#### Description
End-to-end cover for the rebuilt notification channel screens.
`edit.spec.ts` came with the v2 move; this adds the flows around it.
- **list** — search narrows the table, the type filter keeps only that
type, a search that matches nothing offers to clear itself, clicking a
row opens the channel, and View JSON masks the secrets.
- **create** — a webhook channel saves and appears in the list, and
saving without a name reports the missing field.
- **delete** — removing from the row menu takes the channel out of the
list.
- **one of each type** — eleven create specs and eleven edit specs, one
per channel type. Create fills only what the validator refuses to save
without and checks the row appears; edit seeds the channel through the
API, changes its first required field and checks the change survives a
reload. A type whose settings component or validator drifts fails here
rather than in support.
Everything the specs need lives in `drivers/channels.ts`, following
`drivers/routing.ts`: a `channels` driver for the list, the form and the
API, a worker-scoped `channelSet` that seeds one Slack and one email
channel sharing a prefix, and `CHANNEL_TYPES`, the one table both
per-type specs read so a new channel type is added in a single place.
The specs touch `page` only where they wait on a URL.
The type fixtures respect the real validators rather than guessing:
Google Chat needs https on `chat.googleapis.com`, Jira an https
`.atlassian.net` host, incident.io an id after `/v2/alert_events/http/`,
and Telegram a non-zero chat id.
#### Description
From the review of SigNoz/signoz#12976 (channel list and form):
- Add the missing spacing and tooltip - fixed. Tooltip has not been a
common pattern for this though. We should make changes once the button
component supports it
- Add a discard button to the form - fixed
- Lay out the form's action buttons the way the alert pages do - fixed
- Fix light mode, which still looks off on these screens. - fixed
- Fix the text that is not visible in light mode. - fixed
- When the list is filtered by a kind, such as Jira or Google Chat, show
a button that creates a channel of that kind - fixed.
- Fix the field styling, which still looks off - fixed, updated design
- Give the TextArea the same background as the other inputs in light
mode. It differs because it comes from antd. - fixed background and
borders as well.
- Make the delete button the same height as the input next to it -
updated design, fixed
- allow search term api filtering in notification channel search api -
fixed
- show no data state on load aside from the empty state with filters
applied - fixed, an empty workspace gets its own screen with a create
action
- alerts list icon should be same size as the new channel button -
flipped and fixed
- the help icon should be to the right of the new channel button instead
of the left - fixed
#### Issues closed by this PR
Closes https://github.com/SigNoz/pulse-pod/issues/598
#### Screenshots / Screen Recordings
Every story under `Pages/Alerts/Channels`, shot in dark and light before
and after: **https://claude.ai/artifact/6FQ2pawzEhK5hZhWsG1tB2**
130 pairs, 112 changed, 6 new screens. The page groups them, so you can
open just the form screens, just the list, or just the Slack sections.
One caveat on that page: it was captured before the global button font
rule was reverted, so it counts more changed screens than the branch now
has. The groups and what each one shows are still accurate.
#### Description
Gives Telegram a form, now that the v2 API models the kind. Last in the
stack, so it is written against the v2 schemas rather than the v1 form
it would have had to use underneath.
- `Settings/Telegram.tsx`: bot token, the numeric chat id, an optional
forum topic id, the message template, an optional self-hosted Bot API
URL, and a send-silently toggle.
- Telegram joins the channel type select and `renderSettings()`.
- Stories for the new and edit screens, a prefill case covering every
field, and a round-trip case so a saved channel comes back unchanged.
#### Issues closed by this PR
Closes https://github.com/SigNoz/pulse-pod/issues/583
#### Screenshots / Screen Recordings
[Screen diff against `main`, dark and
light](https://claude.ai/artifact/SeVW4fTm88oSCJpiCq2UM8)
Four new screens: the Telegram form, editing one, saving with the
required fields empty, and one with update denied. The other **115
screens are pixel for pixel the same** as on main, in both themes. The
single remaining row is a focus outline left by a story's own click, 95
pixels, checked by cropping both shots.
#### Additional Information
`chatId` is an int64 and `messageThreadId` an int, the first numeric
fields the channel form has had. An empty or half-typed box sends
nothing rather than `NaN`, which would serialise as `null` and be
rejected. The prefill test's field tuples widen to `string | number`
because a number input reports a number.
The message template is left out of the defaults on purpose: the API
fills `DefaultTelegramMessageTemplate` when the key is absent, and
sending an empty string would overwrite it.
The kind itself was taught to the list, the filter and the JSON view
(including masking the bot token) in the base PR, which is what the
exhaustive per-kind maps require once the schema carries `telegram`.
#### Description
- Previewing a rule that drops every non-protected label of a metric
returned 500 "failed to estimate reduction impact". With no kept labels
the cardinality query selects a bare `1`, which ClickHouse types as
`UInt8`, and the driver refuses to scan that into the `uint64` the code
reads it into.
- The literal is now `toUInt64(1)`, matching the scan target, so such
previews report one retained series as intended.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
Dotted keys like rule.id are already the convention across the codebase.
#### Description
- Metrics explorer routes were still on the coarse `ViewAccess` gate, so
a custom role scoped to a workspace key on metrics could list, inspect
and read stats for every metric through them while being denied on
`query_range`.
- Stats, treemap, inspect, highlights and onboarding derive the resource
from the caller's `filter.expression` or resolve to the metrics
wildcard, exactly as `query_range` does. Key-scoped custom roles get 403
unless the filter pins a granted key.
- A new `metrics-field` metaresource covers the metrics list, the
metadata and attributes reads, and the metadata update, with wildcard
grants: admin and editor may update, every managed role may list and
read. Existing organizations get the tuples through a migration.
- The alerts and dashboards lookups read the rule and dashboard stores,
so they require `rule:list` and `dashboard:list`.
- The new `metricsexplorer` integration suite is added to the CI matrix.
#### Issues closed by this PR
Part of SigNoz/keystone-pod#141
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- with release of 0.163.0 of collector contrib, `googlecloudpubsubpush`
receiver is published
- enabling logs services in gcp integration for manual flow
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Contributes to https://github.com/SigNoz/keystone-pod/issues/164
Co-authored-by: Vikrant Gupta <vikrant@signoz.io>
#### Description
- The authz guide listed the `telemetryresource` and `metaresource`
types but never said when a route belongs to which, so new routes have
been landing on role gates or the wrong type.
- Adds a section contrasting the two: telemetry resources are the data,
read-only, with the selector derived from the query; metaresources are
objects about the data with CRUD verbs and ID or wildcard selectors. The
metrics explorer is the worked example, with `metrics:read` for stats
against `metrics-field:list` and `metrics-field:update` for the
catalogue and metadata write.
- Adds the rule of thumb to the summary list.
#### Additional Information
Contributes to: https://github.com/SigNoz/keystone-pod/issues/141
#### Description
Adds a skill for taking before/after screenshots with sbshot, and fixes
advice in the page-story skill that told people to write tests which
always pass.
- **New `sbshot-visual-diff` skill.** sbshot runs through `npx`, so
nothing it knows comes into this repo on its own and the steps were
being worked out again each time. The skill covers the parts that are
easy to get wrong: start a fresh Storybook for each branch, shoot both
themes, compare against the merge-base, measure the noise instead of
arguing about it, and export the result so a reviewer gets a link rather
than a localhost address.
- **It also says to add the stories first.** A screenshot diff can only
show what a story renders, so a new screen with no story shows up as
"nothing changed" rather than "nobody looked".
- **Fixed the page-story skill.** It told you to read `disabled` off a
button the permission turns off. Our components use `aria-disabled`,
which `toBeEnabled` and `toBeDisabled` ignore, so those tests pass on
buttons nobody can click. It now says which attribute to check, what to
do for controls that carry no attribute at all, and how to confirm a new
assertion can actually fail.
#### Additional Information
**Why a separate skill, when `references/verify.md` already mentions
sbshot.**
A rule only gets followed if it is where the work happens. `verify.md`
is about checking one story you have just written. Comparing two
branches is a different job, usually started by someone who is not
writing a story at all, and it brings its own questions: which baseline
to use, how to tell noise from a real change, how to hand a reviewer
something they can open. Someone doing that job has no reason to open a
file about verifying a single story, so a rule parked there does not
reach them, even when it applies to both jobs.
Skills load by matching what is being asked. Folded in as another
reference under `signoz-page-story`, this would only load while someone
was already writing stories, which is the wrong moment. So it is its own
skill, and `verify.md` now ends with a pointer to it, so each file has
one job and they do not drift apart.
Documentation only, no runtime code. Based on `main`.
#### Description
- Follow-up to #13203. `tests/e2e` has its own lockfile, which still
pulled `tinypool@2.1.0` through `oxfmt@0.41.0` (GHSA-5gmw-xhrv-c9v3,
GHSA-85c8-ppgw-ccpr).
- Pinned `oxfmt`, `oxlint` and `oxlint-tsgolint` to the frontend
versions. `tinypool` now resolves to 2.2.0.
- `pnpm fmt:check` and `pnpm lint` pass with no file changes.
#### Description
Pure deletion, stacked on #12975. Once the channel screens run on
`/api/v2/notification_channels`, the v1 layer is unreferenced; this
removes it.
- `api/channels/*` and `types/api/channels/*` — the hand-written v1
clients and their types, all already marked `@deprecated`, plus
`CreateAlertChannels/config.ts`, the hand-written channel interfaces
they were typed against.
- `container/AllAlertChannels/*` — the old list, which the redesigned
list replaced.
- The v1 channel MSW handlers and their fixture, now that nothing
renders against them.
Nothing here changes behaviour: everything deleted is dead once the base
PRs merge. Kept separate so those read as the actual change rather than
1,600 deleted lines.
#### Additional Information
The v1 REST API itself is untouched and still serves other clients; this
only removes the frontend's hand-written access layer.
#### Description
- On the exceptions page, Run Query cleared the filter pills from the
search bar. The list and the count then loaded unfiltered.
