@oneuptime/common 11.3.26 → 11.4.0

package/build/dist/Server/Utils/AI/Sentinel/SentinelInvestigationEngine.js

@@ -0,0 +1,311 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import ObjectID from "../../../../Types/ObjectID";
+import OneUptimeDate from "../../../../Types/Date";
+import AIRunType from "../../../../Types/AI/AIRunType";
+import AIRunStatus from "../../../../Types/AI/AIRunStatus";
+import AIRunEventType from "../../../../Types/AI/AIRunEventType";
+import AIRun from "../../../../Models/DatabaseModels/AIRun";
+import AIRunEvent from "../../../../Models/DatabaseModels/AIRunEvent";
+import AIRunService from "../../../Services/AIRunService";
+import AIRunEventService from "../../../Services/AIRunEventService";
+import ProjectService from "../../../Services/ProjectService";
+import LlmProviderService from "../../../Services/LlmProviderService";
+import ObservabilityAssistant from "../Chat/ObservabilityAssistant";
+import logger from "../../Logger";
+import CaptureSpan from "../../Telemetry/CaptureSpan";
+/*
+ * Sentinel — the shared autonomous-investigation engine.
+ *
+ * A single subject-agnostic core that powers "wake on signal" investigations
+ * for both incidents and alerts (and, later, anomalies). It:
+ *   1. records the run as an AIRun(Investigation) + AIRunEvents (audit trail),
+ *   2. runs the existing read-only, tool-grounded, citation-minting agent loop
+ *      (ObservabilityAssistant) with the Sentinel persona and a larger budget,
+ *   3. brands the cited analysis, judges confidence, and
+ *   4. hands the finished analysis back to the caller to post to the subject's
+ *      timeline.
+ *
+ * The investigation is strictly READ-ONLY: it can never mutate anything.
+ * Enablement + provider gating is shared via isEnabledForProject().
+ */
+// Budgets — larger than an interactive chat-ops answer, small enough to stay cheap.
+const MAX_LLM_CALLS = 8;
+const MAX_TOOL_CALLS = 12;
+const MAX_WALL_CLOCK_MS = 150 * 1000;
+const MAX_OUTPUT_TOKENS = 2000;
+/*
+ * Sentinel's own contract: it writes exactly this phrase when it cannot
+ * determine a cause. We match it deterministically to drive "quiet mode" —
+ * a non-answer should never loudly page the on-call.
+ */
+const INCONCLUSIVE_RE = /inconclusive[^.\n]*insufficient signal/i;
+// Maps a live agent step to the AIRunEvent type persisted for the glass-box trail.
+const STEP_EVENT_TYPE = {
+    llm_started: AIRunEventType.LlmCallStarted,
+    llm_completed: AIRunEventType.LlmCallCompleted,
+    tool_started: AIRunEventType.ToolCallStarted,
+    tool_completed: AIRunEventType.ToolCallCompleted,
+    tool_failed: AIRunEventType.ToolCallFailed,
+};
+const INVESTIGATION_PERSONA = `You are "Sentinel", OneUptime's autonomous AI Site Reliability Engineer. You have been woken automatically because a NEW signal (an incident or alert) was just declared in this project — no human has asked you a question yet. Investigate it proactively and produce a first-pass root cause analysis that the on-call engineer will read the moment they are paged.
+
+Investigate like a senior on-call engineer:
+- Start from the affected monitors/services named in the signal.
+- Use your read tools to inspect the telemetry AROUND the signal's creation time: recent exceptions and their trends, error/latency metrics versus their normal range, failing traces, relevant logs, and recent changes / deploys.
+- Form the single most likely root-cause hypothesis. If the evidence is inconclusive, say so plainly and list what you checked — do NOT guess a cause the data does not support.
+- If the context lists past resolved incidents, check whether this is a RECURRENCE. If the current signal matches one, say so explicitly, reference that incident number, and note how it was resolved before — but still verify against the current telemetry.
+
+Write your final answer as a concise incident-response note with exactly these sections (use these markdown headings):
+**Summary** — one or two sentences a paged engineer can read in five seconds.
+**Most likely root cause** — your hypothesis, with only the confidence the evidence actually supports, each factual claim carrying its [C#] citation. If you could not determine it, write "Inconclusive — insufficient signal" and explain what is missing.
+**Evidence** — the key findings that support or rule out the hypothesis, each cited.
+**Suggested next steps** — concrete actions for the on-call engineer.
+
+Keep it tight and skimmable. You are read-only: never claim to have changed anything.`;
+export default class SentinelInvestigationEngine {
+    /*
+     * Shared gate: AI enabled, the subject's auto-investigation opt-in on, and an
+     * LLM provider configured. Incidents and alerts each have their own opt-in so
+     * they can be enabled independently. Runs before any (subject-specific)
+     * context assembly.
