tracer-sh 0.3.3 → 0.3.5

package/README.md

@@ -10,14 +10,32 @@ During an incident, most time goes to switching between observability tools
 and gathering context — not fixing the problem. Tracer connects your providers
 to a single AI chat interface so you find the root cause in one place.
 
+## How it works
+
+```
+┌─────────┐       your API keys         ┌──────────────────┐
+│         │ ◄──────────────────────────►│  Observability   │
+│ Tracer  │                             │  Providers       │
+│  local  │       your API keys         ├──────────────────┤
+│         │ ◄──────────────────────────►│  LLM Providers   │
+└─────────┘                             └──────────────────┘
+```
+
+Everything runs on your machine. Your data stays local in an encrypted SQLite
+database. Tracer talks directly to your provider and LLM APIs using your own
+API keys — no intermediary servers, no telemetry, no data leaves your machine
+except the API calls you control.
+
 ## Debug
 
-Chat with an AI agent that queries your providers in real-time and finds root causes — all from a single conversation.
+Chat with an AI agent that queries your providers in real time and finds root
+causes — all from a single conversation.
 
-- Natural language investigation
+- Natural language investigation across all connected providers
 - Live query execution with inline charts
+- Attach evidence to any message — screenshots, log files, code, PDFs — via paperclip, drag-and-drop, or paste
 - Post-mortem reports — download as Markdown to share
-- Share investigations as PNG — drop the exported image back into Tracer to re-open the analysis
+- Share investigations as PNG — drop the exported image onto the sidebar to re-open the full analysis
 - Agent memory across sessions
 - Session history and cost tracking
 
@@ -25,65 +43,26 @@ Chat with an AI agent that queries your providers in real-time and finds root ca
 
 ## Settings
 
-Configure providers, LLM credentials, agent behavior, and memory. All data is stored locally — nothing leaves your machine except the API calls you configure.
+Configure providers, LLM credentials, integrations, and agent behavior. Each
+provider setup includes connectivity tests and guidance on creating
+least-privilege API keys.
 
-- Anthropic (Claude) and Google (Gemini) API keys
+- LLM backends: Anthropic (Claude), Google (Gemini via AI Studio or Vertex AI)
 - Data provider setup with connectivity tests
+- Jira integration
 - Thinking budgets and step limits
 - Agent memory management
 
 ![Settings page](docs/screenshots/settings_page.png)
 
-## How it works
-
-```
-┌─────────┐       your API keys         ┌──────────────────┐
-│         │ ◄──────────────────────────►│  Observability   │
-│ Tracer  │                             │  Providers       │
-│  local  │       your API keys         ├──────────────────┤
-│         │ ◄──────────────────────────►│  LLM Providers   │
-└─────────┘                             └──────────────────┘
-```
-
-Everything runs on your machine. Your data stays local in an encrypted SQLite
-database. Tracer talks directly to your provider and LLM APIs using your own API
-keys — no intermediary servers, no data leaves your machine except API calls you control.
-
-## Security
+## Supported providers
 
-Tracer is built **defense-in-depth**: your secrets — provider and LLM API keys,
-integration tokens, chat history, and agent memory — sit behind several independent
-layers, so no single failure exposes them.
-
-- **Local-only.** Nothing leaves your machine except the provider and LLM API calls you configure. No Tracer servers, no telemetry, no sync.
-- **Encrypted at rest.** The entire SQLite database is encrypted with SQLCipher (AES-256). On disk it is ciphertext — a stolen laptop, a copied `.db` file, or a backup is useless without the key.
-- **Machine-bound, user-scoped key.** A random 256-bit key is generated on first run and stored in your OS keychain (macOS Keychain, Windows Credential Manager, or Linux Secret Service). It never leaves the machine and is scoped to your OS user, so another user on the same box can't read the database either.
-- **Hardened on disk.** The data directory is created owner-only (`0700`); if no keychain is available, the fallback key file is written `0600`.
-
-**Automatic and transparent.** New installs are encrypted from the first run. An
-existing plaintext database is migrated on the first launch of this version — the
-encrypted copy is verified and atomically swapped in, and no plaintext is left behind.
-There's nothing to enable.
-
-**CI / headless.** Where no keychain exists, supply the key yourself with
-`TRACER_DB_KEY` — a 64-character hex string (e.g. `openssl rand -hex 32`).
-
-**What this protects — and what it doesn't.** Encryption at rest defends the file
-(theft, backups, copies) and blocks other users on the same machine. It does **not**
-defend against you, the logged-in user, running code as yourself: the app must hold the
-key at runtime to read its own data, so anyone controlling your user session can too. No
-local-first app escapes this — it's the honest boundary of on-device encryption.
+**Data:** New Relic (NRQL), Google Cloud (Logs, Traces, Metrics, Errors), PostHog (HogQL)
 
-**Key loss means data loss.** Because the key lives only in your keychain, losing it (an
-OS reinstall or keychain reset) makes the database unrecoverable. For a safety net, back
-up the `tracer-sh` / `db-key` keychain value somewhere secure.
+**LLM:** Anthropic (Claude), Google (Gemini — AI Studio or Vertex AI)
 
-**Verify it yourself.** The raw file should be unreadable without the key:
-
-```bash
-sqlite3 ~/.tracer/data/tracer.db '.tables'    # → "Error: file is not a database"
-head -c 16 ~/.tracer/data/tracer.db | od -c   # → random bytes, not "SQLite format 3"
-```
+**Integrations:** Jira — the agent reads issue details and comment threads for
+incident context, and posts comments back only when you explicitly ask.
 
