mergen-server 1.4.0

package/dist/sensor/buffer.js

@@ -0,0 +1,599 @@
+import {
+  LogLevelSchema,
+  ConsoleEventSchema,
+  NetworkEventSchema,
+  ContextSnapshotSchema,
+  WebSocketFrameSchema,
+  WebSocketEventSchema,
+  SSEEventSchema,
+  DiagnosticEventSchema,
+  TerminalOutputEventSchema,
+  TestResultEventSchema,
+  ProcessExitEventSchema,
+  CIEventSchema,
+  DeploymentEventSchema,
+  BackendSpanEventSchema,
+  BrowserEventSchema
+} from "./buffer-schemas.js";
+const AUTH_KEYS = ["token", "userToken", "accessToken", "authToken", "jwt", "user", "session"];
+const AUTH_URL_RE = /login|auth|signin|token/i;
+const MIN_SIGNAL_CONFIDENCE = 0.45;
+function getDefaultTenantId() {
+  return process.env.MERGEN_DEFAULT_TENANT_ID ?? void 0;
+}
+let _getEffectiveBufferSize = () => MAX_BUFFER_SIZE;
+function setBufferSizeGetter(fn) {
+  _getEffectiveBufferSize = fn;
+}
+const MAX_BUFFER_SIZE = (() => {
+  const env = parseInt(process.env.MERGEN_BUFFER_SIZE ?? "", 10);
+  if (!Number.isFinite(env) || env < 1) return 2e3;
+  return Math.min(env, 1e4);
+})();
+const MAX_SIZE = MAX_BUFFER_SIZE;
+class RingBuffer {
+  _ring = new Array(MAX_SIZE).fill(void 0);
+  _head = 0;
+  // index of the oldest slot
+  _count = 0;
+  // number of occupied slots
+  // O(1) running counters — updated on push() and clear()
+  _errors = 0;
+  _warnings = 0;
+  _networkErrors = 0;
+  // Track last localStorage snapshot per URL for diffing
+  _lastLocalStorageByUrl = /* @__PURE__ */ new Map();
+  _lastEventAt = null;
+  _clearedAt = null;
+  _incrementCounters(event) {
+    if (event.type === "console") {
+      if (event.level === "error") this._errors++;
+      else if (event.level === "warn") this._warnings++;
+    } else if (event.type === "network" && (event.status >= 400 || event.status === 0 || event.error)) {
+      this._networkErrors++;
+    }
+  }
+  _decrementCounters(event) {
+    if (event.type === "console") {
+      if (event.level === "error") this._errors--;
+      else if (event.level === "warn") this._warnings--;
+    } else if (event.type === "network" && (event.status >= 400 || event.status === 0 || event.error)) {
+      this._networkErrors--;
+    }
+  }
+  push(event, tenantId) {
+    if (tenantId !== void 0) event._tenantId = tenantId;
+    this._lastEventAt = event.timestamp;
+    if (this._count < MAX_SIZE) {
+      const slot = (this._head + this._count) % MAX_SIZE;
+      this._ring[slot] = event;
+      this._count++;
+      this._incrementCounters(event);
+      return;
+    }
+    const isHighPriority = event.type !== "console" || event.level !== "log";
+    let evictIdx = this._head;
+    if (isHighPriority) {
+      for (let i = 0; i < this._count; i++) {
+        const idx = (this._head + i) % MAX_SIZE;
+        const candidate = this._ring[idx];
+        if (candidate?.type === "console" && candidate.level === "log") {
+          evictIdx = idx;
+          break;
+        }
+      }
+    }
+    const evicted = this._ring[evictIdx];
+    if (evicted) this._decrementCounters(evicted);
+    this._ring[evictIdx] = event;
+    this._incrementCounters(event);
+    if (evictIdx === this._head) {
+      this._head = (this._head + 1) % MAX_SIZE;
+    }
+  }
+  getCounters(tenantId) {
+    if (tenantId === void 0) {
+      return { errors: this._errors, warnings: this._warnings, networkErrors: this._networkErrors };
+    }
+    let errors = 0, warnings = 0, networkErrors = 0;
+    for (const e of this._iterate()) {
+      if (e._tenantId !== tenantId) continue;
+      if (e.type === "console") {
+        if (e.level === "error") errors++;
+        else if (e.level === "warn") warnings++;
+      } else if (e.type === "network" && (e.status >= 400 || e.status === 0 || e.error)) {
+        networkErrors++;
+      }
+    }
+    return { errors, warnings, networkErrors };
+  }
+  *_iterate() {
+    for (let i = 0; i < this._count; i++) {
