feat: CLI, discovery, RCA pipeline, panel images, and investigation hardening

[WZ]

Summary

Full-stack MVP of the dops-assistant DevOps investigation agent:

• CLI interface — Ink React terminal UI with markdown rendering, input history, token usage display, and panel image viewing
• Service discovery — LLM-driven DiscoveryAgent that probes Grafana to find monitored services
• 5-phase RCA pipeline — Anomaly detection → metric/log/infra analysis (parallel) → synthesis, with structured JSON outputs
• Panel image capture — Deterministic capture from Grafana dashboards using user query hints (dashboard/panel name extraction weighted 3x) for relevance
• Investigation hardening — Phase iteration caps, forced-response windows, post-loop retry (3x with mock error injection), pre-fetched datasource UIDs
• Token optimization — Smart tool response truncation, 3 tool calls/iteration cap, trimmed prompts (~60% reduction from 206K to ~88K tokens)
• MCP improvements — HTTP transport support, Grafana time range normalization (epoch ms strings for Go server), image extraction from tool results
• LLM client — Switched from Chat Completions to OpenAI Responses API with token usage surfacing
• Slack integration — Chart image uploads, RCA report formatting
• Output quality — RCA synthesis avoids markdown tables (terminal-friendly), correct panel images based on user query context

Test plan

• npx vitest run — 248 tests pass
• npx tsc --noEmit — types clean
• npm run investigate -- --runs 1 --query "..." — end-to-end investigation produces relevant panel images
• Verify panel images match user-specified dashboard/panel when query includes hints like "(Panel Name in Dashboard Name)"
• Verify RCA report renders cleanly in terminal without broken table formatting

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR merges several MVP features into the codebase: an Ink-based CLI interface, LLM-driven service discovery, richer RCA evidence (including panel screenshots), Slack image uploads, and a migration of the OpenAI client to the Responses API.

Changes:

• Added Ink/React CLI entrypoints and rendering utilities (markdown rendering, tool-call/token logging, image saving).
• Implemented DiscoveryAgent + config schema support and integrated optional discovery into startup flows.
• Extended RCA data types/prompts + MCP/agent pipelines to collect and deliver panel images, and switched the OpenAI client to the Responses API.

Reviewed changes

Copilot reviewed 39 out of 42 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
tsconfig.json	Enables JSX compilation for Ink/React CLI components.
src/notifications/rca-blocks.test.ts	Updates RCA test fixture for new report fields.
src/mcp/client.ts	Changes tool call return type to include text + images.
src/mcp/client.test.ts	Updates tool-call tests and adds image-part coverage.
src/llm/openai.ts	Migrates OpenAI wrapper to Responses API and adds conversion helpers + usage tracking.
src/llm/openai.test.ts	Updates tests for Responses API output parsing and conversion helpers.
src/interfaces/slack.ts	Uploads tool-captured images to Slack threads; adds channelId plumbing.
src/interfaces/slack.test.ts	Adds/updates tests for Slack image uploads and new context shape.
src/interfaces/cli/cli-utils.test.ts	Adds unit tests for CLI markdown parsing, RCA formatting, and image saving behavior.
src/interfaces/cli/Markdown.tsx	Implements CLI markdown renderer (inline formatting + basic tables).
src/interfaces/cli/App.tsx	Implements Ink CLI REPL, tool-call logging, token usage display, RCA formatting, and image saving/opening.
src/index.ts	Integrates optional service discovery and uses merged services for scheduler/Slack bot.
src/discover.tsx	Adds an Ink-based “discover services and write config” entrypoint.
src/config/schema.ts	Adds discovery config schema + exported type.
src/config/schema.test.ts	Adds tests validating discovery schema defaults.
src/config/loader.ts	Adds support for ${VAR:-default} env var interpolation.
src/cli.tsx	Adds CLI entrypoint wiring MCP/LLM/agents/memory into Ink app.
src/agent/types.ts	Adds token/tool callbacks to AgentTask and images to AgentResult (+ ImageAttachment type).
src/agent/rca-types.ts	Extends RCA types with dashboard links, panel images, and richer log findings.
src/agent/rca-prompts.ts	Updates prompts + JSON schemas for enriched evidence and dashboard link extraction.
src/agent/rca-prompts.test.ts	Adds tests covering new RCA schema fields and prompt requirements.
src/agent/prompts.ts	Updates conversational system prompt to encourage panel image capture and forbid base64 in text.
src/agent/investigation.ts	Collects panel images during investigation phases; threads token usage reporting through phases.
src/agent/investigation.test.ts	Updates mocks/fixtures for ToolResult and new log findings fields.
src/agent/intent.ts	Adds service matching helper (including unicode hyphen normalization); updates classifier signature.
src/agent/intent.test.ts	Adds tests for matchService behavior.
src/agent/discovery.ts	Adds LLM-driven DiscoveryAgent that executes tool calls and returns ServiceConfig candidates.
src/agent/discovery.test.ts	Adds tests for discovery output parsing, exclusions, and token-usage callback.
src/agent/discovery-prompts.ts	Adds discovery prompt + schema and message builder.
src/agent/discovery-prompts.test.ts	Adds tests for discovery prompt/schema/message builder.
src/agent/core.ts	Collects tool-returned images, sanitizes tool outputs, strips base64 markdown from responses, and adds token/tool callbacks.
src/agent/core.test.ts	Updates mocks for ToolResult and adds tests for image capture + callback behavior.
package.json	Adds CLI/discover scripts and Ink/React/dotenv deps.
package-lock.json	Locks new dependency graph for CLI/Ink/React additions.
docs/plans/2026-03-02-rca-evidence-enrichment.md	Adds implementation plan for RCA evidence enrichment.
docs/plans/2026-03-02-rca-evidence-enrichment-design.md	Adds design doc for evidence enrichment scope/behavior.
docs/plans/2026-02-26-grafana-screenshots-plan.md	Adds implementation plan for Grafana screenshot delivery.
docs/plans/2026-02-26-grafana-screenshots-design.md	Adds design doc for screenshot pipeline and error handling.
docs/plans/2026-02-26-cli-mode-plan.md	Adds implementation plan for CLI mode.
docs/plans/2026-02-26-cli-mode-design.md	Adds design doc for CLI UX/architecture.
docs/architecture-overiew.md	Adds/updates architecture documentation (needs alignment with Responses API).
.gitignore	Ignores dev/ local config directory.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

