0, tid);
+    const contexts = store.getContext(20, void 0, tid);
+    const terminal = store.getTerminalOutput(100, void 0, void 0, tid);
+    const processExits = store.getProcessExits(20, void 0, void 0, tid);
+    const ciEvents = store.getCIEvents(20, void 0, void 0, tid);
+    const deployments = store.getDeployments(10, void 0, void 0, tid);
+    const causal = await buildCausalChain(logs, network, contexts, void 0, terminal, processExits, ciEvents, deployments);
+    const SYSTEM = [
+      "You are a concise runtime-debug assistant.",
+      'You will receive a structured telemetry report called a "Context Pack".',
+      "Your job is to identify the root cause of the bug and the exact fix.",
+      "",
+      "Rules:",
+      "1. Respond with a single JSON object only \u2014 no surrounding prose, no markdown fences.",
+      "2. Be maximally specific: name the endpoint, field, or code path that is broken.",
+      "3. The fix must be a concrete, immediately-applicable action (a code line, not a concept).",
+      "4. If you are not confident, say so in missing_signals \u2014 do not hallucinate."
+    ].join("\n");
+    const USER = [
+      causal.contextPack,
+      "",
+      "Return a single JSON object with exactly these fields:",
+      "  root_cause  \u2014 one sentence naming what broke and why (be specific: endpoint/field/line)",
+      "  fix         \u2014 one concrete action: a code line, config change, or exact command",
+      "  confidence  \u2014 HIGH | MEDIUM | LOW",
+      "  missing_signals \u2014 what telemetry would make this HIGH confidence, or null"
+    ].join("\n");
+    const openaiRequest = {
+      model: process.env.MERGEN_MODEL ?? "gpt-4o",
+      temperature: 0,
+      response_format: { type: "json_object" },
+      messages: [
+        { role: "system", content: SYSTEM },
+        { role: "user", content: USER }
+      ]
+    };
+    res.json({
+      ok: true,
+      buffered: store.size(tid),
+      hypotheses: causal.hypotheses.length,
+      contextPack: causal.contextPack,
+      openai_request: openaiRequest,
+      prompt: { system: SYSTEM, user: USER }
+    });
+  });
+  router.get("/usage", (_req, res) => {
+    res.json({ ...getUsageSnapshot(), toolCallCounts });
+  });
+  router.post("/explain-why/feedback", (req, res) => {
+    const { id, helpful } = req.body;
+    if (typeof helpful !== "boolean") {
+      res.status(400).json({ error: '"helpful" must be a boolean' });
+      return;
+    }
+    recordExplainWhyFeedback(helpful);
+    res.json({ ok: true, id: id ?? null, helpful });
+  });
+  router.get("/last-pack", (_req, res) => {
+    const latest = hypothesisHistory.latest();
+    if (!latest) {
+      res.json({ ok: true, hasPack: false });
+      return;
+    }
+    const statsByTag = new Map(getStats().map((s) => [s.tag, s]));
+    const enrich = (h) => h ? { ...h, calibration: statsByTag.get(h.tag) ?? null } : h;
+    res.json({
+      ok: true,
+      hasPack: true,
+      builtAt: latest.builtAt,
+      builtAtIso: latest.builtAtIso,
+      triggerMessage: latest.triggerMessage,
+      reason: latest.reason,
+      topHypothesis: enrich(latest.topHypothesis),
+      hypotheses: latest.chain.hypotheses.map((h) => enrich(h)),
+      contextPack: latest.chain.contextPack,
+      hypothesesCount: latest.chain.hypotheses.length,
+      errorsCount: latest.chain.errors.length
+    });
+  });
+  router.get("/history", (req, res) => {
+    const limit = Math.min(20, Math.max(1, Number(req.query.limit ?? 10)));
+    const statsByTag = new Map(getStats().map((s) => [s.tag, s]));
+    const entries = hypothesisHistory.list(limit).map((e) => ({
+      ...e,
+      topHypothesis: e.topHypothesis ? { ...e.topHypothesis, calibration: statsByTag.get(e.topHypothesis.tag) ?? null } : null
+    }));
+    res.json({ ok: true, entries });
+  });
+  router.get("/graph", async (req, res) => {