+      yield this._ring[(this._head + i) % MAX_SIZE];
+    }
+  }
+  getLogs(limit = 50, level, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "console") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (level && e.level !== level) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getNetwork(limit = 50, statusFilter, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "network") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (statusFilter !== void 0 && e.status !== statusFilter) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getContext(limit = 10, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "context") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getWebSockets(limit = 50, connectionUrl, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "websocket") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (connectionUrl && !e.url.includes(connectionUrl)) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getWebSocketCount(tenantId) {
+    let count = 0;
+    for (const e of this._iterate()) {
+      if (e.type !== "websocket") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      count++;
+    }
+    return count;
+  }
+  getSSE(limit = 50, connectionUrl, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "sse") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (connectionUrl && !e.url.includes(connectionUrl)) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getDiagnostics(limit = 50, severity, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "diagnostic") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (severity && e.severity !== severity) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getTerminalOutput(limit = 50, terminalName, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "terminal") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (terminalName && e.terminalName !== terminalName) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getTestResults(limit = 50, status, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "test_result") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (status && e.status !== status) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getProcessExits(limit = 50, reason, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "process_exit") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (reason && e.reason !== reason) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getCIEvents(limit = 50, status, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "ci") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (status && e.status !== status) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getDeployments(limit = 50, environment, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "deployment") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (environment && e.environment !== environment) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getBackendSpans(limit = 50, service, since, tenantId) {
+    const cap = Math.min(limit, _getEffectiveBufferSize());
+    const results = [];
+    for (const e of this._iterate()) {
+      if (e.type !== "backend_span") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (service && e.service !== service) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      results.push(e);
+    }
+    return results.slice(-cap);
+  }
+  getBlastRadius(opts = {}) {
+    const { since, errorPattern, tenantId } = opts;
+    const patternRe = errorPattern ? new RegExp(errorPattern, "i") : null;
+    const sessions = /* @__PURE__ */ new Set();
+    const users = /* @__PURE__ */ new Set();
+    const userSessions = /* @__PURE__ */ new Map();
+    const browserCounts = {};
+    const osCounts = {};
+    const errorMsgCounts = {};
+    let firstSeenAt = null;
+    let lastSeenAt = null;
+    let errorCount = 0;
+    for (const e of this._iterate()) {
+      if (e.type !== "console" || e.level !== "error") continue;
