@obsunified/collector 2.2.0 → 2.2.3

package/src/auth/dashboard-auth.test.ts

@@ -789,3 +789,64 @@ describe("dashboard-auth middleware & programmatic token contract", () => {
 		});
 	});
 });
+
+describe("session cookie Secure attribute", () => {
+	const loginCookie = async (
+		url: string,
+		headers: Record<string, string>,
+		trustProxyHeaders: boolean | undefined,
+	): Promise<string> => {
+		const auth = createDashboardAuth({
+			password: TEST_PASSWORD,
+			token: TEST_TOKEN,
+			loginRateLimit: { trustProxyHeaders, warn: () => {} },
+		});
+		const app = new Hono<{ Bindings: CollectorEnv }>();
+		auth.registerRoutes(app);
+		const res = await app.fetch(
+			new Request(url, {
+				method: "POST",
+				headers: { "Content-Type": "application/json", ...headers },
+				body: JSON.stringify({ password: TEST_PASSWORD }),
+			}),
+			makeEnv(createTestDb()),
+		);
+		expect(res.status).toBe(200);
+		return res.headers.get("Set-Cookie") ?? "";
+	};
+
+	it("sets Secure for an https request URL", async () => {
+		expect(await loginCookie("https://x.test/auth/login", {}, false)).toContain(
+			"; Secure",
+		);
+	});
+
+	it("sets Secure for X-Forwarded-Proto: https when the proxy is trusted", async () => {
+		const cookie = await loginCookie(
+			"http://x.test/auth/login",
+			{ "x-forwarded-proto": "https" },
+			true,
+		);
+		expect(cookie).toContain("; Secure");
+	});
+
+	it("ignores X-Forwarded-Proto when the proxy is not trusted, and on plain http", async () => {
+		expect(
+			await loginCookie(
+				"http://x.test/auth/login",
+				{ "x-forwarded-proto": "https" },
+				undefined,
+			),
+		).not.toContain("Secure");
+		expect(
+			await loginCookie(
+				"http://x.test/auth/login",
+				{ "x-forwarded-proto": "http" },
+				true,
+			),
+		).not.toContain("Secure");
+		expect(
+			await loginCookie("http://x.test/auth/login", {}, true),
+		).not.toContain("Secure");
+	});
+});

package/src/auth/dashboard-auth.ts

@@ -293,6 +293,21 @@ export function createDashboardAuth(config?: DashboardAuthConfig): {
 				: new LoginRateLimiter(config?.loginRateLimit ?? {});
 		let warnedUnkeyedClient = false;
 
+		// `Secure` when the request itself is https, or when the operator
+		// declared a trusted TLS-terminating proxy (`trustProxyHeaders`, i.e.
+		// TRUST_PROXY) that reports `X-Forwarded-Proto: https`.
+		const isSecureRequest = (
+			c: Context<{ Bindings: CollectorEnv }>,
+			limitConfig: { trustProxyHeaders?: boolean } | undefined,
+		): boolean =>
+			c.req.url.startsWith("https:") ||
+			(limitConfig?.trustProxyHeaders === true &&
+				c.req
+					.header("x-forwarded-proto")
+					?.split(",")[0]
+					?.trim()
+					.toLowerCase() === "https");
+
 		app.post("/auth/login", async (c) => {
 			const configuredPassword = config?.password ?? c.env.DASHBOARD_PASSWORD;
 			if (!configuredPassword) {
@@ -342,7 +357,7 @@ export function createDashboardAuth(config?: DashboardAuthConfig): {
 			const sig = await sign(payload, configuredPassword);
 			const cookieValue = `${payload}.${sig}`;
 
-			const isSecure = c.req.url.startsWith("https:");
+			const isSecure = isSecureRequest(c, config?.loginRateLimit || undefined);
 			c.header(
 				"Set-Cookie",
 				`${SESSION_COOKIE}=${encodeURIComponent(cookieValue)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${SESSION_MAX_AGE}${isSecure ? "; Secure" : ""}`,
@@ -405,7 +420,7 @@ export function createDashboardAuth(config?: DashboardAuthConfig): {
 		});
 
 		app.post("/auth/logout", (c) => {
-			const isSecure = c.req.url.startsWith("https:");
+			const isSecure = isSecureRequest(c, config?.loginRateLimit || undefined);
 			c.header(
 				"Set-Cookie",
 				`${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${isSecure ? "; Secure" : ""}`,

package/src/lib/ai-store/calls.ts

@@ -53,6 +53,48 @@ export async function ingestAICallBatch(
 	await db.batch(batch);
 }
 
