Merge branch 'main' into warren/HDX-3277-service-page-quote-escape-bug

Author: kodiakhq[bot]

.changeset/link-button-variant.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/app": patch
+---
+
+feat: Add `link` variant for Button and ActionIcon components

.changeset/olive-hounds-double.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/app": patch
+---
+
+feat: show inline span durations in trace timeline

.changeset/silver-carrots-change.md

@@ -0,0 +1,6 @@
+---
+"@hyperdx/common-utils": patch
+"@hyperdx/app": patch
+---
+
+feat: Add support for dashboard filters on Raw SQL Charts

.github/workflows/security-audit.yml

@@ -0,0 +1,17 @@
+name: Vulnerability Alerts
+
+on:
+  schedule:
+    - cron: '0 9 * * *' # Daily at 9am UTC
+  workflow_dispatch:
+
+jobs:
+  alert:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: kunalnagarco/action-cve@v1.14.23
+        with:
+          org: hyperdxio
+          token: ${{ secrets.DEPENDABOT_NOTIF_PAT }}
+          slack_webhook: ${{ secrets.SLACK_WEBHOOK_VULNERABILITIES }}
+          severity: medium,high,critical

.opencode/commands/do-linear.md

@@ -0,0 +1,54 @@
+---
+description:
+  Fetch a Linear ticket, implement the fix/feature, test, commit, push, and
+  raise a PR
+---
+
+Look up the Linear ticket $ARGUMENTS. Read the ticket description, comments, and
+any linked resources thoroughly.
+
+## Phase 1: Understand the Ticket
+
+- Summarize the ticket — what is being asked for (bug fix, feature, refactor,
+  etc.)
+- Identify acceptance criteria or expected behavior from the description
+- Note any linked issues, related tickets, or dependencies
+
+If the ticket description is too vague or lacks enough information to proceed
+confidently, **stop and ask me for clarification** before writing any code.
+Explain exactly what information is missing and what assumptions you would need
+to make.
+
+## Phase 2: Plan and Implement
+
+Before writing code, read the relevant documentation from the `agent_docs/`
+directory to understand architecture and code patterns.
+
+1. Explore the codebase to understand the relevant code paths and existing
+   patterns
+2. Create an implementation plan — which files to change, what approach to take
+3. Implement the fix or feature following existing codebase patterns
+4. Keep changes minimal and focused on the ticket scope
+
+## Phase 3: Verify
+
+Run lint and type checks, then run the appropriate tests based on which packages
+were modified:
+
+1. Run `make ci-lint` to verify lint and TypeScript types pass
+2. Run `make ci-unit` to verify unit tests pass across all packages
+3. If any checks fail, fix the issues and re-run until everything passes
+
+## Phase 4: Commit, Push, and Open PR
+
+1. Create a new branch named `<current-user>/$ARGUMENTS-<short-description>`.
+   Use the current git/OS username when available, and use `whoami` as a
+   fallback to determine the prefix (e.g. `warren/HDX-1234-fix-search-filter`)
+2. Commit the changes using conventional commit format (e.g. `feat:`, `fix:`,
+   `chore:`) and reference the ticket ID
+3. Push the branch to the remote
+4. Open a pull request with:
+   - Title: `[$ARGUMENTS] <description>`
+   - Body: Use `.github/pull_request_template.md` as the template and fill it in
+     with the relevant summary, testing notes, and Linear ticket link
+   - Label: Attach the `ai-generated` label

.opencode/commands/plan-linear.md

@@ -0,0 +1,22 @@
+---
+description: Research a Linear ticket and create an implementation plan
+agent: plan
+---
+
+Look up the Linear ticket $ARGUMENTS. Read the ticket description and all
+comments on the ticket thoroughly.
+
+Based on your research of the ticket, come up with a detailed implementation
+plan. The plan should include:
+
+1. **Summary** — A concise summary of what the ticket is asking for
+2. **Context** — Relevant information gathered from the ticket description and
+   comments
+3. **Approach** — Step-by-step implementation plan with specific files and
+   components to modify
+4. **Testing** — How the changes should be tested
+5. **Open Questions** — Any ambiguities or decisions that need clarification
+
+Before writing the plan, explore the codebase to understand the relevant code
+paths and existing patterns. Reference specific files and line numbers where
+changes will be needed.

