@debugbundle/mcp 1.11.0 → 1.12.1

package/README.md

@@ -42,7 +42,7 @@ Use `npx -y @debugbundle/mcp` in clients that require noninteractive package exe
 | Claude Desktop local MCP      | local MCP server config                           | uses local machine auth/config                    |
 | Claude Code plugin            | `/plugin marketplace add debugbundle/debugbundle` | installs bundled MCP config and DebugBundle skill |
 | Codex developer plugin | `codex plugin add debugbundle-codex@debugbundle` | repository marketplace; local MCP and workflow skill |
-| Codex direct MCP | `codex mcp add debugbundle -- npx -y @debugbundle/mcp@1.11.0 --local-auth` | app, CLI, and IDE on the same host |
+| Codex direct MCP | `codex mcp add debugbundle -- npx -y @debugbundle/mcp@1.12.1 --local-auth` | app, CLI, and IDE on the same host |
 | Cursor                        | MCP config with `npx @debugbundle/mcp`            | stdio transport                                   |
 | VS Code / GitHub MCP Registry | `com.debugbundle/mcp`                             | official registry metadata                        |
 | OpenClaw / ClawHub            | DebugBundle skill plus MCP config                 | use the published skill for workflow guidance     |

package/dist/main.cjs

@@ -10041,7 +10041,7 @@ var require_agent = __commonJS({
     function defaultFactory(origin, opts) {
       return opts && opts.connections === 1 ? new Client(origin, opts) : new Pool(origin, opts);
     }
-    var Agent2 = class extends DispatcherBase {
+    var Agent3 = class extends DispatcherBase {
       constructor({ factory = defaultFactory, maxOrigins = Infinity, connect, ...options } = {}) {
         if (typeof factory !== "function") {
           throw new InvalidArgumentError("factory must be a function.");
@@ -10155,7 +10155,7 @@ var require_agent = __commonJS({
         return allClientStats;
       }
     };
-    module2.exports = Agent2;
+    module2.exports = Agent3;
   }
 });
 
