mergen-server 1.4.0

package/dist/routes/tickets.js

@@ -0,0 +1,167 @@
+import { Router } from "express";
+import https from "https";
+import { store } from "../sensor/buffer.js";
+import { hypothesisHistory } from "../intelligence/hypothesis-history.js";
+import { generateReproSteps } from "../intelligence/repro-steps.js";
+import { findCodeOwners } from "../sensor/git-suspect.js";
+import logger from "../sensor/logger.js";
+function createTicketsRouter() {
+  const router = Router();
+  router.post("/tickets/linear", async (req, res) => {
+    const { pid, team_id } = req.body ?? {};
+    const apiKey = process.env.LINEAR_API_KEY ?? "";
+    const teamId = team_id ?? process.env.LINEAR_TEAM_ID ?? "";
+    if (!apiKey) {
+      res.status(400).json({ error: "LINEAR_API_KEY not configured", fix: "export LINEAR_API_KEY=lin_api_...", docs: "https://linear.app/settings/api" });
+      return;
+    }
+    if (!teamId) {
+      res.status(400).json({ error: "LINEAR_TEAM_ID not configured", fix: "export LINEAR_TEAM_ID=<team-id>  # or pass team_id in the request body", docs: "https://linear.app/settings/api" });
+      return;
+    }
+    const { title, description } = await buildTicketContent(pid);
+    const mutation = `
+      mutation CreateIssue($input: IssueCreateInput!) {
+        issueCreate(input: $input) {
+          success
+          issue { id identifier url title }
+        }
+      }
+    `;
+    try {
+      const result = await httpPost(
+        "https://api.linear.app/graphql",
+        JSON.stringify({ query: mutation, variables: { input: { teamId, title, description, priority: 2 } } }),
+        { "Authorization": apiKey, "Content-Type": "application/json" }
+      );
+      const parsed = JSON.parse(result);
+      if (parsed.errors) {
+        res.status(400).json({ error: "Linear API error", details: parsed.errors });
+        return;
+      }
+      const issue = parsed.data?.issueCreate?.issue;
+      logger.info({ id: issue?.identifier }, "linear: ticket created");
+      res.json({ ok: true, url: issue?.url, id: issue?.identifier });
+    } catch (err) {
+      logger.warn({ err }, "linear: ticket creation failed");
+      res.status(500).json({ error: err instanceof Error ? err.message : "Linear API failed" });
+    }
+  });
+  router.post("/tickets/jira", async (req, res) => {
+    const { pid, project_key } = req.body ?? {};
+    const baseUrl = process.env.JIRA_BASE_URL ?? "";
+    const email = process.env.JIRA_EMAIL ?? "";
+    const apiToken = process.env.JIRA_API_TOKEN ?? "";
+    const projectKey = project_key ?? process.env.JIRA_PROJECT_KEY ?? "";
+    if (!baseUrl) {
+      res.status(400).json({ error: "JIRA_BASE_URL not configured", fix: "export JIRA_BASE_URL=https://yourco.atlassian.net", docs: "https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/" });
+      return;
+    }
+    if (!email) {
+      res.status(400).json({ error: "JIRA_EMAIL not configured", fix: "export JIRA_EMAIL=you@company.com", docs: "https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/" });
+      return;
+    }
+    if (!apiToken) {
+      res.status(400).json({ error: "JIRA_API_TOKEN not configured", fix: "export JIRA_API_TOKEN=<token>  # create at https://id.atlassian.com/manage-profile/security/api-tokens", docs: "https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/" });
+      return;
+    }
+    if (!projectKey) {
+      res.status(400).json({ error: "JIRA_PROJECT_KEY not configured", fix: "export JIRA_PROJECT_KEY=ENG  # or pass project_key in the request body", docs: "https://support.atlassian.com/jira-software-cloud/docs/what-is-a-jira-project/" });
+      return;
+    }
