tracer-sh 0.1.0 → 0.2.0

package/packages/server/dist/index.js

@@ -13,9 +13,13 @@ import {
   GCP_CROSS_SIGNAL,
   GCP_DOMAIN_KNOWLEDGE,
   GCP_INSIDE_OUT_DEBUGGING,
-  GCP_PAGE_SIZE_RULE,
-  GCP_TOOL_REFERENCE
+  GCP_PAGE_SIZE_RULE
 } from "./chunk-6QUU7TGZ.js";
+import {
+  POSTHOG_AUTH_STOP_RULE,
+  POSTHOG_DOMAIN_KNOWLEDGE,
+  POSTHOG_INSIDE_OUT_DEBUGGING
+} from "./chunk-ANVLQIEK.js";
 import {
   __commonJS,
   __export,
@@ -2748,6 +2752,7 @@ function formatTimestamps(results) {
 // ../shared/src/constants.ts
 var DEFAULT_SESSION_TITLE = "New chat";
 var DEFAULT_CHAT_MODE = "direct";
+var UNIFIED_SCOPE = "__unified__";
 var SESSION_PREFIX = {
   DASHBOARD: "__dashboard__",
   MONITORS: "__monitors__"
@@ -16549,16 +16554,6 @@ var ImportedAnalysisSchema = external_exports.object({
   parts: external_exports.array(external_exports.looseObject({ type: external_exports.string() })).max(200)
 });
 
-// ../shared/src/feature-flags.ts
-var FEATURES = {
-  /** Two-agent orchestrator mode (disabled — direct mode only). */
-  orchestratorMode: false,
-  /** Dashboard page with grid widgets. */
-  dashboards: false,
-  /** Monitor page with alerting. */
-  monitors: false
-};
-
 // src/config.ts
 var CONFIG = {
   /** HTTP server port. Override with TRACER_PORT env var. */
@@ -16569,7 +16564,7 @@ var CONFIG = {
   corsOrigin: process.env.TRACER_CORS_ORIGIN ?? null,
   // ── LLM defaults ──
   defaultChatModel: { provider: "google", modelId: "gemini-3.1-pro-preview" },
-  defaultSubAgentModel: { provider: "google", modelId: "gemini-3-flash-preview" },
+  defaultSubAgentModel: { provider: "google", modelId: "gemini-3.1-pro-preview" },
   defaultUtilityModel: { provider: "google", modelId: "gemini-3.1-flash-lite-preview" },
   /** Models that support thinking/reasoning tokens. */
   thinkingModels: /* @__PURE__ */ new Set(["gemini-3.1-pro-preview", "gemini-3-flash-preview"]),
@@ -16579,6 +16574,13 @@ var CONFIG = {
   mcpPingTimeoutMs: 5e3,
   // ── Agent result sizing ──
   maxModelResultChars: 8e3,
+  /**
+   * Code-level cap on the reasoning ("thinking") text a model may stream within a
+   * single step. Enforced in the stream loops (not just via the provider
+   * thinkingBudget, which models sometimes ignore and loop indefinitely) — when a
+   * step exceeds this, the stream is aborted programmatically. Reset each step.
+   */
+  maxReasoningCharsPerStep: 4e4,
   // ── Monitor scheduler ──
   monitorTickIntervalMs: 1e4,
   monitorQueryTimeoutMs: 3e4,
@@ -16602,7 +16604,6 @@ var DEFAULTS = {
 };
 var SETTINGS_KEYS = {
   chatModel: "chat_model",
-  chatMode: "chat_mode",
   timezone: "timezone",
   directModeMaxSteps: "direct_mode_max_steps",
   subAgentMaxSteps: "sub_agent_max_steps",
@@ -37857,6 +37858,25 @@ var _a20;
 _a20 = symbol20;
 var defaultDownload2 = createDownload();
 
+// src/agents/chat/sub-agent.ts
+var MEMORY_SECTION_NAME = "Corrections from Previous Sessions";
+function injectMemories(prompt, memoryContext) {
+  if (!memoryContext?.existingMemories.length) return prompt;
+  const lines = memoryContext.existingMemories.filter((m) => m.note).map((m) => `- ${m.note}`);
+  if (!lines.length) return prompt;
+  const memoryBlock = `
+
+## ${MEMORY_SECTION_NAME}
+These OVERRIDE any conflicting instructions above \u2014 they are verified fixes from past errors:
+${lines.join("\n")}
+`;
+  const firstBreak = prompt.indexOf("\n\n");
+  if (firstBreak !== -1) {
+    return prompt.slice(0, firstBreak) + memoryBlock + prompt.slice(firstBreak);
+  }
+  return memoryBlock + prompt;
+}
+
 // ../../node_modules/.pnpm/@ai-sdk+anthropic@3.0.71_zod@4.3.6/node_modules/@ai-sdk/anthropic/dist/index.mjs
 var VERSION5 = true ? "3.0.71" : "0.0.0-test";
 var anthropicErrorDataSchema = lazySchema(
@@ -45999,19 +46019,6 @@ function extractUsage(usage, model) {
     cacheWriteTokens: usage.inputTokenDetails?.cacheWriteTokens ?? 0
   };
 }
-function emptyUsage(model = "") {
-  return { model, inputTokens: 0, outputTokens: 0, reasoningTokens: 0, cachedInputTokens: 0, cacheWriteTokens: 0 };
-}
-function addTokenUsage(a, b) {
-  return {
-    model: a.model,
-    inputTokens: a.inputTokens + b.inputTokens,
-    outputTokens: a.outputTokens + b.outputTokens,
-    reasoningTokens: a.reasoningTokens + b.reasoningTokens,
-    cachedInputTokens: a.cachedInputTokens + b.cachedInputTokens,
-    cacheWriteTokens: a.cacheWriteTokens + b.cacheWriteTokens
-  };
-}
 function recordAgentRun(db2, opts) {
   try {
     db2.insert(agentRuns).values({
@@ -46127,7 +46134,8 @@ function createDeleteMemoryTool(memoryExecute, opts) {
 // src/agents/utility/memory-domain-knowledge.ts
 var DOMAIN_LOADERS = {
   newrelic: async () => (await import("./domain-knowledge-WHIEZOOH.js")).NR_DOMAIN_KNOWLEDGE,
-  gcp: async () => (await import("./domain-knowledge-V6AENXZV.js")).GCP_DOMAIN_KNOWLEDGE
+  gcp: async () => (await import("./domain-knowledge-V6AENXZV.js")).GCP_DOMAIN_KNOWLEDGE,
+  posthog: async () => (await import("./domain-knowledge-5JOEEXGN.js")).POSTHOG_DOMAIN_KNOWLEDGE
 };
 async function getDomainKnowledge(providerType) {
   const loader = DOMAIN_LOADERS[providerType];
@@ -46294,327 +46302,6 @@ ${tailInstruction}`;
   }
 }
 
