main
131 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Anwesh
|
837a66f1f1 |
feat(cli): add secure one-shot ask command (#5273)
* feat(agent): enforce host hooks during gather - compose multiple tool hook sets without losing lifecycle callbacks - forward per-turn approval hooks into evidence gathering - cover hook composition and gather propagation * feat(cli): add ask approval policy - gate mutating, external, approval-required, and unclassified tools - support exact per-invocation allowlists and broad bypass - track denied tools safely across concurrent calls * feat(cli): add one-shot ask command * feat(agent): classify action tool side effects * docs(cli): document ask approvals * style(cli): format ask package * fix(cli): respect ask surface boundaries - import harness components through public API modules\n- keep one-shot ask out of recursive REPL command parity\n- disable slash actions without importing shell adapters * fix(cli): keep ask sink surface-owned - preserve the exact public harness runtime API\n- provide a minimal CLI-owned output sink for one-shot turns * fix(cli): handle signals while reading ask stdin - install ask signal handling before prompt resolution\n- return stable JSON cancellation and signal exit codes\n- cover prompt-resolution interrupts and handler restoration * test(cli): pin ask invocation boundaries - verify root --yes never bypasses tool approvals\n- verify exact case-sensitive allowlist matching\n- verify sessions close after turn failures and JSON stays on stdout * docs(cli): present ask as headless CLI - rename the guide and navigation entry to Headless CLI - describe opensre ask as a one-shot non-interactive command * docs(readme): add headless CLI quick start - show the one-shot ask command in the run-mode overview - link to the Headless CLI guide for automation and approval details |
||
|
Devesh
|
568c04f7c1 |
refresh docs — shared integration flow, clearer guides, and accuracy fixes (#4697)
* docs: reorganize sidebar navigation and clean up install pages` * feat: enhance index hero styling and update features documentation * docs: update installation guides and enhance table styling * docs: enhance investigation documentation and improve interactive shell descriptions * Update documentation for API, community giveaway, CloudOpsBench, deployment, FAQ, PR review flow, and Python API * Update documentation for background investigations, closed-loop learning, cron scheduling, and integrations overview * Introducing structured flow for the documentation * docs: update integration documentation for various services --------- Co-authored-by: Vaibhav Upreti <vaibhav.upreti16@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Yauhen Bichel
|
2dc7579a67 | refactor(harness): four import doors by role — ports is the Implement door, spi split into role modules, llm_factory replaces ToolCallingDeps (#5029) | ||
|
Shinu Cherian
|
c7be1fd492 |
docs(shell): add /goal teammate workflow guide (#4896) (#5001)
* docs(shell): add /goal teammate workflow guide (#4896) Documents /goal set, pause, resume, edit, and clear for users. Adds docs/goals.mdx with a copy-paste example, the progress line fields, the turn budget, end states, and how /goal differs from /work and /background. Registers the page in docs.json nav and links it from the interactive shell command reference, where /goal was previously absent. User-facing copy uses /goal only. * docs(shell): correct Slack and Telegram goal start behavior (#4896) The page claimed goals work in Slack and Telegram the same way they do in the shell. Headless sessions have no terminal, so set_auto_command records a turn-outcome hint instead of submitting the condition: the goal is stored but stays at turn 0 until the user's next message drives the first turn. Describes that behavior and points users at the interactive shell when they want the work to start immediately. |
||
|
Anton Vorontsov
|
11215ae941 |
feat(integrations): add Yandex Cloud support base - credentials and verification (#4947)
* feat(integrations): add Yandex Cloud credentials and verification Part of #4605. First of a series bringing Yandex Cloud support in-tree, as agreed in Discord: this one makes the account connectable, the next ones add the tools that read it. After this, `opensre integrations setup yandex_cloud` collects a folder and one credential, and `verify yandex_cloud` mints an IAM token and reads the folder back. Nothing else changes for anyone: without those credentials the integration is simply absent. Four ways to authenticate, because Yandex Cloud genuinely has four and they are alternatives rather than a set to fill in: a service-account key (as a file or inline), an OAuth token, a ready IAM token, and the instance metadata service on a Yandex Cloud VM. The last one needs nothing typed at all - the instance knows its own folder - so the setup wizard fills the folder and cloud ids in from it. That is resolved when setup runs rather than at import: the metadata service lives on a link-local address that does not answer elsewhere, so asking at import time would cost a timeout on every start outside the cloud. Every read is folder-scoped; the Monitoring API rejects cross-folder queries outright, which is why `folder_id` is required unless the metadata service can supply it. The client sends GET and nothing else. Every mutating Yandex Cloud API uses a different verb, so read-only is a property of the client rather than a promise in the docs. Config lives in `integrations/yandex_cloud/config.py` rather than `integrations/config_models.py`: that module is already 1200+ lines, and the per-package layout is what the newer integrations (grafana, honeycomb, posthog, airflow) follow. * fix(integrations): address review on the Yandex Cloud credentials PR Eight findings from CodeQL and Greptile, all real. Two behavioural (P1): - A metadata token with 300s or less left was cached for the full 50-minute fallback, because the safety margin and the missing-value fallback were folded into one `or`. They are now separate: the fallback covers only an absent or unparseable expires_in, and a near-expiry token gets a short TTL. - Yandex Cloud was missing from load_env_integration_services, the startup-safe presence check, so the banner, health and REPL disagreed with verify and effective resolution for an env-configured account. Added, mirroring the classifier's rule. CodeQL: - The client cache key no longer hashes credentials; it is built from the folder, cloud and auth mode alone. No secret reaches a hash, and none becomes a dictionary key. One account per process makes non-secret discriminators sufficient. - Removed the unused `logger` from auth.py and rest_client.py. - Folded the two endpoint-cache module scalars into one dataclass holder, so there is no reassigned-through-global scalar to read as unused. Style (P2): - auth.py uses http.HTTPStatus.OK instead of httpx.codes.OK. - The YC_* constants are re-exported through config.constants. Adds regression tests for both P1s. * fix(integrations): address Codex review on the Yandex Cloud PR Four findings from a Codex pass, all real; two are regressions from the previous review round. P1 - the client cache returned a stale client after a credential rotation. The earlier CodeQL fix keyed the cache on non-secret fields (folder, cloud, auth mode), which collides when a token or key rotates for the same account, so a long-running gateway kept a superseded credential. The key stays non-secret, but a cached client is now reused only when its config still equals the requested one. P2 - a failed endpoint-registry fetch was not recorded, so every later resolve_endpoint retried the network and paid the timeout again instead of falling back to the snapshot for the cache period. The attempt time is now stamped whether or not the fetch succeeded. P2 - use_metadata carried a "true" default so the metadata mode reads as configured on an empty submission, but a mode-gated field cleared for another mode came back blank and the collector substituted that default, persisting use_metadata=true next to a real credential. A resolve hook now clears the flag whenever an explicit credential is present, so both the wizard and the agent path agree. P3 - the startup presence check used YC_* string literals; it now imports the constants from config.constants.yandex_cloud. Adds regression tests for the three behavioural fixes. * fix: resolve leftover catalog.py merge marker * fix: registry backoff on fresh-boot monotonic + refresh prompt snapshot * refactor(yandex-cloud): tighten client boundaries - centralize authentication mode constants in config/constants\n- remove the unused generic POST entry point to preserve read-only scope --------- Co-authored-by: muddlebee <anweshknayak@gmail.com> |
||
|
Raildo Mascena de Sousa Filho
|
b0233d0145 |
feat(new-relic): add read-only New Relic alerts and metrics integration (#4950)
* feat(new-relic): add read-only New Relic alerts and metrics integration
Adds a read-only New Relic integration (NerdGraph): config/client/verifier/
setup, alert-incident and NRQL-metrics investigation tools, integration
wiring (registry/catalog/CLI/effective models), onboarding wizard, alert
routing/reporting/template, and docs.
Consolidates the previously-stacked PRs (#4869-#4872) into one PR per
maintainer request, with every Greptile/CodeQL review finding from that
stack addressed:
- Redacted the real account email/id that had been committed to spec docs;
those spec/plan/tasks docs are dropped from this PR entirely (not needed
in-tree).
- Restricted `base_url` to New Relic's documented US/EU hosts — the client
attaches the API key header unconditionally, so an arbitrary host would
have exfiltrated the credential.
- Fixed NRQL default-injection appending `SINCE` after an existing `LIMIT`
clause (invalid clause order, rejected by NerdGraph).
- Fixed the mutation-keyword guard flagging legitimate queries that merely
contain a forbidden word inside a string literal (e.g. a WHERE filter).
- Fixed truncation detection comparing against the caller's original limit
instead of the vendor-capped limit actually executed, which hid real
truncation on large requests.
- Replaced inline-duplicated env var name literals with the canonical
constants in config/constants/new_relic.py.