+    const { title, description } = await buildTicketContent(pid);
+    const jiraPayload = {
+      fields: {
+        project: { key: projectKey },
+        summary: title,
+        description: {
+          type: "doc",
+          version: 1,
+          content: [{ type: "paragraph", content: [{ type: "text", text: description }] }]
+        },
+        issuetype: { name: "Bug" }
+      }
+    };
+    const auth = Buffer.from(`${email}:${apiToken}`).toString("base64");
+    const jiraUrl = baseUrl.replace(/\/$/, "") + "/rest/api/3/issue";
+    try {
+      const result = await httpPost(
+        jiraUrl,
+        JSON.stringify(jiraPayload),
+        { "Authorization": `Basic ${auth}`, "Content-Type": "application/json", "Accept": "application/json" }
+      );
+      const parsed = JSON.parse(result);
+      if (parsed.errors) {
+        res.status(400).json({ error: "Jira API error", details: parsed.errors });
+        return;
+      }
+      const issueUrl = `${baseUrl.replace(/\/$/, "")}/browse/${parsed.key}`;
+      logger.info({ key: parsed.key }, "jira: ticket created");
+      res.json({ ok: true, url: issueUrl, key: parsed.key });
+    } catch (err) {
+      logger.warn({ err }, "jira: ticket creation failed");
+      res.status(500).json({ error: err instanceof Error ? err.message : "Jira API failed" });
+    }
+  });
+  return router;
+}
+async function buildTicketContent(pid) {
+  const latest = hypothesisHistory.latest();
+  const hyp = pid ? latest?.chain?.hypotheses?.find((h) => h.pid === pid) ?? latest?.topHypothesis : latest?.topHypothesis;
+  const logs = store.getLogs(200);
+  const network = store.getNetwork(200);
+  const contexts = store.getContext(20);
+  const deploys = store.getDeployments(1);
+  const deploy = deploys[0] ?? null;
+  const repro = generateReproSteps(logs, network, contexts);
+  let ownersLine = "";
+  if (latest?.chain?.errors?.[0]?.primaryFrame?.file) {
+    const owners = findCodeOwners(latest.chain.errors[0].primaryFrame.file, process.cwd());
+    if (owners?.owners?.length) ownersLine = `
+Owners: ${owners.owners.join(", ")}`;
+  }
+  const title = hyp?.summary ?? "Bug report from Mergen";
+  const parts = [];
+  if (hyp?.summary) parts.push(`**Issue:** ${hyp.summary}`);
+  if (hyp?.fixHint) parts.push(`**Suggested fix:** ${hyp.fixHint}`);
+  if (deploy) parts.push(`**Affected SHA:** ${deploy.shortSha ?? deploy.sha.slice(0, 7)} (${deploy.environment})`);
+  if (ownersLine) parts.push(ownersLine);
+  if (repro.steps.length > 0) {
+    parts.push("\n**Steps to reproduce:**");
+    repro.steps.forEach((s, i) => parts.push(`${i + 1}. ${s}`));
+  }
+  if (hyp?.evidence?.length) {
+    parts.push("\n**Evidence:**");
+    hyp.evidence.slice(0, 5).forEach((e) => parts.push(`- ${e}`));
+  }
+  const dashUrl = process.env.MERGEN_DASHBOARD_URL;
+  if (dashUrl) parts.push(`
+[View in Mergen](${dashUrl}/dashboard)`);
+  parts.push("\n_Generated automatically by Mergen_");
+  return { title, description: parts.join("\n") };
+}
+function httpPost(url, body, headers) {
+  return new Promise((resolve, reject) => {
+    const parsed = new URL(url);
+    const options = {
+      hostname: parsed.hostname,
+      port: parsed.port || (parsed.protocol === "https:" ? 443 : 80),
+      path: parsed.pathname + parsed.search,
+      method: "POST",
+      headers: { ...headers, "Content-Length": Buffer.byteLength(body) }
+    };
+    const req = https.request(options, (res) => {
+      let data = "";
+      res.on("data", (c) => {
+        data += c.toString();
+      });
+      res.on("end", () => resolve(data));
+    });
+    req.on("error", reject);
+    req.write(body);
+    req.end();
+  });
+}
+export {
+  createTicketsRouter
+};