+     */
+    static async isEnabledForProject(projectId, subjectType) {
+        const project = await ProjectService.findOneById({
+            id: projectId,
+            select: {
+                enableAi: true,
+                enableAutomaticIncidentInvestigation: true,
+                enableAutomaticAlertInvestigation: true,
+            },
+            props: { isRoot: true },
+        });
+        if (!project) {
+            return false;
+        }
+        if (project.enableAi === false) {
+            return false;
+        }
+        const isOptedIn = subjectType === "Alert"
+            ? project.enableAutomaticAlertInvestigation === true
+            : project.enableAutomaticIncidentInvestigation === true;
+        if (!isOptedIn) {
+            return false;
+        }
+        const llmProvider = await LlmProviderService.getLLMProviderForProject(projectId);
+        if (!llmProvider) {
+            logger.debug(`Sentinel: skipping investigation for project ${projectId.toString()} — no LLM provider configured.`);
+            return false;
+        }
+        return true;
+    }
+    /*
+     * Run one investigation end-to-end. Never throws — failures are logged and
+     * recorded on the AIRun.
+     */
+    static async investigate(request) {
+        const { projectId } = request;
+        // Record the run up front so it is auditable even if it fails.
+        const run = new AIRun();
+        run.projectId = projectId;
+        run.runType = AIRunType.Investigation;
+        run.status = AIRunStatus.Running;
+        run.startedAt = OneUptimeDate.getCurrentDate();
+        run.lastHeartbeatAt = OneUptimeDate.getCurrentDate();
+        if (request.subjectIncidentId) {
+            run.triggeredByIncidentId = request.subjectIncidentId;
+        }
+        if (request.subjectAlertId) {
+            run.triggeredByAlertId = request.subjectAlertId;
+        }
+        let createdRun;
+        try {
+            createdRun = await AIRunService.create({
+                data: run,
+                props: { isRoot: true },
+            });
+        }
+        catch (error) {
+            logger.error(`Sentinel: failed to create investigation run: ${error}`);
+            return;
+        }
+        const aiRunId = createdRun.id;
+        let sequence = 0;
+        await this.emitEvent({
+            projectId,
+            aiRunId,
+            sequence: sequence++,
+            eventType: AIRunEventType.RunStarted,
+        });
+        /*
+         * Live narration: persist each LLM/tool step as an AIRunEvent so the UI can
+         * "watch it think" by polling the run's events. Best-effort, ordered.
+         */
+        const onStep = async (step) => {
+            const resultSummary = step.rowCount !== undefined ||
+                step.durationMs !== undefined ||
+                step.errorMessage !== undefined
+                ? {
+                    rowCount: step.rowCount,
+                    durationInMs: step.durationMs,
+                    errorMessage: step.errorMessage,
+                }
+                : undefined;
+            await this.emitEvent({
+                projectId,
+                aiRunId,
+                sequence: sequence++,
+                eventType: STEP_EVENT_TYPE[step.type],
+                toolName: step.toolName,
+                toolArguments: step.toolArguments,
+                resultSummary,
+                citationId: step.citationId,
+            });
+            // Keep the run visibly alive for the stale-run sweeper + live UI.
+            if (step.type === "llm_started") {
+                await this.touchHeartbeat(aiRunId);
+            }
+        };
+        try {
+            const result = await ObservabilityAssistant.answerQuestion({
+                projectId,
+                // System run — full read access to the project's telemetry.
+                props: { isRoot: true },
+                feature: request.feature,
+                systemInstructions: INVESTIGATION_PERSONA,
+                question: `A new signal has just been declared and you have been woken to investigate it. Investigate now and produce your root cause analysis.\n\n${request.contextSummary}`,
+                maxLlmCalls: MAX_LLM_CALLS,
+                maxToolCalls: MAX_TOOL_CALLS,
+                maxWallClockMs: MAX_WALL_CLOCK_MS,
+                maxOutputTokens: MAX_OUTPUT_TOKENS,
+                onStep,
+            });
+            await AIRunService.updateOneBy({
+                query: { _id: aiRunId.toString(), status: AIRunStatus.Running },
+                data: {
+                    status: AIRunStatus.Completed,
+                    completedAt: OneUptimeDate.getCurrentDate(),
+                    lastHeartbeatAt: OneUptimeDate.getCurrentDate(),
+                    llmCallCount: result.llmCallCount,
+                    toolCallCount: result.toolCallCount,
+                    totalTokens: result.totalTokens,
+                },
+                props: { isRoot: true },
+            });
+            await this.emitEvent({
+                projectId,
+                aiRunId,
+                sequence: sequence++,
+                eventType: AIRunEventType.RunCompleted,
+            });
+            const analysis = (result.contentInMarkdown || "").trim();
+            if (!analysis) {
+                logger.debug(`Sentinel: investigation (run ${aiRunId.toString()}) produced no analysis; nothing posted.`);
+                return;
+            }
+            const isConfident = !INCONCLUSIVE_RE.test(analysis);
+            await request.postAnalysis({
+                analysisMarkdown: this.buildBrandedMarkdown(result, analysis),
+                isConfident,
+                result,
+            });
+            logger.debug(`Sentinel: investigation complete (run ${aiRunId.toString()}, confident=${isConfident}, ${result.llmCallCount} LLM calls, ${result.toolCallCount} tools, ${result.totalTokens} tokens).`);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            await AIRunService.updateOneBy({
+                query: { _id: aiRunId.toString(), status: AIRunStatus.Running },
+                data: {
+                    status: AIRunStatus.Error,
+                    completedAt: OneUptimeDate.getCurrentDate(),
+                    errorMessage: message.substring(0, 480),
+                },
+                props: { isRoot: true },
+            });
+            await this.emitEvent({
+                projectId,
+                aiRunId,
+                sequence: sequence++,
+                eventType: AIRunEventType.RunFailed,
+            });
+            logger.error(`Sentinel: investigation failed (run ${aiRunId.toString()}): ${message}`);
+        }
+    }
+    // Wrap the agent's analysis with Sentinel branding + an evidence list.