 ## Install
 
@@ -95,8 +74,6 @@ Requires [Node.js 20+](https://nodejs.org/).
 npx tracer-sh@latest
 ```
 
-`npx` is ephemeral — it runs the newest published version on every launch and isn't a pinned version.
-
 **Install a pinned copy:**
 
 ```bash
@@ -104,42 +81,69 @@ npm install -g tracer-sh
 tracer-sh
 ```
 
-The first run gets the latest version; it then stays on that version until you explicitly update — either with **Update now** in the app (click the version in the sidebar) or by re-running the install.
-
-**Which should I pick?** Use the global install if you want a stable version that only changes when you choose; use `npx` to always grab the newest with zero install.
+Either way, Tracer stays on its installed version until you explicitly update:
+click the version in the sidebar and hit **Update now**, or re-run the install
+command. Note that bare `npx tracer-sh` reuses npm's cached copy and does NOT
+check for new releases — use the in-app update or `npx tracer-sh@latest` to get
+the newest version.
 
-Open `http://localhost:3579`, go to **Settings** to add your API keys and choose an LLM — done.
+Open `http://localhost:3579`, go to **Settings** to add your API keys and
+choose an LLM — done.
 
 ## Headless / CLI
 
-Run an investigation from the terminal and get back the final analysis — so other tools and agents (including Claude Code) can drive Tracer:
+Run an investigation from the terminal and get back the final analysis — so
+other tools and agents (including Claude Code) can drive Tracer:
 
 ```bash
 tracer-sh analyze "Why did checkout error rate spike after 14:00 UTC?"
 ```
 
-Continue a prior run with `--session <id>`; pass `--json` for the full response (session id, queries, usage). Requires a running server.
+- `--session <id>` — continue a prior run with full context
+- `--provider <name>` — scope the investigation to one provider
+- `--json` — full response envelope (session id, queries, usage)
+- `tracer-sh --help` — usage for every subcommand
 
-## Supported Providers
+Requires a running server.
 
-**Data:** New Relic (NRQL), Google Cloud (Logs, Traces, Metrics, Errors), PostHog (HogQL)
+## Security
 
-**LLM:** Anthropic (Claude), Google (Gemini)
+Your secrets — API keys, integration tokens, chat history, agent memory — sit
+behind several independent layers:
 
-## Uninstall
+- **Local-only.** No Tracer servers, no telemetry, no sync.
+- **Encrypted at rest.** The entire SQLite database is encrypted with SQLCipher (AES-256). A stolen laptop, a copied `.db` file, or a backup is ciphertext without the key.
+- **Machine-bound, user-scoped key.** A random 256-bit key is generated on first run and stored in your OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service). It never leaves the machine and other OS users can't read it.
+- **Hardened on disk.** The data directory is owner-only (`0700`); a keychain-less fallback key file is `0600`.
+
+Encryption is automatic — new installs are encrypted from the first run, and
+an existing plaintext database is migrated in place on first launch. In CI or
+headless environments without a keychain, supply the key yourself via
+`TRACER_DB_KEY` (64-char hex, e.g. `openssl rand -hex 32`).
+
+Two honest caveats. Encryption at rest defends the file, not your live
+session: anyone running code as your OS user can read what the app can read —
+that is the boundary of every local-first app. And the key lives only in your
+keychain, so losing it (OS reinstall, keychain reset) makes the database
+unrecoverable; back up the `tracer-sh` / `db-key` keychain value if you want
+a safety net.
+
+Verify it yourself:
 
 ```bash
-npm uninstall -g tracer-sh
+sqlite3 ~/.tracer/data/tracer.db '.tables'    # → "Error: file is not a database"
+head -c 16 ~/.tracer/data/tracer.db | od -c   # → random bytes, not "SQLite format 3"
 ```
 
-To also remove your local database (settings, sessions, API keys):
+## Uninstall
 
 ```bash
-rm -rf ~/.tracer
+npm uninstall -g tracer-sh
+rm -rf ~/.tracer    # also removes settings, sessions, API keys
 ```
 
-The database encryption key also lives in your OS keychain (service `tracer-sh`,
-account `db-key`). Remove it for a clean slate — on macOS:
+The database encryption key lives in your OS keychain (service `tracer-sh`,
+account `db-key`). On macOS:
 
 ```bash
 security delete-generic-password -s tracer-sh -a db-key
@@ -156,19 +160,10 @@ security delete-generic-password -s tracer-sh -a db-key
 
 ## Contributing
 
-Contributions are welcome! There are two main ways to help:
-
-**Report bugs or request features** — [open an issue](https://github.com/sholub-dev/tracer/issues). Include steps to reproduce for bugs, or a clear description for feature requests.
-
-**Submit a code change:**
-
-1. Fork this repo
-2. Create a branch (`git checkout -b fix/my-fix`)
-3. Make your changes and commit
-4. Push to your fork (`git push origin fix/my-fix`)
-5. Open a pull request against `master`
+**Report bugs or request features** — [open an issue](https://github.com/sholub-dev/tracer/issues) with steps to reproduce or a clear description.
 