+      if (tenantId !== void 0 && e._tenantId !== tenantId) continue;
+      if (since !== void 0 && e.timestamp < since) continue;
+      if (patternRe) {
+        const msgText = e.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ");
+        if (!patternRe.test(msgText)) continue;
+      }
+      errorCount++;
+      if (firstSeenAt === null || e.timestamp < firstSeenAt) firstSeenAt = e.timestamp;
+      if (lastSeenAt === null || e.timestamp > lastSeenAt) lastSeenAt = e.timestamp;
+      if (e.sessionId) sessions.add(e.sessionId);
+      if (e.userId) {
+        users.add(e.userId);
+        if (e.sessionId) {
+          let set = userSessions.get(e.userId);
+          if (!set) {
+            set = /* @__PURE__ */ new Set();
+            userSessions.set(e.userId, set);
+          }
+          set.add(e.sessionId);
+        }
+      }
+      if (e.userAgent) {
+        const browser = parseBrowser(e.userAgent);
+        const os = parseOS(e.userAgent);
+        browserCounts[browser] = (browserCounts[browser] ?? 0) + 1;
+        osCounts[os] = (osCounts[os] ?? 0) + 1;
+      }
+      const msg = e.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ").slice(0, 120);
+      errorMsgCounts[msg] = (errorMsgCounts[msg] ?? 0) + 1;
+    }
+    let returningUserSessions = 0;
+    for (const sessionSet of userSessions.values()) {
+      if (sessionSet.size > 1) returningUserSessions += sessionSet.size - 1;
+    }
+    let correlatedDeploy = null;
+    if (firstSeenAt !== null) {
+      const deploys = this.getDeployments(50);
+      const prior = deploys.filter((d) => d.timestamp <= firstSeenAt && d.status === "success").sort((a, b) => b.timestamp - a.timestamp);
+      correlatedDeploy = prior[0]?.sha ?? null;
+    }
+    const topErrors = Object.entries(errorMsgCounts).sort((a, b) => b[1] - a[1]).slice(0, 5).map(([message, count]) => ({ message, count }));
+    return {
+      affectedSessions: sessions.size,
+      affectedUsers: users.size,
+      returningUserSessions,
+      errorCount,
+      firstSeenAt,
+      lastSeenAt,
+      browserSegments: browserCounts,
+      osSegments: osCounts,
+      topErrors,
+      correlatedDeploy,
+      durationMs: firstSeenAt !== null ? Date.now() - firstSeenAt : null
+    };
+  }
+  clear() {
+    this._ring.fill(void 0);
+    this._head = 0;
+    this._count = 0;
+    this._errors = 0;
+    this._warnings = 0;
+    this._networkErrors = 0;
+    this._lastLocalStorageByUrl.clear();
+    this._lastEventAt = null;
+    this._clearedAt = Date.now();
+  }
+  getLocalStorageDiff(current, url) {
+    const prev = this._lastLocalStorageByUrl.get(url) || {};
+    const changed = /* @__PURE__ */ new Set();
+    for (const [key, val] of Object.entries(current)) {
+      if (prev[key] !== val) {
+        changed.add(key);
+      }
+    }
+    for (const key of Object.keys(prev)) {
+      if (!(key in current)) {
+        changed.add(key);
+      }
+    }
+    this._lastLocalStorageByUrl.set(url, { ...current });
+    return { full: current, changed };
+  }
+  getSignals(tenantId) {
+    const candidates = [];
+    const logs = this.getLogs(200, void 0, void 0, tenantId);
+    const network = this.getNetwork(200, void 0, void 0, tenantId);
+    const contexts = this.getContext(20, void 0, tenantId);
+    const latestCtx = contexts.length > 0 ? contexts[contexts.length - 1] : null;
+    const ls = latestCtx?.localStorage ?? {};
+    const authOk = network.filter((n) => AUTH_URL_RE.test(n.url) && n.status === 200);
+    if (authOk.length > 0 && latestCtx) {
+      const missingKeys = AUTH_KEYS.filter(
+        (k) => !(k in ls) || ls[k] === "null" || ls[k] === "" || ls[k] === "undefined"
+      );
+      if (missingKeys.length > 0) {
+        const call = authOk[authOk.length - 1];
+        const key = missingKeys[0];
+        const hasErrors = logs.some((e) => e.level === "error");
