@cachly-dev/mcp-server 0.10.69 → 0.10.71

package/README.md

@@ -22,7 +22,7 @@
     <img src="https://img.shields.io/badge/GDPR-EU%20servers-green" alt="GDPR: EU servers" />
   </a>
   &nbsp;
-  <img src="https://img.shields.io/badge/101%20MCP%20tools-violet" alt="101 MCP tools" />
+  <img src="https://img.shields.io/badge/102%20MCP%20tools-violet" alt="102 MCP tools" />
   &nbsp;
   <img src="https://img.shields.io/badge/License-Apache--2.0-yellow" alt="License: Apache-2.0" />
 </p>

package/dist/src/auth.d.ts

@@ -1,3 +1,29 @@
 export declare function jwtExpiryMs(token: string): number | null;
+/** Long-lived API keys cannot expire silently; raw access tokens can. */
+export declare const API_KEY_PREFIX = "cky_";
+export type AuthState = 'healthy' | 'no_jwt' | 'expired' | 'near_expiry' | 'long_lived';
+export interface AuthDiagnosis {
+    state: AuthState;
+    /** Safe to make API calls right now? (healthy, near_expiry and long_lived all are.) */
+    usable: boolean;
+    /** ms until expiry, or null for tokens with no exp claim (long-lived keys). */
+    expiresInMs: number | null;
+    /** Human-facing message with the single fix, when action is needed. */
+    message: string;
+}
+/** A long-lived API key (cky_live_… / cky_…) has no exp and never expires silently. */
+export declare function isLongLivedApiKey(token: string): boolean;
+export declare const NEAR_EXPIRY_MS: number;
+/**
+ * Diagnose the current credential without making any network call. Pure +
+ * deterministic (pass `now` in tests).
+ */
+export declare function diagnoseAuth(jwt: string, now?: number): AuthDiagnosis;
+export type AuthHealAction = 'none' | 'refresh' | 'reauth';
+/**
+ * Decide what self-healing step (if any) to take for a diagnosis. Pure so the
+ * decision is unit-testable independently of the network-bound executor.
+ */
+export declare function planAuthHeal(d: AuthDiagnosis): AuthHealAction;
 export declare function checkJwt(jwt: string): void;
 export declare function handleApiError(status: number, detail: string): never;