-All PRs require approval before merging.
+**Submit a code change** — fork, branch, and open a pull request against
+`master`. All PRs require approval before merging.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tracer-sh",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "type": "module",
   "description": "Local-first debugging & analysis platform",
   "license": "SEE LICENSE IN LICENSE",

package/packages/server/dist/{chunk-XFJVNMJI.js → chunk-LDYGR5S3.js}

@@ -154,14 +154,14 @@ _Flag if:_ Count is more than 20% lower than the baseline.
 ---
 
 ### Reporting Format
-After completing all applicable checks, report results as a table:
+After completing all applicable checks, report results as a table. (This verdict summary is the ONE permitted markdown table \u2014 each check's underlying data must still be shown via tool calls.)
 
 | Check | Current | Baseline (1w ago) | Delta | Status |
 |-------|---------|-------------------|-------|--------|
-| Response Time P99 | ... | ... | +X% | \u2705 Pass / \u26A0\uFE0F Flagged |
-| Transaction Error Rate | ... | ... | +X% | \u2705 Pass / \u26A0\uFE0F Flagged |
-| External Services Errors | ... | ... | ... | \u2705 Pass / \u26A0\uFE0F Flagged / \u2014 N/A |
-| Success Transactions | ... | ... | -X% | \u2705 Pass / \u26A0\uFE0F Flagged |
+| Response Time P99 | ... | ... | +X% | Pass / FLAGGED |
+| Transaction Error Rate | ... | ... | +X% | Pass / FLAGGED |
+| External Services Errors | ... | ... | ... | Pass / FLAGGED / N/A |
+| Success Transactions | ... | ... | -X% | Pass / FLAGGED |
 
 End with an overall verdict on its own line:
 - \`Service appears healthy.\` \u2014 all checks pass

package/packages/server/dist/{domain-knowledge-6MEHHDWL.js → domain-knowledge-KF3XTKCK.js}

@@ -4,7 +4,7 @@ import {
   NR_DOMAIN_KNOWLEDGE,
   NR_INSIDE_OUT_DEBUGGING,
   NR_SERVICE_HEALTH_RUNBOOK
-} from "./chunk-XFJVNMJI.js";
+} from "./chunk-LDYGR5S3.js";
 import "./chunk-ZAYYPDZP.js";
 export {
   NR_AUTH_STOP_RULE,

package/packages/server/dist/index.js

@@ -13,7 +13,7 @@ import {
   NR_AUTH_STOP_RULE,
   NR_DOMAIN_KNOWLEDGE,
   NR_INSIDE_OUT_DEBUGGING
-} from "./chunk-XFJVNMJI.js";
+} from "./chunk-LDYGR5S3.js";
 import {
   GCP_AUTH_STOP_RULE,
   GCP_CROSS_SIGNAL,
@@ -28202,6 +28202,8 @@ var CONFIG = {
   /** Buffer cap for `npm install -g` output; well above the 1MB default so a noisy
    *  but successful install (native rebuild logs) isn't misreported as a failure. */
   npmInstallMaxBufferBytes: 16 * 1024 * 1024,
+  /** Re-run the background version check when the cached result is older than this. */
+  updateCheckTtlMs: 6 * 60 * 60 * 1e3,
   // ── Dashboard defaults ──
   widgetDefaultWidth: 6,
   widgetDefaultHeight: 6,
@@ -28233,6 +28235,8 @@ import { join, dirname, sep } from "path";
 import { fileURLToPath } from "url";
 var RESTART_EXIT_CODE = CONFIG.restartExitCode;
 var cachedStatus = null;
+var lastCheckAtMs = 0;
+var checkInFlight = false;
 var cachedPackageInfo = null;
 function resolvePackage() {
   if (cachedPackageInfo) return cachedPackageInfo;
@@ -28271,7 +28275,7 @@ function getInstallMethod() {
   return detectInstallMethod(resolvePackage().root);
 }
 function isNewerVersion(latest, current) {
-  const parse4 = (v) => v.replace(/^v/, "").split(".").map(Number);
+  const parse4 = (v) => v.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10) || 0);
   const [la, lb, lc] = parse4(latest);
   const [ca, cb, cc] = parse4(current);
   if (la !== ca) return la > ca;
@@ -28291,6 +28295,9 @@ function fetchLatestNpmVersion() {
   });
 }
 function getUpdateStatus() {
+  if (Date.now() - lastCheckAtMs > CONFIG.updateCheckTtlMs) {
+    checkForUpdateBackground();
+  }
   if (cachedStatus) return cachedStatus;
   return {
     available: false,
@@ -28300,11 +28307,15 @@ function getUpdateStatus() {
   };
 }
 function checkForUpdateBackground() {
+  if (checkInFlight) return;
+  checkInFlight = true;
+  lastCheckAtMs = Date.now();
   const current = readCurrentVersion();
   const method = getInstallMethod();
   const unavailable = () => ({ available: false, currentVersion: current, latestVersion: null, method });
   if (current === "unknown") {
     cachedStatus = unavailable();
+    checkInFlight = false;
     return;
   }
   fetchLatestNpmVersion().then((latest) => {
@@ -28315,28 +28326,35 @@ function checkForUpdateBackground() {
     const available = isNewerVersion(latest, current);
     cachedStatus = { available, currentVersion: current, latestVersion: latest, method };
     if (available) {
-      const hint = method === "global" ? "click the version in the sidebar to update from the app" : method === "npx" ? "re-run: npx tracer-sh@latest" : "git pull, then restart tracer-sh \u2014 the launcher rebuilds automatically";
+      const hint = method === "dev" ? "git pull, then restart tracer-sh \u2014 the launcher rebuilds automatically" : "click the version in the sidebar to update from the app";
       console.log(`Update available: v${current} \u2192 v${latest} (${hint})`);
     }
   }).catch(() => {
     cachedStatus = unavailable();
+  }).finally(() => {
+    checkInFlight = false;
   });
 }
+function npxPrefixDir(root) {
+  return dirname(dirname(root));
+}
 function performSelfUpdate() {
-  const method = getInstallMethod();
-  if (method !== "global") {
+  const { root } = resolvePackage();
+  const method = detectInstallMethod(root);
+  if (method === "dev" || !root) {
     return Promise.resolve({
       ok: false,
       method,
-      error: method === "npx" ? "Running via npx, which can't be updated in place. Re-run `npx tracer-sh@latest` to get the latest version." : "Running from a local source checkout, so in-app update is disabled."
+      error: "Running from a local source checkout, so in-app update is disabled."
     });
   }
+  const install = method === "global" ? "npm install -g tracer-sh@latest" : `npm install --prefix "${npxPrefixDir(root)}" tracer-sh@latest`;
   return new Promise((resolve5) => {
     exec(
       // Quiet flags keep output small (a verbose install can otherwise overflow
       // the stdout buffer and look like a failure); maxBuffer adds headroom for
       // native rebuild logs so a successful install is never misreported.
-      "npm install -g tracer-sh@latest --no-fund --no-audit --loglevel=error",
+      `${install} --no-fund --no-audit --loglevel=error`,
       { encoding: "utf-8", timeout: CONFIG.npmInstallTimeoutMs, maxBuffer: CONFIG.npmInstallMaxBufferBytes },
       (err, _stdout, stderr) => {
         if (err) {
@@ -63435,7 +63453,7 @@ function createDeleteMemoryTool(memoryExecute, opts) {
 