@@ -10946,7 +10946,7 @@ var require_proxy_agent = __commonJS({
   "../../node_modules/.pnpm/undici@8.5.0/node_modules/undici/lib/dispatcher/proxy-agent.js"(exports2, module2) {
     "use strict";
     var { kProxy, kClose, kDestroy, kDispatch } = require_symbols();
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var Pool = require_pool();
     var DispatcherBase = require_dispatcher_base();
     var { InvalidArgumentError, RequestAbortedError, SecureProxyConnectionError } = require_errors();
@@ -11082,7 +11082,7 @@ var require_proxy_agent = __commonJS({
         } else {
           this[kClient] = clientFactory(url, { connect });
         }
-        this[kAgent] = new Agent2({
+        this[kAgent] = new Agent3({
           ...opts,
           factory,
           connect: async (opts2, callback) => {
@@ -11221,7 +11221,7 @@ var require_env_http_proxy_agent = __commonJS({
     var DispatcherBase = require_dispatcher_base();
     var { kClose, kDestroy, kClosed, kDestroyed, kDispatch, kNoProxyAgent, kHttpProxyAgent, kHttpsProxyAgent } = require_symbols();
     var ProxyAgent = require_proxy_agent();
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var DEFAULT_PORTS = {
       "http:": 80,
       "https:": 443
@@ -11234,7 +11234,7 @@ var require_env_http_proxy_agent = __commonJS({
         super();
         this.#opts = opts;
         const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts;
-        this[kNoProxyAgent] = new Agent2(agentOpts);
+        this[kNoProxyAgent] = new Agent3(agentOpts);
         const HTTP_PROXY = httpProxy ?? process.env.http_proxy ?? process.env.HTTP_PROXY;
         if (HTTP_PROXY) {
           this[kHttpProxyAgent] = new ProxyAgent({ ...agentOpts, uri: HTTP_PROXY });
@@ -13993,7 +13993,7 @@ var require_mock_agent = __commonJS({
   "../../node_modules/.pnpm/undici@8.5.0/node_modules/undici/lib/mock/mock-agent.js"(exports2, module2) {
     "use strict";
     var { kClients } = require_symbols();
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var {
       kAgent,
       kMockAgentSet,
@@ -14031,7 +14031,7 @@ var require_mock_agent = __commonJS({
         if (opts?.agent && typeof opts.agent.dispatch !== "function") {
           throw new InvalidArgumentError("Argument opts.agent must implement Agent");
         }
-        const agent = opts?.agent ? opts.agent : new Agent2(opts);
+        const agent = opts?.agent ? opts.agent : new Agent3(opts);
         this[kAgent] = agent;
         this[kClients] = agent[kClients];
         this[kOptions] = mockOptions;
@@ -14653,7 +14653,7 @@ var require_snapshot_recorder = __commonJS({
 var require_snapshot_agent = __commonJS({
   "../../node_modules/.pnpm/undici@8.5.0/node_modules/undici/lib/mock/snapshot-agent.js"(exports2, module2) {
     "use strict";
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var MockAgent = require_mock_agent();
     var { SnapshotRecorder } = require_snapshot_recorder();
     var { InvalidArgumentError, UndiciError } = require_errors();
@@ -14706,7 +14706,7 @@ var require_snapshot_agent = __commonJS({
         });
         this[kSnapshotLoaded] = false;
         if (this[kSnapshotMode] === "record" || this[kSnapshotMode] === "update" || this[kSnapshotMode] === "playback" && opts.excludeUrls && opts.excludeUrls.length > 0) {
-          this[kRealAgent] = new Agent2(opts);
+          this[kRealAgent] = new Agent3(opts);
         }
         if ((this[kSnapshotMode] === "playback" || this[kSnapshotMode] === "update") && this[kSnapshotPath]) {
           this.loadSnapshots().catch(() => {
@@ -14955,10 +14955,10 @@ var require_global2 = __commonJS({
     var globalDispatcher = /* @__PURE__ */ Symbol.for("undici.globalDispatcher.2");
     var legacyGlobalDispatcher = /* @__PURE__ */ Symbol.for("undici.globalDispatcher.1");
     var { InvalidArgumentError } = require_errors();
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var Dispatcher1Wrapper = require_dispatcher1_wrapper();
     if (getGlobalDispatcher() === void 0) {
-      setGlobalDispatcher(new Agent2());
+      setGlobalDispatcher(new Agent3());
     }
     function setGlobalDispatcher(agent) {
       if (!agent || typeof agent.dispatch !== "function") {
@@ -15431,8 +15431,8 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "../../node_modules/.pnpm/undici@8.5.0/node_modules/undici/lib/interceptor/dns.js"(exports2, module2) {
     "use strict";
-    var { isIP: isIP2 } = require("node:net");
-    var { lookup } = require("node:dns");
+    var { isIP: isIP3 } = require("node:net");
+    var { lookup: lookup2 } = require("node:dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError, InformationalError } = require_errors();
     var maxInt = Math.pow(2, 31) - 1;
@@ -15622,7 +15622,7 @@ var require_dns = __commonJS({
         }
       }
       #defaultLookup(origin, opts, cb) {
-        lookup(
+        lookup2(
           origin.hostname,
           {
             all: true,
@@ -15840,7 +15840,7 @@ var require_dns = __commonJS({
             return dispatch(origDispatchOpts, handler7);
           }
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP2(origin.hostname) !== 0) {
+          if (isIP3(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler7);
           }
           instance.runLookup(origin, origDispatchOpts, (err, newOrigin) => {
@@ -25618,7 +25618,7 @@ var require_undici = __commonJS({
     var Pool = require_pool();
     var BalancedPool = require_balanced_pool();
     var RoundRobinPool = require_round_robin_pool();
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var Dispatcher1Wrapper = require_dispatcher1_wrapper();
     var ProxyAgent = require_proxy_agent();
     var Socks5ProxyAgent = require_socks5_proxy_agent();
@@ -25646,7 +25646,7 @@ var require_undici = __commonJS({
     module2.exports.Pool = Pool;
     module2.exports.BalancedPool = BalancedPool;
     module2.exports.RoundRobinPool = RoundRobinPool;
-    module2.exports.Agent = Agent2;
+    module2.exports.Agent = Agent3;
     module2.exports.Dispatcher1Wrapper = Dispatcher1Wrapper;
     module2.exports.ProxyAgent = ProxyAgent;
     module2.exports.Socks5ProxyAgent = Socks5ProxyAgent;
@@ -29507,7 +29507,7 @@ var require_fast_uri = __commonJS({
         query: void 0,
         fragment: void 0
       };
-      let isIP2 = false;
+      let isIP3 = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -29532,9 +29532,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed.host);
             parsed.host = ipv6result.host.toLowerCase();
-            isIP2 = ipv6result.isIPV6;
+            isIP3 = ipv6result.isIPV6;
           } else {
-            isIP2 = true;
+            isIP3 = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -29551,7 +29551,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
+          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP3 === false && nonSimpleDomain(parsed.host)) {
             try {
               parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
             } catch (e) {
@@ -42498,7 +42498,7 @@ var require_mime_types = __commonJS({
     exports2.contentType = contentType;
     exports2.extension = extension;
     exports2.extensions = /* @__PURE__ */ Object.create(null);
-    exports2.lookup = lookup;
+    exports2.lookup = lookup2;
     exports2.types = /* @__PURE__ */ Object.create(null);
     populateMaps(exports2.extensions, exports2.types);
     function charset(type) {
@@ -42540,7 +42540,7 @@ var require_mime_types = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path) {
+    function lookup2(path) {
       if (!path || typeof path !== "string") {
         return false;
       }
@@ -52293,7 +52293,7 @@ var require_mime_types2 = __commonJS({
     exports2.contentType = contentType;
     exports2.extension = extension;
     exports2.extensions = /* @__PURE__ */ Object.create(null);
-    exports2.lookup = lookup;
+    exports2.lookup = lookup2;
     exports2.types = /* @__PURE__ */ Object.create(null);
     exports2._extensionConflicts = [];
     populateMaps(exports2.extensions, exports2.types);
@@ -52336,7 +52336,7 @@ var require_mime_types2 = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path) {
+    function lookup2(path) {
       if (!path || typeof path !== "string") {
         return false;
       }
@@ -59524,7 +59524,7 @@ var require_redis_errors = __commonJS({
 // ../../node_modules/.pnpm/cluster-key-slot@1.1.2/node_modules/cluster-key-slot/lib/index.js
 var require_lib2 = __commonJS({
   "../../node_modules/.pnpm/cluster-key-slot@1.1.2/node_modules/cluster-key-slot/lib/index.js"(exports2, module2) {
-    var lookup = [
+    var lookup2 = [
       0,
       4129,
       8258,
@@ -59824,11 +59824,11 @@ var require_lib2 = __commonJS({
             start = i;
           }
         } else if (char !== 125) {
-          resultHash = lookup[(char ^ resultHash >> 8) & 255] ^ resultHash << 8;
+          resultHash = lookup2[(char ^ resultHash >> 8) & 255] ^ resultHash << 8;
         } else if (i - 1 !== start) {
           return resultHash & 16383;
         }
-        result = lookup[(char ^ result >> 8) & 255] ^ result << 8;
+        result = lookup2[(char ^ result >> 8) & 255] ^ result << 8;
       }
       return result & 16383;
     };
@@ -70211,16 +70211,43 @@ var AlertSchema = external_exports.object({
   severity_lifecycle_scope: AlertSeverityLifecycleScopeSchema.nullable().optional().default(null),
   cooldown_seconds: external_exports.number().int().min(0),
   config: external_exports.record(external_exports.string(), external_exports.unknown()),
+  signing_secret: external_exports.string().optional(),
   is_enabled: external_exports.boolean(),
   created_at: external_exports.string(),
   updated_at: external_exports.string()
 }).strict();
 var AlertListResponseSchema = external_exports.object({
-  alerts: external_exports.array(AlertSchema)
+  alerts: external_exports.array(AlertSchema.omit({ signing_secret: true }).strict())
 }).strict();
 var AlertResponseSchema = external_exports.object({
   alert: AlertSchema
 }).strict();
+var AlertGroupSummarySchema = external_exports.object({
+  group_id: external_exports.string().uuid(),
+  kind: external_exports.enum(["direct", "email_digest"]),
+  project_id: external_exports.string().uuid(),
+  alert_id: external_exports.string().uuid().nullable(),
+  root_incident_id: external_exports.string().uuid().nullable(),
+  channel: AlertChannelSchema,
+  status: external_exports.enum(["pending", "delivered", "failed"]),
+  member_count: external_exports.number().int().min(0),
+  created_at: external_exports.string(),
+  delivered_at: external_exports.string().nullable()
+}).strict();
+var AlertGroupMemberSchema = external_exports.object({
+  incident_id: external_exports.string().uuid(),
+  condition_type: external_exports.string(),
+  created_at: external_exports.string()
+}).strict();
+var AlertGroupListResponseSchema = external_exports.object({
+  groups: external_exports.array(AlertGroupSummarySchema),
+  next_cursor: external_exports.string().nullable()
+}).strict();
+var AlertGroupResponseSchema = external_exports.object({
+  group: AlertGroupSummarySchema,
+  members: external_exports.array(AlertGroupMemberSchema),
+  next_cursor: external_exports.string().nullable()
+}).strict();
 var ApiErrorResponseSchema = external_exports.object({
   error: external_exports.string()
 }).strict();
@@ -70283,6 +70310,28 @@ function createAlertApi(client) {
         })
       );
     },
+    async listAlertGroups(input2) {
+      const response = await client.request({
+        method: "GET",
+        path: `/v1/alert-groups${buildQuery({ project_id: input2.projectId, limit: input2.limit, cursor: input2.cursor })}`,
+        bearerToken: input2.bearerToken
+      });
+      if (response.status < 200 || response.status >= 300) parseApiError(response.status, response.body);
+      const parsed = AlertGroupListResponseSchema.safeParse(response.body);
+      if (!parsed.success) throw new AlertApiError(response.status, "invalid_response_shape");
+      return parsed.data;
+    },
+    async getAlertGroup(input2) {
+      const response = await client.request({
+        method: "GET",
+        path: `/v1/alert-groups/${input2.kind}/${encodeURIComponent(input2.groupId)}${buildQuery({ project_id: input2.projectId, limit: input2.limit, cursor: input2.cursor })}`,
+        bearerToken: input2.bearerToken
+      });
+      if (response.status < 200 || response.status >= 300) parseApiError(response.status, response.body);
+      const parsed = AlertGroupResponseSchema.safeParse(response.body);
+      if (!parsed.success) throw new AlertApiError(response.status, "invalid_response_shape");
+      return parsed.data;
+    },
     async createAlert(input2) {
       const body = {
         project_id: input2.projectId,
@@ -70290,6 +70339,9 @@ function createAlertApi(client) {
         condition_type: input2.conditionType,
         config: input2.config
       };
+      if (input2.channel === "webhook") {
+        body.signing = "hmac_sha256_v1";
+      }
       if (input2.serviceId !== void 0) {
         body.service_id = input2.serviceId;
       }
@@ -70337,6 +70389,9 @@ function createAlertApi(client) {
       if (input2.config !== void 0) {
         body.config = input2.config;
       }
+      if (input2.rotateSigningSecret === true) {
+        body.rotate_signing_secret = true;
+      }
       if (input2.isEnabled !== void 0) {
         body.is_enabled = input2.isEnabled;
       }
@@ -75332,6 +75387,7 @@ function buildCliReference() {
     "## Notifications",
     "",
     "- `debugbundle alert list --project-id <id> [--limit <n>] [--auth-file <path>] [--json]`",
+    "- `debugbundle alert groups --project-id <id> [--limit <n>] [--cursor <cursor>] [--auth-file <path>] [--json]` lists safe alert delivery and email digest groups; `debugbundle alert group <direct|email_digest> <group-id> --project-id <id> [--cursor <cursor>] --json` pages their incident IDs.",
     "- `debugbundle alert create --project-id <id> --channel <channel> --condition <condition> [--service-id <id>] [--severity-min <level>] [--cooldown <seconds>] --config-json <json> [--is-enabled <true|false>] [--auth-file <path>] [--json]`",
     "- `debugbundle alert update <alert-id> --project-id <id> [--service-id <id|null>] [--channel <channel>] [--condition <condition>] [--severity-min <level|null>] [--cooldown <seconds>] [--config-json <json|null>] [--is-enabled <true|false>] [--auth-file <path>] [--json]`",
     "- `debugbundle alert delete <alert-id> --project-id <id> [--auth-file <path>] [--json]`",
@@ -75485,7 +75541,7 @@ function buildMcpReference() {
     "",
     "## Notification Tools",
     "",
-    "- `list_alerts`, `create_alert`, `update_alert`, `delete_alert` \u2014 manage incident alert rules.",
+    "- `list_alerts`, `create_alert`, `update_alert`, `delete_alert` \u2014 manage incident alert rules. `list_alert_groups` and `get_alert_group` inspect project-scoped delivery groups without raw payloads or destination secrets.",
     "- `list_webhooks`, `create_webhook`, `update_webhook`, `delete_webhook` \u2014 manage signed webhook destinations.",
     "- `test_webhook`, `list_webhook_deliveries` \u2014 validate webhook delivery and inspect delivery history.",
     "",
@@ -85009,6 +85065,34 @@ function createAlertMcpTools(api) {
         mapMcpError(error2);
       }
     },
+    async list_alert_groups(input2) {
+      try {
+        return await api.listAlertGroups({
+          bearerToken: String(input2["bearerToken"]),
+          projectId: String(input2["projectId"]),
+          ...typeof input2["limit"] === "number" ? { limit: input2["limit"] } : {},
+          ...typeof input2["cursor"] === "string" ? { cursor: input2["cursor"] } : {}
+        });
+      } catch (error2) {
+        mapMcpError(error2);
+      }
+    },
+    async get_alert_group(input2) {
+      try {
+        const kind = input2["kind"];
+        if (kind !== "direct" && kind !== "email_digest") throw new Error("invalid_group_kind");
+        return await api.getAlertGroup({
+          bearerToken: String(input2["bearerToken"]),
+          projectId: String(input2["projectId"]),
+          kind,
+          groupId: String(input2["groupId"]),
+          ...typeof input2["limit"] === "number" ? { limit: input2["limit"] } : {},
+          ...typeof input2["cursor"] === "string" ? { cursor: input2["cursor"] } : {}
+        });
+      } catch (error2) {
+        mapMcpError(error2);
+      }
+    },
     async create_alert(input2) {
       try {
         const requestInput = {
@@ -85080,6 +85164,19 @@ function createAlertMcpTools(api) {
         mapMcpError(error2);
       }
     },
+    async rotate_alert_webhook_secret(input2) {
+      try {
+        return { alert: await api.updateAlert({
+          bearerToken: String(input2["bearerToken"]),
+          projectId: String(input2["projectId"]),
+          alertId: String(input2["alertId"]),
+          channel: "webhook",
+          rotateSigningSecret: true
+        }) };
+      } catch (error2) {
+        mapMcpError(error2);
+      }
+    },
     async delete_alert(input2) {
       try {
         return {
@@ -98757,8 +98854,8 @@ function applySSRFProtection(dispatcher2) {
   return dispatcher2;
 }
 function createSSRFProtectedDispatcher() {
-  const Agent2 = getAgent();
-  return applySSRFProtection(new Agent2());
+  const Agent3 = getAgent();
+  return applySSRFProtection(new Agent3());
 }
 var dispatcher;
 async function fetchRequest(provider, url, options) {
@@ -104494,6 +104591,88 @@ var CLAIM_DUE_AVAILABILITY_CHECKS_QUERY = `
     c.consecutive_successes
 `;
 
