What shipped at Anyshift, Week of August 17, 2026

The week of August 17, 2026 covered 4 product areas across Annie and the Anyshift Product Updates series.

The headline is PagerDuty as graph queries: who is on call, which incidents are open, which alerts are firing, and what else is related, from Annie CLI, Graph API, or the SDK.

Last week shipped Cloudflare Exposure Beta. This week extends those paths with origin reachability, EKS platform hops, and WAF change evidence.

2 releases carry most of the path: Graph API v0.2.77 and Annie CLI v0.8.50.

PagerDuty on the graph

PagerDuty incidents already triggered Annie investigations. This week the stored operational evidence is queryable on the same graph as the rest of your infrastructure.

After you connect PagerDuty, Annie CLI answers on-call and incident questions without a PagerDuty-specific namespace:

annie graph alerts --provider pagerduty --status firing
annie graph incidents --provider pagerduty --status active
annie graph incidents --provider pagerduty --responder "Jane Doe"
annie graph oncall --at now
annie graph oncall --person "Jane Doe" --at now
annie graph triage checkout --since 2h

--person and --responder accept a display name, canonical person ID, email (including + aliases), or PagerDuty user ID. Matching is exact and case-insensitive. Duplicate evidence from multiple PagerDuty identities is collapsed. If a user or service cannot be mapped, the result stays unresolved instead of guessing.

annie graph triage is deterministic evidence, not an Annie chat. Optional incident_context hops cover the incident, alerts, service (AFFECTS / RESOLVES_TO), on-call, responders, and similar reviewed history. Empty hops are omitted. Graph API v0.2.77 and Annie CLI v0.8.50 carry the workflow. These reads do not acknowledge, reassign, or resolve incidents. For on-call product context, see also On-call.

Cloudflare exposure goes further

Cloudflare Exposure Beta still traces a public hostname toward its origin. The new work is what the path can prove once it gets there.

Origin reachability tells you whether an ALB or NLB origin accepts traffic from outside Cloudflare, by comparing security-group ingress to pinned Cloudflare IP ranges. A restricted_to_cloudflare verdict means the evaluated listeners only allow Cloudflare. directly_reachable means at least one world-open or non-Cloudflare CIDR can hit the origin. The field is evidence on the path. It does not rewrite the overall exposure verdict.

annie graph exposure api.example.com --type CLOUDFLARE_HOSTNAME

Paths can now show when traffic lands on EKS-backed Kubernetes, with platform attribution and hop freshness from a live anyshift-k8s-agent sync. Exposure controls also stamp WAF action, phase, and enabled state, and managed-ruleset updates show up as first-class change events you can investigate against a hostname.

Coding agents keep using get_exposure on Graph MCP. Upgrade Annie CLI to v0.8.50+ for the matching local render of origin reachability.

Annie CLI install page and update checks in annie-cli v0.8.50

The public install page is annie-cli.anyshift.io. It lists the four supported platform downloads and stays in sync with the latest stable release.

Interactive sessions can tell you a newer Annie CLI is out. The TUI keeps the available version in the status bar, and a successful human-readable command may print one reminder every 24 hours. Check on demand:

annie update check
annie update check --output json

Annie reports the installed version, the latest version, and the release URL. It does not download or install the update. JSON output, pipes, CI, help, and version commands stay quiet. Turn passive checks off with annie config set update_check false or ANNIE_UPDATE_CHECK=off. Full detail is in Stay up to date.

VictoriaMetrics shows up in the connected list

VictoriaMetrics was already a queryable source (see the June 15 changelog). Connected-integration summaries and the Annie CLI banner were still omitting it, so a project whose only live-data source was Victoria could look empty.

Those summaries now include VictoriaMetrics. Browse the catalog from Integrations or open Integrations → Monitoring → VictoriaMetrics in the app.

FAQ

What shipped at Anyshift the week of August 17, 2026?

Four customer-facing updates. PagerDuty on-call, incidents, and alerts are queryable through Annie CLI, Graph API, and the Graph SDK. Cloudflare exposure paths add origin reachability plus EKS platform hops and WAF change evidence. Annie CLI publishes a public install page and tells interactive users when a newer release is available. Connected-integration summaries now list VictoriaMetrics.

How do I query PagerDuty from Annie CLI?

After connecting PagerDuty, use annie graph alerts, annie graph incidents, and annie graph oncall. Search responders by display name or email. annie graph triage checkout --since 2h assembles stored incident_context hops for that resource. The same evidence is on Graph API and the Graph SDK. These reads do not acknowledge or resolve incidents.

What is Cloudflare origin reachability?

On a public exposure path that ends at an AWS load balancer, originReachability tells you whether the origin accepts traffic from outside Cloudflare, based on security-group ingress compared to pinned Cloudflare IP ranges. Use annie graph exposure or Graph MCP get_exposure. It does not change the overall exposure verdict.

How does Annie CLI tell me about updates?

Interactive Annie CLI sessions can show a newer release in the TUI and an occasional reminder after a successful command. Run annie update check or annie update check --output json whenever you want the status. Annie does not download or install the update. Turn passive checks off with annie config set update_check false.

What changed for VictoriaMetrics this week?

VictoriaMetrics was already a queryable Annie source. Connected-integration summaries and the Annie CLI banner now include it, so a project that only has Victoria no longer looks like it has no live-data integration.

Ready to try it? Open app.anyshift.io or start from the docs.