+    const seconds = Math.min(600, Math.max(1, Number(req.query.seconds ?? 60)));
+    const since = Date.now() - seconds * 1e3;
+    const logs = store.getLogs(200, void 0, since);
+    const network = store.getNetwork(200, void 0, since);
+    const contexts = store.getContext(20, since);
+    const terminal = store.getTerminalOutput(100, void 0, since);
+    const processExits = store.getProcessExits(20, void 0, since);
+    const ciEvents = store.getCIEvents(20, void 0, since);
+    const deployments = store.getDeployments(10, void 0, since);
+    const causal = await buildCausalChain(logs, network, contexts, since, terminal, processExits, ciEvents, deployments);
+    const graph = buildCausalGraph(causal);
+    res.json({ ok: true, windowSeconds: seconds, graph });
+  });
+  router.get("/topology", (_req, res) => {
+    res.json({ ok: true, ...serviceTopology.snapshot() });
+  });
+  router.get("/timeline", (req, res) => {
+    const seconds = Math.min(600, Math.max(1, Number(req.query.seconds ?? 60)));
+    const limit = Math.min(500, Math.max(1, Number(req.query.limit ?? 200)));
+    const since = Date.now() - seconds * 1e3;
+    const logs = store.getLogs(limit, void 0, since);
+    const network = store.getNetwork(limit, void 0, since);
+    const ctx = store.getContext(20, since);
+    const terminal = store.getTerminalOutput(limit, void 0, since);
+    const processExits = store.getProcessExits(limit, void 0, since);
+    const rows = [];
+    for (const e of logs) {
+      const summary = e.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ").slice(0, 200);
+      rows.push({ ts: e.timestamp, isoTs: new Date(e.timestamp).toISOString(), kind: e.level, summary });
+    }
+    for (const n of network) {
+      const isFail = n.status >= 400 || n.status === 0 || !!n.error;
+      const label = n.status === 0 ? `network error (${n.error ?? "\u2014"})` : `${n.status} ${n.statusText}`;
+      rows.push({
+        ts: n.timestamp,
+        isoTs: new Date(n.timestamp).toISOString(),
+        kind: "request",
+        summary: `${n.method} ${n.url} \u2192 ${label} (${n.duration}ms)${isFail ? " \u26A0" : ""}`
+      });
+    }
+    for (const c of ctx) {
+      rows.push({
+        ts: c.timestamp,
+        isoTs: new Date(c.timestamp).toISOString(),
+        kind: "context",
+        summary: `[${c.trigger}] ${c.url}`
+      });
+    }
+    for (const t of terminal) {
+      rows.push({
+        ts: t.timestamp,
+        isoTs: new Date(t.timestamp).toISOString(),
+        kind: "terminal",
+        summary: t.data.slice(0, 200),
+        source: t.terminalName
+      });
+    }
+    for (const p of processExits) {
+      rows.push({
+        ts: p.timestamp,
+        isoTs: new Date(p.timestamp).toISOString(),
+        kind: "process_exit",
+        summary: `[${p.process}] exited ${p.exitCode} (${p.reason})${p.signal ? " \xB7 " + p.signal : ""}`,
+        source: p.process
+      });
+    }
+    rows.sort((a, b) => a.ts - b.ts);
+    res.json({ ok: true, windowSeconds: seconds, count: rows.length, rows: rows.slice(-limit) });
+  });
+  router.get("/current-version", (_req, res) => {
+    const deploys = store.getDeployments(5);
+    const latest = deploys.find((d) => d.status === "success") ?? deploys[0] ?? null;
+    res.json({
+      ok: true,
+      sha: latest?.sha ?? null,
+      shortSha: latest?.shortSha ?? (latest?.sha?.slice(0, 7) ?? null),
+      environment: latest?.environment ?? null,
+      service: latest?.service ?? null,
+      deployedAt: latest ? new Date(latest.timestamp).toISOString() : null
+    });
+  });
+  router.get("/timeline/unified", (req, res) => {
+    const seconds = Math.min(3600, Math.max(1, Number(req.query.seconds ?? 300)));
+    const limit = Math.min(200, Math.max(1, Number(req.query.limit ?? 50)));
+    const since = Date.now() - seconds * 1e3;
+    const rows = [];
+    for (const e of store.getLogs(limit, void 0, since)) {
+      rows.push({
