mergen-server 1.4.0

package/dist/sensor/ingest.js

@@ -0,0 +1,339 @@
+import { Router } from "express";
+import { timingSafeSecretEqualAny } from "./security-utils.js";
+import { store, BrowserEventSchema } from "./buffer.js";
+import { resolveFrameAndStack } from "./sourcemap.js";
+import { redact } from "./redact.js";
+import logger from "./logger.js";
+import { getStores } from "../storage/store-registry.js";
+import { layer2Store } from "./layer2-store.js";
+import { layer3Store } from "./layer3-store.js";
+import { layer4Store } from "./layer4-store.js";
+import { historyStore } from "./sqlite-store.js";
+import { exportToOtel } from "./otel-exporter.js";
+import { serviceTopology } from "./service-topology.js";
+let _teamBroadcast = null;
+function registerTeamBroadcaster(fn) {
+  _teamBroadcast = fn;
+}
+function maybeTeamBroadcast(event) {
+  if (_teamBroadcast) {
+    try {
+      _teamBroadcast([event], "self");
+    } catch {
+    }
+  }
+}
+let _notifier = null;
+function registerActivityNotifier(n) {
+  _notifier = n;
+}
+class DedupWindow {
+  _seen = /* @__PURE__ */ new Map();
+  _windowMs;
+  constructor(windowMs = 5e3) {
+    this._windowMs = windowMs;
+  }
+  /** Returns true if this fingerprint was seen within the window (duplicate).
+   *  Side effect: records the fingerprint and increments its count. */
+  isDuplicate(fp, ts) {
+    const entry = this._seen.get(fp);
+    if (entry && ts - entry.lastTs < this._windowMs) {
+      entry.count++;
+      entry.lastTs = ts;
+      return true;
+    }
+    this._seen.set(fp, { count: 1, lastTs: ts });
+    if (this._seen.size > 500) {
+      const cutoff = ts - this._windowMs * 2;
+      for (const [k, v] of this._seen) {
+        if (v.lastTs < cutoff) this._seen.delete(k);
+      }
+    }
+    return false;
+  }
+  reset() {
+    this._seen.clear();
+  }
+}
+const _dedup = new DedupWindow(5e3);
+function eventFingerprint(event) {
+  if (event.type === "network") {
+    return `net:${event.method}:${event.url}:${event.status}`;
+  }
+  if (event.type === "console" && event.level === "error") {
+    const msg = typeof event.args[0] === "string" ? event.args[0].slice(0, 100) : "";
+    return `err:${msg}`;
+  }
+  return null;
+}
+const _tenantBuckets = /* @__PURE__ */ new Map();
+function getTenantBucket(tenantId) {
+  let bucket = _tenantBuckets.get(tenantId);
+  if (!bucket) {
+    bucket = new TokenBucket(100, 1e3);
+    _tenantBuckets.set(tenantId, bucket);
+  }
+  return bucket;
+}
+function createIngestRouter(localSecret) {
+  const router = Router();
+  const effectiveSecret = process.env.MERGEN_SECRET ?? localSecret;
+  router.post("/ingest", async (req, res) => {
+    if (!timingSafeSecretEqualAny(req.headers["x-mergen-secret"], effectiveSecret)) {
+      res.status(401).json({ error: "unauthorized" });
+      return;
+    }
+    const tenantId = req.tenantId;
+    const limited = tenantId ? getTenantBucket(tenantId).isRateLimited() : _bucket.isRateLimited();
+    if (limited) {
+      res.status(429).json({ error: "rate limit exceeded" });
+      return;
+    }
+    const result = BrowserEventSchema.safeParse(req.body);
+    if (!result.success) {
+      if (req.body && req.body.type === "blunder") {
+        const { id, recordedAt, blunderType, command, blockReason, service, tag, actor, pid, confidenceScore, triggeredRules } = req.body;
+        if (typeof blunderType !== "string" || typeof blockReason !== "string" || typeof actor !== "string") {
+          res.status(400).json({ error: "invalid blunder event fields" });
+          return;
+        }
