@obsunified/collector 2.2.1 → 2.2.3

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   randomHex,
   sha256Hex,
   sqlDbFor
-} from "./chunk-KMEZKGSO.js";
+} from "./chunk-2FALTDCE.js";
 import {
   LlmCallError,
   aiEvaluationEvidenceReferences,
@@ -289,6 +289,38 @@ async function ingestAICallBatch(db, calls) {
   });
   await db.batch(batch);
 }
+function mapAICallRow(row) {
+  return {
+    projectId: row.project_id ?? "default",
+    callId: row.call_id,
+    traceId: row.trace_id,
+    spanId: row.span_id,
+    serviceName: row.service_name,
+    modelName: row.model_name,
+    provider: row.provider,
+    callType: row.call_type,
+    requestJson: row.request_json,
+    responseJson: row.response_json,
+    promptTokens: row.prompt_tokens,
+    completionTokens: row.completion_tokens,
+    totalCostUsd: row.total_cost_usd,
+    latencyMs: row.latency_ms,
+    isError: row.is_error === 1 || row.is_error === true,
+    errorMessage: row.error_message,
+    occurredAt: row.occurred_at,
+    receivedAt: row.received_at,
+    expiresAt: row.expires_at,
+    sessionId: row.session_id ?? null,
+    interactionId: row.interaction_id ?? null
+  };
+}
+async function getAICallById(db, projectId, callId) {
+  if (!projectId) throw new Error("AIStore.getAICall: projectId is required");
+  const row = await db.prepare(
+    `SELECT * FROM ai_calls WHERE project_id = ? AND call_id = ? LIMIT 1`
+  ).bind(projectId, callId).first();
+  return row ? mapAICallRow(row) : null;
+}
 async function getAICallsOverview(db, options) {
   if (!options.projectId)
     throw new Error("AIStore.getAICalls: projectId is required");
@@ -329,29 +361,7 @@ async function getAICallsOverview(db, options) {
   const summaryParams = [options.projectId, hours];
   if (options.service) summaryParams.push(options.service);
   const summaryResult = await db.prepare(summarySql).bind(...summaryParams).first() || {};
-  const calls = (results.results || []).map((row) => ({
-    projectId: row.project_id ?? "default",
-    callId: row.call_id,
-    traceId: row.trace_id,
-    spanId: row.span_id,
-    serviceName: row.service_name,
-    modelName: row.model_name,
-    provider: row.provider,
-    callType: row.call_type,
-    requestJson: row.request_json,
-    responseJson: row.response_json,
-    promptTokens: row.prompt_tokens,
-    completionTokens: row.completion_tokens,
-    totalCostUsd: row.total_cost_usd,
-    latencyMs: row.latency_ms,
-    isError: row.is_error === 1 || row.is_error === true,
-    errorMessage: row.error_message,
-    occurredAt: row.occurred_at,
-    receivedAt: row.received_at,
-    expiresAt: row.expires_at,
-    sessionId: row.session_id ?? null,
-    interactionId: row.interaction_id ?? null
-  }));
+  const calls = (results.results || []).map(mapAICallRow);
   return {
     calls,
     summary: {
@@ -861,6 +871,9 @@ var AIStore = class {
   async getAICalls(options) {
     return getAICallsOverview(this.db, options);
   }
+  async getAICall(projectId, callId) {
+    return getAICallById(this.db, projectId, callId);
+  }
   async purgeExpired() {
     return purgeExpiredAIData(this.db);
   }
@@ -2494,7 +2507,8 @@ import { AgentAutonomyLevel } from "@obsunified/types/constants";
 // src/lib/autosre-findings.ts
 import {
   buildCanonicalNodeId as buildCanonicalNodeId2,
-  buildFindingFingerprint
+  buildFindingFingerprint,
+  OntologyNodeKindSchema
 } from "@obsunified/types";
 
 // src/lib/autosre-change-correlation.ts
@@ -3112,24 +3126,98 @@ function resolveSafeCausalProofTier(input, serverCohortVerdict) {
   }
   return "unverified_locus";
 }
+async function loadFaultLocusSpan(db, projectId, environment, spanId, traceId) {
+  if (!spanId) return null;
+  return db.prepare(
+    `SELECT service_name, span_name, status_message, error_signature
+			 FROM telemetry_spans
+			 WHERE project_id = ? AND environment = ? AND span_id = ?
+			 ${traceId ? "AND trace_id = ?" : ""}
+			 ORDER BY start_time DESC
+			 LIMIT 1`
+  ).bind(
+    ...traceId ? [projectId, environment, spanId, traceId] : [projectId, environment, spanId]
+  ).first();
+}
+function looksLikeCanonicalNodeId(id) {
+  const parts = id.split(":");
+  return parts.length >= 4 && OntologyNodeKindSchema.options.includes(parts[0]);
+}
+function splitTraceSpanLocus(id) {
+  if (looksLikeCanonicalNodeId(id)) return null;
+  const parts = id.split(":");
+  if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+  return { traceId: parts[0], spanId: parts[1] };
+}
+function fingerprintInputFromSpan(span, environment) {
+  return {
+    environment,
+    originatingNodeId: buildCanonicalNodeId2({
+      kind: "service",
+      environment,
+      serviceName: span.service_name || "unknown-service"
+    }).id,
+    // Empty strings are "absent": returning undefined lets the caller's
+    // `??` chain reach its title/summary fallbacks.