package/dist/routes/validate.js

@@ -0,0 +1,13 @@
+import { Router } from "express";
+import { getWatchState } from "../sensor/fs-watcher.js";
+function createValidateRouter() {
+  const router = Router();
+  router.get("/validate/state", (_req, res) => {
+    const state = getWatchState();
+    res.json({ watching: state !== null, ...state ?? {} });
+  });
+  return router;
+}
+export {
+  createValidateRouter
+};

package/dist/routes/war-room.js

@@ -0,0 +1,113 @@
+import { Router } from "express";
+import { memoryStore, formatMttr } from "../datadog/memory-store.js";
+import { getActiveIncident } from "../datadog/incident-state.js";
+import { store } from "../sensor/buffer.js";
+import { verifyFeedbackToken } from "../sensor/feedback-token.js";
+import logger from "../sensor/logger.js";
+function createWarRoomRouter() {
+  const router = Router();
+  router.get("/api/war-room", (_req, res) => {
+    const active = getActiveIncident();
+    const openRecs = memoryStore.listOpen();
+    const blastRadius = store.getBlastRadius({ since: active?.firedAt });
+    const allRecs = memoryStore.listAll(100);
+    const resolved = allRecs.filter((r) => r.mttrMs !== null).sort((a, b) => b.firedAt - a.firedAt).slice(0, 20).map((r) => ({
+      id: r.id,
+      service: r.service,
+      alertTitle: r.pdAlertTitle,
+      firedAt: r.firedAt,
+      mttrMs: r.mttrMs,
+      mttrFmt: r.mttrMs ? formatMttr(r.mttrMs) : null,
+      resolutionType: r.resolutionType,
+      fingerprint: r.fingerprint,
+      attributionConfidence: r.attributionConfidence,
+      attributionSha: r.attributionSha ? r.attributionSha.slice(0, 8) : null,
+      attributionValidated: r.attributionValidated,
+      fixPrUrl: r.fixPrUrl
+    }));
+    const validated = allRecs.filter(
+      (r) => r.attributionConfidence !== null && r.attributionValidated !== null
+    );
+    const bands = {
+      high: validated.filter((r) => r.attributionConfidence >= 0.8),
+      medium: validated.filter((r) => r.attributionConfidence >= 0.6 && r.attributionConfidence < 0.8),
+      low: validated.filter((r) => r.attributionConfidence < 0.6)
+    };
+    const accuracy = Object.fromEntries(
+      Object.entries(bands).map(([band, recs]) => [
+        band,
+        {
+          correct: recs.filter((r) => r.attributionValidated === 1).length,
+          total: recs.length,
+          pct: recs.length > 0 ? Math.round(recs.filter((r) => r.attributionValidated === 1).length / recs.length * 100) : null
+        }
+      ])
+    );
+    const openEnriched = openRecs.map((r) => ({
+      id: r.id,
+      service: r.service,
+      alertTitle: r.pdAlertTitle,
+      alertUrl: r.pdAlertUrl,
+      firedAt: r.firedAt,
+      implicatedFile: r.implicatedFile,
+      implicatedLine: r.implicatedLine,
+      attributionConfidence: r.attributionConfidence,
+      attributionSha: r.attributionSha ? r.attributionSha.slice(0, 8) : null,
+      traceId: r.traceId
+    }));
+    res.json({
+      ok: true,
+      activeIncident: active ? {
+        service: active.service,
+        alertTitle: active.alertTitle,
+        firedAt: active.firedAt,
+        blameConfidence: active.blameAttribution?.confidence ?? null,
+        blameLabel: active.blameAttribution?.confidenceLabel ?? null,
+        blameSha: active.blameAttribution?.topCandidate?.sha.slice(0, 8) ?? null,
+        blameExplanation: active.blameAttribution?.explanation ?? null
+      } : null,
+      openIncidents: openEnriched,
+      blastRadius: {
+        affectedSessions: blastRadius.affectedSessions,
+        affectedUsers: blastRadius.affectedUsers,
+        errorCount: blastRadius.errorCount,
+        firstSeenAt: blastRadius.firstSeenAt,
+        durationMs: blastRadius.durationMs,
+        browserSegments: blastRadius.browserSegments,
+        topErrors: blastRadius.topErrors.slice(0, 3)
+      },
+      mttrHistory: resolved,
+      attributionAccuracy: accuracy
+    });
+  });
+  router.get("/attribution-feedback", (req, res) => {
+    const id = parseInt(String(req.query.id ?? ""), 10);
+    const correct = req.query.correct === "1";
+    const token = String(req.query.token ?? "");
+    if (isNaN(id)) {
+      res.status(400).send("Invalid id");
+      return;
+    }
+    if (!verifyFeedbackToken(id, correct ? 1 : 0, token)) {
+      logger.warn({ id, correct }, "attribution-feedback: invalid or missing token \u2014 rejected");
+      res.status(403).send("Invalid or expired feedback link");
+      return;
+    }
+    memoryStore.recordAttributionFeedback(id, correct ? 1 : 0);
+    logger.info({ id, correct }, "attribution feedback via link");
+    res.send(`<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="UTF-8"><title>Mergen \u2014 Feedback</title>
+<style>body{font-family:system-ui;text-align:center;padding:60px;background:#0f1117;color:#e2e8f0}</style>
+</head>
+<body>
+  <h2 style="color:${correct ? "#22c55e" : "#ef4444"}">${correct ? "\u2705 Attribution marked correct" : "\u274C Attribution marked incorrect"}</h2>
+  <p style="color:#64748b;margin-top:12px">Feedback stored. Mergen's accuracy improves with every validated incident.</p>
+  <p style="margin-top:24px"><a href="/dashboard" style="color:#3b82f6">Back to war room</a></p>
+</body></html>`);
+  });
+  return router;
+}
+export {
+  createWarRoomRouter
+};