-// src/lib/current-context.ts
-function getCurrentDateBlock(db2) {
-  const timezone = (db2 ? readAppSetting(db2, SETTINGS_KEYS.timezone) : null) ?? process.env.TRACER_TIMEZONE ?? DEFAULTS.timezone;
-  const now2 = /* @__PURE__ */ new Date();
-  const formatted = new Intl.DateTimeFormat("en-US", {
-    timeZone: timezone,
-    weekday: "long",
-    year: "numeric",
-    month: "long",
-    day: "numeric",
-    hour: "2-digit",
-    minute: "2-digit",
-    timeZoneName: "short"
-  }).format(now2);
-  return `## Current Date & Time
-${formatted}`;
-}
-
-// src/agents/chat/sub-agent.ts
-var MEMORY_SECTION_NAME = "Corrections from Previous Sessions";
-function injectMemories(prompt, memoryContext) {
-  if (!memoryContext?.existingMemories.length) return prompt;
-  const lines = memoryContext.existingMemories.filter((m) => m.note).map((m) => `- ${m.note}`);
-  if (!lines.length) return prompt;
-  const memoryBlock = `
-
-## ${MEMORY_SECTION_NAME}
-These OVERRIDE any conflicting instructions above \u2014 they are verified fixes from past errors:
-${lines.join("\n")}
-`;
-  const firstBreak = prompt.indexOf("\n\n");
-  if (firstBreak !== -1) {
-    return prompt.slice(0, firstBreak) + memoryBlock + prompt.slice(firstBreak);
-  }
-  return memoryBlock + prompt;
-}
-function subAgentModelOutput(output) {
-  if (!output) return { type: "text", value: "(no output)" };
-  if (typeof output === "object" && "error" in output) {
-    return { type: "text", value: output.error };
-  }
-  if (typeof output === "object" && "analysis" in output) {
-    return { type: "text", value: output.analysis };
-  }
-  return { type: "text", value: "(aborted)" };
-}
-async function runSubAgent(opts) {
-  const {
-    providerType,
-    db: db2,
-    systemPrompt,
-    task,
-    toolCallId,
-    queryTools,
-    queryToolNames,
-    collectedQueries,
-    memoryContext,
-    writer,
-    sessionId,
-    abortSignal
-  } = opts;
-  const resolved = resolveSubAgentModel(db2, providerType);
-  if ("error" in resolved) {
-    return { error: resolved.error };
-  }
-  const MAX_STEPS = opts.maxSteps ?? readAppSetting(db2, SETTINGS_KEYS.subAgentMaxSteps) ?? DEFAULTS.subAgentMaxSteps;
-  const startTime = Date.now();
-  const subAgentTools = { ...queryTools };
-  const fullSystemPrompt = injectMemories(systemPrompt, memoryContext) + "\n\n" + getCurrentDateBlock(db2);
-  const queryToolNameSet = new Set(queryToolNames);
-  const prompt = `Task: ${task}`;
-  const MAX_ATTEMPTS = 2;
-  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
-    collectedQueries.length = 0;
-    const isLastAttempt = attempt === MAX_ATTEMPTS - 1;
-    const activeWriter = isLastAttempt ? writer : void 0;
-    try {
-      const result = streamText({
-        model: resolved.model,
-        temperature: 0,
-        system: fullSystemPrompt,
-        prompt,
-        tools: subAgentTools,
-        stopWhen: stepCountIs(MAX_STEPS),
-        providerOptions: resolved.providerOptions,
-        experimental_transform: smoothStream({ chunking: "word" }),
-        abortSignal
-      });
-      let analysisText = "";
-      let stepCount = 0;
-      let lastFinishReason;
-      const parts = [];
-      for await (const part of result.fullStream) {
-        if (part.type === "tool-call" && queryToolNameSet.has(part.toolName)) {
-          activeWriter?.write({
-            type: "data-provider-part",
-            data: { toolCallId, part: { type: "tool-call", toolName: part.toolName } }
-          });
-        } else if (part.type === "tool-result" && queryToolNameSet.has(part.toolName)) {
-          const lastQuery = collectedQueries[collectedQueries.length - 1];
-          if (lastQuery) {
-            const qPart = { type: "query", query: lastQuery.query, results: lastQuery.results };
-            parts.push(qPart);
-            activeWriter?.write({
-              type: "data-provider-part",
-              data: { toolCallId, part: qPart }
-            });
-          }
-        } else if (part.type === "reasoning-delta") {
-          const lastPart = parts[parts.length - 1];
-          if (lastPart?.type === "reasoning") {
-            lastPart.content += part.text;
-          } else {
-            parts.push({ type: "reasoning", content: part.text });
-          }
-          activeWriter?.write({
-            type: "data-provider-part",
-            data: { toolCallId, part: { type: "reasoning-delta", delta: part.text } }
-          });
-        } else if (part.type === "text-delta") {
-          analysisText += part.text;
-          const lastPart = parts[parts.length - 1];
-          if (lastPart?.type === "text") {
-            lastPart.content += part.text;
-          } else {
-            parts.push({ type: "text", content: part.text });
-          }
-          activeWriter?.write({
-            type: "data-provider-part",
-            data: { toolCallId, part: { type: "text-delta", delta: part.text } }
-          });
-        } else if (part.type === "finish-step") {
-          stepCount++;
-          if ("finishReason" in part) {
-            lastFinishReason = part.finishReason;
-          }
-        }
-      }
-      const totalUsage = await result.totalUsage;
-      const investigationUsage = extractUsage(totalUsage, resolved.modelId);
-      const truncated = stepCount >= MAX_STEPS;
-      let extraUsage = emptyUsage(resolved.modelId);
-      if (truncated) {
-        let summary;
-        try {
-          const MAX_QUERY_CONTEXT = 12e3;
-          let queryContextLen = 0;
-          const querySummaries = collectedQueries.map((q, i) => {
-            if (queryContextLen >= MAX_QUERY_CONTEXT) return null;
-            const queryStr = q.query.slice(0, 300);
-            let resultSnippet;
-            const isErr = q.results && typeof q.results === "object" && "error" in q.results;
-            if (isErr) {
-              const errMsg = String(q.results.error ?? "unknown error").slice(0, 500);
-              resultSnippet = `ERROR: ${errMsg}`;
-            } else if (q.results != null) {
-              resultSnippet = JSON.stringify(q.results).slice(0, 500);
-            } else {
-              resultSnippet = "(no results)";
-            }
-            const entry = `<query index="${i + 1}">
-<request>${queryStr}</request>
-<result>${resultSnippet}</result>
-</query>`;
-            if (queryContextLen + entry.length > MAX_QUERY_CONTEXT) return null;
-            queryContextLen += entry.length;
-            return entry;
-          }).filter(Boolean).join("\n");
-          const summaryResult = await generateText({
-            model: resolved.model,
-            temperature: 0,
-            system: `You distill a truncated investigation into a factual briefing. The orchestrator has ZERO access to raw query results \u2014 your summary is its ONLY source of information. Everything not in this summary is permanently lost.
-
-Rules:
-- **Preserve every concrete data point.** Service names, error messages, counts, percentages, timestamps, trace IDs, hostnames, endpoints \u2014 if the investigation discovered it, include it. The orchestrator cannot recover data you omit.
-- **Distinguish observations from inferences.** If the sub-agent stated a conclusion, note whether it was directly supported by query data or was an inference. Flag any unsupported claims.
-- **Capture query patterns.** Which filters, field names, and syntax worked vs. failed \u2014 so follow-up calls avoid repeating mistakes.
-- **List remaining work as actionable tasks.** Each item must be a complete standalone brief with all necessary context (identifiers, filters, event types) so a fresh sub-agent could execute it immediately.
-- Complete all four sections fully \u2014 never cut off mid-sentence.
-- Do NOT repeat the original task description.`,
-            prompt: `<context>
-<task>${task}</task>
-<steps_used>${stepCount} of ${MAX_STEPS}</steps_used>
-<query_count>${collectedQueries.length}</query_count>
-</context>
-
-<queries>
-${querySummaries}
-</queries>
-
-<partial_analysis>
-${analysisText.slice(0, 1e4)}
-</partial_analysis>
-
-<instructions>
-Write exactly four sections. Every section must be complete \u2014 do not leave any sentence unfinished.
-
-1. **Completed work** \u2014 bullet list of what was queried and investigated
-2. **Key findings** \u2014 bullet list of specific data points, values, and conclusions discovered so far (include numbers, names, IDs). Label each bullet as [OBSERVATION] or [INFERENCE]. For inferences, cite the observation that supports it.
-3. **Query patterns** \u2014 which query syntax, field names, and filters returned valid results vs which ones failed or returned empty. Include the correct syntax so follow-up queries can reuse it.
-4. **Remaining work** \u2014 bullet list of concrete next-step queries or checks needed to finish the task. Each item must include all necessary identifiers so a fresh sub-agent can act immediately.
-</instructions>`,
-            maxOutputTokens: 6e3,
-            abortSignal
-          });
-          summary = summaryResult.text;
-          extraUsage = extractUsage(summaryResult.usage, resolved.modelId);
-        } catch {
-          const queryList = collectedQueries.map((q, i) => `${i + 1}. ${q.query.slice(0, 300)}`).join("\n");
-          summary = `Queries executed: ${collectedQueries.length}
-${queryList}`;
-        }
-        const notice = `
-
----
-**Investigation truncated** (${stepCount}/${MAX_STEPS} steps)
-
-${summary}
-
-*Consider a follow-up call with a focused task covering the remaining work.*`;
-        analysisText += notice;
-        const lastPart = parts[parts.length - 1];
-        if (lastPart?.type === "text") {
-          lastPart.content += notice;
-        } else {
-          parts.push({ type: "text", content: notice });
-        }
-        activeWriter?.write({
-          type: "data-provider-part",
-          data: { toolCallId, part: { type: "text-delta", delta: notice } }
-        });
-      }
-      for (let i = parts.length - 1; i >= 0; i--) {
-        if (parts[i].type === "text") {
-          parts[i].type = "summary";
-          activeWriter?.write({
-            type: "data-provider-part",
-            data: { toolCallId, part: { type: "mark-summary" } }
-          });
-          break;
-        }
-      }
-      const combinedUsage = addTokenUsage(investigationUsage, extraUsage);
-      const subAgentResult = {
-        analysis: analysisText,
-        parts,
-        truncated,
-        stepCount,
-        model: resolved.modelId,
-        provider: providerType,
-        inputTokens: combinedUsage.inputTokens,
-        outputTokens: combinedUsage.outputTokens,
-        reasoningTokens: combinedUsage.reasoningTokens,
-        cachedInputTokens: combinedUsage.cachedInputTokens,
-        cacheWriteTokens: combinedUsage.cacheWriteTokens
-      };
-      const resolvedSessionId = sessionId ?? writer?.sessionId;
-      const durationMs = Date.now() - startTime;
-      if (memoryContext) {
-        if (resolvedSessionId) {
-          db2.insert(memoryOperations).values({
-            sessionId: resolvedSessionId,
-            operation: "started"
-          }).run();
-        }
-        runMemoryAgent({
-          providerType,
-          db: db2,
-          existingMemories: memoryContext.existingMemories,
-          task,
-          analysisText,
-          collectedQueries,
-          sessionId: resolvedSessionId
-        }).catch((err) => {
-          console.warn(`[memory-agent] ${providerType} failed:`, err);
-        });
-      }
-      if (resolvedSessionId) {
-        recordAgentRun(db2, {
-          sessionId: resolvedSessionId,
-          agentType: providerType,
-          model: resolved.modelId,
-          usage: combinedUsage,
-          durationMs
-        });
-      }
-      const errorCount = collectedQueries.filter(
-        (q) => q.results && typeof q.results === "object" && "error" in q.results
-      ).length;
-      try {
-        db2.insert(subAgentRuns).values({
-          id: crypto.randomUUID(),
-          sessionId: resolvedSessionId ?? null,
-          provider: providerType,
-          task: task.slice(0, 500),
-          queryCount: collectedQueries.length,
-          errorCount,
-          stepCount,
-          truncated: truncated ? 1 : 0,
-          durationMs,
-          finishReason: lastFinishReason ?? null
-        }).run();
-      } catch (err) {
-        console.warn(`[sub-agent-telemetry] Failed to record run:`, err);
-      }
-      return subAgentResult;
-    } catch (err) {
-      if (abortSignal?.aborted || err instanceof Error && err.name === "AbortError") {
-        return { error: "Request was aborted." };
-      }
-      if (attempt === 0) {
-        console.warn(`[sub-agent] ${providerType} attempt 1 failed, retrying:`, err);
-        continue;
-      }
-      const message = err instanceof Error ? err.message : String(err);
-      return { error: `Sub-agent failed after 2 attempts: ${message}` };
-    }
-  }
-  return { error: "Sub-agent failed unexpectedly" };
-}
-
 // src/tools/provider-tool-helpers.ts
 function toolModelOutput(output) {
   if (output && typeof output === "object" && "analysis" in output) {
@@ -46629,6 +46316,7 @@ function buildAfterComplete(opts) {
   const { providerType, db: db2, memoryContext, collectedQueries } = opts;
   return (params) => {
     if (!db2 || !memoryContext) return;
+    if (collectedQueries.length === 0) return;
     const sessionId = params.sessionId;
     if (sessionId) {
       try {
@@ -46830,73 +46518,20 @@ function sanitizeNrqlRows(rows) {
 }
 