+        ts: e.timestamp,
+        isoTs: new Date(e.timestamp).toISOString(),
+        kind: e.level === "error" ? "error" : e.level === "warn" ? "warn" : "log",
+        summary: e.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ").slice(0, 200),
+        source: "browser"
+      });
+    }
+    for (const n of store.getNetwork(limit, void 0, since)) {
+      const fail = n.status >= 400 || n.status === 0 || !!n.error;
+      if (!fail) continue;
+      rows.push({
+        ts: n.timestamp,
+        isoTs: new Date(n.timestamp).toISOString(),
+        kind: "request",
+        summary: `${n.method} ${n.url} \u2192 ${n.status || "ERR"} ${n.statusText} (${n.duration}ms)${n.error ? " \u2014 " + n.error : ""}`,
+        source: "browser"
+      });
+    }
+    const BACKEND_ERROR_RE = /error|exception|traceback|panic|fatal|killed|oom/i;
+    for (const t of store.getTerminalOutput(limit, void 0, since)) {
+      if (!BACKEND_ERROR_RE.test(t.data)) continue;
+      rows.push({
+        ts: t.timestamp,
+        isoTs: new Date(t.timestamp).toISOString(),
+        kind: "terminal",
+        summary: `[${t.terminalName}] ${t.data.slice(0, 200)}`,
+        source: "backend"
+      });
+    }
+    for (const p of store.getProcessExits(20, void 0, since)) {
+      if (p.reason === "normal") continue;
+      rows.push({
+        ts: p.timestamp,
+        isoTs: new Date(p.timestamp).toISOString(),
+        kind: "process_exit",
+        summary: `[${p.process}] exited ${p.exitCode} (${p.reason})${p.signal ? " \xB7 " + p.signal : ""}`,
+        source: "backend"
+      });
+    }
+    for (const c of store.getCIEvents(50, void 0, since)) {
+      rows.push({
+        ts: c.timestamp,
+        isoTs: new Date(c.timestamp).toISOString(),
+        kind: c.status === "failure" ? "ci_failure" : "ci_success",
+        summary: c.status === "failure" ? `CI failed: ${c.job}${c.workflow ? " (" + c.workflow + ")" : ""}${c.failedTests && c.failedTests.length > 0 ? " \u2014 " + c.failedTests.slice(0, 3).map((t) => t.name).join(", ") : ""}` : `CI passed: ${c.job}${c.workflow ? " (" + c.workflow + ")" : ""}`,
+        source: "ci",
+        sha: c.shortSha ?? c.sha.slice(0, 7)
+      });
+    }
+    for (const d of store.getDeployments(20, void 0, since)) {
+      rows.push({
+        ts: d.timestamp,
+        isoTs: new Date(d.timestamp).toISOString(),
+        kind: "deployment",
+        summary: `Deploy to ${d.environment}: ${d.status}${d.service ? " (" + d.service + ")" : ""}${d.actor ? " by " + d.actor : ""}`,
+        source: "deploy",
+        sha: d.shortSha ?? d.sha.slice(0, 7)
+      });
+    }
+    const browserTraceIds = new Set(
+      store.getNetwork(200, void 0, since).filter((n) => n.traceId).map((n) => n.traceId)
+    );
+    for (const s of store.getBackendSpans(limit, void 0, since)) {
+      const joined = browserTraceIds.has(s.traceId);
+      rows.push({
+        ts: s.timestamp,
+        isoTs: new Date(s.timestamp).toISOString(),
+        kind: "backend_span",
+        summary: `[${s.service}] ${s.method} ${s.route} \u2192 ${s.statusCode} (${s.durationMs}ms)${s.error ? " \u2014 " + s.error : ""}`,
+        source: "backend",
+        confidence: joined ? 1 : 0.5,
+        traceId: s.traceId
+      });
+    }
+    rows.sort((a, b) => a.ts - b.ts);
+    const latest = hypothesisHistory.latest();
+    const topHyp = latest?.topHypothesis ?? null;
+    const statsByTag = new Map(getStats().map((s) => [s.tag, s]));
+    const rootCause = topHyp ? {
+      hypothesis: topHyp.summary,
+      tag: topHyp.tag,
+      confidence: topHyp.confidenceScore,
+      fixHint: topHyp.fixHint,
+      builtAt: latest?.builtAt,
+      calibration: statsByTag.get(topHyp.tag) ?? null
+    } : null;
+    res.json({
+      ok: true,
+      windowSeconds: seconds,
+      count: rows.length,
+      rootCause,
+      rows: rows.slice(-limit)
+    });
+  });