+    static buildBrandedMarkdown(result, analysisMarkdown) {
+        let markdown = `## 🧠 Sentinel — Automated Root Cause Analysis\n\n${analysisMarkdown}`;
+        const citations = result.citations || [];
+        if (citations.length > 0) {
+            markdown += `\n\n**Evidence checked**`;
+            for (const citation of citations.slice(0, 15)) {
+                markdown += `\n- **[${citation.id}]** ${citation.label} — ${citation.rowCount} row(s)`;
+            }
+        }
+        markdown += `\n\n---\n*Investigated automatically by OneUptime Sentinel — read-only, ${result.toolCallCount} quer${result.toolCallCount === 1 ? "y" : "ies"} run across your own telemetry${result.modelName ? ` using ${result.modelName}` : ""}. This is an AI-generated first pass; verify before acting.*`;
+        return markdown;
+    }
+    // Refresh lastHeartbeatAt so a long-running investigation isn't swept as stale.
+    static async touchHeartbeat(aiRunId) {
+        try {
+            await AIRunService.updateOneBy({
+                query: { _id: aiRunId.toString(), status: AIRunStatus.Running },
+                data: {
+                    lastHeartbeatAt: OneUptimeDate.getCurrentDate(),
+                },
+                props: { isRoot: true },
+            });
+        }
+        catch (error) {
+            logger.error(`Sentinel: heartbeat update failed: ${error}`);
+        }
+    }
+    static async emitEvent(data) {
+        try {
+            const event = new AIRunEvent();
+            event.projectId = data.projectId;
+            event.aiRunId = data.aiRunId;
+            event.sequence = data.sequence;
+            event.eventType = data.eventType;
+            if (data.toolName) {
+                event.toolName = data.toolName;
+            }
+            if (data.toolArguments) {
+                event.toolArguments = data.toolArguments;
+            }
+            if (data.resultSummary) {
+                event.resultSummary = data.resultSummary;
+            }
+            if (data.citationId) {
+                event.citationId = data.citationId;
+            }
+            await AIRunEventService.create({
+                data: event,
+                props: { isRoot: true },
+            });
+        }
+        catch (error) {
+            // Events are best-effort telemetry — never fail the run because of them.
+            logger.error(`Sentinel: failed to emit AIRunEvent: ${error}`);
+        }
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ObjectID, String]),
+    __metadata("design:returntype", Promise)
+], SentinelInvestigationEngine, "isEnabledForProject", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], SentinelInvestigationEngine, "investigate", null);
+//# sourceMappingURL=SentinelInvestigationEngine.js.map

package/build/dist/Server/Utils/AI/Sentinel/SentinelInvestigationEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SentinelInvestigationEngine.js","sourceRoot":"","sources":["../../../../../../Server/Utils/AI/Sentinel/SentinelInvestigationEngine.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,QAAQ,MAAM,4BAA4B,CAAC;AAClD,OAAO,aAAa,MAAM,wBAAwB,CAAC;AAMnD,OAAO,SAAS,MAAM,gCAAgC,CAAC;AACvD,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAC3D,OAAO,cAAc,MAAM,qCAAqC,CAAC;AACjE,OAAO,KAAK,MAAM,yCAAyC,CAAC;AAC5D,OAAO,UAAU,MAAM,8CAA8C,CAAC;AAGtE,OAAO,YAAY,MAAM,gCAAgC,CAAC;AAC1D,OAAO,iBAAiB,MAAM,qCAAqC,CAAC;AACpE,OAAO,cAAc,MAAM,kCAAkC,CAAC;AAC9D,OAAO,kBAAkB,MAAM,sCAAsC,CAAC;AACtE,OAAO,sBAIN,MAAM,gCAAgC,CAAC;AACxC,OAAO,MAAM,MAAM,cAAc,CAAC;AAClC,OAAO,WAAW,MAAM,6BAA6B,CAAC;AAEtD;;;;;;;;;;;;;;GAcG;AAEH,oFAAoF;AACpF,MAAM,aAAa,GAAW,CAAC,CAAC;AAChC,MAAM,cAAc,GAAW,EAAE,CAAC;AAClC,MAAM,iBAAiB,GAAW,GAAG,GAAG,IAAI,CAAC;AAC7C,MAAM,iBAAiB,GAAW,IAAI,CAAC;AAEvC;;;;GAIG;AACH,MAAM,eAAe,GAAW,yCAAyC,CAAC;AAE1E,mFAAmF;AACnF,MAAM,eAAe,GACnB;IACE,WAAW,EAAE,cAAc,CAAC,cAAc;IAC1C,aAAa,EAAE,cAAc,CAAC,gBAAgB;IAC9C,YAAY,EAAE,cAAc,CAAC,eAAe;IAC5C,cAAc,EAAE,cAAc,CAAC,iBAAiB;IAChD,WAAW,EAAE,cAAc,CAAC,cAAc;CAC3C,CAAC;AAEJ,MAAM,qBAAqB,GAAW;;;;;;;;;;;;;;sFAcgD,CAAC;AA8BvF,MAAM,CAAC,OAAO,OAAO,2BAA2B;IAC9C;;;;;OAKG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACrC,SAAmB,EACnB,WAAgC;QAEhC,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;YAC/D,EAAE,EAAE,SAAS;YACb,MAAM,EAAE;gBACN,QAAQ,EAAE,IAAI;gBACd,oCAAoC,EAAE,IAAI;gBAC1C,iCAAiC,EAAE,IAAI;aACxC;YACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GACb,WAAW,KAAK,OAAO;YACrB,CAAC,CAAC,OAAO,CAAC,iCAAiC,KAAK,IAAI;YACpD,CAAC,CAAC,OAAO,CAAC,oCAAoC,KAAK,IAAI,CAAC;QAE5D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GACf,MAAM,kBAAkB,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAE/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CACV,gDAAgD,SAAS,CAAC,QAAQ,EAAE,gCAAgC,CACrG,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,WAAW,CAC7B,OAA6B;QAE7B,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAE9B,+DAA+D;QAC/D,MAAM,GAAG,GAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;QAC1B,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC,aAAa,CAAC;QACtC,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC;QACjC,GAAG,CAAC,SAAS,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC;QAC/C,GAAG,CAAC,eAAe,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC;QAErD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,GAAG,CAAC,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACxD,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,GAAG,CAAC,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC;QAClD,CAAC;QAED,IAAI,UAAiB,CAAC;QACtB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;gBACrC,IAAI,EAAE,GAAG;gBACT,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,iDAAiD,KAAK,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAa,UAAU,CAAC,EAAG,CAAC;QACzC,IAAI,QAAQ,GAAW,CAAC,CAAC;QAEzB,MAAM,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS;YACT,OAAO;YACP,QAAQ,EAAE,QAAQ,EAAE;YACpB,SAAS,EAAE,cAAc,CAAC,UAAU;SACrC,CAAC,CAAC;QAEH;;;WAGG;QACH,MAAM,MAAM,GAAwD,KAAK,EACvE,IAAgC,EACjB,EAAE;YACjB,MAAM,aAAa,GACjB,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAC3B,IAAI,CAAC,UAAU,KAAK,SAAS;gBAC7B,IAAI,CAAC,YAAY,KAAK,SAAS;gBAC7B,CAAC,CAAC;oBACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,YAAY,EAAE,IAAI,CAAC,UAAU;oBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACH,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,OAAO;gBACP,QAAQ,EAAE,QAAQ,EAAE;gBACpB,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,aAAa;gBACb,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;YAEH,kEAAkE;YAClE,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GACV,MAAM,sBAAsB,CAAC,cAAc,CAAC;gBAC1C,SAAS;gBACT,4DAA4D;gBAC5D,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,qBAAqB;gBACzC,QAAQ,EAAE,2IAA2I,OAAO,CAAC,cAAc,EAAE;gBAC7K,WAAW,EAAE,aAAa;gBAC1B,YAAY,EAAE,cAAc;gBAC5B,cAAc,EAAE,iBAAiB;gBACjC,eAAe,EAAE,iBAAiB;gBAClC,MAAM;aACP,CAAC,CAAC;YAEL,MAAM,YAAY,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE;gBAC/D,IAAI,EAAE;oBACJ,MAAM,EAAE,WAAW,CAAC,SAAS;oBAC7B,WAAW,EAAE,aAAa,CAAC,cAAc,EAAE;oBAC3C,eAAe,EAAE,aAAa,CAAC,cAAc,EAAE;oBAC/C,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,WAAW,EAAE,MAAM,CAAC,WAAW;iBACvB;gBACV,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,OAAO;gBACP,QAAQ,EAAE,QAAQ,EAAE;gBACpB,SAAS,EAAE,cAAc,CAAC,YAAY;aACvC,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAW,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAEjE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CACV,gCAAgC,OAAO,CAAC,QAAQ,EAAE,yCAAyC,CAC5F,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAY,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE7D,MAAM,OAAO,CAAC,YAAY,CAAC;gBACzB,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAC7D,WAAW;gBACX,MAAM;aACP,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CACV,yCAAyC,OAAO,CAAC,QAAQ,EAAE,eAAe,WAAW,KAAK,MAAM,CAAC,YAAY,eAAe,MAAM,CAAC,aAAa,WAAW,MAAM,CAAC,WAAW,WAAW,CACzL,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEzD,MAAM,YAAY,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE;gBAC/D,IAAI,EAAE;oBACJ,MAAM,EAAE,WAAW,CAAC,KAAK;oBACzB,WAAW,EAAE,aAAa,CAAC,cAAc,EAAE;oBAC3C,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC/B;gBACV,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,OAAO;gBACP,QAAQ,EAAE,QAAQ,EAAE;gBACpB,SAAS,EAAE,cAAc,CAAC,SAAS;aACpC,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CACV,uCAAuC,OAAO,CAAC,QAAQ,EAAE,MAAM,OAAO,EAAE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IAC/D,MAAM,CAAC,oBAAoB,CACjC,MAAoC,EACpC,gBAAwB;QAExB,IAAI,QAAQ,GAAW,qDAAqD,gBAAgB,EAAE,CAAC;QAE/F,MAAM,SAAS,GAA0B,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAEhE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,QAAQ,IAAI,0BAA0B,CAAC;YACvC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC9C,QAAQ,IAAI,UAAU,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,QAAQ,SAAS,CAAC;YACzF,CAAC;QACH,CAAC;QAED,QAAQ,IAAI,2EAA2E,MAAM,CAAC,aAAa,QACzG,MAAM,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KACrC,iCACE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EACpD,8DAA8D,CAAC;QAE/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,gFAAgF;IACxE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,OAAiB;QACnD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE;gBAC/D,IAAI,EAAE;oBACJ,eAAe,EAAE,aAAa,CAAC,cAAc,EAAE;iBACvC;gBACV,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAS9B;QACC,IAAI,CAAC;YACH,MAAM,KAAK,GAAe,IAAI,UAAU,EAAE,CAAC;YAC3C,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC/B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YAEjC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YACjC,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;YAC3C,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;YAC3C,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACrC,CAAC;YAED,MAAM,iBAAiB,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,MAAM,CAAC,KAAK,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;CACF;AA/RqB;IADnB,WAAW,EAAE;;qCAED,QAAQ;;4DAyCpB;AAOmB;IADnB,WAAW,EAAE;;;;oDA8Jb"}

package/build/dist/Server/Utils/AI/Sentinel/SentinelMemory.js

@@ -0,0 +1,143 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import SortOrder from "../../../../Types/BaseDatabase/SortOrder";
+import IncidentService from "../../../Services/IncidentService";
+import CaptureSpan from "../../Telemetry/CaptureSpan";
+import logger from "../../Logger";
+/*
+ * Sentinel — episodic memory (Phase 4, "I've seen this before").
+ *
+ * The first, no-new-storage cut of the recurrence short-circuit: instead of a
+ * vector store, retrieve past RESOLVED incidents in the same project that share
+ * monitors/labels with the current signal and carry a recorded root cause, then
+ * feed a compact digest into the investigation so the agent can recognise a
+ * recurrence and reference the prior fix.
+ *
+ * The full episodic store (pgvector embeddings over postmortems/runbooks + a
+ * temporal knowledge graph) is the deferred, larger build — this delivers the
+ * user-visible "this matches #123" behaviour on data we already own.
+ */
+// How many recent incidents to consider, and how many prior cases to surface.
+const CANDIDATE_LIMIT = 30;
+const MAX_CASES = 4;
+const MAX_ROOT_CAUSE_CHARS = 300;
+const SHARED_MONITOR_SCORE = 2;
+const SHARED_LABEL_SCORE = 1;
+export default class SentinelMemory {
+    /*
+     * Returns a markdown "past resolved incidents" section to append to the
+     * investigation context, or an empty string when there is nothing useful.
+     * Never throws — memory is a nice-to-have, not load-bearing.