 // src/agents/utility/memory-domain-knowledge.ts
 var DOMAIN_LOADERS = {
-  newrelic: async () => (await import("./domain-knowledge-6MEHHDWL.js")).NR_DOMAIN_KNOWLEDGE,
+  newrelic: async () => (await import("./domain-knowledge-KF3XTKCK.js")).NR_DOMAIN_KNOWLEDGE,
   gcp: async () => (await import("./domain-knowledge-HC2HKQB3.js")).GCP_DOMAIN_KNOWLEDGE,
   posthog: async () => (await import("./domain-knowledge-RET7XGI5.js")).POSTHOG_DOMAIN_KNOWLEDGE
 };
@@ -63449,7 +63467,7 @@ async function getDomainKnowledge(providerType) {
 var SYSTEM_PROMPT = `You are a Memory Manager. Review completed sessions and extract lessons from FAILURES and STRUGGLE PATTERNS.
 
 ## MANDATORY RULE
-If the session contains ANY failed queries, you MUST address each failure \u2014 either create_memory if no similar memory exists, or update_memory if an existing memory covers the same topic but could be improved. Every failure MUST result in a tool call. Do NOT skip failures.
+If the session contains ANY failed queries, you MUST address each failure \u2014 either create_memory if no similar memory exists, or update_memory if an existing memory covers the same topic but could be improved. Every failure MUST result in a tool call, with ONE exception: transient infrastructure failures (timeout, rate limit, 5xx/server error, network blip) teach nothing about the query language \u2014 for those, state you are skipping them and why instead of saving a memory. A false lesson is worse than none, because memories override future instructions.
 
 ## Purpose of memories
 Memories capture corrections from real failures and discoveries in the user's specific environment. Each user's system has unique event types, field names, and naming conventions that differ from generic documentation. When the agent tries something and it fails or struggles, the correction is extremely valuable for future sessions.
@@ -63479,6 +63497,7 @@ If the agent failed then corrected itself, capture the MISTAKE \u2192 CORRECTION
 If the agent failed but never found a correction, still save the mistake: "Don't use [wrong syntax/field] in NRQL"
 
 ## When NOT to save
+- Transient failures \u2014 timeouts, rate limits, 5xx/server errors, network blips. Not query-language lessons; saving them poisons future sessions.
 - General best practices that aren't tied to a specific failure or struggle
 - Successful patterns that didn't involve a prior failure or struggle
 - User-specific data (IDs, account names, endpoints)
@@ -63545,18 +63564,18 @@ ${domainKnowledge}
 ` : "";
   let tailInstruction;
   if (failures.length > 0) {
-    tailInstruction = `This session had ${failures.length} failed queries. You MUST address each failure with create_memory or update_memory \u2014 no exceptions.`;
+    tailInstruction = `This session had ${failures.length} failed queries. You MUST address each failure with create_memory or update_memory \u2014 the only exception is transient infrastructure failures, which you skip with a stated reason.`;
     if (emptyCount > 0) tailInstruction += ` Additionally, ${emptyCount} queries returned empty results \u2014 review the session for struggle patterns.`;
   } else if (emptyCount > 0) {
     tailInstruction = `This session had no errors but ${emptyCount} queries returned empty results. Review the full session timeline for struggle patterns \u2014 repeated attempts, name variations, trial-and-error discovery. If there is a generalized learning, save it. If results were legitimately empty, respond with "No changes needed."`;
   } else {
     tailInstruction = `If the session was clean, respond with "No changes needed." and make no tool calls.`;
   }
-  const failuresSection = failures.length > 0 ? `## \u26A0 FAILURES DETECTED (${failures.length}) \u2014 each MUST be addressed
+  const failuresSection = failures.length > 0 ? `## FAILURES DETECTED (${failures.length}) \u2014 each MUST be addressed
 ${failures.map((f) => `- Query #${f.idx}: \`${f.query}\`
   Error: ${f.error}`).join("\n")}
 
-For each failure above, call create_memory (or update_memory if a similar memory already exists).
+For each failure above, call create_memory (or update_memory if a similar memory already exists), unless it is a transient infrastructure failure \u2014 then say so and skip it.
 