- Removed an unused module-level constant flagged by CodeQL.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix(new-relic): add JP region support and fix code-review findings
- Add https://api.jp.newrelic.com to the allowed base_url hosts (config,
docs, .env.example, setup wizard copy) alongside the existing US/EU hosts.
- Fix _add_new_relic_alerts crashing on an incident with condition_name=None
(dict.get(key, default) doesn't substitute for a key present with a None
value).
- Fix NRQL default SINCE/LIMIT injection and extract_limit reading
clause-like text out of string literals (e.g. '%SINCE yesterday%',
'%LIMIT 5%') instead of only real clauses, by matching against a
length-preserving literal-masked copy of the query.
- Anchor the mutation-keyword guard to word boundaries so identifiers that
merely contain a forbidden word (e.g. MutationAuditEvent) aren't rejected.
* perf(new-relic): dedup incident_id via set instead of list membership
parse_incident_rows checked `incident_id not in order` against a growing
list inside the per-row loop, an O(n) scan per row (O(n^2) overall). NrAiIncident
can return up to NEW_RELIC_NRQL_LIMIT_MAX (5,000) rows, so a busy account
near that cap paid a real quadratic cost for no reason. Track membership
with a separate set alongside the ordered list.
* test: regenerate prompt characterization snapshot after merging main
main's runtime-facts prompt refactor (
|
||
|
Vaibhav Upreti
|
5f940cf445 |
docs: remove Tracer product branding from Mintlify site (#4956)
* docs: remove Tracer product branding from Mintlify site Rewrite environment install guides for OpenSRE, rebrand hosted setup copy to OpenSRE Cloud, update footer/socials, and delete orphaned Tracer eBPF/product docs that were never in the current nav. * docs: address PR review on gateway modes and Codespaces redirect Include Buzz in Docker gateway mode platforms, and send retired /environments/codespaces links to /install instead of Windows setup. |
||
|
Arul Goyal
|
0222284a28 |
feat(sqs): add read-only SQS queue-attributes tool for stuck-consume… (#4592)
* feat(sqs): add read-only SQS queue-attributes tool for stuck-consumer diagnosis Adds get_sqs_queue_attributes so the investigation agent can inspect SQS queue state during an incident — visible depth, in-flight count, oldest-message age, visibility timeout, DLQ wiring, and FIFO flag. Queue state lives in queue attributes, not logs or metrics: a consumer that hangs without raising writes no error line, so log search comes back clean while the queue stops draining. Reading in_flight_count pinned at the consumer count, a climbing oldest-message age, and has_dlq=false identifies that shape immediately. Follows the integrations/cloudtrail/ pattern (account-wide AWS service riding on the aws integration for availability and region) rather than integrations/rds/ (pinned to one configured resource). Read-only via the existing aws_sdk_client allowlist; list_queues and get_queue_attributes match ^list_.* and ^get_.*. Refs #2803 * issues addressed * Removed oldestMessage in queue metric --------- Co-authored-by: Devesh <deveshrathod047@gmail.com> |
||
|
Vaibhav Upreti
|
149649bc76 |
feat: task management v1 (#4496)
* feat: task management v1 * fix: unblock CI for work-item tool schemas and tests Preserve property names like title during schema normalization, rename the colliding work-item scoring test module, and list /work in help. * fix: address Greptile P1s for work-item reminders and store safety Disable prior reminder schedules on remind_at updates, refuse mutations when the durable store is unreadable, and record last_reminded_at only after successful delivery. |
||
|
Anwesh
|
012ffd2c47 |
feat(integrations): add Buzz (block/buzz) delivery integration (#4756)
* feat(integrations): add Buzz (block/buzz) delivery integration Adds a delivery-tier Buzz integration, modeled on integrations/rocketchat/: config normalization, buzz-cli subprocess client, verifier, credential resolution, alarm dispatcher (watchdog --provider buzz), report-delivery adapter, an agent-callable buzz_send_message tool, onboarding wizard wiring, docs, and tests. buzz-cli is not distributed (cargo build only), so it's treated as a soft dependency like helm/railway/gh: missing binary/key reports as ProbeResult.missing with an install hint, surfaced through `opensre integrations verify buzz` and `opensre doctor`. No installer/Dockerfile changes in this PR. Scoped as delivery-only per the discussion on #4190; a two-way gateway transport (gateway/buzz/) is left for a follow-up issue. Closes #4190 * fix(buzz): carry stored buzz_path through watchdog credential resolution Greptile review on #4756: resolve_buzz_credentials() resolved relay_url/default_channel/auth_tag/private_key but never buzz_path, so a non-PATH binary configured via `opensre integrations setup buzz` was silently dropped for /watch and CLI watchdog alarm delivery, falling back to a bare `buzz` PATH lookup that would fail to find it. Also merges upstream/main (branch was 2 commits behind) to fix an unrelated CI failure: the synthetic PR merge ref lost a blank line in gateway/discord/client.py that neither side was missing individually (main has since landed an independent same-day fix, #4757). * fix(ci): allowlist tools -> integrations.buzz edges in .importlinter.strict CI's Import graph step caught 3 forbidden tools -> integrations edges, mirroring the existing rocketchat/discord exemptions: - tools.system.watch_dog.runner -> integrations.buzz.{alarms,credentials} - tools.investigation.reporting.delivery.bootstrap -> integrations.buzz.reporting_adapter Not caught locally because .importlinter.strict isn't part of lint/format-check/typecheck; only CI's "Import graph" step runs it. * test(buzz): trim test volume to essential/distinct coverage - Drop tests/integrations/test_buzz_alarms.py: BuzzAlarmDispatcher is a thin cooldown-gate + transport-call wrapper; CooldownGate's own timing/isolation semantics are already covered by tests/platform/notifications/test_cooldown.py, and the mirrored RocketChatAlarmDispatcher pattern doesn't need re-proving per vendor. - Collapse BuzzConfig default-value checks into one test; fold the three probe_access failure-detail tests (auth/network/other) into a single parametrized case. - test_buzz_delivery.py: drop send-success and single-exit-code tests that duplicated BuzzClient-level coverage already in test_buzz.py (post_buzz_message/send_buzz_report are thin passthroughs); keep the security-critical (private key never leaks to error/logs) and the genuinely distinct logic (report prefix, truncation, defaults). - test_buzz_send_message_tool.py: merge the metadata + surface-scoping checks into one test; drop the redundant is_available negative case (empty dict and blank private_key hit the same falsy branch). 49 tests remain (down from ~73), covering: config validation, classify, binary resolution, every BuzzClient exit-code branch once, private-key leak prevention (argv/logs/repr), the two Greptile-flagged buzz_path regressions, and every distinct branch in the send-message tool and report/alarm delivery wrappers. * Potential fix for pull request finding 'Empty except' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * fix(buzz): document the empty except in probe_access CodeQL (py/ineffectual-statement-adjacent empty-except finding, #2097): 'except' clause did nothing but pass with no explanatory comment. The channel-count enrichment is a display nicety, not a correctness signal (the exit code already confirmed success), so keep it non-fatal but log why it's skipped instead of silently swallowing the parse failure. --------- Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> |
||
|
Vaibhav Upreti
|
23d5deac50 |
feat(github): fix security/quality findings and ship PRs with auto-detected coding agents (#4597)
* feat(github): fix security/quality findings and ship PRs with auto-detected coding agents Add the fix_github_security_alert action tool: resolve a Dependabot, code-scanning, or Code Quality finding, fix it in the local checkout (built-in ruff fixers first), and optionally commit/push a fresh opensre/github-security-fix-* branch and open a PR. Make the coding-agent seam multi-backend and zero-config: CODING_AGENT now defaults to auto, which picks the first ready backend among Pi, Claude Code (claude -p acceptEdits), and Codex (codex exec workspace-write). Shared machinery moves to leaf modules (integrations/llm_cli/agent_exec.py, integrations/git/worktree_capture.py) and the Pi client is refactored onto them; tests migrated in the same change. When no agent is ready the tool now returns one actionable line instead of a vague coding-agent-fallback message. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ci): restore import-linter ignores and harden coding-agent cleanup Drop stale fix_sentry_issue.pr ignore_imports (module removed) and allow ship → pull_requests. Skip the F401 line-delete fallback after Ruff rewrites the file, and terminate coding-agent process groups on timeout. * fix(github): use public UI URLs for Code Quality findings The findings API returns only an authenticated api.github.com url (html_url is null). Synthesize github.com/security/quality/findings/{n} so tasks, PR bodies, and tool responses never link to a 401 API endpoint. * fix: repair CI for PR #4597 - ## Summary ## Summary **Root cause:** `test_run_pi_coding_task_timeout` drives the timeout path in `poll_agent_process`, which calls `_signal_process_group` (integrations/llm_cli/agent_exec.py:121). That function reads `proc.pid`, but the test's `_FakePopen` stand-in never defined a `pid` attribute → `AttributeError`. **Change (1 file):** - `tests/integrations/test_pi.py` — added `self.pid: int | None = None` to `_FakePopen.