+     */
+    static async getPriorSimilarIncidentsContext(data) {
+        try {
+            const candidates = await IncidentService.findBy({
+                query: {
+                    projectId: data.projectId,
+                },
+                select: {
+                    _id: true,
+                    incidentNumber: true,
+                    title: true,
+                    rootCause: true,
+                    createdAt: true,
+                    currentIncidentState: {
+                        isResolvedState: true,
+                    },
+                    monitors: {
+                        name: true,
+                    },
+                    labels: {
+                        name: true,
+                    },
+                },
+                sort: {
+                    createdAt: SortOrder.Descending,
+                },
+                limit: CANDIDATE_LIMIT,
+                skip: 0,
+                props: { isRoot: true },
+            });
+            const currentIdString = data.currentIncidentId.toString();
+            const monitorSet = new Set(data.monitorNames.map((n) => {
+                return n.toLowerCase();
+            }));
+            const labelSet = new Set(data.labelNames.map((n) => {
+                return n.toLowerCase();
+            }));
+            const scored = candidates
+                .filter((incident) => {
+                var _a, _b;
+                return (((_a = incident.id) === null || _a === void 0 ? void 0 : _a.toString()) !== currentIdString &&
+                    ((_b = incident.currentIncidentState) === null || _b === void 0 ? void 0 : _b.isResolvedState) === true &&
+                    Boolean(incident.rootCause && incident.rootCause.trim().length > 0));
+            })
+                .map((incident) => {
+                let score = 0;
+                for (const monitor of incident.monitors || []) {
+                    if (monitor.name && monitorSet.has(monitor.name.toLowerCase())) {
+                        score += SHARED_MONITOR_SCORE;
+                    }
+                }
+                for (const label of incident.labels || []) {
+                    if (label.name && labelSet.has(label.name.toLowerCase())) {
+                        score += SHARED_LABEL_SCORE;
+                    }
+                }
+                return { incident, score };
+            });
+            /*
+             * Prefer cases that actually share a monitor/label; otherwise fall back to
+             * the most recent resolved incidents (V8's sort is stable, keeping recency).
+             */
+            const relevant = scored
+                .filter((item) => {
+                return item.score > 0;
+            })
+                .sort((a, b) => {
+                return b.score - a.score;
+            });
+            const chosen = (relevant.length > 0 ? relevant : scored).slice(0, MAX_CASES);
+            if (chosen.length === 0) {
+                return "";
+            }
+            let markdown = "\n\n# Past resolved incidents in this project (recurrence context)\n" +
+                "If the current signal matches one of these, this may be a recurrence — say so explicitly and reference the incident number and how it was resolved.\n";
+            for (const { incident } of chosen) {
+                const rootCause = (incident.rootCause || "").trim();
+                const shortRootCause = rootCause.length > MAX_ROOT_CAUSE_CHARS
+                    ? `${rootCause.substring(0, MAX_ROOT_CAUSE_CHARS)}…`
+                    : rootCause;
+                markdown += `\n- **#${incident.incidentNumber} — ${incident.title || "Untitled"}**`;
+                markdown += `\n  Previously resolved. Root cause: ${shortRootCause}`;
+                const monitorNames = (incident.monitors || [])
+                    .map((m) => {
+                    return m.name || "";
+                })
+                    .filter(Boolean);
+                if (monitorNames.length > 0) {
+                    markdown += `\n  Monitors: ${monitorNames.join(", ")}`;
+                }
+            }
+            return markdown;
+        }
+        catch (error) {
+            logger.error(`Sentinel: failed to load recurrence context: ${error}`);
+            return "";
+        }
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], SentinelMemory, "getPriorSimilarIncidentsContext", null);
+//# sourceMappingURL=SentinelMemory.js.map