+  router.get("/unified-dashboard", async (req, res) => {
+    const tid = req.tenantId;
+    const teamState = getTeamState();
+    const counters = store.getCounters(tid);
+    const buffered = store.size(tid);
+    const signals = store.getSignals(tid);
+    const allClear = counters.errors === 0 && counters.networkErrors === 0 && signals.length === 0 && buffered > 0;
+    const health = {
+      ok: true,
+      buffered,
+      errors: counters.errors,
+      warnings: counters.warnings,
+      networkErrors: counters.networkErrors,
+      websocketConnections: store.getWebSocketCount(tid),
+      lastEventAt: store.lastEventAt(tid),
+      clearedAt: store.clearedAt(),
+      mcpLastCallAt: lastMcpCallAt,
+      firstAnalyzeAt,
+      lastTimeToFirstAnalysisMs,
+      metrics: getMetricCounters(),
+      signals,
+      allClear,
+      allClearMessage: allClear ? `\u2705 0 errors in the last session (${buffered} events captured)` : null,
+      allClearSince: allClear ? store.clearedAt() ?? store.lastEventAt() : null,
+      name: "mergen",
+      version: serverVersion,
+      teamSync: isTeamEnabled() ? { enabled: true, memberName: teamState?.memberName, connectedPeers: 0 } : { enabled: false },
+      costGuard: getCostGuardStats(),
+      pendingBypassesCount: (getPendingBypasses() ?? []).length + getPendingHolds().length,
+      blockedActionsCount: getBlockedActionCount()
+    };
+    const usage = getUsageSnapshot();
+    const latest = hypothesisHistory.latest();
+    const stats = getStats();
+    const statsByTag = new Map(stats.map((s) => [s.tag, s]));
+    const enrich = (h) => h ? { ...h, calibration: statsByTag.get(h.tag) ?? null } : h;
+    const lastPack = latest ? {
+      ok: true,
+      hasPack: true,
+      builtAt: latest.builtAt,
+      builtAtIso: latest.builtAtIso,
+      triggerMessage: latest.triggerMessage,
+      reason: latest.reason,
+      topHypothesis: enrich(latest.topHypothesis),
+      hypotheses: latest.chain.hypotheses.map((h) => enrich(h)),
+      contextPack: latest.chain.contextPack,
+      hypothesesCount: latest.chain.hypotheses.length,
+      errorsCount: latest.chain.errors.length
+    } : { ok: true, hasPack: false };
+    const history = hypothesisHistory.list(5).map((e) => ({
+      ...e,
+      topHypothesis: e.topHypothesis ? { ...e.topHypothesis, calibration: statsByTag.get(e.topHypothesis.tag) ?? null } : null
+    }));
+    const trusted = stats.filter((s) => s.trusted);
+    const totalVerdicts = trusted.reduce((sum, s) => sum + s.verdicts, 0);
+    const overall = totalVerdicts > 0 ? trusted.reduce((sum, s) => sum + s.accuracy * s.verdicts, 0) / totalVerdicts : null;
+    const calibration = {
+      ok: true,
+      overallAccuracy: overall,
+      trustedDetectors: trusted.length,
+      totalDetectors: stats.length,
+      perDetector: stats
+    };
+    const seconds = 300;
+    const limit = 12;
+    const since = Date.now() - seconds * 1e3;
+    const rows = [];
+    for (const e of store.getLogs(limit, void 0, since)) {
+      rows.push({
+        ts: e.timestamp,
+        isoTs: new Date(e.timestamp).toISOString(),
+        kind: e.level === "error" ? "error" : e.level === "warn" ? "warn" : "log",
+        summary: e.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ").slice(0, 200),
+        source: "browser"
+      });
+    }
+    for (const n of store.getNetwork(limit, void 0, since)) {
+      const fail = n.status >= 400 || n.status === 0 || !!n.error;
+      if (!fail) continue;
+      rows.push({
+        ts: n.timestamp,
+        isoTs: new Date(n.timestamp).toISOString(),
+        kind: "request",
+        summary: `${n.method} ${n.url} \u2192 ${n.status || "ERR"} ${n.statusText} (${n.duration}ms)${n.error ? " \u2014 " + n.error : ""}`,
+        source: "browser"
+      });
+    }
+    const BACKEND_ERROR_RE = /error|exception|traceback|panic|fatal|killed|oom/i;
