mergen-server 1.4.0

package/dist/commands/policy.js

@@ -0,0 +1,710 @@
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { resolve, join } from "path";
+import { homedir } from "os";
+import { log, success, error, hr, findPort } from "./shared.js";
+async function approveCommand(cmdArgs) {
+  const token = cmdArgs[0]?.trim();
+  if (!token) {
+    error("Token required. Usage: mergen approve <id>");
+    process.exit(1);
+  }
+  let secret = "";
+  const secretPath = join(homedir(), ".mergen", "secret");
+  if (existsSync(secretPath)) {
+    try {
+      secret = readFileSync(secretPath, "utf8").trim();
+    } catch {
+    }
+  }
+  log("Locating running Mergen gateway server...");
+  let port = 3e3;
+  let discovered = false;
+  for (let p = 3e3; p <= 3010; p++) {
+    try {
+      const r = await fetch(`http://127.0.0.1:${p}/health`, { signal: AbortSignal.timeout(300) });
+      if (r.ok) {
+        port = p;
+        discovered = true;
+        break;
+      }
+    } catch {
+    }
+  }
+  if (!discovered) {
+    error("No active Mergen server detected on local ports 3000-3010.");
+    log("Make sure the server is running: mergen-server start");
+    process.exit(1);
+  }
+  log(`Connecting to server on port ${port}...`);
+  try {
+    const headers = { "Content-Type": "application/json" };
+    if (secret) {
+      headers["x-mergen-secret"] = secret;
+    }
+    const res = await fetch(`http://127.0.0.1:${port}/hitl/approve`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ token })
+    });
+    const body = await res.json();
+    if (res.ok && body.ok) {
+      success(`Approved! The blocked tool call will be allowed to proceed.`);
+    } else {
+      error(`Approval failed: ${body.error ?? "Unknown error"}`);
+      process.exit(1);
+    }
+  } catch (err) {
+    error(`Failed to reach server: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+}
+async function shadowReportCommand() {
+  let port = 3e3;
+  let serverFound = false;
+  for (let p = 3e3; p <= 3010; p++) {
+    try {
+      const r = await fetch(`http://127.0.0.1:${p}/health`, { signal: AbortSignal.timeout(800) });
+      if (r.ok) {
+        port = p;
+        serverFound = true;
+        break;
+      }
+    } catch {
+    }
+  }
+  if (!serverFound) {
+    error("Server not running. Start with: mergen-server start");
+    process.exit(1);
+  }
+  const secret = (() => {
+    try {
+      return readFileSync(join(homedir(), ".mergen", "secret"), "utf8").trim();
+    } catch {
+      return "";
+    }
+  })();
+  const headers = { "content-type": "application/json" };
+  if (secret) headers["x-mergen-secret"] = secret;
+  const BASE = `http://127.0.0.1:${port}`;
+  const [summaryRes, entriesRes] = await Promise.all([
+    fetch(`${BASE}/shadow-report`, { headers, signal: AbortSignal.timeout(5e3) }),
+    fetch(`${BASE}/shadow-report/entries?limit=20`, { headers, signal: AbortSignal.timeout(5e3) })
+  ]);
+  const summary = summaryRes.ok ? await summaryRes.json() : null;
+  const entriesData = entriesRes.ok ? await entriesRes.json() : null;
+  const W = 60;
+  const div = "\u2500".repeat(W);
+  const days = summary?.windowDays ?? 30;
+  console.log(`
+Shadow Mode Track Record \u2014 last ${days} days`);
+  console.log(div);
+  const entries = entriesData?.entries ?? [];
+  if (entries.length === 0) {
+    console.log("  No shadow entries yet.");
+    console.log("  Shadow mode posts diagnoses without executing fixes.");
