@oneuptime/common 12.0.7 → 12.0.9

package/Server/Utils/AI/Toolbox/AlertTools.ts

@@ -1,10 +1,15 @@
 import Alert from "../../../../Models/DatabaseModels/Alert";
+import AlertOwnerTeam from "../../../../Models/DatabaseModels/AlertOwnerTeam";
+import AlertOwnerUser from "../../../../Models/DatabaseModels/AlertOwnerUser";
 import { JSONObject } from "../../../../Types/JSON";
 import ObjectID from "../../../../Types/ObjectID";
 import Permission from "../../../../Types/Permission";
+import Query from "../../../../Types/BaseDatabase/Query";
 import SortOrder from "../../../../Types/BaseDatabase/SortOrder";
 import { AIChatCitationTargetType } from "../../../../Types/AI/AIChatTypes";
 import AlertService from "../../../Services/AlertService";
+import AlertOwnerTeamService from "../../../Services/AlertOwnerTeamService";
+import AlertOwnerUserService from "../../../Services/AlertOwnerUserService";
 import QueryHelper from "../../../Types/Database/QueryHelper";
 import OneUptimeDate from "../../../../Types/Date";
 import ToolResultSerializer, { SerializedResult } from "./Serializer";
@@ -32,26 +37,40 @@ const resolveReadPermissions: () => Array<Permission> =
     return cachedReadPermissions;
   };
 
+type AlertStateFilter = "active" | "resolved" | "any";
+
 export const QueryAlertsTool: ObservabilityTool = {
   name: "query_alerts",
   description:
-    "Query alerts in this project. Returns the most recent alerts with their current state and severity. Pass alertId to get full details of one alert.",
+    "Query alerts in this project with their current state and severity. To answer 'which alerts are active/firing right now?' pass state='active' — it returns every unresolved alert regardless of age (no time window unless createdWithinHours is passed explicitly). state='resolved' returns only resolved alerts; the default 'any' returns both, limited to the createdWithinHours window. Results are newest-first; the result reports the total match count — pass skip to page through more. Pass alertId to get full details of one alert, including its description and its owners (teams and users).",
   inputSchema: {
     type: "object",
     properties: {
       alertId: {
         type: "string",
-        description: "Get one alert by its ID (includes description).",
+        description:
+          "Get one alert by its ID (includes description and owners).",
+      },
+      state: {
+        type: "string",
+        enum: ["active", "resolved", "any"],
+        description:
+          "Filter by current alert state: 'active' = not yet resolved (any age), 'resolved' = resolved only, 'any' = both (default).",
       },
       createdWithinHours: {
         type: "number",
         description:
-          "Only alerts created within this many hours (default 24, max 720).",
+          "Only alerts created within this many hours (default 24, max 720). Ignored for state='active' unless passed explicitly, so long-running active alerts are never hidden.",
       },
       limit: {
         type: "number",
         description: "Maximum alerts to return (default 10, max 25).",
       },
+      skip: {
+        type: "number",
+        description:
+          "Rows to skip for paging through a large result (default 0, max 500).",
+      },
     },
   },
   get requiredPermissions(): Array<Permission> {
@@ -82,6 +101,73 @@ export const QueryAlertsTool: ObservabilityTool = {
         props: ctx.props,
       });
 