+        const rules = Array.isArray(triggeredRules) ? triggeredRules.filter((r) => typeof r === "string").slice(0, 32).map((r) => r.slice(0, 200)) : null;
+        try {
+          await getStores().blunders.record({
+            id: typeof id === "string" ? id : void 0,
+            recordedAt: typeof recordedAt === "number" ? recordedAt : void 0,
+            blunderType,
+            command: typeof command === "string" ? command : null,
+            blockReason,
+            service: typeof service === "string" ? service : null,
+            tag: typeof tag === "string" ? tag : null,
+            actor,
+            pid: typeof pid === "string" ? pid : null,
+            confidenceScore: typeof confidenceScore === "number" ? confidenceScore : null,
+            triggeredRules: rules
+          });
+          res.status(204).end();
+          return;
+        } catch (err) {
+          logger.warn({ err }, "ingest: failed to record blunder");
+          res.status(500).json({ error: "failed to record blunder" });
+          return;
+        }
+      }
+      res.status(400).json({ error: "invalid event", details: result.error.flatten() });
+      return;
+    }
+    const tsFutureMs = result.data.timestamp - Date.now();
+    if (tsFutureMs > 10 * 60 * 1e3) {
+      const eventUrl = "url" in result.data ? result.data.url : void 0;
+      logger.warn({ tsFutureMs, url: eventUrl }, "ingest: event timestamp is too far in the future \u2014 rejected");
+      res.status(400).json({ error: "event timestamp too far in the future" });
+      return;
+    }
+    const event = redactEvent(clampNetworkBodies(result.data));
+    const fp = eventFingerprint(event);
+    if (fp && _dedup.isDuplicate(fp, event.timestamp)) {
+      res.status(204).end();
+      return;
+    }
+    res.status(204).end();
+    _processEvent(event, req.tenantId);
+  });
+  return router;
+}
+const ingestRouter = Router();
+class TokenBucket {
+  constructor(limit = 100, windowMs = 1e3) {
+    this.limit = limit;
+    this.windowMs = windowMs;
+  }
+  limit;
+  windowMs;
+  _count = 0;
+  _timer = null;
+  isRateLimited() {
+    if (this._count >= this.limit) return true;
+    this._count++;
+    if (!this._timer) {
+      this._timer = setTimeout(() => {
+        this._count = 0;
+        this._timer = null;
+      }, this.windowMs);
+    }
+    return false;
+  }
+  reset() {
+    if (this._timer) {
+      clearTimeout(this._timer);
+      this._timer = null;
+    }
+    this._count = 0;
+  }
+}
+const _bucket = new TokenBucket();
+function resetForTesting() {
+  _bucket.reset();
+  _dedup.reset();
+}
+function isRateLimited() {
+  return _bucket.isRateLimited();
+}
+const SOURCEMAP_TIMEOUT_MS = 2e3;
+const MAX_BODY_BYTES = 8 * 1024;
+const TRUNC_MARKER = "[\u2026truncated by mergen]";
+function clampBody(body) {
+  if (body == null) return body;
+  if (typeof body === "string") {
+    return body.length > MAX_BODY_BYTES ? body.slice(0, MAX_BODY_BYTES) + ` ${TRUNC_MARKER} (+${body.length - MAX_BODY_BYTES} bytes)` : body;
+  }
+  let s;
+  try {
+    s = JSON.stringify(body);
+  } catch {
+    return TRUNC_MARKER;
+  }
+  if (s.length <= MAX_BODY_BYTES) return body;
+  return s.slice(0, MAX_BODY_BYTES) + ` ${TRUNC_MARKER} (+${s.length - MAX_BODY_BYTES} bytes)`;
+}
+function clampNetworkBodies(event) {
+  if (event.type !== "network") return event;
+  return {
+    ...event,
+    requestBody: clampBody(event.requestBody),
+    responseBody: clampBody(event.responseBody)
+  };
+}
+function redactEvent(event) {
+  if (event.type === "network") {
+    return {
+      ...event,
+      url: typeof event.url === "string" ? redact(event.url) : event.url,
+      requestBody: redact(event.requestBody),