+    for (const t of store.getTerminalOutput(limit, void 0, since)) {
+      if (!BACKEND_ERROR_RE.test(t.data)) continue;
+      rows.push({
+        ts: t.timestamp,
+        isoTs: new Date(t.timestamp).toISOString(),
+        kind: "terminal",
+        summary: `[${t.terminalName}] ${t.data.slice(0, 200)}`,
+        source: "backend"
+      });
+    }
+    for (const p of store.getProcessExits(20, void 0, since)) {
+      if (p.reason === "normal") continue;
+      rows.push({
+        ts: p.timestamp,
+        isoTs: new Date(p.timestamp).toISOString(),
+        kind: "process_exit",
+        summary: `[${p.process}] exited ${p.exitCode} (${p.reason})${p.signal ? " \xB7 " + p.signal : ""}`,
+        source: "backend"
+      });
+    }
+    for (const c of store.getCIEvents(50, void 0, since)) {
+      rows.push({
+        ts: c.timestamp,
+        isoTs: new Date(c.timestamp).toISOString(),
+        kind: c.status === "failure" ? "ci_failure" : "ci_success",
+        summary: c.status === "failure" ? `CI failed: ${c.job}${c.workflow ? " (" + c.workflow + ")" : ""}${c.failedTests && c.failedTests.length > 0 ? " \u2014 " + c.failedTests.slice(0, 3).map((t) => t.name).join(", ") : ""}` : `CI passed: ${c.job}${c.workflow ? " (" + c.workflow + ")" : ""}`,
+        source: "ci",
+        sha: c.shortSha ?? c.sha.slice(0, 7)
+      });
+    }
+    for (const d of store.getDeployments(20, void 0, since)) {
+      rows.push({
+        ts: d.timestamp,
+        isoTs: new Date(d.timestamp).toISOString(),
+        kind: "deployment",
+        summary: `Deploy to ${d.environment}: ${d.status}${d.service ? " (" + d.service + ")" : ""}${d.actor ? " by " + d.actor : ""}`,
+        source: "deploy",
+        sha: d.shortSha ?? d.sha.slice(0, 7)
+      });
+    }
+    const browserTraceIds = new Set(
+      store.getNetwork(200, void 0, since).filter((n) => n.traceId).map((n) => n.traceId)
+    );
+    for (const s of store.getBackendSpans(limit, void 0, since)) {
+      const joined = browserTraceIds.has(s.traceId);
+      rows.push({
+        ts: s.timestamp,
+        isoTs: new Date(s.timestamp).toISOString(),
+        kind: "backend_span",
+        summary: `[${s.service}] ${s.method} ${s.route} \u2192 ${s.statusCode} (${s.durationMs}ms)${s.error ? " \u2014 " + s.error : ""}`,
+        source: "backend",
+        confidence: joined ? 1 : 0.5,
+        traceId: s.traceId
+      });
+    }
+    rows.sort((a, b) => a.ts - b.ts);
+    const topHyp = latest?.topHypothesis ?? null;
+    const rootCause = topHyp ? {
+      hypothesis: topHyp.summary,
+      tag: topHyp.tag,
+      confidence: topHyp.confidenceScore,
+      fixHint: topHyp.fixHint,
+      builtAt: latest?.builtAt,
+      calibration: statsByTag.get(topHyp.tag) ?? null
+    } : null;
+    const timelineUnified = {
+      ok: true,
+      windowSeconds: seconds,
+      count: rows.length,
+      rootCause,
+      rows: rows.slice(-limit)
+    };
+    const edges = await getStores().incidents.getInteractionGraph(void 0, req.tenantId);
+    const interactionServices = [...new Set(edges.flatMap((e) => [e.source, e.target]))];
+    const interactions = {
+      edges,
+      services: interactionServices
+    };
+    const services = getSdkServices();
+    const policy = loadEnterprisePolicy();
+    const firings = getRuleFirings();
+    const policies = {
+      enabled: policy.enabled,
+      rules: policy.rules.map((r) => ({
+        id: r.id,
+        name: r.name,
+        description: r.description,
+        action: r.action,
+        triggerCount: firings.get(r.id) ?? 0,
+        immutable: IMMUTABLE_RULE_IDS.has(r.id)
+      }))
+    };
+    const gateCovers = getGateCoverageSummary();
+    const activity = getRecentActivity(20);
+    const bypassStats = getBypassStats();
+    const securityMetrics = {
+      protectedActions: agentCallCount,
+      // getBlockedActionCount() = real-time in-memory count of BLOCK verdicts from the gate.