+      let ownerTeamNames: string = "";
+      let ownerUserNames: string = "";
+
+      if (alert) {
+        /*
+         * Owners live in join tables, not on the Alert row itself. projectId
+         * is pinned to the tenant from ctx because alertId is an untrusted
+         * model argument.
+         */
+        const ownerTeams: Array<AlertOwnerTeam> =
+          await AlertOwnerTeamService.findBy({
+            query: {
+              alertId: alertId,
+              projectId: ctx.projectId,
+            },
+            select: {
+              _id: true,
+              team: {
+                name: true,
+              },
+            },
+            limit: 10,
+            skip: 0,
+            props: ctx.props,
+          });
+
+        const ownerUsers: Array<AlertOwnerUser> =
+          await AlertOwnerUserService.findBy({
+            query: {
+              alertId: alertId,
+              projectId: ctx.projectId,
+            },
+            select: {
+              _id: true,
+              user: {
+                name: true,
+                email: true,
+              },
+            },
+            limit: 10,
+            skip: 0,
+            props: ctx.props,
+          });
+
+        ownerTeamNames = ownerTeams
+          .map((ownerTeam: AlertOwnerTeam) => {
+            return ownerTeam.team?.name || "";
+          })
+          .filter((value: string) => {
+            return value.length > 0;
+          })
+          .join(", ");
+
+        ownerUserNames = ownerUsers
+          .map((ownerUser: AlertOwnerUser) => {
+            return (
+              ownerUser.user?.name?.toString() ||
+              ownerUser.user?.email?.toString() ||
+              ""
+            );
+          })
+          .filter((value: string) => {
+            return value.length > 0;
+          })
+          .join(", ");
+      }
+
       const rows: Array<JSONObject> = alert
         ? [
             {
@@ -92,6 +178,8 @@ export const QueryAlertsTool: ObservabilityTool = {
               state: alert.currentAlertState?.name,
               severity: alert.alertSeverity?.name,
               createdAt: alert.createdAt,
+              ownerTeams: ownerTeamNames || undefined,
+              ownerUsers: ownerUserNames || undefined,
             },
           ]
         : [];
@@ -123,6 +211,14 @@ export const QueryAlertsTool: ObservabilityTool = {
       };
     }
 
+    const stateArg: string | undefined = ToolArgs.getString(args, "state");
+    const state: AlertStateFilter =
+      stateArg?.toLowerCase() === "active"
+        ? "active"
+        : stateArg?.toLowerCase() === "resolved"
+          ? "resolved"
+          : "any";
+
     const createdWithinHours: number = ToolArgs.getNumber(
       args,
       "createdWithinHours",
@@ -133,17 +229,52 @@ export const QueryAlertsTool: ObservabilityTool = {
       min: 1,
       max: 25,
     });
+    const skip: number = ToolArgs.getNumber(args, "skip", {
+      defaultValue: 0,
+      min: 0,
+      max: 500,
+    });
 
-    const endTime: Date = OneUptimeDate.getCurrentDate();
-    const startTime: Date = OneUptimeDate.addRemoveHours(
-      endTime,
-      -1 * createdWithinHours,
-    );
+    const query: Query<Alert> = {};
+
+    /*
+     * State is matched through the AlertState flags rather than the state
+     * name, so custom state names ("Firing", "Triaged", …) still classify
+     * correctly: anything not flagged resolved counts as active.
+     */
+    if (state === "active") {
+      query.currentAlertState = { isResolvedState: false };
+    } else if (state === "resolved") {
+      query.currentAlertState = { isResolvedState: true };
+    }
+
+    /*
+     * "active" answers "what is firing right now?" — an alert that opened a
+     * week ago and is still unresolved must show up, so the createdAt window
+     * only applies when the model asked for one explicitly. "Explicitly"
+     * mirrors ToolArgs.getNumber parsing (same rule as IncidentTools): only
+     * a usable number counts — junk like "all" would otherwise re-impose
+     * the 24h default and hide exactly the long-running alerts this filter
+     * exists to surface.
+     */
+    const rawWindow: unknown = args["createdWithinHours"];
+    const hasExplicitWindow: boolean =
+      (typeof rawWindow === "number" && Number.isFinite(rawWindow)) ||
+      (typeof rawWindow === "string" &&
+        rawWindow.trim().length > 0 &&
+        Number.isFinite(Number(rawWindow)));
+
+    if (state !== "active" || hasExplicitWindow) {
+      const endTime: Date = OneUptimeDate.getCurrentDate();
+      const startTime: Date = OneUptimeDate.addRemoveHours(
+        endTime,
+        -1 * createdWithinHours,
+      );
+      query.createdAt = QueryHelper.inBetween(startTime, endTime);
+    }
 
     const alerts: Array<Alert> = await AlertService.findBy({
-      query: {
-        createdAt: QueryHelper.inBetween(startTime, endTime),
-      },
+      query: query,
       select: {
         _id: true,
         title: true,
@@ -160,10 +291,17 @@ export const QueryAlertsTool: ObservabilityTool = {
         createdAt: SortOrder.Descending,
       },
       limit: limit,
-      skip: 0,
+      skip: skip,
       props: ctx.props,
     });
 
