@a-company/sentinel 0.2.0 → 3.5.0

package/dist/mcp.js

@@ -13,7 +13,7 @@ import initSqlJs from "sql.js";
 import { v4 as uuidv4 } from "uuid";
 import * as path from "path";
 import * as fs from "fs";
-var SCHEMA_VERSION = 2;
+var SCHEMA_VERSION = 4;
 var DEFAULT_CONFIDENCE = {
   score: 50,
   timesMatched: 0,
@@ -133,6 +133,72 @@ var SentinelStorage = class {
         notes TEXT
       );
 
+      -- Structured logs table
+      CREATE TABLE IF NOT EXISTS logs (
+        id TEXT PRIMARY KEY,
+        timestamp TEXT NOT NULL,
+        level TEXT NOT NULL CHECK (level IN ('debug','info','warn','error')),
+        symbol TEXT NOT NULL,
+        symbol_type TEXT NOT NULL DEFAULT 'raw',
+        message TEXT NOT NULL,
+        data_json TEXT,
+        service TEXT NOT NULL,
+        session_id TEXT,
+        correlation_id TEXT,
+        duration_ms REAL,
+        environment TEXT
+      );
+
+      -- Service registry
+      CREATE TABLE IF NOT EXISTS services (
+        name TEXT PRIMARY KEY,
+        version TEXT,
+        pid INTEGER,
+        started_at TEXT NOT NULL,
+        last_seen_at TEXT NOT NULL,
+        environment TEXT,
+        metadata_json TEXT
+      );
+
+      -- Live app state snapshots (latest-wins per service+session)
+      CREATE TABLE IF NOT EXISTS app_state (
+        service TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        timestamp TEXT NOT NULL,
+        state_json TEXT NOT NULL,
+        active_flows_json TEXT,
+        active_gates_json TEXT,
+        PRIMARY KEY (service, session_id)
+      );
+
+      -- Metrics table
+      CREATE TABLE IF NOT EXISTS metrics (
+        id TEXT PRIMARY KEY,
+        timestamp TEXT NOT NULL,
+        name TEXT NOT NULL,
+        type TEXT NOT NULL CHECK (type IN ('counter','gauge','histogram')),
+        value REAL NOT NULL,
+        tags_json TEXT DEFAULT '{}',
+        service TEXT NOT NULL,
+        environment TEXT
+      );
+
+      -- Traces table
+      CREATE TABLE IF NOT EXISTS traces (
+        trace_id TEXT NOT NULL,
+        span_id TEXT PRIMARY KEY,
+        parent_span_id TEXT,
+        service TEXT NOT NULL,
+        symbol TEXT NOT NULL,
+        operation TEXT NOT NULL,
+        start_time TEXT NOT NULL,
+        end_time TEXT,
+        duration_ms REAL,
+        status TEXT NOT NULL DEFAULT 'ok',
+        tags_json TEXT DEFAULT '{}',
+        log_ids_json TEXT DEFAULT '[]'
+      );
+
       -- Indexes
       CREATE INDEX IF NOT EXISTS idx_incidents_timestamp ON incidents(timestamp);
       CREATE INDEX IF NOT EXISTS idx_incidents_status ON incidents(status);
@@ -142,6 +208,18 @@ var SentinelStorage = class {
       CREATE INDEX IF NOT EXISTS idx_practice_events_habit_id ON practice_events(habit_id);
       CREATE INDEX IF NOT EXISTS idx_practice_events_engineer ON practice_events(engineer);
       CREATE INDEX IF NOT EXISTS idx_practice_events_session_id ON practice_events(session_id);
+      CREATE INDEX IF NOT EXISTS idx_logs_timestamp ON logs(timestamp);
+      CREATE INDEX IF NOT EXISTS idx_logs_level ON logs(level);
+      CREATE INDEX IF NOT EXISTS idx_logs_symbol ON logs(symbol);
+      CREATE INDEX IF NOT EXISTS idx_logs_service ON logs(service);
+      CREATE INDEX IF NOT EXISTS idx_logs_session_id ON logs(session_id);
+      CREATE INDEX IF NOT EXISTS idx_logs_correlation_id ON logs(correlation_id);
+      CREATE INDEX IF NOT EXISTS idx_metrics_timestamp ON metrics(timestamp);
+      CREATE INDEX IF NOT EXISTS idx_metrics_name ON metrics(name);
+      CREATE INDEX IF NOT EXISTS idx_metrics_service ON metrics(service);
+      CREATE INDEX IF NOT EXISTS idx_traces_trace_id ON traces(trace_id);
+      CREATE INDEX IF NOT EXISTS idx_traces_service ON traces(service);
+      CREATE INDEX IF NOT EXISTS idx_traces_start_time ON traces(start_time);
     `);
     this.db.run(
       "INSERT OR REPLACE INTO metadata (key, value) VALUES ('schema_version', ?)",
@@ -271,6 +349,101 @@ var SentinelStorage = class {
       this.db.run(
         "INSERT OR REPLACE INTO metadata (key, value) VALUES ('schema_version', '2')"
       );