- The shared run handler empties `filters.items`. The exceptions filter
keeps its state only in `filters.items`. #8733 made this handler run for
every caller.
- Run Query on exceptions and Ctrl+Enter in the search bar now keep the
filter items. This PR does not change the shared run handler, so the
explorers work the same.
#### Issues closed by this PR
Closes https://github.com/SigNoz/events-pod/issues/186
#### Screen recording
https://github.com/user-attachments/assets/3fae4f8e-2916-42f5-b2cf-56e7e376a451https://github.com/user-attachments/assets/cc076823-7302-4eb4-99f7-9e4375a1a24f
#### Additional Information
The other pages with this search bar (funnels, pipelines) keep their
filters in their own state, so the new Ctrl+Enter changes nothing there.
#### Description
Puts the notification channel screens on fine-grained authz. Stacked on
#12976, which moves them onto the v2 API without touching authorization.
- `notification-channel` was already enforced on the v2 routes but never
reached the frontend: `cmd/authz.go` keeps an allowlist of the resources
exposed to the generated permission types, and channels were missing
from it. Adding it regenerates `permissions.type.ts`, and the panel
entry makes the resource show up when editing a custom role.
- Adds the permission builders (`list`/`create` at the collection,
`read`/`update`/`delete` per channel) and the two hooks that read them,
mirroring the dashboard helpers.
- Swaps the role checks for those permissions on the list, the create
button, the per-row actions, the form and the create/edit routes.
#### Issues closed by this PR
Closes https://github.com/SigNoz/pulse-pod/issues/290
#### Screenshots / Screen Recordings
[Before and after, every channel
screen](https://claude.ai/artifact/XGtzyX1B7ipNhdpMkJJEW4): swipe, fade
or side-by-side between #12976 and this branch, one entry per Storybook
story.
19 new permission states. The other 38 screens are pixel-identical, so
nothing changes for a user who holds the permissions. The single
exception is the list's loading state, where the skeleton is now inset
to line up with the header band above it.
#### Additional Information
- `/alerts/channels/new` and `/alerts/channels/edit/:id` were ADMIN-only
through the legacy role gate. They now run on authz, so a custom role
granting `notification-channel:create` or `update` can reach them;
`Private.test.tsx` is updated to match.
- The verbs match what the routes enforce and what the managed roles
already grant: admin gets create/read/update/delete/list, editor and
viewer get read/list. `test` is deliberately gated on `create`, since a
test send persists nothing and the channel need not exist.
- With only `read` and `list`, the edit screen opens read-only rather
than disappearing.
- Generated file: `permissions.type.ts` is produced by `go run
./cmd/enterprise generate authz` and should not be hand-edited.
#### Description
- Moves the notification channel screens onto
`/api/v2/notification_channels` (list, get, create, update, delete,
test) through the generated client. The per-kind create/edit/test flows
are replaced by one form driven by the generated spec types.
- Redesigns the channels list on the shared table the rest of the
product uses. Search, kind filter and page live in the URL, so a
filtered list survives a reload and can be shared.
- Surfaces the configuration v2 added: Slack `color`, `titleLink`,
`pretext`, `fallback`, `footer`, `fields[]` and `actions[]`; webhook
`bearerToken`, with basic auth now genuinely optional.
- Adds a read-only JSON view of a channel, with credential fields masked
behind a reveal toggle.
- Points the alert rule and routing policy channel pickers at the v2
list. It pages rather than truncating, so an org past the API's 200
limit no longer loses channels from the dropdown.
- Mounts the create and edit routes inside the alerts page, so opening a
channel is a normal client-side navigation instead of a full remount.
#### Issues closed by this PR
Closes https://github.com/SigNoz/pulse-pod/issues/415
#### Screenshots / Screen Recordings
[Before and after, every channel
screen](https://claude.ai/artifact/4bQPQRXmDxCUPVXEvajT2h): swipe, fade
or side-by-side between `main` and this branch, one entry per Storybook
story.
31 screens changed and 8 are new. The `Viewer` list state is gone:
read-only stopped being a role the list checks and became a permission,
so those states live on #12975.
#### Description
- A `description:"..."` tag on a struct field whose type is a named
schema (an enum or another struct) never reached `docs/api/openapi.yml`:
OpenAPI 3.0 allows no siblings next to `$ref`, so the reflector emitted
a bare reference. The existing tags on `thresholdBasic.kind`,
`evaluationRolling.kind`, the query envelopes and the authn domain
configs were all lost this way.
- Adds a `jsonschema.InterceptProp` hook that wraps such references in
`allOf: [{$ref}]` and keeps the description beside it, the same shape
openapi-go already emits for deprecated references. Fields without a
description keep the bare `$ref`.
- Regenerates the spec and the frontend API clients. Only descriptions
were added; discriminators and mappings are unchanged, and oapi-codegen,
orval and the MCP server's schema extraction all resolve a single-ref
`allOf` to the referenced type.
- Groundwork for adding field descriptions to the rule, query builder,
notification channel, saved view and dashboard payloads in follow-up
PRs, one per package. Tracked in SigNoz/nerve-pod#426.
#### Issues closed by this PR
Part of SigNoz/nerve-pod#426.
#### Additional Information
Verified with `go test ./pkg/signoz/`, `go run cmd/enterprise/*.go
generate openapi` and `pnpm generate:api`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
A tiny PR to address vanta reports, I tiny-pool was being used by
oxlint/oxfmt, so I upgraded both.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
Some files changed due to upgrade in the deps of oxfmt, and I also had
to disable react compiler since it's now supported by oxlint by default.
#### Description
The channel pickers on the alert rule form and the routing policies read
`/api/v2/notification_channels` instead of the hand-written v1 client.
- `useChannelOptions` pages the v2 list rather than truncating, so an
org past the API's 200 limit stops losing channels from the dropdown.
- It always returns an array, so the call sites drop their `|| []`
fallbacks.
- The story mocks for the pages that render a picker move to the v2
endpoint.
#### Description
The channels list, on `/api/v2/notification_channels` and the shared
table the rest of the product uses. Split out of the v2 form migration
so each can be read on its own; the form keeps running on v1 until that
lands.
- The list reads the v2 list endpoint: search, kind filter and page live
in the URL, so a filtered list survives a reload and can be shared. Row
actions open, duplicate-free delete, and a read-only JSON view of a
channel with credentials masked behind a reveal.
- Create and edit now mount inside the alerts page, so opening a channel
is a client-side navigation instead of a full remount that resets the
tab.
- The alert rule and routing policy pickers read the same v2 list. They
page rather than truncating, so an org past the API's 200 limit stops
losing channels from the dropdown.
#### Additional Information
The v1 and v2 APIs share the same row and id, so the list links straight
at the existing edit screen and it resolves the channel unchanged.
Nothing here deletes the old list; it stops being rendered and is
removed once the rest of the stack lands.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Adds Telegram as a custom notifier so a rule's `_title_template` /
`_body_template`
annotations override the channel's message, matching the other custom
channels.
- Telegram's HTML parse mode accepts a fixed tag list (tags like p , br,
div , span...etc not supported)and the Bot API can reject the entire
sendMessage on anything outside it — swapping in the generic HTML
renderer stops notifications arriving at all. Hence a dedicated renderer
that emits only supported tags, flattening headings, lists, tables and
images to text.
Sample payload — what the generic renderer puts on the wire
```
{
"chat_id": "8862729750",
"parse_mode": "HTML",
"disable_web_page_preview": "true",
"text": "<b><p>renderer test (critical)</p></b>\n\n<p><strong>firing</strong> on <code>used</code></p>\n<h2>Impact</h2>\n<ul>\n<li>memory at 0.39</li>\n</ul>"
}
```
Against the same rule, the Telegram renderer sends:
```
{
"chat_id": "8862729750",
"parse_mode": "HTML",
"disable_web_page_preview": "true",
"text": "<b>renderer test (critical)</b>\n\n<b>firing</b> on <code>used</code>\n\n<b>Impact</b>\n\n• memory at 0.39"
}
```
- Verified against a private chat (positive chatId), a group (negative
chatId), and a specific forum topic within that group via
messageThreadId.
- Fixes a ruler bug: the expander rewrote every `$`-ref into a label
lookup,
blanking private annotations before any notifier saw them. Per-rule
templates
never worked end to end for any channel until now.
Check the screenshot of how it looks without the fix and with the fix
for the same template
- Drops `parseMode` from the Telegram channel spec. HTML is the only
mode rendered
for, and the notifier and the channel read path both reject anything
else.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/pulse-pod/issues/509
#### Screenshots
<img width="250" height="550" alt="File"
src="https://github.com/user-attachments/assets/2d568a41-2d96-4fee-9575-a5867e34c804"
/>
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
- `parse_mode` still appears in `openapi.yml` under
`ConfigTelegramConfigDTO`.
That's upstream's `config.TelegramConfig`, a different schema from ours.
- `$alert.value`, `$rule.threshold.value`, `$rule.compare_op` and
`$rule.match_type` render empty because no rule type attaches those
annotations.
Attaching them adds rows to MS Teams cards and values to Opsgenie
descriptions,
so it's left as a follow-up.
---------
Co-authored-by: Naman Verma <naman.verma@signoz.io>
#### Description
- Adding any label to a PR left failed `e2e` checks next to the real
result. A `pull_request_target` run failed as unauthorized, and the
`labeled` run cancelled the in-flight e2e run, whose `e2e` job then
reported failure.
- e2eci now runs only on `pull_request` opened / synchronize / reopened,
so each commit gets its `e2e` check from a single run.
- Labels are read live in the `changes` job. The new `e2elabelci`
workflow re-runs the commit's e2eci run when `safe-to-test` or
`safe-to-e2e` is added, so the labels still start e2e right away without
adding a second `e2e` check. It never checks out PR code.
- Fork and dependabot PRs still need `safe-to-test`, and run only on a
re-run, because `postci` strips the label on push and a first attempt
could read it before that lands.