+    const totalCount: number = (
+      await AlertService.countBy({
+        query: query,
+        props: ctx.props,
+      })
+    ).toNumber();
+
     const rows: Array<JSONObject> = alerts.map((alert: Alert) => {
       return {
         id: alert.id?.toString(),
@@ -178,10 +316,31 @@ export const QueryAlertsTool: ObservabilityTool = {
     const serialized: SerializedResult =
       ToolResultSerializer.serializeRows(rows);
 
+    let dataForLlm: string = serialized.text;
+    if (rows.length > 0 && totalCount > rows.length) {
+      dataForLlm = `Showing rows ${skip + 1}–${skip + rows.length} of ${totalCount} total. Pass skip to page further.\n${serialized.text}`;
+    }
+
+    let scopeLabel: string;
+    if (state === "active") {
+      scopeLabel = hasExplicitWindow
+        ? `Active alerts, last ${createdWithinHours}h`
+        : "Active alerts";
+    } else if (state === "resolved") {
+      scopeLabel = `Resolved alerts, last ${createdWithinHours}h`;
+    } else {
+      scopeLabel = `Alerts, last ${createdWithinHours}h`;
+    }
+
+    const citationLabel: string =
+      totalCount > serialized.rowCount
+        ? `${scopeLabel} (${serialized.rowCount} of ${totalCount})`
+        : `${scopeLabel} (${serialized.rowCount} found)`;
+
     return {
-      dataForLlm: serialized.text,
+      dataForLlm: dataForLlm,
       rowCount: serialized.rowCount,
-      citationLabel: `Alerts, last ${createdWithinHours}h (${serialized.rowCount} found)`,
+      citationLabel: citationLabel,
       citationTarget: {
         type: AIChatCitationTargetType.Alerts,
       },
@@ -191,7 +350,10 @@ export const QueryAlertsTool: ObservabilityTool = {
         rows.length > 0
           ? WidgetBuilder.alertList({
               title: `Alerts (${rows.length})`,
-              description: `Created in the last ${createdWithinHours}h`,
+              description:
+                state === "active" && !hasExplicitWindow
+                  ? "Currently unresolved alerts"
+                  : `Created in the last ${createdWithinHours}h`,
               items: rows,
               link: { type: AIChatCitationTargetType.Alerts },
             })

package/Server/Utils/AI/Toolbox/IncidentTools.ts

@@ -1,10 +1,17 @@
 import Incident from "../../../../Models/DatabaseModels/Incident";
+import IncidentOwnerTeam from "../../../../Models/DatabaseModels/IncidentOwnerTeam";
+import IncidentOwnerUser from "../../../../Models/DatabaseModels/IncidentOwnerUser";
+import BadDataException from "../../../../Types/Exception/BadDataException";
 import { JSONObject } from "../../../../Types/JSON";
 import ObjectID from "../../../../Types/ObjectID";
 import Permission from "../../../../Types/Permission";
+import PositiveNumber from "../../../../Types/PositiveNumber";
+import Query from "../../../../Types/BaseDatabase/Query";
 import SortOrder from "../../../../Types/BaseDatabase/SortOrder";
 import { AIChatCitationTargetType } from "../../../../Types/AI/AIChatTypes";
 import IncidentService from "../../../Services/IncidentService";
+import IncidentOwnerTeamService from "../../../Services/IncidentOwnerTeamService";
+import IncidentOwnerUserService from "../../../Services/IncidentOwnerUserService";
 import QueryHelper from "../../../Types/Database/QueryHelper";
 import OneUptimeDate from "../../../../Types/Date";
 import ToolResultSerializer, { SerializedResult } from "./Serializer";
@@ -16,6 +23,15 @@ import {
   ToolExecutionResult,
 } from "./ToolTypes";
 