+      currentVersion = 2;
+    }
+    if (currentVersion < 3) {
+      try {
+        this.db.run(`
+          CREATE TABLE IF NOT EXISTS logs (
+            id TEXT PRIMARY KEY,
+            timestamp TEXT NOT NULL,
+            level TEXT NOT NULL CHECK (level IN ('debug','info','warn','error')),
+            symbol TEXT NOT NULL,
+            symbol_type TEXT NOT NULL DEFAULT 'raw',
+            message TEXT NOT NULL,
+            data_json TEXT,
+            service TEXT NOT NULL,
+            session_id TEXT,
+            correlation_id TEXT,
+            duration_ms REAL,
+            environment TEXT
+          );
+
+          CREATE TABLE IF NOT EXISTS services (
+            name TEXT PRIMARY KEY,
+            version TEXT,
+            pid INTEGER,
+            started_at TEXT NOT NULL,
+            last_seen_at TEXT NOT NULL,
+            environment TEXT,
+            metadata_json TEXT
+          );
+
+          CREATE TABLE IF NOT EXISTS app_state (
+            service TEXT NOT NULL,
+            session_id TEXT NOT NULL,
+            timestamp TEXT NOT NULL,
+            state_json TEXT NOT NULL,
+            active_flows_json TEXT,
+            active_gates_json TEXT,
+            PRIMARY KEY (service, session_id)
+          );
+
+          CREATE INDEX IF NOT EXISTS idx_logs_timestamp ON logs(timestamp);
+          CREATE INDEX IF NOT EXISTS idx_logs_level ON logs(level);
+          CREATE INDEX IF NOT EXISTS idx_logs_symbol ON logs(symbol);
+          CREATE INDEX IF NOT EXISTS idx_logs_service ON logs(service);
+          CREATE INDEX IF NOT EXISTS idx_logs_session_id ON logs(session_id);
+          CREATE INDEX IF NOT EXISTS idx_logs_correlation_id ON logs(correlation_id);
+        `);
+      } catch {
+      }
+      this.db.run(
+        "INSERT OR REPLACE INTO metadata (key, value) VALUES ('schema_version', '3')"
+      );
+      currentVersion = 3;
+    }
+    if (currentVersion < 4) {
+      try {
+        this.db.run(`
+          CREATE TABLE IF NOT EXISTS metrics (
+            id TEXT PRIMARY KEY,
+            timestamp TEXT NOT NULL,
+            name TEXT NOT NULL,
+            type TEXT NOT NULL CHECK (type IN ('counter','gauge','histogram')),
+            value REAL NOT NULL,
+            tags_json TEXT DEFAULT '{}',
+            service TEXT NOT NULL,
+            environment TEXT
+          );
+
+          CREATE TABLE IF NOT EXISTS traces (
+            trace_id TEXT NOT NULL,
+            span_id TEXT PRIMARY KEY,
+            parent_span_id TEXT,
+            service TEXT NOT NULL,
+            symbol TEXT NOT NULL,
+            operation TEXT NOT NULL,
+            start_time TEXT NOT NULL,
+            end_time TEXT,
+            duration_ms REAL,
+            status TEXT NOT NULL DEFAULT 'ok',
+            tags_json TEXT DEFAULT '{}',
+            log_ids_json TEXT DEFAULT '[]'
+          );
+
+          CREATE INDEX IF NOT EXISTS idx_metrics_timestamp ON metrics(timestamp);
+          CREATE INDEX IF NOT EXISTS idx_metrics_name ON metrics(name);
+          CREATE INDEX IF NOT EXISTS idx_metrics_service ON metrics(service);
+          CREATE INDEX IF NOT EXISTS idx_traces_trace_id ON traces(trace_id);
+          CREATE INDEX IF NOT EXISTS idx_traces_service ON traces(service);
+          CREATE INDEX IF NOT EXISTS idx_traces_start_time ON traces(start_time);
+        `);
+      } catch {
+      }
+      this.db.run(
+        "INSERT OR REPLACE INTO metadata (key, value) VALUES ('schema_version', '4')"
+      );
     }
   }
   /**
@@ -1245,6 +1418,620 @@ var SentinelStorage = class {
       notes: obj.notes || void 0
     };
   }
+  // ─── Structured Logs ─────────────────────────────────────────────
+  inferSymbolType(symbol) {
+    if (symbol.startsWith("#")) return "component";
+    if (symbol.startsWith("^")) return "gate";
+    if (symbol.startsWith("!")) return "signal";
+    if (symbol.startsWith("$")) return "flow";
+    if (symbol.startsWith("~")) return "aspect";
+    return "raw";
+  }
+  insertLog(input) {
+    this.initializeSync();
+    const id = input.id || uuidv4();