- Fork e2e now runs the PR's code under `pull_request` with no secrets.
Under `pull_request_target`, checkout defaulted to the base branch, so
fork runs tested `main` instead of the PR.
---------
Co-authored-by: Aswin <aswin.km@signoz.io>
Co-authored-by: Aswin K.M. <astrobot7@gmail.com>
#### Description
- This PR turns on saved views and the bottom strip for all users. The
`SAVED_VIEW_ENABLED` flag now always reads as on.
- The flag code stays in place. The cleanup in
https://github.com/SigNoz/events-pod/issues/77 removes it.
- The old saved views URLs now redirect to their explorer through the
existing old-routes redirects:
- `/logs/saved-views` to `/logs/logs-explorer`
- `/traces/saved-views` to `/traces-explorer`
- `/metrics-explorer/views` to `/metrics-explorer/explorer`
- `/meter/explorer/views` to `/meter/explorer`
#### Issues closed by this PR
Part of https://github.com/SigNoz/events-pod/issues/57
#### Additional Information
- Merge this PR after #13022, #13028 and #13027. Without them, the
explorers show a placeholder views panel next to the old bottom bar.
- The flag also hides the Pylon chat bubble and the chat support
gateway, because Support moves into the bottom strip.
#### Description
- The explorer order-by sanitizer sent a Sentry warning each time it
dropped an order-by column. Each new order made a new Sentry issue, and
each new issue paged.
- Dropping a stale order is expected. Since #13085, it happens when a
user switches from List to Time Series or Table.
- The sanitizer no longer reports to Sentry. The filtering is unchanged.
#### Issues closed by this PR
Closes https://github.com/SigNoz/events-pod/issues/180
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Redesigned span tooltip with AI usage breakdown; tooltip rows/styles
shared under `TraceTooltip`.
- AI badge and icons on gen-ai spans in the waterfall.
- Header shows trace-level AI tokens (with breakdown tooltip) and cost
from the summary's `ai` field.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Close -
https://github.com/orgs/SigNoz/projects/59/views/18?pane=issue&itemId=263424271&issue=SigNoz%7Cnerve-pod%7C397
<!--If applicable, include screenshots or screen recordings that clearly
show the behavior before the change and the result after the change. -->
#### Screenshots / Screen Recordings
https://github.com/user-attachments/assets/b22bcbfb-8f74-40ac-a263-d5ac2a1f23b0
TDD-
https://app.notion.com/p/signoz/Trace-Details-Changes-for-AI-o11y-3ebfcc6bcd1980b185b4c17cd1810075?source=copy_link
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
figma -
https://www.figma.com/design/UPcVP7G1Scd5PLOQzvI9Q1/Trace-Explorer?node-id=4874-3499&t=5QH0Uv1oiS7v1Rfe-0
- We changed tooltip designed a little bit, we added same font of
subheading ( usage breakdown ) as of heading (span) , min and max
heights also cost icon could be better .
- We have introduced a new logic to calculate total
```
if input < cache_read + cache_write:
total_input = input + cache_read + cache_write
else
total_input = input
```
- Also now if backend sends any of ai related field we will display all
field with value set as zero .
- We have updated events tooltip as well (styles ).
- have added storybook as well . pages-traces-trace-details--ai-trace
- Span detail changes will be done in last pr :)
Stack 2/4, based on #13065.
<!--Please delete paragraphs that you did not use before submitting.-->
---------
Co-authored-by: Gaurav Tewari <tewarig@users.noreply.github.com>
#### Description
- The saved views stories now have an `Authz` folder, with one story per
missing permission. The stories follow the dashboard and billing authz
stories.
- `NoList`, `NoCreate`, `NoRead`, `NoUpdate` and `NoDelete` each deny
one permission.
- `NoCreateSaveMenu`, `NoUpdateSaveMenu` and `NoReadOpenView` show the
same denials in the `✓` menu and on an open view.
- `ReadOnly` denies create, update and delete together.
- `CheckLoading` and `CheckFailed` cover a pending check and a failed
check.
- Each story checks what is disabled and what still works.
- The main stories move to `Components/Saved Views/Overview`, and
`NoAccess` is now `NoList`.
- The header `✓` and `✕` buttons get a gap again. After the ui upgrade
they are link buttons without padding, so they touched.
#### Issues closed by this PR
#### Screenshot
Before
<img width="608" height="120" alt="image"
src="https://github.com/user-attachments/assets/e9fcf890-3355-4cd5-82e4-a4e0221aaacd"
/>
After
<img width="734" height="212" alt="image"
src="https://github.com/user-attachments/assets/7ce0d2d3-7155-4365-bbab-aad0fef6fc29"
/>
Part of https://github.com/SigNoz/events-pod/issues/71
#### Description
- The "Add to query" chip on a logs list row no longer fetches v3
`attribute_keys` before it adds the filter. The hook builds the filter
item with the same util the log details drawer uses, then redirects. The
stored key has an empty data type and context. The filter expression is
built from key and value, so the request is unchanged.
- `LogDetail` dropped two props it never read, `onAddToQuery` and
`onClickActionItem`, from its type and from six call sites.
- Removed the code that only existed for those props: the `EntityLogs`
callback, `generateFilterQuery`, `getOldLogsOperatorFromNew` and
`ActionItemProps`. Removed `onGroupByAttribute` from `useActiveLog`,
which nothing called.
#### Issues closed by this PR
Closes https://github.com/SigNoz/events-pod/issues/160
#### Screenshot
https://github.com/user-attachments/assets/7cce500a-6dbf-45cb-937f-7366d515b0b9https://github.com/user-attachments/assets/f5cbd1bd-0863-4633-ad6e-2fd15f7ae7c5https://github.com/user-attachments/assets/2fb7dbeb-c474-4730-9a9d-363257a7fff7
#### Additional Information
- Only one user path runs the changed hook: the field chips on a log row
in the logs explorer list and in live logs.
- The merged where clause shows adjacent clauses without `AND`. The
grammar allows an implicit AND and the query runs. This is pre-existing
in `convertFiltersToExpressionWithExistingQuery` and is not changed
here.
- Part of https://github.com/SigNoz/events-pod/issues/156.
#### Description
- Saved views now follow the `saved-view` permissions:
- `list` gates the views panel.
- `create` gates `+`, "Save as new view" and "Create view".
- `read` gates opening a view. List rows for views the user cannot read
are disabled, with the reason on hover.
- `update` and `delete` gate the row menu and the `✓` menu, per view.
- Opening a view checks `read` first. Without it, the view is not
fetched and the header shows "No view access".
- Denied buttons and menu items stay visible. They are disabled and show
the reason on hover. They use `AuthZButton` and `AuthZDropdown`.
- The row menu has "Copy ID", so a user can copy a view's id to use in a
role.
- The authz generator now includes `saved-view`, and roles settings gets
a Saved Views panel.
- Stories for the header and the views panel are under `Components/Saved
Views`.
#### Issues closed by this PR
Closes https://github.com/SigNoz/events-pod/issues/76
#### Screenshot / Screenrecording
https://github.com/user-attachments/assets/c6505fb1-5a57-4c61-ad7e-09531d500002
<img width="490" height="982" alt="Screenshot 2026-10-15 at 12 13 00 PM"
src="https://github.com/user-attachments/assets/b8ab7760-c0c9-4ee7-8201-c8dae8cdfd57"
/>
<img width="349" height="567" alt="Screenshot 2026-10-15 at 12 13 32 PM"
src="https://github.com/user-attachments/assets/ee7e0ebc-e929-4ff1-a624-e605fe09cb95"
/>
<img width="693" height="955" alt="Screenshot 2026-10-15 at 12 14 10 PM"
src="https://github.com/user-attachments/assets/023c022a-5105-471a-acce-835251f9ea3f"
/>
<img width="1458" height="2016" alt="image"
src="https://github.com/user-attachments/assets/c33d5e65-dae7-454e-a5e0-2b7796e204cc"
/>
#### Additional Information
- The change is behind `SAVED_VIEW_ENABLED`.
- On staging, the per view update and delete checks do not show in the
AuthZ DevTools. List and create work. The backend team must check this
before the PR moves out of draft.
- The save as new prompt and the unsaved changes nudge are not in this
PR.
#### Description
- Adds `POST /api/v2/rules/{id}/clone`, a server-side clone for alert
rules. The caller passes only the source rule's id and gets back the
newly created rule.
- Until now, cloning was done entirely by the frontend, which re-posted
the whole rule it had in memory to the create endpoint. The new endpoint
copies the rule from what is actually persisted, so clones are
consistent regardless of the client.
- The clone keeps every modeled field of the source, including its
enabled or disabled state, and is owned by the user who cloned it.
Cloning fails with a 400 that names the source rule when it no longer
passes create validation, for example when its channel has been deleted.
- The name follows the convention introduced by the dashboard clone API:
`My Alert - Copy`, then `My Alert - Copy (2)`, `My Alert - Copy (3)`
when a copy is cloned again. The same suffix logic was adopted, minus
the length cap, since alert names have no limit today.
- The endpoint reuses the existing create path, so validation,
notification routing and evaluator start-up behave exactly as a manual
create.
- Includes unit tests for the naming and copy logic and an integration
test covering clone, clone of a clone, unknown id and malformed id.
#### Issues closed by this PR
ClosesSigNoz/pulse-pod#228
#### Additional Information
- Backend only. The frontend still uses the client-side approach and can
switch to this endpoint in a follow-up.
- Names are not de-duplicated against existing rules, matching the
dashboard clone behaviour. Rule names are not unique today, so a
collision is harmless.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- AI SDK: a JSON answer such as `{"answer": 42}` was dropped, and a JSON
list was read as nameless tool calls. The output is now tool calls only
when every item has `toolName`;
anything else is kept as text.
- litellm: parallel calls (`gen_ai.completion.N` numbers tool calls, not
choices), a call next to text, and the history's `tool_calls` /
`tool_call_id` kept beside `parts` now become tool call and tool
response parts.