 // src/lib/shared-prompts.ts
-function buildOrchestratorPrompt(config2) {
-  return `You have access to ${config2.providerName} via the ${config2.toolName} tool. Pass it a complete task description \u2014 the sub-agent autonomously writes and executes ${config2.queryDescription}, handles errors, and returns analysis + raw results. May run concurrently with other provider tools.
-
-## CRITICAL: Sub-Agent Is Stateless
-
-Every call to the ${config2.toolName} tool spawns a FRESH sub-agent with ZERO memory of previous calls. It does not see prior conversation history, previous queries, or earlier findings. You MUST treat each call as if you are talking to the sub-agent for the very first time.
-
-### How to write a task
-Every task you pass to the tool must be **completely self-contained** \u2014 a standalone brief that makes sense with zero outside context. The sub-agent cannot see your conversation history, previous tool results, or anything else. It receives ONLY the task string you write.
+var UNIFIED_ROLE_INTRO = `You are Tracer, an observability expert in a direct conversation with a developer. You have DIRECT access to the query tools of multiple providers at once \u2014 each provider's syntax, fields, and debugging guidance are documented below. Pick the right provider(s) for each question; when a question spans providers, query them and correlate across the results in one investigation. You have full conversation history and can reference previous messages. You run as an AUTONOMOUS MULTI-STEP AGENT \u2014 after each tool call you automatically receive results and CAN (and often SHOULD) make additional tool calls before finishing.`;
+function buildUnifiedModePrompt(providerFragments, maxSteps) {
+  return `${UNIFIED_ROLE_INTRO}
 
-**Always include:**
-- **Concrete identifiers** found so far: service names, error messages, trace IDs, metric values, timestamps, hostnames, endpoints \u2014 copy them verbatim
-- **Environment**: prod / staging / dev \u2014 state it explicitly every time
-- **What was already tried**: which queries ran, what they returned, what didn't work \u2014 so the sub-agent doesn't repeat failed approaches
-- **What to investigate next**: the specific question this call should answer
-
-**Never do this:**
-- "Check the upstream service" \u2014 WHICH service? The sub-agent doesn't know.
-- "Look into those errors further" \u2014 WHICH errors? Repeat the error message and context.
-- "Continue the investigation" \u2014 there is nothing to continue. Start from scratch with full context.
-
-Think of each task as a memo to a colleague who just joined the project and knows nothing about what you've done so far.
-
-${config2.classifySection}
-
-${config2.contextSection}
-
-### Example
-${config2.example}
-
-## After the Sub-Agent Returns
-
-Results are shown in a rich UI automatically. Do NOT repeat raw data tables. Instead, write a **developer-ready incident report** \u2014 your response must contain enough detail that a developer can read it, fully understand what happened, and act on it without asking follow-up questions.
-
-**Your response MUST include:**
-1. **The full story** \u2014 what happened, step by step, as a chronological narrative. Include the request chain/call flow with service names, endpoints, timestamps, durations, status codes, and exact error messages at each hop. Quote error messages verbatim.
-2. **Scope and impact** \u2014 is this isolated or systemic? How many requests affected? When did it start?
-3. **Root cause** \u2014 if identified, with the evidence chain. If not yet identified, say what's known and what's missing.
-
-**Do NOT suggest fixes, solutions, or recommendations.** Your job is to present the facts so the developer can decide what to do.
-
-**Every claim needs its proof.** Never state a fact without showing where it came from.
-
-**Never give a vague summary.** Be specific: exact error messages, counts, timestamps, service names.
-
-If the answer is partial, truncated, or needs deeper investigation \u2014 call the tool again. The next sub-agent starts completely blank: no memory, no context, no history. Your follow-up task must be a **complete standalone brief** containing:
-1. **All findings so far** \u2014 concrete values: metric numbers, service names, trace IDs, error messages, timestamps
-2. **What was already queried** \u2014 successful query patterns and filters, plus what failed and why
-3. **The specific next question** \u2014 what this new sub-agent should investigate
-
-If you don't carry forward findings, the next sub-agent will repeat the same queries and waste its step budget rediscovering what you already know.
-
-## Detective Discipline: Track Every Lead
+## Rules
+${buildRules({ investigation: true })}
 
-You are the detective stitching the case together across stateless sub-agents. Each sub-agent sees one piece; you see the whole board.
+${DETECTIVE_MINDSET}
 
-**After every sub-agent return:**
-1. **Catalog new identifiers** \u2014 extract every trace ID, service name, error class, endpoint, and timestamp from the sub-agent's response. Add them to your running list.
-2. **Check for uninvestigated leads** \u2014 compare your identifier list against what has been searched. Any identifier that was discovered but not yet queried in context is an open lead.
-3. **Never conclude with open leads** \u2014 if there are uninvestigated identifiers, call the tool again with a task that searches them. A conclusion built on partial evidence is wrong until proven otherwise.
-4. **Build the cross-call narrative** \u2014 sub-agents cannot connect their own findings to previous calls. You must synthesize: "Sub-agent 1 found error X in service A with traceId T. Sub-agent 2 traced T and found the root cause in service B." This stitching is YOUR job.
+${EXECUTION_DISCIPLINE}
 
-The task is **done** when it either:
-- Answers the user's question with concrete data, OR
-- Concludes it cannot be answered, citing specific evidence (e.g. "no events for this service", "field doesn't exist") \u2014 not vague "no data found."
+${providerFragments.join("\n\n---\n\n")}
 
-Never ask "Should I proceed?" \u2014 the user asked you to investigate, so investigate.`;
+${buildAnalysisSection(maxSteps)}`;
 }
 function buildRules(opts) {
   const rules = [
@@ -46943,44 +46578,10 @@ For multi-step investigations:
 4. **\u2192 Can I answer now?** \u2014 If YES: respond. If NO: state what's missing.
 
 For simple questions (counts, lookups), skip this \u2014 just answer directly.`;
-function buildExecutionLoop(exampleSteps) {
-  return `### Query Efficiency
-
-**Pack information per query.** Combine fields, use grouping to get breakdowns. One well-crafted query replaces three lazy ones.
-**Empty results = wrong query, not missing data.** Check field names, time range, and filters. Pivot \u2014 don't retry the same approach.
-**No speculation.** If a query returns empty or partial data, state what was searched and what was not found. Say "insufficient data to determine X" \u2014 never invent explanations for missing data.
-
-### Execution Loop
-
-After writing the plan, repeat for each step:
-
-1. **Step N: [Goal]** \u2014 state what gap this query fills
-2. **Tool call** \u2192 ONE query
-3. **\u2192 Found:** [concrete data] **\u2192 So what:** [one-sentence inference]
-4. **\u2192 Can I answer now?** \u2014 If YES: write final response immediately. If NO: state what's still missing and continue.
-
-${exampleSteps}
-
-**STOP when "Done when" criteria are met.** Do NOT add "confirmation" or "completeness" queries.`;
-}
-function buildPlanFormat(scopeLabel, scopeDescription) {
-  return `### Plan format
-\`\`\`
-**${scopeLabel}:** ${scopeDescription}
-**Reasoning:** [what's your most specific fact, hypothesis, approach]
-
-**Plan** (N steps):
-1. [Goal \u2014 what to find] \u2192 starting point
-2. [Goal \u2014 what to learn from step 1's results]
-...
-
-**Done when:** [success criteria]
-\`\`\``;
-}
-function analysisBlock(marker26) {
-  const markerAction = marker26 === "text" ? "write `<analysis>` on its own line **before anything else**" : "call the `begin_analysis` tool **before writing anything**";
-  const markerStep = marker26 === "text" ? "`<analysis>` (on its own line \u2014 nothing before it except your investigation steps)" : "Call `begin_analysis` tool (nothing before it except your investigation steps)";
-  const markerRef = marker26 === "text" ? "this marker" : "this tool";
+function analysisBlock() {
+  const markerAction = "call the `begin_analysis` tool **before writing anything**";
+  const markerStep = "Call `begin_analysis` tool (nothing before it except your investigation steps)";
+  const markerRef = "this tool";
   return `When you are ready to present your findings, ${markerAction}. Do NOT write any summary or findings before ${markerRef} \u2014 everything the user reads must come after it. The UI renders everything after it with distinct styling.
 
 ### Structure your response as:
@@ -47000,35 +46601,10 @@ function analysisBlock(marker26) {
 - Each tool call in the analysis should show different data from the others \u2014 different metric, different time slice, different service, or different grouping.
 - ${NO_FIXES_RULE}`;
 }
-function buildFinalResponse(maxSteps) {
-  const wrapAt = maxSteps - 5;
-  return `## Final Response
-
-${analysisBlock("text")}
-
-## Step Budget
-
-You have a maximum of ${maxSteps} steps. If approaching step ${wrapAt}, wrap up immediately with what you have.`;
-}
-function buildDirectFinalResponse(maxSteps) {
-  return `## Response Format
-
-Your queries render visually in the UI \u2014 the user can see the results. Write a concise answer that references the visual results rather than repeating data.
-
-After your queries, write:
-1. **Answer**: Concrete answer with actual values \u2014 timestamps, names, counts, IDs. Include all relevant identifiers (service names, trace IDs, endpoints) so the orchestrator has them for follow-up.
-2. **Caveats** (optional): If the answer is incomplete, state what's missing and why. Omit if complete.
-
-Be specific: "Last login: 2024-01-15 14:30 UTC via payment-service" not "a recent login was found".
-
-${NO_FIXES_RULE}
-
-You have a maximum of ${maxSteps} steps.`;
-}
 function buildAnalysisSection(maxSteps) {
   return `## Response Format
 
-${analysisBlock("tool")}
+${analysisBlock()}
 - For simple questions, the query results themselves are the visual evidence \u2014 just add a brief text answer.
 