+        const confidence = hasErrors ? 0.9 : 0.72;
+        candidates.push({
+          kind: "auth_token_not_stored",
+          message: `${call.method} ${call.url} \u2192 200 but \`localStorage.${key}\` is null \u2014 reads will get null`,
+          action: `Check the ${call.url} response handler: call \`localStorage.setItem('${key}', ...)\` before navigating away`,
+          count: authOk.length,
+          confidence,
+          suggestedTool: "quick_check"
+        });
+      }
+    }
+    const authFail = network.filter(
+      (n) => AUTH_URL_RE.test(n.url) && (n.status >= 400 || n.status === 0 || !!n.error)
+    );
+    for (const call of authFail) {
+      const label = call.status === 0 ? `network error (${call.error ?? "no response"})` : `HTTP ${call.status}`;
+      const confidence = call.status >= 500 || call.status === 0 ? 0.85 : 0.65;
+      candidates.push({
+        kind: "auth_500",
+        message: `${call.method} ${call.url} failed with ${label} \u2014 users cannot log in`,
+        action: `Check the server logs for ${call.url} \u2014 ${call.status >= 500 ? "server-side error" : "client sent bad request"}`,
+        count: 1,
+        confidence,
+        suggestedTool: "quick_check"
+      });
+    }
+    if (contexts.length >= 2) {
+      const prev = contexts[contexts.length - 2].localStorage;
+      const curr = ls;
+      const clearedKeys = Object.keys(prev).filter(
+        (k) => prev[k] && prev[k] !== "null" && prev[k] !== "undefined" && (!(k in curr) || curr[k] === "null" || curr[k] === "" || curr[k] === "undefined")
+      );
+      if (clearedKeys.length > 0) {
+        const key = clearedKeys[0];
+        const confidence = AUTH_KEYS.includes(key) ? 0.8 : 0.55;
+        candidates.push({
+          kind: "storage_cleared",
+          message: `\`localStorage.${key}\` was set, then cleared between page events \u2014 may cause null-read crash`,
+          action: `Find where \`localStorage.removeItem('${key}')\` or \`localStorage.clear()\` is called and guard it`,
+          count: clearedKeys.length,
+          confidence,
+          suggestedTool: "quick_check"
+        });
+      }
+    }
+    const netErrUrls = /* @__PURE__ */ new Map();
+    for (const n of network) {
+      if (n.status >= 400 || n.status === 0 || n.error) {
+        const prev = netErrUrls.get(n.url);
+        netErrUrls.set(n.url, {
+          count: (prev?.count ?? 0) + 1,
+          status: n.status,
+          error: n.error
+        });
+      }
+    }
+    for (const [url, { count, status, error }] of netErrUrls) {
+      if (count >= 3) {
+        if (AUTH_URL_RE.test(url)) continue;
+        const label = status === 0 ? `network error (${error ?? "no response"})` : `HTTP ${status}`;
+        const confidence = Math.min(0.88, 0.5 + (count - 3) * 0.08);
+        candidates.push({
+          kind: "repeated_network_error",
+          message: `${url} failing ${count}\xD7 with ${label} \u2014 dependent state will be uninitialised`,
+          action: `Guard every read of the response data with a null/error check, or retry with back-off`,
+          count,
+          confidence,
+          suggestedTool: "quick_check"
+        });
+      }
+    }
+    const warnEvents = logs.filter((e) => e.level === "warn");
+    if (warnEvents.length >= 5) {
+      const firstMsg = warnEvents[0].args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ").slice(0, 80);
+      const confidence = Math.min(0.75, 0.45 + (warnEvents.length - 5) * 0.04);
+      candidates.push({
+        kind: "warn_spike",
+        message: `${warnEvents.length} warnings \u2014 e.g. "${firstMsg}" \u2014 may escalate to crash`,
+        action: `Run explain_warning on the first warning to understand the escalation path`,
+        count: warnEvents.length,
+        confidence,
+        suggestedTool: "explain_warning"
+      });
+    }
+    const errMsgs = /* @__PURE__ */ new Map();