+function mapAICallRow(row: AICallRow): AICallRecord {
+	return {
+		projectId: row.project_id ?? "default",
+		callId: row.call_id,
+		traceId: row.trace_id,
+		spanId: row.span_id,
+		serviceName: row.service_name,
+		modelName: row.model_name,
+		provider: row.provider,
+		callType: row.call_type,
+		requestJson: row.request_json,
+		responseJson: row.response_json,
+		promptTokens: row.prompt_tokens,
+		completionTokens: row.completion_tokens,
+		totalCostUsd: row.total_cost_usd,
+		latencyMs: row.latency_ms,
+		isError: row.is_error === 1 || row.is_error === true,
+		errorMessage: row.error_message,
+		occurredAt: row.occurred_at,
+		receivedAt: row.received_at,
+		expiresAt: row.expires_at,
+		sessionId: row.session_id ?? null,
+		interactionId: row.interaction_id ?? null,
+	};
+}
+
+/** One call by id, scoped to the project; `null` when absent. */
+export async function getAICallById(
+	db: SqlDb,
+	projectId: string,
+	callId: string,
+): Promise<AICallRecord | null> {
+	if (!projectId) throw new Error("AIStore.getAICall: projectId is required");
+	const row = await db
+		.prepare(
+			`SELECT * FROM ai_calls WHERE project_id = ? AND call_id = ? LIMIT 1`,
+		)
+		.bind(projectId, callId)
+		.first<AICallRow>();
+	return row ? mapAICallRow(row) : null;
+}
+
 export async function getAICallsOverview(
 	db: SqlDb,
 	options: AICallsOverviewOptions,
@@ -109,29 +151,7 @@ export async function getAICallsOverview(
 			.bind(...summaryParams)
 			.first<AICallSummaryRow>()) || {};
 
-	const calls: AICallRecord[] = (results.results || []).map((row) => ({
-		projectId: row.project_id ?? "default",
-		callId: row.call_id,
-		traceId: row.trace_id,
-		spanId: row.span_id,
-		serviceName: row.service_name,
-		modelName: row.model_name,
-		provider: row.provider,
-		callType: row.call_type,
-		requestJson: row.request_json,
-		responseJson: row.response_json,
-		promptTokens: row.prompt_tokens,
-		completionTokens: row.completion_tokens,
-		totalCostUsd: row.total_cost_usd,
-		latencyMs: row.latency_ms,
-		isError: row.is_error === 1 || row.is_error === true,
-		errorMessage: row.error_message,
-		occurredAt: row.occurred_at,
-		receivedAt: row.received_at,
-		expiresAt: row.expires_at,
-		sessionId: row.session_id ?? null,
-		interactionId: row.interaction_id ?? null,
-	}));
+	const calls: AICallRecord[] = (results.results || []).map(mapAICallRow);
 
 	return {
 		calls,

package/src/lib/ai-store.ts

@@ -10,7 +10,11 @@ import type {
 	AISpansOverviewOptions,
 	AISpansOverviewResponse,
 } from "@obsunified/types";
-import { getAICallsOverview, ingestAICallBatch } from "./ai-store/calls";
+import {
+	getAICallById,
+	getAICallsOverview,
+	ingestAICallBatch,
+} from "./ai-store/calls";
 import {
 	getAIEvaluation,
 	ingestAIEvaluations,
@@ -37,6 +41,13 @@ export class AIStore {
 		return getAICallsOverview(this.db, options);
 	}
 
