@obsunified/collector 2.2.0 → 2.2.3

package/src/migrations-postgres/051_incident_active_dedup_unique.sql

@@ -0,0 +1,31 @@
+-- (PostgreSQL mirror) Make active-incident deduplication race-free (RFC 0013 § 6.A, governance review B4).
+--
+-- `openOrDeduplicateIncident` used to SELECT-then-INSERT, so two concurrent
+-- alerts for the same symptom could each open an incident. A partial UNIQUE
+-- index lets the database arbitrate; the application inserts with
+-- ON CONFLICT DO NOTHING and re-reads the winner.
+
+-- Collapse any pre-existing duplicate active rows (keep the newest per key) so
+-- the index can be built. Older duplicates are closed as escalated, not deleted.
+UPDATE incident_investigations
+SET status = 'escalated'
+WHERE status IN ('open', 'dispatched', 'leased', 'remediating', 'verifying')
+  AND EXISTS (
+    SELECT 1 FROM incident_investigations o
+    WHERE o.project_id = incident_investigations.project_id
+      AND o.environment = incident_investigations.environment
+      AND o.dedup_key = incident_investigations.dedup_key
+      AND o.status IN ('open', 'dispatched', 'leased', 'remediating', 'verifying')
+      AND (
+        o.opened_at > incident_investigations.opened_at
+        OR (o.opened_at = incident_investigations.opened_at AND o.id > incident_investigations.id)
+      )
+  );
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_incidents_active_dedup
+  ON incident_investigations (project_id, environment, dedup_key)
+  WHERE status IN ('open', 'dispatched', 'leased', 'remediating', 'verifying');
+
+-- Watchdog (governance review B11): a finding is only `recovered` after two
+-- consecutive checkpoints with sufficient traffic and a healthy error rate.
+ALTER TABLE investigation_findings ADD COLUMN IF NOT EXISTS consecutive_ok_checks BIGINT NOT NULL DEFAULT 0;

package/src/migrations-postgres/052_remediation_callback.sql

@@ -0,0 +1,10 @@
+-- (PostgreSQL mirror) Persisted grant-handoff callback (RFC 0013 § 6.B, journey review J17).
+--
+-- A proposal parked for human approval may carry a webhook that receives the
+-- one-time grant token when the approval happens later. `callback_url` is the
+-- target (SSRF-guarded again at delivery time); `callback_secret` is the HMAC
+-- signing secret, stored as supplied (the collector has no at-rest encryption
+-- helper) and never returned by any GET. Both are cleared once the grant is
+-- delivered, rejected or expired.
+ALTER TABLE remediation_proposals ADD COLUMN IF NOT EXISTS callback_url TEXT;
+ALTER TABLE remediation_proposals ADD COLUMN IF NOT EXISTS callback_secret TEXT;

package/src/migrations-postgres/053_remediation_callback_delivery.sql

@@ -0,0 +1,7 @@
+-- (PostgreSQL mirror) Last grant-handoff webhook delivery outcome (RFC 0013 § 6.B).
+--
+-- JSON `{status: 'delivered'|'failed', attempts, lastError, at}` recorded after
+-- the grant webhook is attempted (up to 3 attempts). It never contains the
+-- callback URL or secret, so unlike callback_url it is kept after approval so
+-- the dashboard can flag a failed handoff.
+ALTER TABLE remediation_proposals ADD COLUMN IF NOT EXISTS callback_delivery TEXT;