+      blockedActions: getBlockedActionCount(),
+      // approvalsRequested = outstanding human-approval queue across both mechanisms:
+      //   • HITL bypass requests (warn-rule triggers awaiting approve/deny)
+      //   • HITL holds (policy holds awaiting quorum approval)
+      approvalsRequested: (getPendingBypasses() ?? []).length + getPendingHolds().length,
+      // shadowViolations = bypasses actually granted (agent got through a warn gate)
+      shadowViolations: bypassStats.totalBypasses,
+      latencyMs: getLastEvalLatencyMs()
+    };
+    res.json({
+      health,
+      usage,
+      lastPack,
+      history,
+      calibration,
+      timelineUnified,
+      services,
+      interactions,
+      pendingBypasses: getPendingBypasses(),
+      activity,
+      policies,
+      gateCovers,
+      securityMetrics
+    });
+  });
+  function getSdkServices() {
+    const logs = store.getLogs(500);
+    const spans = store.getBackendSpans(200);
+    const services = /* @__PURE__ */ new Map();
+    for (const e of logs) {
+      if (!e.url?.startsWith("mergen://node/") && !e.url?.startsWith("mergen://python/")) continue;
+      const parts = e.url.split("/");
+      const sdk = parts[2] ?? "unknown";
+      const name = parts[3] ?? "unknown";
+      const key = `${sdk}/${name}`;
+      const prev = services.get(key);
+      services.set(key, {
+        sdk,
+        lastSeen: Math.max(e.timestamp, prev?.lastSeen ?? 0),
+        errorCount: (prev?.errorCount ?? 0) + (e.level === "error" ? 1 : 0),
+        spanCount: prev?.spanCount ?? 0
+      });
+    }
+    for (const s of spans) {
+      const key = `${s.sdk}/${s.service}`;
+      const prev = services.get(key);
+      services.set(key, {
+        sdk: s.sdk,
+        lastSeen: Math.max(s.timestamp, prev?.lastSeen ?? 0),
+        errorCount: (prev?.errorCount ?? 0) + (s.statusCode >= 400 ? 1 : 0),
+        spanCount: (prev?.spanCount ?? 0) + 1
+      });
+    }
+    return Object.fromEntries(services);
+  }
+  router.get("/watchers", (_req, res) => {
+    res.json({
+      ok: true,
+      processes: listProcessWatchers(),
+      containers: listStreamedContainers()
+    });
+  });
+  router.post("/watchers/start", (req, res) => {
+    const { name, command, args, cwd } = req.body ?? {};
+    if (!command || typeof command !== "string") {
+      res.status(400).json({ error: "command is required" });
+      return;
+    }
+    const watcherName = typeof name === "string" && name.trim() ? name.trim() : command;
+    startProcessWatcher({ name: watcherName, command, args, cwd });
+    res.json({ ok: true, name: watcherName });
+  });
+  router.post("/watchers/stop", (req, res) => {
+    const { name } = req.body ?? {};
+    if (!name || typeof name !== "string") {
+      res.status(400).json({ error: "name is required" });
+      return;
+    }
+    stopProcessWatcher(name);
+    res.json({ ok: true });
+  });
+  router.post("/watchers/docker", async (_req, res) => {
+    await startDockerLogStream();
+    res.json({ ok: true, containers: listStreamedContainers() });
+  });
+  router.delete("/watchers/docker", (_req, res) => {
+    stopDockerLogStream();
+    res.json({ ok: true });
+  });
+  let _captureMarkTs = null;
+  router.post("/mark", (_req, res) => {
+    _captureMarkTs = Date.now();
+    res.json({ ok: true, timestamp: _captureMarkTs, iso: new Date(_captureMarkTs).toISOString() });
+  });
+  router.get("/mark", (_req, res) => {
+    res.json({ ok: true, timestamp: _captureMarkTs, iso: _captureMarkTs ? new Date(_captureMarkTs).toISOString() : null });
+  });
+  router.get("/sessions", (_req, res) => {
+    const sessions = listActiveSessions().map((s) => {
+      const last = s.iterations.length > 0 ? s.iterations[s.iterations.length - 1] : null;
+      return {
+        id: s.id,
+        description: s.description,
