mergen-server 1.4.0

package/dist/sensor/session-history.js

@@ -0,0 +1,74 @@
+import fs from "fs";
+import path from "path";
+import { SESSIONS_DIR } from "./paths.js";
+import logger from "./logger.js";
+const SCHEMA_VERSION = 1;
+const MAX_SESSIONS = 30;
+function ensureDir() {
+  fs.mkdirSync(SESSIONS_DIR, { recursive: true });
+}
+function toSafeFilename(ts, label) {
+  const safe = label.replace(/[^a-zA-Z0-9_-]/g, "-").slice(0, 40);
+  return `${new Date(ts).toISOString().replace(/[:.]/g, "-")}-${safe}.json`;
+}
+function saveSessionToHistory(events, label = "session") {
+  if (events.length === 0) return;
+  try {
+    ensureDir();
+    const ts = Date.now();
+    const filename = toSafeFilename(ts, label);
+    const payload = { v: SCHEMA_VERSION, savedAt: ts, label, eventCount: events.length, events };
+    fs.writeFileSync(path.join(SESSIONS_DIR, filename), JSON.stringify(payload), "utf8");
+    pruneOldSessions();
+    logger.info({ count: events.length, filename }, "session saved to history");
+  } catch (err) {
+    logger.warn({ err }, "session history save failed");
+  }
+}
+function listFiles() {
+  try {
+    ensureDir();
+    return fs.readdirSync(SESSIONS_DIR).filter((f) => f.endsWith(".json")).sort();
+  } catch {
+    return [];
+  }
+}
+function pruneOldSessions() {
+  const files = listFiles();
+  if (files.length <= MAX_SESSIONS) return;
+  for (const f of files.slice(0, files.length - MAX_SESSIONS)) {
+    try {
+      fs.unlinkSync(path.join(SESSIONS_DIR, f));
+    } catch {
+    }
+  }
+}
+function listSessionMetas() {
+  return listFiles().map((filename) => {
+    try {
+      const raw = fs.readFileSync(path.join(SESSIONS_DIR, filename), "utf8");
+      const parsed = JSON.parse(raw);
+      return { id: filename.replace(".json", ""), savedAt: parsed.savedAt, eventCount: parsed.eventCount, label: parsed.label, filename };
+    } catch {
+      return null;
+    }
+  }).filter((m) => m !== null).reverse();
+}
+function loadSessionsByTimeRange(since, until) {
+  const metas = listSessionMetas().filter((m) => m.savedAt >= since && m.savedAt <= until);
+  const all = [];
+  for (const meta of metas) {
+    try {
+      const raw = fs.readFileSync(path.join(SESSIONS_DIR, meta.filename), "utf8");
+      const parsed = JSON.parse(raw);
+      if (parsed.v === SCHEMA_VERSION) all.push(...parsed.events);
+    } catch {
+    }
+  }
+  return all.sort((a, b) => a.timestamp - b.timestamp);
+}
+export {
+  listSessionMetas,
+  loadSessionsByTimeRange,
+  saveSessionToHistory
+};

package/dist/sensor/session-persist.js

@@ -0,0 +1,38 @@
+import fs from "fs";
+import { SESSION_FILE, DATA_DIR } from "./paths.js";
+import logger from "./logger.js";
+const SCHEMA_VERSION = 1;
+const SESSION_MAX_AGE_MS = 8 * 60 * 60 * 1e3;
+function saveSession(events) {
+  if (events.length === 0) return;
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    const payload = { v: SCHEMA_VERSION, savedAt: Date.now(), events };
+    fs.writeFileSync(SESSION_FILE, JSON.stringify(payload), "utf8");
+    logger.info({ count: events.length }, "session persisted to disk");
+  } catch (err) {
+    logger.warn({ err }, "session persist failed \u2014 buffer will be lost on restart");
+  }
+}
+function loadSession() {
+  try {
+    if (!fs.existsSync(SESSION_FILE)) return null;
+    const raw = fs.readFileSync(SESSION_FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.v !== SCHEMA_VERSION) return null;
+    const age = Date.now() - parsed.savedAt;