+// ../../packages/storage/src/alert-outbound-guard.ts
+var import_promises5 = require("node:dns/promises");
+var import_node_net2 = require("node:net");
+var import_undici3 = __toESM(require_undici(), 1);
+var blockedAddresses2 = new import_node_net2.BlockList();
+for (const [address, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.88.99.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+]) blockedAddresses2.addSubnet(address, prefix);
+for (const [address, prefix] of [
+  ["::", 128],
+  ["::1", 128],
+  ["64:ff9b::", 96],
+  ["100::", 64],
+  ["2001::", 23],
+  ["2001:db8::", 32],
+  ["2002::", 16],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["ff00::", 8]
+]) blockedAddresses2.addSubnet(address, prefix, "ipv6");
+function blocked() {
+  return new Error("alert_target_blocked");
+}
+function assertPublicAddress(address, family) {
+  if (family !== 4 && family !== 6 || (0, import_node_net2.isIP)(address) !== family || blockedAddresses2.check(address, family === 4 ? "ipv4" : "ipv6")) {
+    throw blocked();
+  }
+}
+function assertPublicHostname(hostname2) {
+  const normalized = hostname2.toLowerCase().replace(/\.$/, "");
+  if (!normalized.includes(".") || [".local", ".internal", ".localhost"].some((suffix) => normalized.endsWith(suffix))) {
+    throw blocked();
+  }
+}
+async function resolveAlertOutboundAddress(hostname2, resolve4 = import_promises5.lookup) {
+  const literalFamily = (0, import_node_net2.isIP)(hostname2);
+  if (literalFamily) {
+    assertPublicAddress(hostname2, literalFamily);
+    return { address: hostname2, family: literalFamily };
+  }
+  assertPublicHostname(hostname2);
+  let answers;
+  try {
+    answers = await resolve4(hostname2, { all: true, verbatim: true });
+  } catch {
+    throw blocked();
+  }
+  if (answers.length === 0) throw blocked();
+  for (const answer of answers) assertPublicAddress(answer.address, answer.family);
+  const first = answers[0];
+  return { address: first.address, family: first.family };
+}
+var outboundAgent = new import_undici3.Agent({
+  connections: 4,
+  maxOrigins: 128,
+  connect: {
+    lookup(hostname2, options, callback) {
+      resolveAlertOutboundAddress(hostname2).then(
+        ({ address, family }) => {
+          if (options.all) callback(null, [{ address, family }]);
+          else callback(null, address, family);
+        },
+        () => callback(blocked(), "")
+      );
+    }
+  }
+});
+
 // ../../packages/storage/src/auth-rate-limiter.ts
 var import_ioredis = __toESM(require_built3(), 1);
 