- Redaction placeholders (OpenInference's `__REDACTED__`, OpenRouter's
`[OR_REDACTED]`) no longer become `uri` parts: media without a URL
scheme is a generic part, with a warning.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of
https://github.com/SigNoz/nerve-pod/issues/266#issuecomment-6198620761
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
- Checked against real spans from litellm 1.105.1, OpenInference 0.1.49
and AI SDK 5.0.277 run against a local stub server. Replaying the
static-telemetry-generator captures changes only the four affected
spans.
- OpenInference redacts `input.value` too, so a redacted image cannot be
recovered from the raw request.
#### Description
- The querier reads a traces JSON number as
`toFloat64OrNull(p::String)`: every numeric type and a numeric string
read as Float64. Replaces the `dynamicType` gate around
`accurateCastOrNull`.
- The `toFloat64` collision cast leaves a read already starting
`toFloat64OrNull(` bare.
Why avoiding the `toFloat64` wrapper on json number queries?
The wrapper exists for the map (`Bad get: has UInt64, requested
Float64`) and hid the read from its skip index.
#### Additional Information
- A number-typed key now matches a value stored as a numeric string
(`"404"`), and an integer above 2^53 reads rounded instead of NULL.
#### Performance Impact
Almost none
```
case: num = all values already numbers
case: mixed = values are numbers and stringified mixed
rows: 20M
┌──────────────────────────────────────────────────────┬───────┬─────────────┬─────────┐
│ Read │ num │ mixed │ ≈ │
│ │ │ │ ns/row │
├──────────────────────────────────────────────────────┼───────┼─────────────┼─────────┤
│ new toFloat64OrNull(p::String) │ 0.56s │ 0.56s │ 28 │
├──────────────────────────────────────────────────────┼───────┼─────────────┼─────────┤
│ old dynamicType gate (the QB wrapped it in │ 0.57s │ 0.77s │ 29 / 38 │
│ toFloat64) │ │ │ │
└──────────────────────────────────────────────────────┴───────┴─────────────┴─────────┘
```
## Description
- Adds `POST /api/v1/promoted_paths/materialized`: indexes the JSON
sub-columns of the signal's materialized attributes whose materialized
column has a skip index, and returns the indexed paths and the skipped
ones (already indexed).
- Each JSON index mirrors the type and granularity of the materialized
column's index, typed by the column (`String` or `Float64`), and is
built on new parts only. Reruns are no-ops.
- Only signals with a JSON attribute target are accepted (traces today),
so `logs` works once its attributes get a JSON target. Authz checks the
update scope of that signal.
## Additional Information
- The traces querier reads numbers through a `dynamicType`-gated cast,
so `Float64` sub-column indexes are not used until the querier supports
them.
- A materialized key that can't be indexed (unsupported index type,
bool, cardinal path) is logged and left out.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
#### Description
- The last (and first) bucket of a time series is often still filling.
The API already flags these with `partial: true`, but charts drew them
as normal points, so panels showed a fake drop at the right edge
(customer report: 1,575 → 281).
- Time series and Area panels (V1 and V2 dashboards) now draw a dot with
a dotted ring on partial points; Bar panels get a dotted outline around
the partial bar. Lines and bars are otherwise unchanged.
- The tooltip header shows "(partial)" when hovering a partial bucket.
- The flag is carried through the existing data paths
(`flattenTimeSeries` for V2; converter → `convertNewDataToOld` →
`QueryData.partialTimestamps` for V1) into the shared uPlotV2 series
config, where a draw hook renders the markers. Charts that don't pass
partial timestamps are unchanged.
#### Screenshots
<img width="790" height="502" alt="image"
src="https://github.com/user-attachments/assets/15779208-2143-44c4-993e-49d4cd5a3a79"
/>
<img width="1034" height="734" alt="image"
src="https://github.com/user-attachments/assets/9e968a4b-b554-4fac-a57f-46afa94f7e4f"
/>
#### Additional Information
- Metrics queries round the end time down to the minute, so their last
bucket is rarely partial. Traces/logs panels show the marker most
readily.
- The bar outline re-runs that series' bar path builder for the one
partial bar to get its rect (the width calc scans the series once per
partial bar per redraw).
Closes https://github.com/SigNoz/pulse-pod/issues/592
#### Description
- Point 22 onboarding doc links to their final URLs instead of paths
that only resolve through signoz.io redirects.
- Rename the iOS Swift card's `dataSource` to `ios-swift`; it shared
`swift` with the Swift APM card, so `?getStartedSource=swift` and card
selection could not tell them apart.
- Recolor or trim 13 logos that were invisible or unreadable on the dark
or light card (Render, CloudNativePG, LiveKit, Apache Druid, HCP Vault,
Heroku, Podman, GitHub, Celery, OpenCode, Vector, Baseten, Honeycomb).
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/echo-pod/issues/796
<!--If applicable, include screenshots or screen recordings that clearly
show the behavior before the change and the result after the change. -->
#### Screenshots / Screen Recordings
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
<!--Please delete paragraphs that you did not use before submitting.-->
---------
Co-authored-by: Manika Malhotra <manika@signoz.io>
#### Description
- Infra monitoring routes were still on the coarse `ViewAccess` gate, so
a custom role scoped to a workspace key on metrics could read every
host, pod and workload through them while being denied on `query_range`.
- All 12 routes now declare a telemetry resource def: lists derive the
resource from the caller's `filter.expression` exactly as `query_range`
does, checks resolves to the metrics wildcard. Managed roles are
unaffected; key-scoped custom roles get 403 unless the filter pins a
granted key.
- Adds four generic extractors in `querybuilder` (filter-expression
body, wildcard, raw stream, builder query) that the other telemetry
surfaces will reuse in follow-up PRs.
#### Issues closed by this PR
Part of SigNoz/keystone-pod#141
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Span details (pretty and JSON views) now shows an allow list of
queryable span fields instead of hiding a deny list.
- Hides rendering-only keys: `time_unix`, `level`, `has_children`,
`sub_tree_node_count`, `service.name`, and the
`formattedInput`/`formattedOutput`/`formatter`/`formatterWarnings`
fields from #13121.
- `attributes` and `resource` are shown in full.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
https://github.com/SigNoz/nerve-pod/issues/432
<!--If applicable, include screenshots or screen recordings that clearly
show the behavior before the change and the result after the change. -->
#### Screenshots / Screen Recordings
before -
<img width="1637" height="1092" alt="image"
src="https://github.com/user-attachments/assets/fd7a3af8-c558-49d2-b120-ffbddf24924a"
/>
now -
<img width="1683" height="1094" alt="image"
src="https://github.com/user-attachments/assets/01d18ac6-4b75-4d42-9c16-60d6f1911723"
/>
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
<!--Please delete paragraphs that you did not use before submitting.-->
https://github.com/SigNoz/nerve-pod/issues/432#issuecomment-6164009733
---------
Co-authored-by: Gaurav Tewari <tewarig@users.noreply.github.com>
#### Description
- Remove `POST
/api/v1/rules/{id}/history/{stats,timeline,top_contributors,overall_status}`.
They built ClickHouse queries from the path `{id}` and body fields via
`fmt.Sprintf`, allowing SQL injection by any authenticated user.
- Superseded by the parameterized `/api/v2/rules/{id}/history/*`
handlers; the frontend already moved to v2 in #12132.
- Drop the now-unused v1 rule state history reader methods and model
types, including `GetLastSavedRuleStateHistory`, another injection sink.
#### Issues closed by this PR
Closes#11747
#### Additional Information
Breaking: v1 rule history endpoints are gone. Frontend builds predating
#12132 still call them, so the alert history page breaks until they are
upgraded.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Anthropic Messages: formats a request `{system, messages}` or a
response `{content, stop_reason}`, with every image and document source
type, `tool_use`, `tool_result`, thinking and the server tool blocks.
- Gemini generateContent: formats a request `{contents,
systemInstruction}` or a response `{candidates}`, in REST camelCase or
SDK snake_case, with inline and file data, thought parts, `functionCall`
and `functionResponse`.
- Tool results that both APIs carry inside the next user turn become a
tool message before it. The Anthropic stop reasons and Gemini finish
reasons map onto the schema's enum.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of https://github.com/SigNoz/nerve-pod/issues/266
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
Eighth and last of the stack, on top of #13115. No capture records
either body, OpenInference's flattened messages cover its users; every
case cites the SDK type or API doc behind it. These serve gateways
recording raw provider bodies and the fallback path.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- OpenRouter: formats the `{completion, reasoning, tools, rawRequest}`
answer object its broadcast writes, the completion as a tool call when
it is a tool name from `tools`
followed by JSON arguments, else as text; beside the OpenAI chat request
it answers this counts as one format.
- Vercel AI SDK and Mastra: formats the legacy `ai.*` telemetry, the
provider prompt in its v1 and v2 part spellings, the parent span's
`ai.prompt`, and the answer split across
`ai.response.text` and `ai.response.toolCalls`, with images given as a
URL, base64 or a serialised Buffer.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of https://github.com/SigNoz/nerve-pod/issues/266
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
Seventh of the stack, on top of #13115.
<!--Please delete paragraphs that you did not use before submitting.-->
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Formats the LangSmith OTel exporter's serialised run inputs and
outputs, `{messages: [[…]]}` and `{generations: [[…]]}` of
langchain_core `{lc, type, id, kwargs}` messages: roles from the message
class, string content and langchain_core's standard content blocks, tool
calls and tool messages,
and `error` for a failed call whose body sits in `response_metadata`.
- The finish reason is read under the key each partner writes:
`finish_reason` for most, `stop_reason` for anthropic, `stopReason` for
bedrock, `done_reason` for ollama. Provider-native thinking blocks are
kept as sent for now.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of https://github.com/SigNoz/nerve-pod/issues/266
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
Sixth of the stack, on top of #13115.
