mergen-server 1.4.0

package/dist/routes/sentry.js

@@ -0,0 +1,140 @@
+import crypto from "crypto";
+import { Router } from "express";
+import { store } from "../sensor/buffer.js";
+import { hypothesisHistory } from "../intelligence/hypothesis-history.js";
+import logger from "../sensor/logger.js";
+const sentryRouter = Router();
+const SENTRY_SECRET = process.env.MERGEN_SENTRY_SECRET;
+function verifySignature(rawBody, signature) {
+  if (!SENTRY_SECRET) return true;
+  if (!signature) return false;
+  const expected = crypto.createHmac("sha256", SENTRY_SECRET).update(rawBody).digest("hex");
+  try {
+    return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
+  } catch {
+    return false;
+  }
+}
+function buildStackString(exc) {
+  const frames = exc.stacktrace?.frames ?? [];
+  const lines = frames.slice(-10).reverse().map((f) => {
+    const loc = f.filename ?? f.abs_path ?? "<unknown>";
+    const line = f.lineno ? `:${f.lineno}` : "";
+    const col = f.colno ? `:${f.colno}` : "";
+    const fn = f.function ? ` (${f.function})` : "";
+    return `  at ${loc}${line}${col}${fn}`;
+  });
+  const header = `${exc.type ?? "Error"}: ${exc.value ?? ""}`;
+  return [header, ...lines].join("\n");
+}
+function extractUrl(payload) {
+  return payload.data?.event?.request?.url ?? payload.data?.issue?.permalink ?? payload.data?.event?.url ?? "sentry://webhook";
+}
+sentryRouter.post(
+  "/webhook/sentry",
+  // Raw body capture for HMAC verification — must run before express.json()
+  // parses the body. We buffer the raw bytes here and then parse manually.
+  (req, res) => {
+    const MAX_BODY_BYTES = 2 * 1024 * 1024;
+    const chunks = [];
+    let totalBytes = 0;
+    req.on("data", (chunk) => {
+      totalBytes += chunk.length;
+      if (totalBytes > MAX_BODY_BYTES) {
+        res.status(413).json({ error: "payload too large" });
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      if (res.headersSent) return;
+      const rawBody = Buffer.concat(chunks);
+      const signature = req.headers["sentry-hook-signature"];
+      if (!verifySignature(rawBody, signature)) {
+        res.status(401).json({ error: "invalid sentry-hook-signature" });
+        return;
+      }
+      let payload;
+      try {
+        payload = JSON.parse(rawBody.toString("utf8"));
+      } catch {
+        res.status(400).json({ error: "malformed JSON" });
+        return;
+      }
+      res.status(200).json({ ok: true });
+      const action = payload.action ?? "unknown";
+      const issue = payload.data?.issue;
+      const event = payload.data?.event;
+      const url = extractUrl(payload);
+      const now = Date.now();
+      if (!["created", "triggered", "assigned"].includes(action) && action !== "unknown") {
+        logger.debug({ action }, "sentry webhook: ignoring non-error action");
+        return;
+      }
+      const level = (issue?.level ?? event?.level ?? "error").toLowerCase();
+      const logLevel = level === "warning" ? "warn" : level === "error" ? "error" : "log";
+      const title = issue?.title ?? event?.title ?? event?.logentry?.message ?? "Sentry error";
+      const culprit = issue?.culprit ?? event?.culprit ?? "";
+      const env = event?.environment ? ` [${event.environment}]` : "";
+      const project = issue?.project?.name ? ` (${issue.project.name})` : "";
+      const primaryArgs = [
+        `[sentry${env}${project}] ${title}`,
+        ...culprit ? [`  at ${culprit}`] : []
+      ];
+      let stackStr;
+      const excValues = event?.exception?.values ?? [];
+      if (excValues.length > 0) {
+        stackStr = excValues.map(buildStackString).join("\n\nCaused by:\n");
+      }
+      store.push({
+        type: "console",
+        level: logLevel,
+        args: primaryArgs,
+        stack: stackStr,
+        url,
+        timestamp: event?.timestamp ? Math.round(event.timestamp * 1e3) : now
+      });
+      if (event?.request?.url) {
+        const method = (event.request.method ?? "GET").toUpperCase();
+        const reqUrl = event.request.url;
+        const status = logLevel === "error" ? 0 : 200;
+        store.push({
+          type: "network",
+          method,
+          url: reqUrl,
+          status,
+          statusText: logLevel === "error" ? "Sentry Error Context" : "ok",
+          duration: 0,
+          requestBody: event.request.data ?? void 0,
+          error: logLevel === "error" ? `Sentry captured: ${title}` : void 0,
+          timestamp: event?.timestamp ? Math.round(event.timestamp * 1e3) : now
+        });
+      }
+      const breadcrumbs = event?.breadcrumbs?.values ?? [];
+      for (const crumb of breadcrumbs.slice(-10)) {
+        const crumbLevel = (crumb.level ?? "log").toLowerCase();
+        const crumbLogLevel = crumbLevel === "warning" ? "warn" : crumbLevel === "error" ? "error" : "log";
+        const crumbMsg = [crumb.category, crumb.message].filter(Boolean).join(": ");
+        if (!crumbMsg) continue;
+        store.push({
+          type: "console",
+          level: crumbLogLevel,
+          args: [`[sentry:breadcrumb] ${crumbMsg}`],
+          url,
+          timestamp: crumb.timestamp ? Math.round(crumb.timestamp * 1e3) : now - 1
+        });
+      }
+      if (logLevel === "error") {
+        hypothesisHistory.notifyError();
+      }
+      logger.info(
+        { action, title: title.slice(0, 80), level: logLevel, breadcrumbs: breadcrumbs.length },
+        "sentry webhook ingested"
+      );
+    });
+  }
+);
+export {
+  sentryRouter
+};

package/dist/routes/sessions.js

@@ -0,0 +1,43 @@
+import { Router } from "express";
+import { listSessionMetas, loadSessionsByTimeRange } from "../sensor/session-history.js";
+import { getAuditLog } from "../sensor/audit-log.js";
+import {
+  getSessionCallRing,
+  getSessionContaminationState,
+  getDetectedSequences
+} from "../intelligence/session-threat-tracker.js";
+function createSessionsRouter() {
+  const router = Router();
+  router.get("/sessions/history/list", (_req, res) => {
+    res.json({ sessions: listSessionMetas() });
+  });
+  router.get("/sessions/history", (req, res) => {
+    const since = parseInt(req.query.since, 10) || 0;
+    const until = parseInt(req.query.until, 10) || Date.now();
+    const limit = Math.min(parseInt(req.query.limit, 10) || 200, 2e3);
+    const events = loadSessionsByTimeRange(since, until).slice(0, limit);
+    res.json({ events, count: events.length, since, until });
+  });
+  router.get("/audit", (req, res) => {
+    const limit = Math.min(parseInt(req.query.limit, 10) || 100, 1e3);
+    res.json({ entries: getAuditLog(limit) });
+  });
+  router.get("/sessions/:id/threat-graph", (req, res) => {
+    const sessionId = req.params.id;
+    const callRing = getSessionCallRing(sessionId);
+    const contam = getSessionContaminationState(sessionId);
+    const sequences = getDetectedSequences(sessionId);
+    res.json({
+      sessionId,
+      callRing,
+      contaminated: contam.contaminated,
+      contaminationSource: contam.source,
+      contaminatedCallsRemaining: contam.callsRemaining,
+      detectedSequences: sequences
+    });
+  });
+  return router;
+}
+export {
+  createSessionsRouter
+};