__init__`. With `pid=None`, `_signal_process_group` skips the `os.killpg` branch and uses its documented `terminate()`/`kill()` fallback, which the fake implements. This also guarantees tests never signal a real process group. No production code was touched — the `pid is not None` guard in `agent_exec.py` already handles this case correctly; the fake was just incomplete. **Verification:** - `uv run python -m pytest tests/integrations/test_pi.py -q` → 11 passed, 1 skipped (opt-in live test) - `ruff check` + `ruff format --check` on the edited file → clean Per instructions, I did not commit or push; the fix is in the working tree alongside your other uncommitted changes. Generated by OpenSRE from https://github.com/Tracer-Cloud/opensre/pull/4597. * feat(github): add PR CI fixer and harden agent commit subjects Add fix_github_pr_ci to inspect failing Actions checks, run an auto-detected coding agent, and push fixes to the existing PR branch. Skip cancelled sibling checks, sanitize markdown headings out of commit subjects, and make process-group cleanup tolerate test doubles without pid. * feat(git): stamp OpenSRE co-author trailer on agent commits Ensure local commits and CI formula/readme bump commits include the OpenSRE Agent trailer so agent-authored changes stay attributable. * fix(config): track OpenSRE commit co-author constants The git helpers import these trailers; keep the constants module in the repo so the branch stays importable after the co-author stamp landed. * fix(ci): unblock PR #4597 test failures Compress github_cli skill guidance under the registry char budget, classify fix_github_pr_ci for Sentry telemetry coverage, and refresh the action-system prompt characterization snapshot. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Yauhen Bichel
|
4362673a07 | fix(ci): refresh stale auto-merge PRs and keep runtime paths human-merged (#4670) | ||
|
Yauhen Bichel
|
dad9aa539e | refactor: readable entry points — startup extracted from gateway boot, plain names, TurnResult, Python API docs (#4610) | ||
|
Kamlesh Prajapati
|
404f72835e |
docs: add AWS EC2 page in the docs and nav (#4572)
* docs: add AWS EC2 page in the docs and nav * docs: clarify tiers source field vs tier tool argument in EC2 docs |
||
|
Yauhen Bichel
|
09967edb6a | feat(filestorage): optional sync of laptop context to a user-owned S3 bucket (#4498) | ||
|
Radharani Basak
|
fd99677ac2 |
docs: add ELB integration page (#4490)
* docs: add ELB integration page * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Radha Rani Basak <radharabibasak2003@gmail.com> Co-authored-by: Anwesh <8139783+muddlebee@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Nandan Manna
|
c892c755d0 |
docs(s3): add AWS S3 user docs page (C-35, #4356) (#4409)
* docs(s3): add AWS S3 user docs page (C-35, #4356) Or with a body (recommended for the PR): docs(s3): add AWS S3 user docs page (C-35, #4356) Add docs/s3.mdx covering the AWS S3 integration: setup (reuses the shared AWS credentials), IAM permissions, the four read-only tools (list_s3_objects, inspect_s3_object, get_s3_object, check_s3_marker), verification via `opensre integrations verify aws`, and troubleshooting. Register the page in docs/docs.json under "Cloud, code, and collaboration" so it appears in the site nav. Closes #4356 * docs(s3): address Greptile review — credential chain, verify output, marker source |
||
|
sahil nayak
|
8d7919dbd7 |
Add AWS Elasticsearch docs page and register in nav (#4412)
* Add AWS Elasticsearch docs page and register in nav Signed-off-by: sahilnyk <contactsahilpnayak@gmail.com> * Recommend read-only user, clarify API-key gap, drop internal flag ref Signed-off-by: sahilnyk <contactsahilpnayak@gmail.com> --------- Signed-off-by: sahilnyk <contactsahilpnayak@gmail.com> |
||
|
Shelly
|
bc6d90aab5 | docs: add AWS Lambda integration guide (#4403) | ||
|
Yauhen Bichel
|
ed2c58fa23 | feat(gateway): scope Slack turns to the org that owns the team install (#4391) | ||
|
Vaibhav Upreti
|
2803b5351f |
feat: memory management (#4001)
* feat(memory): add agent memory store, tool, and REPL commands Introduce persistent agent memory with markdown storage, prompt injection, session extraction, and /memory slash commands for listing and managing entries. * fix(tests): restore memory stub and unify extraction imports Add long_term_memory to the gather-prompt stub after the main merge, and use a single module-alias import style in the memory extraction tests. * feat(memory): reject secret-like content and harden on-disk writes Add safety checks before durable memory ingestion, atomic file writes with restrictive permissions, and shared memory env constants across store/tool paths. * fix(memory): unblock teardown and coordinate concurrent writes Schedule session-end extraction after resource release, restore outgoing transcripts on rotate paths, and serialize memory mutations with a file lock. * fix(memory): join extraction briefly on session close After releasing resources, wait up to a short timeout for background extraction so shell exit can persist durable facts without blocking forever. * fix(memory): persist on exit, scope gateway, harden safety Run session-end extraction synchronously on process exit so durable facts are not dropped by a timed daemon join. Keep gateway rotation non-blocking and off by default for the host-global store; redact secret-like spans before the extraction LLM call and enforce safety inside save_memory. |
||
|
Fariz Anjum
|
0b59755c52 |
feat(integrations): add Railway integration and Slack bot runtime tools built on it (#4060)
* feat(integrations): add Slack bot runtime tools Add vendor-first Railway tools (inspect latest successful deployment, confirmed redeploy) and a Slack thread replay tool with cursor pagination and token redaction. Register Railway as a CLI-backed integration and wire tool discovery, telemetry, tests, and docs. Fixes #3230 Rebased onto current main (squashed from the PR branch's merge-laden history to apply cleanly). * refactor(railway): migrate setup onto the shared IntegrationSetupSpec flow Address review of #4060: - Move Railway setup from a hand-rolled `upsert_integration` handler onto the shared setup flow: add `integrations/railway/setup.py` (RAILWAY_SETUP) and `config/constants/railway.py`, and reduce the CLI handler to `_run_spec_setup(RAILWAY_SETUP)`. This persists to every tier (store, keyring, .env) instead of store-only, which the deploy preflight reads. - Move the "token or complete default scope" either/or rule into verify_railway so setup and `integrations verify railway` agree on what "configured" means (per integrations/AGENTS.md); drop the setup-only guard. - Route Railway env-name literals in _catalog_impl.py through the new config/constants/railway.py. - Remove two unused, unrelated config classes (GitLabIntegrationConfig, SentryIntegrationConfig) that were dead on arrival. - Fix a stray-indent whitespace change on "messaging/slack" in docs.json. - Add tests for the verifier cross-field rule and the spec wiring. * fix(slack): make thread replay truncated flag unambiguous Greptile review: when the cursor-dedup guard stops paging (Slack repeats a cursor), the leftover non-empty cursor made truncated=True even though no genuine cap was hit. Clear the cursor before that break so truncated reflects only a real _MAX_MESSAGES cap. Add a repeated-cursor regression test. The review's other points were already resolved by the vendor-first refactor: is_available now gates on shutil.which, the no-success case returns error_type=deployment_unavailable, and latest selection uses max(createdAt). --------- Co-authored-by: muddlebee <anweshknayak@gmail.com> |
||
|
Saptarshi Sarkar
|
a05576533a |
feat: Add Grafana Loki log sink with tests and documentation (#3961)
* feat: added grafana loki log sink integration Signed-off-by: Saptarshi Sarkar <saptarshi.programmer@gmail.com> * test: added tests for grafana log sink and log report delivery adapter Signed-off-by: Saptarshi Sarkar <saptarshi.programmer@gmail.com> * docs: added docs for the new grafana loki log sink adapter Signed-off-by: Saptarshi Sarkar <saptarshi.programmer@gmail.com> * fix: fixed bug in loki push url construction Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Signed-off-by: Saptarshi Sarkar <saptarshi.programmer@gmail.com> * fix: fixed import quality check by adding ignore import statement for grafana report delivery adapter Signed-off-by: Saptarshi Sarkar <saptarshi.programmer@gmail.com> * feat(tests): added synthetic e2e tests and fixed loki only setup Signed-off-by: Saptarshi Sarkar <saptarshi.programmer@gmail.com> * fix(CI): fixed the import error due to rocketchat integration Signed-off-by: Saptarshi Sarkar <saptarshi.programmer@gmail.com> * fix: fixed missing ssl verify in post request method Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Signed-off-by: Saptarshi Sarkar <saptarshi.programmer@gmail.com> * fix(grafana): resolve GRAFANA_WRITE_TOKEN via keyring and honor ssl_verify on Loki push - GRAFANA_WRITE_TOKEN is a *_TOKEN secret; read it through resolve_env_credential (env then keyring) per the credential resolution contract in docs/adding-tools-and-integrations.md, instead of bare os.getenv. GRAFANA_LOKI_PUSH_URL stays plain env (a *_URL value). - The direct Loki push request ignored the Grafana client's ssl_verify entirely, defaulting to True even when the account is configured with verify_ssl=False for a self-signed on-prem instance. Add a public ssl_verify property on GrafanaClientBase and honor it in _push_to_loki (falls back to True in Loki-only mode with no client). * fix: fixed uncaught 204 loki error and stale docstring for `_make_post_request()` method Signed-off-by: Saptarshi Sarkar <saptarshi.programmer@gmail.com> --------- Signed-off-by: Saptarshi Sarkar <saptarshi.programmer@gmail.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: muddlebee <anweshknayak@gmail.com> |