+    normalizedOperation: span.span_name?.trim() || void 0,
+    errorSignature: span.error_signature?.trim() || span.status_message?.trim() || void 0,
+    downstreamTargetNodeId: null
+  };
+}
 async function recordInvestigationFinding(db, projectId, input, options = {}) {
   const logger = options.logger ?? consoleLogger;
   const nowIso = (/* @__PURE__ */ new Date()).toISOString();
   const environment = (input.environment ?? input.fingerprintInput?.environment ?? "default").trim().toLowerCase();
-  const defaultOriginNode = input.faultLocusEntityId.includes(":") ? input.faultLocusEntityId : buildCanonicalNodeId2({
+  const idempotencyKey = input.idempotencyKey?.trim();
+  let idempotencyId;
+  if (idempotencyKey) {
+    idempotencyId = `fnd_k${(await sha256Hex(`${projectId}\0${environment}\0${idempotencyKey}`)).slice(0, 20)}`;
+    const replay = await getInvestigationFinding(
+      db,
+      projectId,
+      idempotencyId,
+      environment
+    );
+    if (replay) return replay;
+  }
+  const supplied = input.fingerprintInput ?? {};
+  const locusId = input.faultLocusEntityId.trim();
+  let spanDerived = {};
+  const traceSpan = input.faultLocusEntityKind === "span" ? splitTraceSpanLocus(locusId) : null;
+  if (traceSpan) {
+    const spanRow = await loadFaultLocusSpan(
+      db,
+      projectId,
+      environment,
+      traceSpan.spanId,
+      traceSpan.traceId
+    );
+    if (spanRow) spanDerived = fingerprintInputFromSpan(spanRow, environment);
+  } else if (!locusId.includes(":") && input.faultLocusEntityKind !== "service") {
+    const spanRow = await loadFaultLocusSpan(
+      db,
+      projectId,
+      environment,
+      locusId
+    );
+    if (spanRow) spanDerived = fingerprintInputFromSpan(spanRow, environment);
+  }
+  const defaultOriginNode = locusId.includes(":") ? traceSpan ? buildCanonicalNodeId2({
     kind: "service",
     environment,
-    serviceName: input.faultLocusEntityId
+    serviceName: locusId
+  }).id : locusId : buildCanonicalNodeId2({
+    kind: "service",
+    environment,
+    serviceName: locusId
   }).id;
-  const fpResult = buildFindingFingerprint(
-    input.fingerprintInput ?? {
-      environment,
-      originatingNodeId: defaultOriginNode,
-      normalizedOperation: input.title,
-      errorSignature: input.summary.slice(0, 120),
-      downstreamTargetNodeId: null
-    }
-  );
+  const fpResult = buildFindingFingerprint({
+    environment: supplied.environment ?? environment,
+    originatingNodeId: supplied.originatingNodeId ?? spanDerived.originatingNodeId ?? defaultOriginNode,
+    normalizedOperation: supplied.normalizedOperation ?? spanDerived.normalizedOperation ?? input.title,
+    errorSignature: supplied.errorSignature ?? spanDerived.errorSignature ?? input.summary.slice(0, 120),
+    downstreamTargetNodeId: supplied.downstreamTargetNodeId ?? spanDerived.downstreamTargetNodeId ?? null
+  });
   const priorRow = await db.prepare(
     `SELECT id, causal_verification_status FROM investigation_findings
 			 WHERE project_id = ? AND environment = ? AND fingerprint = ?