+    console.log("  Set MERGEN_SHADOW_MODE=true and connect PagerDuty to start.\n");
+  } else {
+    console.log(` ${"Date".padEnd(12)}${"Service".padEnd(12)}${"Tag".padEnd(26)}${"Conf".padEnd(6)}Verdict`);
+    console.log(div);
+    for (const e of entries) {
+      const date = new Date(e.recordedAt).toISOString().slice(0, 10);
+      const svc = (e.service ?? "unknown").slice(0, 10).padEnd(12);
+      const tag = (e.incidentTag ?? "").replace(/^infra_/, "").slice(0, 24).padEnd(26);
+      const conf = `${e.diagnosisConfidence}%`.padEnd(6);
+      const verd = e.humanVerdict === "would-approve" ? "\u2705 approve" : e.humanVerdict === "would-override" ? "\u270B override" : "(unreviewed)";
+      console.log(` ${date.padEnd(12)}${svc}${tag}${conf}${verd}`);
+    }
+    console.log(div);
+    const total = summary?.total ?? entries.length;
+    const reviewed = summary?.humanReviewed ?? 0;
+    const fpNote = reviewed >= 5 && summary?.approvalRate != null ? `false positive rate: ${Math.round((1 - summary.approvalRate) * 100)}%` : `false positive rate: pending (${reviewed} of 5 reviews needed)`;
+    console.log(` Total: ${total} entries \xB7 ${reviewed} reviewed \xB7 ${fpNote}`);
+    if (summary?.recommendation) console.log(` ${summary.recommendation}`);
+  }
+  console.log(`
+ Run: mergen-server impact-report   for the full Day-30 deck summary
+`);
+}
+async function allowCommand(args) {
+  const { loadEnterprisePolicy, saveEnterprisePolicy } = await import("../intelligence/enterprise-policy-engine.js");
+  const fileIdx = args.indexOf("--file");
+  const actorIdx = args.indexOf("--actor");
+  const svcIdx = args.indexOf("--service");
+  const fileGlob = fileIdx !== -1 ? args[fileIdx + 1] : null;
+  const actorFlag = actorIdx !== -1 ? args[actorIdx + 1] : "all";
+  const svcFlag = svcIdx !== -1 ? args[svcIdx + 1] : void 0;
+  const positional = args.filter((a, i) => !a.startsWith("--") && (fileIdx === -1 || i !== fileIdx + 1) && (actorIdx === -1 || i !== actorIdx + 1) && (svcIdx === -1 || i !== svcIdx + 1));
+  const cmdPattern = positional[0] ?? null;
+  if (!cmdPattern && !fileGlob) {
+    console.log('Usage: mergen-server allow "<command pattern>"');
+    console.log('       mergen-server allow --file "<file glob>"');
+    console.log('       mergen-server allow "npm install" --actor ai --service api');
+    process.exit(1);
+  }
+  const actor = actorFlag === "ai" || actorFlag === "human" ? actorFlag : "all";
+  const label = cmdPattern ?? fileGlob;
+  const rule = {
+    id: `allowlist_${Date.now()}`,
+    name: `Allowlist: ${label}`,
+    description: `Added via mergen-server allow on ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`,
+    action: "pass",
+    reason: `Explicitly allowed: ${label}`,
+    conditions: {
+      ...cmdPattern ? { commands: [cmdPattern] } : {},
+      ...fileGlob ? { files: [fileGlob] } : {},
+      ...actor !== "all" ? { actorType: actor } : {},
+      ...svcFlag ? { services: [svcFlag] } : {}
+    }
+  };
+  const config = loadEnterprisePolicy();
+  config.rules.push(rule);
+  saveEnterprisePolicy(config);
+  success(`Allowlisted: ${label}`);
+  if (actor !== "all") log(`Actor: ${actor}`, "\u2139");
+  if (svcFlag) log(`Service: ${svcFlag}`, "\u2139");
+  console.log(`
+  Rule id: ${rule.id}`);
+  console.log(`  Policy file: ~/.mergen/enterprise-policy.json`);
+  console.log(`
+  To remove it: edit ~/.mergen/enterprise-policy.json and delete the rule with this id.