+    for (const e of logs.filter((l) => l.level === "error")) {
+      const msg = e.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ").slice(0, 100);
+      errMsgs.set(msg, (errMsgs.get(msg) ?? 0) + 1);
+    }
+    for (const [msg, count] of errMsgs) {
+      if (count >= 3) {
+        const confidence = Math.min(0.92, 0.62 + (count - 3) * 0.08);
+        candidates.push({
+          kind: "repeated_error",
+          message: `"${msg}" \u2014 thrown ${count}\xD7 \u2014 not a one-off, it's a code path bug`,
+          action: `Use reconstruct_context to find the root cause \u2014 this error fires on every execution of a specific path`,
+          count,
+          confidence,
+          suggestedTool: "quick_check"
+        });
+      }
+    }
+    const slowReqs = network.filter((n) => n.duration > 2e3).sort((a, b) => b.duration - a.duration);
+    if (slowReqs.length >= 3) {
+      const worst = slowReqs[0];
+      const confidence = Math.min(0.72, 0.45 + (slowReqs.length - 3) * 0.04);
+      candidates.push({
+        kind: "slow_requests",
+        message: `${slowReqs.length} slow requests \u2014 worst: ${worst.method} ${worst.url} (${worst.duration}ms) \u2014 may cause race conditions`,
+        action: `Run session_summary to see all slow endpoints, then check for sequential fetches that could run in parallel`,
+        count: slowReqs.length,
+        confidence,
+        suggestedTool: "session_summary"
+      });
+    }
+    const seen = /* @__PURE__ */ new Set();
+    return candidates.filter((s) => s.confidence >= MIN_SIGNAL_CONFIDENCE).sort((a, b) => b.confidence - a.confidence).filter((s) => {
+      if (seen.has(s.kind)) return false;
+      seen.add(s.kind);
+      return true;
+    });
+  }
+  size(tenantId) {
+    if (tenantId === void 0) return this._count;
+    let n = 0;
+    for (const e of this._iterate()) {
+      if (e._tenantId === tenantId) n++;
+    }
+    return n;
+  }
+  serialize(tenantId) {
+    if (tenantId === void 0) return Array.from(this._iterate());
+    return Array.from(this._iterate()).filter((e) => e._tenantId === tenantId);
+  }
+  rehydrate(events, tenantId) {
+    for (const event of events) this.push(event, tenantId);
+  }
+  lastEventAt(tenantId) {
+    if (tenantId === void 0) return this._lastEventAt;
+    let last = null;
+    for (const e of this._iterate()) {
+      if (e._tenantId !== tenantId) continue;
+      if (last === null || e.timestamp > last) last = e.timestamp;
+    }
+    return last;
+  }
+  clearedAt() {
+    return this._clearedAt;
+  }
+}
+function parseBrowser(ua) {
+  if (/Edg\//.test(ua)) return "Edge";
+  if (/OPR\//.test(ua)) return "Opera";
+  if (/Firefox\//.test(ua)) return "Firefox";
+  if (/Chrome\//.test(ua)) return "Chrome";
+  if (/Safari\//.test(ua) && !/Chrome/.test(ua)) return "Safari";
+  if (/MSIE|Trident/.test(ua)) return "IE";
+  return "Other";
+}
+function parseOS(ua) {
+  if (/iPhone|iPad/.test(ua)) return "iOS";
+  if (/Android/.test(ua)) return "Android";
+  if (/Mac OS X/.test(ua) && !/iPhone|iPad/.test(ua)) return "macOS";
+  if (/Windows/.test(ua)) return "Windows";
+  if (/Linux/.test(ua)) return "Linux";
+  return "Other";
+}
+let store = new RingBuffer();
+function setStore(s) {
+  store = s;
+}
+function getStaleErrors(thresholdMs = 60 * 60 * 1e3) {
+  const cutoff = Date.now() - thresholdMs;
+  const logs = store.getLogs(500, "error");
+  const grouped = /* @__PURE__ */ new Map();
+  for (const ev of logs) {
+    const key = String(ev.args[0] ?? "").slice(0, 120);
+    if (!key) continue;
+    const existing = grouped.get(key);
+    if (!existing) {
+      grouped.set(key, { firstSeenAt: ev.timestamp, count: 1 });
+    } else {
+      if (ev.timestamp < existing.firstSeenAt) existing.firstSeenAt = ev.timestamp;
+      existing.count += 1;
+    }
+  }
+  const now = Date.now();
+  const stale = [];