@@ -105013,6 +105192,11 @@ function normalizeInstalledJavaEvent(candidate) {
   };
 }
 
+// ../../packages/event-normalizer/src/java-stderr.ts
+function isJavaRedirectedStderrLogger(candidate) {
+  return typeof candidate === "string" && candidate.length <= 256 && (candidate === "stderr" || candidate === "org.jboss.stdio" || candidate.startsWith("org.jboss.stdio."));
+}
+
 // ../../packages/event-normalizer/src/java-timer-message.ts
 var TIMER_DIAGNOSTIC = /^WFLYEJB002(?:0|2):[^\n]*\[id=[^\]\n]*\btimedObjectId=/;
 var JAVA_TIMER_DATE = /\b(previousRun|initialExpiration|nextExpiration)=((?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+[A-Za-z][A-Za-z0-9:+-]{0,15}\s+\d{4})\b/g;
@@ -105502,12 +105686,22 @@ function getRequestResponseStatus(payload2) {
   const status = payload2?.["response_status"];
   return typeof status === "number" && Number.isFinite(status) ? status : null;
 }
-function classifyEvent(eventType, logLevel, probeActivationId, payload2, capturePreset = "minimal", immediateClientErrorStatuses = [], immediateClientErrorPathRules = []) {
+function isJavaStackContinuation(payload2) {
+  const message3 = payload2?.["message"];
+  if (typeof message3 !== "string" || message3.length > 16384 || /[\r\n]/.test(message3)) return false;
+  const attributes = payload2?.["attributes"];
+  if (attributes === null || typeof attributes !== "object" || Array.isArray(attributes)) return false;
+  if (!isJavaRedirectedStderrLogger(attributes["logger"])) return false;
+  if ("throwable" in attributes && attributes.throwable !== null) return false;
+  return /^\s*(?:at\s+[\w.$/]+\([^\r\n]*\)|\.\.\.\s+\d+\s+more|(?:Caused by|Suppressed):\s+[\w.$/]+(?:Exception|Error|Throwable)(?::[^\r\n]*|\s|$))\s*$/.test(message3);
+}
+function classifyEvent(eventType, logLevel, probeActivationId, payload2, capturePreset = "minimal", immediateClientErrorStatuses = [], immediateClientErrorPathRules = [], runtime) {
   switch (eventType) {
     case "backend_exception":
     case "frontend_exception":
       return "incident_signal";
     case "log_event":
+      if (runtime === "java" && isJavaStackContinuation(payload2)) return "context_signal";
       if (logLevel !== void 0 && INCIDENT_LOG_LEVELS.has(logLevel)) {
         return "incident_signal";
       }
@@ -107141,6 +107335,8 @@ var STORAGE_BOOTSTRAP_STATEMENTS = [
       severity_lifecycle_scope text,
       cooldown_seconds integer NOT NULL DEFAULT 0,
       config jsonb NOT NULL DEFAULT '{}'::jsonb,
+      signing_secret text,
+      webhook_payload_version smallint NOT NULL DEFAULT 0 CHECK (webhook_payload_version IN (0, 1)),
       is_enabled boolean NOT NULL DEFAULT true,
       created_at timestamptz NOT NULL DEFAULT now(),
       updated_at timestamptz NOT NULL DEFAULT now(),
@@ -107187,6 +107383,7 @@ var STORAGE_BOOTSTRAP_STATEMENTS = [
       dedupe_key text NOT NULL,
       notification_key text NOT NULL DEFAULT '',
       coalescing_key text,
+      evaluation_job_id text,
       channel text NOT NULL,
       status text NOT NULL,
       payload jsonb NOT NULL,
@@ -107205,6 +107402,21 @@ var STORAGE_BOOTSTRAP_STATEMENTS = [
     CREATE INDEX alert_deliveries_alert_notification_idx
     ON alert_deliveries (alert_id, notification_key, created_at DESC)
   `,
+  `
+    CREATE TABLE alert_delivery_members (
+      id uuid PRIMARY KEY,
+      delivery_id uuid NOT NULL REFERENCES alert_deliveries(id) ON DELETE CASCADE,
+      incident_id uuid NOT NULL,
+      condition_type text NOT NULL,
+      dedupe_key text NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (delivery_id, incident_id, condition_type, dedupe_key)
+    )
+  `,
+  `
+    CREATE INDEX alert_delivery_members_delivery_created_idx
+    ON alert_delivery_members (delivery_id, created_at ASC, id ASC)
+  `,
   `
     CREATE TABLE alert_email_digests (
       id uuid PRIMARY KEY,
@@ -109699,6 +109911,45 @@ var STORAGE_SCHEMA_MIGRATIONS = [
     id: "202609160001_add_browser_resource_routes",
     description: "Retain sanitized browser resource routes independently of raw event sampling.",
     statements: ["ALTER TABLE incident_events ADD COLUMN IF NOT EXISTS resource_route text"]
+  }),
+  defineStorageSchemaMigration({
+    id: "202609240001_add_alert_delivery_members",
+    description: "Retain incident identities represented by one coherent alert delivery.",
+    statements: [
+      `
+        CREATE TABLE IF NOT EXISTS alert_delivery_members (
+          id uuid PRIMARY KEY,
+          delivery_id uuid NOT NULL REFERENCES alert_deliveries(id) ON DELETE CASCADE,
+          incident_id uuid NOT NULL,
+          condition_type text NOT NULL,
+          dedupe_key text NOT NULL,
+          created_at timestamptz NOT NULL DEFAULT now(),
+          UNIQUE (delivery_id, incident_id, condition_type, dedupe_key)
+        )
+      `,
+      `
+        CREATE INDEX IF NOT EXISTS alert_delivery_members_delivery_created_idx
+        ON alert_delivery_members (delivery_id, created_at ASC, id ASC)
+      `
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202609240002_add_alert_webhook_signing_secret",
+    description: "Store custom alert-webhook signing secrets separately from readable rule config.",
+    statements: ["ALTER TABLE alert_rules ADD COLUMN IF NOT EXISTS signing_secret text"]
+  }),
+  defineStorageSchemaMigration({
+    id: "202609250001_add_alert_evaluation_owner",
+    description: "Bind direct alert retries to the durable evaluation job that created the intent.",
+    statements: ["ALTER TABLE alert_deliveries ADD COLUMN IF NOT EXISTS evaluation_job_id text"]
+  }),
+  defineStorageSchemaMigration({
+    id: "202609250002_version_alert_webhook_payloads",
+    description: "Preserve legacy custom webhook bodies while enforcing signatures for every delivery.",
+    statements: [
+      "ALTER TABLE alert_rules ADD COLUMN IF NOT EXISTS webhook_payload_version smallint NOT NULL DEFAULT 0 CHECK (webhook_payload_version IN (0, 1))",
+      "UPDATE alert_rules SET webhook_payload_version = 1 WHERE channel = 'webhook' AND signing_secret IS NOT NULL"
+    ]
   })
 ];
 