+      responseBody: redact(event.responseBody),
+      requestHeaders: event.requestHeaders ? redact(event.requestHeaders) : event.requestHeaders,
+      responseHeaders: event.responseHeaders ? redact(event.responseHeaders) : event.responseHeaders
+    };
+  }
+  if (event.type === "console") {
+    return { ...event, args: redact(event.args) };
+  }
+  if (event.type === "context") {
+    return {
+      ...event,
+      localStorage: redact(event.localStorage),
+      sessionStorage: redact(event.sessionStorage)
+    };
+  }
+  return event;
+}
+function withTimeout(promise, ms) {
+  return Promise.race([
+    promise,
+    new Promise(
+      (_, reject) => setTimeout(() => reject(new Error(`sourcemap resolution timed out after ${ms}ms`)), ms)
+    )
+  ]);
+}
+function _processEvent(event, tenantId) {
+  const isError = event.type === "console" && event.level === "error";
+  const isPageload = event.type === "context" && event.trigger === "pageload";
+  const isHmr = event.type === "context" && event.trigger === "hmr";
+  const isFailedNet = event.type === "network" && (event.status >= 400 || event.status === 0 || !!event.error);
+  const isSlowNet = event.type === "network" && event.duration > 500;
+  const burstReason = () => {
+    if (isFailedNet) {
+      const w = store.getNetwork(50, void 0, Date.now() - 1e4);
+      if (w.filter((n) => n.status >= 400 || n.status === 0 || !!n.error).length >= 3) return "net_burst";
+    }
+    if (isSlowNet) {
+      const w = store.getNetwork(50, void 0, Date.now() - 1e4);
+      if (w.filter((n) => n.duration > 500).length >= 3) return "slow_burst";
+    }
+    return null;
+  };
+  const triggerActivity = () => {
+    if (!_notifier) return;
+    if (isError) {
+      _notifier.notifyError();
+      return;
+    }
+    if (isPageload) {
+      _notifier.notifyActivity("pageload");
+      return;
+    }
+    if (isHmr) {
+      _notifier.notifyActivity("hmr");
+      return;
+    }
+    const burst = burstReason();
+    if (burst) {
+      _notifier.notifyActivity(burst);
+      return;
+    }
+  };
+  const eventId = layer2Store.indexEvent(event);
+  const breakpoint = layer3Store.checkBreakpoint(event);
+  if (breakpoint) logger.info({ breakpoint: breakpoint.id, eventId }, "Breakpoint hit");
+  if (event.type === "console" && event.level === "error") {
+    const message = event.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ");
+    layer4Store.recordError(message, event.stack);
+  }
+  if (event.type === "console" && typeof event.stack === "string") {
+    withTimeout(resolveFrameAndStack(event.stack), SOURCEMAP_TIMEOUT_MS).then(({ resolvedStack, primaryFrame }) => {
+      const resolved_event = {
+        ...event,
+        stack: resolvedStack,
+        ...primaryFrame?.gitSuspect ? { gitSuspect: primaryFrame.gitSuspect } : {}
+      };
+      store.push(resolved_event, tenantId);
+      historyStore.push(resolved_event);
+      maybeTeamBroadcast(resolved_event);
+      exportToOtel(resolved_event);
+    }).catch((err) => {
+      logger.warn({ err }, "sourcemap resolution failed or timed out, storing raw event");
+      store.push(event, tenantId);
+      historyStore.push(event);
+      maybeTeamBroadcast(event);
+      exportToOtel(event);
+    }).finally(triggerActivity);
+  } else {
+    store.push(event, tenantId);
+    historyStore.push(event);
+    maybeTeamBroadcast(event);
+    exportToOtel(event);
+    updateTopology(event);
+    triggerActivity();
+  }
+}
+function updateTopology(event) {
+  if (event.type === "backend_span") {
+    serviceTopology.updateFromSpan(event);
+    const siblings = store.getBackendSpans(50).filter((s) => s.traceId === event.traceId);
