4569657923
## What & why This is the system behind the Dashboard Agent — an assistant that answers questions about a project's runs, errors, queues, deploys and health, and can investigate failures end to end. The agent runs as a chat.agent task in its own Trigger project. It has no access to the main database or ClickHouse; all platform data is read through the public API using a delegated, read-only user token. Everything here is behind `canAccessDashboardAgent` and inert with the flag off. The UI that mounts the panel lands in #4529. ## Stack `#4418` (this, base) ← `#4529` UI ← `#4525` Watch ← `#4516` storybook gallery. The scenario/contract reference for the whole stack is `internal-packages/dashboard-agent/GUIDEBOOK.md` (it lands on the Watch branch): it states, per feature, what makes each thing happen and where that is decided. ## What's inside **Agent runtime and tools** — `internal-packages/dashboard-agent`: prompt, tool set (API reads, TRQL query, docs, navigation, evidence/investigations, repo source), conversation compaction, a prompt-prefix token budget pinned by snapshot test, and sampled LLM-judged turn evals. The package cannot import webapp server code, which is what makes the "no DB access" claim structural rather than a convention. **Contracts** — `internal-packages/dashboard-agent-contracts`: `trigger://` URIs, intents, and the block envelope every rendered card travels in. **Conversation store** — `internal-packages/dashboard-agent-db`: drizzle over postgres-js in its own `trigger_dashboard_agent` Postgres schema, plus one additive migration. **Auth boundary** — the user-actor token gains an optional environment claim; one guard (`userActorEnvironment.server.ts`) enforces it so routes don't each re-derive the rule. Token minting, cap ceiling, and the RBAC fallback path for self-hosted. **Transport** — webapp resource routes that mint the token and proxy each turn, and SDK-side mid-turn reconnect. **Public API the agent reads through** — orgs, projects, environments, runs, queue metrics, workers, a run's commit metadata, repo snapshot, reports, and `POST /api/v1/query`. **Reports** — the health report's layout is declared once and shared by the card, the markdown surface and the JSON/MCP surface, so the same report reads the same in the dashboard, the terminal and an editor. **Block renderers** — the report and investigation cards the flows above already emit (`app/components/dashboard-agent/`). The panel that hosts them, and the rest of the chat UI, is #4529. **Query safety and CSP** — see below. ## Key decisions - **The agent is a separate Trigger project, not webapp code.** It reads platform data over the public API with a delegated user-actor token whose `cap` ceilings it to read scopes. No Prisma, no ClickHouse, no webapp imports. - **The PAT-only auth helper now refuses user-actor tokens.** This is an intentional behavioral change: its callers consume only a bare userId and do not enforce delegated-token capabilities. Actor-aware routes continue through the scoped route builders instead. - **RBAC fallback builds a delegated token's ability from its own cap**, never the blanket ability a PAT gets (read-only when the token declares none). Without this, the agent's read-only cap would buy a write JWT on self-hosted. - **Org creation checks RBAC only for user-actor tokens, and only after the env gate**, so an install with `ORG_CREATION_API_ENABLED` off returns 404 rather than 403, and an ordinary PAT never consults an ability the route has no org to scope. Both orderings are pinned by test. - **The query path is read-only in depth.** TRQL rejects write statements at the grammar level (they don't parse, rather than being filtered), ClickHouse runs with `readonly=1`, and the org/project/env filters are injected server-side from the credential — the request body cannot widen scope. An unparseable query denies instead of falling through to the permissive resource. - **Document-wide img-src CSP.** Remote images are an outbound-request/exfiltration surface, so the policy permits only own-origin/data/blob, the required SSO avatar hosts, and the favicon endpoint. Operators can add exact origins through CSP_IMG_SRC_ALLOWLIST; wildcard hosts and bare schemes are intentionally not allowed. - **The chat transport reconnects on a mid-turn EOF** (`@trigger.dev/sdk`). A body that ends without a turn-complete is terminal only when the server says `X-Session-Settled: true`; otherwise the transport resubscribes from `lastEventId` with bounded backoff, and any record re-earns the budget. Previously a closed long-poll window or a proxy restart left the reply stuck as if still generating. - **Conversations live in their own datastore**, schema-scoped and foreign-key-free (it references `organizationId`/`userId` by id, because in cloud it is a different database). It is a display read-model for the History tab and transport resume; `chat.agent`'s object-store snapshot remains the model's source of truth. - **Deterministic first.** Reports and health checks contain no LLM — they are computed from the same data the dashboard shows, and the model only narrates and links them. That is what makes a number in an answer auditable. ## Testing - 63 new test files, run with `pnpm run test --filter webapp` and per-package vitest. Heaviest coverage on the auth boundary (`userActorPatOnlyBoundary`, `userActorTokenClaimsAndScopes`, `contextlessPatRoutes`, `rbacFallbackBranch`), TRQL read-only, the report layout, and the SDK reconnect. - The agent package has a separate eval lane (`pnpm run test:evals`, `vitest.eval.config.ts`) that hits the real model, so it never runs in `pnpm test`. - Live-tested against a local stack scenario by scenario; the GUIDEBOOK lists the condition each behaviour is expected under, which is what those runs were checked against. ## Changelog `.server-changes/dashboard-agent.md`, plus changesets for `@trigger.dev/core` (report schemas), `@trigger.dev/sdk` (chat reconnect) and the CLI's `mint-token` help text.