||
|
Devesh
|
27288c71c6 | Revamp Mintlify docs: fix nav/CSS, replace placeholder copy, and add integration setup guides (#4150) | ||
|
MOHAMMED TALHA ANSARI
|
cd96fab09c |
feat(servicenow): interactive-shell configuration check via the OpenSearch verifier/wizard pattern (#3102) (#4094)
* feat(servicenow): integration config, classifier, verifier, and catalog wiring (#3102) ServiceNow joins the integration catalog with the same shape as the other credentialed services: a strict config model (instance_url + username + password for HTTP Basic), a classifier for store/env records, a config-presence verifier mirroring the OpenSearch/Jira pattern, registry spec (verify + setup + aliases), effective-model publication, env-var loading (SERVICENOW_INSTANCE_URL/USERNAME/PASSWORD, password resolved env-then-keyring), startup-safe banner visibility, and a legacy CLI setup handler. * feat(servicenow): onboarding wizard flow with live credential validation (#3102) Adds ServiceNow to the onboarding wizard (Incident & Comms group): a configurator that prompts instance URL/username/password, validates with an authenticated one-row sys_user table read (200/401/403/404 mapped to actionable messages), persists to the local store, and syncs env values with the password kept in the OS keyring. * test(servicenow): catalog, verifier, wizard validator, and CLI coverage (#3102) Covers store-record classification (incl. the alternate 'url' credential key and rejection of partial credentials), config normalization, env-var resolution, the startup-safe banner path (no keyring), verifier passed/missing statuses, verify_integrations dispatch, wizard validator HTTP branch mapping (200/401/403/404/500/RequestError), the integration_health export surface, and CLI verify/setup acceptance. * docs(servicenow): integration guide, docs navigation, and README table (#3102) Documents all four setup paths (wizard, legacy CLI, env vars, persistent store), the verify flow incl. asking the interactive shell directly, troubleshooting for the onboarding probe statuses, and security notes. Moves ServiceNow from the planned column to the available integrations in the README table. * test(servicenow): shell verify-gate regression + live turn scenario (#3102) Deterministic test that /verify servicenow passes the real SUPPORTED_VERIFY_SERVICES gate (the exact failure #3102 describes), plus a 206 live-LLM turn scenario mirroring 205-sentry so 'Is ServiceNow configured?' plans /integrations verify servicenow instead of suggesting a CLI command. * fix(servicenow): harden URL scheme, credential parity, and reconfigure UX (self-review) (#3102) Applies confirmed findings from an adversarial review pass: - instance_url now goes through validate_https_or_loopback_http_url in both the config model and the wizard validator, so the password is never sent as Basic auth over plaintext HTTP to a remote host (the validator refuses before any request is made). - classify strips instance_url before the 'url' alternate-key fallback, so a whitespace-only value no longer shadows a valid url credential. - The startup banner gate now requires SERVICENOW_PASSWORD too, matching the verifier/env-loader so the banner and verify never disagree. - The env loader resolves the password (env then keyring) only after the cheap env vars are present — unconfigured installs no longer pay an OS keyring roundtrip on every catalog resolution. - Wizard reconfigure prefills the stored password (jenkins pattern) so Enter keeps it instead of looping on 'Required.' - Welcome banner renders 'ServiceNow' instead of title-cased 'Servicenow'. - Docs show the real table-shaped verify output and the https requirement. * fix(ci): only pass pytest-collectible .py files as fallback test-scope targets The unmatched-tests fallback in test_scope_rules.classify appended any changed path under tests/ as a raw pytest target, so a changed fixture or scenario data file (.json/.yml) aborted the whole make test-scope run with pytest exit 4 (0 tests collected). Scenario YAMLs like tests/core/agent/scenarios/**/206-*.yml are exercised through their runner, not as collection targets. * test(servicenow): exact-match detail assertions to resolve CodeQL URL-substring alerts (#3102) CodeQL flags 'substring in url_string' checks (py/incomplete-url-substring- sanitization) even in test assertions. Asserting the full detail string is both alert-free and a stricter contract on the verifier/validator output. * fix(servicenow): validate instance_url in the legacy CLI setup path (#3102) The wizard validated the URL before saving but 'opensre integrations setup servicenow' did not: a plain-http remote URL was stored silently, then dropped at classification (the ValueError is swallowed by design), leaving 'verify servicenow' stuck at missing with no explanation. The CLI path now runs the same https-or-loopback validation and exits with the actionable message at setup time. Covers both paths with handler tests (normalized https save; plain-http remote rejected pre-save). * fix(servicenow): resolve setup_order/verify_order collision with rocketchat Both integrations landed with setup_order=41/verify_order=55 after the merge with main; test_registry_invariants.py requires unique orders per service. Bump servicenow to 42/56 (next free slots). --------- Co-authored-by: muddlebee <anweshknayak@gmail.com> |
||
|
Marcos Paulo Diniz
|
d2d6d61a70 |
feat(integrations): add Rocket.Chat outbound delivery (PAT + webhook) (#4114)
* feat(integrations): add Rocket.Chat outbound delivery (PAT + webhook) Add a rocketchat messaging integration following the existing vendor pattern (Discord/Telegram for token auth, Slack for webhook): - integrations/rocketchat/: classifier, REST delivery via the shared delivery_transport (chat.postMessage + incoming webhook), report delivery adapter self-registration, and /api/v1/me verifier with a non-posting webhook reachability probe - RocketChatConfig supporting two delivery modes: Personal Access Token (server_url + auth_token + user_id, dynamic channel targeting) and/or incoming webhook (webhook_url, fixed destination; preferred when both are set) - env loading (ROCKETCHAT_*), catalog/registry/effective-model wiring, onboard wizard step with mode choice, and `opensre integrations setup rocketchat` - docs/messaging/rocketchat page registered in docs.json; messaging index, integrations overview, and env-var reference updated - unit tests mirroring Discord delivery/classify/verifier coverage (payload shape, success:false handling, token/webhook-URL redaction, truncation, shared-transport delegation) Refs #4113 * fix(rocketchat): satisfy import-linter contract and address Greptile findings - Add the missing tools -> integrations.rocketchat.reporting_adapter allowlist entry to .importlinter.strict (the CI-failing import-linter contract check). - Log a meaningful destination on delivery failure instead of an empty channel when routing went through the webhook. - Clear a stale stored webhook_url when the wizard is re-run in token-only mode, since webhook is otherwise silently preferred over the token at delivery time. --------- Co-authored-by: muddlebee <anweshknayak@gmail.com> |
||
|
Anwesh
|
26ccd6683d |
feat(integrations): PostHog setup guide, verify wiring (#4064)
* docs: add PostHog bounce rate integration user setup guide * docs: simplify bounce rate calculation section to clarify automation * feat(integrations): wire PostHog bounce-rate verify and catalog - register posthog verifier and env catalog loading - add posthog-bounce alias for CLI verify without colliding with MCP - add tests for classify, verify, and effective integration resolution * docs(posthog): clarify onboarding scope and improve setup guide - explain PostHog MCP vs bounce-rate vs product telemetry - document env-only setup and posthog-bounce verify command - note onboarding wizard covers MCP only, not bounce-rate monitoring * fix(integrations): align PostHog naming with Sentry pattern - Remove posthog -> posthog_mcp management alias so bare posthog is REST - Drop posthog-bounce aliases; verify posthog hits REST integration directly - Update CLI/registry tests and docs for posthog vs posthog_mcp split * fix(integrations): assign unique verify_order for posthog * Update docs/posthog-mcp.mdx Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * feat(integrations): add PostHog REST onboarding and fix HogQL query - add wizard and `setup posthog` CLI for project ID and personal API key - wire validate_posthog_integration into onboarding health checks - fix HogQL bounce-rate query ($session_duration, $start_timestamp, INTERVAL) - update docs and tests for REST setup alongside posthog_mcp split * refactor(integrations): drop unused PostHog bounce-rate client - remove query_bounce_rate, alert helpers, and POSTHOG_BOUNCE_* config - narrow REST posthog to credentials, verify, and onboarding only - update docs, env example, and E2E to validate project metadata * fix(integrations): address PostHog PR review feedback - use _request_json directly to satisfy CodeQL unused-alias finding - clarify PostHog REST vs MCP onboarding distinction in docs --------- Co-authored-by: PrinceThummar011 <princethummar011@gmail.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> |
||
|
Tan Wee Joe
|
7507591ac1 |
feat: architecture audit skill for finding violations and refactor tasks (#3996)