+    if (siblings.length > 1) serviceTopology.updateFromTraceGroup(siblings);
+    return;
+  }
+  if (event.type === "network" && event.traceId) {
+    const matchingSpan = store.getBackendSpans(50).find((s) => s.traceId === event.traceId);
+    if (matchingSpan) {
+      serviceTopology.updateFromTraceJoin(
+        event.url,
+        matchingSpan.service,
+        event.duration,
+        event.status >= 500 || !!event.error,
+        event.traceId,
+        event.timestamp
+      );
+    }
+  }
+}
+export {
+  MAX_BODY_BYTES,
+  TokenBucket,
+  clampBody,
+  clampNetworkBodies,
+  createIngestRouter,
+  ingestRouter,
+  registerActivityNotifier,
+  registerTeamBroadcaster,
+  resetForTesting
+};

package/dist/sensor/jest-reporter.js

@@ -0,0 +1,52 @@
+import http from "http";
+const MERGEN_PORT = parseInt(process.env.MERGEN_PORT ?? "3000", 10);
+function postEvent(payload) {
+  const body = JSON.stringify(payload);
+  const req = http.request(
+    {
+      hostname: "127.0.0.1",
+      port: MERGEN_PORT,
+      path: "/ingest",
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(body)
+      }
+    },
+    (res) => res.resume()
+  );
+  req.on("error", () => {
+  });
+  req.write(body);
+  req.end();
+}
+class MergenJestReporter {
+  constructor(_globalConfig, _options) {
+  }
+  onTestResult(_test, testResult) {
+    const file = testResult.testFilePath;
+    for (const t of testResult.testResults) {
+      const stateMap = {
+        passed: "pass",
+        failed: "fail",
+        skipped: "skip",
+        todo: "todo",
+        pending: "skip"
+      };
+      const error = t.failureMessages[0] ? { message: t.failureMessages[0].split("\n")[0], stack: t.failureMessages[0] } : void 0;
+      postEvent({
+        type: "test_result",
+        runner: "jest",
+        file,
+        name: t.fullName,
+        status: stateMap[t.status] ?? "skip",
+        duration: t.duration ?? void 0,
+        error,
+        timestamp: Date.now()
+      });
+    }
+  }
+}
+export {
+  MergenJestReporter as default
+};

package/dist/sensor/k8s-events.js

@@ -0,0 +1,132 @@
+import { execFile } from "child_process";
+import { promisify } from "util";
+import logger from "./logger.js";
+const execFileAsync = promisify(execFile);
+const POLL_INTERVAL_MS = 3e4;
+const MAX_BUFFERED = 500;
+const EVENT_WINDOW_MS = 10 * 60 * 1e3;
+const _buffer = [];
+const _seenUids = /* @__PURE__ */ new Set();
+function push(event) {
+  _buffer.push(event);
+  if (_buffer.length > MAX_BUFFERED) _buffer.shift();
+}
+function toTimestamp(item) {
+  const raw = item.lastTimestamp ?? item.firstTimestamp ?? item.eventTime ?? item.metadata.creationTimestamp;
+  return raw ? new Date(raw).getTime() : Date.now();
+}
+function normalizeEvent(item, namespace) {
+  if (item.type === "Normal") return null;
+  const reason = (item.reason ?? "").toLowerCase();
+  const message = item.message ?? "";
+  const msgLow = message.toLowerCase();
+  const service = item.involvedObject.name;
+  const ts = toTimestamp(item);
+  const attrs = {
+    namespace,
+    objectKind: item.involvedObject.kind,
+    k8sReason: item.reason,
+    count: item.count ?? 1
+  };
+  if (reason === "oomkilling" || reason === "oom" || msgLow.includes("oom")) {
+    return { kind: "oom_kill", timestamp: ts, service, severity: "critical", message, attributes: attrs, source: "k8s" };
+  }
+  if (reason === "backoff" || msgLow.includes("back-off") || msgLow.includes("crashloop")) {
+    return { kind: "pod_crash", timestamp: ts, service, severity: "critical", message, attributes: attrs, source: "k8s" };
+  }
+  if (reason === "evicting" || reason === "evicted") {