#### Description
- `GET /api/v1/stats` drops the viewer role gate and moves to open
access. Authentication still applies; the handler reads the organization
from the caller's claims, so the response stays scoped to their org.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Formats raw OpenAI Responses bodies, a request `{input, instructions}`
or a response `{output, status}` of items: messages, function and custom
tool calls with their outputs, reasoning summaries, compaction, and
every built-in tool item as a server tool call or its response.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of https://github.com/SigNoz/nerve-pod/issues/266
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
Fifth of the stack, on top of #13115. No capture reaches this converter
directly, OpenInference's flattened messages cover the Agents SDK; it
serves gateways recording Responses bodies and the fallback path.
<!--Please delete paragraphs that you did not use before submitting.-->
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Formats the flattened `gen_ai.prompt.N.*` and `gen_ai.completion.N.*`
keys openllmetry's instrumentations wrote before their semconv rewrite,
still written by mistralai and by crewai through the openai
instrumentation 0.45.6.
- A semconv output message with no parts takes its tool call from the
`gen_ai.completion.N` keys beside it, which litellm writes while its
semconv message never carries the call.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of https://github.com/SigNoz/nerve-pod/issues/266
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
Fourth of the stack, on top of #13115.
<!--Please delete paragraphs that you did not use before submitting.-->
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Formats the flattened `llm.input_messages.N.*` and
`llm.output_messages.N.*` keys OpenInference writes on LLM spans. They
take precedence over the raw provider request the mapper copies, since
they have one shape across providers; a side without them falls back to
the raw copy.
- Handles text, media and reasoning items, tool calls and results, the
legacy `function_call` keys and `llm.finish_reason`; runs of assistant
messages fold into one.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of https://github.com/SigNoz/nerve-pod/issues/266
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
Third of the stack, on top of #13115. Thread integration suite passes
end to end for all three.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- `gen_ai.system_instructions` leads the formatted input as a system
message; `gen_ai.response.finish_reasons` sets the finish reason of each
output message over whatever the payload carried, whichever converter
ran.
- Semconv repairs for pydantic-ai: tool call arguments given as a JSON
string are decoded, `result` on a tool call response becomes `response`.
Finish reasons inside semconv messages go through the alias table,
litellm writes `tool_calls`.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of https://github.com/SigNoz/nerve-pod/issues/266
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
Second of the stack, on top of #13115.
<!--Please delete paragraphs that you did not use before submitting.-->
#### Description
- e2e now runs on every PR that changes `frontend/` or `tests/e2e/`. The
`safe-to-e2e` label still opts in any other PR.
- A new `changes` job reads the PR's file list and gates the `fmtlint`
and `test` jobs on it.
- A new `e2e` job is the single check to mark as required. It fails when
e2e was needed but did not pass, including fork and dependabot PRs still
waiting on `safe-to-test`.
- In the merge queue, `e2e` passes without running the suite, so the
queue is not blocked.
- New pushes cancel the PR's in-flight run.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
This is a PR to add basic testing for our routing, specific parts of the
app that goes from one page to another.
This will act as a base test layer for upcoming react-router upgrade,
this PR also follows the new approach of drivers instead of random
getByTestId in the spec layer.
I also took the opportunity to add support to run the E2E with the base
path feature (eg: /signoz/).
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/uforge-pod/issues/6190
#### Description
AI query do not support creating alert for now. so we should remove
create alert action as well for ai query.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
https://github.com/SigNoz/nerve-pod/issues/460
#### Screenshots / Screen Recordings
https://github.com/user-attachments/assets/d2634f0e-1334-47b3-9ad0-1cb3a226d81b
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
<!--Please delete paragraphs that you did not use before submitting.-->
---------
Co-authored-by: Gaurav Tewari <tewarig@users.noreply.github.com>
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
Bumps @signozhq/ui 0.1.0 to 0.2.0 and @signozhq/design-tokens 2.1.6 to
2.2.1.
Reworked components (breaking):
- Button: `variant` and `color` are a required pair; `outlined`, `ghost`
and `dashed` only take `secondary`. `destructive` is now `danger`;
`none`, the `action` variant, the `icon` size and `background` are gone.
Icon-only buttons use `icon` plus `aria-label`. `className` and `style`
are no longer accepted, so the local overrides went with them. Adds
`width`, `maxWidth`, `textOverflow` and `loadingTooltip`.
- ButtonGroup: moved to `@signozhq/ui/button-group`, driven by `items`.
- Badge: `solid`/`outlined` variants and a semantic palette (`primary`,
`secondary`, `danger`, `warning`, `success`, `info`, `archive`,
`highlight-danger`) replace the hue names (`robin`, `cherry`,
`vanilla`...). `capitalize` and `textEllipsis` became `textTransform`
and `textOverflow`. `closable` is gone; removable chips use the new
`Pill.Closeable`.
- Tooltip: Radix to Base UI. `TooltipSimple`, `TooltipRoot`,
`TooltipTrigger` and `TooltipContent` collapse into one `Tooltip` with
`title`. Per-tree `TooltipProvider` wrappers are no longer needed (44 to
1).
- DropdownMenu: replaced by `Dropdown` (Base UI Menu), built from typed
`items` (action, link, checkbox, radio group, submenu, group) instead of
composed `DropdownMenu*` parts and `MenuItem`.
- ToggleGroup, RadioGroup, Tabs: Radix to Base UI, each driven by an
`items` prop instead of `*Item`/`*Trigger` children. `TabItemProps` is
now `TabsItemProps`.
- Checkbox, Switch: Radix to Base UI, semantic `color` required. Switch
requires `textPlacement`.
Contracts shared by the reworked components, enforced by their types:
- `disabled` needs a `disabledTooltip` (and `readOnly` a
`readOnlyTooltip`), so every disabled control now says why (about 140
reasons added).
- `data-testid` is written as `testId`.
App side:
- About 3,300 lines of SCSS overrides removed, since the components no
longer take `className` and their defaults now match the designs.
- AuthZButton builds on Button's `disabledTooltip`/`loadingTooltip`
instead of wrapping it in AuthZTooltip; new AuthZDropdown gates Dropdown
items the same way.
- Jest gets a `PointerEvent` polyfill for Base UI; `styles.scss` sets
compatibility variables for badge width, dropdown height, toggle-group
label width and dropdown z-index.
#### How to review the code
This PR got a lot larger than I wanted so I tried few ways to help you
review/read all these changes.
First, pick the commits that belongs to your pod/area first.
For pulse-pod:
-
da5cacec54
-
dc85d92b3c
-
9e5eae6169
-
6c8b1d5282
For events pod:
-
92c74f6067
-
74894b372a
-
45d1646abf
And the rest of the commits, well, I will appreciate if you spent some
time looking at them since they don't have specific owner for now (by
CODEOWNERS), and few of them I maintain (Settings/AuthZ for eg).
#### How to review visually
To be able to review the changes visually, I build a tool called
[sbshot](https://github.com/SigNoz/sbshot/) that help us capture the
stories before/after and then generate a website to let you visualize
the diff and know by % how much each page changed in pixels.
You can take a look at this tool here:
https://pr-docs.viniciusl.com.br/signoz-v3-update-components-1012
I tried to add as many tags as possible to let you filter, so my
suggestion for you is:
- take a look first at the stories that matter for you
- then read the code of the changes, to ensure everything was covered
- and finally, after you think it's good enough, run the app
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/engineering-pod/issues/6157
---------
Co-authored-by: Vinícius Lourenço <vinicius@signoz.io>
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Waterfall spans carry `formattedInput`, `formattedOutput`, `formatter`
and `formatterWarnings`, same as thread spans, so span details needs no
separate API. Set only for spans with gen_ai messages, omitted
otherwise.
- Waterfall queries read the JSON attributes column when
`use_trace_attributes_json` is on; org id threaded through for the flag.
- Thread endpoint: the same four keys renamed from snake_case to
camelCase, in line with the rest of the API.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes SigNoz/nerve-pod#268
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
- Breaking for the thread API on `main`: `formatted_input`,
`formatted_output`, `formatter_warnings` are now `formattedInput`,
`formattedOutput`, `formatterWarnings`.
- Formatted fields come from the JSON column only; the waterfall
`attributes` map still reads the legacy maps (#12798).
#### Description
- Query builder field rules gain a `default` state whose placeholder
names the value an empty field falls back to. Every field input reads it
(group by, having, order by, limit, legend format, step interval);
built-in placeholders now live on the `ADD_ONS` entries.
- Panel kinds can declare `defaultRowLimit`: sent as `limit` only for a
single builder query that sets none, since per-query limits across
several queries can keep different groups and break their join.
- Panel kinds can declare `syncedQueryBuilderFields`: an edit to one
query copies to the rest, and a newly added query takes the existing
value. Values that already differ are left alone until edited.
- Add-on rows share one height, label width, bordered collapse button
and placeholder colour; the query pane keeps a stable scrollbar gutter.
#### Additional Information
- No panel kind uses `defaultRowLimit` or `syncedQueryBuilderFields`
yet; the Scatter Plot panel (#13051) is the first.
- Order By gains a placeholder ("Select fields to order by");
`GroupByFilter`, `OrderByFilter` and `HavingFilter` take an optional
`placeholder`, and other callers keep their current text.
Closes https://github.com/SigNoz/pulse-pod/issues/578
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Claude Code cache tokens never reached pricing: its bare keys
(`input_tokens`, `cache_read_tokens`, `cache_creation_tokens`,
`tool_name`) are now sources.
- Also mapped: Cursor hooks keys, vLLM's response-only model, gateway
cache and reasoning token spellings, old OpenLLMetry finish reasons,
CrewAI agent name and id.
- `gen_ai.operation.name` mapped again from span kind keys; safe since
the collector no longer overwrites native values.
- llm condition gains `llm.input_messages` so failed OpenInference
calls, which carry no model key, still map.
- README next to the definitions records source provenance and what is
left unmapped.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/nerve-pod/issues/408
---------
Co-authored-by: Srikanth Chekuri <srikanth.chekuri92@gmail.com>
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Thread rows are the explorer gate: spans with a model, tool or agent
name. Agent spans come back with empty formatted lists; Basically
matching the filter to be same as in other places.