+	async getAICall(
+		projectId: string,
+		callId: string,
+	): Promise<AICallRecord | null> {
+		return getAICallById(this.db, projectId, callId);
+	}
+
 	async purgeExpired(): Promise<number> {
 		return purgeExpiredAIData(this.db);
 	}

package/src/lib/analyses-runner.ts

@@ -36,7 +36,11 @@ import {
 	type Logger,
 } from "../framework/logger";
 import { AnalysesStore } from "./analyses-store";
-import { openOrDeduplicateIncident } from "./autosre-remediation-gate";
+import {
+	evaluateRemediationWatchdogs,
+	openOrDeduplicateIncident,
+	resolveServiceIncidentTarget,
+} from "./autosre-remediation-gate";
 import { generateNarrative, LlmCallError, type LlmConfig } from "./llm";
 import {
 	computeSignature,
@@ -292,6 +296,20 @@ export async function runAllDueAnalyses(
 		totals.narrated += summary.narrated;
 		totals.skipped += summary.skipped ?? 0;
 	}
+
+	// RFC 0013 § 5.B: the post-remediation watchdog (grant/claim timeouts and the
+	// +2m/+5m/+15m recovery checkpoints) rides the 1-minute tick so checkpoints
+	// are evaluated close to when they come due. Cross-project by design.
+	try {
+		const wd = await evaluateRemediationWatchdogs(db, { logger });
+		if (wd.evaluated + wd.timedOutClaims + wd.expiredGrants + wd.failed > 0) {
+			logger.info("[analyses] remediation watchdog summary", { ...wd });
+		}
+	} catch (error) {
+		logger.error("[analyses] remediation watchdog failed", {
+			error: error instanceof Error ? error.message : String(error),
+		});
+	}
 	return totals;
 }
 
@@ -477,12 +495,31 @@ async function runDueAnalysesForProject(
 						}
 						await store.insertResult(result, expiresAt);
 						if (result.status === "critical") {
-							await openOrDeduplicateIncident(db, projectId, {
-								environment: "default",
-								targetNodeId: `analysis:${def.id}`,
-								symptomAnchorKind: "analysis",
-								symptomAnchorId: def.id,
-							}).catch(() => undefined);
+							try {
+								const scopeService = def.scope?.service;
+								const target = await resolveServiceIncidentTarget(
+									db,
+									projectId,
+									typeof scopeService === "string" ? scopeService : null,
+									`analysis:${def.id}`,
+									logger,
+								);
+								await openOrDeduplicateIncident(db, projectId, {
+									environment: target.environment,
+									targetNodeId: target.targetNodeId,
+									symptomAnchorKind: "analysis",
+									symptomAnchorId: def.id,
+								});
+							} catch (incidentError) {
+								// Incident bookkeeping must not fail the analysis run.
+								logger.error("[analyses] failed to open incident", {
+									analysis_id: def.id,
+									error:
+										incidentError instanceof Error
+											? incidentError.message
+											: String(incidentError),
+								});
+							}
 						}
 						// markRan releases the claim as a side-effect.
 						await store.markRan(projectId, def.id, result.generatedAt);

package/src/lib/autosre-change-correlation.ts

@@ -12,6 +12,7 @@ import type {
 	RelationshipCertainty,
 } from "@obsunified/types";
 import { buildCanonicalNodeId } from "@obsunified/types";
+import { normalizeEnvironment } from "@obsunified/types/lineage";
 import { randomHex } from "./hash";
 import { parseJsonArray, parseJsonRecord } from "./json";
 import type { SqlDb } from "./sql-db";
@@ -73,14 +74,30 @@ export const mapChangeEventRow = (row: ChangeEventRow): ChangeEvent => ({
 	expiresAt: row.expires_at,
 });
 
+export class InvalidTimestampError extends Error {
+	constructor(field: string, value: string) {
+		super(`${field} must be a valid ISO-8601 timestamp, got "${value}"`);
+		this.name = "InvalidTimestampError";
+	}
+}
+
+/** Canonicalizes a client timestamp to `toISOString()` form so string comparison in SQL is sound. */
+const normalizeTimestamp = (field: string, value: string): string => {
+	const ms = new Date(value).getTime();
+	if (!Number.isFinite(ms)) throw new InvalidTimestampError(field, value);
+	return new Date(ms).toISOString();
+};
+
 export async function recordChangeEvent(
 	db: SqlDb,
 	projectId: string,
 	input: ChangeEventInput,
 ): Promise<ChangeEvent> {
 	const nowIso = new Date().toISOString();
-	const occurredAt = input.occurredAt || nowIso;
-	const environment = (input.environment || "default").trim().toLowerCase();
+	const occurredAt = input.occurredAt
+		? normalizeTimestamp("occurredAt", input.occurredAt)
+		: nowIso;
+	const environment = normalizeEnvironment(input.environment);
 	const namespace = (input.namespace || "default").trim();
 	const serviceName = input.serviceName?.trim() || null;
 