@@ -3181,7 +3269,7 @@ async function recordInvestigationFinding(db, projectId, input, options = {}) {
     priorRecurrenceBonus: input.confidenceBreakdown?.priorRecurrenceBonus ?? priorBonus,
     finalConfidence: confidence
   };
-  const id = input.id?.trim() || `fnd_${randomHex(10)}`;
+  const id = idempotencyId ?? (input.id?.trim() || `fnd_${randomHex(10)}`);
   const expiresAt = new Date(Date.now() + 90 * 24 * 36e5).toISOString();
   await db.prepare(
     `INSERT INTO investigation_findings (
@@ -3880,10 +3968,14 @@ async function dispatchIncidentWebhook(db, projectId, incidentId, webhook) {
     webhook.environment
   );
   if (!incident) {
-    return { delivered: false, error: "Incident not found" };
+    return { delivered: false, error: "Incident not found", attempts: 0 };
   }
   if (!webhook.grant && incident.dispatchAttempts >= 5) {
-    return { delivered: false, error: "MAX_DISPATCH_ATTEMPTS (5) exceeded" };
+    return {
+      delivered: false,
+      error: "MAX_DISPATCH_ATTEMPTS (5) exceeded",
+      attempts: 0
+    };
   }
   let safeUrl;
   try {
@@ -3912,7 +4004,7 @@ async function dispatchIncidentWebhook(db, projectId, incidentId, webhook) {
       incidentId,
       error
     });
-    return { delivered: false, error };
+    return { delivered: false, error, attempts: 0 };
   }
   const nowIso = (/* @__PURE__ */ new Date()).toISOString();
   const body = JSON.stringify({
@@ -3944,37 +4036,53 @@ async function dispatchIncidentWebhook(db, projectId, incidentId, webhook) {
     headers["X-Obs-Signature-256"] = `sha256=${hmac}`;
   }
   const fetchFn = webhook.fetchImpl ?? fetch;
+  const sleep = webhook.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const maxAttempts = webhook.grant ? GRANT_DELIVERY_BACKOFF_MS.length + 1 : 1;
   let delivered = false;
   let status;
   let errorMsg;
-  try {
-    const res = await fetchFn(safeUrl.toString(), {
-      method: "POST",
-      headers,
-      body,
-      // Never follow redirects: a 3xx could re-aim the POST (and its
-      // signed body, which may carry a grant token) at another host.
-      redirect: "manual",
-      signal: AbortSignal.timeout(5e3)
-    });
-    status = res.status;
-    if (res.status >= 300 && res.status < 400) {
-      errorMsg = `Redirect (HTTP ${res.status}) refused`;
-    } else {
-      delivered = res.ok;
-      if (!res.ok) errorMsg = `HTTP ${res.status}`;
+  let attempts = 0;
+  while (attempts < maxAttempts) {
+    attempts++;
+    let retryable = false;
+    status = void 0;
+    errorMsg = void 0;
+    try {
+      const res = await fetchFn(safeUrl.toString(), {
+        method: "POST",
+        headers,
+        body,
+        // Never follow redirects: a 3xx could re-aim the POST (and its
+        // signed body, which may carry a grant token) at another host.
+        redirect: "manual",
+        signal: AbortSignal.timeout(5e3)
+      });
+      status = res.status;
+      if (res.status >= 300 && res.status < 400) {
+        errorMsg = `Redirect (HTTP ${res.status}) refused`;
+      } else {
+        delivered = res.ok;
+        if (!res.ok) {
+          errorMsg = `HTTP ${res.status}`;
+          retryable = res.status >= 500;
+        }
+      }
+    } catch (err) {
+      errorMsg = err instanceof Error ? err.message : String(err);
+      retryable = true;
     }
-  } catch (err) {
-    errorMsg = err instanceof Error ? err.message : String(err);
+    if (delivered || !retryable || attempts >= maxAttempts) break;
+    await sleep(GRANT_DELIVERY_BACKOFF_MS[attempts - 1]);
   }
   if (!delivered) {
     logger.warn("[autosre] incident webhook delivery failed", {
       incidentId,
-      error: errorMsg
+      error: errorMsg,
+      attempts
     });
   }
   if (webhook.grant) {
-    return { delivered, status, error: errorMsg };
+    return { delivered, status, error: errorMsg, attempts };
   }
   await db.prepare(
     `UPDATE incident_investigations
@@ -3991,7 +4099,44 @@ async function dispatchIncidentWebhook(db, projectId, incidentId, webhook) {
     incident.environment,
     incident.id
   ).run();
-  return { delivered, status, error: errorMsg };
+  return { delivered, status, error: errorMsg, attempts };
+}
+var GRANT_DELIVERY_BACKOFF_MS = [500, 1500];
+async function recordCallbackDelivery(db, projectId, environment, proposalId, outcome) {
+  const record = {
+    status: outcome.delivered ? "delivered" : "failed",
+    attempts: outcome.attempts,
+    lastError: outcome.delivered ? null : outcome.error ?? null,
+    at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await db.prepare(
+    `UPDATE remediation_proposals SET callback_delivery = ?