+// Allowed values for query_incidents' `state` filter.
+type IncidentStateFilter = "active" | "resolved" | "any";
+
+const INCIDENT_STATE_FILTERS: Array<IncidentStateFilter> = [
+  "active",
+  "resolved",
+  "any",
+];
+
 /*
  * Derived from the model ACL so the tool gate can never drift from RBAC.
  * Resolved lazily rather than at module load: this module is pulled in through
@@ -35,7 +51,7 @@ const resolveReadPermissions: () => Array<Permission> =
 export const QueryIncidentsTool: ObservabilityTool = {
   name: "query_incidents",
   description:
-    "Query incidents in this project. Returns the most recent incidents with their current state and severity. Pass incidentId to get full details of one incident — including its affected monitors, labels, root cause, remediation and postmortem notes, and the incident window (telemetryWindowStart) to pivot into logs/traces/metrics for the affected services.",
+    'Query incidents in this project. Returns the most recent incidents with their current state and severity. Pass state="active" to list currently unresolved incidents regardless of when they were created (use this for \'what incidents are active/open right now?\'), or state="resolved" for closed ones. Pass incidentId to get full details of one incident — including its owner teams and owner users, affected monitors, labels, root cause, remediation and postmortem notes, and the incident window (telemetryWindowStart) to pivot into logs/traces/metrics for the affected services. For the incident\'s activity thread — state changes, notes and the latest updates — use get_incident_timeline.',
   inputSchema: {
     type: "object",
     properties: {
@@ -43,15 +59,26 @@ export const QueryIncidentsTool: ObservabilityTool = {
         type: "string",
         description: "Get one incident by its ID (includes description).",
       },
+      state: {
+        type: "string",
+        enum: ["active", "resolved", "any"],
+        description:
+          "Filter by current state: 'active' = not yet resolved (ignores the time window unless createdWithinHours is passed explicitly, so long-running open incidents are included), 'resolved' = resolved only, 'any' = no state filter (default).",
+      },
       createdWithinHours: {
         type: "number",
         description:
-          "Only incidents created within this many hours (default 168 = 7 days, max 720).",
+          "Only incidents created within this many hours (default 168 = 7 days, max 720). Ignored when state is 'active' unless passed explicitly.",
       },
       limit: {
         type: "number",
         description: "Maximum incidents to return (default 10, max 25).",
       },
+      skip: {
+        type: "number",
+        description:
+          "Number of incidents to skip for pagination (default 0, max 500).",
+      },
     },
   },
   get requiredPermissions(): Array<Permission> {
@@ -95,6 +122,76 @@ export const QueryIncidentsTool: ObservabilityTool = {
         props: ctx.props,
       });
 
+      /*
+       * Ownership lives in join tables (IncidentOwnerTeam/IncidentOwnerUser),
+       * not as relations on the Incident model itself, so "who owns this
+       * incident?" needs two extra scoped queries. projectId is pinned to the
+       * tenant from ctx because incidentId is an untrusted model argument.
+       */
+      let ownerTeamNames: string = "";
+      let ownerUserNames: string = "";
+
+      if (incident) {
+        const [ownerTeams, ownerUsers]: [
+          Array<IncidentOwnerTeam>,
+          Array<IncidentOwnerUser>,
+        ] = await Promise.all([
+          IncidentOwnerTeamService.findBy({
+            query: {
+              incidentId: incidentId,
+              projectId: ctx.projectId,
+            },
+            select: {
+              _id: true,
+              team: {
+                name: true,
+              },
+            },
+            limit: 25,
+            skip: 0,
+            props: ctx.props,
+          }),
+          IncidentOwnerUserService.findBy({
+            query: {
+              incidentId: incidentId,
+              projectId: ctx.projectId,
+            },
+            select: {
+              _id: true,
+              user: {
+                name: true,
+                email: true,
+              },
+            },
+            limit: 25,
+            skip: 0,
+            props: ctx.props,
+          }),
+        ]);
+
+        ownerTeamNames = ownerTeams
+          .map((ownerTeam: IncidentOwnerTeam) => {
+            return ownerTeam.team?.name || "";
+          })
+          .filter((value: string) => {
+            return value.length > 0;
+          })
+          .join(", ");
+
+        ownerUserNames = ownerUsers
+          .map((ownerUser: IncidentOwnerUser) => {
+            return (
+              ownerUser.user?.name?.toString() ||
+              ownerUser.user?.email?.toString() ||
+              ""
+            );
+          })
+          .filter((value: string) => {
+            return value.length > 0;
+          })
+          .join(", ");
+      }
+
       /*
        * Surface the incident's blast radius (affected monitors + labels) and
        * its own window so the model can pivot from an incident into the
@@ -129,6 +226,8 @@ export const QueryIncidentsTool: ObservabilityTool = {
               state: incident.currentIncidentState?.name,
               severity: incident.incidentSeverity?.name,
               createdAt: incident.createdAt,
+              ownerTeams: ownerTeamNames || undefined,
+              ownerUsers: ownerUserNames || undefined,
               affectedMonitors: affectedMonitors || undefined,
               labels: incidentLabels || undefined,
               rootCause: incident.rootCause,
@@ -166,6 +265,20 @@ export const QueryIncidentsTool: ObservabilityTool = {
       };
     }
 