* feat: create models and base files for architecture issue tool * feat: repository cloning * feat: implement scanners and skill * feat: implement generation of md report * feature: implement multi language support for repo * fix: merge architecture audit report text * feat: convert oversized file scanner into skill * feat: reimplement architecture audit skill * refactor: architecture audit skill * perf: optimise architecture audit skill * ruff * fix: sort architecture_issue_tool imports for ruff I001 Co-authored-by: Cursor <cursoragent@cursor.com> * Refine action text and arch tool deps Avoid streaming short, non-user-facing final text from action turns, and keep the architecture issue tool self-contained by inlining GitHub token/creds helpers instead of importing peer integrations modules. Also tighten tool schemas and update the prompt characterization snapshot. * Update test_telemetry.py * fix: greptile issues * Update pyproject.toml * fix * fix * fix ci * fix: remove unused function --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Srikar Naramsetty
|
d1fa2345f7 |
feat(integrations): add cloud-agnostic Kubernetes integration (#3809)
* feat(integrations): add cloud-agnostic Kubernetes integration (#3795) Adds a new `kubernetes` integration that connects to any Kubernetes cluster via kubeconfig (file path or inline YAML), independent of cloud provider (GKE, AKS, EKS, on-prem, k3s, etc.). Tools added: - kubernetes_list_pods — pod phase, readiness, restart counts - kubernetes_get_pod_logs — tail container logs - kubernetes_list_deployments — replica health and rollout status - kubernetes_get_events — crash loops, OOM kills, scheduling failures - kubernetes_describe_pod — full pod spec, container states, owner refs - kubernetes_list_nodes — node conditions, capacity, allocatable, taints - kubernetes_list_services — service type, ports, selector - kubernetes_list_statefulsets — StatefulSet replica status - kubernetes_list_daemonsets — DaemonSet desired/ready counts - kubernetes_list_ingresses — ingress rules, host→service mappings, TLS - kubernetes_list_configmaps — ConfigMap key-value data - kubernetes_get_resource — generic fetch for any named resource type Wiring: config_models, effective_models, registry, catalog_impl, alert_source, gather_evidence, intake, and tool registry all updated. Docs page added and registered in docs.json. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(kubernetes): fix _get_clients 3-tuple unpacking and add cli setup handler - Update probe_access tests to pass 3-tuple (core, apps, networking) when patching _get_clients, matching the expanded return type - Add _setup_kubernetes() wizard handler to integrations/cli.py so that `opensre integrations setup kubernetes` is supported (fixes test_every_setup_spec_has_handler registry assertion) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(tests): allowlist kubernetes tools in telemetry coverage audit All 12 kubernetes tools let unexpected exceptions escape run() to the #1476 global wrapper (the client catches and returns structured error dicts internally), so they belong in _TOOLS_WITHOUT_DELIBERATE_CATCH. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(kubernetes): add client lifecycle management and remove dead serialization branch - Add close(), __enter__, __exit__ to KubernetesClient so the ApiClient connection pool is properly released after each tool invocation - Wrap all 12 tool run() methods in `with client:` to guarantee close() on both success and error paths - Remove dead else branch in get_resource (self._api_client is always set by _build_clients); add assertion to satisfy mypy Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(kubernetes): fix external_ips typo in list_services and complete docs tool table - Fix AttributeError: V1ServiceSpec.external_i_ps -> external_ips in client.py - Add all 8 missing tools to docs/kubernetes.mdx Available tools table - Update RBAC permissions block to cover all resources used by the 12 tools Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(kubernetes): address greptile review comments - Add kubernetes to valid EvidenceSource values in tools.mdc - Strip env var values in describe_pod to prevent credential leakage to LLM during investigations; return only key names Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(kubernetes): redact env var values in get_resource for pod resources sanitize_for_serialization() returns the full pod JSON including spec.containers[].env[].value, bypassing the redaction in describe_pod. Add _redact_env_values() helper and apply it after serialization when the resource type is a pod, keeping credential redaction consistent. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(kubernetes): extend env var redaction to workload controller pod templates Deployment/StatefulSet/DaemonSet/ReplicaSet resources embed a pod template at spec.template.spec.containers[].env — same leakage vector as the pod env var fix. Extend _redact_env_values to handle both pod spec and pod template layouts, and apply it to all workload types in get_resource. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(kubernetes): use namespace-scoped probe to avoid false 403 on restricted service accounts list_namespace() is cluster-wide (GET /api/v1/namespaces) and requires a ClusterRole binding. Namespace-scoped service accounts on GKE Workload Identity, AKS Managed Identity, on-prem Role bindings, and k3s restricted configs all receive 403 here — even though every investigation tool is namespace-scoped and would work correctly. Switch to list_namespaced_pod(namespace=..., limit=1) which matches the actual permission scope of the 12 investigation tools and accurately reflects whether the configured credentials will work. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(kubernetes): sync tests and format to namespace-scoped probe Update probe_access tests to mock list_namespaced_pod instead of the old list_namespace (cluster-wide) call, matching the namespace-scoped probe introduced in the previous commit. Also apply ruff formatting to client.py (frozenset literal expansion). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(tests): update eks alert routing expectations for kubernetes integration After adding the Kubernetes integration, eks alert routing now includes 'kubernetes' in both relevance and seed sources. Update test assertions to match the new routing in alert_source.py. Also removes the empty core/context/ directory leftover from the core/state refactor, which was being detected as a namespace package and causing test_old_context_package_is_removed to fail. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(kubernetes): resolve post-merge fallout from main's refactors - integrations/kubernetes/client.py: update import for platform.observability.errors.service (renamed from platform.observability.service_errors upstream), which broke the entire verifier registration chain in CI. - integrations/registry.py: kubernetes and gitlab both claimed verify_order=52; bump kubernetes to 53. - tests/core/domain/alerts/test_alert_source.py: ruff format * fix(importlinter): drop stale scheduler->telegram credentials ignore entry platform/scheduler/credentials.py resolves the Telegram token via _get_integration_credential("telegram", ...) rather than importing integrations.telegram.credentials, so the ignore_imports entry never matched a real edge. Pre-existing on main (from #3908); surfaced here because the quality job's strict import-linter check runs against this PR's merge with main. * fix(kubernetes): include valueFrom-sourced env var names in describe_pod The env filter kept only literal-value env vars (e.value is not None), silently dropping the names of secretKeyRef/configMapKeyRef-sourced vars. Names alone carry no credential material and are useful diagnostic signal, so include all container env var names regardless of source; values are still never returned. Addresses Greptile review feedback on PR #3809. * fix(kubernetes): address greptile review comments - Add surfaces = ("investigation", "chat") to all 12 kubernetes tools - Fix get_pod_logs: guard against empty pod_name before API call - Add resource_type enum derived from _RESOURCE_DISPATCH to get_resource schema - Move _WORKLOAD_TYPES to module scope in client.py - Fix use_cases description: env var names only, values are redacted - Fix multi-file KUBECONFIG: skip config_file= when path contains ":" - Widen SERVICE column in verify table to 16 chars (was 10, "kubernetes" is 10) - Restore EKS SOURCE_ALIASES to include kubernetes/k8s/kubectl/pod keywords - Update .env.example and client.py docstring to reflect KUBECONFIG behavior Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: sort imports in kubernetes tools __init__ (ruff) * fix: address greptile review feedback (greploop iteration 1) - Strip the kubectl.kubernetes.io/last-applied-configuration annotation in describe_pod and get_resource, which was leaking literal env var values that per-field redaction had already stripped elsewhere. - Route argocd alerts to the kubernetes tools too, not just eks, so ArgoCD alerts on non-EKS clusters seed the new integration. - Trim eks's generic k8s/pod/kubectl aliases so it no longer looks "relevant" for every Kubernetes alert regardless of cluster type. * fix: honor configured colon-separated kubeconfig_path (greploop iteration 2) KubeConfigMerger already splits config_file on the OS path separator and merges each file itself -- the same mechanism the SDK uses for its KUBECONFIG env var fallback. Passing kubeconfig_path straight through instead of falling back to config_file=None keeps DB-stored integrations from silently reading the process environment's KUBECONFIG (or defaulting to ~/.kube/config) instead of the configured paths. --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: muddlebee <anweshknayak@gmail.com> |
||
|
paul
|
96a3dd1135 |
docs: hide Tracer tab and OpenSRE Cloud navbar link
Remove the Tracer tab and the app.tracer.cloud navbar link from docs.json navigation, and comment out the homepage cards that pointed into the hidden tab. The .mdx sources stay in the repo so the section can be restored later by reverting this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Yauhen Bichel
|