+    if (age > SESSION_MAX_AGE_MS) {
+      fs.unlinkSync(SESSION_FILE);
+      logger.info({ ageMs: age }, "stale session discarded");
+      return null;
+    }
+    return parsed.events;
+  } catch (err) {
+    logger.warn({ err }, "session load failed");
+    return null;
+  }
+}
+export {
+  loadSession,
+  saveSession
+};

package/dist/sensor/shadow-promote.js

@@ -0,0 +1,122 @@
+import fs from "fs";
+import path from "path";
+import { DATA_DIR, zeroRetentionMode } from "./paths.js";
+import logger from "./logger.js";
+import { stageProposal } from "../intelligence/policy-proposals.js";
+import { loadEnterprisePolicy } from "../intelligence/enterprise-policy-engine.js";
+const SHADOW_RULE_STATS_FILE = path.join(DATA_DIR, "shadow-rule-stats.json");
+const MAX_STATS_ENTRIES = 1e3;
+const PROMOTION_WINDOW_MS = 14 * 24 * 60 * 60 * 1e3;
+const MIN_HITS_FOR_PROMOTION = 5;
+let _stats = {};
+let _loaded = false;
+function _load() {
+  if (_loaded) return;
+  _loaded = true;
+  if (!fs.existsSync(SHADOW_RULE_STATS_FILE)) return;
+  try {
+    const raw = JSON.parse(fs.readFileSync(SHADOW_RULE_STATS_FILE, "utf8"));
+    if (raw?.version === 1 && raw.stats) {
+      _stats = raw.stats;
+    }
+  } catch (err) {
+    logger.warn({ err }, "shadow-promote: failed to load stats \u2014 starting fresh");
+  }
+}
+function _persist() {
+  if (zeroRetentionMode()) return;
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    const entries = Object.entries(_stats);
+    if (entries.length > MAX_STATS_ENTRIES) {
+      const sorted = entries.sort(([, a], [, b]) => b.lastHitAt - a.lastHitAt);
+      _stats = Object.fromEntries(sorted.slice(0, MAX_STATS_ENTRIES));
+    }
+    const tmp = `${SHADOW_RULE_STATS_FILE}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify({ version: 1, stats: _stats }), "utf8");
+    fs.renameSync(tmp, SHADOW_RULE_STATS_FILE);
+  } catch (err) {
+    logger.warn({ err }, "shadow-promote: persist failed");
+  }
+}
+function _ensureRule(ruleId, ruleName) {
+  if (!_stats[ruleId]) {
+    _stats[ruleId] = {
+      ruleId,
+      ruleName,
+      totalHits: 0,
+      falsePositives: 0,
+      confirmedHits: 0,
+      firstHitAt: Date.now(),
+      lastHitAt: Date.now(),
+      proposalStaged: false,
+      proposalStagedAt: null
+    };
+  }
+  return _stats[ruleId];
+}
+function recordShadowRuleHit(ruleId, ruleName) {
+  _load();
+  const stat = _ensureRule(ruleId, ruleName);
+  stat.totalHits++;
+  stat.lastHitAt = Date.now();
+  _persist();
+  _maybeStagePromosal(stat);
+}
+function recordShadowRuleFeedback(ruleId, ruleName, isFalsePositive) {
+  _load();
+  const stat = _ensureRule(ruleId, ruleName);
+  if (isFalsePositive) {
+    stat.falsePositives++;
+    stat.proposalStaged = false;
+    stat.proposalStagedAt = null;
+  } else {
+    stat.confirmedHits++;
+  }
+  _persist();
+}
+function resetShadowRuleStats(ruleId) {
+  _load();
+  delete _stats[ruleId];
+  _persist();
+}
+function getShadowRuleStats() {
+  _load();
+  return Object.values(_stats).sort((a, b) => b.totalHits - a.totalHits);
+}
+function _maybeStagePromosal(stat) {
+  if (stat.proposalStaged) return;
+  if (stat.totalHits < MIN_HITS_FOR_PROMOTION) return;
+  if (stat.falsePositives > 0) return;
+  if (Date.now() - stat.firstHitAt < PROMOTION_WINDOW_MS) return;
+  const policy = loadEnterprisePolicy();
+  const rule = policy.rules.find((r) => r.id === stat.ruleId);
+  if (!rule || rule.action !== "warn") return;
+  const proposalRule = {
+    ...rule,
+    action: "warn",