+`);
+}
+async function verifyLogCommand() {
+  let port = 3e3;
+  let result = null;
+  for (let p = 3e3; p <= 3010; p++) {
+    try {
+      const r = await fetch(`http://127.0.0.1:${p}/agent-blunders/verify`, { signal: AbortSignal.timeout(2e3) });
+      if (r.ok) {
+        result = await r.json();
+        port = p;
+        break;
+      }
+    } catch {
+    }
+  }
+  hr();
+  console.log("\u2B21 Mergen \u2014 Agent Blunder Log integrity check\n");
+  if (!result) {
+    log("Server not running \u2014 cannot verify log. Start with: mergen-server start", "\u26A0");
+    process.exit(1);
+  }
+  if (result.valid) {
+    const count = result.verified ?? 0;
+    if (count === 0) {
+      success(`Log integrity: PASS \u2014 ${result.note ?? "Log is empty"}`);
+    } else {
+      success(`Log integrity: PASS \u2014 ${count} entries verified`);
+      if (result.truncated) {
+        log(`Chain is partial (ring buffer wrapped) \u2014 pre-eviction entries cannot be verified. This is expected, not a tamper signal.`, "\u2B21");
+      }
+      if (result.verifiedFrom) {
+        log(`Verified from entry: ${result.verifiedFrom}`, "\u2B21");
+      }
+    }
+    hr();
+    console.log(`
+  API: GET http://127.0.0.1:${port}/agent-blunders/verify
+`);
+    process.exit(0);
+  } else {
+    hr();
+    error(`Log integrity: FAIL \u2014 hash chain broken at entry index ${result.firstInvalidIdx ?? "?"}`);
+    if (result.reason) console.error(`  Reason: ${result.reason}`);
+    console.error("\n  The Agent Blunder Log may have been tampered with or corrupted.");
+    console.error(`  Full details: GET http://127.0.0.1:${port}/agent-blunders/verify`);
+    hr();
+    process.exit(1);
+  }
+}
+async function guardCommand(args) {
+  const strict = args.includes("--strict");
+  const install = args.includes("--install");
+  if (install) {
+    const hookPath = resolve(process.cwd(), ".git", "hooks", "pre-commit");
+    if (!existsSync(resolve(process.cwd(), ".git"))) {
+      error("Not a git repository. Run from project root.");
+      process.exit(1);
+    }
+    const script = `#!/bin/sh
+# Mergen guard \u2014 checks for runtime errors before commit
+mergen-server guard
+`;
+    writeFileSync(hookPath, script, { encoding: "utf8", mode: 493 });
+    success(`Pre-commit hook installed: ${hookPath}`);
+    log("Mergen will now report runtime errors before each commit.");
+    return;
+  }
+  let serverPort = 0;
+  let health = null;
+  for (let p = 3e3; p <= 3010; p++) {
+    try {
+      const r = await fetch(`http://127.0.0.1:${p}/health`, { signal: AbortSignal.timeout(800) });
+      if (r.ok) {
+        health = await r.json();
+        serverPort = p;
+        break;
+      }
+    } catch {
+    }
+  }
+  if (!health) {
+    log("Mergen: server not running \u2014 skipping runtime check", "\u2B21");
+    process.exit(0);
+  }
+  let incidentHits = [];
+  try {
+    const { execSync: _exec } = await import("child_process");
+    const staged = _exec("git diff --cached --name-only 2>/dev/null", { encoding: "utf8" }).trim();
+    if (staged) {
+      const stagedServices = /* @__PURE__ */ new Set();
+      for (const f of staged.split("\n")) {
+        const m = f.match(/^(?:services|apps|packages|src)\/([^/]+)\//);
+        if (m) stagedServices.add(m[1].toLowerCase());
+        const top = f.split("/")[0];
+        if (top && !["src", "test", "tests", "docs", ".github", "scripts", "config"].includes(top)) {
+          stagedServices.add(top.toLowerCase());
+        }
+      }
+      if (stagedServices.size > 0) {
+        const r = await fetch(`http://127.0.0.1:${serverPort}/override-corpus`, {
+          signal: AbortSignal.timeout(1e3)
+        });
+        if (r.ok) {
+          const body = await r.json();
+          for (const entry of body.corpus ?? []) {
+            const matchedService = entry.services.find(
+              (s) => stagedServices.has(s.toLowerCase())
+            );
+            if (matchedService) {
+              incidentHits.push({
+                tag: entry.tag,