abd3663c56 | feat(backend): Slack Socket Mode gateway, async investigations store, Terraform Fargate deploy (#3998) | ||
|
Anwesh
|
068fae6cfa |
feat: add X (Twitter) hosted MCP integration (#3692)
* feat: add X (Twitter) hosted MCP integration Adds integrations/x_mcp/ exposing X's official MCP server (xdevplatform/xmcp) as list_x_tools/call_x_tool, following the posthog_mcp/sentry_mcp pattern but adapted for XMCP's self-hosted (not always-on) deployment model. Closes #3589. * Update integrations/catalog.py Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * fix(x_mcp): bound session open+initialize inside the timeout, not just the RPC _open_x_mcp_session's transport connect and MCP initialize handshake were unbounded; only the call_tool RPC itself was wrapped in asyncio.wait_for. A server that accepts a connection but never completes the handshake could hang list_x_tools/call_x_tool indefinitely. Wrap the whole session-open + operation coroutine in wait_for instead. --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> |
||
|
Anwesh
|
b5b0025b33 |
docs: add investigation pipeline architecture guide (#3677)
* docs: add investigation pipeline architecture guide Document the six-stage investigation pipeline and ReAct evidence loop end-to-end (stage flow, tool-selection cap, seed calls, duplicate detection, stagnation breaker, context budget) with Mermaid diagrams, since no existing doc covered the pipeline/loop control flow — investigation-tool-calling.md is scoped to tool schema/LLM payload mechanics only. * docs: add user-facing "how an investigation works" page Companion to investigation-pipeline-architecture.md (contributor-focused), but written for end users: plain-language walkthrough of the six-stage pipeline with a simple Mermaid diagram, no file paths or code references. Registered in docs.json under Getting Started > First steps, right after investigation-overview. * docs: fix link-rot, vale spellcheck, and Greptile findings - Point the AGENTS.md and tools/investigation/reporting/ references at absolute GitHub URLs instead of ../ relative paths, which Mintlify's link-rot checker can't resolve outside the docs/ root. - Reword "whatever's configured" to avoid the vale spellcheck flag on the contraction. - Fully qualify shorthand file paths (gather_evidence/*.py, plan_evidence/node.py) to their full tools/investigation/stages/... paths for clarity. - Fix the ReAct loop diagram: the forced tool-free final iteration (S14) now loops back through llm.invoke (S4) instead of jumping straight to Done, matching what the code actually does. * docs: fix stagnation-breaker nudge count (greploop iteration 1) The prose said the model gets "one nudge" before tool access is stripped, but agent.py appends STAGNATION_NUDGE on every duplicate-only iteration — with MAX_STAGNANT_ITERATIONS=2 that's two nudges before the next turn strips tools. Updated the prose and split the diagram's duplicate-handling branch to show the nudge firing on each stagnant iteration, not just once at the threshold. |
||
|
Aniket Rawat
|
3dfadf6768 |
feat(tools): add fix_sentry_issue tool (Sentry URL -> Pi fix diff) (#3306)
* feat(tools): add fix_sentry_issue tool (Sentry URL -> Pi fix diff) * fix(fix_sentry_issue): map Sentry HTTP errors (404/auth/network) to clean error_kind * update the ref |
||
|
vincenthus
|
2dddcffd46 |
feat(tools): add GitHub workflow status tools (#3247)
* feat(tools): add GitHub workflow status tools * fix(tools): repair GitHub workflow mutation approval * fix(tools): harden GitHub workflow mutations * fix(tests): satisfy GitHub workflow CodeQL checks * feat(tools): add GitHub workflow skill guidance --------- Co-authored-by: davincios <davincios@users.noreply.github.com> |
||
|
Aniket Rawat
|
6719015eb0 |
feat(tools): add Pi coding tool + integration for submitting coding t… (#3224)
* feat(tools): add Pi coding tool + integration for submitting coding tasks * Update integrations/pi/__init__.py Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * revert false positives * clear lfecycle methods,verification, error handling, polling as requested * split into errors/validation/runner + fix pipe-drain deadlock * delimit the untrusted task and harden the prompt * add diff tracking * add false-posititive limit detection and fail fast when on a non-git workspace * formatted test_pi.py file for ruff tests --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> |
||
|
davincios
|
2d804296d4 |
Merge main into closed-loop learning PR
Resolve conflicts between closed-loop learning feedback events and the latest interactive-shell feedback output path. Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
kasulani
|
62a6672f0e |
feat(integrations): add Temporal Integration (#2572) (#2805)
* feat(integrations): add Temporal service client with workflow and namespace methods * feat(integrations): add probe_access to Temporal client for integration verification * feat(integrations): wire Temporal into catalog, verification, and registry * feat(integrations): add Temporal investigation tools for workflows, history, task queues, and namespace * docs(integrations): add Temporal integration page with setup, tools, and troubleshooting * test(integrations): add Temporal synthetic RCA scenario * fix(integrations): resolve Temporal setup/verify order collision after rebase * fix(temporal): percent-encode workflow_id and task_queue_name in URL paths * fix(integrations): restore Temporal classifier dropped in catalog rebase conflict * docs(integrations): document Temporal env vars and catalog entry |
||
|
Anwesh
|
8f25067d29 |
feat(cli) : background RCA email notifications via SMTP (#2657)
* Add background RCA email notifications via SMTP * Address Greptile background RCA feedback * Fix background runner startup race |
||
|
Avital Tamir
|
3afd3bbf12 |
feat(groundcover): add groundcover observability integration (minimal) (#2899)
* feat(groundcover): add groundcover observability integration (minimal) Add groundcover as a configured, verifiable observability provider over its public read-only MCP endpoint (gcQL), with a minimal first-PR tool surface. Follow-up PRs will add the remaining tools, alert-source routing, onboarding wizard, docs page, and synthetic scenarios. - Config + catalog + registry + verification + CLI setup so the integration appears in `opensre integrations list` and `verify groundcover` works (fail-closed probe: tool surface + tenant/backend routing; secrets redacted). - MCP service client (streamable-HTTP JSON-RPC, token redaction, bounded connect retries, cached gcQL reference). - Three tools: get_groundcover_query_reference, query_groundcover_logs, query_groundcover_traces — credentials bound into a runtime client (never model-facing) with additionalProperties:false schemas. - .env.example + environment-variable docs. - Tests: config/env/verify, MCP client, and the three tools. Closes #2850 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(groundcover): use idiomatic gcQL leading filters (no '| filter' pipe) Per the gcQL reference, queries lead with the filter directly (e.g. 'level:error | limit 50'); the '| filter' pipe is reserved for post-aggregation conditions on computed aliases. Update the seed default queries, the logs/traces examples, and the shared query guidance accordingly. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(groundcover): align gcQL examples with the official reference Audited tool/guidance gcQL against groundcover's authoritative reference: - Lead with the filter directly; reserve the '| filter' pipe for post-aggregation conditions on computed aliases (was '* | filter <predicate>'). - Fix trace error fields: use status_code>=500 (HTTP spans only) and status:error (universal); drop the non-existent 'http.status_code' dotted field. - Add span-type error-filtering guidance and key trace field names. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(groundcover): make logs/traces explicit @tool functions Convert GroundcoverLogsTool and GroundcoverTracesTool from the make_signal_tool factory + __module__ reassignment workaround to explicit @tool-decorated module functions, matching the SigNoz/QueryReference shape. Each tool now defines its own _is_available/_extract_params/run in its module and calls the shared run_signal_query/base_extract_params helpers, so the registry homes the callables naturally with no __module__ hack. Delete the now-unused make_signal_tool factory (and its Callable import) from app/tools/utils/groundcover.py; the genuinely-shared logic helpers stay. Behavior preserved: same output envelope, groundcover_<signal> source labels, synthetic-backend short-circuit, credential-free model-facing schema (additionalProperties:false), required query with seed defaults, and the corrected gcQL guidance. Add concise docstrings to the public tool functions and availability/extract helpers for consistency and docstring coverage. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(groundcover): drop _time sort from seed queries/examples The deployed public MCP endpoint rejects 'sort by (_time desc)' even though both gcQL references document it as valid (the unified _time sort alias appears to be newer than the public deployment). The seed sort is non-essential — results are bounded by '| limit N' and returned recent-first — so drop it for robustness. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(groundcover): project fields in signal seed queries/examples The public MCP endpoint rejects bare raw select-all row pulls (<filter> | limit N returning all columns); '| fields ...' projections and '| stats ...' aggregations both work. Generalize the fix across logs and traces: - Seed defaults now project: logs -> 'level:error | fields _time, workload, instance, content | limit 50'; traces -> 'status:error | fields _time, workload, span_name, status_code, duration_seconds | limit 50'. - Tool examples + shared GCQL_GUIDANCE: project raw rows with '| fields ...' (or aggregate with '| stats ...') instead of returning all columns. - Canonical field names per the authoritative per-signal references (logs: content/instance/level; traces: span_name/workload/status_code/duration_seconds). - Test fixture default_query updated to the idiomatic projected form. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(groundcover): add minimal provider page + nav entry Scoped to this PR's surface (setup, verify, the three read-only tools, gcQL guidance/examples, troubleshooting). Does not claim alert-source seeding or the other signals, which land in follow-up PRs. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(groundcover): address Greptile review feedback - probe_access fails closed when list_workspaces returns no accessible workspaces (previously passed, then every query would fail at runtime). Add regression test. - gcQL reference cache now carries a TTL (6h) keyed by endpoint, so an updated reference is picked up without a process restart. - extract_params uses sources.get("groundcover", {}) so a caller bypassing is_available doesn't hit a KeyError (logs/traces/reference tools). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(groundcover): forward time window to synthetic backend in run_signal_query The backend short-circuit only forwarded query, dropping start/end/period (the SigNoz backend path forwards all params). Forward them and assert it in the backend test. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(groundcover): resolve CodeQL alerts - test: assert probe detail on stable non-URL tokens ('Connected to ' prefix + workspace name) instead of a host substring, which tripped CodeQL's incomplete-URL-substring-sanitization heuristic (false positive on a test). - export _verify_groundcover via _verification_adapters __all__ like the other verifiers, resolving the 'unused global variable' note. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Devesh
|
92072a03e6 |
chore(docs): disable Changelog navigation and update related documentation (#2896)
* chore(docs): disable Changelog navigation and update related documentation * chore(docs): update comments for re-enabling Changelog navigation in daily_update.py |
||
|
vincenthus
|
7ffdf271b7 |
refactor(fleet): rename app/agents package to app/fleet_monitoring (#2879)
* refactor(integrations): drop MCP transport prompt, fix to recommended mode Everyone selects the recommended transport during setup, so the Streamable HTTP / SSE / stdio selection added friction without value. Hardcode each MCP integration to its recommended transport (GitHub / PostHog / Sentry -> streamable-http, OpenClaw -> stdio) in both the legacy `integrations setup` flow and the onboarding wizard, and leave comments documenting that the prompt must not be reintroduced. Env-var overrides (e.g. POSTHOG_MCP_MODE=stdio) still work for advanced users. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(fleet): rename app/agents package to app/fleet_monitoring The local AI agent-fleet monitoring package (per-PID probes, registry, token meters, samplers) was named app/agents, which was easily confused with app/agent (the product's investigation agent loop). Rename it to app/fleet_monitoring and update all imports, the tests/ mirror dir, and CI/scope-rule path references. User-facing surfaces renamed for consistency: - slash command /agents -> /fleet - CLI group `opensre agents` -> `opensre fleet` - docs page docs/agents.mdx -> docs/fleet.mdx (+ nav slug) Persistent user-data artifacts (~/.opensre/agents.yaml, agents.jsonl, agents-bus.sock, the agents/ lock dir, and the agents: config key) are intentionally left unchanged to avoid breaking existing installs. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
vincenthus
|
0e234eb2ea |
Sentry querying tests (#2857)
* fix(investigation): stop indiscriminate Hermes/Datadog tool calls Gate get_hermes_logs behind hermes_available_or_backend so Hermes log polling only runs when Hermes is connected, and make start-guidance content-driven for generic/unknown alerts so the agent pulls only the integrations relevant to the alert instead of fanning out to all of them. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(repl,integrations): LLM-only action routing + Sentry/GitHub/PostHog querying Routing: remove the deterministic regex/policy engine (slash_commands rule packs, policy_engine, policy_tags, intent_parser patterns/SAMPLE_ALERT_RE) and make the LLM action planner the sole tool selector. The only remaining deterministic path is literal command/alias dispatch in command_dispatch, which must never infer intent from natural language. Add a bounded tool-gathering loop (app/agent/tool_loop.py, chat/tool_gathering.py) so the conversational assistant can ground answers in live integration data, and teach the planner to treat "investigate a sample/test alert" as the alert_sample tool. Integrations/tools: add Sentry issue search, GitHub Issues (+MCP OAuth) and PostHog MCP tooling with docs and tests. Tests/docs: add routing scenarios for the sample-alert phrasing, update the routing-policy ADR to reflect the LLM-only design, and refresh affected tests. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(repl): clarify planner prompt precedence for investigate vs. handoff Make the explicit-instruction rule dominant over alert-content presence: an explicit investigate/analyze/diagnose/RCA request maps to investigation_start even when the message also contains a pasted alert payload, while a bare alert payload or incident description (no instruction) maps to assistant_handoff. Resolves planner nondeterminism on pasted alert blobs now that the LLM is the sole tool selector (no regex overrides). Co-authored-by: Cursor <cursoragent@cursor.com> * work in progress * feat(repl): show MCP services in /integrations list and register Sentry MCP telemetry names Render all integrations (including github/openclaw MCP services) in `/integrations list`, sorted by service name, rather than hiding MCP-type services in a separate view. Update the command and rendering tests accordingly, and add the Sentry MCP swallow-site tool names (list_sentry_tools / call_sentry_tool) to the telemetry migration set. Checkpoint on sentry-querying-tests; the execute_cli_actions consolidation landed in the preceding work-in-progress commit. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(repl): defer agent-planned interactive pickers to exclusive stdin Allow any registered slash command through run_interactive (registry-backed instead of a per-command allowlist) and queue inline-picker/wizard commands (/integrations, /mcp setup/remove/connect/disconnect) back through the REPL loop's exclusive-stdin path so they no longer race the live prompt and leak terminal CPR replies into the input line. Co-authored-by: Cursor <cursoragent@cursor.com> * fixed live health banner * docs(posthog): document posthog setup/verify alias and harden alias test Add a quick-reference block to posthog-mcp.mdx showing that `posthog` resolves to the canonical `posthog_mcp` flow for both setup and verify, and relax the verify monkeypatch to accept any args so the alias test stays robust to the verification_exit_code signature. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(repl): strengthen compound-action completeness in planner prompt Make the planner emit a tool call for EVERY mappable clause in a compound request and never drop or merge the second action. Resolves live-LLM flakiness on "check health and then show connected services", which intermittently emitted only /health and dropped /integrations list. Co-authored-by: Cursor <cursoragent@cursor.com> * test(repl): resample live planner contract to absorb LLM nondeterminism The live planner makes a single stochastic LLM sample per case, so an otherwise-correct compound mapping (e.g. health + connected services) can intermittently drop a clause and flake CI. Retry the live plan up to 3 times and pass on the first match; a genuinely wrong mapping still fails every attempt, so this absorbs nondeterminism without bypassing the live planner decision. Co-authored-by: Cursor <cursoragent@cursor.com> * ci: run cli-runtime live planner contracts on openai The default anthropic tool-call model (claude-haiku) cannot reliably perform compound action routing — e.g. "check health and then show connected services" emits only /health (0/12 locally), failing the live planner contract every run. Pin the cli-runtime shard to openai via a per-shard llm_provider matrix value (other shards keep the anthropic default), matching the provider routing-live-post-merge.yml already uses. Co-authored-by: Cursor <cursoragent@cursor.com> * test(repl): skip live planner cases on provider outages The planner raises PlannerLLMError on provider billing/quota/overload errors, which previously hard-failed the live contract instead of using the existing transient-skip path (that only handled empty plans). Catch the raised error and skip on billing/credit/quota/rate-limit/overload signatures so a provider outage (e.g. depleted API credits) no longer blocks CI; funded providers still run and assert the contract for real. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
vincenthus
|
cce3039818 |
feat(repl,integrations): LLM-only action routing + Sentry/GitHub/PostHog querying (#2855)