+    name: `[Shadow Promote] ${rule.name}`,
+    reason: `Shadow promotion: rule "${rule.name}" has fired ${stat.totalHits} times over ${Math.round((Date.now() - stat.firstHitAt) / 864e5)} days with zero false positives. Approve to promote to block.`
+  };
+  const ruleHash = `shadow_promote_${stat.ruleId}`;
+  try {
+    const proposal = stageProposal(ruleHash, proposalRule, stat.totalHits);
+    if (proposal) {
+      stat.proposalStaged = true;
+      stat.proposalStagedAt = Date.now();
+      _persist();
+      logger.info(
+        { ruleId: stat.ruleId, hits: stat.totalHits },
+        "shadow-promote: staged promotion proposal for rule"
+      );
+    }
+  } catch (err) {
+    logger.warn({ err, ruleId: stat.ruleId }, "shadow-promote: failed to stage proposal");
+  }
+}
+export {
+  getShadowRuleStats,
+  recordShadowRuleFeedback,
+  recordShadowRuleHit,
+  resetShadowRuleStats
+};

package/dist/sensor/sourcemap.js

@@ -0,0 +1,281 @@
+import fs from "fs/promises";
+import path from "path";
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { SourceMapConsumer } from "source-map";
+import { LRUCache } from "lru-cache";
+import fg from "fast-glob";
+const execFileAsync = promisify(execFile);
+const consumerCache = new LRUCache({
+  max: 20,
+  dispose: (consumer) => {
+    try {
+      consumer.destroy();
+    } catch {
+    }
+  }
+});
+const MAP_INDEX_TTL_MS = 3e4;
+let mapIndex = null;
+let mapIndexCreatedAt = 0;
+let scanInFlight = null;
+async function getMapIndex() {
+  if (mapIndex && Date.now() - mapIndexCreatedAt < MAP_INDEX_TTL_MS) return mapIndex;
+  if (scanInFlight) return scanInFlight;
+  scanInFlight = (async () => {
+    const files = await fg("**/*.js.map", {
+      cwd: process.cwd(),
+      absolute: true,
+      ignore: ["**/node_modules/**", "**/.git/**"],
+      deep: 8
+    });
+    const index = /* @__PURE__ */ new Map();
+    for (const f of files) {
+      index.set(path.basename(f), f);
+    }
+    mapIndex = index;
+    mapIndexCreatedAt = Date.now();
+    scanInFlight = null;
+    return index;
+  })();
+  return scanInFlight;
+}
+const BLAME_TIMEOUT_MS = 800;
+const MAX_BLAME_CACHE = 500;
+const blameCache = /* @__PURE__ */ new Map();
+async function blameFrame(file, line) {
+  const absFile = path.isAbsolute(file) ? file : path.resolve(process.cwd(), file);
+  const cacheKey = `${absFile}:${line}`;
+  if (blameCache.has(cacheKey)) return blameCache.get(cacheKey);
+  if (blameCache.size >= MAX_BLAME_CACHE) {
+    blameCache.delete(blameCache.keys().next().value);
+  }
+  try {
+    await fs.access(absFile);
+  } catch {
+    blameCache.set(cacheKey, null);
+    return null;
+  }
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["blame", "-L", `${line},${line}`, "--porcelain", absFile],
+      { cwd: process.cwd(), timeout: BLAME_TIMEOUT_MS }
+    );
+    const lines = stdout.split("\n");
+    const sha = lines[0]?.slice(0, 40) ?? "";
+    if (!sha || /^0+$/.test(sha)) {
+      blameCache.set(cacheKey, null);
+      return null;
+    }
+    const author = lines.find((l) => l.startsWith("author "))?.slice(7).trim() ?? "unknown";
+    const summary = lines.find((l) => l.startsWith("summary "))?.slice(8).trim() ?? "";
+    const result = { sha, author, summary };
+    blameCache.set(cacheKey, result);
+    return result;
+  } catch {
+    blameCache.set(cacheKey, null);
+    return null;
+  }
+}
+async function getConsumer(mapPath) {
+  const cached = consumerCache.get(mapPath);
+  if (cached) return cached;