package/build/dist/Server/Utils/AI/Sentinel/SentinelMemory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SentinelMemory.js","sourceRoot":"","sources":["../../../../../../Server/Utils/AI/Sentinel/SentinelMemory.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,SAAS,MAAM,0CAA0C,CAAC;AAGjE,OAAO,eAAe,MAAM,mCAAmC,CAAC;AAChE,OAAO,WAAW,MAAM,6BAA6B,CAAC;AACtD,OAAO,MAAM,MAAM,cAAc,CAAC;AAElC;;;;;;;;;;;;GAYG;AAEH,8EAA8E;AAC9E,MAAM,eAAe,GAAW,EAAE,CAAC;AACnC,MAAM,SAAS,GAAW,CAAC,CAAC;AAC5B,MAAM,oBAAoB,GAAW,GAAG,CAAC;AAEzC,MAAM,oBAAoB,GAAW,CAAC,CAAC;AACvC,MAAM,kBAAkB,GAAW,CAAC,CAAC;AAErC,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC;;;;OAIG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,IAKnD;QACC,IAAI,CAAC;YACH,MAAM,UAAU,GAAoB,MAAM,eAAe,CAAC,MAAM,CAAC;gBAC/D,KAAK,EAAE;oBACL,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,cAAc,EAAE,IAAI;oBACpB,KAAK,EAAE,IAAI;oBACX,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,IAAI;oBACf,oBAAoB,EAAE;wBACpB,eAAe,EAAE,IAAI;qBACtB;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,IAAI;qBACX;oBACD,MAAM,EAAE;wBACN,IAAI,EAAE,IAAI;qBACX;iBACF;gBACD,IAAI,EAAE;oBACJ,SAAS,EAAE,SAAS,CAAC,UAAU;iBAChC;gBACD,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,MAAM,eAAe,GAAW,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YAClE,MAAM,UAAU,GAAgB,IAAI,GAAG,CACrC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE;gBAClC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;YACzB,CAAC,CAAC,CACH,CAAC;YACF,MAAM,QAAQ,GAAgB,IAAI,GAAG,CACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE;gBAChC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;YACzB,CAAC,CAAC,CACH,CAAC;YAEF,MAAM,MAAM,GAAiD,UAAU;iBACpE,MAAM,CAAC,CAAC,QAAkB,EAAE,EAAE;;gBAC7B,OAAO,CACL,CAAA,MAAA,QAAQ,CAAC,EAAE,0CAAE,QAAQ,EAAE,MAAK,eAAe;oBAC3C,CAAA,MAAA,QAAQ,CAAC,oBAAoB,0CAAE,eAAe,MAAK,IAAI;oBACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CACpE,CAAC;YACJ,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,QAAkB,EAAE,EAAE;gBAC1B,IAAI,KAAK,GAAW,CAAC,CAAC;gBAEtB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBAC9C,IAAI,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;wBAC/D,KAAK,IAAI,oBAAoB,CAAC;oBAChC,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;oBAC1C,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;wBACzD,KAAK,IAAI,kBAAkB,CAAC;oBAC9B,CAAC;gBACH,CAAC;gBAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAC7B,CAAC,CAAC,CAAC;YAEL;;;eAGG;YACH,MAAM,QAAQ,GAAiD,MAAM;iBAClE,MAAM,CAAC,CAAC,IAA2C,EAAE,EAAE;gBACtD,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;YACxB,CAAC,CAAC;iBACD,IAAI,CACH,CACE,CAAwC,EACxC,CAAwC,EACxC,EAAE;gBACF,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YAC3B,CAAC,CACF,CAAC;YAEJ,MAAM,MAAM,GAAiD,CAC3D,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CACxC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAEtB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,IAAI,QAAQ,GACV,sEAAsE;gBACtE,uJAAuJ,CAAC;YAE1J,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,MAAM,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAW,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5D,MAAM,cAAc,GAClB,SAAS,CAAC,MAAM,GAAG,oBAAoB;oBACrC,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,oBAAoB,CAAC,GAAG;oBACpD,CAAC,CAAC,SAAS,CAAC;gBAEhB,QAAQ,IAAI,UAAU,QAAQ,CAAC,cAAc,MAAM,QAAQ,CAAC,KAAK,IAAI,UAAU,IAAI,CAAC;gBACpF,QAAQ,IAAI,wCAAwC,cAAc,EAAE,CAAC;gBAErE,MAAM,YAAY,GAAkB,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;qBAC1D,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;oBAClB,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;gBACtB,CAAC,CAAC;qBACD,MAAM,CAAC,OAAO,CAAC,CAAC;gBAEnB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,QAAQ,IAAI,iBAAiB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,CAAC;YACH,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,KAAK,EAAE,CAAC,CAAC;YACtE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAjIqB;IADnB,WAAW,EAAE;;;;2DAiIb"}

package/build/dist/Server/Utils/AI/Toolbox/IncidentTools.js

@@ -23,7 +23,7 @@ const resolveReadPermissions = () => {
 };
 export const QueryIncidentsTool = {
     name: "query_incidents",
-    description: "Query incidents in this project. Returns the most recent incidents with their current state and severity. Pass incidentId to get full details of one incident.",
+    description: "Query incidents in this project. Returns the most recent incidents with their current state and severity. Pass incidentId to get full details of one incident — including its affected monitors, labels, root cause, remediation and postmortem notes, and the incident window (telemetryWindowStart) to pivot into logs/traces/metrics for the affected services.",
     inputSchema: {
         type: "object",
         properties: {
@@ -62,9 +62,41 @@ export const QueryIncidentsTool = {
                     incidentSeverity: {
                         name: true,
                     },
+                    monitors: {
+                        _id: true,
+                        name: true,
+                    },
+                    labels: {
+                        name: true,
+                    },
+                    rootCause: true,
+                    remediationNotes: true,
+                    postmortemNote: true,
                 },
                 props: ctx.props,
             });
+            /*
+             * Surface the incident's blast radius (affected monitors + labels) and
+             * its own window so the model can pivot from an incident into the
+             * logs/traces/metrics of the affected services over the right time
+             * range, instead of guessing which service or hour to look at.