+    const timestamp = input.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+    const symbolType = input.symbolType || this.inferSymbolType(input.symbol);
+    this.db.run(
+      `INSERT INTO logs (
+        id, timestamp, level, symbol, symbol_type, message, data_json,
+        service, session_id, correlation_id, duration_ms, environment
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        id,
+        timestamp,
+        input.level,
+        input.symbol,
+        symbolType,
+        input.message,
+        input.data ? JSON.stringify(input.data) : null,
+        input.service,
+        input.sessionId || null,
+        input.correlationId || null,
+        input.durationMs ?? null,
+        input.environment || null
+      ]
+    );
+    this.save();
+    return id;
+  }
+  insertLogBatch(entries) {
+    this.initializeSync();
+    let accepted = 0;
+    const errors = [];
+    for (const input of entries) {
+      try {
+        const id = input.id || uuidv4();
+        const timestamp = input.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+        const symbolType = input.symbolType || this.inferSymbolType(input.symbol);
+        this.db.run(
+          `INSERT INTO logs (
+            id, timestamp, level, symbol, symbol_type, message, data_json,
+            service, session_id, correlation_id, duration_ms, environment
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+          [
+            id,
+            timestamp,
+            input.level,
+            input.symbol,
+            symbolType,
+            input.message,
+            input.data ? JSON.stringify(input.data) : null,
+            input.service,
+            input.sessionId || null,
+            input.correlationId || null,
+            input.durationMs ?? null,
+            input.environment || null
+          ]
+        );
+        accepted++;
+      } catch (err) {
+        errors.push(err instanceof Error ? err.message : String(err));
+      }
+    }
+    this.save();
+    return { accepted, errors };
+  }
+  queryLogs(options = {}) {
+    this.initializeSync();
+    const { limit = 100, offset = 0 } = options;
+    const conditions = [];
+    const params = [];
+    if (options.level) {
+      conditions.push("level = ?");
+      params.push(options.level);
+    }
+    if (options.symbol) {
+      conditions.push("symbol LIKE ?");
+      params.push(`%${options.symbol}%`);
+    }
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.sessionId) {
+      conditions.push("session_id = ?");
+      params.push(options.sessionId);
+    }
+    if (options.correlationId) {
+      conditions.push("correlation_id = ?");
+      params.push(options.correlationId);
+    }
+    if (options.search) {
+      conditions.push("message LIKE ?");
+      params.push(`%${options.search}%`);
+    }
+    if (options.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = this.db.exec(
+      `SELECT * FROM logs ${whereClause} ORDER BY timestamp DESC LIMIT ? OFFSET ?`,
+      [...params, limit, offset]
+    );
+    if (result.length === 0) return [];
+    return result[0].values.map(
+      (row) => this.rowToLogEntry(result[0].columns, row)
+    );
+  }
+  getLogCount(options = {}) {
+    this.initializeSync();
+    const conditions = [];
+    const params = [];
+    if (options.level) {
+      conditions.push("level = ?");
+      params.push(options.level);
+    }
+    if (options.symbol) {
+      conditions.push("symbol LIKE ?");
+      params.push(`%${options.symbol}%`);
+    }
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = this.db.exec(
+      `SELECT COUNT(*) as count FROM logs ${whereClause}`,
+      params
+    );
+    if (result.length === 0 || result[0].values.length === 0) return 0;
+    return result[0].values[0][0];
+  }
+  pruneLogs(maxCount) {
+    this.initializeSync();
+    if (maxCount <= 0) return 0;
+    const currentCount = this.getLogCount();
+    if (currentCount <= maxCount) return 0;
+    const deleteCount = currentCount - maxCount;
+    this.db.run(
+      `DELETE FROM logs WHERE id IN (
+        SELECT id FROM logs ORDER BY timestamp ASC LIMIT ?