- `FormatMessages` takes the span's JSON attribute document instead of
the two message values, so a converter can read any attribute and object
values arrive whole. The key walk moves out of spantypes.
- Tool spans are formatted: `gen_ai.tool.call.arguments` as an assistant
`tool_call`, `gen_ai.tool.call.result` as a tool `tool_call_response`,
with the LangChain callback and traceloop decorator envelopes unwrapped.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of https://github.com/SigNoz/nerve-pod/issues/266
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
First of a stack. Each following PR adds one message converter and only
the shared code it needs.
## Description
- Adds core rule 8 to `frontend/docs/authz-guide.md`: every resource a
role can be scoped to must show its selector with a copy control, so
admins can paste it into the role editor instead of digging IDs out of
URLs or API responses.
- Adds the matching item to the migration checklist and points at
`permissions.config.ts` for the per-resource selector format.
#### Description
- The trace details waterfall filter now runs on `query_range` v5. The
typed expression goes to the backend as `filter.expression`, scoped to
the trace id. Before, the expression was converted to filter items and
v5 converted them back, so an OR or a function produced no request.
Those expressions now run.
- The Highlight errors switch and the category buttons read their state
from the committed expression.
- The span details actions (Filter for, Filter out, Group by) build the
filter key locally instead of fetching v3 `attribute_keys`. The stored
key has an empty data type and context, the same as a key typed into the
query builder. The explorer request is unchanged.
- Removed the unused `useTraceActions` hook.
#### Issues closed by this PR
Closes https://github.com/SigNoz/events-pod/issues/159
#### Additional Information
- Group-by from the span panel now sends an empty `fieldDataType`
instead of `string`. The backend resolves the key by name.
- The waterfall and flamegraph fetches (`/api/v4/traces/{id}/waterfall`,
`/api/v3/traces/{id}/flamegraph`) are feature routes and are not part of
this change.
- The filter row commits only expressions that parse. The Highlight
errors switch now reads quoted or uppercase `true` as on and `!=` as
off, which main got wrong.
- Part of https://github.com/SigNoz/events-pod/issues/156.
#### Description
- with the saved views flag on, the old views ui is hidden.. bottom
explorer bar on logs / traces / metrics / meter, the Views tabs on those
pages and the All Views link on the home widget. views are in the
explorer header and panel now.
- views shortcuts and the go to views palette entries removed, not
behind the flag since the flag turns on next.
#### Issues closed by this PR
Part of https://github.com/SigNoz/events-pod/issues/71
#### Additional Information
- meter never had create alert / add to dashboard in its bar (hidden for
meter), so hiding it there loses nothing.. the bottom bar commit note
saying otherwise is wrong.
- old views urls still open the page with an empty pane when the flag is
on.. routes go away in the cleanup PR.
- flag off is same as main apart from the shortcuts.
#### Description
- real all views panel in the sidebar.. views split into created by me /
created by others, search by name, `↺` on the open view to clear it.
empty state has a create view button, same modal as the header.
- row `...` menu with copy link, edit view details and delete. copy link
copies the whole explorer link, a link with only the viewKey does not
open the view (same in the v1 bar).
- hover card on a view like the trace waterfall one.. filter per query
with items and expression combined, coloured with the query search
theme, metric line for metrics and meter, last updated.
`@lezer/highlight` added for the colouring, same version already in the
tree.
- explorer columns for a view now come from the view itself, not the
views list.. if the list call failed the explorer fell back to default
columns and the header went amber with no way to discard. header shows a
red failed to load state when the view itself does not load.
- unsaved changes check maps the stored view through the same mapper as
the page.. older views kept fields we never write (`reduceTo` on a
graph) and were always amber.
- qf settings drawer matched to the panel, sidebar tooltips wait 500ms,
meter explorer gets saved views, metrics explorer tab loses the extra
padding around the sidebar.
#### Issues closed by this PR
Part of https://github.com/SigNoz/events-pod/issues/71
#### Screen recording
https://github.com/user-attachments/assets/f882b5b7-c108-49f3-b62e-132b0db3a60f
#### Additional Information
- behind `SAVED_VIEW_ENABLED`, flag off is today's ui.
- make default, duplicate and add to shortcuts not in this PR.. default
needs a backend api.
- qf settings drawer is a shared component, every qf page gets the new
header and search.
- browser pass on logs / traces / metrics / meter in progress.
#### Description
- Opamp places user log pipelines around the first
`signozlogsnormalizer` in the logs pipeline, per its `opamp.position`:
the normalizer runs after them by default (`after`), before them with
`before`. Other processors keep their places.
- Without the normalizer, processor ordering is unchanged.
- The `use_json_body`-prepended normalize operator is dropped when the
normalizer already runs ahead of user pipelines (`before`); otherwise
both are kept.
- Removes the `json_body_dual_ingestion` flag: the normalize operator no
longer stashes the original body, and isn't appended after user
pipelines when only that flag is on.
| `use_json_body` | `opamp.position` | Logs pipeline | Normalize
operator |
|---|---|---|---|
| off | no normalizer | memory_limiter → user → custom → batch
(unchanged) | — |
| off | `after` (default) | … → user → normalizer → … | — |
| off | `before` | … → normalizer → user → … | — |
| on | no normalizer | memory_limiter → normalize op → user → custom →
batch | prepended |
| on | `after` (default) | … → normalize op → user → normalizer → … |
prepended (both normalize) |
| on | `before` | … → normalizer → user → … | dropped |
#### Additional Information
- Depends on SigNoz/signoz-otel-collector#953 for the `opamp.position`
config.
- The pipelines preview still prepends the operator under
`use_json_body`, since it can't see per-collector `opamp.position`.
- Configs still setting `json_body_dual_ingestion` keep working; the
unknown flag is skipped with a warning.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
#### Description
- Adds a `pytest.md` rule: run `make py-fmt` and `make py-lint` after
changing `.py` files, matching what integration CI enforces.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
Cleaning out models which are now not synced by zeus.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/nerve-pod/issues/402
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
Please check issue for more details
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
#### Description
- Thread spans now carry `formatted_input`, `formatted_output`,
`formatter` and `formatter_warnings`, with the messages in the OTel
GenAI shape; the `genai` types mirror the semconv schema.
- Tool spans are thread rows too, gated on `gen_ai.tool.name`, since
they carry no input or output messages.
- One normalizer added: the semconv passthrough plus the OpenAI chat
format; a bare string becomes `text`, anything else `generic`, both with
a warning. Other formats follow in separate PRs.
- Unknown keys are dropped from the formatted view, the raw attribute on
the span keeps them; object attributes are read from the JSON column
only.
- Formatter tests use the message attributes as the collector stored
them for the SigNoz/scripts captures (litellm, langchain, OpenInference,
bifrost), not hand-written samples.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of https://github.com/SigNoz/nerve-pod/issues/266
#### Additional information.
Please note that functions in formatter.go and openaichat.go are AI
generated, and I have tested them through tests.
- Converters are per message format, not per SDK. Covered now: SDKs
writing semconv (litellm, langchain, openllmetry, portkey, traceloop LLM
spans) and the OpenAI chat format (bifrost, openrouter input,
OpenInference raw OpenAI calls). Not yet: tool
spans, OpenInference flattened messages, OpenAI Responses items,
openrouter's completion object, Vercel, traceloop legacy prompt keys,
raw Anthropic and Gemini. The full table is in the design doc.
- OpenAPI spec and the generated frontend client are in a separate
commit.
<!--Please delete paragraphs that you did not use before submitting.-->
---
<sub>Stack created with <a
href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a
href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
Adds a new query plugin kind `signoz/AIBuilderQuery`. Its corresponding
spec is equivalent to `qb.QueryBuilderQuery[qb.TraceAggregation]`
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/pulse-pod/issues/334
#### Screenshots / Screen Recordings
https://github.com/user-attachments/assets/3388abc1-f079-464c-b660-7b65ef54cb68
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
Will need to build UI changes on top of this
<!--Please delete paragraphs that you did not use before submitting.-->
---------
Co-authored-by: Gaurav Tewari <gauravtewari111@gmail.com>
Co-authored-by: Gaurav Tewari <tewarig@users.noreply.github.com>
#### Description
- Panel titles resolve dashboard variables (`$var`, `{{var}}`,
`[[var]]`) in the panel header, View modal and download filenames,
reusing the Text panel's `interpolateVariables`.
- Editor title input suggests dashboard variables after `$` (V1 parity,
#7898).
#### Issues closed by this PR
ClosesSigNoz/pulse-pod#327
#### Description
- The "New panel" and "Change panel type" drawers flash for one frame
when they finish opening or closing.
- Cause: `@signozhq/ui`'s `DrawerWrapper` runs its slide on WAAPI via
`motion@11`, which drops the native animation before writing the final
style, so a frame paints with the stale start position.
- Passing an `onUpdate` to the drawer content makes motion drive the
slide in JS. On a live dashboard this went from 24 jumps over 8
open/close cycles to 0.
#### Additional Information
- Workaround only; the proper fix belongs in `@signozhq/ui` (separate
PR). Remove `utils/drawerSlide.ts` and its two usages once that lands.
#### Description
- Scalar trace operator queries ignored `limit`: `buildScalarQuery`
ordered the groups but never added a `LIMIT`, and post-processing only
limits time series. Table, Pie and Top List panels over a trace operator
showed every group.
closes https://github.com/SigNoz/pulse-pod/issues/574
---------
Co-authored-by: Srikanth Chekuri <srikanth.chekuri92@gmail.com>
#### Description
- `create_json_index` still hit `/api/v1/logs/promote_paths`, removed in
#12839 → `test_indexed_paths` failed with 404.