@@ -109713,7 +109964,7 @@ var STORAGE_SCHEMA_MIGRATIONS2 = [
 ].sort((left, right) => left.id.localeCompare(right.id));
 
 // ../cli/src/cloud-artifact-cache.ts
-var import_promises5 = require("node:fs/promises");
+var import_promises6 = require("node:fs/promises");
 var import_node_path6 = require("node:path");
 
 // ../cli/src/cli-fs-helpers.ts
@@ -109858,9 +110109,9 @@ async function pruneCloudArtifactCache(input2, dependencies) {
   };
 }
 async function pruneExpiredArtifactsInDirectory(directoryPath, now, olderThanMs, dependencies) {
-  const readdir = dependencies?.readdir ?? import_promises5.readdir;
-  const rm = dependencies?.rm ?? import_promises5.rm;
-  const stat = dependencies?.stat ?? import_promises5.stat;
+  const readdir = dependencies?.readdir ?? import_promises6.readdir;
+  const rm = dependencies?.rm ?? import_promises6.rm;
+  const stat = dependencies?.stat ?? import_promises6.stat;
   let fileNames;
   try {
     fileNames = await readdir(directoryPath);
@@ -109902,8 +110153,8 @@ async function pruneExpiredArtifactsInDirectory(directoryPath, now, olderThanMs,
   );
 }
 async function updateCachedArtifactStatus(filePath, input2, dependencies) {
-  const readFile = dependencies?.readFile ?? import_promises5.readFile;
-  const writeFile = dependencies?.writeFile ?? import_promises5.writeFile;
+  const readFile = dependencies?.readFile ?? import_promises6.readFile;
+  const writeFile = dependencies?.writeFile ?? import_promises6.writeFile;
   let payload2;
   try {
     const raw = await readFile(filePath, "utf8");
@@ -109937,15 +110188,15 @@ function applyIncidentStatusToPayload(payload2, incidentId2, incident) {
   return nextPayload;
 }
 async function persistCloudArtifact(directoryPath, fileName, payload2, dependencies) {
-  const mkdir5 = dependencies?.mkdir ?? import_promises5.mkdir;
-  const writeFile = dependencies?.writeFile ?? import_promises5.writeFile;
+  const mkdir5 = dependencies?.mkdir ?? import_promises6.mkdir;
+  const writeFile = dependencies?.writeFile ?? import_promises6.writeFile;
   await mkdir5(directoryPath, { recursive: true });
   await writeFile((0, import_node_path6.join)(directoryPath, fileName), `${JSON.stringify(payload2, null, 2)}
 `, "utf8");
 }
 
 // ../cli/src/local-retrieval-store.ts
-var import_promises6 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 var import_node_path7 = require("node:path");
 var CONNECTION_FILE_PATH2 = ".debugbundle/local/connection.json";
 var STATE_FILE_PATH = ".debugbundle/local/state.json";
@@ -109958,7 +110209,7 @@ function projectLocalEvidence(value) {
   return projected.value;
 }
 async function readLocalArtifact(path, dependencies) {
-  const readFile = dependencies?.readFile ?? import_promises6.readFile;
+  const readFile = dependencies?.readFile ?? import_promises7.readFile;
   const raw = await readFile(path, "utf8");
   if (Buffer.byteLength(raw, "utf8") > MAX_ARTIFACT_BYTES) {
     throw createReadError(503, "privacy_projection_unavailable");
@@ -109977,7 +110228,7 @@ function createReadError(status, code) {
   return new RetrievalApiError(status, code);
 }
 async function readJsonFile(path, dependencies) {
-  const readFile = dependencies?.readFile ?? import_promises6.readFile;
+  const readFile = dependencies?.readFile ?? import_promises7.readFile;
   try {
     return JSON.parse(await readFile(path, "utf8"));
   } catch (error2) {
@@ -110147,7 +110398,7 @@ async function readLocalState(dependencies) {
 }
 async function writeLocalState(state, dependencies) {
   const rootDirectory = getWorkspaceRoot2(dependencies);
-  const writeFile = dependencies?.writeFile ?? import_promises6.writeFile;
+  const writeFile = dependencies?.writeFile ?? import_promises7.writeFile;
   await writeFile(getStateFilePath(rootDirectory), `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
@@ -110837,7 +111088,7 @@ function createServicesMcpTools(api) {
 
 // ../../packages/agent-setup/src/files.ts
 var import_node_fs2 = require("node:fs");
-var import_promises7 = require("node:fs/promises");
+var import_promises8 = require("node:fs/promises");
 var import_node_crypto9 = require("node:crypto");
 var import_node_path8 = require("node:path");
 var digest2 = (text) => (0, import_node_crypto9.createHash)("sha256").update(text).digest("hex");
@@ -110852,7 +111103,7 @@ async function safePath(root, file, allowLeafLink = false) {
   for (let i = 0; i < parts.length; i++) {
     cursor = (0, import_node_path8.join)(cursor, parts[i]);
     try {
-      const info2 = await (0, import_promises7.lstat)(cursor);
+      const info2 = await (0, import_promises8.lstat)(cursor);
       if (info2.isSymbolicLink() && !(allowLeafLink && i === parts.length - 1))
         throw new Error(`Unsafe symbolic link: ${file}`);
       if (i < parts.length - 1 && !info2.isDirectory())
@@ -110866,10 +111117,10 @@ async function safePath(root, file, allowLeafLink = false) {
 async function readManaged(root, file) {
   const path = await safePath(root, file);
   try {
-    const initial = await (0, import_promises7.lstat)(path);
+    const initial = await (0, import_promises8.lstat)(path);
     if (!initial.isFile() || initial.size > 1024 * 1024)
       throw new Error(`Invalid or oversized managed file: ${file}`);
-    const handle = await (0, import_promises7.open)(
+    const handle = await (0, import_promises8.open)(
       path,
       import_node_fs2.constants.O_RDONLY | import_node_fs2.constants.O_NOFOLLOW | import_node_fs2.constants.O_NONBLOCK
     );
@@ -110902,14 +111153,14 @@ async function readManaged(root, file) {
 }
 async function writeManaged(root, file, value, expected) {
   const path = await safePath(root, file);
-  await (0, import_promises7.mkdir)((0, import_node_path8.dirname)(path), { recursive: true });
+  await (0, import_promises8.mkdir)((0, import_node_path8.dirname)(path), { recursive: true });
   await safePath(root, file);
-  const previousMode = await (0, import_promises7.lstat)(path).then((info2) => info2.mode & 511).catch((error2) => {
+  const previousMode = await (0, import_promises8.lstat)(path).then((info2) => info2.mode & 511).catch((error2) => {
     if (!isMissing(error2)) throw error2;
     return void 0;
   });
   const temporary = `${path}.${(0, import_node_crypto9.randomUUID)()}.tmp`;
-  const handle = await (0, import_promises7.open)(
+  const handle = await (0, import_promises8.open)(
     temporary,
     import_node_fs2.constants.O_WRONLY | import_node_fs2.constants.O_CREAT | import_node_fs2.constants.O_EXCL | import_node_fs2.constants.O_NOFOLLOW,
     384
@@ -110921,21 +111172,21 @@ async function writeManaged(root, file, value, expected) {
     if (await readManaged(root, file) !== expected)
       throw new Error(`File changed during setup: ${file}`);
     await safePath(root, file);
-    await (0, import_promises7.rename)(temporary, path);
+    await (0, import_promises8.rename)(temporary, path);
   } finally {
     await handle.close();
-    await (0, import_promises7.unlink)(temporary).catch((error2) => {
+    await (0, import_promises8.unlink)(temporary).catch((error2) => {
       if (!isMissing(error2)) throw error2;
     });
   }
 }
 async function projectRoot(cwd) {
-  const start = await (0, import_promises7.realpath)(cwd);
+  const start = await (0, import_promises8.realpath)(cwd);
   let cursor = start;
   while (true) {
     if (await readManaged(cursor, ".debugbundle/profile.json") !== void 0) return cursor;
     try {
-      await (0, import_promises7.lstat)((0, import_node_path8.join)(cursor, ".git"));
+      await (0, import_promises8.lstat)((0, import_node_path8.join)(cursor, ".git"));
       return start;
     } catch (error2) {
       if (!isMissing(error2)) throw error2;
@@ -111001,7 +111252,7 @@ async function pluginHints(root) {
 }
 