 ` : "";
   const prompt = `Review this completed ${providerType} session and decide what to remember.
@@ -63833,6 +63852,8 @@ ${DETECTIVE_MINDSET}
 
 ${EVIDENCE_GROUNDING}
 
+${ROOT_CAUSE_DISCIPLINE}
+
 ${EXECUTION_DISCIPLINE}
 
 ${providerFragments.join("\n\n---\n\n")}
@@ -63842,7 +63863,7 @@ ${buildAnalysisSection(maxSteps)}`;
 function buildRules(opts) {
   const rules = [
     `1. **ONE tool call per step.** After each tool result, write a brief summary, then make the next call.`,
-    `2. **Empty results = wrong query, not missing data.** Fix the filter, field name, or time range. Do not retry the same approach.`,
+    `2. **Empty results: suspect the query first, then prove absence.** Check field name, case, quoting, and time range; fix and retry differently. If a deliberately broadened probe (wider window, fewer filters) is also empty, the absence IS the finding \u2014 report it. Never keep reshaping the same query hoping data appears.`,
     `3. **NEVER repeat a failed query.** Read the error, fix the cause. Same error twice \u2192 completely different approach.`,
     `4. **Use discovered identifiers exactly.** If the actual name differs from the task, use the exact discovered value.`,
     `5. You MUST write a non-empty text response when done \u2014 the user sees your text as the analysis.`,
@@ -63880,12 +63901,25 @@ Your only sources of truth are the literal text of tool results from this sessio
 
 1. **Field names and values are opaque labels.** Never translate or assign meaning to a field name, enum value, code, or flag beyond its literal text \u2014 systems attach internal meanings you cannot know. Report the raw value; if its meaning matters and is undocumented, say so.
 2. **Absence requires an empty probe.** Only claim something is missing, absent, or "not on file" if a query that would have returned it came back empty. Not having looked is not evidence of absence.
-3. **Separate facts, deductions, and gaps.** Facts restate query results. Deductions must follow from stated facts alone \u2014 present them as deductions and name the supporting results; correlation across results is not causation. Gaps are reported as "the data does not show X" \u2014 never filled with a plausible story.`;
+3. **Separate facts, deductions, and gaps.** Facts restate query results. Deductions must follow from stated facts alone \u2014 present them as deductions and name the supporting results; correlation across results is not causation. Gaps are reported as "the data does not show X" \u2014 never filled with a plausible story.
+4. **Exact values only.** Every number, identifier, timestamp, and quoted error message in your response must appear literally in a tool result. Values you compute from results must be labeled as computed, with their inputs shown. A name you inferred (service, field, event) must be confirmed by a query before it appears in a finding.
+5. **Scope claims to what you queried.** "No errors" means "no errors matching my filter in my window" \u2014 state the window. Never generalize a claim beyond the time range, filter, or service actually queried.
+6. **Label confidence.** State each conclusion as confirmed (a result directly shows it), likely (converging evidence, no direct proof), or unverified (plausible, untested). Only a query result upgrades a claim \u2014 more prose does not. Never present likely or unverified as confirmed.`;
+var ROOT_CAUSE_DISCIPLINE = `## Root-Cause Discipline
+
+For "why is X happening" investigations; skip for simple lookups. Steps 1-2 are usually a single time-bucketed query; steps 3-6 are reasoning applied to results you already have \u2014 they cost thought, not extra steps.
+
+1. **Verify the symptom before explaining it.** The user's description is a claim, not a fact. Your first query confirms the problem actually appears in the data \u2014 right service, right window, roughly the reported magnitude. If it doesn't, report exactly that (with the probe you ran) instead of hunting for causes of something the data does not show.
+2. **Anchor the timeline.** Establish when the symptom started with a time-bucketed query. A cause must precede the onset \u2014 anything that began after it is a consequence or a coincidence. Ask what changed at onset: deployment, config, traffic shape, a dependency's errors.
+3. **Name the hypothesis each query tests.** Prefer queries that could DISPROVE it \u2014 a query that can only agree with you proves nothing. One matching correlation is never, by itself, a root cause.
+4. **Follow the chain to the earliest anomaly.** Timeouts, retries, and 5xx responses are usually symptoms. Keep asking "what made THAT happen" until you reach the earliest anomalous signal visible in the data. If the chain leaves the data you can query (application code, third-party internals), that boundary itself is the finding \u2014 never bridge it with a plausible story.
+5. **Rule out the strongest alternative.** Before declaring a root cause, name the best competing explanation and the evidence that eliminates it. If you cannot eliminate it, present both candidates and what distinguishes them.
+6. **Check magnitudes against a baseline.** Compare to the same window a day or week earlier before calling anything a spike or drop. Keep your own numbers consistent \u2014 if two of your results disagree (sampling, different windows), reconcile the disagreement before building on either.`;
 var NO_FIXES_RULE = `**NEVER suggest fixes, remediation, next steps, or actions.** Forbidden phrasings include: "consider," "you should," "try," "might want to," "recommend," "could help," "suggests [action]," "would resolve," "to fix this." Any sentence about what to DO about the problem is forbidden, regardless of phrasing. Your job ends at "here is what happened and the evidence." The developer decides what to do.`;
 var EXECUTION_DISCIPLINE = `## Execution Discipline
 
 For multi-step investigations:
-1. **Step N: [Goal]** \u2014 state what gap this fills
+1. **Step N: [Goal]** \u2014 state the hypothesis this tests or the gap it fills
 2. **Tool call** \u2192 ONE query
 3. **\u2192 Found:** [data] **\u2192 So what:** [only what this data supports \u2014 if it needs an assumption, it's a gap, not a finding]
 4. **\u2192 Can I answer now?** \u2014 If YES: respond. If NO: state what's missing.
@@ -63906,7 +63940,7 @@ function analysisBlock() {
    - Do not start writing until you have a clear chain and a concrete list of visuals to run.
 2. ${markerStep}
 3. **Visual-first narrative.** Walk through what happened and back EVERY substantive finding with a tool call that displays the supporting data (chart or table in the UI). Weave tool calls between narrative paragraphs \u2014 do not cluster them all at the top or bottom. Short connecting text explains each visual; the visuals carry the evidence.
-4. **End with a concise conclusion** \u2014 the root cause, or the specific gap that prevents naming one, phrased as a deduction from the visuals above.
+4. **End with a concise conclusion** \u2014 the root cause with its confidence label (confirmed / likely / unverified), or the specific gap that prevents naming one, phrased as a deduction from the visuals above. If the conclusion is not confirmed, name the single piece of evidence that would settle it.
 