package/dist/scripts/check-arch.js

@@ -0,0 +1,22 @@
+import path from "path";
+import { checkBoundaries, formatBoundaryReport } from "../intelligence/arch-boundaries.js";
+const args = process.argv.slice(2);
+const srcDirFlag = args.indexOf("--srcDir");
+const srcDir = srcDirFlag !== -1 && args[srcDirFlag + 1] ? args[srcDirFlag + 1] : path.resolve(process.cwd(), "src");
+console.log(`
+Checking architectural boundaries in: ${srcDir}
+`);
+const result = checkBoundaries({ srcDir });
+const report = formatBoundaryReport(result, srcDir);
+console.log(report);
+if (result.violations.length > 0) {
+  console.error(`
+\u2716 ${result.violations.length} violation(s) found. Fix before committing.
+`);
+  process.exit(1);
+} else {
+  console.log(`
+\u2714 ${result.filesChecked} files checked. No violations.
+`);
+  process.exit(0);
+}

package/dist/seeds/community-corpus.js

@@ -0,0 +1,176 @@
+import { importOverrides } from "../intelligence/override-corpus.js";
+import logger from "../sensor/logger.js";
+const COMMUNITY_ENTRIES = [
+  // ── Friday settlement window ──────────────────────────────────────────────
+  {
+    incidentTag: "infra_db_connection_pool",
+    proposedCommand: "ALTER SYSTEM SET max_connections = 300",
+    overrideReason: "compliance-hold",
+    rationale: "Friday settlement window \u2014 pool resize requires DBA sign-off and is unsafe during batch job window (Fri 14:00\u201324:00 UTC)",
+    service: "postgres",
+    environment: "production",
+    dayOfWeek: 5,
+    // Friday
+    hourOfDay: 14,
+    actor: "community"
+  },
+  {
+    incidentTag: "infra_db_connection_pool",
+    proposedCommand: "ALTER SYSTEM SET max_connections = 300",
+    overrideReason: "compliance-hold",
+    rationale: "Friday settlement window late \u2014 do not resize DB connections after 18:00 UTC Friday",
+    service: "postgres",
+    environment: "production",
+    dayOfWeek: 5,
+    hourOfDay: 18,
+    actor: "community"
+  },
+  // ── Schema mutations during peak traffic ──────────────────────────────────
+  {
+    incidentTag: "infra_slow_query",
+    proposedCommand: "CREATE INDEX CONCURRENTLY idx_users_email ON users(email)",
+    overrideReason: "batch-window",
+    rationale: "Index builds compete with peak traffic queries Mon\u2013Fri 08:00\u201318:00 UTC \u2014 run during off-hours or maintenance window",
+    service: "postgres",
+    environment: "production",
+    dayOfWeek: 1,
+    // Monday
+    hourOfDay: 9,
+    actor: "community"
+  },
+  {
+    incidentTag: "infra_slow_query",
+    proposedCommand: "CREATE INDEX CONCURRENTLY idx_users_email ON users(email)",
+    overrideReason: "batch-window",
+    rationale: "Index builds during mid-day peak \u2014 defer to overnight maintenance window",
+    service: "postgres",
+    environment: "production",
+    dayOfWeek: 3,
+    // Wednesday
+    hourOfDay: 14,
+    actor: "community"
+  },
+  // ── Redis cache flush during active sessions ───────────────────────────────
+  {
+    incidentTag: "infra_service_unavailable",
+    proposedCommand: "redis-cli FLUSHDB",
+    overrideReason: "on-call-discretion",
+    rationale: "Flushing Redis during business hours logs out all active users \u2014 coordinate with support team and post change notice first",
+    service: "redis",
+    environment: "production",
+    dayOfWeek: 2,
+    // Tuesday
+    hourOfDay: 10,
+    actor: "community"
+  },
+  // ── Weekend batch window auto-scaling block ───────────────────────────────
+  {
+    incidentTag: "infra_queue_backlog",
+    proposedCommand: "kubectl scale deployment/worker --replicas=20",
+    overrideReason: "batch-window",
+    rationale: "Weekend batch window \u2014 worker auto-scaling competes with scheduled ETL jobs Sat\u2013Sun; coordinate with data team before scaling",
+    service: "worker",
+    environment: "production",