package/dist/src/auth.js

@@ -11,18 +11,90 @@ export function jwtExpiryMs(token) {
         return null;
     }
 }
-export function checkJwt(jwt) {
+// ── Self-healing auth ─────────────────────────────────────────────────────────
+// The silent-failure mode we guard against: a token that is missing, expired, or
+// about to expire degrades the brain into "0 recalls" without the user ever being
+// told why. Instead of failing silently (or only at the moment a network call
+// finally 401s), we diagnose the credential up front and either heal it
+// automatically (mint a fresh long-lived key while the current one is still valid)
+// or surface a single, actionable instruction.
+/** Long-lived API keys cannot expire silently; raw access tokens can. */
+export const API_KEY_PREFIX = 'cky_';
+/** A long-lived API key (cky_live_… / cky_…) has no exp and never expires silently. */
+export function isLongLivedApiKey(token) {
+    return token.startsWith(API_KEY_PREFIX);
+}
+// Refresh a token this close to expiry (or already expired) the moment we touch it.
+export const NEAR_EXPIRY_MS = 10 * 60 * 1000; // 10 minutes
+const SETUP_URL = 'https://cachly.dev/setup-ai';
+/**
+ * Diagnose the current credential without making any network call. Pure +
+ * deterministic (pass `now` in tests).
+ */
+export function diagnoseAuth(jwt, now = Date.now()) {
     if (!jwt) {
-        throw new McpError(ErrorCode.InvalidRequest, 'CACHLY_JWT env var not set.\n\nGet your token at https://cachly.dev/setup-ai and add it to your MCP config:\n  CACHLY_JWT=<your-token>');
+        return {
+            state: 'no_jwt',
+            usable: false,
+            expiresInMs: null,
+            message: `No CACHLY_JWT set — the brain can't persist or recall anything (you'd silently get 0 recalls).\n\nGet your token at ${SETUP_URL} and add it to your MCP config, or just call any tool to start the one-time device-flow sign-in.`,
+        };
     }
     const expMs = jwtExpiryMs(jwt);
-    if (expMs !== null && expMs < Date.now()) {
-        throw new McpError(ErrorCode.InvalidRequest, `CACHLY_JWT expired at ${new Date(expMs).toISOString()}.\n\nGet a fresh token at https://cachly.dev/setup-ai and update CACHLY_JWT in your MCP config.`);
+    // No exp claim → long-lived API key. These are the healthy steady state.
+    if (expMs === null) {
+        return {
+            state: isLongLivedApiKey(jwt) ? 'long_lived' : 'healthy',
+            usable: true,
+            expiresInMs: null,
+            message: '',
+        };
+    }
+    const remaining = expMs - now;
+    if (remaining <= 0) {
+        return {
+            state: 'expired',
+            usable: false,
+            expiresInMs: remaining,
+            message: `CACHLY_JWT expired at ${new Date(expMs).toISOString()} — recalls will silently return nothing until you re-authenticate.\n\nGet a fresh token at ${SETUP_URL}, or call any tool to re-run the device-flow sign-in.`,
+        };
+    }
+    if (remaining <= NEAR_EXPIRY_MS) {
+        const mins = Math.max(1, Math.round(remaining / 60_000));
+        return {
+            state: 'near_expiry',
+            usable: true,
+            expiresInMs: remaining,
+            message: `CACHLY_JWT expires in ~${mins} min. cachly will refresh it automatically into a long-lived key while it's still valid.`,
+        };
+    }
+    return { state: 'healthy', usable: true, expiresInMs: remaining, message: '' };
+}
+/**
+ * Decide what self-healing step (if any) to take for a diagnosis. Pure so the
+ * decision is unit-testable independently of the network-bound executor.
+ */
+export function planAuthHeal(d) {
+    switch (d.state) {
+        case 'no_jwt':
+        case 'expired':
+            return 'reauth';
+        case 'near_expiry':
+            return 'refresh';
+        case 'healthy':
+        case 'long_lived':
+            return 'none';
+    }
+}
+export function checkJwt(jwt) {
+    const d = diagnoseAuth(jwt);
+    if (!d.usable) {
+        throw new McpError(ErrorCode.InvalidRequest, d.message);
     }
 }
 export function handleApiError(status, detail) {
     if (status === 401) {
-        throw new McpError(ErrorCode.InvalidRequest, `Authentication failed (401): ${detail}\n\nYour CACHLY_JWT may be expired or invalid. Get a fresh token at https://cachly.dev/setup-ai`);
+        throw new McpError(ErrorCode.InvalidRequest, `Authentication failed (401): ${detail}\n\nYour CACHLY_JWT may be expired or invalid. Get a fresh token at ${SETUP_URL}`);
     }
     if (status === 403) {
         throw new McpError(ErrorCode.InvalidRequest, `Access denied (403): ${detail}\n\nCheck that your CACHLY_JWT belongs to an account with access to this resource.`);

package/dist/src/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACjC,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,cAAc,EACxB,wIAAwI,CACzI,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,cAAc,EACxB,yBAAyB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,iGAAiG,CACxJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc;IAC3D,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,cAAc,EACxB,gCAAgC,MAAM,iGAAiG,CACxI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,cAAc,EACxB,wBAAwB,MAAM,oFAAoF,CACnH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,oBAAoB,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;AACvF,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACjC,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,8EAA8E;AAC9E,wEAAwE;AACxE,mFAAmF;AACnF,+CAA+C;AAE/C,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAcrC,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAC1C,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAE3D,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,uHAAuH,SAAS,kGAAkG;SAC5O,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE/B,yEAAyE;IACzE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;YACxD,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,GAAG,GAAG,CAAC;IAC9B,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,yBAAyB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,8FAA8F,SAAS,uDAAuD;SAC9N,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC;QACzD,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,0BAA0B,IAAI,0FAA0F;SAClI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACjF,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAgB;IAC3C,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS,CAAC;QACf,KAAK,YAAY;YACf,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc;IAC3D,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,cAAc,EACxB,gCAAgC,MAAM,uEAAuE,SAAS,EAAE,CACzH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,cAAc,EACxB,wBAAwB,MAAM,oFAAoF,CACnH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,oBAAoB,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;AACvF,CAAC"}