+                service: matchedService,
+                reason: entry.dominantReason,
+                timePattern: entry.timePattern,
+                total: entry.total
+              });
+            }
+          }
+        }
+      }
+    }
+  } catch {
+  }
+  const errors = health.errors ?? 0;
+  const warns = health.warnings ?? 0;
+  const netErr = health.networkErrors ?? 0;
+  const sigs = health.signals ?? [];
+  const highSig = sigs.filter((s) => s.confidence >= 0.8);
+  hr();
+  console.log("\u2B21 Mergen \u2014 pre-commit runtime check\n");
+  if (errors === 0 && warns === 0 && netErr === 0 && sigs.length === 0) {
+    success("Buffer clean \u2014 no errors, warnings, or signals");
+  } else {
+    if (errors > 0) console.log(`  \u26A0 ${errors} console error(s) in buffer`);
+    if (warns > 0) console.log(`  \u26A0 ${warns} console warning(s) in buffer`);
+    if (netErr > 0) console.log(`  \u26A0 ${netErr} network error(s) in buffer`);
+    for (const s of sigs.slice(0, 3)) {
+      const pct = Math.round(s.confidence * 100);
+      console.log(`  \u{1F50D} [${pct}%] ${s.message}`);
+    }
+    if (strict && (errors > 0 || highSig.length > 0)) {
+      console.log('\n  Ask your AI: "analyze_runtime" before committing');
+      hr();
+      error("Commit blocked (--strict mode). Fix runtime errors first.");
+      process.exit(1);
+    }
+    log('\nCommit allowed. Run "analyze_runtime" to investigate.');
+  }
+  if (incidentHits.length > 0) {
+    console.log("");
+    console.log("  \u2B21 Incident history for staged services:");
+    for (const hit of incidentHits.slice(0, 5)) {
+      const reason = hit.reason ? ` \xB7 ${hit.reason}` : "";
+      const pattern = hit.timePattern ? ` \xB7 ${hit.timePattern}` : "";
+      console.log(`    \u2022 ${hit.service} \u2014 ${hit.tag}${reason}${pattern} (${hit.total}\xD7)`);
+    }
+    console.log(`  This is informational. Review corpus: GET /override-corpus`);
+  }
+  hr();
+  process.exit(0);
+}
+async function policyPushCommand() {
+  const port = await findPort();
+  if (!port) {
+    error("Server not running. Start it first: mergen-server start");
+    process.exit(1);
+  }
+  const resp = await fetch(`http://127.0.0.1:${port}/policies/export`, { signal: AbortSignal.timeout(5e3) });
+  if (!resp.ok) {
+    error(`Policy fetch failed: ${resp.status}`);
+    process.exit(1);
+  }
+  const policy = await resp.json();
+  const { mkdirSync: mkd, writeFileSync: wf } = await import("fs");
+  const dir = resolve(process.cwd(), ".mergen");
+  mkd(dir, { recursive: true });
+  const file = resolve(dir, "policy.json");
+  wf(file, JSON.stringify(policy, null, 2) + "\n", "utf8");
+  success(`Policy saved to .mergen/policy.json`);
+  log("Commit this file to track policy changes in git:");
+  log('  git add .mergen/policy.json && git commit -m "chore: update mergen policy"');
+}
+async function policyPullCommand(args) {
+  const mode = args.includes("--merge") ? "merge" : "replace";
+  const { readFileSync: rf, existsSync: ex } = await import("fs");
+  const file = resolve(process.cwd(), ".mergen", "policy.json");
+  if (!ex(file)) {
+    error("No .mergen/policy.json found. Run: mergen-server policy-push first.");
+    process.exit(1);
+  }
+  let policy;
+  try {
+    policy = JSON.parse(rf(file, "utf8"));
+  } catch {
+    error("Failed to parse .mergen/policy.json");
+    process.exit(1);
+  }
+  const port = await findPort();
+  if (!port) {
+    error("Server not running. Start it first: mergen-server start");
+    process.exit(1);
+  }
+  const resp = await fetch(`http://127.0.0.1:${port}/policies/import`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ policy, mode }),
+    signal: AbortSignal.timeout(5e3)
+  });
+  const data = await resp.json();
+  if (!resp.ok || !data.ok) {
+    error(`Policy import failed: ${JSON.stringify(data.error)}`);
+    process.exit(1);
+  }
+  success(`Policy applied (${mode}): ${data.ruleCount} rules active`);
+}
+async function policyDiffCommand() {