 **Rules:**
 - **Tool calls are mandatory, not optional.** Every substantive claim needs a tool call showing the data. Narrative without visuals is not acceptable. Cite investigation steps inline with \`[step N]\` only when it adds auditability \u2014 do not substitute citations for visuals.
@@ -63927,7 +63961,7 @@ You have a maximum of ${maxSteps} steps. Most investigations should finish in 3-
 
 ## Final Reminders
 - **Tool calls are the evidence.** Every substantive claim in your response needs a visual \u2014 even if the same query already ran during investigation, re-run it here. The analysis section must be self-contained.
-- **Stay Grounded in Evidence:** every claim maps to a specific tool result; values mean only what their literal text says; absence claims need an empty probe; gaps are stated as "the data does not show". No fixes.`;
+- **Stay Grounded in Evidence:** every claim maps to a specific tool result; values mean only what their literal text says; absence claims need an empty probe; claims stay scoped to the window actually queried; conclusions carry confidence labels; gaps are stated as "the data does not show". No fixes.`;
 }
 
 // src/lib/prompt-builder.ts
@@ -63958,6 +63992,8 @@ ${DETECTIVE_MINDSET}
 
 ${EVIDENCE_GROUNDING}
 
+${ROOT_CAUSE_DISCIPLINE}
+
 ${config2.insideOutDebugging}
 
 ${EXECUTION_DISCIPLINE}
@@ -73994,7 +74030,7 @@ Only after reviewing all memories, perform any needed updates or deletes.
 - **Default to KEEP.** Only delete when you are 100% certain the memory is harmful or an exact duplicate.
 - Merge duplicates: UPDATE the better one, DELETE the other.
 - Rewrite vague notes to be specific and actionable (max 15 words).
-- Delete memories that teach bad NRQL syntax (e.g. using GROUP BY, DISTINCT, or other SQL that doesn't exist in NRQL).`;
+- Delete memories that teach syntax invalid for THIS provider's query language \u2014 judge against the provider domain knowledge in the prompt, never against another provider's dialect (e.g. GROUP BY is invalid NRQL but valid HogQL).`;
 async function runMemoryOptimizer(db2, toolName) {
   const memories = db2.select().from(toolMemories).where(eq(toolMemories.toolName, toolName)).all();
   const emptyStats = { kept: 0, updated: 0, deleted: 0 };
@@ -74606,8 +74642,8 @@ var updateRouter = router({
       currentVersion: status.currentVersion,
       latestVersion: status.latestVersion,
       method: status.method,
-      // Only a global install can be upgraded in place from the app.
-      canSelfUpdate: status.method === "global"
+      // Global and npx installs upgrade in place; only source checkouts can't.
+      canSelfUpdate: status.method !== "dev"
     };
   }),
   // Upgrade a global install in place, then trigger a graceful restart so the
@@ -75190,6 +75226,13 @@ ${formatted}`;
 }
 
 // src/agents/base-agent.ts
+var IMAGE_ANALYSIS_GUIDANCE = `## Working with attached images and files
+The user has attached one or more images or files. Treat each as primary evidence, not decoration:
+- Analyze every attachment carefully and in full \u2014 do not skim. Inspect fine detail, not just the gist.
+- Extract ALL information that could matter: exact error messages and stack traces, status/error codes, log lines, timestamps, numeric values with their units, axis labels and series values on charts/graphs, configuration keys, IDs, and any text visible in screenshots.
+- Transcribe values precisely and double-check each reading before relying on it \u2014 re-read the image to confirm digits, spelling, and signs rather than approximating.
+- Quote what is actually shown rather than paraphrasing loosely, and tie every conclusion back to specific details in the attachment.
+- If any part is blurry, cropped, truncated, or ambiguous, say so explicitly and ask \u2014 never guess at an unreadable value.`;
 function sanitizeMessages(messages) {
   return messages.map((msg) => {
     if (msg.role !== "assistant") return msg;
@@ -75274,11 +75317,16 @@ When the user's question spans multiple providers, query each relevant provider
     const fragments = collected.promptFragments ?? [];
     systemPrompt = fragments.length > 0 ? `${basePrompt}
 
+${EVIDENCE_GROUNDING}
+
 ${fragments.join("\n\n")}` : `${basePrompt}
 
 No observability providers are currently configured. If the user asks about observability data, let them know they can connect providers in the Settings page.`;
   }
   systemPrompt += "\n\n" + getCurrentDateBlock(context2.db);
+  if (modelInput.some((m) => m.parts.some((p) => p.type === "file"))) {
+    systemPrompt += "\n\n" + IMAGE_ANALYSIS_GUIDANCE;
+  }
   if (summaryForPrompt) {
     systemPrompt += `
 
@@ -75725,10 +75773,10 @@ If a tool call fails, retry with a corrected approach. If you fail the same tool
 
 ## Chart Type Selection
 - "auto" \u2014 let the frontend auto-detect based on query shape
-- "timeseries" \u2014 for TIMESERIES queries (line charts)
-- "table" \u2014 for FACET queries without TIMESERIES
+- "timeseries" \u2014 for time-bucketed queries (NRQL TIMESERIES, HogQL GROUP BY time bucket) \u2014 line charts
+- "table" \u2014 for grouped/top-N results without a time axis (NRQL FACET, SQL GROUP BY)
 - "scalar" \u2014 for single-value aggregations
-- "histogram" \u2014 for histogram() queries
+- "histogram" \u2014 for distribution queries (e.g. NRQL histogram())
 