agent_docs/code_style.md

@@ -36,6 +36,7 @@ The project uses Mantine UI with **custom variants** defined in `packages/app/sr
 | `variant="primary"` | Primary actions (Submit, Save, Create, Run) | `<Button variant="primary">Save</Button>` |
 | `variant="secondary"` | Secondary actions (Cancel, Clear, auxiliary actions) | `<Button variant="secondary">Cancel</Button>` |
 | `variant="danger"` | Destructive actions (Delete, Remove, Rotate API Key) | `<Button variant="danger">Delete</Button>` |
+| `variant="link"` | Link-style actions with no background or border (View Details, navigation-style CTAs) | `<Button variant="link">View Details</Button>` |
 
 ### DO NOT USE (Forbidden Patterns)
 
@@ -58,11 +59,15 @@ The following patterns are **NOT ALLOWED** for Button and ActionIcon:
 <Button variant="primary">Save</Button>
 <Button variant="secondary">Cancel</Button>
 <Button variant="danger">Delete</Button>
+<Button variant="link">View Details</Button>
 <ActionIcon variant="primary">...</ActionIcon>
 <ActionIcon variant="secondary">...</ActionIcon>
 <ActionIcon variant="danger">...</ActionIcon>
+<ActionIcon variant="link">...</ActionIcon>
 ```
 
+**Link variant details**: Renders with no background, no border, and muted text color. On hover, text brightens to full contrast. Use for link-style CTAs that should blend into surrounding content (e.g., "View Details", "View Full Trace").
+
 **Note**: `variant="filled"` is still valid for **form inputs** (Select, TextInput, etc.), just not for Button/ActionIcon.
 
 ### Icon-Only Buttons → ActionIcon

package.json

@@ -76,7 +76,7 @@
     "brace-expansion": "^2.0.2",
     "diff": "^5.2.2",
     "on-headers": "^1.1.0",
-    "fast-xml-parser": "^4.4.0",
+    "fast-xml-parser": "^4.5.4",
     "systeminformation": "^5.24.0"
   }
 }

packages/api/openapi.json

@@ -1389,6 +1389,11 @@
             "description": "SQL query template to execute. Supports HyperDX template variables.",
             "example": "SELECT count() FROM otel_logs WHERE timestamp > now() - INTERVAL 1 HOUR"
           },
+          "sourceId": {
+            "type": "string",
+            "description": "Optional ID of the data source associated with this Raw SQL chart. Used for applying dashboard filters.",
+            "example": "65f5e4a3b9e77c001a567890"
+          },
           "numberFormat": {
             "$ref": "#/components/schemas/NumberFormat",
             "description": "Number formatting options for displayed values."

packages/api/src/routers/external-api/__tests__/dashboards.test.ts

@@ -2311,6 +2311,7 @@ describe('External API v2 Dashboards - new format', () => {
 
     it('can round-trip all raw SQL chart config types', async () => {
       const connectionId = connection._id.toString();
+      const sourceId = traceSource._id.toString();
       const sqlTemplate = 'SELECT count() FROM otel_logs WHERE {timeFilter}';
 
       const lineRawSql: ExternalDashboardTile = {
@@ -2324,6 +2325,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'line',
           connectionId,
           sqlTemplate,
+          sourceId,
           compareToPreviousPeriod: true,
           fillNulls: true,
           alignDateRangeToGranularity: true,
@@ -2342,6 +2344,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'stacked_bar',
           connectionId,
           sqlTemplate,
+          sourceId,
           fillNulls: false,
           alignDateRangeToGranularity: false,
           numberFormat: { output: 'byte', decimalBytes: true },
@@ -2359,6 +2362,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'table',
           connectionId,
           sqlTemplate,
+          sourceId,
           numberFormat: { output: 'percent', mantissa: 1 },
         },
       };
@@ -2374,6 +2378,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'number',
           connectionId,
           sqlTemplate,
+          sourceId,
           numberFormat: { output: 'currency', currencySymbol: '$' },
         },
       };
@@ -2389,6 +2394,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'pie',
           connectionId,
           sqlTemplate,
+          sourceId,
         },
       };
 
@@ -2457,6 +2463,43 @@ describe('External API v2 Dashboards - new format', () => {
       });
     });
 
+    it('should return 400 when source connection does not match tile connection', async () => {
+      const otherConnection = await Connection.create({
+        team: team._id,