+  const raw = await fs.readFile(mapPath, "utf8");
+  const consumer = await new SourceMapConsumer(raw);
+  consumerCache.set(mapPath, consumer);
+  return consumer;
+}
+const FRAME_RE = /^\s+at\s+(?:(.+?)\s+\()?(.+?):(\d+):(\d+)\)?$/;
+function extractSnippet(content, errorLine, context = 2) {
+  const lines = content.split("\n");
+  const start = Math.max(0, errorLine - 1 - context);
+  const end = Math.min(lines.length - 1, errorLine - 1 + context);
+  const width = String(end + 1).length;
+  const rows = [];
+  for (let i = start; i <= end; i++) {
+    const num = String(i + 1).padStart(width);
+    const isCrash = i + 1 === errorLine;
+    const pointer = isCrash ? "\u25B6" : " ";
+    const annotation = isCrash ? "  // [ROOT CAUSE]" : "";
+    rows.push(`  ${pointer} ${num} \u2502 ${lines[i]}${annotation}`);
+  }
+  return rows.join("\n");
+}
+async function deminifyFrame(frame) {
+  const match = FRAME_RE.exec(frame);
+  if (!match) return frame;
+  const [, fnName, fileUrl, lineStr, colStr] = match;
+  const line = parseInt(lineStr, 10);
+  const column = parseInt(colStr, 10);
+  const mapName = path.basename(fileUrl.split("?")[0]) + ".map";
+  let index = await getMapIndex();
+  let mapPath = index.get(mapName);
+  if (!mapPath) {
+    mapIndex = null;
+    index = await getMapIndex();
+    mapPath = index.get(mapName);
+    if (!mapPath) return `${frame} [no sourcemap found]`;
+  }
+  try {
+    const consumer = await getConsumer(mapPath);
+    const pos = consumer.originalPositionFor({ line, column });
+    if (!pos.source) return `${frame} [no sourcemap found]`;
+    const fn = pos.name ?? fnName ?? "<anonymous>";
+    const resolved = `    at ${fn} (${pos.source}:${pos.line}:${pos.column})`;
+    try {
+      const sourceContent = consumer.sourceContentFor(pos.source, true);
+      if (sourceContent && pos.line) {
+        const snippet = extractSnippet(sourceContent, pos.line);
+        return `${resolved}
+${snippet}`;
+      }
+    } catch {
+    }
+    return resolved;
+  } catch {
+    return `${frame} [sourcemap error]`;
+  }
+}
+async function resolveStackTrace(stack) {
+  const lines = stack.split("\n");
+  const resolved = await Promise.all(lines.map(deminifyFrame));
+  return resolved.join("\n");
+}
+async function resolveFrameAndStack(stack) {
+  const lines = stack.split("\n");
+  let primaryFrame = null;
+  const resolvedLines = await Promise.all(
+    lines.map(async (line) => {
+      const match = FRAME_RE.exec(line);
+      if (!match) return line;
+      const [, fnName, fileUrl, lineStr, colStr] = match;
+      const lineNum = parseInt(lineStr, 10);
+      const colNum = parseInt(colStr, 10);
+      const mapName = path.basename(fileUrl.split("?")[0]) + ".map";
+      let index = await getMapIndex();
+      let mapPath = index.get(mapName);
+      if (!mapPath) {
+        mapIndex = null;
+        index = await getMapIndex();
+        mapPath = index.get(mapName);
+        if (!mapPath) return `${line} [no sourcemap found]`;
+      }
+      try {
+        const consumer = await getConsumer(mapPath);
+        const pos = consumer.originalPositionFor({ line: lineNum, column: colNum });
+        if (!pos.source) return `${line} [no sourcemap found]`;
+        const fn = pos.name ?? fnName ?? "<anonymous>";
+        const resolved = `    at ${fn} (${pos.source}:${pos.line}:${pos.column})`;
+        let snippet = "";
+        try {
+          const sourceContent = consumer.sourceContentFor(pos.source, true);