 ## Step Budget
@@ -47041,42 +46617,19 @@ You have a maximum of ${maxSteps} steps. Most investigations should finish in 3-
 }
 
 // src/lib/prompt-builder.ts
-function buildDirectSubAgentPrompt(config2) {
-  return `${config2.directRoleIntro}
-
-${config2.authStopRule}
-
-## Rules
-${buildRules({ investigation: false, extraRules: config2.extraRules })}
-
-${config2.domainKnowledge}
-
-${buildDirectFinalResponse(config2.subAgentMaxSteps)}
-
-Raw results are returned separately to the UI.`;
-}
-function buildInvestigateSubAgentPrompt(config2) {
+function buildUnifiedModeFragment(config2) {
   const extra = config2.extraSections?.length ? "\n\n" + config2.extraSections.join("\n\n") : "";
-  return `${config2.investigateRoleIntro}
+  const rules = config2.extraRules?.length ? `
 
-${config2.authStopRule}
+### ${config2.providerName} query rules
+` + config2.extraRules.map((r, i) => `${i + 1}. ${r}`).join("\n") : "";
+  return `# ${config2.providerName}
 
-## CRITICAL RULES
-${buildRules({ investigation: true, extraRules: config2.extraRules })}
-
-${DETECTIVE_MINDSET}
+${config2.authStopRule}
 
 ${config2.insideOutDebugging}
 
-${config2.planningPhase}
-
-${buildExecutionLoop(config2.executionLoopExample)}
-
-${config2.domainKnowledge}${extra}
-
-${buildFinalResponse(config2.subAgentMaxSteps)}
-
-Raw results are returned separately to the UI.`;
+${config2.domainKnowledge}${extra}${rules}`;
 }
 function buildDirectModePrompt(config2) {
   const extra = config2.extraSections?.length ? "\n\n" + config2.extraSections.join("\n\n") : "";
@@ -47105,76 +46658,11 @@ var NR_CONFIG = {
   authStopRule: NR_AUTH_STOP_RULE,
   domainKnowledge: NR_DOMAIN_KNOWLEDGE,
   insideOutDebugging: NR_INSIDE_OUT_DEBUGGING,
-  directRoleIntro: `You are a New Relic NRQL query specialist. Answer data lookups in 1-3 queries \u2014 counts, lists, metric checks. Do NOT investigate root causes.
-
-## Approach
-Answer exactly what was asked. Do NOT add unrelated analysis unless asked.
-Pack information: use FACET for breakdowns, multiple SELECTs for multiple metrics \u2014 get the most from each query.
-If initial results are sparse, try other event types (Transaction \u2192 TransactionError \u2192 Log) before concluding.
-If your first 2 queries return empty, verify data exists: \`SELECT count(*) FROM Transaction SINCE 1 day ago\`.`,
-  investigateRoleIntro: `You are a New Relic incident investigator. You run as an AUTONOMOUS MULTI-STEP AGENT \u2014 after each tool call you automatically receive results and CAN (and often SHOULD) make additional tool calls before finishing. You trace root causes across event types, correlate signals, and build evidence chains.`,
-  planningPhase: `### Planning Phase
-Before your first query, write a SHORT plan (2-4 sentences max). Think:
-1. **What's the most specific fact I have?** \u2014 Start there. Never start broad when you have something specific.
-2. **What's the minimum I need to answer?** \u2014 Usually: the error, the service, and whether it's isolated or systemic. That's often 2-3 queries, not 10.
-3. **When do I stop?** \u2014 Define your "done when" criteria BEFORE starting.
-
-Begin your FIRST response with the plan, followed by your first tool call.
-
-${buildPlanFormat("Environment", "[prod/staging/dev]")}
-
-### Example plan
-\`\`\`
-**Environment:** production
-**Reasoning:** I have a concrete settlement ID (830189). Search TransactionError directly for it \u2014 probably in error.message or request.uri. If found, I have the error + context. Only expand to trace chain if the error alone doesn't explain the cause.
-
-**Plan** (3 steps):
-1. Search TransactionError for "830189" \u2014 get error details, appName, traceId
-2. If error is clear (e.g. validation failure) \u2192 done. If ambiguous (e.g. timeout) \u2192 trace the request chain via traceId
-3. Count similar errors to determine scope (isolated vs pattern)
-
-**Done when:** Error message, failing service, and whether it's isolated or systemic.
-\`\`\``,
-  executionLoopExample: `**Step 1: Search TransactionError for ID 830189**
-\u2192 call execute_nrql with: SELECT \\\`error.message\\\`, \\\`error.class\\\`, appName, traceId, timestamp FROM TransactionError WHERE \\\`error.message\\\` LIKE '%830189%' OR request.uri LIKE '%830189%' SINCE 24 hours ago LIMIT 10
-**\u2192 Found:** 3 events: appName=payment-prod, error.class=SettlementException, error.message="pool exhausted, 50/50 connections", traceId=abc123, 14:28-14:31 UTC.
-**\u2192 So what:** Connection pool exhaustion in payment-prod caused the settlement failure. The error is self-explanatory \u2014 no need to trace the request chain.
-**\u2192 Can I answer now?** Almost \u2014 need to know if this is isolated or systemic.
-**Step 2: Count similar errors to check scope**
-\u2192 call execute_nrql with: SELECT count(*) FROM TransactionError WHERE appName = 'payment-prod' AND \\\`error.class\\\` = 'SettlementException' SINCE 1 hour ago TIMESERIES 5 minutes
-**\u2192 Found:** 47 identical errors in last hour, all payment-prod, all "pool exhausted".
-**\u2192 So what:** Systemic \u2014 not isolated to settlement 830189. Connection pool is saturated.
-**\u2192 Can I answer now?** YES \u2014 switch to evidence presentation.`,
   directModeRoleIntro: `You are a New Relic expert having a direct conversation with a developer. You have full conversation history and can reference previous messages. Handle both simple lookups and multi-step investigations depending on what the user asks. You run as an AUTONOMOUS MULTI-STEP AGENT \u2014 after each tool call you automatically receive results and CAN (and often SHOULD) make additional tool calls before finishing.`,
-  subAgentMaxSteps: DEFAULTS.subAgentMaxSteps,
   directModeMaxSteps: DEFAULTS.directModeMaxSteps
 };
-var directSubAgentPrompt = buildDirectSubAgentPrompt(NR_CONFIG);
-var investigateSubAgentPrompt = buildInvestigateSubAgentPrompt(NR_CONFIG);
 var directModeSystemPrompt = buildDirectModePrompt(NR_CONFIG);
-var newRelicSystemPrompt = buildOrchestratorPrompt({
-  providerName: "New Relic",
-  toolName: "nrql",
-  queryDescription: "NRQL queries",
-  classifySection: `## Crafting the Task
-
-### 1. Classify and set directive
-- **DIRECT** (lookup, count, metric check, "how many", "what is", "list"): \`directive="DIRECT"\`
-- **INVESTIGATE** (root-cause, tracing, "why", "debug", "failing", cross-ref): \`directive="INVESTIGATE"\`
-- **Ambiguous** ("something is slow"): Ask the user to narrow scope before calling the tool.
-
-If a DIRECT call returns insufficient results, re-call with \`directive="INVESTIGATE"\` and a more focused task.`,
-  contextSection: `### 2. Extract ALL context \u2014 the sub-agent only knows what you tell it
-- **Environment**: prod/staging/dev \u2014 pass explicitly
-- **Identifiers**: IDs, error messages, user names, URLs, trace IDs \u2014 verbatim
-- **Service/endpoint**: if mentioned
-- **Timeframe**: if stated`,
-  example: `User: "settlement endpoint failing in prod, settlement id 830189"
-\u2192 nrql({ directive: "INVESTIGATE", task: "Find errors related to settlement ID 830189. Environment: production. Look in TransactionError for this ID in error.message or request.uri." })
-
-User: "how many errors in the last hour?"
-\u2192 nrql({ directive: "DIRECT", task: "Count total errors in the last hour." })`
-});
+var nrUnifiedFragment = buildUnifiedModeFragment(NR_CONFIG);
 
 // src/providers/newrelic/tools.ts
 function buildExecuteNrqlTool(provider, collectedQueries, writer) {
@@ -47215,42 +46703,6 @@ function createNewRelicDirectTools(provider, memoryContext, writer, db2) {
     afterComplete: buildAfterComplete({ providerType: "newrelic", db: db2, memoryContext, collectedQueries })
   };
 }
-function createNewRelicTools(provider, memoryContext, writer, db2) {
-  return {
-    nrql: tool({
-      description: "Investigate New Relic data by describing WHAT you want to find out. A sub-agent will autonomously write and execute NRQL queries, handle error recovery, and save lessons learned. Results are AUTOMATICALLY displayed to the user in a rich UI \u2014 NEVER repeat or reformat them in your text response. If the sub-agent's analysis includes a question, use conversation context to answer it or ask the user.",
-      inputSchema: external_exports.object({
-        task: external_exports.string().describe("A clear description of what to investigate (e.g. 'find recent errors and their root causes', 'check latency for /api/users endpoint in the last hour')"),
-        directive: external_exports.enum(["DIRECT", "INVESTIGATE"]).describe(
-          "DIRECT for simple lookups/counts. INVESTIGATE for root-cause analysis, tracing, cross-referencing."
-        )
-      }),
-      execute: async ({ task, directive }, { toolCallId, abortSignal }) => {
-        if (!db2) {
-          return { error: "Database not available for model resolution." };
-        }
-        const collectedQueries = [];
-        const executeNrql = buildExecuteNrqlTool(provider, collectedQueries);
-        const systemPrompt = directive === "DIRECT" ? directSubAgentPrompt : investigateSubAgentPrompt;
-        return runSubAgent({
-          providerType: "newrelic",
-          db: db2,
-          systemPrompt,
-          task,
-          toolCallId,
-          queryTools: { execute_nrql: executeNrql },
-          queryToolNames: ["execute_nrql"],
-          collectedQueries,
-          memoryContext,
-          writer,
-          sessionId: writer?.sessionId,
-          abortSignal
-        });
-      },
-      toModelOutput: ({ output }) => subAgentModelOutput(output)
-    })
-  };
-}
 
 // src/providers/newrelic/newrelic.provider.ts
 var NewRelicProvider = class extends BaseProvider {
@@ -47339,29 +46791,17 @@ var NewRelicProvider = class extends BaseProvider {
     return response.data?.actor.account.nrql.results ?? [];
   }
   getChatTools(options) {
-    if (options.mode === "direct") {
-      const direct = createNewRelicDirectTools(
-        this,
-        options.memoryContext,
-        options.writer,
-        options.db
-      );
-      return {
-        tools: direct.tools,
-        systemPrompt: direct.systemPrompt,
-        maxSteps: NR_DIRECT_MODE_MAX_STEPS,
-        afterComplete: direct.afterComplete
-      };
-    }
-    const tools = createNewRelicTools(
+    const direct = createNewRelicDirectTools(
       this,
       options.memoryContext,
       options.writer,
       options.db
     );
     return {
-      tools,
-      promptFragments: [newRelicSystemPrompt]
+      tools: direct.tools,
+      maxSteps: NR_DIRECT_MODE_MAX_STEPS,
+      afterComplete: direct.afterComplete,
+      ...options.mode === "unified" ? { promptFragments: [nrUnifiedFragment] } : { systemPrompt: direct.systemPrompt }
     };
   }
 };
@@ -49926,188 +49366,6 @@ function deserializeMessage(line) {
   return JSONRPCMessageSchema2.parse(JSON.parse(line));
 }
 