package/dist/src/ckg.d.ts

@@ -31,6 +31,15 @@ export type FileNode = {
     count: number;
     ts: string;
 };
+export type ServiceNode = {
+    id: string;
+    name: string;
+    kind: 'service' | 'system';
+    domain: string;
+    type: 'service';
+    count: number;
+    last_active: string;
+};
 export declare function ckgSlug(text: string): string;
 /** Extract 1-3 significant keywords from free text for a problem concept */
 export declare function extractProblemConcept(text: string): string | null;
@@ -39,5 +48,7 @@ export declare function ckgUpsertNode(redis: Redis, id: string, domain: string,
 export declare function ckgUpsertPersonNode(redis: Redis, handle: string, domain: string): Promise<string>;
 /** Upsert a File node; returns the node id ("file:{slug}"). */
 export declare function ckgUpsertFileNode(redis: Redis, filePath: string): Promise<string>;
+/** Upsert a Service/System node; returns the node id ("service:{slug}"). */
+export declare function ckgUpsertServiceNode(redis: Redis, name: string, domain: string, kind?: 'service' | 'system'): Promise<string>;
 export declare function ckgUpdateEdge(redis: Redis, from: string, edgeType: string, to: string, success: boolean, partial?: boolean): Promise<void>;
 export declare function ckgRecordCollaboration(redis: Redis, fileId: string, personId: string): Promise<void>;

package/dist/src/ckg.js

@@ -49,6 +49,25 @@ export async function ckgUpsertFileNode(redis, filePath) {
     await redis.set(key, JSON.stringify(node));
     return id;
 }
+/** Upsert a Service/System node; returns the node id ("service:{slug}"). */
+export async function ckgUpsertServiceNode(redis, name, domain, kind = 'service') {
+    const id = `service:${ckgSlug(name)}`;
+    const key = `cachly:ckg:node:${id}`;
+    const raw = await redis.get(key);
+    const node = raw
+        ? JSON.parse(raw)
+        : { id, name, kind, domain, type: 'service', count: 0, last_active: new Date().toISOString() };
+    node.count = (node.count || 0) + 1;
+    node.last_active = new Date().toISOString();
+    if (!node.domain)
+        node.domain = domain;
+    // A node may start life as a 'service' and later be classified as 'system' (or vice
+    // versa) by an explicit caller — honour the latest non-default classification.
+    if (kind === 'system')
+        node.kind = 'system';
+    await redis.set(key, JSON.stringify(node));
+    return id;
+}
 export async function ckgUpdateEdge(redis, from, edgeType, to, success, partial = false) {
     const key = `cachly:ckg:edge:${from}:${edgeType}:${to}`;
     const raw = await redis.get(key);

package/dist/src/ckg.js.map

@@ -1 +1 @@
-{"version":3,"file":"ckg.js","sourceRoot":"","sources":["../../src/ckg.ts"],"names":[],"mappings":"AAiCA,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,EAAC,OAAO,CAAC,CAAC,CAAC;AAEvQ,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE;SAC7B,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAClD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACf,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAY,EAAE,EAAU,EAAE,MAAc,EAAE,IAAY;IACxF,MAAM,GAAG,GAAG,mBAAmB,EAAE,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC3G,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAY,EAAE,MAAc,EAAE,MAAc;IACpF,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,mBAAmB,EAAE,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAe,GAAG;QAC1B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC5F,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAY,EAAE,QAAgB;IACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC7C,MAAM,EAAE,GAAG,QAAQ,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,mBAAmB,EAAE,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAa,GAAG;QACxB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9F,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAY,EAAE,IAAY,EAAE,QAAgB,EAAE,EAAU,EAAE,OAAgB,EAAE,OAAO,GAAG,KAAK;IAC7H,MAAM,GAAG,GAAG,mBAAmB,IAAI,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC/H,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;SACnD,IAAI,OAAO;QAAE,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;IAC/D,oEAAoE;IACpE,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,+DAA+D;IAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,uBAAuB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAY,EAAE,MAAc,EAAE,QAAgB;IACzF,MAAM,WAAW,GAAG,4BAA4B,MAAM,EAAE,CAAC;IACzD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5D,IAAI,KAAK,KAAK,QAAQ;YAAE,SAAS;QACjC,uDAAuD;QACvD,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"ckg.js","sourceRoot":"","sources":["../../src/ckg.ts"],"names":[],"mappings":"AA+CA,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,EAAC,OAAO,CAAC,CAAC,CAAC;AAEvQ,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE;SAC7B,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAClD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACf,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAY,EAAE,EAAU,EAAE,MAAc,EAAE,IAAY;IACxF,MAAM,GAAG,GAAG,mBAAmB,EAAE,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC3G,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAY,EAAE,MAAc,EAAE,MAAc;IACpF,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,mBAAmB,EAAE,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAe,GAAG;QAC1B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC5F,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAY,EAAE,QAAgB;IACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC7C,MAAM,EAAE,GAAG,QAAQ,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,mBAAmB,EAAE,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAa,GAAG;QACxB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9F,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAY,EAAE,IAAY,EAAE,MAAc,EAAE,OAA6B,SAAS;IAC3H,MAAM,EAAE,GAAG,WAAW,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,mBAAmB,EAAE,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAgB,GAAG;QAC3B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvC,oFAAoF;IACpF,+EAA+E;IAC/E,IAAI,IAAI,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;IAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAY,EAAE,IAAY,EAAE,QAAgB,EAAE,EAAU,EAAE,OAAgB,EAAE,OAAO,GAAG,KAAK;IAC7H,MAAM,GAAG,GAAG,mBAAmB,IAAI,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC/H,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;SACnD,IAAI,OAAO;QAAE,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;IAC/D,oEAAoE;IACpE,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,+DAA+D;IAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,uBAAuB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAY,EAAE,MAAc,EAAE,QAAgB;IACzF,MAAM,WAAW,GAAG,4BAA4B,MAAM,EAAE,CAAC;IACzD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5D,IAAI,KAAK,KAAK,QAAQ;YAAE,SAAS;QACjC,uDAAuD;QACvD,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC"}