* fix(investigation): stop indiscriminate Hermes/Datadog tool calls Gate get_hermes_logs behind hermes_available_or_backend so Hermes log polling only runs when Hermes is connected, and make start-guidance content-driven for generic/unknown alerts so the agent pulls only the integrations relevant to the alert instead of fanning out to all of them. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(repl,integrations): LLM-only action routing + Sentry/GitHub/PostHog querying Routing: remove the deterministic regex/policy engine (slash_commands rule packs, policy_engine, policy_tags, intent_parser patterns/SAMPLE_ALERT_RE) and make the LLM action planner the sole tool selector. The only remaining deterministic path is literal command/alias dispatch in command_dispatch, which must never infer intent from natural language. Add a bounded tool-gathering loop (app/agent/tool_loop.py, chat/tool_gathering.py) so the conversational assistant can ground answers in live integration data, and teach the planner to treat "investigate a sample/test alert" as the alert_sample tool. Integrations/tools: add Sentry issue search, GitHub Issues (+MCP OAuth) and PostHog MCP tooling with docs and tests. Tests/docs: add routing scenarios for the sample-alert phrasing, update the routing-policy ADR to reflect the LLM-only design, and refresh affected tests. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(repl): clarify planner prompt precedence for investigate vs. handoff Make the explicit-instruction rule dominant over alert-content presence: an explicit investigate/analyze/diagnose/RCA request maps to investigation_start even when the message also contains a pasted alert payload, while a bare alert payload or incident description (no instruction) maps to assistant_handoff. Resolves planner nondeterminism on pasted alert blobs now that the LLM is the sole tool selector (no regex overrides). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Devesh
|
d838998c80 |
refactor(cli): integrate token accounting into session management (#2814)
* refactor(cli): integrate token accounting into session management * refactor(cli): update LLM run info structure and enhance token coercion handling - Changed return structure in `answer_cli_agent` to use `LlmRunInfo` for better clarity and added latency tracking. - Modified `_coerce_usage_tokens` to accept float values for input and output token counts, improving flexibility. - Added tests to ensure correct behavior for float token counts and validate session token usage tracking. * docs: Add link to Interactive Shell Commands in investigation overview - Updated the investigation overview documentation to include a reference to the new "Interactive Shell Commands" page for quick access to slash commands. - Added "interactive-shell-commands" to the documentation navigation for improved discoverability. |
||
|
Aniket Agarwal
|
ebbd438602 |
feat(tempo): added grafana tempo integration (#2646)
* feat(tempo): added grafana tempo integration * feat(tempo): bug fix * feat(tempo): pr review comments * feat(tempo): test fix * feat(tempo): updated tempo docs * feat(tempo): updated tempo docs * feat(tempo): correct test cases * feat(temp): added auth * feat(temp): added auth * feat(temp): added auth * feat(temp): added auth * fix(tempo): address PR review feedback - Fix duplicate registry order (tempo now uses setup_order=25, verify_order=37) - Avoid leaking httpx connection pools by using httpx.get per request - Correct validate success message and docs (version requirement, env var descriptions) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(tempo): add TEMPO_* vars to .env.example Required by TOOL_INTEGRATION_CHECKLIST.md for new integrations. * fix(tempo): resolve post-merge order collision and stale wizard test count - tempo's setup_order/verify_order (30/41) collided with redis, added separately on main after this branch's base; reassigned tempo to 32/43. - tests/cli_smoke_test.py stagger_j was stale after merging in pagerduty (also added on main): wizard now has 27 integrations, not 26. --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: muddlebee <coreblockspace@gmail.com> |
||
|
kasulani
|
913f4474a4 |
feat(integrations): add pagerduty integration (#2560) (#2688)
* feat(integrations): add pagerduty integration (#2560) * fix(integrations): bump pagerduty registry order to free slots * fix(integrations): resolve pagerduty/redis setup_order and verify_order collision Merging upstream/main brought in the redis integration, which had already claimed setup_order=30/verify_order=41 — the same slots pagerduty's last commit bumped to. Move pagerduty to the next free slots (31/42). --------- Co-authored-by: muddlebee <anweshknayak@gmail.com> |
||
|
Zihao Xue
|
bfb232b3cf |
feat(redis): add redis integration (#2699)
* build: add redis into dependency * feat(redis): implementation of redis integrations * feat(redis): redis registration with tools and agent * test(redis): add unit tests of redis integration * docs(redis): update docs to include redis integration * test(redis): e2e tests and unit test file location of integration * fix: update redis order in the IntegrationSpec * refactor(getenv): add safe_int for type consistency * fix(redis): unique order id for redis service * refactor(redis): replace env-var reading with existing redis env reader * refactor(redis): add use_cases and outputs to all redis tools * refactor(setup_redis): fail fast once user does not offer redis host * refactor(redis): reapply refactors to accelerate scan key round-trip queries |
||
|
MOHAMMED TALHA ANSARI
|
1d419f6e33 |
feat: add CloudTrail event-lookup tool for change forensics (#2686) (#2747)
* feat(tools): add CloudTrail event-lookup tool for change forensics Adds a thin, planner-selectable CloudTrailEventsTool that wraps the read-only CloudTrail lookup_events API to answer "who changed what, and when?" during AWS incidents — IAM changes, security-group mutations, EKS/Lambda config updates, and resource deletions. - New app/tools/CloudTrailEventsTool calling execute_aws_sdk_call (service=cloudtrail, op=lookup_events). lookup_* is already on the read-only allowlist, so no aws_sdk_client changes are needed. - New app/integrations/cloudtrail.py: availability gates on the account-level "aws" integration (reusing AWSIntegrationConfig and the creds already wired via the EKS/CloudWatch path), since CloudTrail is account-wide rather than tied to a single resource. - Exposes resource_name / event_source / username filters. CloudTrail allows only one LookupAttribute per call, so the most specific filter is sent (resource_name > username > event_source); duration_minutes is converted to the StartTime/EndTime window. Response shape mirrors RDSEventsTool, including the synthetic aws_backend short-circuit. - Registers "cloudtrail" in the EvidenceSource literal and nudges the planner to treat it as a primary source for AWS-originating alerts (cloudwatch / eks / alertmanager) in app/agent/prompt.py. - Adds docs/cloudtrail_events.mdx (registered in docs/docs.json) and tests covering schema, availability, extraction, filter priority, the time-window helper, response shaping, discovery, and the backend short-circuit. Classifies the tool in test_telemetry.py. Closes #2686 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(cloudtrail): auto-seed CloudTrail for AWS-originating alerts Add 'cloudtrail' to the investigation tool-seeding map for cloudwatch/eks/ alertmanager (the prompt prioritization map already had it), so CloudTrail change-causality is pulled in automatically at the start of an AWS incident, not just when the planner picks it. Regression test guards both maps. * Update tests/tools/test_cloudtrail_events.py Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * feat(cloudtrail): signal truncation and support pagination lookup_events caps at 50 results per page; previously total_events was just the page count, so an agent could silently miss events on a busy account. Surface 'truncated' (from CloudTrail's NextToken) and the 'next_token', and accept a next_token param to fetch the next page. Docs + tests updated. * fix(cloudtrail): address review — synthetic safety, bool coercion, docs Blocking: - Read the synthetic backend handle from the harness-shaped aws['ec2_backend'] key (was '_backend', always None), so synthetic runs short-circuit to the fixture instead of a real boto3 lookup_events call. Add a harness-shaped regression test that goes through cloudtrail_extract_params. - Implement lookup_events on the AWSBackend protocol and FixtureAWSBackend so the synthetic path returns a valid empty result instead of AttributeError. Quality: - Stop auto-seeding CloudTrail for cloudwatch/eks/alertmanager alerts (revert the investigation.py seeding); leave it planner-driven via prompt.py so a busy account isn't hit with unscoped, rate-limited account-wide lookups. - Coerce ReadOnly ('true'/'false' string) to a real bool ('false' is truthy). - Declare injected_params=('aws_backend',) for consistency with the RDS tool. - Document that the configured role/creds gate availability only; the lookup uses boto3's ambient credential chain (matches RDS/EKS). --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> |
||
|
Kevin Espiñeira
|
8c9c5e621a |
feat(grafana): add deployment-annotations tool for change correlation (#2689) (#2702)
Add a read-only GrafanaAnnotationsTool plus a query_annotations() method on GrafanaClientBase so the agent can answer "did a deploy/config change precede this alert?" for deploys from any source (ArgoCD/Flux, Helm, Terraform, manual), not just GitHub pushes. Complements GitDeployTimelineTool and reuses the existing Grafana auth. - service: query_annotations() mirrors query_alert_rules() (direct requests.get -> list[dict]); _map_annotation/_epoch_ms_to_iso map /api/annotations to ISO-8601 UTC - tool: mirrors GrafanaAlertRulesTool, reuses GrafanaLogsTool helpers, supports the grafana_backend fixture path, forwards basic-auth credentials - backends: add query_annotations() to the GrafanaBackend Protocol and all implementers - docs: docs/grafana_annotations.mdx registered in docs.json - tests: tests/tools/test_grafana_annotations_tool.py (schema, availability, extraction, backend path, UTC parsing, basic-auth, time-window override) |