- Fixture now posts to `/api/v1/promoted_paths` with `signal: logs` /
`context: body`; paths are bare (no `body.` prefix) per #13021.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
#### Description
- The list view kept its Order by value in component state, so the sort
never reached the URL. It was lost on back navigation from trace
details, ignored on a deep link, and never saved with a view. The sort
now lives in `compositeQuery`.
- The order-by sanitizer dropped every valid list sort, because a list
panel orders by row fields rather than a group-by key or an aggregation.
It is now gated on panel type and unchanged for Time Series and Table.
- A raw panel (list or trace) cannot order by an aggregation. So,
switching to a list or trace panel now clears the order, so each view
applies its own default.
- Run Query set a flag that suppressed the sanitizer. The flag was never
cleared, so every later init on the page skipped sanitizing. It is now
cleared after the init it applies to.
- Same change applied to the LLM Observability list and trace views.
Those two tabs offer different fields, so before the clear each one
could send the other's.
#### Issues closed by this PR
Closes https://github.com/SigNoz/engineering-pod/issues/6043
Closes https://github.com/SigNoz/signoz/issues/12355
#### Additional Information
- An order no longer survives a round trip through a list or trace
panel. Set a sort on Time Series, open List, and the aggregated order is
gone. This is the trade for closing the leak between the two raw tabs.
- A pre-existing link or saved view that carries an aggregation order on
a list panel falls back to that view's default. The app no longer
produces such a link.
#### Screenshot
Traces back navigation keeps the order by
https://github.com/user-attachments/assets/c98215ee-479c-4d6c-bce8-c8dca3185d99
Switch to table or time series preserves the order by if valid else
resets. (This was existing behaviour onload but did not work on tab
switch due to a run query flag issue we fixed..mentioned in desc above)
https://github.com/user-attachments/assets/26a68377-cf04-442e-8d9e-683de6e773a1
Switch to list or trace view resets the order to respective
default(existing behaviour for traces and llm. new for logs)
https://github.com/user-attachments/assets/680447e7-7dd1-44ac-bcd4-716aa3e796e7
#### Description
- Adds Bun / Elysia, SNMP, Vercel Eve and Microsoft Agent Framework to
the onboarding picker.
- Replaces the Android Java and Android Kotlin cards with one Android
card, since the new doc supersedes both.
- New logos: `bun`, `microsoft`. Android reuses the existing mark.
#### Issues closed by this PR
ClosesSigNoz/signoz.io#4270ClosesSigNoz/signoz.io#4240ClosesSigNoz/signoz.io#4236ClosesSigNoz/signoz.io#4231ClosesSigNoz/signoz.io#4219
#### Description
- `/api/v1/promoted_path` moves from the legacy
`EditAccess`/`ViewAccess` gates to `CheckResources`. Each signal is
guarded by its existing field resource: `logs-field` for logs,
`traces-field` for traces.
- POST checks `update` on the field resource of every signal named in
the body. A mixed logs+traces request needs both grants.
- GET checks `list` on the signals the `signal`/`context` filters
select. With no filters, or filters that match no domain, it checks all
of them.
- Managed-role grants already exist in the registry (editor/admin
update, viewer list), so nothing changes for managed roles. Migration
131 backfills these tuples for orgs created before the kinds were
registered.
- New `promote` integration suite covers the managed-role matrix and
per-signal scoping with a custom role, including revoke.
#### Additional Information
Stacked on #13021.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Stacked on #12839.
## What this does
**Per-path indexes for trace attributes**
The `traces/attribute` domain now supports `indexes`, same as logs body.
Promoted attributes are indexed on `attributes_promoted`, unpromoted
ones on `attributes` — so indexing without promoting works, like it does
for logs body.
Trace index expressions are plain sub-column casts, e.g.
`attributes_promoted.http.route::String`.
**Bare paths in every domain (breaking)**
The `body.` prefix is dropped — the API URL already names the context,
so paths are bare attribute names everywhere: `body.user.name` →
`user.name`. Existing promotions stay valid (paths were always stored
bare). Prefixed paths (`body.`, `attributes.`, …) are rejected with a
guiding error.
## Summary
- Refactors the promote module into a target-parameterized core
(`promotetypes.Target`) so the existing logs `body_v2 → body_promoted`
flow and new promotion domains share one implementation.
- Adds the spans `attributes → attributes_promoted` JSON domain behind
new endpoints `POST/GET /api/v1/traces/promote_paths`. Promotions are
recorded as
`('traces','attributes_promoted','JSON()','attribute',<name>,0,now)`
rows in `signoz_metadata.column_evolution_metadata` — the same rows the
traces field mapper already consumes to read
`attributes_promoted.<path>` per time window, so queries pick up
promoted attributes automatically (forward-only, with the usual
`multiIf` fan-out across the promotion boundary).
🤖 Generated with Kimi K3
Note: Will raise a followup for supporting indexing on trace attribute,
wanted to keep the diff clean this is more of a refactor
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Trace details header reads its metadata from `GET
/api/v1/traces/{id}/summary` (#12911) instead of deriving it from the
waterfall response.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
close -
https://github.com/orgs/SigNoz/projects/59/views/18?pane=issue&itemId=263423245&issue=SigNoz%7Cnerve-pod%7C396
<!--If applicable, include screenshots or screen recordings that clearly
show the behavior before the change and the result after the change. -->
#### Screenshots / Screen Recordings
https://github.com/user-attachments/assets/b5900a84-20b5-402a-bf3f-f137cac3c2a3
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
- Stack 1/4.
this is just a simple change. we will be doing ai realted change in
upcomming prs
- Also for now the error state is not their. we keep showing loading
just like span details panel (lmk if we can change this in follow up )
---------
Co-authored-by: Gaurav Tewari <tewarig@users.noreply.github.com>
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Adds WireMock-backed integration tests for four alert channels: Google
Chat, incident.io, Jira, and JSM Ops.
- Each channel gets two suites: the synchronous channel-test API
(tests/alerts/) and the real firing-rule pipeline (tests/alertmanager/).
- The shared WireMock container serves real TLS (CA from
https://github.com/SigNoz/signoz/pull/12486) under network aliases for
signoz-test.atlassian.net, and api.atlassian.com. A tls-hosts container
label recreates reused containers when the host list changes.
- Google Chat covers the cardsV2 payload with deep links, verbatim
webhook url, permanent 400/403, and a 429→200 retry.
- incident.io covers the alert event shape, a single Bearer prefix on
the token, permanent 401/422, and a 429→202 retry.
- Jira covers issue create (JQL + basic auth + ADF panel), the wont-fix
JQL clause, update of an existing open issue, reopen of a done issue,
permanent 400/401, service-account routing via the api.atlassian.com
gateway, and a search 429 retry.
- JSM Ops covers alert create plus a timeline note (GenieKey auth, HTML
body), the drop-failed-note tolerance, permanent 422/401, and a create
429 retry.
- The shared webhook-verify helper gains urlPath/count/min_count
matching and a path_pattern regex variant for paths embedding the
group-hash alias.
- Fixes a harness bug: ClickHouse mounted its cluster config from pytest
basetemp, which is wiped every session, so reused containers
hot-reloaded away their cluster definition. The configs now live in the
cross-session cache.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/pulse-pod/issues/165
Closes https://github.com/SigNoz/pulse-pod/issues/373
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
- Channel-test readiness is polled (channels/test returns 404 until the
org's alertmanager registers) instead of a fixed sleep.
- Resolved-path delivery (send_resolved close/transition flows) is
deliberately out of scope: it needs a real alert to stop firing, which
is timing-heavy; the status mapping is unit-tested.
<!--Please delete paragraphs that you did not use before submitting.-->
---------
Co-authored-by: nikhilmantri0902 <nikhil.mantri1999@gmail.com>
Co-authored-by: Naman Verma <naman.verma@signoz.io>
Co-authored-by: Praneeth Lingam <praneethlingam@Ollys-MacBook-Pro.local>
#### Description
- real saved views header on top of the sidebar layout.. my view,
selected view and unsaved changes states per figma. create and save as
new share one modal, ✓ updates the view or saves it as new, ✕ discards
back to the saved view and the undo arrow clears it. clear only removes
what the view set, time range stays.
- unsaved changes check compares the queries in their stored v5 form
with empty values dropped like the server does.. comparing after mapping
back to the qb shape made every untouched view read dirty. no amber
flash while switching views or ticking quick filters.
- last used view reopens when the explorer is opened with nothing in the
url, decided on first render.. the default query check the bar uses
never passes, the provider fills `aggregateOperator`.
- logs and traces take the tab from the url, and logs ends live mode
whenever the tab is not the list.
- quick filters header restyled to match the views header.. ghost
buttons, design system tooltips, no funnel, same row height. shared
component so every qf page gets it.
#### Issues closed by this PR
Part of https://github.com/SigNoz/events-pod/issues/71
#### Screenshots
https://github.com/user-attachments/assets/982f87ab-185c-4321-8056-310131e6cb98
#### Additional Information
- behind `SAVED_VIEW_ENABLED`, flag off is today's ui.
- manual pass on logs and traces, metrics smoke. restore on logs and the
settings tooltip not rechecked after the last fixes.
- old bar still has its own restore bug, it goes away with the bar.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
The issue seems to be caused by a weird race-condition that makes the
`AnimatePresence` context to be undefined, causing the `usePresence` to
crash.
The `motion/react-client` is meant to be used only by server components
of next.js, so updating the imports is safe and should fix the issue.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/engineering-pod/issues/5957
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
Two little optimizations:
- run the e2e CI shards since it's getting a little bigger (and slower)
- run parts of the steps in background
- this is something that was introduced recently by
https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/
Also adds a model pattern in `llm-o11y/llm-pricing.spec.ts`: the backend
rejects an empty `modelPattern` since #12995.