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(JSON.stringify(record), projectId, environment, proposalId).run();
+  return record;
+}
+function callbackHostOf(url) {
+  if (!url) return null;
+  try {
+    return new URL(url).host || null;
+  } catch {
+    return null;
+  }
+}
+function parseCallbackDelivery(raw) {
+  if (!raw) return null;
+  try {
+    const v = JSON.parse(raw);
+    if (v.status !== "delivered" && v.status !== "failed") return null;
+    return {
+      status: v.status,
+      attempts: Number(v.attempts ?? 0),
+      lastError: typeof v.lastError === "string" ? v.lastError : null,
+      at: String(v.at ?? "")
+    };
+  } catch {
+    return null;
+  }
 }
 var mapProposalRow = (row, grantToken) => ({
   id: row.id,
@@ -4021,6 +4166,8 @@ var mapProposalRow = (row, grantToken) => ({
   remediationAgentRunId: row.remediation_agent_run_id,
   resultingChangeId: row.resulting_change_id,
   failureReason: row.failure_reason,
+  callbackHost: callbackHostOf(row.callback_url),
+  callbackDelivery: parseCallbackDelivery(row.callback_delivery),
   createdAt: row.created_at,
   updatedAt: row.updated_at,
   expiresAt: row.expires_at,
@@ -4185,6 +4332,7 @@ async function proposeRemediationAction(db, projectId, input, options = {}) {
   } else if (effectiveAutonomy === AgentAutonomyLevel.BlockedByPolicy) {
     status = "rejected";
   }
+  const storedCallback = status === "pending_human_approval" && options.callback?.url ? options.callback : null;
   const id = `rem_${randomHex(10)}`;
   const expiresAt = new Date(Date.now() + 30 * 24 * 36e5).toISOString();
   if (effectiveAutonomy === AgentAutonomyLevel.BlockedByPolicy) {
@@ -4202,8 +4350,9 @@ async function proposeRemediationAction(db, projectId, input, options = {}) {
 				expected_current_state_json, desired_target_state_json,
 				requested_autonomy, effective_autonomy, policy_decision_reason,
 				status, grant_token_hash, grant_expires_at,
+				callback_url, callback_secret,
 				created_at, updated_at, expires_at
-			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 			ON CONFLICT DO NOTHING`
   ).bind(
     projectId,
@@ -4222,6 +4371,8 @@ async function proposeRemediationAction(db, projectId, input, options = {}) {
     status,
     grantTokenHash,
     grantExpiresAt,
+    storedCallback?.url ?? null,
+    storedCallback?.secret ?? null,
     nowIso,
     nowIso,
     expiresAt
@@ -4284,6 +4435,14 @@ async function listRemediationProposals(db, options) {
   ).bind(...binds).all();
   return rows.results.map((r) => mapProposalRow(r));
 }
+async function getRemediationCallback(db, projectId, proposalId, environment) {
+  const row = await loadProposalRow(db, projectId, proposalId, environment);
+  if (!row?.callback_url) return null;
+  return {
+    url: row.callback_url,
+    ...row.callback_secret ? { secret: row.callback_secret } : {}
+  };
+}
 async function approveRemediationProposal(db, projectId, proposalId, options) {
   const row = await loadProposalRow(
     db,
@@ -4311,6 +4470,8 @@ async function approveRemediationProposal(db, projectId, proposalId, options) {
 			     grant_expires_at = ?,
 			     approved_by_user_id = ?,
 			     approved_at = ?,
+			     callback_url = NULL,
+			     callback_secret = NULL,
 			     updated_at = ?
 			 WHERE project_id = ? AND environment = ? AND id = ?
 			   AND status = 'pending_human_approval'`
@@ -4358,6 +4519,8 @@ async function rejectRemediationProposal(db, projectId, proposalId, options) {
     `UPDATE remediation_proposals
 			 SET status = 'rejected',
 			     grant_token_hash = NULL,
+			     callback_url = NULL,
+			     callback_secret = NULL,
 			     failure_reason = ?,
 			     updated_at = ?
 			 WHERE project_id = ? AND environment = ? AND id = ?
@@ -8125,14 +8288,20 @@ var UsageStore = class {
 					SUM(CASE WHEN event_type = 'interaction' THEN 1 ELSE 0 END) AS interaction_count,
 					SUM(CASE WHEN event_type = 'frontend_error' OR severity = 'error' THEN 1 ELSE 0 END) AS error_count,
 					MAX(CASE WHEN event_type = 'page_view' THEN CAST(COALESCE(${loadMsExpr}, ${loadTimeMsExpr}, ${durationMsExpr}) AS REAL) ELSE NULL END) AS max_load_ms,
-					(SELECT referrer FROM usage_events ref WHERE ref.project_id = ue.project_id AND ref.session_id = ue.session_id ORDER BY occurred_at ASC LIMIT 1) AS referrer,
-					(SELECT page_path FROM usage_events lp WHERE lp.project_id = ue.project_id AND lp.session_id = ue.session_id ORDER BY occurred_at DESC LIMIT 1) AS last_path
+					(SELECT referrer FROM usage_events ref WHERE ref.project_id = ? AND ref.session_id = ue.session_id ORDER BY occurred_at ASC LIMIT 1) AS referrer,
+					(SELECT page_path FROM usage_events lp WHERE lp.project_id = ? AND lp.session_id = ue.session_id ORDER BY occurred_at DESC LIMIT 1) AS last_path
 				FROM usage_events ue
 				WHERE project_id = ? AND received_at >= ?