227 lines
8.5 KiB
TypeScript
227 lines
8.5 KiB
TypeScript
import { type ReactNode } from "react";
|
||
import {
|
||
Line,
|
||
LineChart,
|
||
ReferenceLine,
|
||
ResponsiveContainer,
|
||
Tooltip,
|
||
type TooltipProps,
|
||
YAxis,
|
||
} from "recharts";
|
||
import { formatDateTime } from "~/components/primitives/DateTime";
|
||
import { Header3 } from "~/components/primitives/Headers";
|
||
import { SimpleTooltip } from "~/components/primitives/Tooltip";
|
||
import TooltipPortal from "~/components/primitives/TooltipPortal";
|
||
import {
|
||
ACTIVITY_CHART_HEIGHT,
|
||
ACTIVITY_CHART_PEAK_CLASS,
|
||
ACTIVITY_CHART_WIDTH,
|
||
} from "./ActivityBarChart";
|
||
|
||
type UnitLabel = { singular: string; plural: string };
|
||
|
||
/** Extra px above the plot so the hover activeDot at the peak value isn't clipped by the SVG edge. */
|
||
const DOT_HEADROOM = 3;
|
||
|
||
type MiniLineChartDatum = {
|
||
date: Date;
|
||
count: number;
|
||
/** Raw per-bucket throttled count (tooltip). */
|
||
throttledCount: number;
|
||
/** The queued value again, present only around throttled buckets, so the warning overlay
|
||
* retraces the same line and reads as one line changing colour. */
|
||
throttledOverlay: number | null;
|
||
};
|
||
|
||
export type MiniLineChartProps = {
|
||
/** Equal-width time buckets, oldest first. */
|
||
data?: number[];
|
||
/**
|
||
* Per-bucket throttled counts aligned 1:1 with `data`. Where throttling occurred, the queued
|
||
* line itself is retraced in the warning colour — one line that changes colour, with the
|
||
* throttled magnitude carried by the tooltip.
|
||
*/
|
||
throttled?: number[];
|
||
/** Tooltip wording for the overlay buckets. Null omits the overlay line. */
|
||
overlayLabel?: string | null;
|
||
/** Epoch ms of the first bucket's start. When omitted, the last bucket is anchored to now. */
|
||
bucketStartMs?: number;
|
||
/** Width of each bucket in ms. Defaults to one hour. */
|
||
bucketIntervalMs?: number;
|
||
/** Line colour for the queued series. */
|
||
color?: string;
|
||
/** Trailing peak scalar shown after the chart. Defaults to the max of the buckets. */
|
||
peak?: number;
|
||
/** Format the trailing peak label. Defaults to `toLocaleString`. */
|
||
formatPeak?: (peak: number) => string;
|
||
/** Tooltip content shown on hover of the trailing peak label. */
|
||
peakTooltip?: ReactNode;
|
||
/** Unit shown in the per-bucket tooltip (e.g. queued, runs). */
|
||
unitLabel?: UnitLabel;
|
||
/** Chart width in px. Defaults to the shared ACTIVITY_CHART_WIDTH. Ignored when `fillWidth`. */
|
||
width?: number;
|
||
/** Plot height in px. Defaults to the shared ACTIVITY_CHART_HEIGHT. */
|
||
height?: number;
|
||
/** Stretch the plot to the container width (via ResponsiveContainer) instead of a fixed px width. */
|
||
fillWidth?: boolean;
|
||
/** Show the trailing peak label to the right of the chart. Defaults to true. */
|
||
showPeak?: boolean;
|
||
};
|
||
|
||
/**
|
||
* Inline fixed-size mini line sparkline for list rows, plus a trailing peak label. Presentational —
|
||
* the caller supplies zero/carry-forward-filled buckets. Renders an em-dash when there's no data.