 ## Widget Sizing
 The dashboard uses a ${CONFIG.gridColumns}\xD7${CONFIG.gridColumns} grid (${CONFIG.gridColumns} columns, ${CONFIG.gridColumns} rows fill the viewport). Both axes are responsive to screen size.
@@ -76207,6 +76255,9 @@ The condition is a JS expression evaluated against the query \`result\` array. E
 - \`result[0].average > 2\` \u2014 alert when average exceeds 2 seconds
 - \`result[0].errorRate > 0.05\` \u2014 alert when error rate exceeds 5%
 
+## Threshold Grounding
+Never invent a threshold. Unless the user gave an explicit number, run the monitor's query over recent data FIRST and pick the threshold relative to the observed values. When proposing a condition, state the observed baseline it is based on (e.g. "normal is 5-10/min, alerting above 50"). A threshold chosen without looking at the data either never fires or fires constantly.
+
 ## Frequency Recommendations
 - 30s \u2014 critical real-time checks
 - 60s \u2014 standard monitoring (default)

package/packages/web/dist/assets/{SearchableSelect-BfcFMllA.js → SearchableSelect-C0HvVPdQ.js}

@@ -1 +1 @@
-import{a as q,r as s,j as r}from"./index-L_n_IFmZ.js";var P=q();function $(c){const n=c?`tracer:starred:${c}`:null,[i,S]=s.useState(()=>{if(!n)return new Set;try{const a=localStorage.getItem(n);return a?new Set(JSON.parse(a)):new Set}catch{return new Set}});return[i,a=>{S(u=>{const t=new Set(u);return t.has(a)?t.delete(a):t.add(a),n&&localStorage.setItem(n,JSON.stringify([...t])),t})}]}function I({options:c,value:n,onChange:i,placeholder:S="Select...",storageKey:v,fitContent:a,disabled:u}){const[t,l]=s.useState(!1),[w,y]=s.useState(""),f=s.useRef(null),j=s.useRef(null),N=s.useRef(null),g=s.useRef(null),[x,C]=$(v),[m,L]=s.useState({top:0,left:0,minWidth:0});s.useEffect(()=>{if(!t)return;const e=d=>{f.current?.contains(d.target)||j.current?.contains(d.target)||l(!1)};return document.addEventListener("mousedown",e),()=>document.removeEventListener("mousedown",e)},[t]);const R=s.useCallback(()=>{if(!f.current)return;const e=f.current.getBoundingClientRect();L({top:e.bottom+4,left:e.left,minWidth:e.width})},[]);s.useEffect(()=>{t&&(R(),y(""),requestAnimationFrame(()=>N.current?.focus()))},[t,R]);const h=c.find(e=>e.value===n),p=s.useMemo(()=>{const e=w.toLowerCase();return[...e?c.filter(o=>o.label.toLowerCase().includes(e)||o.value.toLowerCase().includes(e)):c].sort((o,b)=>{const k=x.has(o.value)?0:1,E=x.has(b.value)?0:1;return k!==E?k-E:o.label.localeCompare(b.label)})},[c,w,x]);s.useEffect(()=>{if(t&&n&&g.current){const e=g.current.querySelector(`[data-value="${CSS.escape(n)}"]`);e&&e.scrollIntoView({block:"nearest"})}},[t,n]);const W=t?P.createPortal(r.jsxs("div",{ref:j,className:"fixed z-[100] bg-white border border-[#d4d2cd] rounded shadow-lg",style:{top:m.top,left:m.left,minWidth:m.minWidth,width:a?"max-content":m.minWidth},children:[r.jsx("div",{className:"p-1.5 border-b border-[#e8e6e1]",children:r.jsx("input",{ref:N,type:"text",value:w,onChange:e=>y(e.target.value),placeholder:"Search...",className:"w-full px-2 py-1.5 text-xs text-[#2c2c2c] font-sans bg-[#f5f4f0] border border-[#e8e6e1] rounded focus:outline-none focus:border-[#2b5ea7] placeholder:text-[#9c9890]",onKeyDown:e=>{e.key==="Escape"&&l(!1),e.key==="Enter"&&p.length>0&&(i(p[0].value),l(!1))}})}),r.jsx("div",{ref:g,className:"max-h-[280px] overflow-y-auto",children:p.length===0?r.jsx("div",{className:"px-3 py-3 text-xs text-[#9c9890] text-center",children:"No projects found"}):p.map(e=>{const d=e.value===n,o=x.has(e.value);return r.jsxs("div",{"data-value":e.value,className:`flex items-center gap-1.5 px-2 py-1.5 text-xs font-sans cursor-pointer transition-colors ${d?"bg-[#2b5ea7]/10 text-[#2b5ea7]":"text-[#2c2c2c] hover:bg-[#f5f4f0]"}`,onClick:()=>{i(e.value),l(!1)},children:[r.jsx("button",{type:"button",onClick:b=>{b.stopPropagation(),C(e.value)},className:`shrink-0 w-4 h-4 flex items-center justify-center text-[10px] transition-colors ${o?"text-[#d4a017]":"text-[#d4d2cd] hover:text-[#9c9890]"}`,title:o?"Unstar":"Star to pin to top",children:o?"★":"☆"}),r.jsx("span",{className:a?"whitespace-nowrap":"truncate flex-1",children:e.label})]},e.value)})})]}),document.body):null;return r.jsxs(r.Fragment,{children:[r.jsxs("button",{ref:f,type:"button",onClick:()=>!u&&l(!t),disabled:u,className:"w-full bg-white border border-[#d4d2cd] rounded px-3 py-2 text-xs text-[#2c2c2c] font-sans text-left flex items-center justify-between focus:outline-none focus:border-[#2b5ea7] hover:border-[#b0ada6] transition-colors disabled:opacity-50 disabled:cursor-not-allowed",children:[r.jsx("span",{className:h?"text-[#2c2c2c] truncate":"text-[#9c9890]",children:h?h.displayLabel??h.label:S}),r.jsx("span",{className:"text-[#9c9890] text-[10px] ml-2 shrink-0 transition-transform duration-200",style:{transform:t?"rotate(180deg)":"rotate(0deg)"},children:"▾"})]}),W]})}export{I as S,P as r,$ as u};