+        targetComponent: s.targetComponent ?? null,
+        startedAt: s.startedAt,
+        iterationCount: s.iterations.length,
+        baselineErrorCount: s.baseline.errors.length,
+        baselineNetworkFailureCount: s.baseline.networkFailures.length,
+        latestDiff: last ? {
+          resolved: last.diff.resolved.length,
+          persisted: last.diff.persisted.length,
+          newErrors: last.diff.newErrors.length,
+          isFixed: last.diff.isFixed
+        } : null
+      };
+    });
+    res.json({ ok: true, sessions });
+  });
+  router.get("/export/incident", async (req, res) => {
+    const from = Number(req.query.from) || Date.now() - 60 * 60 * 1e3;
+    const to = Number(req.query.to) || Date.now();
+    const sha = typeof req.query.sha === "string" ? req.query.sha : void 0;
+    const format = req.query.format === "json" ? "json" : "md";
+    const window = { from, to };
+    const since = window.from;
+    const logs = store.getLogs(500, void 0, since).filter((e) => e.timestamp <= to);
+    const network = store.getNetwork(500, void 0, since).filter((e) => e.timestamp <= to);
+    const terminal = store.getTerminalOutput(200, void 0, since).filter((e) => e.timestamp <= to);
+    const ciEvents = store.getCIEvents(50, void 0, since).filter((e) => e.timestamp <= to);
+    const deployments = store.getDeployments(20, void 0, since).filter((e) => e.timestamp <= to);
+    const exits = store.getProcessExits(20, void 0, since).filter((e) => e.timestamp <= to);
+    const filteredDeploy = sha ? deployments.filter((d) => d.sha?.startsWith(sha) || sha.startsWith(d.sha?.slice(0, 7) ?? "")) : deployments;
+    const latest = hypothesisHistory.latest();
+    const topHyp = latest?.topHypothesis ?? null;
+    const errors = logs.filter((e) => e.level === "error");
+    const warns = logs.filter((e) => e.level === "warn");
+    const netFail = network.filter((n) => n.status >= 400 || n.status === 0);
+    const affectedServices = [
+      .../* @__PURE__ */ new Set([
+        ...netFail.map((n) => {
+          try {
+            return new URL(n.url).hostname;
+          } catch {
+            return n.url;
+          }
+        }),
+        ...terminal.filter((t) => /error|exception|fatal/i.test(t.data)).map((t) => t.terminalName)
+      ])
+    ];
+    if (format === "json") {
+      res.json({
+        ok: true,
+        generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        window: { from: new Date(from).toISOString(), to: new Date(to).toISOString() },
+        sha,
+        topHypothesis: topHyp,
+        affectedServices,
+        summary: { errors: errors.length, warnings: warns.length, networkFailures: netFail.length },
+        deployments: filteredDeploy,
+        ciEvents,
+        timeline: logs.concat(network).sort((a, b) => a.timestamp - b.timestamp)
+      });
+      return;
+    }
+    const lines = [];
+    const startIso = new Date(from).toISOString();
+    const endIso = new Date(to).toISOString();
+    const depRef = filteredDeploy[0];
+    lines.push(`# Incident Postmortem \u2014 ${startIso.slice(0, 10)}`);
+    lines.push("");
+    if (topHyp) {
+      lines.push(`**Root Cause**`);
+      lines.push(`${topHyp.summary}`);
+      if (topHyp.evidence && topHyp.evidence.length > 0) {
+        lines.push("");
+        lines.push(`**Evidence**`);
+        for (const ev of topHyp.evidence) lines.push(`- ${ev}`);
+      }
+    }
+    lines.push("");
+    lines.push(`**Window:** ${startIso.slice(11, 19)} \u2192 ${endIso.slice(11, 19)} UTC`);
+    if (depRef) lines.push(`**SHA:** \`${depRef.shortSha ?? depRef.sha.slice(0, 7)}\` \u2014 deployed to ${depRef.environment}${depRef.actor ? " by " + depRef.actor : ""}`);
+    if (topHyp?.fixHint) lines.push(`**Fix:** ${topHyp.fixHint}`);
+    lines.push("");
+    lines.push("## Summary");
+    lines.push("");
+    lines.push(`| Signal | Count |`);