+  for (const [message, { firstSeenAt, count }] of grouped) {
+    if (firstSeenAt < cutoff) {
+      stale.push({ message, firstSeenAt, ageMs: now - firstSeenAt, count });
+    }
+  }
+  return stale.sort((a, b) => a.firstSeenAt - b.firstSeenAt);
+}
+export {
+  AUTH_KEYS,
+  AUTH_URL_RE,
+  BackendSpanEventSchema,
+  BrowserEventSchema,
+  CIEventSchema,
+  ConsoleEventSchema,
+  ContextSnapshotSchema,
+  DeploymentEventSchema,
+  DiagnosticEventSchema,
+  LogLevelSchema,
+  NetworkEventSchema,
+  ProcessExitEventSchema,
+  SSEEventSchema,
+  TerminalOutputEventSchema,
+  TestResultEventSchema,
+  WebSocketEventSchema,
+  WebSocketFrameSchema,
+  getDefaultTenantId,
+  getStaleErrors,
+  parseBrowser,
+  parseOS,
+  setBufferSizeGetter,
+  setStore,
+  store
+};

package/dist/sensor/bypass-tracker.js

@@ -0,0 +1,93 @@
+import fs from "fs";
+import path from "path";
+import { DATA_DIR, zeroRetentionMode } from "./paths.js";
+import logger from "./logger.js";
+const BYPASS_FILE = path.join(DATA_DIR, "bypass-tracker.json");
+const BLOCK_WINDOW_MS = 6e4;
+const REFINEMENT_THRESHOLD = 5;
+const _recentBlocks = /* @__PURE__ */ new Map();
+let _entries = {};
+let _loaded = false;
+let _testingMode = false;
+function _resetBypassTrackerForTesting() {
+  _entries = {};
+  _loaded = true;
+  _testingMode = true;
+  _recentBlocks.clear();
+}
+function load() {
+  if (_testingMode || _loaded) return;
+  _loaded = true;
+  if (!fs.existsSync(BYPASS_FILE)) {
+    _entries = {};
+    return;
+  }
+  try {
+    const raw = JSON.parse(fs.readFileSync(BYPASS_FILE, "utf8"));
+    if (raw?.version === 1 && raw.entries && typeof raw.entries === "object") {
+      _entries = raw.entries;
+    }
+  } catch {
+    _entries = {};
+  }
+}
+function persist() {
+  if (zeroRetentionMode() || _testingMode) return;
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true, mode: 448 });
+    const tmp = `${BYPASS_FILE}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify({ version: 1, entries: _entries }), "utf8");
+    fs.renameSync(tmp, BYPASS_FILE);
+  } catch (err) {
+    logger.warn({ err }, "bypass-tracker: persist failed");
+  }
+}
+function trackBlock(toolName, triggeredRules) {
+  _recentBlocks.set(toolName, { triggeredRules, blockedAt: Date.now() });
+}
+function trackSuccessfulCall(toolName) {
+  load();
+  const recent = _recentBlocks.get(toolName);
+  if (!recent) return;
+  const elapsed = Date.now() - recent.blockedAt;
+  if (elapsed > BLOCK_WINDOW_MS) {
+    _recentBlocks.delete(toolName);
+    return;
+  }
+  _recentBlocks.delete(toolName);
+  logger.info(
+    { toolName, ruleIds: recent.triggeredRules, elapsedMs: elapsed },
+    "bypass-tracker: block-then-bypass detected"
+  );
+  for (const ruleId of recent.triggeredRules) {
+    const entry = _entries[ruleId] ?? { ruleId, count: 0, toolNames: [], lastBypassAt: 0 };
+    entry.count++;
+    entry.lastBypassAt = Date.now();
+    if (!entry.toolNames.includes(toolName)) entry.toolNames.push(toolName);
+    _entries[ruleId] = entry;
+  }
+  persist();
+}
+function getRefinementCandidates() {
+  load();
+  return Object.values(_entries).filter((e) => e.count >= REFINEMENT_THRESHOLD).sort((a, b) => b.count - a.count).map((e) => ({
+    ruleId: e.ruleId,
+    bypassCount: e.count,
+    toolNames: e.toolNames,
+    lastBypassAt: e.lastBypassAt,
+    recommendation: `Rule "${e.ruleId}" has been blocked then immediately bypassed ${e.count} times. Consider narrowing its conditions in ~/.mergen/enterprise-policy.json to reduce false positives.`
+  }));
+}
+function getBypassStats() {
+  load();
+  const totalBypasses = Object.values(_entries).reduce((sum, e) => sum + e.count, 0);
+  return { totalBypasses, uniqueRules: Object.keys(_entries).length };
+}
+export {
+  REFINEMENT_THRESHOLD,
+  _resetBypassTrackerForTesting,
+  getBypassStats,
+  getRefinementCandidates,
+  trackBlock,
+  trackSuccessfulCall
+};