|
||
* The queued series is a thin monotone line (no dots) matching the big Backlog chart; stretches
|
||
* where the queue was throttled retrace the same line in the warning colour. Shares its fixed
|
||
* dimensions and trailing peak label with {@link ActivityBarChart}, but plots lines instead of bars.
|
||
*/
|
||
export function MiniLineChart({
|
||
data,
|
||
throttled,
|
||
overlayLabel = "throttled",
|
||
bucketStartMs,
|
||
bucketIntervalMs,
|
||
color = "var(--color-tasks)",
|
||
peak: peakOverride,
|
||
formatPeak,
|
||
peakTooltip,
|
||
unitLabel = { singular: "value", plural: "values" },
|
||
width = ACTIVITY_CHART_WIDTH,
|
||
height = ACTIVITY_CHART_HEIGHT,
|
||
fillWidth = false,
|
||
showPeak = true,
|
||
}: MiniLineChartProps) {
|
||
const hasPeakOverride = peakOverride !== undefined;
|
||
if (!data || data.length === 0 || (data.every((v) => v === 0) && !hasPeakOverride)) {
|
||
return <span className="text-text-dimmed">–</span>;
|
||
}
|
||
|
||
// The overlay only draws where throttling happened. Mapping other buckets to null leaves gaps so
|
||
// a wholly-zero throttled series never paints over the queued line.
|
||
const hasThrottled = throttled?.some((v) => v > 0) ?? false;
|
||
|
||
const max = Math.max(...data);
|
||
const peak = peakOverride ?? max;
|
||
|
||
// Map each bucket to a dated point so the tooltip can show the window it represents. Buckets are
|
||
// `intervalMs` wide; if the caller didn't pass the first bucket's start, anchor the last bucket to
|
||
// now (hourly default).
|
||
const intervalMs = bucketIntervalMs ?? 3600_000;
|
||
const startMs = bucketStartMs ?? Date.now() - (data.length - 1) * intervalMs;
|
||
const chartData: MiniLineChartDatum[] = data.map((count, i) => {
|
||
const t = throttled?.[i] ?? 0;
|
||
// Extend the mask one bucket forward (a segment needs both endpoints non-null), so even a
|
||
// single throttled bucket draws a visible warning stretch.