 				GROUP BY session_id
 				ORDER BY last_seen DESC
 				LIMIT ?`
-    ).bind(options.projectId, cutoff, limit * 3).all();
+    ).bind(
+      options.projectId,
+      options.projectId,
+      options.projectId,
+      cutoff,
+      limit * 3
+    ).all();
     const raw = (result.results ?? []).map((r) => ({
       sessionId: r.session_id,
       visitorId: r.visitor_id,
@@ -11512,6 +11681,13 @@ var aiReceiverPlugin = {
       });
       return c.json(response);
     });
+    app.get("/internal/ai/calls/:callId", async (c) => {
+      const projectId = getProjectId(c);
+      const store = new AIStore(sqlDbFor(c.env));
+      const call = await store.getAICall(projectId, c.req.param("callId"));
+      if (!call) return c.json({ error: "AI call not found" }, 404);
+      return c.json({ call, traceId: call.traceId, spanId: call.spanId });
+    });
     app.get("/internal/ai/spans", async (c) => {
       const projectId = getProjectId(c);
       const store = new AIStore(sqlDbFor(c.env));
@@ -13050,22 +13226,74 @@ async function requireHumanDashboardSession(c) {
 var autosreRoutesPlugin = {
   name: "autosre-routes",
   register(app, runtime) {
-    const deliverGrant = async (env, db, projectId, body, proposal) => {
-      const webhookUrl = typeof body.webhookUrl === "string" ? body.webhookUrl.trim() : "";
-      if (!webhookUrl || !proposal.grantToken) return void 0;
-      if (proposal.status !== "grant_issued") return void 0;
-      return dispatchIncidentWebhook(db, projectId, proposal.incidentId, {
-        url: webhookUrl,
-        secret: typeof body.secret === "string" ? body.secret : void 0,
-        environment: proposal.environment,
-        allowPrivateNetworks: env?.ALERT_WEBHOOK_ALLOW_PRIVATE === "true",
-        logger: runtime.logger,
-        grant: {
-          proposalId: proposal.id,
-          status: proposal.status,
-          grantToken: proposal.grantToken
+    const deliverGrant = async (env, db, projectId, body, proposal, stored) => {
+      const bodyUrl = typeof body.webhookUrl === "string" ? body.webhookUrl.trim() : "";
+      const target = bodyUrl ? {
+        url: bodyUrl,
+        secret: typeof body.secret === "string" ? body.secret : void 0
+      } : stored ?? null;
+      const notAttempted = {
+        attempted: false,
+        delivered: false,
+        attempts: 0,
+        host: null
+      };
+      if (!target || !proposal.grantToken) {
+        return { webhookDelivery: void 0, grantDelivery: notAttempted };
+      }
+      if (proposal.status !== "grant_issued") {
+        return { webhookDelivery: void 0, grantDelivery: notAttempted };
+      }
+      let host = null;
+      try {
+        host = new URL(target.url).host || null;
+      } catch {
+        host = null;
+      }
+      const webhookDelivery = await dispatchIncidentWebhook(
+        db,
+        projectId,
+        proposal.incidentId,
+        {
+          url: target.url,
+          secret: target.secret,
+          environment: proposal.environment,
+          allowPrivateNetworks: env?.ALERT_WEBHOOK_ALLOW_PRIVATE === "true",
+          logger: runtime.logger,
+          grant: {
+            proposalId: proposal.id,
+            status: proposal.status,
+            grantToken: proposal.grantToken
+          }
         }
-      });
+      );
+      let error = webhookDelivery.error ? webhookDelivery.error.replace(
+        /\b[a-z][a-z0-9+.-]*:\/\/\S+/gi,
+        "<url>"
+      ) : void 0;
+      if (error && target.secret) {
+        error = error.split(target.secret).join("<redacted>");
+      }
+      const record = await recordCallbackDelivery(
+        db,
+        projectId,
+        proposal.environment,
+        proposal.id,
+        {
+          delivered: webhookDelivery.delivered,
+          attempts: webhookDelivery.attempts,
+          error
+        }
+      );
+      proposal.callbackDelivery = record;
+      const grantDelivery = {
+        attempted: true,
+        delivered: webhookDelivery.delivered,
+        attempts: webhookDelivery.attempts,
+        host,
+        ...webhookDelivery.delivered ? {} : { error: error ?? "unknown error" }
+      };
+      return { webhookDelivery, grantDelivery };
     };
     app.post("/v1/changes", async (c) => {
       const projectId = getProjectId(c);
@@ -13321,6 +13549,7 @@ var autosreRoutesPlugin = {
       const db = sqlDbFor(c.env);
       const input = {
         id: typeof body.id === "string" ? body.id : void 0,
+        idempotencyKey: typeof body.idempotencyKey === "string" && body.idempotencyKey.trim() ? body.idempotencyKey.trim() : void 0,
         environment: typeof body.environment === "string" ? body.environment : void 0,
         incidentId: typeof body.incidentId === "string" ? body.incidentId : null,
         fingerprintInput: body.fingerprintInput && typeof body.fingerprintInput === "object" ? body.fingerprintInput : void 0,
@@ -13341,6 +13570,7 @@ var autosreRoutesPlugin = {
         citedEvidenceIds: Array.isArray(body.citedEvidenceIds) ? body.citedEvidenceIds.filter(
           (id) => typeof id === "string"
