# alert_reviewer.py
import yaml
from pathlib import Path
from anthropic import Anthropic

client = Anthropic()

def review_alerting_rules(rules_file: str) -> str:
    """Review Prometheus alerting rules for common issues."""
    rules = Path(rules_file).read_text()

    response = client.messages.create(
        model="claude-opus-4-6",
        max_tokens=3000,
        messages=[{
            "role": "user",
            "content": f"""You are a Prometheus and SRE expert. Review these alerting rules
for quality issues.

For each problematic alert, provide:
ALERT: [alert name]
ISSUE: [what's wrong]
SEVERITY: [Critical/High/Medium/Low]
FIX: [corrected PromQL expression or configuration]

Check for:
1. Missing `for` clauses (fires on single spikes)
2. Missing `job` or `service` label filters (fires across all services)
3. Threshold too sensitive (minor spikes trigger)
4. Threshold too lax (real issues missed)
5. Missing inhibition rules for cascading alerts
6. Complex PromQL that could be simplified
7. Missing `summary` and `description` annotations
8. Duplicate or redundant alerts covering same condition

Rules file:
{rules[:5000]}"""
        }]
    )
    return response.content[0].text

# Review all rules files
for rules_file in Path("alerts/").glob("*.yaml"):
    print(f"\n=== Reviewing {rules_file.name} ===")
    review = review_alerting_rules(str(rules_file))
    print(review)

def generate_slo_alerts(slo_config: dict) -> str:
    """Generate Prometheus alerting rules from SLO definition."""
    response = client.messages.create(
        model="claude-opus-4-6",
        max_tokens=2500,
        messages=[{
            "role": "user",
            "content": f"""Generate Prometheus alerting rules implementing multi-window
multi-burn-rate SLO alerts for this service.

SLO Configuration:
{yaml.dump(slo_config, default_flow_style=False)}

Generate:
1. Error budget burn rate alerts (page and ticket severity)
   - 1h + 5m windows (fast burn: 14.4x budget)
   - 6h + 30m windows (slow burn: 6x budget)
   - 24h + 2h windows (slow burn: 3x budget)
2. Availability alert
3. Latency alert at the defined SLO threshold
4. Inhibition rules to suppress ticket alerts when pager fires

Use these labels: severity=page|ticket, team=[team from config]
Include runbook_url in annotations.

Return valid Prometheus YAML rules format."""
        }]
    )
    return response.content[0].text

# Example SLO configuration
payment_slo = {
    "service": "payment-service",
    "team": "payments",
    "slos": {
        "availability": {
            "target": 0.999,  # 99.9%
            "window": "30d"
        },
        "latency": {
            "p99_target_ms": 500,
            "window": "30d"
        }
    },
    "metric_labels": {
        "job": "payment-service",
        "namespace": "production"
    },
    "runbook_base_url": "https://wiki.example.com/runbooks/payments"
}

rules_yaml = generate_slo_alerts(payment_slo)
print(rules_yaml)

def recommend_thresholds(
    metric_name: str,
    historical_stats: dict,
    desired_false_positive_rate: float = 0.01
) -> str:
    """Recommend alert thresholds based on historical data."""
    response = client.messages.create(
        model="claude-opus-4-6",
        max_tokens=1000,
        messages=[{
            "role": "user",
            "content": f"""Recommend Prometheus alert thresholds for {metric_name}.

Historical statistics (90 days):
{yaml.dump(historical_stats, default_flow_style=False)}

Target: false positive rate below {desired_false_positive_rate * 100}%
(i.e., alert should fire on real issues, not normal variation)

Provide:
1. RECOMMENDED_THRESHOLD: Value and why
2. FOR_DURATION: How long metric must exceed threshold before alerting
3. PROMQL_EXPRESSION: Ready-to-use alert expression
4. EXPECTED_FP_RATE: Estimated false positive rate with this threshold
5. TRADEOFF: What incident severity this threshold might miss"""
        }]
    )
    return response.content[0].text

# Example: tune CPU alert threshold
cpu_stats = {
    "mean": 42.3,
    "p50": 40.1,
    "p90": 61.2,
    "p95": 68.4,
    "p99": 78.1,
    "max": 94.2,
    "incident_cpu_levels": [82, 87, 91],  # CPU at time of past incidents
    "false_positive_threshold": 75,         # Current threshold causing false positives
    "false_positive_frequency": "3x per week"
}

recommendation = recommend_thresholds("CPU utilization", cpu_stats)
print(recommendation)

def generate_runbook(alert_config: dict, service_info: dict) -> str:
    """Generate an on-call runbook for a Prometheus alert."""
    response = client.messages.create(
        model="claude-opus-4-6",
        max_tokens=2000,
        messages=[{
            "role": "user",
            "content": f"""Write an on-call runbook for this Prometheus alert.

Alert: {yaml.dump(alert_config, default_flow_style=False)}
Service: {yaml.dump(service_info, default_flow_style=False)}

Format:
## [Alert Name]

**Severity**: [from alert]
**Summary**: [one line]

### What This Alert Means
[2-3 sentences explaining what's happening]

### Initial Triage (2 minutes)
[3-5 specific commands to run first]

### Common Causes
[Ordered list: most common first]

### Remediation Steps
[Per cause, what to do]

### Escalation
When to escalate and to whom

Use specific kubectl/aws/curl commands. Reference actual metric names."""
        }]
    )
    return response.content[0].text