package/src/plugins/ai-call-by-id.test.ts

@@ -0,0 +1,73 @@
+import type { MiddlewareHandler } from "hono";
+import { describe, expect, it } from "vitest";
+import { createTelemetryCollectorApp } from "../framework/collector";
+import type { CollectorEnv } from "../framework/env";
+import { MemSqlDb } from "../lib/test-utils/mem-sql-db";
+import { aiReceiverPlugin } from "./ai-receiver";
+
+const passthrough: MiddlewareHandler<{
+	Bindings: CollectorEnv;
+	Variables: { projectId: string };
+}> = async (c, next) => {
+	c.set("projectId", "default");
+	await next();
+};
+
+const app = createTelemetryCollectorApp({
+	plugins: [aiReceiverPlugin],
+	auth: { middleware: passthrough },
+	dashboardAuth: { middleware: passthrough, registerRoutes: () => {} },
+});
+
+const row = {
+	project_id: "default",
+	call_id: "call-1",
+	trace_id: "trace-1",
+	span_id: "span-1",
+	service_name: "svc",
+	model_name: "gpt-4.1",
+	provider: "openai",
+	call_type: "chat",
+	request_json: null,
+	response_json: null,
+	prompt_tokens: 10,
+	completion_tokens: 5,
+	total_cost_usd: 0.01,
+	latency_ms: 120,
+	is_error: 0,
+	error_message: null,
+	occurred_at: "2026-05-01T00:00:00.000Z",
+	received_at: "2026-05-01T00:00:01.000Z",
+	expires_at: "2026-05-02T00:00:00.000Z",
+};
+
+describe("GET /internal/ai/calls/:callId", () => {
+	it("returns the call with its trace and span ids", async () => {
+		const db = new MemSqlDb({
+			first: (sql, binds) =>
+				sql.includes("FROM ai_calls") && binds[1] === "call-1" ? row : null,
+		});
+		const res = await app.request("/internal/ai/calls/call-1", {}, {
+			DB: db,
+		} as unknown as CollectorEnv);
+		expect(res.status).toBe(200);
+		const body = (await res.json()) as {
+			call: { callId: string; modelName: string };
+			traceId: string;
+			spanId: string;
+		};
+		expect(body.call.callId).toBe("call-1");
+		expect(body.call.modelName).toBe("gpt-4.1");
+		expect(body.traceId).toBe("trace-1");
+		expect(body.spanId).toBe("span-1");
+		expect(db.calls[0].binds).toEqual(["default", "call-1"]);
+	});
+
+	it("answers 404 for an unknown call id", async () => {
+		const db = new MemSqlDb({ first: () => null });
+		const res = await app.request("/internal/ai/calls/nope", {}, {
+			DB: db,
+		} as unknown as CollectorEnv);
+		expect(res.status).toBe(404);
+	});
+});

package/src/plugins/ai-receiver.ts

@@ -97,6 +97,16 @@ export const aiReceiverPlugin: CollectorPlugin = {
 			return c.json(response);
 		});
 
+		// One AI call by its call id, with the trace/span it belongs to. Backs
+		// the `#/ai/calls/<id>` deep link when the call is outside the loaded list.
+		app.get("/internal/ai/calls/:callId", async (c) => {
+			const projectId = getProjectId(c);
+			const store = new AIStore(sqlDbFor(c.env));
+			const call = await store.getAICall(projectId, c.req.param("callId"));
+			if (!call) return c.json({ error: "AI call not found" }, 404);
+			return c.json({ call, traceId: call.traceId, spanId: call.spanId });
+		});
+
 		// OpenInference-kind spans (LLM/TOOL/RETRIEVER/CHAIN/AGENT/...) joined
 		// with their payload side-table. This is the replacement for the flat
 		// ai_calls endpoint — it returns typed spans that live inside the

package/src/plugins/alerts-evaluator.ts

@@ -11,7 +11,10 @@ import {
 	type Logger,
 } from "../framework/logger";
 import { AlertsStore, compareValue } from "../lib/alerts-store";
-import { openOrDeduplicateIncident } from "../lib/autosre-remediation-gate";
+import {
+	openOrDeduplicateIncident,
+	resolveServiceIncidentTarget,
+} from "../lib/autosre-remediation-gate";
 import { sqlDbFor } from "../lib/sql-db";
 import {
 	assertSafeWebhookUrl,
@@ -439,9 +442,18 @@ export async function evaluateAllRules(
 		allowPrivateWebhookTargets,
 		hostLookup: options?.hostLookup,
 		onAlertFiring: async (rule) => {
+			// Target the rule's service when it names one (environment taken from
+			// that service's latest spans); otherwise fall back to the rule itself.
+			const target = await resolveServiceIncidentTarget(
+				db,
+				rule.projectId,
+				(rule.query as { serviceName?: string }).serviceName,
+				`alert:${rule.id}`,
+				logger,
+			);
 			await openOrDeduplicateIncident(db, rule.projectId, {
-				environment: "default",
-				targetNodeId: `alert:${rule.id}`,
+				environment: target.environment,
+				targetNodeId: target.targetNodeId,
 				symptomAnchorKind: "alert",
 				symptomAnchorId: rule.id,
 			});