         ) : [],
+        codeReferences: Array.isArray(body.codeReferences) ? body.codeReferences : void 0,
         agentRunId: typeof body.agentRunId === "string" ? body.agentRunId : null
       };
       const finding = await recordInvestigationFinding(db, projectId, input, {
@@ -13393,6 +13623,27 @@ var autosreRoutesPlugin = {
         return c.json({ verified: false, error: message }, 400);
       }
     });
+    app.get("/internal/evals/runs/:id", async (c) => {
+      const projectId = getProjectId(c);
+      const runId = c.req.param("id");
+      const db = sqlDbFor(c.env);
+      const row = await db.prepare(
+        `SELECT id, eval_case_id, service_version, commit_sha,
+					        pass_count, fail_count
+					 FROM eval_runs WHERE project_id = ? AND id = ? LIMIT 1`
+      ).bind(projectId, runId).first();
+      if (!row) return c.json({ error: "Eval run not found" }, 404);
+      return c.json({
+        run: {
+          id: row.id,
+          evalCaseId: row.eval_case_id,
+          serviceVersion: row.service_version,
+          commitSha: row.commit_sha,
+          passCount: Number(row.pass_count ?? 0),
+          failCount: Number(row.fail_count ?? 0)
+        }
+      });
+    });
     app.get("/internal/remediations", async (c) => {
       const projectId = getProjectId(c);
       const db = sqlDbFor(c.env);
@@ -13431,6 +13682,21 @@ var autosreRoutesPlugin = {
         body.requestedAutonomy
       ) ? body.requestedAutonomy : "autonomous_write";
       const db = sqlDbFor(c.env);
+      const callbackUrl = typeof body.webhookUrl === "string" ? body.webhookUrl.trim() : "";
+      if (callbackUrl) {
+        try {
+          assertSafeWebhookUrl(callbackUrl, {
+            allowPrivateNetworks: c.env?.ALERT_WEBHOOK_ALLOW_PRIVATE === "true"
+          });
+        } catch (err) {
+          return c.json(
+            {
+              error: `webhookUrl rejected: ${err instanceof Error ? err.message : String(err)}`
+            },
+            400
+          );
+        }
+      }
       const input = {
         environment: typeof body.environment === "string" ? body.environment : void 0,
         incidentId,
@@ -13444,9 +13710,13 @@ var autosreRoutesPlugin = {
       };
       try {
         const proposal = await proposeRemediationAction(db, projectId, input, {
-          logger: runtime.logger
+          logger: runtime.logger,
+          callback: callbackUrl ? {
+            url: callbackUrl,
+            secret: typeof body.secret === "string" && body.secret ? body.secret : void 0
+          } : void 0
         });
-        const webhookDelivery = await deliverGrant(
+        const { webhookDelivery, grantDelivery } = await deliverGrant(
           c.env,
           db,
           projectId,
@@ -13458,6 +13728,7 @@ var autosreRoutesPlugin = {
             proposal,
             ...proposal,
             grantToken: proposal.grantToken ?? null,
+            grantDelivery,
             ...webhookDelivery ? { webhookDelivery } : {}
           },
           201
@@ -13483,6 +13754,12 @@ var autosreRoutesPlugin = {
       const approvedByUserId = sessionCheck.sessionActor;
       const db = sqlDbFor(c.env);
       try {
+        const storedCallback = await getRemediationCallback(
+          db,
+          projectId,
+          proposalId,
+          environment
+        );
         const proposal = await approveRemediationProposal(
           db,
           projectId,
@@ -13492,17 +13769,19 @@ var autosreRoutesPlugin = {
             approvedByUserId
           }
         );
-        const webhookDelivery = await deliverGrant(
+        const { webhookDelivery, grantDelivery } = await deliverGrant(
           c.env,
           db,
           projectId,
           body,
-          proposal
+          proposal,
+          storedCallback
         );
         return c.json({
           proposal,
           ...proposal,
           grantToken: proposal.grantToken ?? null,
+          grantDelivery,
           ...webhookDelivery ? { webhookDelivery } : {}
         });
       } catch (err) {
@@ -13994,7 +14273,9 @@ var linksFromAi = (calls, prefix) => {
     label: prefix,
     links: calls.map((c) => ({
       label: `${c.provider} \xB7 ${c.modelName}`,
-      href: `#/ai?id=${c.callId}`
+      href: `#/ai/calls/${encodeURIComponent(c.callId)}`,
+      entityKind: "ai_call",
+      entityId: c.callId
     }))
   };
 };
@@ -14067,7 +14348,7 @@ var linksFromToolCalls = (calls, prefix, metadataForAction) => {
       links: [
         {
           label: `${calls.length} tool calls`,
-          href: `#/tools`,
+          href: `#/tool-calls`,
           count: calls.length,
           sample: truncate(calls[0].toolName),
           entityKind: "tool_call",
@@ -14100,7 +14381,8 @@ var linksFromRetrievalEvents = (events, prefix) => {
     label: prefix,
     links: events.map((r) => ({
       label: `retrieve: ${r.retrieverName} (${r.totalResults} docs)`,
-      href: `#/retrieval-events/${r.id}`
+      // No dedicated retrieval tab: the owning action's detail page lists it.