+    lines.push(`|--------|-------|`);
+    lines.push(`| Browser errors | ${errors.length} |`);
+    lines.push(`| Warnings | ${warns.length} |`);
+    lines.push(`| Network failures | ${netFail.length} |`);
+    lines.push(`| CI failures | ${ciEvents.filter((c) => c.status === "failure").length} |`);
+    lines.push(`| Deployments | ${filteredDeploy.length} |`);
+    lines.push("");
+    if (affectedServices.length > 0) {
+      lines.push("## Affected Services");
+      lines.push("");
+      for (const svc of affectedServices) lines.push(`- ${svc}`);
+      lines.push("");
+    }
+    lines.push("## Timeline");
+    lines.push("");
+    lines.push("| Time | Source | Event |");
+    lines.push("|------|--------|-------|");
+    const rows = [];
+    for (const c of ciEvents) rows.push({ ts: c.timestamp, src: "CI", msg: `${c.status === "failure" ? "\u274C" : "\u2705"} ${c.job}${c.failedTests?.length ? " \u2014 " + c.failedTests.slice(0, 2).map((t) => t.name).join(", ") : ""}` });
+    for (const d of filteredDeploy) rows.push({ ts: d.timestamp, src: "Deploy", msg: `\u{1F680} Deployed to ${d.environment}: ${d.status}${d.actor ? " by " + d.actor : ""}` });
+    for (const e of errors) rows.push({ ts: e.timestamp, src: "Browser", msg: `\u{1F534} ${e.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ").slice(0, 100)}` });
+    for (const n of netFail) rows.push({ ts: n.timestamp, src: "Network", msg: `${n.method} ${n.url} \u2192 ${n.status} (${n.duration}ms)` });
+    for (const t of terminal.filter((t2) => /error|exception|fatal/i.test(t2.data))) rows.push({ ts: t.timestamp, src: t.terminalName, msg: t.data.slice(0, 100) });
+    for (const p of exits.filter((p2) => p2.reason !== "normal")) rows.push({ ts: p.timestamp, src: p.process, msg: `\u{1F4A5} Exited ${p.exitCode} (${p.reason})` });
+    rows.sort((a, b) => a.ts - b.ts);
+    for (const r of rows) {
+      const t = new Date(r.ts).toISOString().slice(11, 19);
+      lines.push(`| ${t} | ${r.src} | ${r.msg.replace(/\|/g, "/")} |`);
+    }
+    lines.push("");
+    if (topHyp?.evidence?.length) {
+      lines.push("## Evidence");
+      lines.push("");
+      for (const e of topHyp.evidence) lines.push(`- ${e}`);
+      lines.push("");
+    }
+    lines.push("---");
+    lines.push(`*Generated by Mergen at ${(/* @__PURE__ */ new Date()).toISOString()}*`);
+    res.setHeader("Content-Type", "text/markdown; charset=utf-8");
+    res.send(lines.join("\n"));
+  });
+  router.get("/replay", (req, res) => {
+    const since = Number(req.query["since"]) || 0;
+    const limit = Math.min(Number(req.query["limit"]) || 500, 2e3);
+    const level = typeof req.query["level"] === "string" ? req.query["level"] : void 0;
+    const type = typeof req.query["type"] === "string" ? req.query["type"] : void 0;
+    const events = historyStore.query({ since, limit, level, type });
+    res.json({ ok: true, count: events.length, events });
+  });
+  router.get("/sdk-status", (_req, res) => {
+    res.json({ ok: true, services: getSdkServices() });
+  });
+  router.get("/trace/:traceId", (req, res) => {
+    const traceId = req.params["traceId"]?.toLowerCase();
+    if (!traceId || !/^[0-9a-f]{32}$/.test(traceId)) {
+      res.status(400).json({ error: "invalid traceId \u2014 must be 32 hex chars" });
+      return;
+    }
+    const browserNet = store.getNetwork(200).filter((n) => n.traceId?.toLowerCase() === traceId);
+    const backendSpans = store.getBackendSpans(50).filter((s) => s.traceId.toLowerCase() === traceId);
+    const backendLogs = store.getTerminalOutput(200).filter((t) => t.traceId?.toLowerCase() === traceId);
+    const found = browserNet.length + backendSpans.length + backendLogs.length > 0;
+    res.json({ ok: true, traceId, found, browserNet, backendSpans, backendLogs });
+  });
+  return router;
+}
+export {
+  createSensorRouter
+};