 // ../../packages/agent-setup/src/index.ts
-var import_promises10 = require("node:fs/promises");
+var import_promises11 = require("node:fs/promises");
 var import_node_path11 = require("node:path");
 
 // ../../packages/agent-setup/src/model.ts
@@ -111090,11 +111341,11 @@ async function syncFiles(root, files, hashes2, fix, prefix = CANONICAL, legacyHa
 }
 
 // ../../packages/agent-setup/src/discovery.ts
-var import_promises8 = require("node:fs/promises");
+var import_promises9 = require("node:fs/promises");
 var import_node_path9 = require("node:path");
 async function entries(root, dir, remaining = { count: 100 }) {
   const result = [];
-  for await (const entry of await (0, import_promises8.opendir)(await safePath(root, dir))) {
+  for await (const entry of await (0, import_promises9.opendir)(await safePath(root, dir))) {
     if (--remaining.count < 0 || entry.isSymbolicLink())
       throw new Error("Unowned native discovery entries.");
     const path = `${dir}/${entry.name}`;
@@ -111125,15 +111376,15 @@ async function removeDiscovery(root, files, manifest) {
   if (!manifest.claude) return void 0;
   try {
     const path = await safePath(root, NATIVE, true);
-    const info2 = await (0, import_promises8.lstat)(path).catch((error2) => {
+    const info2 = await (0, import_promises9.lstat)(path).catch((error2) => {
       if (!isMissing(error2)) throw error2;
       return void 0;
     });
     if (info2) {
       if (manifest.claude.mode === "link") {
-        if (!info2.isSymbolicLink() || await (0, import_promises8.readlink)(path) !== LINK)
+        if (!info2.isSymbolicLink() || await (0, import_promises9.readlink)(path) !== LINK)
           return "claude-code: preserved changed skill link during removal.";
-        await (0, import_promises8.unlink)(path);
+        await (0, import_promises9.unlink)(path);
       } else {
         if (!info2.isDirectory())
           return "claude-code: preserved changed skill directory during removal.";
@@ -111150,13 +111401,13 @@ async function removeDiscovery(root, files, manifest) {
           const content = await readManaged(root, file);
           if (content === void 0 || digest2(content) !== manifest.claude.files[file.slice(NATIVE.length + 1)])
             return "claude-code: preserved a skill file changed during removal.";
-          await (0, import_promises8.unlink)(await safePath(root, file));
+          await (0, import_promises9.unlink)(await safePath(root, file));
         }
         for (const dir of copyDirectories(files))
-          await (0, import_promises8.rmdir)(await safePath(root, dir)).catch((error2) => {
+          await (0, import_promises9.rmdir)(await safePath(root, dir)).catch((error2) => {
             if (!isMissing(error2)) throw error2;
           });
-        await (0, import_promises8.rmdir)(path);
+        await (0, import_promises9.rmdir)(path);
       }
     }
     delete manifest.claude;
@@ -111165,10 +111416,10 @@ async function removeDiscovery(root, files, manifest) {
     return "claude-code: cannot safely remove managed discovery; manual review required.";
   }
 }
-async function syncDiscovery(root, files, manifest, fix, writeLink = import_promises8.symlink) {
+async function syncDiscovery(root, files, manifest, fix, writeLink = import_promises9.symlink) {
   try {
     const path = await safePath(root, NATIVE, true);
-    let info2 = await (0, import_promises8.lstat)(path).catch((error2) => {
+    let info2 = await (0, import_promises9.lstat)(path).catch((error2) => {
       if (!isMissing(error2)) throw error2;
       return void 0;
     });
@@ -111178,7 +111429,7 @@ async function syncDiscovery(root, files, manifest, fix, writeLink = import_prom
         message: `claude-code: missing ${NATIVE}; run debugbundle validate --fix.`
       };
     if (!info2 && fix) {
-      await (0, import_promises8.mkdir)((0, import_node_path9.dirname)(path), { recursive: true });
+      await (0, import_promises9.mkdir)((0, import_node_path9.dirname)(path), { recursive: true });
       await safePath(root, NATIVE);
       if (manifest.claude?.mode !== "copy") {
         try {
@@ -111190,11 +111441,11 @@ async function syncDiscovery(root, files, manifest, fix, writeLink = import_prom
           manifest.claude = { mode: "copy", files: {} };
         }
       }
-      if (manifest.claude?.mode === "copy") await (0, import_promises8.mkdir)(path, { recursive: true });
-      info2 = await (0, import_promises8.lstat)(path);
+      if (manifest.claude?.mode === "copy") await (0, import_promises9.mkdir)(path, { recursive: true });
+      info2 = await (0, import_promises9.lstat)(path);
     }
     if (info2?.isSymbolicLink()) {
-      if (await (0, import_promises8.readlink)(path) !== LINK || manifest.claude?.mode === "copy")
+      if (await (0, import_promises9.readlink)(path) !== LINK || manifest.claude?.mode === "copy")
         return {
           status: "conflict",
           message: "claude-code: preserved unknown or changed skill link."
@@ -111228,7 +111479,7 @@ async function syncDiscovery(root, files, manifest, fix, writeLink = import_prom
 