+      href: `#/actions/${encodeURIComponent(r.actionId)}`
     }))
   };
 };
@@ -14116,7 +14398,9 @@ var linksFromEvalResults = (results, prefix, metadataForAction) => {
     label: prefix,
     links: results.map((e) => ({
       label: `eval: ${e.evaluatorName} (${e.passed ? "passed" : "failed"})`,
-      href: `#/evals/${e.id}`,
+      // The Evaluations tab resolves this id to an eval case, falling back
+      // to the case saved from the same action.
+      href: `#/evaluations/${encodeURIComponent(e.id)}`,
       entityKind: "eval",
       entityId: e.id,
       ...metadataForAction?.(e.actionId)
@@ -14135,10 +14419,95 @@ var linksFromArtifacts = (arts, prefix) => {
     label: prefix,
     links: arts.map((a) => ({
       label: `artifact: ${a.artifactName} (${a.artifactType})`,
-      href: `#/artifacts/${a.id}`
+      // No dedicated artifact tab: the owning action's detail page lists it.
+      href: `#/actions/${encodeURIComponent(a.actionId)}`
     }))
   };
 };
+var hrefForEntity = (kind, id) => {
+  const enc = encodeURIComponent;
+  switch (kind) {
+    case "trace":
+      return `#/traces?trace=${enc(id)}`;
+    case "span": {
+      const [traceId, spanId] = id.split(":");
+      return spanId && traceId ? `#/traces?trace=${enc(traceId)}&span=${enc(spanId)}` : `#/evidence?kind=span&id=${enc(id)}`;
+    }
+    case "alert":
+      return `#/alerts?id=${enc(id)}`;
+    case "analysis":
+      return "#/health";
+    case "service":
+      return `#/service-map?service=${enc(id)}`;
+    case "agent_run":
+      return `#/agent-runs/${enc(id)}`;
+    case "action":
+      return `#/actions/${enc(id)}`;
+    case "tool_call":
+      return `#/tool-calls/${enc(id)}`;
+    case "ai_call":
+      return `#/ai/calls/${enc(id)}`;
+    case "profile":
+      return `#/profiles/${enc(id)}`;
+    case "change":
+      return `#/changes/${enc(id)}`;
+    case "finding":
+      return `#/findings/${enc(id)}`;
+    case "incident":
+      return `#/incidents/${enc(id)}`;
+    case "eval":
+      return `#/evaluations/${enc(id)}`;
+    case "log":
+      return `#/logs?id=${enc(id)}`;
+    case "replay":
+      return `#/replay?session=${enc(id)}`;
+    default:
+      return `#/evidence?kind=${enc(kind)}&id=${enc(id)}`;
+  }
+};
+var HEX_SPAN_PAIR = /^[0-9a-f]{32}:[0-9a-f]{16}$/i;
+var HEX_SPAN_ID = /^[0-9a-f]{16}$/i;
+var NODE_KINDS = /* @__PURE__ */ new Set([
+  "service",
+  "endpoint",
+  "database",
+  "queue",
+  "messaging_topic",
+  "topic",
+  "cache",
+  "external"
+]);
+var resolveFaultLocusTarget = (faultLocusEntityId) => {
+  const id = faultLocusEntityId;
+  if (HEX_SPAN_PAIR.test(id)) {
+    return {
+      entityKind: "span",
+      entityId: id,
+      href: hrefForEntity("span", id)
+    };
+  }
+  if (HEX_SPAN_ID.test(id)) {
+    return {
+      entityKind: "span",
+      entityId: id,
+      href: hrefForEntity("span", id)
+    };
+  }
+  const segments = id.split(":");
+  if (segments.length > 1 && NODE_KINDS.has(segments[0] ?? "")) {
+    const name = segments[3] || segments[segments.length - 1] || id;
+    return {
+      entityKind: "service",
+      entityId: id,
+      href: hrefForEntity("service", name)
+    };
+  }
+  return {
+    entityKind: "service",
+    entityId: id,
+    href: hrefForEntity("service", id)
+  };
+};
 
 // src/plugins/connected-routes.ts
 var emptySignalActionContext = () => ({
@@ -14936,10 +15305,11 @@ var connectedRoutesPlugin = {
             }
           ];
           const spans = changeRow.version ? await db.prepare(
-            `SELECT DISTINCT trace_id, span_id, service_name, span_name
+            `SELECT trace_id, span_id, service_name, span_name
 									 FROM telemetry_spans
 									 WHERE project_id = ? AND environment = ? AND service_version = ? AND status_code = 2
-									 ORDER BY start_time DESC LIMIT 5`
+									 GROUP BY trace_id, span_id, service_name, span_name
+									 ORDER BY MAX(start_time) DESC LIMIT 5`
           ).bind(projectId, changeRow.environment, changeRow.version).all() : { results: [] };
           manifest.across = [
