feat(alerts): agent tools, public API, MCP and chat delivery

Agent tools, public API and MCP support for Alerts, including chat
delivery.

Mono-RevId: bbbafbdc63f85c0de3b8acc36e18ac01c3d69aa7

Author: kathiekiwi

.changeset/monitoring-alert-mcp-tools.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Added MCP tools for monitoring alerts: `list_alert_capabilities`, `list_alerts`, `create_alert`, and `resolve_alert`, so an MCP client can discover what a project can watch and manage alerts directly. Health capabilities expose customizable threshold params, discoverable via `list_alert_capabilities` and settable via `create_alert`.

apps/webapp/app/components/dashboard-agent/tool-labels.ts

@@ -22,9 +22,14 @@ const TOOL_LABELS: Record<string, string> = {
   get_current_page: "Reading the current page",
   navigate_to: "Opening the page",
   schedule_watch: "Filling in a watch",
-  list_alerts: "Listing alerts",
-  create_alert: "Creating an alert",
-  delete_alert: "Deleting an alert",
+  list_watch_subscriptions: "Listing alerts",
+  create_watch_subscription: "Creating an alert",
+  delete_watch_subscription: "Deleting an alert",
+  describe_alert_capabilities: "Listing alert capabilities",
+  create_monitoring_alert: "Creating an alert",
+  update_alert_draft: "Updating the alert draft",
+  list_monitoring_alerts: "Listing alerts",
+  resolve_monitoring_alert: "Resolving an alert",
   locate: "Locating the id",
   submit_feedback: "Sending feedback",
   // Code mode.

apps/webapp/app/routes/api.v1.dashboard-agent.alerts.$channelId.ts

@@ -3,7 +3,9 @@ import { z } from "zod";
 import { resolveAgentAlertContext } from "~/services/dashboardAgentAlertContext.server";
 import { unsubscribeChannelFromWatchAlerts } from "~/services/dashboardAgentWatchAlerts.server";
 import { logger } from "~/services/logger.server";
+import { rbac } from "~/services/rbac.server";
 import { authenticateUatOrApiRequest } from "~/services/uatRoutePreamble.server";
+import { canAcrossEnvironments } from "~/v3/services/dashboardResourceAccess.server";
 
 /**
  * `DELETE /api/v1/dashboard-agent/alerts/:channelId` — stop alerting this channel
@@ -71,13 +73,26 @@ export async function action({ request, params }: ActionFunctionArgs) {
       );
     }
 
+    const access = await rbac.authenticateUserActor(request, {
+      organizationId: context.environment.organizationId,
+      projectId: context.environment.project.id,
+    });
+    if (!access.ok) {
+      return json({ error: access.error }, { status: access.status });
+    }
+
     const result = await unsubscribeChannelFromWatchAlerts(parsedParams.data.channelId, {
       projectId: context.environment.project.id,
       // A project is shared by every member, so the caller's own address is part of the scope.
       organizationId: context.environment.organizationId,
       ownerUserId: userId,
+      authorize: (environmentTypes) =>
+        canAcrossEnvironments(access.ability, "write", "alerts", environmentTypes),
     });
     if (!result.ok) {
+      if (result.reason === "forbidden") {
+        return json({ error: "You don't have permission to manage alerts" }, { status: 403 });
+      }
       if (result.reason === "conflict") {
         return json(
           { error: "That alert was being changed elsewhere. Try again.", code: "conflict" },

apps/webapp/app/routes/api.v1.dashboard-agent.alerts.ts

@@ -16,8 +16,10 @@ import {
   watchAlertDeduplicationKey,
 } from "~/services/dashboardAgentWatchAlerts.server";
 import { logger } from "~/services/logger.server";
+import { rbac } from "~/services/rbac.server";
 import { authenticateUatOrApiRequest } from "~/services/uatRoutePreamble.server";
 import { canUseDashboardAgentWatches } from "~/v3/canUseDashboardAgentWatches.server";
+import { canAcrossEnvironments } from "~/v3/services/dashboardResourceAccess.server";
 
 /**
  * `GET` lists this chat's project's watch alerts; `POST` subscribes the user's email. Only
@@ -168,6 +170,13 @@ export async function action({ request }: ActionFunctionArgs) {
     return json({ error: "Alerts are not available here", code: gate.reason }, { status: 403 });
   }
 
+  const access = await rbac.authenticateUserActor(request, {
+    organizationId: environment.organizationId,
+    projectId: environment.project.id,
+  });
+  if (!access.ok) {
+    return json({ error: access.error }, { status: access.status });
+  }
   // Only the signed-in user's own account email may be subscribed. Read off the
   // primary: this is the identity the subscription is pinned to.
   const user = await prisma.user.findFirst({ where: { id: userId }, select: { email: true } });
@@ -186,16 +195,31 @@ export async function action({ request }: ActionFunctionArgs) {
     );
   }
 
+  const deduplicationKey = watchAlertDeduplicationKey(email);
+  const existing = await prisma.projectAlertChannel.findFirst({
+    where: { projectId: environment.project.id, deduplicationKey },
+    select: { environmentTypes: true },
+  });
+  const environmentTypes = [...(existing?.environmentTypes ?? []), environment.type];
+  if (!canAcrossEnvironments(access.ability, "write", "alerts", environmentTypes)) {
+    return json({ error: "You don't have permission to manage alerts" }, { status: 403 });
+  }
+
   try {
     const channel = await subscribeChannelToWatchAlerts({
       userId,
       email,
       // Stable per (email, project), so asking twice re-enables one channel and asking from
       // a second environment adds that environment to it.
-      deduplicationKey: watchAlertDeduplicationKey(email),
+      deduplicationKey,
       environmentType: environment.type,
       project: environment.project,
+      authorize: (environmentTypes) =>
+        canAcrossEnvironments(access.ability, "write", "alerts", environmentTypes),
     });
+    if ("denied" in channel) {
+      return json({ error: "You don't have permission to manage alerts" }, { status: 403 });
+    }
 
     return json({ id: channel.id, type: channel.type, target: email, enabled: channel.enabled });
   } catch (error) {