+        name: 'Other Connection',
+        host: config.CLICKHOUSE_HOST,
+        username: config.CLICKHOUSE_USER,
+        password: config.CLICKHOUSE_PASSWORD,
+      });
+
+      const response = await authRequest('post', BASE_URL)
+        .send({
+          name: 'Dashboard with Mismatched Source Connection',
+          tiles: [
+            {
+              name: 'Raw SQL Tile',
+              x: 0,
+              y: 0,
+              w: 6,
+              h: 3,
+              config: {
+                configType: 'sql',
+                displayType: 'table',
+                connectionId: otherConnection._id.toString(),
+                sourceId: traceSource._id.toString(),
+                sqlTemplate: 'SELECT count() FROM otel_logs',
+              },
+            },
+          ],
+          tags: [],
+        })
+        .expect(400);
+
+      expect(response.body).toEqual({
+        message: `The following source IDs do not match the specified connections: ${traceSource._id.toString()}`,
+      });
+    });
+
     it('should create a dashboard with filters', async () => {
       const dashboardPayload = {
         name: 'Dashboard with Filters',
@@ -3100,6 +3143,7 @@ describe('External API v2 Dashboards - new format', () => {
 
     it('can round-trip all raw SQL chart config types', async () => {
       const connectionId = connection._id.toString();
+      const sourceId = traceSource._id.toString();
       const sqlTemplate = 'SELECT count() FROM otel_logs WHERE {timeFilter}';
 
       const lineRawSql: ExternalDashboardTileWithId = {
@@ -3114,6 +3158,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'line',
           connectionId,
           sqlTemplate,
+          sourceId,
           compareToPreviousPeriod: true,
           fillNulls: true,
           alignDateRangeToGranularity: true,
@@ -3133,6 +3178,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'stacked_bar',
           connectionId,
           sqlTemplate,
+          sourceId,
           fillNulls: false,
           alignDateRangeToGranularity: false,
           numberFormat: { output: 'byte', decimalBytes: true },
@@ -3151,6 +3197,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'table',
           connectionId,
           sqlTemplate,
+          sourceId,
           numberFormat: { output: 'percent', mantissa: 1 },
         },
       };
@@ -3167,6 +3214,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'number',
           connectionId,
           sqlTemplate,
+          sourceId,
           numberFormat: { output: 'currency', currencySymbol: '$' },
         },
       };
@@ -3183,6 +3231,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'pie',
           connectionId,
           sqlTemplate,
+          sourceId,
         },
       };
 
@@ -3271,6 +3320,45 @@ describe('External API v2 Dashboards - new format', () => {
       });
     });
 
+    it('should return 400 when source connection does not match tile connection', async () => {
+      const dashboard = await createTestDashboard();
+      const otherConnection = await Connection.create({
+        team: team._id,
+        name: 'Other Connection',
+        host: config.CLICKHOUSE_HOST,
+        username: config.CLICKHOUSE_USER,
+        password: config.CLICKHOUSE_PASSWORD,
+      });
+
+      const response = await authRequest('put', `${BASE_URL}/${dashboard._id}`)
+        .send({
+          name: 'Updated Dashboard with Mismatched Source Connection',
+          tiles: [
+            {
+              id: new ObjectId().toString(),
+              name: 'Raw SQL Tile',
+              x: 0,
+              y: 0,
+              w: 6,
+              h: 3,
+              config: {
+                configType: 'sql',
+                displayType: 'table',
+                connectionId: otherConnection._id.toString(),
+                sourceId: traceSource._id.toString(),
+                sqlTemplate: 'SELECT count() FROM otel_logs',
+              },
+            },
+          ],
+          tags: [],
+        })
+        .expect(400);
+
+      expect(response.body).toEqual({
+        message: `The following source IDs do not match the specified connections: ${traceSource._id.toString()}`,
+      });
+    });
+
     it('should delete alert when tile is updated from builder to raw SQL config', async () => {
       const tileId = new ObjectId().toString();
       const dashboard = await createTestDashboard({