             {
@@ -15004,7 +15374,7 @@ var connectedRoutesPlugin = {
               links: [
                 {
                   label: `fault locus: ${findingRow.faultLocusEntityId}`,
-                  href: `#/traces?q=${encodeURIComponent(findingRow.faultLocusEntityId)}`,
+                  ...resolveFaultLocusTarget(findingRow.faultLocusEntityId),
                   relationshipCertainty: "exact",
                   causalProofTier: proofTier
                 },
@@ -15052,8 +15422,11 @@ var connectedRoutesPlugin = {
               links: [
                 {
                   label: `${incRow.symptomAnchorKind}: ${incRow.symptomAnchorId}`,
-                  href: `#/alerts?id=${encodeURIComponent(incRow.symptomAnchorId)}`,
-                  entityKind: incRow.symptomAnchorKind === "analysis" ? "analysis" : "alert",
+                  href: hrefForEntity(
+                    incRow.symptomAnchorKind,
+                    incRow.symptomAnchorId
+                  ),
+                  entityKind: incRow.symptomAnchorKind,
                   entityId: incRow.symptomAnchorId,
                   relationshipCertainty: "exact"
                 }
@@ -16275,6 +16648,9 @@ var evalCasesRoutesPlugin = {
   }
 };
 
+// src/plugins/evidence-retrieval-routes.ts
+import { buildFindingFingerprint as buildFindingFingerprint2 } from "@obsunified/types";
+
 // src/lib/parse-pprof.ts
 import {
   decodePprof,
@@ -17648,6 +18024,30 @@ var attachAutoSreTriageContext = async (db, projectId, traceId, bundle, logger)
         limit: 5
       });
     }
+    if (faultLocus?.faultLocusSpan) {
+      const spanFp = fingerprintInputFromSpan(
+        faultLocus.faultLocusSpan,
+        environment
+      );
+      const fingerprint = buildFindingFingerprint2({
+        ...spanFp,
+        normalizedOperation: spanFp.normalizedOperation ?? "",
+        errorSignature: spanFp.errorSignature ?? ""
+      }).fingerprint;
+      const byFingerprint = await searchInvestigationFindings(db, {
+        projectId,
+        environment,
+        fingerprint,
+        limit: 5
+      });
+      const seen = new Set(priorFindingsList.map((f) => f.id));
+      for (const f of byFingerprint) {
+        if (!seen.has(f.id) && priorFindingsList.length < 5) {
+          priorFindingsList.push(f);
+          seen.add(f.id);
+        }
+      }
+    }
     const priorFindings = priorFindingsList.map((f) => ({
       findingId: f.id,
       title: f.title,
@@ -22064,6 +22464,7 @@ function createDashboardAuth(config) {
   const registerRoutes = (app) => {
     const limiter = config?.loginRateLimit === false ? null : new LoginRateLimiter(config?.loginRateLimit ?? {});
     let warnedUnkeyedClient = false;
+    const isSecureRequest = (c, limitConfig) => c.req.url.startsWith("https:") || limitConfig?.trustProxyHeaders === true && c.req.header("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase() === "https";
     app.post("/auth/login", async (c) => {
       const configuredPassword = config?.password ?? c.env.DASHBOARD_PASSWORD;
       if (!configuredPassword) {
@@ -22099,7 +22500,7 @@ function createDashboardAuth(config) {
       const payload = createSessionToken(expiresAt);
       const sig = await sign(payload, configuredPassword);
       const cookieValue = `${payload}.${sig}`;
-      const isSecure = c.req.url.startsWith("https:");
+      const isSecure = isSecureRequest(c, config?.loginRateLimit || void 0);
       c.header(
         "Set-Cookie",
         `${SESSION_COOKIE}=${encodeURIComponent(cookieValue)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${SESSION_MAX_AGE}${isSecure ? "; Secure" : ""}`
@@ -22147,7 +22548,7 @@ function createDashboardAuth(config) {
       return c.json({ authenticated: true });
     });
     app.post("/auth/logout", (c) => {
-      const isSecure = c.req.url.startsWith("https:");
+      const isSecure = isSecureRequest(c, config?.loginRateLimit || void 0);
       c.header(
         "Set-Cookie",
         `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${isSecure ? "; Secure" : ""}`