package/dist/src/handlers/brain.js

@@ -1,13 +1,26 @@
 import { execSync } from 'node:child_process';
 import { calculateConfidence, confidenceBadge, STRUCTURED_TEMPLATES, CONFIDENCE_WARN_VALUE, CONFIDENCE_STALE_VALUE, CONFIDENCE_WARN_DAYS } from '../confidence.js';
-import { ckgSlug, extractProblemConcept, ckgUpsertNode, ckgUpdateEdge, ckgUpsertPersonNode, ckgUpsertFileNode, ckgRecordCollaboration } from '../ckg.js';
+import { ckgSlug, extractProblemConcept, ckgUpsertNode, ckgUpdateEdge, ckgUpsertPersonNode, ckgUpsertFileNode, ckgRecordCollaboration, ckgUpsertServiceNode } from '../ckg.js';
 import { safeJsonParse, scanKeys } from '../utils.js';
 import { keywordSearch, tokenize, splitMultiQuery, levenshtein, indexVocab as _indexVocab } from '../search.js';
 import { rerankByQuality } from '../rerank.js';
 import { computeEmbedding, hasEmbedProvider } from '../embeddings.js';
 // ── Changelog (shown once per version in session_start) ──────────────────────
-const MCP_VERSION = '0.10.69';
+const MCP_VERSION = '0.10.71';
 const WHATS_NEW = {
+    '0.10.71': [
+        `🛡️ **Self-healing auth** — no more silent "0 recalls because the token quietly died"`,
+        `  ♻️ Near-expiry tokens auto-refresh into a long-lived key while still valid (zero interaction)`,
+        `  🔁 A rejected (401) call self-heals once and retries before surfacing an error`,
+        `  📣 If the credential is truly dead, session_start + get_api_status say so plainly + how to fix`,
+    ],
+    '0.10.70': [
+        `🛰️ **Service/System nodes in the graph (Phase 3)** — the brain now models running systems`,
+        `  🆕 \`brain_service_map(service="prometheus")\` — who owns it + every failure/fix known`,
+        `  🏷️ Tag lessons with \`service="..."\` (\`service_kind="system"\` for infra) — person→operates, file→runs_in edges`,
+        `  🚨 Incident triage: a restarting pod → instant "who knows this and what's broken before"`,
+        `  📊 102 MCP tools`,
+    ],
     '0.10.69': [
         `📁 **Personalized context-aware recall (Phase 3)** — pass \`context_files\` to \`smart_recall\``,
         `  🎯 Lessons learned on your current files bubble up — even when the query doesn't name the file`,
@@ -87,12 +100,12 @@ export const BRAIN_TOOL_NAMES = new Set([
     'learn_from_attempts', 'recall_best_solution', 'smart_recall',
     'session_start', 'session_end', 'session_ping', 'session_handoff', 'auto_learn_session',
     'brain_who_knows', 'brain_file_map', 'team_expertise_map',
-    'skill_gaps', 'brain_coverage', 'brain_metrics',
+    'skill_gaps', 'brain_coverage', 'brain_metrics', 'brain_service_map',
 ]);
 export async function handleBrainTool(name, args, getConnection, apiFetch) {
     switch (name) {
         case 'learn_from_attempts': {
-            const { instance_id, topic, outcome, what_worked, what_failed = '', context: ctx = '', severity = 'major', file_paths = [], commands = [], tags = [], depends_on = [], author = '', visibility = 'team', } = args;
+            const { instance_id, topic, outcome, what_worked, what_failed = '', context: ctx = '', severity = 'major', file_paths = [], commands = [], tags = [], depends_on = [], author = '', visibility = 'team', service = '', service_kind = 'service', } = args;
             const redis = await getConnection(instance_id);
             const ts = new Date().toISOString();
             // ── Structured template hints ──────────────────────────────────────────
@@ -210,6 +223,7 @@ export async function handleBrainTool(name, args, getConnection, apiFetch) {
                 tags,
                 depends_on,
                 ...(author ? { author } : {}),
+                ...(service ? { service } : {}),
                 visibility,
                 recall_count: recallCount,
                 ts,
@@ -378,6 +392,30 @@ export async function handleBrainTool(name, args, getConnection, apiFetch) {
                 }
                 catch { /* non-critical */ }
             }
+            // ── Phase 3: Service/System nodes ─────────────────────────────────────────
+            // When a lesson names the service/system it concerns (e.g. "prometheus",
+            // "cachly-web"), wire it into the graph: person→operates→service,