+             */
+            const affectedMonitors = ((incident === null || incident === void 0 ? void 0 : incident.monitors) || [])
+                .map((monitor) => {
+                return monitor.name || "";
+            })
+                .filter((value) => {
+                return value.length > 0;
+            })
+                .join(", ");
+            const incidentLabels = ((incident === null || incident === void 0 ? void 0 : incident.labels) || [])
+                .map((label) => {
+                return label.name || "";
+            })
+                .filter((value) => {
+                return value.length > 0;
+            })
+                .join(", ");
             const rows = incident
                 ? [
                     {
@@ -75,6 +107,12 @@ export const QueryIncidentsTool = {
                         state: (_b = incident.currentIncidentState) === null || _b === void 0 ? void 0 : _b.name,
                         severity: (_c = incident.incidentSeverity) === null || _c === void 0 ? void 0 : _c.name,
                         createdAt: incident.createdAt,
+                        affectedMonitors: affectedMonitors || undefined,
+                        labels: incidentLabels || undefined,
+                        rootCause: incident.rootCause,
+                        remediationNotes: incident.remediationNotes,
+                        postmortemNote: incident.postmortemNote,
+                        telemetryWindowStart: incident.createdAt,
                     },
                 ]
                 : [];
@@ -164,4 +202,117 @@ export const QueryIncidentsTool = {
         };
     },
 };
+export const SearchIncidentsTool = {
+    name: "search_incidents",
+    description: "Search PAST incidents by free text across their title, description, root cause, remediation notes and postmortem. Use this to ground root-cause analysis in history — e.g. 'have we seen this error before, and how was it resolved?'. Returns matching incidents (most recent first) with their root cause and postmortem so you can reuse prior resolutions.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            searchText: {
+                type: "string",
+                description: "Text to match (case-insensitive substring) across incident title, description, root cause, remediation notes and postmortem.",
+            },
+            createdWithinHours: {
+                type: "number",
+                description: "Only incidents created within this many hours (default 2160 = 90 days, max 8760 = 1 year).",
+            },
+            limit: {
+                type: "number",
+                description: "Maximum incidents to return (default 5, max 15).",
+            },
+        },
+        required: ["searchText"],
+    },
+    get requiredPermissions() {
+        return resolveReadPermissions();
+    },
+    execute: async (args, ctx) => {
+        const searchText = ToolArgs.getString(args, "searchText");
+        if (!searchText) {
+            return {
+                dataForLlm: "Error: searchText is required. Provide the text to search past incidents for.",
+                rowCount: 0,
+                citationLabel: "Incident search (no query)",
+                redactionCount: 0,
+                isTruncated: false,
+            };
+        }
+        const createdWithinHours = ToolArgs.getNumber(args, "createdWithinHours", { defaultValue: 2160, min: 1, max: 8760 });
+        const limit = ToolArgs.getNumber(args, "limit", {
+            defaultValue: 5,
+            min: 1,
+            max: 15,
+        });
+        const endTime = OneUptimeDate.getCurrentDate();
+        const startTime = OneUptimeDate.addRemoveHours(endTime, -1 * createdWithinHours);
+        const incidents = await IncidentService.findBy({
+            query: {
+                createdAt: QueryHelper.inBetween(startTime, endTime),
+                /*
+                 * The OR-joined ILIKE Raw references the listed columns, not the
+                 * attached property — this is the established multiSearch attachment
+                 * pattern (see QueryUtil).
+                 */
+                title: QueryHelper.multiSearch([
+                    "title",
+                    "description",
+                    "rootCause",
+                    "remediationNotes",
+                    "postmortemNote",
+                ], searchText),
+            },
+            select: {
+                _id: true,
+                title: true,
+                incidentNumber: true,
+                createdAt: true,
+                currentIncidentState: {
+                    name: true,
+                },
+                incidentSeverity: {
+                    name: true,
+                },
+                rootCause: true,
+                postmortemNote: true,
+            },
+            sort: {
+                createdAt: SortOrder.Descending,
+            },
+            limit: limit,
+            skip: 0,
+            props: ctx.props,
+        });
+        const rows = incidents.map((incident) => {
+            var _a, _b, _c;
+            return {
+                id: (_a = incident.id) === null || _a === void 0 ? void 0 : _a.toString(),
+                incidentNumber: incident.incidentNumber,
+                title: incident.title,
+                state: (_b = incident.currentIncidentState) === null || _b === void 0 ? void 0 : _b.name,
+                severity: (_c = incident.incidentSeverity) === null || _c === void 0 ? void 0 : _c.name,
+                createdAt: incident.createdAt,
+                rootCause: incident.rootCause,
+                postmortemNote: incident.postmortemNote,
+            };
+        });
+        const serialized = ToolResultSerializer.serializeRows(rows);
+        return {
+            dataForLlm: serialized.text,
+            rowCount: serialized.rowCount,
+            citationLabel: `Incident search "${searchText}" (${serialized.rowCount} found)`,
+            citationTarget: {
+                type: AIChatCitationTargetType.Incidents,
+            },
+            redactionCount: serialized.redactionCount,
+            isTruncated: serialized.isTruncated,
+            widget: rows.length > 0
+                ? WidgetBuilder.incidentList({
+                    title: `Incidents matching "${searchText}" (${rows.length})`,
+                    items: rows,
+                    link: { type: AIChatCitationTargetType.Incidents },
+                })
+                : undefined,
+        };
+    },
+};
 //# sourceMappingURL=IncidentTools.js.map