+  const { readFileSync: rf, existsSync: ex } = await import("fs");
+  const file = resolve(process.cwd(), ".mergen", "policy.json");
+  const port = await findPort();
+  if (!port) {
+    error("Server not running.");
+    process.exit(1);
+  }
+  const resp = await fetch(`http://127.0.0.1:${port}/policies/export`, { signal: AbortSignal.timeout(5e3) });
+  if (!resp.ok) {
+    error("Could not fetch live policy.");
+    process.exit(1);
+  }
+  const live = await resp.json();
+  const liveIds = new Set((live.rules ?? []).map((r) => r.id));
+  if (!ex(file)) {
+    log("No .mergen/policy.json \u2014 run mergen-server policy-push to create it");
+    process.exit(0);
+  }
+  let disk;
+  try {
+    disk = JSON.parse(rf(file, "utf8"));
+  } catch {
+    error("Cannot parse .mergen/policy.json");
+    process.exit(1);
+    return;
+  }
+  const diskIds = new Set((disk.rules ?? []).map((r) => r.id));
+  hr();
+  console.log("\u2B21 Mergen \u2014 Policy Diff (.mergen/policy.json vs live server)\n");
+  const onlyLive = [...liveIds].filter((id) => !diskIds.has(id));
+  const onlyDisk = [...diskIds].filter((id) => !liveIds.has(id));
+  const inBoth = [...liveIds].filter((id) => diskIds.has(id));
+  if (onlyLive.length === 0 && onlyDisk.length === 0) {
+    success("Policy files are in sync \u2014 no differences");
+  } else {
+    if (onlyLive.length > 0) console.log(`  + Live only (not in file): ${onlyLive.join(", ")}`);
+    if (onlyDisk.length > 0) console.log(`  - File only (not in live): ${onlyDisk.join(", ")}`);
+    console.log(`  = Matching rules: ${inBoth.length}`);
+    log("\nTo sync file \u2192 server: mergen-server policy-pull");
+    log("To sync server \u2192 file: mergen-server policy-push");
+  }
+  try {
+    const impactResp = await _authedFetch(port, "/policies/diff-impact", {
+      method: "POST",
+      body: JSON.stringify(disk)
+    });
+    if (impactResp.ok) {
+      const impact = await impactResp.json();
+      if (impact.ok && impact.eventsInWindow > 0) {
+        console.log(`
+  Impact if applied (replayed against ${impact.eventsInWindow} recent live calls):`);
+        console.log(`    would newly block: ${impact.newlyBlocked}   would newly hold: ${impact.newlyHeld}`);
+        console.log(`    would no longer block: ${impact.noLongerBlocked}   would no longer hold: ${impact.noLongerHeld}`);
+        const families = Object.entries(impact.byToolFamily);
+        if (families.length > 0) {
+          console.log(`    affected tools: ${families.map(([t, n]) => `${t} (${n})`).join(", ")}`);
+        }
+      }
+    }
+  } catch {
+  }
+  hr();
+}
+async function policySimulateCommand(args) {
+  const filePath = args.find((a) => !a.startsWith("--"));
+  if (!filePath) {
+    error("Usage: mergen-server policy simulate <policyFile> [--window-days=N]");
+    process.exit(1);
+  }
+  const resolved = resolve(process.cwd(), filePath);
+  if (!existsSync(resolved)) {
+    error(`File not found: ${resolved}`);
+    process.exit(1);
+  }
+  let policy;
+  try {
+    policy = JSON.parse(readFileSync(resolved, "utf8"));
+  } catch {
+    error(`Failed to parse ${resolved} as JSON`);
+    process.exit(1);
+  }
+  const windowFlag = args.find((a) => a.startsWith("--window-days="));
+  const windowDays = windowFlag ? Number(windowFlag.split("=")[1]) : 30;
+  const port = await findPort();
+  if (!port) {
+    error("Server not running. Start it first: mergen-server start");
+    process.exit(1);
+  }
+  let secret = "";
+  const secretPath = join(homedir(), ".mergen", "secret");
+  if (existsSync(secretPath)) {
+    try {
+      secret = readFileSync(secretPath, "utf8").trim();
+    } catch {
+    }
+  }
+  const resp = await fetch(`http://127.0.0.1:${port}/policies/preview?windowDays=${windowDays}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...secret ? { "x-mergen-secret": secret } : {} },
+    body: JSON.stringify(policy),
+    signal: AbortSignal.timeout(1e4)
+  });
+  const data = await resp.json();
+  if (!resp.ok || !data.ok) {
+    error(`Simulation failed: ${JSON.stringify(data.error ?? data)}`);