 // ../../packages/agent-setup/src/instructions.ts
 var import_node_path10 = require("node:path");
-var import_promises9 = require("node:fs/promises");
+var import_promises10 = require("node:fs/promises");
 var DEFAULTS2 = {
   codex: "AGENTS.md",
   "claude-code": "CLAUDE.md",
@@ -111237,7 +111488,7 @@ var DEFAULTS2 = {
 };
 async function instructionExists(root, path) {
   try {
-    return (await (0, import_promises9.lstat)(await safePath(root, path, true))).size > 0;
+    return (await (0, import_promises10.lstat)(await safePath(root, path, true))).size > 0;
   } catch (error2) {
     if (isMissing(error2)) return false;
     throw error2;
@@ -111252,7 +111503,7 @@ async function instructionPath(root, agent) {
       ".claude/CLAUDE.md"
     ]) {
       try {
-        await (0, import_promises9.lstat)(await safePath(root, path, true));
+        await (0, import_promises10.lstat)(await safePath(root, path, true));
         return path;
       } catch (error2) {
         if (!isMissing(error2)) throw error2;
@@ -111267,14 +111518,14 @@ async function instructionPath(root, agent) {
 }
 async function linkedInstructions(root, path) {
   const absolute = await safePath(root, path, true);
-  const info2 = await (0, import_promises9.lstat)(absolute).catch((error2) => {
+  const info2 = await (0, import_promises10.lstat)(absolute).catch((error2) => {
     if (!isMissing(error2)) throw error2;
     return void 0;
   });
   if (!info2?.isSymbolicLink()) return void 0;
   const destination = (0, import_node_path10.relative)(
     root,
-    (0, import_node_path10.resolve)((0, import_node_path10.dirname)(absolute), await (0, import_promises9.readlink)(absolute))
+    (0, import_node_path10.resolve)((0, import_node_path10.dirname)(absolute), await (0, import_promises10.readlink)(absolute))
   ).replaceAll("\\", "/");
   if (!["AGENTS.md", "AGENTS.override.md", `${CANONICAL}/SKILL.md`].includes(destination))
     return false;
@@ -111389,7 +111640,7 @@ async function removeInstruction(root, agent, manifest, retained = []) {
         return `${agent}: preserved changed instruction spacing during removal.`;
       const end = range.end + owned.suffix.length;
       const next = current.slice(0, prefixStart) + current.slice(end);
-      if (owned.created && next === "") await (0, import_promises9.unlink)(await safePath(root, owned.path));
+      if (owned.created && next === "") await (0, import_promises10.unlink)(await safePath(root, owned.path));
       else await writeManaged(root, owned.path, next, current);
     }
     delete manifest.instructions[agent];
@@ -111422,11 +111673,11 @@ async function discoveryOverride(root, agent) {
 async function manageAgentSetup(input2) {
   if (!input2.fix) return manage(input2);
   const lockPath = await safePath(input2.root, ".debugbundle/agent-setup.lock");
-  await (0, import_promises10.mkdir)((0, import_node_path11.dirname)(lockPath), { recursive: true });
+  await (0, import_promises11.mkdir)((0, import_node_path11.dirname)(lockPath), { recursive: true });
   await safePath(input2.root, ".debugbundle/agent-setup.lock");
   let lock;
   try {
-    lock = await (0, import_promises10.open)(lockPath, "wx", 384);
+    lock = await (0, import_promises11.open)(lockPath, "wx", 384);
   } catch {
     throw new Error(
       "Agent setup is locked or not writable. Wait for the active setup to finish; after a crashed process, remove .debugbundle/agent-setup.lock only after confirming no setup is running."
@@ -111436,7 +111687,7 @@ async function manageAgentSetup(input2) {
     return await manage(input2);
   } finally {
     await lock.close();
-    await (0, import_promises10.unlink)(await safePath(input2.root, ".debugbundle/agent-setup.lock"));
+    await (0, import_promises11.unlink)(await safePath(input2.root, ".debugbundle/agent-setup.lock"));
   }
 }
 async function manage(input2) {
@@ -111520,7 +111771,7 @@ var legacy_skill_hashes_default = {
 };
 
 // ../cli/src/agent-setup.ts
-var import_promises11 = require("node:readline/promises");
+var import_promises12 = require("node:readline/promises");
 var MANAGED_AGENTS_START = "<!-- debugbundle:start -->";
 var MANAGED_AGENTS_END = "<!-- debugbundle:end -->";
 function buildManagedAgentsSection() {
@@ -111589,7 +111840,7 @@ function localScaffoldFailure(error2, json2 = false) {
 }
 
 // ../cli/src/doctor-command.ts
-var import_promises12 = require("node:fs/promises");
+var import_promises13 = require("node:fs/promises");
 var import_node_path12 = require("node:path");
 
 // ../cli/src/connection-config.ts
@@ -111752,7 +112003,7 @@ function buildPrivacyPreview() {
     "body.otp",
     "context.apiKey"
   ];
-  const sampleEventClass = classifyEvent(sampleEvent.event_type, void 0, void 0, sampleEvent.payload);
+  const sampleEventClass = classifyEvent(sampleEvent.event_type, void 0, void 0, sampleEvent.payload, "minimal", [], [], sampleEvent.service.runtime);
   return {
     policy_version: TELEMETRY_PRIVACY_POLICY_VERSION,
     rule_families: ["sensitive_keys", "credential_text", "urls", "private_keys", "payment_cards"],
@@ -112148,13 +112399,13 @@ async function runDoctorCommand(input2, dependencies = {}) {
   const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
   const fetchImpl = dependencies.fetchImpl ?? nodeFetch;
   const readAuthStateImpl = dependencies.readAuthState ?? readCliAuthState;
-  const readdir = dependencies.readdir ?? import_promises12.readdir;
+  const readdir = dependencies.readdir ?? import_promises13.readdir;
   const readFile = dependencies.readFile ?? (async (filePath) => {
     const content = await readManaged(rootDirectory, (0, import_node_path12.relative)(rootDirectory, filePath));
     if (content === void 0) throw Object.assign(new Error("Missing local scaffold file."), { code: "ENOENT" });
     return content;
   });
-  const stat = dependencies.stat ?? import_promises12.stat;
+  const stat = dependencies.stat ?? import_promises13.stat;
   const rootDirectory = await projectRoot(cwd());
   const currentTime = now();
   const { check: profileCheck, profile, validationErrors } = await loadProfile(rootDirectory, { readFile, stat });
@@ -112321,7 +112572,7 @@ function formatCloudResult(input2, exitCode, checks, errors, incidentId2, verifi
 
 // ../cli/src/verify-command.ts
 var import_node_crypto13 = require("node:crypto");
-var import_promises14 = require("node:fs/promises");
+var import_promises15 = require("node:fs/promises");
 var import_node_path15 = require("node:path");
 
 // ../../packages/log-parser/src/project-id.ts
@@ -112357,7 +112608,7 @@ var import_node_path14 = require("node:path");
 
 // ../cli/src/process-command.ts
 var import_node_crypto11 = require("node:crypto");
-var import_promises13 = require("node:fs/promises");
+var import_promises14 = require("node:fs/promises");
 var import_node_path13 = require("node:path");
 