+            // concept→affects→service, file→runs_in→service. This is what lets
+            // brain_service_map answer "who owns X and what's gone wrong with X before".
+            if (service && typeof service === 'string' && service.trim()) {
+                try {
+                    const domain = topic.split(':')[0] ?? 'unknown';
+                    const kind = service_kind === 'system' ? 'system' : 'service';
+                    const serviceId = await ckgUpsertServiceNode(redis, service.trim(), domain, kind);
+                    const conceptId = ckgSlug(topic);
+                    // concept → affects → service (outcome decides edge confidence)
+                    await ckgUpdateEdge(redis, conceptId, 'affects', serviceId, outcome === 'success', outcome === 'partial');
+                    if (author) {
+                        const personId = `person:${ckgSlug(author)}`;
+                        await ckgUpdateEdge(redis, personId, 'operates', serviceId, true);
+                    }
+                    for (const fp of file_paths.slice(0, 8)) {
+                        const fileId = `file:${ckgSlug(fp)}`;
+                        await ckgUpdateEdge(redis, fileId, 'runs_in', serviceId, true);
+                    }
+                }
+                catch { /* non-critical */ }
+            }
             // ── Ambient team propagation: if author is set + outcome is success,
             // auto-store as a team lesson so knowledge is shared without a separate
             // team_learn call. Tags gain 'team'; the lesson is attributed to the author.
@@ -2417,6 +2455,120 @@ export async function handleBrainTool(name, args, getConnection, apiFetch) {
             ].filter(Boolean);
             return lines.join('\n');
         }
+        // ── brain_service_map ───────────────────────────────────────────────────────
+        // Phase 3: "Who owns this service, and what's gone wrong with it before?"
+        // Bridges a running system (e.g. a restarting prometheus pod) to the people who
+        // operate it, the files that run in it, and the lessons learned operating it.
+        case 'brain_service_map': {
+            const { instance_id, service, } = args;
+            if (!service || typeof service !== 'string' || !service.trim()) {
+                return '⚠️ `brain_service_map` requires a non-empty `service`. Example: `brain_service_map(service="prometheus")`.';
+            }
+            const redis = await getConnection(instance_id);
+            const serviceId = `service:${ckgSlug(service.trim())}`;
+            const nodeRaw = await redis.get(`cachly:ckg:node:${serviceId}`).catch(() => null);
+            const node = nodeRaw ? safeJsonParse(nodeRaw, null) : null;
+            // Inbound edges: person→operates, concept→affects, file→runs_in
+            const inbound = await redis.smembers(`cachly:ckg:idx:to:${serviceId}`).catch(() => []);
+            const operators = [];
+            const files = [];
+            const concepts = [];
+            for (const ek of inbound) {
+                const er = await redis.get(ek).catch(() => null);
+                if (!er)
+                    continue;
+                const edge = safeJsonParse(er, null);
+                if (!edge)
+                    continue;
+                if (edge.edgeType === 'operates') {
+                    const pr = await redis.get(`cachly:ckg:node:${edge.from}`).catch(() => null);
+                    const pn = pr ? safeJsonParse(pr, null) : null;
+                    if (pn?.handle)
+                        operators.push({ handle: pn.handle, trials: edge.trials });
+                }
+                else if (edge.edgeType === 'runs_in') {
+                    const fr = await redis.get(`cachly:ckg:node:${edge.from}`).catch(() => null);
+                    const fn = fr ? safeJsonParse(fr, null) : null;
+                    if (fn?.path)
+                        files.push({ path: fn.path, trials: edge.trials });
+                }
+                else if (edge.edgeType === 'affects') {
+                    concepts.push({ id: edge.from, confidence: edge.confidence });
+                }
+            }