+    process.exit(1);
+  }
+  hr();
+  console.log(`\u2B21 Mergen \u2014 Policy Simulation (${filePath}, last ${data.windowDays} days)
+`);
+  console.log(`  ${data.blundersEvaluated} historical events replayed`);
+  console.log(`  would block: ${data.wouldBlock} (${data.blockRate}%)   would hold: ${data.wouldWarn} (${data.warnRate}%)   would pass: ${data.wouldPass} (${data.passRate}%)`);
+  console.log(`  agents affected:   ${data.agentsAffected.length > 0 ? data.agentsAffected.join(", ") : "none"}`);
+  console.log(`  services affected: ${data.servicesAffected.length > 0 ? data.servicesAffected.join(", ") : "none"}`);
+  if (data.changedVerdicts.length > 0) {
+    console.log(`
+  Sample of changed outcomes (previously blocked, would now ${data.changedVerdicts[0].preview}):`);
+    for (const c of data.changedVerdicts) {
+      console.log(`    - [${c.service ?? "unknown"}] ${c.command ?? c.id} \u2192 ${c.preview}`);
+    }
+  }
+  console.log(`
+  ${data.note}`);
+  hr();
+}
+async function _authedFetch(port, urlPath, init = {}) {
+  let secret = "";
+  const secretPath = join(homedir(), ".mergen", "secret");
+  if (existsSync(secretPath)) {
+    try {
+      secret = readFileSync(secretPath, "utf8").trim();
+    } catch {
+    }
+  }
+  return fetch(`http://127.0.0.1:${port}${urlPath}`, {
+    ...init,
+    headers: { "Content-Type": "application/json", ...secret ? { "x-mergen-secret": secret } : {}, ...init.headers ?? {} },
+    signal: AbortSignal.timeout(1e4)
+  });
+}
+async function policyVersionsCommand() {
+  const port = await findPort();
+  if (!port) {
+    error("Server not running. Start it first: mergen-server start");
+    process.exit(1);
+  }
+  const resp = await _authedFetch(port, "/policies/versions");
+  const data = await resp.json();
+  if (!resp.ok || !data.ok) {
+    error(`Failed to list versions: ${JSON.stringify(data.error ?? data)}`);
+    process.exit(1);
+  }
+  hr();
+  console.log("\u2B21 Mergen \u2014 Policy Versions (newest first)\n");
+  if (data.versions.length === 0) {
+    log("No policy versions recorded yet \u2014 versions are created automatically on every policy save.");
+  } else {
+    for (const v of data.versions) console.log(`  ${v}`);
+    log(`
+Roll back with: mergen-server policy-rollback <versionId>`);
+  }
+  hr();
+}
+async function policyRollbackCommand(args) {
+  const versionId = args[0]?.trim();
+  if (!versionId) {
+    error("Usage: mergen-server policy-rollback <versionId>");
+    log("List available versions with: mergen-server policy-versions");
+    process.exit(1);
+  }
+  const port = await findPort();
+  if (!port) {
+    error("Server not running. Start it first: mergen-server start");
+    process.exit(1);
+  }
+  const resp = await _authedFetch(port, `/policies/versions/${encodeURIComponent(versionId)}/revert`, { method: "POST" });
+  const data = await resp.json();
+  if (!resp.ok || !data.ok) {
+    error(`Rollback failed: ${JSON.stringify(data.error ?? data)}`);
+    process.exit(1);
+  }
+  success(`Policy rolled back to version ${data.revertedTo} (${data.ruleCount} rules active).`);
+}
+async function traceReplayCommand(args) {
+  const traceId = args[0]?.trim();
+  if (!traceId) {
+    error("Usage: mergen-server trace-replay <traceId>");
+    log("Find a trace id from a gate-event/blunder-log entry, or MERGEN_TRACE_ID if you set one explicitly.");
+    process.exit(1);
+  }
+  const port = await findPort();
+  if (!port) {
+    error("Server not running. Start it first: mergen-server start");
+    process.exit(1);
+  }
+  const resp = await _authedFetch(port, `/replay/${encodeURIComponent(traceId)}`);
+  const data = await resp.json();
+  if (!resp.ok || !data.ok) {
+    error(`Replay failed: ${JSON.stringify(data.error ?? data)}`);
+    process.exit(1);
+  }
+  hr();
+  console.log(`\u2B21 Mergen \u2014 Runtime Replay (trace ${traceId})
+`);
+  for (const e of data.entries) {
+    const when = new Date(e.ts).toISOString();
+    if (e.source === "gate-event") {