|
||
const inOverlay = t > 0 || (throttled?.[i - 1] ?? 0) > 0;
|
||
return {
|
||
date: new Date(startMs + i * intervalMs),
|
||
count,
|
||
throttledCount: t,
|
||
throttledOverlay: inOverlay ? count : null,
|
||
};
|
||
});
|
||
|
||
const chart = (
|
||
<LineChart
|
||
data={chartData}
|
||
width={width}
|
||
height={height + DOT_HEADROOM}
|
||
margin={{ top: DOT_HEADROOM, right: 0, left: 0, bottom: 0 }}
|
||
>
|
||
<YAxis domain={[0, max || 1]} hide />
|
||
<Tooltip
|
||
cursor={{ stroke: "rgba(255, 255, 255, 0.2)", strokeWidth: 1 }}
|
||
content={<MiniLineChartTooltip unitLabel={unitLabel} overlayLabel={overlayLabel} />}
|
||
allowEscapeViewBox={{ x: true, y: true }}
|
||
wrapperStyle={{ zIndex: 1000 }}
|
||
animationDuration={0}
|
||
/>
|
||
<ReferenceLine y={0} stroke="var(--color-border-bright)" strokeWidth={1} />
|
||
<Line
|
||
type="monotone"
|
||
dataKey="count"
|
||
stroke={color}
|
||
strokeWidth={1}
|
||
dot={false}
|
||
activeDot={{ r: 2.5, fill: color, strokeWidth: 0 }}
|
||
isAnimationActive={false}
|
||
/>
|
||
{hasThrottled && (
|
||
<Line
|
||
type="monotone"
|
||
dataKey="throttledOverlay"
|
||
stroke="var(--color-warning)"
|
||
strokeWidth={1}
|
||
dot={false}
|
||
activeDot={{ r: 2.5, fill: "var(--color-warning)", strokeWidth: 0 }}
|
||
connectNulls={false}
|
||
isAnimationActive={false}
|
||
/>
|
||
)}
|
||
</LineChart>
|
||
);
|
||
|
||
return (
|
||
<div className={`flex items-start gap-1.5${fillWidth ? " w-full" : ""}`}>
|
||
{/* +DOT_HEADROOM of extra height, spent as top margin, so the hover activeDot at the peak
|
||
isn't clipped by the SVG edge while the plotted area stays `height` tall. */}
|
||
<div
|
||
className={`rounded-sm${fillWidth ? " w-full" : ""}`}
|
||
style={{ width: fillWidth ? undefined : width, height: height + DOT_HEADROOM }}
|
||
>
|
||
{/* Fixed px dims skip ResponsiveContainer's ResizeObserver (see ActivityBarChart); with
|
||
fillWidth we opt back into it so the plot stretches to the block. */}
|
||
{fillWidth ? (
|
||
<ResponsiveContainer width="100%" height={height + DOT_HEADROOM}>
|
||
{chart}
|
||
</ResponsiveContainer>
|
||
) : (
|
||
chart
|
||
)}
|
||
</div>
|
||
{showPeak && (
|
||
<MiniLinePeakLabel tooltip={peakTooltip}>
|
||
{formatPeak ? formatPeak(peak) : peak.toLocaleString()}
|
||
</MiniLinePeakLabel>
|
||
)}
|
||
</div>
|
||
);
|
||
}
|
||
|
||
function MiniLinePeakLabel({ tooltip, children }: { tooltip?: ReactNode; children: ReactNode }) {
|
||
const label = <span className={ACTIVITY_CHART_PEAK_CLASS}>{children}</span>;
|
||
if (!tooltip) return label;
|
||
return <SimpleTooltip asChild button={label} content={tooltip} />;
|
||
}
|
||
|
||
function MiniLineChartTooltip({
|
||
active,
|
||
payload,
|
||
unitLabel,
|
||
overlayLabel = "throttled",
|
||
}: TooltipProps<number, string> & { unitLabel: UnitLabel; overlayLabel?: string | null }) {
|
||
if (!active || !payload || payload.length === 0) return null;
|
||
const entry = payload[0].payload as MiniLineChartDatum;
|
||
const date = entry.date instanceof Date ? entry.date : new Date(entry.date);
|
||
const formattedDate = formatDateTime(date, "UTC", [], false, true);
|
||
const throttled = entry.throttledCount;
|
||
return (
|
||
<TooltipPortal active={active}>
|
||
<div className="rounded-sm border border-grid-bright bg-background-dimmed px-3 py-2">
|
||
<Header3 className="border-b border-b-border-bright pb-2">{formattedDate}</Header3>
|
||
<div className="mt-2 text-xs text-text-bright">
|
||
<span className="tabular-nums">{entry.count.toLocaleString()}</span>{" "}
|
||
<span className="text-text-dimmed">
|
||
{entry.count === 1 ? unitLabel.singular : unitLabel.plural}
|
||
</span>
|
||
</div>
|
||
{throttled > 0 && overlayLabel !== null && (
|
||
<div className="mt-1 text-xs text-warning">
|
||
<span className="tabular-nums">{throttled.toLocaleString()}</span> {overlayLabel}
|
||
</div>
|
||
)}
|
||
</div>
|
||
</TooltipPortal>
|
||
);
|
||
}
|