+    const stateFilterString: string =
+      ToolArgs.getString(args, "state") || "any";
+
+    if (
+      !INCIDENT_STATE_FILTERS.includes(stateFilterString as IncidentStateFilter)
+    ) {
+      throw new BadDataException(
+        `Invalid state: ${stateFilterString}. Use one of: active, resolved, any.`,
+      );
+    }
+
+    const stateFilter: IncidentStateFilter =
+      stateFilterString as IncidentStateFilter;
+
     const createdWithinHours: number = ToolArgs.getNumber(
       args,
       "createdWithinHours",
@@ -176,6 +289,27 @@ export const QueryIncidentsTool: ObservabilityTool = {
       min: 1,
       max: 25,
     });
+    const skip: number = ToolArgs.getNumber(args, "skip", {
+      defaultValue: 0,
+      min: 0,
+      max: 500,
+    });
+
+    /*
+     * Mirrors ToolArgs.getNumber parsing: the window was "provided" only when
+     * the raw argument is a usable number. Needed because an active incident
+     * opened months ago must still show up for "what's active right now?" —
+     * so state=active drops the createdAt filter unless the model explicitly
+     * asked for a window.
+     */
+    const rawWindow: unknown = args["createdWithinHours"];
+    const windowProvided: boolean =
+      (typeof rawWindow === "number" && Number.isFinite(rawWindow)) ||
+      (typeof rawWindow === "string" &&
+        rawWindow.trim().length > 0 &&
+        Number.isFinite(Number(rawWindow)));
+
+    const applyTimeFilter: boolean = stateFilter !== "active" || windowProvided;
 
     const endTime: Date = OneUptimeDate.getCurrentDate();
     const startTime: Date = OneUptimeDate.addRemoveHours(
@@ -183,10 +317,34 @@ export const QueryIncidentsTool: ObservabilityTool = {
       -1 * createdWithinHours,
     );
 
+    const query: Query<Incident> = {};
+
+    if (applyTimeFilter) {
+      query.createdAt = QueryHelper.inBetween(startTime, endTime);
+    }
+
+    /*
+     * currentIncidentState is resolved through the state's flags rather than
+     * by name, because state names are user-configurable per project while
+     * isResolvedState is the canonical "closed" marker.
+     */
+    if (stateFilter === "active") {
+      query.currentIncidentState = {
+        isResolvedState: false,
+      };
+    } else if (stateFilter === "resolved") {
+      query.currentIncidentState = {
+        isResolvedState: true,
+      };
+    }
+
+    const totalCount: PositiveNumber = await IncidentService.countBy({
+      query: query,
+      props: ctx.props,
+    });
+
     const incidents: Array<Incident> = await IncidentService.findBy({
-      query: {
-        createdAt: QueryHelper.inBetween(startTime, endTime),
-      },
+      query: query,
       select: {
         _id: true,
         title: true,
@@ -203,7 +361,7 @@ export const QueryIncidentsTool: ObservabilityTool = {
         createdAt: SortOrder.Descending,
       },
       limit: limit,
-      skip: 0,
+      skip: skip,
       props: ctx.props,
     });
 
@@ -221,10 +379,31 @@ export const QueryIncidentsTool: ObservabilityTool = {
     const serialized: SerializedResult =
       ToolResultSerializer.serializeRows(rows);
 