+          if (sourceContent && pos.line) {
+            snippet = extractSnippet(sourceContent, pos.line);
+          }
+        } catch {
+        }
+        return snippet ? `${resolved}
+${snippet}` : resolved;
+      } catch {
+        return `${line} [sourcemap error]`;
+      }
+    })
+  );
+  for (let i = 0; i < lines.length; i++) {
+    if (primaryFrame) break;
+    const match = FRAME_RE.exec(lines[i]);
+    if (!match) continue;
+    const [, fnName, fileUrl, lineStr, colStr] = match;
+    if (fileUrl.startsWith("node:") || fileUrl.includes("node_modules")) continue;
+    const lineNum = parseInt(lineStr, 10);
+    const colNum = parseInt(colStr, 10);
+    const mapName = path.basename(fileUrl.split("?")[0]) + ".map";
+    const index = await getMapIndex();
+    const mapPath = index.get(mapName);
+    if (!mapPath) continue;
+    try {
+      const consumer = await getConsumer(mapPath);
+      const pos = consumer.originalPositionFor({ line: lineNum, column: colNum });
+      if (!pos.source || !pos.line) continue;
+      const fn = pos.name ?? fnName ?? "<anonymous>";
+      let snippet = "";
+      try {
+        const sourceContent = consumer.sourceContentFor(pos.source, true);
+        if (sourceContent) snippet = extractSnippet(sourceContent, pos.line, 5);
+      } catch {
+      }
+      let gitSuspect = null;
+      try {
+        gitSuspect = await blameFrame(pos.source, pos.line);
+      } catch {
+      }
+      primaryFrame = {
+        fn,
+        file: pos.source,
+        line: pos.line,
+        column: pos.column ?? colNum,
+        snippet,
+        rawResolved: `    at ${fn} (${pos.source}:${pos.line}:${pos.column})`,
+        gitSuspect
+      };
+    } catch {
+      continue;
+    }
+  }
+  return { primaryFrame, resolvedStack: resolvedLines.join("\n") };
+}
+async function resolveFirstFrame(stack) {
+  const lines = stack.split("\n");
+  for (const line of lines) {
+    const match = FRAME_RE.exec(line);
+    if (!match) continue;
+    const [, fnName, fileUrl, lineStr, colStr] = match;
+    if (fileUrl.startsWith("node:") || fileUrl.includes("node_modules")) continue;
+    const lineNum = parseInt(lineStr, 10);
+    const colNum = parseInt(colStr, 10);
+    const mapName = path.basename(fileUrl.split("?")[0]) + ".map";
+    let index = await getMapIndex();
+    let mapPath = index.get(mapName);
+    if (!mapPath) {
+      mapIndex = null;
+      index = await getMapIndex();
+      mapPath = index.get(mapName);
+    }
+    if (!mapPath) continue;
+    try {
+      const consumer = await getConsumer(mapPath);
+      const pos = consumer.originalPositionFor({ line: lineNum, column: colNum });
+      if (!pos.source || !pos.line) continue;
+      const fn = pos.name ?? fnName ?? "<anonymous>";
+      let snippet = "";
+      try {
+        const sourceContent = consumer.sourceContentFor(pos.source, true);
+        if (sourceContent) snippet = extractSnippet(sourceContent, pos.line, 5);
+      } catch {
+      }
+      let gitSuspect = null;
+      try {
+        gitSuspect = await blameFrame(pos.source, pos.line);
+      } catch {
+      }
+      return {
+        fn,
+        file: pos.source,
+        line: pos.line,
+        column: pos.column ?? colNum,
+        snippet,
+        rawResolved: `    at ${fn} (${pos.source}:${pos.line}:${pos.column})`,
+        gitSuspect
+      };
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+export {
+  resolveFirstFrame,
+  resolveFrameAndStack,
+  resolveStackTrace
+};