 // ../../packages/shared-types/src/browser-recovery.ts
@@ -113898,7 +114149,10 @@ function classifyEnvelope(envelope, capturePreset) {
     envelope.event_type === "log_event" ? envelope.payload.level : void 0,
     envelope.event_type === "probe_event" ? envelope.payload.activation_id : void 0,
     envelope.payload,
-    capturePreset
+    capturePreset,
+    [],
+    [],
+    envelope.service.runtime
   );
 }
 function isIncidentSignalEnvelope(envelope, capturePreset) {
@@ -114216,11 +114470,11 @@ function serializeState(state) {
 }
 async function processCommand(input2, dependencies = {}) {
   const cwd = dependencies.cwd ?? (() => process.cwd());
-  const mkdir5 = dependencies.mkdir ?? import_promises13.mkdir;
-  const readFile = dependencies.readFile ?? ((filePath) => (0, import_promises13.readFile)(filePath, "utf8"));
-  const readdir = dependencies.readdir ?? import_promises13.readdir;
-  const stat = dependencies.stat ?? import_promises13.stat;
-  const writeFile = dependencies.writeFile ?? ((filePath, content) => (0, import_promises13.writeFile)(filePath, content, "utf8"));
+  const mkdir5 = dependencies.mkdir ?? import_promises14.mkdir;
+  const readFile = dependencies.readFile ?? ((filePath) => (0, import_promises14.readFile)(filePath, "utf8"));
+  const readdir = dependencies.readdir ?? import_promises14.readdir;
+  const stat = dependencies.stat ?? import_promises14.stat;
+  const writeFile = dependencies.writeFile ?? ((filePath, content) => (0, import_promises14.writeFile)(filePath, content, "utf8"));
   const rootDirectory = cwd();
   const eventsDirectoryPath = (0, import_node_path13.join)(rootDirectory, LOCAL_EVENTS_DIRECTORY_PATH);
   const statePath = (0, import_node_path13.join)(rootDirectory, LOCAL_STATE_FILE_PATH);
@@ -114708,14 +114962,14 @@ async function writeVerificationEventBatch(input2, dependencies) {
 async function verifyLocalCommand(input2, dependencies = {}) {
   const cwd = dependencies.cwd ?? (() => process.cwd());
   const mkdir5 = dependencies.mkdir ?? (async (path, options) => {
-    await (0, import_promises14.mkdir)(path, options);
+    await (0, import_promises15.mkdir)(path, options);
   });
   const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
   const processLocal = dependencies.processCommand ?? processCommand;
   const readVerifiedLocalState = dependencies.readLocalState ?? readLocalState;
   const readVerifiedLocalBundle = dependencies.getLocalBundle ?? getLocalBundle;
-  const rename3 = dependencies.rename ?? (async (sourcePath, destinationPath) => (0, import_promises14.rename)(sourcePath, destinationPath));
-  const writeFile = dependencies.writeFile ?? (async (path, content) => (0, import_promises14.writeFile)(path, content, "utf8"));
+  const rename3 = dependencies.rename ?? (async (sourcePath, destinationPath) => (0, import_promises15.rename)(sourcePath, destinationPath));
+  const writeFile = dependencies.writeFile ?? (async (path, content) => (0, import_promises15.writeFile)(path, content, "utf8"));
   const checks = [];
   function finalize(exitCode, errors, incidentId2) {
     return formatResult(input2, exitCode, checks, errors, incidentId2);
@@ -114736,7 +114990,7 @@ async function verifyLocalCommand(input2, dependencies = {}) {
   });
   try {
     const rootDirectory = cwd();
-    const profile = await readProfile(rootDirectory, async (path) => (0, import_promises14.readFile)(path, "utf8"));
+    const profile = await readProfile(rootDirectory, async (path) => (0, import_promises15.readFile)(path, "utf8"));
     const projectId2 = buildProjectId(profile);
     const verificationNow = now();
     const runId = verificationNow.toISOString().replace(/[-:.TZ]/g, "").slice(0, 14);
@@ -115311,7 +115565,7 @@ async function smokeCommand(input2, dependencies = {}) {
 }
 
 // ../cli/src/validate-command.ts
-var import_promises15 = require("node:fs/promises");
+var import_promises16 = require("node:fs/promises");
 var import_node_path16 = require("node:path");
 var SUGGESTED_ACTIONS2 = [
   "Run debugbundle setup if .debugbundle/profile.json is missing.",
@@ -115426,14 +115680,14 @@ async function fixMissingFile(rootDirectory, filePath, buildContent, dependencie
 async function runValidateCommand(input2, dependencies = {}) {
   const cwd = dependencies.cwd ?? (() => process.cwd());
   const mkdir5 = dependencies.mkdir ?? (async (path, options) => {
-    await (0, import_promises15.mkdir)(path, options);
+    await (0, import_promises16.mkdir)(path, options);
   });
   const readFile = dependencies.readFile ?? (async (filePath) => {
     const content = await readManaged(rootDirectory, (0, import_node_path16.relative)(rootDirectory, filePath));
     if (content === void 0) throw Object.assign(new Error("Missing local scaffold file."), { code: "ENOENT" });
     return content;
   });
-  const stat = dependencies.stat ?? import_promises15.stat;
+  const stat = dependencies.stat ?? import_promises16.stat;
   const rootDirectory = await projectRoot(cwd());
   for (const file of [PROFILE_FILE_PATH, CONNECTION_FILE_PATH, GITIGNORE_FILE_PATH]) await safePath(rootDirectory, file);
   const profileValidation = await validateProfile(rootDirectory, { readFile, stat });
@@ -116540,6 +116794,30 @@ var MCP_TOOL_CATALOG_OPERATIONS = [
       limit: external_exports.number().optional()
     })
   },
+  {
+    name: "list_alert_groups",
+    group: "alerts",
+    description: "List project-scoped alert delivery and email digest groups with bounded incident counts and no payloads or destination secrets.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string().uuid(),
+      limit: external_exports.number().int().min(1).max(100).optional(),
+      cursor: external_exports.string().max(256).optional()
+    })
+  },
+  {
+    name: "get_alert_group",
+    group: "alerts",
+    description: "Inspect one project-scoped alert group and a paginated page of member incident IDs without raw logs or destination secrets.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string().uuid(),
+      kind: external_exports.enum(["direct", "email_digest"]),
+      groupId: external_exports.string().uuid(),
+      limit: external_exports.number().int().min(1).max(100).optional(),
+      cursor: external_exports.string().max(256).optional()
+    })
+  },
   {
     name: "create_alert",
     group: "alerts",
@@ -116575,6 +116853,16 @@ var MCP_TOOL_CATALOG_OPERATIONS = [
       isEnabled: external_exports.boolean().optional()
     })
   },
+  {
+    name: "rotate_alert_webhook_secret",
+    group: "alerts",
+    description: "Rotate a custom alert-webhook signing secret and reveal the new secret once.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string(),
+      alertId: external_exports.string()
+    })
+  },
   {
     name: "delete_alert",
     group: "alerts",
@@ -117117,7 +117405,7 @@ var import_node_readline = require("node:readline");
 var package_default = {
   name: "@debugbundle/mcp",
   mcpName: "com.debugbundle/mcp",
-  version: "1.11.0",
+  version: "1.12.1",
   private: false,
   description: "MCP server for runtime error reporting, incident response, health checks, debug bundles, and product analytics",
   license: "Apache-2.0",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@debugbundle/mcp",
   "mcpName": "com.debugbundle/mcp",
-  "version": "1.11.0",
+  "version": "1.12.1",
   "private": false,
   "description": "MCP server for runtime error reporting, incident response, health checks, debug bundles, and product analytics",
   "license": "Apache-2.0",

package/server.json

@@ -8,13 +8,13 @@
     "source": "github",
     "subfolder": "apps/mcp"
   },
-  "version": "1.11.0",
+  "version": "1.12.1",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@debugbundle/mcp",
-      "version": "1.11.0",
+      "version": "1.12.1",
       "transport": {
         "type": "stdio"
       },