@@ -257,7 +274,7 @@ export async function listChangeEvents(
 	}
 	if (options.since) {
 		conditions.push("occurred_at >= ?");
-		binds.push(options.since);
+		binds.push(normalizeTimestamp("since", options.since));
 	}
 
 	const limit = Math.max(1, Math.min(200, options.limit ?? 50));
@@ -346,8 +363,10 @@ const summarizeCohort = (
 		requestCount > 0 ? downstreamCount / requestCount : 0;
 	const avgDownstreamDurationMs =
 		downstreamCount > 0
-			? downstreamSpans.reduce((acc, s) => acc + Number(s.duration_ms ?? 0), 0) /
-				downstreamCount
+			? downstreamSpans.reduce(
+					(acc, s) => acc + Number(s.duration_ms ?? 0),
+					0,
+				) / downstreamCount
 			: null;
 
 	return {
@@ -433,7 +452,9 @@ export async function findCrossTraceContention(
 			}>(),
 	]);
 
-	const isScoped = nodeRow ? nodeRow.is_scoped_identity === 1 : !options.targetNodeId.includes(":unscoped/");
+	const isScoped = nodeRow
+		? nodeRow.is_scoped_identity === 1
+		: !options.targetNodeId.includes(":unscoped/");
 	const relationshipCertainty: RelationshipCertainty = isScoped
 		? "exact"
 		: "inferred";
@@ -455,7 +476,11 @@ export async function findCrossTraceContention(
 const extractFilePathsFromSpan = (span: SpanCohortSampleRow): string[] => {
 	const found: string[] = [];
 	const attrs = parseJsonRecord(span.attributes_json ?? "{}");
-	for (const key of ["code.filepath", "obs.code.filepath", "exception.stacktrace"]) {
+	for (const key of [
+		"code.filepath",
+		"obs.code.filepath",
+		"exception.stacktrace",
+	]) {
 		const val = attrs[key];
 		if (typeof val === "string") {
 			found.push(val);
@@ -556,9 +581,9 @@ export async function computeChangeBlastRadius(
 
 	const flagKey =
 		change.kind === "feature_flag"
-			? (typeof change.attributes.flagKey === "string"
+			? ((typeof change.attributes.flagKey === "string"
 					? change.attributes.flagKey
-					: change.serviceName) ?? "flag"
+					: change.serviceName) ?? "flag")
 			: null;
 
 	const newCohortKey =
@@ -577,7 +602,10 @@ export async function computeChangeBlastRadius(
 			const attrs = parseJsonRecord(s.attributes_json ?? "{}");
 			const direct = attrs[`obs.feature_flags.${flagKey}`];
 			if (direct !== undefined && direct !== null) return String(direct);
-			if (attrs["feature_flag.key"] === flagKey && attrs["feature_flag.variant"] !== undefined) {
+			if (
+				attrs["feature_flag.key"] === flagKey &&
+				attrs["feature_flag.variant"] !== undefined
+			) {
 				return String(attrs["feature_flag.variant"]);
 			}
 			const nested = attrs["obs.feature_flags"];
@@ -732,8 +760,7 @@ export async function computeChangeBlastRadius(
 	} else if (preBaseline.requestCount >= minSample) {
 		// Instant 100% cutover: compare post-change v_new vs pre-change baseline
 		rateDifference = newCohort.errorRate - preBaseline.errorRate;
-		relativeRisk =
-			newCohort.errorRate / Math.max(preBaseline.errorRate, 0.001);
+		relativeRisk = newCohort.errorRate / Math.max(preBaseline.errorRate, 0.001);
 		const p95Ratio =
 			newCohort.p95DurationMs !== null &&
 			preBaseline.p95DurationMs !== null &&