+      )`,
+      [deleteCount]
+    );
+    this.save();
+    return deleteCount;
+  }
+  rowToLogEntry(columns, row) {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return {
+      id: obj.id,
+      timestamp: obj.timestamp,
+      level: obj.level,
+      symbol: obj.symbol,
+      symbolType: obj.symbol_type || "raw",
+      message: obj.message,
+      data: obj.data_json ? JSON.parse(obj.data_json) : void 0,
+      service: obj.service,
+      sessionId: obj.session_id || void 0,
+      correlationId: obj.correlation_id || void 0,
+      durationMs: obj.duration_ms || void 0,
+      environment: obj.environment || void 0
+    };
+  }
+  // ─── Service Registry ──────────────────────────────────────────
+  registerService(reg) {
+    this.initializeSync();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.run(
+      `INSERT INTO services (name, version, pid, started_at, last_seen_at, environment, metadata_json)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(name) DO UPDATE SET
+         version = excluded.version,
+         pid = excluded.pid,
+         last_seen_at = excluded.last_seen_at,
+         environment = excluded.environment,
+         metadata_json = excluded.metadata_json`,
+      [
+        reg.name,
+        reg.version || null,
+        reg.pid ?? null,
+        now,
+        now,
+        reg.environment || null,
+        reg.metadata ? JSON.stringify(reg.metadata) : null
+      ]
+    );
+    this.save();
+  }
+  updateServiceLastSeen(name) {
+    this.initializeSync();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.run(
+      "UPDATE services SET last_seen_at = ? WHERE name = ?",
+      [now, name]
+    );
+    this.save();
+  }
+  getServices() {
+    this.initializeSync();
+    const result = this.db.exec(
+      "SELECT * FROM services ORDER BY last_seen_at DESC"
+    );
+    if (result.length === 0) return [];
+    return result[0].values.map((row) => {
+      const obj = {};
+      result[0].columns.forEach((col, i) => {
+        obj[col] = row[i];
+      });
+      return {
+        name: obj.name,
+        version: obj.version || void 0,
+        pid: obj.pid || void 0,
+        startedAt: obj.started_at,
+        lastSeenAt: obj.last_seen_at,
+        environment: obj.environment || void 0,
+        metadata: obj.metadata_json ? JSON.parse(obj.metadata_json) : void 0
+      };
+    });
+  }
+  // ─── App State ──────────────────────────────────────────────────
+  upsertAppState(state) {
+    this.initializeSync();
+    this.db.run(
+      `INSERT INTO app_state (service, session_id, timestamp, state_json, active_flows_json, active_gates_json)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON CONFLICT(service, session_id) DO UPDATE SET
+         timestamp = excluded.timestamp,
+         state_json = excluded.state_json,
+         active_flows_json = excluded.active_flows_json,
+         active_gates_json = excluded.active_gates_json`,
+      [
+        state.service,
+        state.sessionId,
+        state.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+        JSON.stringify(state.state),
+        state.activeFlows ? JSON.stringify(state.activeFlows) : null,
+        state.activeGates ? JSON.stringify(state.activeGates) : null
+      ]
+    );
+    this.save();
+  }
+  getAppState(service, sessionId) {
+    this.initializeSync();
+    let query = "SELECT * FROM app_state WHERE service = ?";
+    const params = [service];
+    if (sessionId) {
+      query += " AND session_id = ?";
+      params.push(sessionId);
+    }
+    query += " ORDER BY timestamp DESC";
+    const result = this.db.exec(query, params);
+    if (result.length === 0) return [];
+    return result[0].values.map((row) => this.rowToAppState(result[0].columns, row));
+  }
+  getAllAppStates() {
+    this.initializeSync();
+    const result = this.db.exec(
+      "SELECT * FROM app_state ORDER BY timestamp DESC"
+    );
+    if (result.length === 0) return [];
+    return result[0].values.map((row) => this.rowToAppState(result[0].columns, row));
+  }
+  rowToAppState(columns, row) {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return {
+      service: obj.service,
+      sessionId: obj.session_id,
+      timestamp: obj.timestamp,
+      state: JSON.parse(obj.state_json),
+      activeFlows: obj.active_flows_json ? JSON.parse(obj.active_flows_json) : void 0,
+      activeGates: obj.active_gates_json ? JSON.parse(obj.active_gates_json) : void 0
+    };
+  }
+  // ─── Metrics ───────────────────────────────────────────────────
+  insertMetric(input) {
+    this.initializeSync();
+    const id = uuidv4();
+    const timestamp = input.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+    this.db.run(
+      `INSERT INTO metrics (
+        id, timestamp, name, type, value, tags_json, service, environment
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        id,
+        timestamp,
+        input.name,
