Files
triggerdotdev--trigger.dev/apps/webapp/app/routes/api.v1.queues.$queueParam.metrics.ts
T
Katia Bulatova 4569657923 feat(webapp): dashboard agent — chat, reports, investigate (#4418)
## What & why

This is the system behind the Dashboard Agent — an assistant that
answers questions about a project's runs, errors, queues, deploys and
health, and can investigate failures end to end.

The agent runs as a chat.agent task in its own Trigger project. It has
no access to the main database or ClickHouse; all platform data is read
through the public API using a delegated, read-only user token.

Everything here is behind `canAccessDashboardAgent` and inert with the
flag off. The UI that mounts the panel lands in #4529.

## Stack

`#4418` (this, base) ← `#4529` UI ← `#4525` Watch ← `#4516` storybook
gallery. The scenario/contract reference for the whole stack is
`internal-packages/dashboard-agent/GUIDEBOOK.md` (it lands on the Watch
branch): it states, per feature, what makes each thing happen and where
that is decided.

## What's inside

**Agent runtime and tools** — `internal-packages/dashboard-agent`:
prompt, tool set (API reads, TRQL query, docs, navigation,
evidence/investigations, repo source), conversation compaction, a
prompt-prefix token budget pinned by snapshot test, and sampled
LLM-judged turn evals. The package cannot import webapp server code,
which is what makes the "no DB access" claim structural rather than a
convention.

**Contracts** — `internal-packages/dashboard-agent-contracts`:
`trigger://` URIs, intents, and the block envelope every rendered card
travels in.

**Conversation store** — `internal-packages/dashboard-agent-db`: drizzle
over postgres-js in its own `trigger_dashboard_agent` Postgres schema,
plus one additive migration.

**Auth boundary** — the user-actor token gains an optional environment
claim; one guard (`userActorEnvironment.server.ts`) enforces it so
routes don't each re-derive the rule. Token minting, cap ceiling, and
the RBAC fallback path for self-hosted.

**Transport** — webapp resource routes that mint the token and proxy
each turn, and SDK-side mid-turn reconnect.

**Public API the agent reads through** — orgs, projects, environments,
runs, queue metrics, workers, a run's commit metadata, repo snapshot,
reports, and `POST /api/v1/query`.

**Reports** — the health report's layout is declared once and shared by
the card, the markdown surface and the JSON/MCP surface, so the same
report reads the same in the dashboard, the terminal and an editor.

**Block renderers** — the report and investigation cards the flows above
already emit (`app/components/dashboard-agent/`). The panel that hosts
them, and the rest of the chat UI, is #4529.

**Query safety and CSP** — see below.

## Key decisions

- **The agent is a separate Trigger project, not webapp code.** It reads
platform data over the public API with a delegated user-actor token
whose `cap` ceilings it to read scopes. No Prisma, no ClickHouse, no
webapp imports.
- **The PAT-only auth helper now refuses user-actor tokens.** This is an
intentional behavioral change: its callers consume only a bare userId
and do not enforce delegated-token capabilities. Actor-aware routes
continue through the scoped route builders instead.
- **RBAC fallback builds a delegated token's ability from its own cap**,
never the blanket ability a PAT gets (read-only when the token declares
none). Without this, the agent's read-only cap would buy a write JWT on
self-hosted.
- **Org creation checks RBAC only for user-actor tokens, and only after
the env gate**, so an install with `ORG_CREATION_API_ENABLED` off
returns 404 rather than 403, and an ordinary PAT never consults an
ability the route has no org to scope. Both orderings are pinned by
test.
- **The query path is read-only in depth.** TRQL rejects write
statements at the grammar level (they don't parse, rather than being
filtered), ClickHouse runs with `readonly=1`, and the org/project/env
filters are injected server-side from the credential — the request body
cannot widen scope. An unparseable query denies instead of falling
through to the permissive resource.
- **Document-wide img-src CSP.** Remote images are an
outbound-request/exfiltration surface, so the policy permits only
own-origin/data/blob, the required SSO avatar hosts, and the favicon
endpoint. Operators can add exact origins through CSP_IMG_SRC_ALLOWLIST;
wildcard hosts and bare schemes are intentionally not allowed.
- **The chat transport reconnects on a mid-turn EOF**
(`@trigger.dev/sdk`). A body that ends without a turn-complete is
terminal only when the server says `X-Session-Settled: true`; otherwise
the transport resubscribes from `lastEventId` with bounded backoff, and
any record re-earns the budget. Previously a closed long-poll window or
a proxy restart left the reply stuck as if still generating.
- **Conversations live in their own datastore**, schema-scoped and
foreign-key-free (it references `organizationId`/`userId` by id, because
in cloud it is a different database). It is a display read-model for the
History tab and transport resume; `chat.agent`'s object-store snapshot
remains the model's source of truth.
- **Deterministic first.** Reports and health checks contain no LLM —
they are computed from the same data the dashboard shows, and the model
only narrates and links them. That is what makes a number in an answer
auditable.

## Testing

- 63 new test files, run with `pnpm run test --filter webapp` and
per-package vitest. Heaviest coverage on the auth boundary
(`userActorPatOnlyBoundary`, `userActorTokenClaimsAndScopes`,
`contextlessPatRoutes`, `rbacFallbackBranch`), TRQL read-only, the
report layout, and the SDK reconnect.
- The agent package has a separate eval lane (`pnpm run test:evals`,
`vitest.eval.config.ts`) that hits the real model, so it never runs in
`pnpm test`.
- Live-tested against a local stack scenario by scenario; the GUIDEBOOK
lists the condition each behaviour is expected under, which is what
those runs were checked against.