-// src/mcp/mcp-tools.ts
-function extractMcpContent(result) {
-  if (result && typeof result === "object" && !Array.isArray(result)) {
-    const r = result;
-    if (Array.isArray(r.content)) {
-      const texts = r.content.filter((c) => c.type === "text" && typeof c.text === "string").map((c) => c.text);
-      if (texts.length > 0) {
-        const combined = texts.join("\n").trim();
-        try {
-          return JSON.parse(combined);
-        } catch {
-          return combined;
-        }
-      }
-    }
-  }
-  return result;
-}
-function detectTruncation(normalized) {
-  const str = typeof normalized === "string" ? normalized : JSON.stringify(normalized);
-  return str.includes("truncated due to") && str.includes("character limit");
-}
-function isTransportError(err) {
-  if (!(err instanceof Error)) return false;
-  const msg = err.message.toLowerCase();
-  return msg.includes("transport") || msg.includes("disconnected") || msg.includes("econnreset") || msg.includes("epipe") || msg.includes("channel closed") || msg.includes("process exited") || msg.includes("not connected") || msg.includes("econnrefused");
-}
-var MAX_MODEL_RESULT_CHARS = CONFIG.maxModelResultChars;
-function buildModelResult(normalized) {
-  if (Array.isArray(normalized)) {
-    const total = normalized.length;
-    for (const count of [5, 3, 2, 1]) {
-      const sample = normalized.slice(0, count);
-      const payload = count < total ? { count: total, results: sample, note: `Showing ${count} of ${total}. Full results displayed in the UI.` } : { count: total, results: sample };
-      const json4 = JSON.stringify(payload);
-      if (json4.length <= MAX_MODEL_RESULT_CHARS) return json4;
-    }
-    return JSON.stringify({ count: total, note: "Results too large to include inline. Full results displayed in the UI." });
-  }
-  const json3 = typeof normalized === "string" ? normalized : JSON.stringify(normalized);
-  if (json3.length <= MAX_MODEL_RESULT_CHARS) return json3;
-  return json3.slice(0, MAX_MODEL_RESULT_CHARS) + `... [truncated \u2014 full results displayed in the UI]`;
-}
-function wrapMcpTools(mcpTools, provider) {
-  const collectedQueries = [];
-  const mcpToolNames = Object.keys(mcpTools);
-  const wrappedTools = {};
-  for (const [name26, mcpTool] of Object.entries(mcpTools)) {
-    const originalExecute = mcpTool.execute.bind(mcpTool);
-    wrappedTools[name26] = {
-      ...mcpTool,
-      execute: async (input, context2) => {
-        const queryStr = typeof input === "string" ? input : JSON.stringify(input).slice(0, 500);
-        const execArgs = context2?.abortSignal ? [input, { abortSignal: context2.abortSignal }] : [input];
-        try {
-          const result = await originalExecute(...execArgs);
-          const normalized = extractMcpContent(result);
-          if (detectTruncation(normalized)) {
-            const errorMsg = `The result exceeded the server's size limit and was discarded. To fix this:
-1. Reduce pageSize (use 5-10, never exceed 20)
-2. Add more specific filters to narrow results
-3. Request fewer fields or a shorter time range
-Retry with a more targeted query.`;
-            collectedQueries.push({ query: `${name26}: ${queryStr}`, results: { error: errorMsg } });
-            return { content: [{ type: "text", text: errorMsg }] };
-          }
-          collectedQueries.push({ query: `${name26}: ${queryStr}`, results: normalized });
-          return { content: [{ type: "text", text: buildModelResult(normalized) }] };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          collectedQueries.push({ query: `${name26}: ${queryStr}`, results: { error: message } });
-          if (isTransportError(err)) {
-            provider.invalidateTools();
-          }
-          return { error: message };
-        }
-      }
-    };
-  }
-  return { wrappedTools, mcpToolNames, collectedQueries };
-}
-function createMcpChatTools(provider, definition, options) {
-  const { writer, memoryContext, db: db2 } = options;
-  const toolName = provider.type;
-  const orchestratorPrompt = buildOrchestratorPrompt({
-    providerName: definition.label,
-    toolName,
-    queryDescription: "MCP tool calls",
-    classifySection: `## Crafting the Task
-
-The sub-agent has access to ${definition.label} MCP tools. Describe WHAT you want to find out \u2014 the sub-agent will choose the right MCP tools autonomously.
-
-For simple lookups, be direct. For complex investigations, provide full context.`,
-    contextSection: `### Extract ALL context \u2014 the sub-agent only knows what you tell it
-- **Environment**: prod/staging/dev \u2014 pass explicitly
-- **Identifiers**: IDs, error messages, user names, URLs, trace IDs \u2014 verbatim
-- **Service/endpoint**: if mentioned
-- **Timeframe**: if stated`,
-    example: `User: "check recent errors in production"
-\u2192 ${toolName}({ task: "Find recent errors in production. List error messages, counts, affected services, and timestamps." })
-
-User: "why is the checkout endpoint slow?"
-\u2192 ${toolName}({ task: "Investigate latency issues on the checkout endpoint. Environment: production. Look for slow transactions, error patterns, and upstream dependencies." })`
-  });
-  const tools = {
-    [toolName]: tool({
-      description: `Investigate ${definition.label} data by describing WHAT you want to find out. A sub-agent will autonomously use MCP tools to query data, handle error recovery, and return analysis + raw results. Results are AUTOMATICALLY displayed to the user in a rich UI \u2014 NEVER repeat or reformat them in your text response.`,
-      inputSchema: external_exports.object({
-        task: external_exports.string().describe(
-          "A clear description of what to investigate \u2014 include all relevant context, identifiers, environment, and timeframe."
-        )
-      }),
-      execute: async ({ task }, { toolCallId, abortSignal }) => {
-        if (!db2) {
-          return { error: "Database not available for model resolution." };
-        }
-        let mcpTools;
-        try {
-          mcpTools = await provider.getMcpTools();
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          return { error: `Failed to discover MCP tools: ${msg}` };
-        }
-        if (!mcpTools || Object.keys(mcpTools).length === 0) {
-          return { error: "No MCP tools available from the server." };
-        }
-        const { wrappedTools, mcpToolNames, collectedQueries } = wrapMcpTools(mcpTools, provider);
-        const toolDescriptions = mcpToolNames.map((name26) => {
-          const t2 = mcpTools[name26];
-          const desc2 = t2?.description ?? "(no description)";
-          return `- **${name26}**: ${desc2}`;
-        }).join("\n");
-        const maxSteps = readAppSetting(db2, SETTINGS_KEYS.subAgentMaxSteps) ?? DEFAULTS.subAgentMaxSteps;
-        const systemPrompt = `You are an autonomous agent with access to ${definition.label} via MCP tools. Use the tools below to answer the user's question.
-
-## Available Tools
-${toolDescriptions}
-
-## Rules
-1. **ONE tool call per response.** Write a 1-2 sentence summary of the result before the next call.
-2. **Empty results \u2260 no data.** It means the query or parameters may be wrong \u2014 adjust and retry.
-3. **NEVER repeat a failed call with the same arguments.** Read the error, fix the cause.
-4. You MUST write a non-empty text response when done \u2014 the user sees your text as the analysis.
-5. Check "${MEMORY_SECTION_NAME}" if present \u2014 these override conflicting instructions above.
-
-${definition.systemPromptHint ?? ""}
-
-## Response Format
-
-Your final text is the ONLY thing the orchestrator sees \u2014 raw results are stripped. Write a complete answer.
-
-After ALL tool calls, you MUST write:
-1. **Tools used**: Each tool call and what it found (1 line each). Mark failures inline: \`FAILED: [reason]\`.
-2. **Key findings**: Concrete values \u2014 metric numbers, error messages, service names, timestamps, IDs, counts.
-3. **Remaining questions** (optional): What you could NOT answer and what to try next.
-
-You have a maximum of ${maxSteps} steps.`;
-        return runSubAgent({
-          providerType: provider.type,
-          db: db2,
-          systemPrompt,
-          task,
-          toolCallId,
-          queryTools: wrappedTools,
-          queryToolNames: mcpToolNames,
-          collectedQueries,
-          memoryContext,
-          writer,
-          maxSteps,
-          sessionId: writer?.sessionId,
-          abortSignal
-        });
-      },
-      toModelOutput: ({ output }) => subAgentModelOutput(output)
-    })
-  };
-  return {
-    tools,
-    promptFragments: [orchestratorPrompt]
-  };
-}
-
 // src/mcp/mcp-provider.ts
 var McpProvider = class extends BaseProvider {
   constructor(definition, config2, providerType) {
@@ -50219,8 +49477,12 @@ var McpProvider = class extends BaseProvider {
       throw err;
     }
   }
-  getChatTools(options) {
-    return createMcpChatTools(this, this.definition, options);
+  /**
+   * Base MCP providers expose no chat tools by default — concrete MCP-backed
+   * providers (e.g. GCP) override this with their own direct query tools.
+   */
+  getChatTools(_options) {
+    return { tools: {} };
   }
   // Structured data methods — MCP-backed providers expose data through tool calls, not these typed APIs.
   async getErrors(_timeRange) {
@@ -50540,47 +49802,33 @@ function formatGcpResult(toolName, data) {
     }
   }
 }
-var MAX_MODEL_RESULT_CHARS2 = CONFIG.maxModelResultChars;
-function buildGcpModelResult(toolName, normalized) {
-  const formatted = formatGcpResult(toolName, normalized);
-  if (formatted.length <= MAX_MODEL_RESULT_CHARS2) return formatted;
-  return formatted.slice(0, MAX_MODEL_RESULT_CHARS2) + "\n\n*[truncated \u2014 full results displayed in the UI]*";
-}
-function wrapGcpMcpTools(mcpTools, provider) {
-  const collectedQueries = [];
-  const mcpToolNames = Object.keys(mcpTools);
-  const wrappedTools = {};
-  for (const [name26, mcpTool] of Object.entries(mcpTools)) {
-    const originalExecute = mcpTool.execute.bind(mcpTool);
-    wrappedTools[name26] = {
-      ...mcpTool,
-      execute: async (input, context2) => {
-        const queryStr = typeof input === "string" ? input : JSON.stringify(input).slice(0, 500);
-        const execArgs = context2?.abortSignal ? [input, { abortSignal: context2.abortSignal }] : [input];
+
+// src/mcp/mcp-tools.ts
+function extractMcpContent(result) {
+  if (result && typeof result === "object" && !Array.isArray(result)) {
+    const r = result;
+    if (Array.isArray(r.content)) {
+      const texts = r.content.filter((c) => c.type === "text" && typeof c.text === "string").map((c) => c.text);
+      if (texts.length > 0) {
+        const combined = texts.join("\n").trim();
         try {
-          const result = await originalExecute(...execArgs);
-          const normalized = extractMcpContent(result);
-          if (detectTruncation(normalized)) {
-            const errorMsg = `The result exceeded the server's size limit and was discarded. To fix this:
-1. Reduce pageSize (use 5-10, never exceed 20)
-2. Add more specific filters to narrow results
-3. Request fewer fields or a shorter time range
-Retry with a more targeted query.`;
-            collectedQueries.push({ query: `${name26}: ${queryStr}`, results: { error: errorMsg } });
-            return { content: [{ type: "text", text: errorMsg }] };
-          }
-          collectedQueries.push({ query: `${name26}: ${queryStr}`, results: normalized });
-          return { content: [{ type: "text", text: buildGcpModelResult(name26, normalized) }] };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          collectedQueries.push({ query: `${name26}: ${queryStr}`, results: { error: message } });
-          if (isTransportError(err)) provider.invalidateTools();
-          return { error: message };
+          return JSON.parse(combined);
+        } catch {
+          return combined;
         }
       }
-    };
+    }
   }
-  return { wrappedTools, mcpToolNames, collectedQueries };
+  return result;
+}
+function detectTruncation(normalized) {
+  const str = typeof normalized === "string" ? normalized : JSON.stringify(normalized);
+  return str.includes("truncated due to") && str.includes("character limit");
+}
+function isTransportError(err) {
+  if (!(err instanceof Error)) return false;
+  const msg = err.message.toLowerCase();
+  return msg.includes("transport") || msg.includes("disconnected") || msg.includes("econnreset") || msg.includes("epipe") || msg.includes("channel closed") || msg.includes("process exited") || msg.includes("not connected") || msg.includes("econnrefused");
 }
 