+        input.type,
+        input.value,
+        JSON.stringify(input.tags || {}),
+        input.service,
+        input.environment || null
+      ]
+    );
+    this.save();
+    return id;
+  }
+  insertMetricBatch(entries) {
+    this.initializeSync();
+    let accepted = 0;
+    const errors = [];
+    for (const input of entries) {
+      try {
+        const id = uuidv4();
+        const timestamp = input.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+        this.db.run(
+          `INSERT INTO metrics (
+            id, timestamp, name, type, value, tags_json, service, environment
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+          [
+            id,
+            timestamp,
+            input.name,
+            input.type,
+            input.value,
+            JSON.stringify(input.tags || {}),
+            input.service,
+            input.environment || null
+          ]
+        );
+        accepted++;
+      } catch (err) {
+        errors.push(err instanceof Error ? err.message : String(err));
+      }
+    }
+    this.save();
+    return { accepted, errors };
+  }
+  queryMetrics(options = {}) {
+    this.initializeSync();
+    const { limit = 100, offset = 0 } = options;
+    const conditions = [];
+    const params = [];
+    if (options.name) {
+      conditions.push("name = ?");
+      params.push(options.name);
+    }
+    if (options.type) {
+      conditions.push("type = ?");
+      params.push(options.type);
+    }
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.tag) {
+      const eqIdx = options.tag.indexOf("=");
+      if (eqIdx > 0) {
+        const tagKey = options.tag.substring(0, eqIdx);
+        const tagValue = options.tag.substring(eqIdx + 1);
+        conditions.push("tags_json LIKE ?");
+        params.push(`%"${tagKey}":"${tagValue}"%`);
+      }
+    }
+    if (options.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = this.db.exec(
+      `SELECT * FROM metrics ${whereClause} ORDER BY timestamp DESC LIMIT ? OFFSET ?`,
+      [...params, limit, offset]
+    );
+    if (result.length === 0) return [];
+    return result[0].values.map(
+      (row) => this.rowToMetricEntry(result[0].columns, row)
+    );
+  }
+  getMetricCount(options = {}) {
+    this.initializeSync();
+    const conditions = [];
+    const params = [];
+    if (options.name) {
+      conditions.push("name = ?");
+      params.push(options.name);
+    }
+    if (options.type) {
+      conditions.push("type = ?");
+      params.push(options.type);
+    }
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.tag) {
+      const eqIdx = options.tag.indexOf("=");
+      if (eqIdx > 0) {
+        const tagKey = options.tag.substring(0, eqIdx);
+        const tagValue = options.tag.substring(eqIdx + 1);
+        conditions.push("tags_json LIKE ?");
+        params.push(`%"${tagKey}":"${tagValue}"%`);
+      }
+    }
+    if (options.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = this.db.exec(
+      `SELECT COUNT(*) as count FROM metrics ${whereClause}`,
+      params
+    );
+    if (result.length === 0 || result[0].values.length === 0) return 0;
+    return result[0].values[0][0];
+  }
+  aggregateMetric(name, options) {
+    this.initializeSync();
+    const conditions = ["name = ?"];
+    const params = [name];
+    if (options?.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options?.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options?.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = `WHERE ${conditions.join(" AND ")}`;
+    const result = this.db.exec(
+      `SELECT COUNT(*) as count, SUM(value) as sum, MIN(value) as min, MAX(value) as max, AVG(value) as avg
+       FROM metrics ${whereClause}`,
+      params
+    );
+    if (result.length === 0 || result[0].values.length === 0) {
+      return { name, count: 0, sum: 0, min: 0, max: 0, avg: 0 };
+    }
+    const row = result[0].values[0];
+    return {
+      name,
+      count: row[0] || 0,
+      sum: row[1] || 0,
+      min: row[2] || 0,
+      max: row[3] || 0,
+      avg: row[4] || 0
+    };
+  }
+  pruneMetrics(maxCount) {
+    this.initializeSync();
+    if (maxCount <= 0) return 0;
+    const currentCount = this.getMetricCount();
+    if (currentCount <= maxCount) return 0;
+    const deleteCount = currentCount - maxCount;
+    this.db.run(
+      `DELETE FROM metrics WHERE id IN (
+        SELECT id FROM metrics ORDER BY timestamp ASC LIMIT ?
+      )`,
+      [deleteCount]
+    );
+    this.save();
+    return deleteCount;
+  }
+  rowToMetricEntry(columns, row) {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return {
+      id: obj.id,
+      timestamp: obj.timestamp,
+      name: obj.name,
+      type: obj.type,
+      value: obj.value,
+      tags: obj.tags_json ? JSON.parse(obj.tags_json) : {},
+      service: obj.service,
+      environment: obj.environment || void 0
+    };
+  }