## Changelog

`.server-changes/dashboard-agent.md`, plus changesets for
`@trigger.dev/core` (report schemas), `@trigger.dev/sdk` (chat
reconnect) and the CLI's `mint-token` help text.
2026-08-11 18:56:14 +02:00

145 lines
5.4 KiB
TypeScript

import { json } from "@remix-run/server-runtime";
import { z } from "zod";
import { clickhouseFactory } from "~/services/clickhouse/clickhouseFactoryInstance.server";
import { logger } from "~/services/logger.server";
import { createLoaderApiRoute } from "~/services/routeBuilders/apiBuilder.server";
import { queueDepthSeries } from "~/v3/queueDepthSeries";
/**
* Per-queue metrics over a window. `queueParam` is the queue name; `?type=task` (the default)
* adds the `task/` prefix. An unknown queue returns zeroed metrics, not a 404.
*/
const UNIT_MS: Record<string, number> = { s: 1e3, m: 6e4, h: 36e5, d: 864e5, w: 6048e5 };
const MAX_PERIOD_MS = 7 * UNIT_MS.d;
const PeriodSchema = z
.string()
.regex(/^[1-9]\d*[smhdw]$/, "period must be a shorthand like '15m', '1h', or '24h'")
.refine(
(p) => Number(p.slice(0, -1)) * UNIT_MS[p.slice(-1)] <= MAX_PERIOD_MS,
"period is too large (max 7d)"
);
const SearchParamsSchema = z.object({
type: z.enum(["task", "custom"]).default("task"),
period: PeriodSchema.default("1h"),
});
const TREND_POINTS = 12;
function periodMs(period: string): number {
return Number(period.slice(0, -1)) * UNIT_MS[period.slice(-1)];
}
function formatClickhouseDateTime(date: Date): string {
return date.toISOString().slice(0, 19).replace("T", " ");
}
function finiteOrNull(value: number | undefined): number | null {
return typeof value === "number" && Number.isFinite(value) ? value : null;
}
export const loader = createLoaderApiRoute(
{
params: z.object({
queueParam: z.string().transform((val) => val.replace(/%2F/g, "/")),
}),
searchParams: SearchParamsSchema,
allowJWT: true,
corsStrategy: "none",
findResource: async () => 1, // dummy — the queue name isn't resolved against Postgres
authorization: {
action: "read",
resource: () => ({ type: "query", id: "queue_metrics" }),
},
},
async ({ params, searchParams, authentication }) => {
// Already decoded by Remix and the schema; decoding again would 500 on a literal "%".
const name = params.queueParam;
const queue = searchParams.type === "task" && !name.startsWith("task/") ? `task/${name}` : name;
const windowMs = periodMs(searchParams.period);
const windowMinutes = windowMs / 60_000;
const bucketSeconds = Math.max(60, Math.round(windowMs / 1000 / TREND_POINTS));
// Snap both bounds to the bucket grid so repeated calls share ClickHouse cache entries.
const bucketIntervalMs = bucketSeconds * 1000;
const endMs = Math.ceil(Date.now() / bucketIntervalMs) * bucketIntervalMs;
const startMs = endMs - windowMs;
// The trend grid covers whole buckets, so a period that isn't a bucket multiple still lines up.
const gridStartMs = Math.floor(startMs / bucketIntervalMs) * bucketIntervalMs;
const numBuckets = Math.round((endMs - gridStartMs) / bucketIntervalMs);
try {
const clickhouse = await clickhouseFactory.getClickhouseForOrganization(
authentication.environment.organizationId,
"query"
);
const ids = {
organizationId: authentication.environment.organizationId,
projectId: authentication.environment.projectId,
environmentId: authentication.environment.id,
queueNames: [queue],
startTime: formatClickhouseDateTime(new Date(startMs)),
endTime: formatClickhouseDateTime(new Date(endMs)),
};
const [summaryResult, trendResult] = await Promise.all([
clickhouse.queueMetrics.listSummary(ids),
clickhouse.queueMetrics.depthSparklines({ ...ids, bucketSeconds }),
]);
const [summaryError, summaryRows] = summaryResult;
const [trendError, trendRows] = trendResult;
if (summaryError || trendError) {
logger.warn("Failed to read queue metrics", {
summaryError: summaryError?.message,
trendError: trendError?.message,
organizationId: ids.organizationId,
projectId: ids.projectId,
environmentId: ids.environmentId,
});
return json({ error: "Queue metrics are unavailable right now." }, { status: 503 });
}
const summary = summaryRows?.[0];
const startedCount = summary?.started_count ?? 0;
return json({
queue,
period: searchParams.period,
from: new Date(startMs).toISOString(),
to: new Date(endMs).toISOString(),
waitMs: {
p50: finiteOrNull(summary?.p50_wait_ms),
p95: finiteOrNull(summary?.p95_wait_ms),
},
peakQueued: summary?.peak_queued ?? 0,
startedCount,
startedPerMin: Number((startedCount / windowMinutes).toFixed(2)),
throttledCount: summary?.throttled_count ?? 0,
bucketIntervalMs,
// Oldest first, one point per bucket: a bucket with no sample carries the previous depth.
depthTrend: queueDepthSeries(trendRows ?? [], {
startMs: gridStartMs,
bucketIntervalMs,
numBuckets,
}).depth,
});
} catch (error) {
// Rethrow Responses: swallowing one would turn it into a 500.
if (error instanceof Response) throw error;
logger.error("Failed to read queue metrics", {
error,
queue,
organizationId: authentication.environment.organizationId,
projectId: authentication.environment.projectId,
environmentId: authentication.environment.id,
});
return json({ error: "Something went wrong, please try again." }, { status: 500 });
}
}
);