+    const total: number = totalCount.toNumber();
+
+    let dataForLlm: string = serialized.text;
+    if (total > rows.length && rows.length > 0) {
+      dataForLlm = `Showing rows ${skip + 1}–${skip + rows.length} of ${total} total. Pass skip to page further.\n${dataForLlm}`;
+    } else if (total > 0 && rows.length === 0 && skip > 0) {
+      // Paged past the end: keep the model oriented instead of a bare empty.
+      dataForLlm = `No rows at skip=${skip}; there are ${total} total. Lower skip to page back.\n${dataForLlm}`;
+    }
+
+    const windowLabel: string = applyTimeFilter
+      ? `, last ${createdWithinHours}h`
+      : "";
+
+    let stateLabel: string = "Incidents";
+    if (stateFilter === "active") {
+      stateLabel = "Active incidents";
+    } else if (stateFilter === "resolved") {
+      stateLabel = "Resolved incidents";
+    }
+
     return {
-      dataForLlm: serialized.text,
+      dataForLlm: dataForLlm,
       rowCount: serialized.rowCount,
-      citationLabel: `Incidents, last ${createdWithinHours}h (${serialized.rowCount} found)`,
+      citationLabel: `${stateLabel}${windowLabel} (${total} total)`,
       citationTarget: {
         type: AIChatCitationTargetType.Incidents,
       },
@@ -233,8 +412,10 @@ export const QueryIncidentsTool: ObservabilityTool = {
       widget:
         rows.length > 0
           ? WidgetBuilder.incidentList({
-              title: `Incidents (${rows.length})`,
-              description: `Created in the last ${createdWithinHours}h`,
+              title: `${stateLabel} (${total})`,
+              description: applyTimeFilter
+                ? `Created in the last ${createdWithinHours}h`
+                : "Regardless of when they were created",
               items: rows,
               link: { type: AIChatCitationTargetType.Incidents },
             })

package/Server/Utils/AI/Toolbox/Index.ts

@@ -17,6 +17,26 @@ import { QueryIncidentsTool, SearchIncidentsTool } from "./IncidentTools";
 import { QueryAlertsTool } from "./AlertTools";
 import { QueryMonitorsTool } from "./MonitorTools";
 import { QueryScheduledMaintenanceTool } from "./ScheduledMaintenanceTools";
+import {
+  GetOnCallStatusTool,
+  QueryOnCallPagesTool,
+  QueryOnCallPoliciesTool,
+} from "./OnCallTools";
+import {
+  QueryStatusPageAnnouncementsTool,
+  QueryStatusPagesTool,
+} from "./StatusPageTools";
+import { QuerySlosTool } from "./SloTools";
+import { QueryRunbooksTool } from "./RunbookTools";
+import { GetAlertTimelineTool, GetIncidentTimelineTool } from "./TimelineTools";
+import {
+  GetAIInvestigationTool,
+  QueryAIInsightsTool,
+  StartInvestigationTool,
+} from "./AIMetaTools";
+import { QueryProbesTool, QueryWorkflowsTool } from "./WorkflowProbeTools";
+import { QueryTeamsTool } from "./TeamTools";
+import { CreateAlertNoteTool, CreateIncidentNoteTool } from "./NoteWriteTools";
 import { TopExceptionsTool } from "./ExceptionTools";
 import { LogHistogramTool, SearchLogsTool } from "./LogTools";
 import { RecentChangesTool } from "./RecentChangesTools";
@@ -72,9 +92,33 @@ export default class AIToolbox {
     LookupContextTool,
     QueryIncidentsTool,
     SearchIncidentsTool,
+    GetIncidentTimelineTool,
+    GetAlertTimelineTool,
     QueryAlertsTool,
     QueryMonitorsTool,
     QueryScheduledMaintenanceTool,
+    /*
+     * Platform reads: the operational surface an on-call product exists to
+     * answer questions about — who is on call, what does the runbook say,
+     * what do customers see, is the error budget burning.
+     */
+    QueryOnCallPoliciesTool,
+    GetOnCallStatusTool,
+    QueryOnCallPagesTool,
+    QueryStatusPagesTool,
+    QueryStatusPageAnnouncementsTool,
+    QuerySlosTool,
+    QueryRunbooksTool,
+    QueryWorkflowsTool,
+    QueryProbesTool,
+    QueryTeamsTool,
+    /*
+     * The AI's own prior work: autonomous investigation results and insight
+     * findings. Chat reads these first instead of re-deriving a root cause
+     * the platform already posted.
+     */
+    GetAIInvestigationTool,
+    QueryAIInsightsTool,
     TopExceptionsTool,
     SearchLogsTool,
     LogHistogramTool,
@@ -102,6 +146,10 @@ export default class AIToolbox {
     RunRunbookTool,
     PostIncidentStatusUpdateTool,
     ChangeIncidentSeverityTool,
+    // Private notes (never notify status-page subscribers) + investigations.
+    CreateIncidentNoteTool,
+    CreateAlertNoteTool,
+    StartInvestigationTool,
     /*
      * Code writes (mutations). These never touch the default or a protected
      * branch — every chat-authored commit lands somewhere a human must still