+  // ─── Traces ───────────────────────────────────────────────────
+  insertSpan(input) {
+    this.initializeSync();
+    const spanId = input.spanId || uuidv4();
+    const startTime = input.startTime || (/* @__PURE__ */ new Date()).toISOString();
+    this.db.run(
+      `INSERT INTO traces (
+        trace_id, span_id, parent_span_id, service, symbol, operation,
+        start_time, end_time, duration_ms, status, tags_json, log_ids_json
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        input.traceId,
+        spanId,
+        input.parentSpanId || null,
+        input.service,
+        input.symbol,
+        input.operation,
+        startTime,
+        input.endTime || null,
+        input.durationMs ?? null,
+        input.status || "ok",
+        JSON.stringify(input.tags || {}),
+        JSON.stringify(input.logIds || [])
+      ]
+    );
+    this.save();
+    return spanId;
+  }
+  getTrace(traceId) {
+    this.initializeSync();
+    const result = this.db.exec(
+      "SELECT * FROM traces WHERE trace_id = ? ORDER BY start_time ASC",
+      [traceId]
+    );
+    if (result.length === 0 || result[0].values.length === 0) return null;
+    const spans = result[0].values.map(
+      (row) => this.rowToTraceSpan(result[0].columns, row)
+    );
+    const services = [...new Set(spans.map((s) => s.service))];
+    const startTimes = spans.map((s) => s.startTime);
+    const endTimes = spans.filter((s) => s.endTime).map((s) => s.endTime);
+    const startTime = startTimes.sort()[0];
+    const endTime = endTimes.length > 0 ? endTimes.sort().reverse()[0] : startTime;
+    const startMs = new Date(startTime).getTime();
+    const endMs = new Date(endTime).getTime();
+    const totalDurationMs = endMs - startMs;
+    return {
+      traceId,
+      spans,
+      services,
+      totalDurationMs: totalDurationMs > 0 ? totalDurationMs : 0,
+      startTime,
+      endTime
+    };
+  }
+  queryTraces(options = {}) {
+    this.initializeSync();
+    const conditions = [];
+    const params = [];
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.symbol) {
+      conditions.push("symbol = ?");
+      params.push(options.symbol);
+    }
+    if (options.since) {
+      conditions.push("start_time >= ?");
+      params.push(options.since);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const traceLimit = Math.min(options.limit || 20, 20);
+    const result = this.db.exec(
+      `SELECT DISTINCT trace_id FROM traces ${whereClause} ORDER BY start_time DESC LIMIT ?`,
+      [...params, traceLimit]
+    );
+    if (result.length === 0) return [];
+    const traces = [];
+    for (const row of result[0].values) {
+      const traceId = row[0];
+      const trace = this.getTrace(traceId);
+      if (trace) {
+        traces.push(trace);
+      }
+    }
+    return traces;
+  }
+  rowToTraceSpan(columns, row) {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return {
+      traceId: obj.trace_id,
+      spanId: obj.span_id,
+      parentSpanId: obj.parent_span_id || void 0,
+      service: obj.service,
+      symbol: obj.symbol,
+      operation: obj.operation,
+      startTime: obj.start_time,
+      endTime: obj.end_time || void 0,
+      durationMs: obj.duration_ms || void 0,
+      status: obj.status || "ok",
+      tags: obj.tags_json ? JSON.parse(obj.tags_json) : {},
+      logs: obj.log_ids_json ? JSON.parse(obj.log_ids_json) : []
+    };
+  }
   close() {
     if (this.db) {
       this.save();
@@ -1902,7 +2689,7 @@ var PatternSuggester = class {
       },
       resolution: {
         description: incident.resolution?.notes || "Resolution approach TBD",
-        strategy: "fix-code",
+        strategy: this.inferStrategy([incident]),
         priority: "medium"
       },
       source: "suggested",
@@ -1917,6 +2704,7 @@ var PatternSuggester = class {
   suggestFromGroup(group) {
     const baseId = `group-${group.id.toLowerCase().replace(/[^a-z0-9]/g, "-")}`;
     const symbols = this.buildSymbolCriteria(group.commonSymbols);
+    const groupIncidents = group.incidents.slice(0, 20).map((id) => this.storage.getIncident(id)).filter((i) => i != null);
     const pattern = {
       id: baseId,
       name: group.name || `Pattern from group ${group.id}`,
@@ -1927,7 +2715,7 @@ var PatternSuggester = class {
       },
       resolution: {
         description: "Resolution approach TBD based on grouped incidents",
-        strategy: "fix-code",
+        strategy: groupIncidents.length > 0 ? this.inferStrategy(groupIncidents) : "fix-code",
         priority: this.getPriorityFromCount(group.count)
       },
       source: "suggested",
@@ -2226,21 +3014,38 @@ var PatternSuggester = class {
     return false;
   }
   /**
-   * Infer resolution strategy from incidents
+   * Infer resolution strategy from incident error patterns and context.
+   * Uses keyword heuristics across all incident messages to pick the
+   * most likely resolution approach.