 // src/providers/gcp/gcp-auth.ts
@@ -50676,50 +49924,9 @@ var GCP_CONFIG = {
   domainKnowledge: GCP_DOMAIN_KNOWLEDGE,
   insideOutDebugging: GCP_INSIDE_OUT_DEBUGGING,
   extraSections: [GCP_CROSS_SIGNAL],
-  directRoleIntro: `You are a Google Cloud observability expert. Answer the question completely and efficiently using the available GCP observability MCP tools (Cloud Logging, Cloud Monitoring, Cloud Trace, Error Reporting).`,
-  investigateRoleIntro: `You are a Google Cloud incident investigator. You run as an AUTONOMOUS MULTI-STEP AGENT \u2014 after each tool call you automatically receive results and CAN (and often SHOULD) make additional tool calls before finishing. You trace root causes across logs, metrics, traces, and error groups.`,
-  planningPhase: `### Planning Phase
-Before your first tool call, write a SHORT plan. Think:
-1. **Which signal to start with?** \u2014 Logs (specific errors), Error Reporting (grouped patterns), Metrics (trends), Traces (latency)?
-2. **Most specific starting fact?** \u2014 A service name, error message, trace ID?
-3. **When do I stop?** \u2014 Define your "done when" criteria BEFORE starting.
-
-Begin your FIRST response with the plan, followed by your first tool call.
-
-${buildPlanFormat("Scope", "[project/service/time range \u2014 determines query filtering]")}
-
-### Example plan
-\`\`\`
-**Scope:** project=my-project-123, Cloud Run service=my-service
-**Reasoning:** Service is crashing \u2014 check recent error logs first, then error groups for patterns, then OOM metrics.
-
-**Plan** (3 steps):
-1. Pull recent ERROR logs for the Cloud Run service
-2. Check Error Reporting for grouped crash patterns
-3. Query memory/CPU metrics to check for OOM
-
-**Done when:** Root cause of crashes identified (OOM, startup failure, dependency error, etc.).
-\`\`\``,
-  executionLoopExample: `**Step 1: Pull recent error logs for the service**
-\u2192 call list_log_entries with filter: resource.type="cloud_run_revision" AND resource.labels.service_name="my-service" AND severity>=ERROR
-**\u2192 Found:** 47 ERROR entries in the last hour, top message "Container memory limit of 512Mi exceeded", service=my-service, revision=my-service-00042-abc.
-**\u2192 So what:** The service is OOMKilling due to memory pressure.
-**\u2192 Can I answer now?** Not yet \u2014 need to determine if this is a memory leak (gradual) or traffic spike (sudden).
-**Step 2: Check memory metrics**
-\u2192 call list_time_series with metric: run.googleapis.com/container/memory/utilizations
-**\u2192 Found:** Memory usage climbed steadily from 60% to 100% over 3 hours before the first OOM.
-**\u2192 So what:** Gradual memory increase suggests a leak, not a traffic spike.
-**\u2192 Can I answer now?** YES \u2014 switch to evidence presentation.`,
   directModeRoleIntro: `You are a Google Cloud observability expert having a direct conversation with a developer. You have access to Cloud Logging, Cloud Monitoring, Cloud Trace, and Error Reporting via MCP tools. You have full conversation history and can reference previous messages. You run as an AUTONOMOUS MULTI-STEP AGENT \u2014 after each tool call you automatically receive results and CAN (and often SHOULD) make additional tool calls before finishing.`,
-  subAgentMaxSteps: DEFAULTS.subAgentMaxSteps,
   directModeMaxSteps: DEFAULTS.directModeMaxSteps
 };
-var GCP_INVESTIGATE_CONFIG = {
-  ...GCP_CONFIG,
-  extraSections: [GCP_CROSS_SIGNAL, GCP_TOOL_REFERENCE]
-};
-var directSystemPrompt = buildDirectSubAgentPrompt(GCP_CONFIG);
-var investigateSystemPrompt = buildInvestigateSubAgentPrompt(GCP_INVESTIGATE_CONFIG);
 var gcpDirectModeSystemPrompt = buildDirectModePrompt(GCP_CONFIG);
 function buildProjectConstraint(projectId) {
   if (!projectId) return "";
@@ -50729,85 +49936,11 @@ You MUST use ONLY project ID \`${projectId}\` for ALL tool calls.
 NEVER guess, infer, or try alternative project IDs. If a tool call fails for this project, report the error \u2014 do NOT retry with a different project name.
 `;
 }
-var gcpSystemPrompt = buildOrchestratorPrompt({
-  providerName: "Google Cloud (GCP)",
-  toolName: "gcloud",
-  queryDescription: "GCP observability API calls",
-  classifySection: `## Crafting the Task
-
-### 1. Classify and set directive
-- **DIRECT** (fetch logs, list error groups, query a metric, "how many", "show me recent errors"): \`directive="DIRECT"\`
-- **INVESTIGATE** (multi-step debugging, root-cause, cross-signal correlation, "why", "failing"): \`directive="INVESTIGATE"\`
-- **Ambiguous** ("something is wrong"): Ask the user to narrow scope before calling the tool.
-
-If a DIRECT call returns insufficient results, re-call with \`directive="INVESTIGATE"\` and a more focused task.`,
-  contextSection: `### 2. Extract ALL context \u2014 the sub-agent only knows what you tell it
-- **Project**: The GCP project ID is pre-configured in settings \u2014 the sub-agent already knows it. Do NOT ask the user for a project ID; omit it from your task description unless the user explicitly mentions a different one.
-- **Service/resource**: Cloud Run service name, GKE cluster, function name, etc.
-- **Identifiers**: error messages, trace IDs, log filter strings \u2014 verbatim
-- **Timeframe**: if stated (e.g., "last hour", "since yesterday")`,
-  example: `User: "why is my Cloud Run service crashing in prod project my-project-123"
-\u2192 gcloud({ directive: "INVESTIGATE", task: "Investigate why Cloud Run service is crashing. Project: my-project-123. Start by pulling recent ERROR logs for Cloud Run, then check error groups and any relevant metrics." })
-
-User: "show me recent errors"
-\u2192 gcloud({ directive: "DIRECT", task: "List recent error log entries. Filter: severity>=ERROR, last 1 hour." })`
-});
+function buildGcpUnifiedFragment(projectId) {
+  return buildUnifiedModeFragment(GCP_CONFIG) + buildProjectConstraint(projectId);
+}
 