+    const isDisk = msgLow.includes("disk") || msgLow.includes("ephemeral") || msgLow.includes("storage");
+    return { kind: isDisk ? "disk_pressure" : "oom_kill", timestamp: ts, service, severity: "critical", message, attributes: attrs, source: "k8s" };
+  }
+  if ((reason === "failed" || reason === "failedsync") && (msgLow.includes("imagepull") || msgLow.includes("errimagepull") || msgLow.includes("image pull"))) {
+    return { kind: "pod_crash", timestamp: ts, service, severity: "critical", message, attributes: { ...attrs, k8sReason: "ImagePullError" }, source: "k8s" };
+  }
+  if (reason === "unhealthy") {
+    return { kind: "pod_crash", timestamp: ts, service, severity: "high", message, attributes: attrs, source: "k8s" };
+  }
+  if (reason === "failedmount" || reason === "failedattachvolume") {
+    return { kind: "pod_crash", timestamp: ts, service, severity: "critical", message, attributes: attrs, source: "k8s" };
+  }
+  if (reason === "nodehasdiskcapacity" || msgLow.includes("disk pressure")) {
+    return { kind: "disk_pressure", timestamp: ts, service, severity: "high", message, attributes: attrs, source: "k8s" };
+  }
+  if (reason === "nodenotready" || reason === "notready") {
+    return { kind: "service_unavailable", timestamp: ts, service, severity: "critical", message, attributes: attrs, source: "k8s" };
+  }
+  if (reason === "toomanyrequests" || msgLow.includes("rate limit") || msgLow.includes("429")) {
+    return { kind: "rate_limit_cascade", timestamp: ts, service, severity: "high", message, attributes: attrs, source: "k8s" };
+  }
+  return null;
+}
+async function pollNamespace(namespace) {
+  let stdout;
+  try {
+    const result = await execFileAsync("kubectl", ["get", "events", "-n", namespace, "-o", "json"], {
+      timeout: 1e4,
+      maxBuffer: 4 * 1024 * 1024
+      // 4 MB
+    });
+    stdout = result.stdout;
+  } catch {
+    return;
+  }
+  let list;
+  try {
+    list = JSON.parse(stdout);
+  } catch {
+    return;
+  }
+  if (!Array.isArray(list?.items)) return;
+  const cutoff = Date.now() - EVENT_WINDOW_MS;
+  for (const item of list.items) {
+    const uid = item.metadata?.uid;
+    if (!uid || _seenUids.has(uid)) continue;
+    const normalized = normalizeEvent(item, namespace);
+    if (!normalized) {
+      _seenUids.add(uid);
+      continue;
+    }
+    if (normalized.timestamp < cutoff) {
+      _seenUids.add(uid);
+      continue;
+    }
+    _seenUids.add(uid);
+    push(normalized);
+    logger.debug({ kind: normalized.kind, service: normalized.service, namespace }, "k8s-events: new event");
+  }
+  if (_seenUids.size > 1e4) {
+    const arr = [..._seenUids];
+    arr.slice(0, 5e3).forEach((uid) => _seenUids.delete(uid));
+  }
+}
+let _pollHandle = null;
+let _namespaces = [];
+function startK8sEventsPoller() {
+  const raw = process.env.MERGEN_K8S_NAMESPACE;
+  if (!raw) return () => {
+  };
+  _namespaces = raw.split(",").map((s) => s.trim()).filter(Boolean);
+  if (_namespaces.length === 0) return () => {
+  };
+  logger.info({ namespaces: _namespaces }, "k8s-events: polling started");
+  void Promise.all(_namespaces.map(pollNamespace));
+  _pollHandle = setInterval(() => {
+    void Promise.all(_namespaces.map(pollNamespace));
+  }, POLL_INTERVAL_MS);
+  _pollHandle.unref();
+  return () => {
+    if (_pollHandle) {
+      clearInterval(_pollHandle);
+      _pollHandle = null;
+    }
+    logger.info("k8s-events: polling stopped");
+  };
+}
+function getK8sEvents(since) {
+  if (since === void 0) return [..._buffer];
+  return _buffer.filter((e) => e.timestamp >= since);
+}
+export {
+  getK8sEvents,
+  startK8sEventsPoller
+};