+    dayOfWeek: 6,
+    // Saturday
+    hourOfDay: 2,
+    actor: "community"
+  },
+  {
+    incidentTag: "infra_queue_backlog",
+    proposedCommand: "kubectl scale deployment/worker --replicas=20",
+    overrideReason: "batch-window",
+    rationale: "Sunday batch window \u2014 do not auto-scale workers during Sunday ETL window (00:00\u201306:00 UTC)",
+    service: "worker",
+    environment: "production",
+    dayOfWeek: 0,
+    // Sunday
+    hourOfDay: 3,
+    actor: "community"
+  },
+  // ── Database credential rotation ──────────────────────────────────────────
+  {
+    incidentTag: "infra_service_unavailable",
+    proposedCommand: "aws secretsmanager rotate-secret --secret-id prod/db/password",
+    overrideReason: "compliance-hold",
+    rationale: "DB credential rotation requires CAB approval and a coordinated rolling restart \u2014 cannot be done autonomously without change ticket",
+    service: "secrets-manager",
+    environment: "production",
+    dayOfWeek: 4,
+    // Thursday
+    hourOfDay: 15,
+    actor: "community"
+  },
+  // ── Direct production migration block ────────────────────────────────────
+  {
+    incidentTag: "infra_slow_query",
+    proposedCommand: "prisma migrate deploy",
+    overrideReason: "compliance-hold",
+    rationale: "Production migrations must run via CI pipeline with rollback plan \u2014 direct deploy bypasses peer review and breaks audit trail",
+    service: "api",
+    environment: "production",
+    dayOfWeek: 1,
+    hourOfDay: 11,
+    actor: "community"
+  },
+  // ── OOM restart block during payment processing ──────────────────────────
+  {
+    incidentTag: "infra_oom_kill",
+    proposedCommand: "kubectl rollout restart deployment/payments",
+    overrideReason: "on-call-discretion",
+    rationale: "Payments service restart during checkout window drops in-flight transactions \u2014 drain first, then restart after traffic drops below 20 req/s",
+    service: "payments",
+    environment: "production",
+    dayOfWeek: 5,
+    // Friday
+    hourOfDay: 17,
+    actor: "community"
+  },
+  // ── Rate limit cascade: do not retry immediately ─────────────────────────
+  {
+    incidentTag: "infra_rate_limit_cascade",
+    proposedCommand: "kubectl scale deployment/api --replicas=10",
+    overrideReason: "cost-constraint",
+    rationale: "Scaling API pods does not fix upstream rate limit cascades \u2014 it amplifies the retry storm; fix the backoff logic instead",
+    service: "api",
+    environment: "production",
+    dayOfWeek: 2,
+    hourOfDay: 8,
+    actor: "community"
+  },
+  // ── Disk pressure: do not delete pg_wal without DBA approval ─────────────
+  {
+    incidentTag: "infra_disk_pressure",
+    proposedCommand: "find /var/lib/postgresql/data/pg_wal -mtime +7 -delete",
+    overrideReason: "compliance-hold",
+    rationale: "Deleting WAL segments without verifying replication lag can break standby replicas \u2014 always check pg_stat_replication first, then get DBA approval",
+    service: "postgres",
+    environment: "production",
+    dayOfWeek: 3,
+    hourOfDay: 20,
+    actor: "community"
+  }
+];
+function loadCommunityCorpus() {
+  try {
+    const { imported, skipped } = importOverrides(
+      COMMUNITY_ENTRIES.map(({ actor: _actor, ...entry }) => ({
+        ...entry,
+        manualAction: "Deferred \u2014 see rationale"
+      })),
+      { source: "community", actor: "community" }
+    );
+    if (imported > 0) {
+      logger.info({ loaded: imported, skipped }, "community-corpus: seeded");
+    }
+    return { loaded: imported, skipped };
+  } catch (err) {
+    logger.warn({ err }, "community-corpus: failed to seed");
+    return { loaded: 0, skipped: COMMUNITY_ENTRIES.length };
+  }
+}
+const COMMUNITY_CORPUS_COUNT = COMMUNITY_ENTRIES.length;
+export {
+  COMMUNITY_CORPUS_COUNT,
+  loadCommunityCorpus
+};