+import{a as q,r as s,j as r}from"./index-DWtKdjfG.js";var P=q();function $(c){const n=c?`tracer:starred:${c}`:null,[i,S]=s.useState(()=>{if(!n)return new Set;try{const a=localStorage.getItem(n);return a?new Set(JSON.parse(a)):new Set}catch{return new Set}});return[i,a=>{S(u=>{const t=new Set(u);return t.has(a)?t.delete(a):t.add(a),n&&localStorage.setItem(n,JSON.stringify([...t])),t})}]}function I({options:c,value:n,onChange:i,placeholder:S="Select...",storageKey:v,fitContent:a,disabled:u}){const[t,l]=s.useState(!1),[w,y]=s.useState(""),f=s.useRef(null),j=s.useRef(null),N=s.useRef(null),g=s.useRef(null),[x,C]=$(v),[m,L]=s.useState({top:0,left:0,minWidth:0});s.useEffect(()=>{if(!t)return;const e=d=>{f.current?.contains(d.target)||j.current?.contains(d.target)||l(!1)};return document.addEventListener("mousedown",e),()=>document.removeEventListener("mousedown",e)},[t]);const R=s.useCallback(()=>{if(!f.current)return;const e=f.current.getBoundingClientRect();L({top:e.bottom+4,left:e.left,minWidth:e.width})},[]);s.useEffect(()=>{t&&(R(),y(""),requestAnimationFrame(()=>N.current?.focus()))},[t,R]);const h=c.find(e=>e.value===n),p=s.useMemo(()=>{const e=w.toLowerCase();return[...e?c.filter(o=>o.label.toLowerCase().includes(e)||o.value.toLowerCase().includes(e)):c].sort((o,b)=>{const k=x.has(o.value)?0:1,E=x.has(b.value)?0:1;return k!==E?k-E:o.label.localeCompare(b.label)})},[c,w,x]);s.useEffect(()=>{if(t&&n&&g.current){const e=g.current.querySelector(`[data-value="${CSS.escape(n)}"]`);e&&e.scrollIntoView({block:"nearest"})}},[t,n]);const W=t?P.createPortal(r.jsxs("div",{ref:j,className:"fixed z-[100] bg-white border border-[#d4d2cd] rounded shadow-lg",style:{top:m.top,left:m.left,minWidth:m.minWidth,width:a?"max-content":m.minWidth},children:[r.jsx("div",{className:"p-1.5 border-b border-[#e8e6e1]",children:r.jsx("input",{ref:N,type:"text",value:w,onChange:e=>y(e.target.value),placeholder:"Search...",className:"w-full px-2 py-1.5 text-xs text-[#2c2c2c] font-sans bg-[#f5f4f0] border border-[#e8e6e1] rounded focus:outline-none focus:border-[#2b5ea7] placeholder:text-[#9c9890]",onKeyDown:e=>{e.key==="Escape"&&l(!1),e.key==="Enter"&&p.length>0&&(i(p[0].value),l(!1))}})}),r.jsx("div",{ref:g,className:"max-h-[280px] overflow-y-auto",children:p.length===0?r.jsx("div",{className:"px-3 py-3 text-xs text-[#9c9890] text-center",children:"No projects found"}):p.map(e=>{const d=e.value===n,o=x.has(e.value);return r.jsxs("div",{"data-value":e.value,className:`flex items-center gap-1.5 px-2 py-1.5 text-xs font-sans cursor-pointer transition-colors ${d?"bg-[#2b5ea7]/10 text-[#2b5ea7]":"text-[#2c2c2c] hover:bg-[#f5f4f0]"}`,onClick:()=>{i(e.value),l(!1)},children:[r.jsx("button",{type:"button",onClick:b=>{b.stopPropagation(),C(e.value)},className:`shrink-0 w-4 h-4 flex items-center justify-center text-[10px] transition-colors ${o?"text-[#d4a017]":"text-[#d4d2cd] hover:text-[#9c9890]"}`,title:o?"Unstar":"Star to pin to top",children:o?"★":"☆"}),r.jsx("span",{className:a?"whitespace-nowrap":"truncate flex-1",children:e.label})]},e.value)})})]}),document.body):null;return r.jsxs(r.Fragment,{children:[r.jsxs("button",{ref:f,type:"button",onClick:()=>!u&&l(!t),disabled:u,className:"w-full bg-white border border-[#d4d2cd] rounded px-3 py-2 text-xs text-[#2c2c2c] font-sans text-left flex items-center justify-between focus:outline-none focus:border-[#2b5ea7] hover:border-[#b0ada6] transition-colors disabled:opacity-50 disabled:cursor-not-allowed",children:[r.jsx("span",{className:h?"text-[#2c2c2c] truncate":"text-[#9c9890]",children:h?h.displayLabel??h.label:S}),r.jsx("span",{className:"text-[#9c9890] text-[10px] ml-2 shrink-0 transition-transform duration-200",style:{transform:t?"rotate(180deg)":"rotate(0deg)"},children:"▾"})]}),W]})}export{I as S,P as r,$ as u};