package/dist/sensor/layer2-store.js

@@ -0,0 +1,111 @@
+import { randomBytes } from "crypto";
+class Layer2Store {
+  eventIndex = /* @__PURE__ */ new Map();
+  // id → full event
+  watchPatterns = /* @__PURE__ */ new Map();
+  // id → pattern
+  watchListeners = /* @__PURE__ */ new Map();
+  /** Store full event with ID for later replay */
+  indexEvent(event) {
+    const id = randomBytes(8).toString("hex");
+    this.eventIndex.set(id, event);
+    for (const [watchId, pattern] of this.watchPatterns) {
+      if (this.matchesPattern(event, pattern)) {
+        const listener = this.watchListeners.get(watchId);
+        if (listener) listener(event);
+      }
+    }
+    return id;
+  }
+  /** Retrieve full event by ID */
+  getEventById(id) {
+    return this.eventIndex.get(id);
+  }
+  /** Register a watch pattern */
+  registerWatch(pattern, type) {
+    const id = randomBytes(8).toString("hex");
+    this.watchPatterns.set(id, {
+      id,
+      pattern,
+      type,
+      createdAt: Date.now()
+    });
+    return id;
+  }
+  /** Remove a watch pattern */
+  removeWatch(id) {
+    this.watchListeners.delete(id);
+    return this.watchPatterns.delete(id);
+  }
+  /** List all active watch patterns */
+  listWatches() {
+    return Array.from(this.watchPatterns.values());
+  }
+  /** Set callback for watch pattern */
+  setWatchListener(watchId, callback) {
+    this.watchListeners.set(watchId, callback);
+  }
+  /** Build timeline from events */
+  buildTimeline(events, from, to) {
+    return events.filter((e) => {
+      if (from !== void 0 && e.timestamp < from) return false;
+      if (to !== void 0 && e.timestamp > to) return false;
+      return true;
+    }).map((e) => ({
+      timestamp: e.timestamp,
+      type: e.type,
+      summary: this.summarizeEvent(e),
+      fullEvent: e
+    })).sort((a, b) => a.timestamp - b.timestamp);
+  }
+  matchesPattern(event, pattern) {
+    if (pattern.type !== event.type) return false;
+    try {
+      const regex = new RegExp(pattern.pattern, "i");
+      if (event.type === "console") {
+        const message = event.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ");
+        return regex.test(message);
+      }
+      if (event.type === "network") {
+        return regex.test(event.url);
+      }
+    } catch {
+      if (event.type === "console") {
+        const message = event.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ");
+        return message.includes(pattern.pattern);
+      }
+      if (event.type === "network") {
+        return event.url.includes(pattern.pattern);
+      }
+    }
+    return false;
+  }
+  summarizeEvent(event) {
+    if (event.type === "console") {
+      const msg = event.args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ").slice(0, 100);
+      return `[${event.level.toUpperCase()}] ${msg}`;
+    }
+    if (event.type === "network") {
+      return `${event.method} ${event.url} \u2192 ${event.status} (${event.duration}ms)`;
+    }
+    if (event.type === "context") {
+      return `Context snapshot (${event.trigger}) at ${event.url}`;
+    }
+    return "Unknown event";
+  }
+  /** Clear old indexed events to prevent memory leak (keep last 500) */
+  pruneEventIndex() {
+    const MAX_INDEXED_EVENTS = 500;
+    if (this.eventIndex.size > MAX_INDEXED_EVENTS) {
+      const sorted = Array.from(this.eventIndex.entries()).sort((a, b) => b[1].timestamp - a[1].timestamp);
+      this.eventIndex.clear();
+      for (const [id, event] of sorted.slice(0, MAX_INDEXED_EVENTS)) {
+        this.eventIndex.set(id, event);
+      }
+    }
+  }
+}
+const layer2Store = new Layer2Store();
+export {
+  layer2Store
+};