    */
   inferStrategy(incidents) {
     const messages = incidents.map((i) => i.error.message.toLowerCase());
-    if (messages.some((m) => m.includes("timeout") || m.includes("network"))) {
+    const hasKeyword = (keywords) => messages.some((m) => keywords.some((k) => m.includes(k)));
+    if (hasKeyword(["revert", "rollback", "regression", "broke after deploy", "since deploy"])) {
+      return "rollback";
+    }
+    if (hasKeyword(["config", "environment variable", "env var", "missing key", "secret", "credential"])) {
+      return "config-change";
+    }
+    if (hasKeyword(["out of memory", "oom", "heap", "memory limit", "capacity", "too many connections", "pool exhausted"])) {
+      return "scale-up";
+    }
+    if (hasKeyword(["timeout", "network", "econnrefused", "econnreset", "dns", "socket hang up"])) {
       return "retry";
     }
-    if (messages.some(
-      (m) => m.includes("validation") || m.includes("invalid") || m.includes("required")
-    )) {
+    if (hasKeyword(["unavailable", "service down", "circuit breaker", "fallback", "503", "502"])) {
+      return "fallback";
+    }
+    if (hasKeyword(["validation", "invalid", "required", "constraint", "duplicate", "not found", "404"])) {
       return "fix-data";
     }
-    if (messages.some((m) => m.includes("permission") || m.includes("403"))) {
+    if (hasKeyword(["permission", "forbidden", "403", "401", "unauthorized", "access denied"])) {
       return "escalate";
     }
+    const uniqueTypes = new Set(incidents.map((i) => i.error.type).filter(Boolean));
+    if (uniqueTypes.size > 2) {
+      return "investigate";
+    }
     return "fix-code";
   }
   /**
@@ -2497,6 +3302,101 @@ function getToolsList() {
           minOccurrences: { type: "number", description: "Min similar incidents for suggestion" }
         }
       }
+    },
+    // ─── Observability Tools ──────────────────────────────────────
+    {
+      name: "sentinel_logs",
+      description: "Query structured logs from connected apps. Filters by level, symbol, service, search text, time range.",
+      annotations: { readOnlyHint: true, destructiveHint: false },
+      inputSchema: {
+        type: "object",
+        properties: {
+          level: { type: "string", enum: ["debug", "info", "warn", "error"], description: "Filter by log level" },
+          symbol: { type: "string", description: "Filter by symbol (partial match)" },
+          service: { type: "string", description: "Filter by service name" },
+          search: { type: "string", description: "Search in log messages" },
+          since: { type: "string", description: "ISO timestamp \u2014 logs after this time" },
+          sessionId: { type: "string", description: "Filter by session ID" },
+          correlationId: { type: "string", description: "Filter by correlation ID" },
+          limit: { type: "number", description: "Max results (default: 50)" }
+        }
+      }
+    },
+    {
+      name: "sentinel_services",
+      description: "List all registered services with version, environment, and last-seen time.",
+      annotations: { readOnlyHint: true, destructiveHint: false },
+      inputSchema: {
+        type: "object",
+        properties: {}
+      }
+    },
+    {
+      name: "sentinel_app_state",
+      description: "Get live app state snapshots. Shows current state, active flows, and held gates for connected services.",
+      annotations: { readOnlyHint: true, destructiveHint: false },
+      inputSchema: {
+        type: "object",
+        properties: {
+          service: { type: "string", description: "Filter by service name" }
+        }
+      }
+    },
+    {
+      name: "sentinel_validate_symbol",
+      description: "Check if a symbol has been used in logs. Returns usage count and suggestions.",
+      annotations: { readOnlyHint: true, destructiveHint: false },
+      inputSchema: {
+        type: "object",
+        properties: {
+          symbol: { type: "string", description: "Symbol to validate (e.g., #checkout, ^auth)" }
+        },
+        required: ["symbol"]
+      }
+    },
+    {
+      name: "sentinel_flow_activity",
+      description: "Get recent flow events \u2014 which flow nodes were hit, in what order, by which service.",
+      annotations: { readOnlyHint: true, destructiveHint: false },
+      inputSchema: {
+        type: "object",
+        properties: {
+          flowId: { type: "string", description: "Filter by flow ID (e.g., $checkout-flow)" },
+          service: { type: "string", description: "Filter by service name" },
+          since: { type: "string", description: "ISO timestamp \u2014 events after this time" }
+        }
+      }
+    },
+    {
+      name: "sentinel_metrics",
+      description: "Query metrics (counters, gauges, histograms) from connected apps. Supports filtering and aggregation.",
+      annotations: { readOnlyHint: true, destructiveHint: false },
+      inputSchema: {
+        type: "object",
+        properties: {
+          name: { type: "string", description: "Metric name filter" },
+          type: { type: "string", enum: ["counter", "gauge", "histogram"], description: "Metric type filter" },
+          service: { type: "string", description: "Service name filter" },
+          since: { type: "string", description: "ISO timestamp \u2014 metrics after this time" },
+          aggregate: { type: "boolean", description: "If true and name is provided, return aggregation instead of raw data" },
+          limit: { type: "number", description: "Max results (default: 50)" }