+            operators.sort((a, b) => b.trials - a.trials);
+            files.sort((a, b) => b.trials - a.trials);
+            concepts.sort((a, b) => b.confidence - a.confidence);
+            const lessons = [];
+            const lessonKeys = await scanKeys(redis, 'cachly:lesson:best:*', { max: 1500 });
+            const svcLower = service.trim().toLowerCase();
+            for (const k of lessonKeys.slice(0, 400)) {
+                const raw = await redis.get(k).catch(() => null);
+                if (!raw)
+                    continue;
+                const ld = safeJsonParse(raw, {});
+                if (ld.visibility === 'private')
+                    continue;
+                if ((ld.service ?? '').toLowerCase() !== svcLower)
+                    continue;
+                lessons.push({ ...ld, topic: k.replace('cachly:lesson:best:', '') });
+            }
+            if (!node && lessons.length === 0 && operators.length === 0) {
+                return [
+                    `## 🛰️ Service Map — \`${service}\``,
+                    ``,
+                    `Nothing known about this service yet.`,
+                    ``,
+                    `Tag lessons with the service they concern so the brain can build this map:`,
+                    `\`learn_from_attempts(topic="...", service="${service}", author="you", file_paths=[...])\``,
+                ].join('\n');
+            }
+            const kindLabel = node?.kind === 'system' ? '🖥️ system' : '🛰️ service';
+            const lines = [
+                `## ${node?.kind === 'system' ? '🖥️' : '🛰️'} Service Map — \`${service}\``,
+                ``,
+                node ? `_${kindLabel} · ${node.count} lesson${node.count !== 1 ? 's' : ''} referenced · domain: ${node.domain}_` : `_No graph node yet — built from tagged lessons below._`,
+                ``,
+            ];
+            // Operators (who owns it)
+            if (operators.length > 0) {
+                const owners = operators.slice(0, 5).map((o, i) => {
+                    const medal = i === 0 ? '🥇' : i === 1 ? '🥈' : i === 2 ? '🥉' : `${i + 1}.`;
+                    return `${medal} **${o.handle}** (${o.trials}×)`;
+                }).join(' · ');
+                lines.push(`**Operators:** ${owners}`, ``);
+            }
+            else {
+                lines.push(`**Operators:** _None attributed — add \`author\` when learning about this service_`, ``);
+            }
+            // Recent failures first — the triage gold for an incident
+            const failures = lessons.filter(l => l.outcome === 'failure');
+            const successes = lessons.filter(l => l.outcome !== 'failure');
+            if (failures.length > 0) {
+                lines.push(`**⚠️ Known failures (${failures.length}):**`);
+                for (const l of failures.slice(0, 6)) {
+                    const sev = l.severity === 'critical' ? ' 🔴' : l.severity === 'major' ? ' 🟡' : '';
+                    const by = l.author ? ` · 👤 ${l.author}` : '';
+                    lines.push(`  - ❌ \`${l.topic}\`${sev}${by} — ${(l.what_worked ?? '').slice(0, 100)}`);
+                }
+                lines.push(``);
+            }
+            if (successes.length > 0) {
+                lines.push(`**✅ Proven fixes (${successes.length}):**`);
+                for (const l of successes.slice(0, 6)) {
+                    const emoji = l.outcome === 'partial' ? '⚠️' : '✅';
+                    const by = l.author ? ` · 👤 ${l.author}` : '';
+                    lines.push(`  - ${emoji} \`${l.topic}\`${by} — ${(l.what_worked ?? '').slice(0, 100)}`);
+                }
+                lines.push(``);
+            }
+            // Files that run in this service
+            if (files.length > 0) {
+                lines.push(`**Files in this service:** ${files.slice(0, 8).map(f => `\`${f.path}\``).join(', ')}`, ``);
+            }
+            lines.push(`---`, `_Tag lessons with \`service="${service}"\` to keep this map current. For infra, pass \`service_kind="system"\`._`);
+            return lines.join('\n');
+        }
         // ── sync_file_changes ─────────────────────────────────────────────────────
         default:
             return null;