 // src/providers/gcp/tools.ts
-function createGcpTools(provider, memoryContext, writer, db2, projectId) {
-  const projectConstraint = buildProjectConstraint(projectId);
-  const tools = {
-    gcloud: tool({
-      description: "Investigate Google Cloud observability data by describing WHAT you want to find out. A sub-agent will autonomously query Cloud Logging, Cloud Monitoring, Cloud Trace, and Error Reporting via MCP tools, handle errors, and return analysis + raw results. Results are AUTOMATICALLY displayed to the user in a rich UI \u2014 NEVER repeat or reformat them in your text response.",
-      inputSchema: external_exports.object({
-        task: external_exports.string().describe(
-          "A clear description of what to investigate (e.g. 'show recent errors for my Cloud Run service', 'investigate why error rate spiked in project my-project')"
-        ),
-        directive: external_exports.enum(["DIRECT", "INVESTIGATE"]).describe(
-          "DIRECT for simple lookups/lists/describes. INVESTIGATE for root-cause analysis, multi-step debugging."
-        )
-      }),
-      execute: async ({ task, directive }, { toolCallId, abortSignal }) => {
-        if (!db2) {
-          return { error: "Database not available for model resolution." };
-        }
-        const auth2 = await getGcpAuth();
-        if (!auth2.ok) return { error: auth2.message };
-        let mcpTools;
-        try {
-          mcpTools = await provider.getMcpTools();
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          return { error: `Failed to discover GCP MCP tools: ${msg}` };
-        }
-        if (!mcpTools || Object.keys(mcpTools).length === 0) {
-          return { error: "No GCP MCP tools available from the server." };
-        }
-        const { wrappedTools, mcpToolNames, collectedQueries } = wrapGcpMcpTools(mcpTools, provider);
-        const systemPrompt = (directive === "DIRECT" ? directSystemPrompt : investigateSystemPrompt) + projectConstraint;
-        return runSubAgent({
-          providerType: "gcp",
-          db: db2,
-          systemPrompt,
-          task,
-          toolCallId,
-          queryTools: wrappedTools,
-          queryToolNames: mcpToolNames,
-          collectedQueries,
-          memoryContext,
-          writer,
-          sessionId: writer?.sessionId,
-          abortSignal
-        });
-      },
-      toModelOutput: ({ output }) => subAgentModelOutput(output)
-    })
-  };
-  return {
-    tools,
-    promptFragments: [gcpSystemPrompt]
-  };
-}
 function createGcpDirectTools(provider, memoryContext, writer, db2, projectId) {
   const projectConstraint = buildProjectConstraint(projectId);
   const rawMcpTools = provider.getCachedTools();
@@ -50887,22 +50020,299 @@ var GcpProvider = class extends McpProvider {
     return super.ping();
   }
   getChatTools(options) {
-    if (options.mode === "direct") {
-      const direct = createGcpDirectTools(
-        this,
-        options.memoryContext,
-        options.writer,
-        options.db,
-        this.config.projectId
-      );
-      return {
-        tools: direct.tools,
-        systemPrompt: direct.systemPrompt,
-        maxSteps: GCP_DIRECT_MODE_MAX_STEPS,
-        afterComplete: direct.afterComplete
-      };
+    const direct = createGcpDirectTools(
+      this,
+      options.memoryContext,
+      options.writer,
+      options.db,
+      this.config.projectId
+    );
+    const hasTools = Object.keys(direct.tools).length > 0;
+    return {
+      tools: direct.tools,
+      maxSteps: GCP_DIRECT_MODE_MAX_STEPS,
+      afterComplete: direct.afterComplete,
+      ...options.mode === "unified" ? hasTools ? { promptFragments: [buildGcpUnifiedFragment(this.config.projectId)] } : {} : { systemPrompt: direct.systemPrompt }
+    };
+  }
+};
+
+// src/providers/posthog/posthog.client.ts
+var DEFAULT_HOST = "https://us.posthog.com";
+var PosthogClient = class {
+  apiKey;
+  projectId;
+  host;
+  constructor(apiKey, projectId, host) {
+    this.apiKey = apiKey;
+    this.projectId = projectId;
+    this.host = (host?.trim() || DEFAULT_HOST).replace(/\/+$/, "");
+  }
+  async query(hogql) {
+    const response = await fetch(`${this.host}/api/projects/${this.projectId}/query/`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.apiKey}`
+      },
+      body: JSON.stringify({
+        query: { kind: "HogQLQuery", query: hogql },
+        name: "tracer"
+      }),
+      signal: AbortSignal.timeout(35e3)
+    });
+    if (!response.ok) {
+      let detail = `${response.status} ${response.statusText}`;
+      try {
+        const body = await response.json();
+        detail = body.detail ?? body.error ?? detail;
+      } catch {
+      }
+      throw new Error(`PostHog query failed: ${detail}`);
+    }
+    const result = await response.json();
+    if (result.error) {
+      throw new Error(`PostHog query error: ${result.error}`);
+    }
+    return result;
+  }
+};
+
+// src/providers/posthog/posthog-formatter.ts
+function rowsToObjects(resp) {
+  const { columns, results } = resp;
+  if (!Array.isArray(results) || !Array.isArray(columns)) return [];
+  return results.map((row) => {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return obj;
+  });
+}
+function fmtVal3(v) {
+  if (v == null) return "";
+  if (typeof v === "number") return Number.isInteger(v) ? String(v) : v.toFixed(2);
+  if (Array.isArray(v)) return v.length <= 5 ? v.join("; ") : `[${v.length} items]`;
+  if (typeof v === "object") return JSON.stringify(v);
+  return String(v);
+}
+function csvEscape2(val) {
+  if (val.includes(",") || val.includes('"') || val.includes("\n")) {
+    return `"${val.replace(/"/g, '""')}"`;
+  }
+  return val;
+}
+function formatHogqlCsv(rows) {
+  if (rows.length === 0) return "No results.";
+  const headers = Object.keys(rows[0]);
+  let displayRows = rows;
+  let note = "";
+  if (rows.length > 10) {
+    displayRows = rows.slice(0, 10);
+    note = `
+(${rows.length - 10} more rows omitted)`;
+  }
+  const hdr = headers.map(csvEscape2).join(",");
+  const body = displayRows.map((r) => headers.map((k) => csvEscape2(fmtVal3(r[k]))).join(",")).join("\n");
+  return `${hdr}
+${body}${note}`;
+}
+
+// src/providers/posthog/queries.ts
+function esc2(value) {
+  return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+function timeExpr(value) {
+  const v = value.trim().toLowerCase();
+  if (v === "today") return "toStartOfDay(now())";
+  if (v === "yesterday") return "toStartOfDay(now()) - interval 1 day";
+  const rel = v.match(/^(\d+)\s+(second|minute|hour|day|week|month)s?\s+ago$/);
+  if (rel) return `now() - interval ${rel[1]} ${rel[2]}`;
+  if (/\d{4}-\d{2}-\d{2}/.test(value)) return `toDateTime('${esc2(value.trim())}')`;
+  return "now() - interval 24 hour";
+}
+function timeFilter(since, until) {
+  const sinceExpr = since ? timeExpr(since) : "now() - interval 24 hour";
+  const untilClause = until ? ` AND timestamp <= ${timeExpr(until)}` : "";
+  return ` AND timestamp >= ${sinceExpr}${untilClause}`;
+}
+function errorQuery2(since, until) {
+  return `SELECT
+  coalesce(properties.$exception_list[1].type, properties.$exception_type) AS error_class,
+  coalesce(properties.$exception_list[1].value, properties.$exception_message) AS message,
+  properties.$exception_fingerprint AS fingerprint,
+  count() AS count,
+  min(timestamp) AS first_seen,
+  max(timestamp) AS last_seen
+FROM events
+WHERE event = '$exception'${timeFilter(since, until)}
+GROUP BY error_class, message, fingerprint
+ORDER BY count DESC
+LIMIT 100`;
+}
+function transactionQuery2(since, until) {
+  return `SELECT
+  coalesce(properties.$pathname, properties.$current_url) AS name,
+  count() AS throughput
+FROM events
+WHERE event = '$pageview'${timeFilter(since, until)}
+GROUP BY name
+ORDER BY throughput DESC
+LIMIT 100`;
+}
+function logQuery2(since, filter2, until) {
+  const filterClause = filter2 ? ` AND (event ILIKE '%${esc2(filter2)}%' OR properties.$current_url ILIKE '%${esc2(filter2)}%')` : "";
+  return `SELECT timestamp, event, properties.$current_url AS url, distinct_id
+FROM events
+WHERE 1 = 1${timeFilter(since, until)}${filterClause}
+ORDER BY timestamp DESC
+LIMIT 200`;
+}
+
+// src/providers/posthog/prompts.ts
+var POSTHOG_DIRECT_MODE_MAX_STEPS = DEFAULTS.directModeMaxSteps;
+var POSTHOG_CONFIG = {
+  providerName: "PostHog",
+  authStopRule: POSTHOG_AUTH_STOP_RULE,
+  domainKnowledge: POSTHOG_DOMAIN_KNOWLEDGE,
+  insideOutDebugging: POSTHOG_INSIDE_OUT_DEBUGGING,
+  directModeRoleIntro: `You are a PostHog expert having a direct conversation with a developer. You have full conversation history and can reference previous messages. Handle both simple lookups and multi-step investigations depending on what the user asks. You run as an AUTONOMOUS MULTI-STEP AGENT \u2014 after each tool call you automatically receive results and CAN (and often SHOULD) make additional tool calls before finishing.`,
+  directModeMaxSteps: DEFAULTS.directModeMaxSteps
+};
+var directModeSystemPrompt2 = buildDirectModePrompt(POSTHOG_CONFIG);
+var posthogUnifiedFragment = buildUnifiedModeFragment(POSTHOG_CONFIG);
+
+// src/providers/posthog/tools.ts
+function buildExecuteHogqlTool(provider, collectedQueries, writer) {
+  return tool({
+    description: "Execute a HogQL query against PostHog.",
+    inputSchema: external_exports.object({
+      query: external_exports.string().describe("The HogQL query to execute")
+    }),
+    execute: async ({ query }, { toolCallId }) => {
+      try {
+        const rows = await provider.executeRawQuery(query);
+        collectedQueries.push({ query, results: rows });
+        writer?.write({
+          type: "data-provider-part",
+          data: { toolCallId, part: { type: "query", query, results: rows } }
+        });
+        const csv = formatHogqlCsv(rows);
+        return { parts: [{ type: "query", query, results: rows }], analysis: csv };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        collectedQueries.push({ query, results: { error: message } });
+        return { error: message };
+      }
+    },
+    toModelOutput: ({ output }) => toolModelOutput(output)
+  });
+}
+function createPosthogDirectTools(provider, memoryContext, writer, db2) {
+  const collectedQueries = [];
+  return {
+    tools: {
+      execute_hogql: buildExecuteHogqlTool(provider, collectedQueries, writer),
+      [ANALYSIS_TOOL_NAME]: beginAnalysisTool
+    },
+    systemPrompt: injectMemories(directModeSystemPrompt2, memoryContext),
+    afterComplete: buildAfterComplete({ providerType: "posthog", db: db2, memoryContext, collectedQueries })
+  };
+}
+
+// src/providers/posthog/posthog.provider.ts
+var PosthogProvider = class extends BaseProvider {
+  name = "posthog";
+  type = "posthog";
+  client;
+  constructor(config2) {
+    super();
+    this.client = new PosthogClient(config2.apiKey, config2.projectId, config2.host);
+  }
+  async initialize() {
+    await this.testConnection();
+  }
+  async testConnection() {
+    try {
+      await this.client.query("SELECT 1");
+      this.connected = true;
+      this.lastChecked = (/* @__PURE__ */ new Date()).toISOString();
+      return true;
+    } catch {
+      this.connected = false;
+      this.lastChecked = (/* @__PURE__ */ new Date()).toISOString();
+      return false;
     }
-    return createGcpTools(this, options.memoryContext, options.writer, options.db, this.config.projectId);
+  }
+  async ping() {
+    try {
+      await this.client.query("SELECT 1");
+      this.connected = true;
+      this.lastChecked = (/* @__PURE__ */ new Date()).toISOString();
+      return { ok: true };
+    } catch (err) {
+      this.connected = false;
+      this.lastChecked = (/* @__PURE__ */ new Date()).toISOString();
+      return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+  }
+  async dispose() {
+    this.connected = false;
+  }
+  async getErrors(timeRange) {
+    const rows = rowsToObjects(await this.client.query(errorQuery2(timeRange.since, timeRange.until)));
+    return rows.map((r, i) => ({
+      id: `ph-err-${i}`,
+      appName: "",
+      // PostHog has no service/app dimension
+      errorClass: String(r.error_class ?? "Unknown"),
+      message: String(r.message ?? ""),
+      count: Number(r.count ?? 0),
+      firstSeen: String(r.first_seen ?? ""),
+      lastSeen: String(r.last_seen ?? ""),
+      transactionName: String(r.fingerprint ?? ""),
+      // exception fingerprint (dedup key)
+      provider: "posthog"
+    }));
+  }
+  async getTransactions(timeRange) {
+    const rows = rowsToObjects(await this.client.query(transactionQuery2(timeRange.since, timeRange.until)));
+    return rows.map((r) => ({
+      name: String(r.name ?? "Unknown"),
+      avgDuration: 0,
+      throughput: Number(r.throughput ?? 0),
+      errorRate: 0,
+      provider: "posthog"
+    }));
+  }
+  async getLogs(timeRange, filter2) {
+    const rows = rowsToObjects(await this.client.query(logQuery2(timeRange.since, filter2, timeRange.until)));
+    return rows.map((r) => ({
+      timestamp: String(r.timestamp ?? ""),
+      level: "info",
+      // PostHog events have no severity level
+      message: String(r.event ?? ""),
+      attributes: { url: r.url, distinct_id: r.distinct_id },
+      provider: "posthog"
+    }));
+  }
+  async executeRawQuery(query) {
+    return rowsToObjects(await this.client.query(query));
+  }
+  getChatTools(options) {
+    const direct = createPosthogDirectTools(
+      this,
+      options.memoryContext,
+      options.writer,
+      options.db
+    );
+    return {
+      tools: direct.tools,
+      maxSteps: POSTHOG_DIRECT_MODE_MAX_STEPS,
+      afterComplete: direct.afterComplete,
+      ...options.mode === "unified" ? { promptFragments: [posthogUnifiedFragment] } : { systemPrompt: direct.systemPrompt }
+    };
   }
 };
 