+        }
+      }
+    },
+    {
+      name: "sentinel_traces",
+      description: "Query distributed traces across services. Shows span trees with timing, status, and service hops.",
+      annotations: { readOnlyHint: true, destructiveHint: false },
+      inputSchema: {
+        type: "object",
+        properties: {
+          traceId: { type: "string", description: "Get a specific trace by ID" },
+          service: { type: "string", description: "Filter by service name" },
+          symbol: { type: "string", description: "Filter by symbol" },
+          since: { type: "string", description: "ISO timestamp \u2014 traces after this time" },
+          limit: { type: "number", description: "Max traces (default: 10, max: 20)" }
+        }
+      }
     }
   ];
 }
@@ -2725,6 +3625,137 @@ async function handleTool(name, args) {
         2
       );
     }
+    // ─── Observability Tools ──────────────────────────────────────
+    case "sentinel_logs": {
+      const { level, symbol, service, search, since, sessionId, correlationId, limit = 50 } = args;
+      const logs = store.queryLogs({
+        level,
+        symbol,
+        service,
+        search,
+        since,
+        sessionId,
+        correlationId,
+        limit
+      });
+      const total = store.getLogCount({ level, symbol, service, since });
+      return JSON.stringify({
+        count: logs.length,
+        total,
+        logs: logs.map((l) => ({
+          timestamp: l.timestamp,
+          level: l.level,
+          symbol: l.symbol,
+          service: l.service,
+          message: l.message,
+          data: l.data,
+          sessionId: l.sessionId,
+          correlationId: l.correlationId,
+          durationMs: l.durationMs
+        }))
+      }, null, 2);
+    }
+    case "sentinel_services": {
+      const services = store.getServices();
+      return JSON.stringify({
+        count: services.length,
+        services: services.map((s) => ({
+          name: s.name,
+          version: s.version,
+          environment: s.environment,
+          lastSeen: s.lastSeenAt,
+          startedAt: s.startedAt,
+          pid: s.pid
+        }))
+      }, null, 2);
+    }
+    case "sentinel_app_state": {
+      const { service: svc } = args;
+      const states = svc ? store.getAppState(svc) : store.getAllAppStates();
+      return JSON.stringify({
+        states: states.map((s) => ({
+          service: s.service,
+          sessionId: s.sessionId,
+          state: s.state,
+          activeFlows: s.activeFlows,
+          activeGates: s.activeGates,
+          timestamp: s.timestamp
+        }))
+      }, null, 2);
+    }
+    case "sentinel_validate_symbol": {
+      const { symbol: sym } = args;
+      const logCount = store.getLogCount({ symbol: sym });
+      return JSON.stringify({
+        symbol: sym,
+        usedInLogs: logCount > 0,
+        logCount,
+        tip: logCount === 0 ? "This symbol has not appeared in any logs. It may be a typo or unused." : `This symbol has been used in ${logCount} log entries.`
+      }, null, 2);
+    }
+    case "sentinel_flow_activity": {
+      const { flowId, service: flowSvc, since: flowSince } = args;
+      const flowLogs = store.queryLogs({ symbol: flowId, service: flowSvc, since: flowSince, limit: 100 });
+      const flowEvents = flowLogs.filter((l) => ["flow", "signal", "gate"].includes(l.symbolType)).map((l) => ({
+        timestamp: l.timestamp,
+        symbol: l.symbol,
+        symbolType: l.symbolType,
+        service: l.service,
+        message: l.message,
+        level: l.level
+      }));
+      return JSON.stringify({ count: flowEvents.length, events: flowEvents }, null, 2);
+    }
+    case "sentinel_metrics": {
+      const { name: metricName, type: metricType, service: metricSvc, since: metricSince, aggregate, limit: metricLimit } = args;
+      if (aggregate && metricName) {
+        const agg = store.aggregateMetric(metricName, { service: metricSvc, since: metricSince });
+        return JSON.stringify(agg, null, 2);
+      }
+      const metrics = store.queryMetrics({
+        name: metricName,
+        type: metricType,
+        service: metricSvc,
+        since: metricSince,
+        limit: Math.min(metricLimit || 50, 100)
+      });
+      return JSON.stringify({
+        count: metrics.length,
+        metrics: metrics.map((m) => ({
+          timestamp: m.timestamp,
+          name: m.name,
+          type: m.type,
+          value: m.value,
+          tags: m.tags,
+          service: m.service
+        }))
+      }, null, 2);
+    }
+    case "sentinel_traces": {
+      const { traceId: tid, service: traceSvc, symbol: traceSym, since: traceSince, limit: traceLimit } = args;
+      if (tid) {
+        const trace = store.getTrace(tid);
+        if (!trace) return JSON.stringify({ error: "Trace not found" });
+        return JSON.stringify(trace, null, 2);
+      }
+      const traces = store.queryTraces({
+        service: traceSvc,
+        symbol: traceSym,
+        since: traceSince,
+        limit: Math.min(traceLimit || 10, 20)
+      });
+      return JSON.stringify({
+        count: traces.length,
+        traces: traces.map((t) => ({
+          traceId: t.traceId,
+          services: t.services,
+          spanCount: t.spans.length,
+          totalDurationMs: t.totalDurationMs,
+          startTime: t.startTime,
+          endTime: t.endTime
+        }))
+      }, null, 2);
+    }
     default:
       return JSON.stringify({ error: `Unknown tool: ${name}` });
   }