+      console.log(`  [${when}] GATE   ${e.toolName ?? ""} \u2192 ${e.verdict}   ${e.command ?? ""}`);
+    } else {
+      console.log(`  [${when}] BLUNDER ${e.blunderType}   ${e.command ?? ""}`);
+    }
+    if (e.triggeredRules && e.triggeredRules.length > 0) {
+      console.log(`             rules: ${e.triggeredRules.join(", ")}`);
+    }
+  }
+  console.log(`
+  ${data.note}`);
+  hr();
+}
+async function testSafetyCommand() {
+  const port = await findPort();
+  let results;
+  if (port) {
+    try {
+      const resp = await fetch(`http://127.0.0.1:${port}/safety-test?verbose=1`, {
+        signal: AbortSignal.timeout(5e3)
+      });
+      const data = await resp.json();
+      hr();
+      console.log("\u2B21 Mergen \u2014 Safety Test Suite\n");
+      console.log(`  ${data.passed}/${data.total} tests passed`);
+      if (data.cases) {
+        for (const c of data.cases) {
+          const icon = c.passed ? "\u2713" : "\u2717";
+          console.log(`  ${icon} ${c.name}`);
+          if (!c.passed) console.log(`      expected=${c.expected} got=${c.got}`);
+        }
+      }
+      hr();
+      process.exit(data.allPassed ? 0 : 1);
+      return;
+    } catch {
+    }
+  }
+  log("Server not running \u2014 running safety tests locally");
+  const { loadEnterprisePolicy, DEFAULT_ENTERPRISE_POLICY, _resetPolicyCacheForTesting } = await import("../intelligence/enterprise-policy-engine.js");
+  const { runPolicyTestCases } = await import("../intelligence/policy-test-runner.js");
+  const { DEFAULT_SAFETY_TESTS } = await import("../intelligence/default-safety-tests.js");
+  const saved = loadEnterprisePolicy();
+  _resetPolicyCacheForTesting(DEFAULT_ENTERPRISE_POLICY);
+  const summary = runPolicyTestCases(DEFAULT_SAFETY_TESTS);
+  hr();
+  console.log("\u2B21 Mergen \u2014 Safety Test Suite\n");
+  for (const r of summary.results) {
+    const icon = r.passed ? "\u2713" : "\u2717";
+    console.log(`  ${icon} ${r.id}`);
+    if (!r.passed) console.log(`      expected=${r.expected} got=${r.got}`);
+  }
+  console.log(`
+  ${summary.passed}/${summary.total} tests passed`);
+  hr();
+  _resetPolicyCacheForTesting(saved);
+  process.exit(summary.allPassed ? 0 : 1);
+}
+async function policyTestCommand(args) {
+  const { runPolicyTestCases, parsePolicyTestFile } = await import("../intelligence/policy-test-runner.js");
+  const filePath = args.find((a) => !a.startsWith("--"));
+  let cases;
+  let sourceLabel;
+  if (filePath) {
+    const resolved = resolve(process.cwd(), filePath);
+    if (!existsSync(resolved)) {
+      error(`File not found: ${resolved}`);
+      process.exit(1);
+    }
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync(resolved, "utf8"));
+    } catch {
+      error(`Failed to parse ${resolved} as JSON`);
+      process.exit(1);
+    }
+    try {
+      cases = parsePolicyTestFile(raw);
+    } catch (err) {
+      error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+    sourceLabel = filePath;
+  } else {
+    const { DEFAULT_SAFETY_TESTS } = await import("../intelligence/default-safety-tests.js");
+    cases = DEFAULT_SAFETY_TESTS;
+    sourceLabel = "built-in default suite (8 cases)";
+  }
+  const summary = runPolicyTestCases(cases);
+  hr();
+  console.log(`\u2B21 Mergen \u2014 Policy Test (${sourceLabel})
+`);
+  for (const r of summary.results) {
+    const icon = r.passed ? "\u2713" : "\u2717";
+    console.log(`  ${icon} ${r.id}${r.description ? ` \u2014 ${r.description}` : ""}`);
+    if (!r.passed) console.log(`      expected=${r.expected} got=${r.got}  reasons=[${r.reasons.join("; ")}]`);
+  }
+  console.log(`
+  ${summary.passed}/${summary.total} tests passed`);
+  hr();
+  process.exit(summary.allPassed ? 0 : 1);
+}
+export {
+  allowCommand,
+  approveCommand,
+  guardCommand,
+  policyDiffCommand,
+  policyPullCommand,
+  policyPushCommand,
+  policyRollbackCommand,
+  policySimulateCommand,
+  policyTestCommand,
+  policyVersionsCommand,
+  shadowReportCommand,
+  testSafetyCommand,
+  traceReplayCommand,
+  verifyLogCommand
+};