@@ -50960,6 +50370,24 @@ function registerDefaultProviders(providers) {
       configFields: []
     }
   );
+  providers.registerFactory(
+    "posthog",
+    (cfg) => new PosthogProvider({
+      type: "posthog",
+      apiKey: cfg.apiKey,
+      projectId: cfg.projectId,
+      host: cfg.host
+      // default (us.posthog.com) applied in PosthogClient
+    }),
+    {
+      label: "PostHog",
+      configFields: [
+        { key: "apiKey", label: "Personal API Key", type: "password" },
+        { key: "projectId", label: "Project ID", type: "text" },
+        { key: "host", label: "Host", type: "text", required: false }
+      ]
+    }
+  );
 }
 
 // src/trpc/context.ts
@@ -56759,17 +56187,6 @@ var settingsRouter = router({
     writeAppSetting(ctx.db, SETTINGS_KEYS.chatModel, { provider: input.provider, modelId: input.modelId });
     return { success: true };
   }),
-  getChatMode: publicProcedure.query(({ ctx }) => {
-    if (!FEATURES.orchestratorMode) return DEFAULT_CHAT_MODE;
-    return readAppSetting(ctx.db, SETTINGS_KEYS.chatMode) ?? DEFAULT_CHAT_MODE;
-  }),
-  saveChatMode: publicProcedure.input(external_exports.enum(["orchestrator", "direct"])).mutation(({ ctx, input }) => {
-    if (!FEATURES.orchestratorMode && input === "orchestrator") {
-      return { success: false };
-    }
-    writeAppSetting(ctx.db, SETTINGS_KEYS.chatMode, input);
-    return { success: true };
-  }),
   getSubAgentModel: publicProcedure.input(external_exports.string().describe("Provider type, e.g. 'newrelic'")).query(({ ctx, input }) => {
     return readAppSetting(ctx.db, subAgentModelKey(input)) ?? null;
   }),
@@ -56975,6 +56392,7 @@ var AGENT_TYPE_LABELS = {
   chat: "Chat",
   newrelic: "New Relic sub-agent",
   gcp: "GCP sub-agent",
+  posthog: "PostHog sub-agent",
   title: "Title gen",
   memory: "Memory"
 };
@@ -57633,6 +57051,24 @@ var StreamBroadcaster = class {
   }
 };
 
+// src/lib/current-context.ts
+function getCurrentDateBlock(db2) {
+  const timezone = (db2 ? readAppSetting(db2, SETTINGS_KEYS.timezone) : null) ?? process.env.TRACER_TIMEZONE ?? DEFAULTS.timezone;
+  const now2 = /* @__PURE__ */ new Date();
+  const formatted = new Intl.DateTimeFormat("en-US", {
+    timeZone: timezone,
+    weekday: "long",
+    year: "numeric",
+    month: "long",
+    day: "numeric",
+    hour: "2-digit",
+    minute: "2-digit",
+    timeZoneName: "short"
+  }).format(now2);
+  return `## Current Date & Time
+${formatted}`;
+}
+
 // src/agents/base-agent.ts
 function sanitizeMessages(messages) {
   return messages.map((msg) => {
@@ -57688,7 +57124,7 @@ async function processLLMStream(sessionId, messages, context2, broadcaster, serv
 
 If a tool call fails, retry with a corrected approach. If you fail the same tool call twice, DO NOT retry again \u2014 stop and explain the issue to the user. Ask clarifying questions if needed. Never silently give up.
 
-When the user's question spans multiple providers, call the relevant provider tools IN PARALLEL in the same step. Each runs independently with its own sub-agent. After all complete, synthesize findings across providers.`;
+When the user's question spans multiple providers, query each relevant provider and synthesize findings across the results.`;
     const fragments = collected.promptFragments ?? [];
     systemPrompt = fragments.length > 0 ? `${basePrompt}
 
@@ -57777,11 +57213,23 @@ No observability providers are currently configured. If the user asks about obse
     }
   });
   const reader = uiStream.getReader();
+  let reasoningChars = 0;
   try {
     while (true) {
       const { done, value } = await reader.read();
       if (done) break;
-      const { providerMetadata: _, ...clean } = value;
+      const v = value;
+      if (v.type === "start-step") {
+        reasoningChars = 0;
+      } else if (v.type === "reasoning-delta" && typeof v.delta === "string") {
+        reasoningChars += v.delta.length;
+        if (reasoningChars > CONFIG.maxReasoningCharsPerStep) {
+          console.warn(`[chat] reasoning exceeded ${CONFIG.maxReasoningCharsPerStep} chars in one step \u2014 aborting ${sessionId}`);
+          serverAbort.abort();
+          break;
+        }
+      }
+      const { providerMetadata: _, ...clean } = v;
       broadcaster.emit(clean);
     }
   } catch (err) {
@@ -57890,7 +57338,15 @@ function collectBaseTools(registry2, db2, writer, mode, activeProvider) {
       }
     }
   }
-  const systemPrompt = systemPrompts.length > 0 ? systemPrompts.join("\n\n---\n\n") : void 0;
+  const systemPrompt = mode === "unified" ? promptFragments.length > 0 ? injectMemories(
+    buildUnifiedModePrompt(promptFragments, maxSteps ?? DEFAULTS.directModeMaxSteps),
+    // Unified holds every connected provider's tools, so surface all their memories
+    // (direct mode injects the active provider's memories via its own systemPrompt).
+    {
+      toolName: "unified",
+      existingMemories: memories.filter((m) => connectedProviders.some((p) => p.type === m.toolName))
+    }
+  ) : void 0 : systemPrompts.length > 0 ? systemPrompts.join("\n\n---\n\n") : void 0;
   const afterComplete = afterCompleteCallbacks.length > 0 ? (params) => {
     for (const cb of afterCompleteCallbacks) cb(params);
   } : void 0;
@@ -57898,8 +57354,7 @@ function collectBaseTools(registry2, db2, writer, mode, activeProvider) {
 }
 
 // src/tools/chat-tools.ts
-function collectChatTools(registry2, db2, writer, activeProvider) {
-  const mode = readAppSetting(db2, "chat_mode") ?? DEFAULT_CHAT_MODE;
+function collectChatTools(registry2, db2, writer, activeProvider, mode = DEFAULT_CHAT_MODE) {
   const { tools, promptFragments, systemPrompt, maxSteps, afterComplete, connectedProviders } = collectBaseTools(registry2, db2, writer, mode, activeProvider);
   if (connectedProviders.length === 0) {
     return { tools: void 0, promptFragments: [] };
@@ -58597,13 +58052,15 @@ function registerChatRoutes(app, context2) {
         generateSessionTitle(context2.db, id, textPart.text);
       }
     }
-    const mode = readAppSetting(context2.db, SETTINGS_KEYS.chatMode) ?? DEFAULT_CHAT_MODE;
-    const modelOverride = mode === "direct" && activeProvider ? resolveSubAgentModel(context2.db, activeProvider) : void 0;
+    const isUnified = activeProvider === UNIFIED_SCOPE;
+    const mode = isUnified ? "unified" : "direct";
+    const scopedProvider = isUnified ? void 0 : activeProvider;
+    const modelOverride = mode === "direct" && scopedProvider ? resolveSubAgentModel(context2.db, scopedProvider) : void 0;
     const result = await runChatAgent({
       sessionId: id,
       messages,
       context: context2,
-      collectTools: (writer) => collectChatTools(context2.providers, context2.db, writer, activeProvider),
+      collectTools: (writer) => collectChatTools(context2.providers, context2.db, writer, scopedProvider, mode),
       sessionTitle: (updatedMessages) => {
         const firstUserMsg = updatedMessages.find((m) => m.role === "user");
         const textPart = firstUserMsg?.parts.find((p) => p.type === "text");