ink-table is imported by the new CLI Markdown renderer (src/interfaces/cli/Markdown.tsx) but it is not listed in dependencies here. This will break fresh installs / CI builds that only rely on package.json. Add ink-table as a direct dependency (or remove the import/use).

[Copilot]

The cli/discover scripts disable TLS verification via NODE_TLS_REJECT_UNAUTHORIZED=0. That makes it easy to accidentally run these entrypoints with insecure HTTPS handling and can mask certificate issues. Consider removing this flag, or gating it behind an explicit opt-in env var (and documenting why it’s needed).

Suggested change

	"cli": "NODE_TLS_REJECT_UNAUTHORIZED=0 NODE_NO_WARNINGS=1 tsx src/cli.tsx",
	"discover": "NODE_TLS_REJECT_UNAUTHORIZED=0 NODE_NO_WARNINGS=1 tsx src/discover.tsx"
	"cli": "NODE_NO_WARNINGS=1 tsx src/cli.tsx",
	"discover": "NODE_NO_WARNINGS=1 tsx src/discover.tsx"

[Copilot]

Avoid side effects inside the setToolCalls state updater. The updater function should be pure, but it currently calls addMessage(...) while computing the summary, which can behave unpredictably with React batching/re-render behavior. Compute the summary outside the state setter (e.g., using a ref for the last toolCalls + token totals), then clear toolCalls in a separate setToolCalls([]) call.

[Copilot]

Image attachments collected from MCP tool results always use a .png filename and don’t include any disambiguator for the outer i loop. This can (a) produce the wrong extension when mimeType isn’t image/png, and (b) overwrite earlier images if the same tool is called again in a later iteration. Derive the extension from mimeType (as AgentCore does) and include a unique suffix (e.g., i or a UUID) in the filename.

Suggested change

	collectedImages.push({
	filename: `panel-${call.name}-${j}-${k}.png`,
	const ext =
	img.mimeType && img.mimeType.startsWith("image/")
	? img.mimeType.substring("image/".length)
	: "bin";
	collectedImages.push({
	filename: `panel-${call.name}-${i}-${j}-${k}.${ext}`,

[Copilot]

callTool() currently includes image parts even when data is missing, mapping them to an empty string. Downstream code decodes img.data as base64 and may end up uploading/handling empty buffers. Filter out image parts with missing/empty data (and optionally validate base64) so images only contains usable entries.

[Copilot]

The MCP connection isn’t cleaned up on early cancellation or errors: if cancelled becomes true after mcp.connect() (or if any later step throws), mcp.disconnect() is skipped. Wrap the workflow in a try/finally (and/or track mcp in outer scope) so the MCP client is always disconnected, even on errors or when the component unmounts.

Suggested change

	await mcp.disconnect();
	setStatus("done");
	} catch (err) {
	log(`Error: ${err instanceof Error ? err.message : String(err)}`);
	setStatus("error");
	setStatus("done");
	} catch (err) {
	log(`Error: ${err instanceof Error ? err.message : String(err)}`);
	setStatus("error");
	} finally {
	try {
	await mcp.disconnect();
	} catch {
	// Ignore disconnect errors to avoid masking the original failure
	}

[Copilot]

This doc section still describes the LLM client as calling the Chat Completions API and mentions an empty choices array, but src/llm/openai.ts has been switched to the Responses API (response.output, input_tokens, etc.). Update the documentation here to match the current implementation to avoid misleading readers.

Suggested change

	A thin wrapper around the `openai` SDK. The single method `chat(messages, tools)` calls the OpenAI chat completions API and returns a typed discriminated union:
	- `{ type: "text", content: string }` — the LLM produced a final response
	- `{ type: "tool_calls", calls: ToolCall[] }` — the LLM wants to call one or more tools
	This shape is what the Agent Core loops on. The LLM client never loops itself — it makes exactly one API call per invocation.
	Guards are in place for two failure modes: an empty `choices` array (content filtering) and malformed JSON in tool call arguments.
	A thin wrapper around the `openai` SDK. The single method `chat(messages, tools)` calls the OpenAI Responses API and returns a typed discriminated union:
	- `{ type: "text", content: string }` — the LLM produced a final response
	- `{ type: "tool_calls", calls: ToolCall[] }` — the LLM wants to call one or more tools
	This shape is what the Agent Core loops on. The LLM client never loops itself — it makes exactly one API call per invocation.
	Guards are in place for two failure modes: a missing or empty `response.output` (e.g. due to content filtering) and malformed JSON in tool call arguments.