#### Additional Information
Latest run
([37721605759](https://github.com/SigNoz/signoz/actions/runs/37721605759))
against the last 10 successful single-job runs (Sep 7 to Oct 1):
| | Before (median) | After (4 shards) |
|---|---|---|
| Wall time | 26.5 min | 12.6 min |
| Playwright tests | 19.7 min | 3.7 to 5.9 min per shard |
| Job start to tests | 7.3 min | 6.3 to 7.8 min |
| Runner time | 26.5 min | 46.9 min |
- Sharding gives almost all of the gain. The previous run
([37717653047](https://github.com/SigNoz/signoz/actions/runs/37717653047))
took 12.3 min wall and 46.6 min runner time.
- Starting `playwright-browsers` after the image pulls cut its download
from 1.7 to 3.1 min down to about 50 s, but it now overlaps
`bring-up-stack`, which got about 30 s slower. Job start to tests stays
at about 7 min in both runs, so the background steps save about 20 s per
job.
#### Description
- Adds an **Overview** tab to the Kubernetes side drawer. It lists
resources related to the drawer's entity, using the existing v2
infra-monitoring list APIs (`listPods`, `listContainers`, …) and reusing
each category's table columns and fetcher from the entity registry.
- The drawer entity's identity expression (e.g. `k8s.node.name = 'xyz'`)
is locked into every related query as the search's initial expression,
so it cannot be edited away. Anything the user types is added on top.
- A dropdown switches the listed resource (defaults to pods), and a
compass button opens the same list, with the same filter, on the
corresponding k8s list page.
- Clicking a row opens that resource's own drawer, overview tab
included, so you can walk node -> pod -> container.
- Overview is the landing tab for every category that has related
resources; categories without any (volumes, containers) are unchanged
and still land on Metrics.
#### Screen Recording
https://github.com/user-attachments/assets/2bfdf320-0267-4552-b7c2-1eb54451256d
#### Issues closed by this PR
Closes https://github.com/SigNoz/pulse-pod/issues/512
Closes https://github.com/SigNoz/pulse-pod/issues/513
#### Description
- Heatmap legend now shows the search bar and caps at two rows, like
other panels. The layout already reserved the search row, but
`customLegend` only received the item width, so the heatmap never
rendered it and its grid spilled into that space as a third row.
`customLegend` now gets the full `LegendLayout`.
- Legend readouts take an optional `itemLabel` (default `series`);
heatmap passes `groups`, since its entries are summed into one grid
rather than drawn as separate series.
#### Screenshots
Before
<img width="987" height="436" alt="image"
src="https://github.com/user-attachments/assets/f4ec5170-dc11-46c4-8de3-452cbc1fb094"
/>
After
<img width="984" height="429" alt="image"
src="https://github.com/user-attachments/assets/f64aea62-f167-4151-a060-c0e2bf603aa1"
/>
Closes https://github.com/SigNoz/pulse-pod/issues/532
#### Description
- The log details header moved when the user switched from Overview to
Context. The drawer body used the native scrollbar, which appeared and
disappeared with the content height. The header grid followed the width
change.
- The drawer body now uses `OverlayScrollbar`, the same as the dashboard
settings drawer. The overlay takes no width, so the header stays in
place on every tab.
- The content box grows with its children, so the arrows hint at the
bottom stays pinned across the whole scroll.
#### Issues closed by this PR
Closes https://github.com/SigNoz/events-pod/issues/163
#### Screenshot
Before
https://github.com/user-attachments/assets/908d761c-d723-40db-8178-1e6ad02b9547
After
https://github.com/user-attachments/assets/65560758-c9d4-4d3f-8303-029b3d9114e6
#### Additional Information
- Most of the tsx diff is formatting from the wrap. The change is three
lines.
- The drawer tab stories (`LogDetails`, `LogDetailsContext`) were not
run locally. The manual check on staging is the verification for this
change.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Adds `GET /api/v1/traces/{traceID}/thread`, which returns the spans
that carry `gen_ai.input.messages` or `gen_ai.output.messages`, in
timestamp order.
- Pages with `after` / `before` cursors (`nextCursor` / `prevCursor`),
or `spanId` to open the page around a span (404 if absent); the three
are exclusive.
- Message normalisation (`formatted_input` / `formatted_output`) comes
in a stacked follow-up PR.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Part of https://github.com/SigNoz/nerve-pod/issues/266
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
- The thread reads only the `attributes` JSON column, so spans that have
messages only in the old attribute maps don't appear.
- The waterfall API is unchanged.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
- Adds `GET /api/v1/traces/{traceID}/summary`. It returns the trace
header fields shown with the waterfall, plus AI token and cost totals,
using one query.
- The waterfall loads every span to get these fields. It will stop
returning them once the frontend uses this endpoint.
- Fixes these waterfall bugs:
- On traces over 10k spans, the entry point is empty.
- If some spans point to a parent that was never received, the root can
change on every reload.
| Trace size | Endpoint | Latency | Server memory | Data sent to server
|
|---|---|---|---|---|
| 2M spans | summary | 0.65 s | 84 MiB | 3 KB |
| 2M spans | waterfall | 12.5 s | 2.6 GiB | 128 MiB |
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/nerve-pod/issues/265
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
- AI token and cost fields are now typed `number`, the same as in
metadata.
---------
Co-authored-by: Srikanth Chekuri <srikanth.chekuri92@gmail.com>
#### Description
- first slice of saved views in the quick filters sidebar..
`QuickFiltersLayout` gets a `savedViewProps` next to `quickFilterProps`,
both optional. views header sits above the filters, `≡` opens an All
views panel in the sidebar's place and the filters slide right over the
content as one drawer. nothing remounts, so expanded sections and an
open settings drawer survive the toggle.
- header and panel are placeholders for now (dummy name, empty list)..
this PR is the layout, the real header / list / actions come on top of
it. behind `SAVED_VIEW_ENABLED`, flag off is today's ui.
- metrics has no quick filters, so it gets the layout with only the
views side.. header on top, list always visible, nothing slides.
- logs explorer moved onto `QuickFiltersLayout`.. it was the last one
mounting quick filters on its own. content wrapper now hands a definite
height down so logs can keep sizing its list from the pane instead of
`calc(100vh - ..)`.
- quick filters settings drawer animates with transform instead of
width.. width relaid out the drawer every frame, that was the jitter.
clipped so it comes out from behind the filters.
#### Issues closed by this PR
Part of https://github.com/SigNoz/events-pod/issues/71
#### Screenshots/ Screen recording
<img width="1728" height="1001" alt="12994 - metrics dummy section"
src="https://github.com/user-attachments/assets/7a57fd43-a11b-44e7-a8ca-4b197826bd36"
/>
https://github.com/user-attachments/assets/fd6a4ac4-6464-4059-9986-99d42e159a3d
#### Additional Information
- flag off checked on logs / traces / metrics / exceptions.. sidebar,
list scroll and pane scroll same as before.
- borders and l1 background per figma, quick filters width still 280px..
will take that up with design.
- cc. @H4ad since `QuickFiltersLayout` is from the scroll fix PR.
#### Description
- Stories for the current new-panel picker and panel editor config pane,
as the visual baseline for #12992 and #13010.
- Dashboard detail: picker opened from the toolbar, with a kind
selected, without sections, and from a section's menu.
- Panel editor: one story per panel kind with every config section
expanded; Area and Text added to the editor's kind list.
- `story-shots.mjs`: round the grown viewport height up, since
Playwright rejects fractional sizes.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
To be merged along with UI changes
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/pulse-pod/issues/347
Closes https://github.com/SigNoz/pulse-pod/issues/193
---------
Co-authored-by: Abhi kumar <ahrefabhi@gmail.com>
#### Description
- Adds saved views for the alerts list page: a view stores the v3 list
params (`query` DSL string, `states`, `sort`, `order`) and the FE
replays them, mirroring dashboard saved views.
- New CRUD APIs: `GET/POST /api/v2/rule_views`, `PUT/DELETE
/api/v2/rule_views/{id}`. Open to all roles including viewer, like
dashboard views; shared org-wide.
- New `rule_view` table (migration 127), same shape as `dashboard_view`
plus an explicit index on `org_id` (neither Postgres nor SQLite
auto-indexes an FK's referencing column).
- Validation on save: name (required, trimmed, max 64), `version` must
be `v1`, query length-capped at 1024 (not compiled, a work-in-progress
query is saveable), `states`/`sort`/`order` enum-checked; zero
sort/order normalize to the list defaults (`updated_at`/`desc`); unknown
body fields rejected.
- Covered by unit tests and a new integration suite
(`alerts/07_rule_views.py`: rejection table, 404s, full lifecycle);
OpenAPI spec regenerated.
- discussion: SigNoz/pulse-pod#304.
#### Issues closed by this PR
Closes SigNoz/pulse-pod#227
#### Additional Information
- Based on #12780 (alerts listing page revamp), which this PR's branch
is cut from; backend only, FE ships separately.
---------
Co-authored-by: Naman Verma <naman.verma@signoz.io>
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
Prev. we had a banner with this hardcoded values. now we have replaced
it. the callout component.
#### Issues closed by this PR
<!--If applicable, include screenshots or screen recordings that clearly
show the behavior before the change and the result after the change. -->
#### Screenshots / Screen Recordings
before -
<img width="1517" height="325" alt="image"
src="https://github.com/user-attachments/assets/257639f0-0e97-4606-b9c9-55ee8cabe53f"
/>
Now -
<img width="1515" height="339" alt="image"
src="https://github.com/user-attachments/assets/b02a9cae-3fc0-4980-90c9-2bde1c9b2c98"
/>
#### Additional Information
<!--Please delete paragraphs that you did not use before submitting.-->
Co-authored-by: Gaurav Tewari <tewarig@users.noreply.github.com>
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044](https://github.com/urllib3/urllib3/issues/5044)
<https://github.com/urllib3/urllib3/issues/5044></code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945](https://github.com/urllib3/urllib3/issues/4945)
<https://github.com/urllib3/urllib3/issues/4945></code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092](https://github.com/urllib3/urllib3/issues/5092)
<https://github.com/urllib3/urllib3/issues/5092></code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b1d30ab61f"><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="9016d7e8af"><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li>
<li><a
href="9101f581a8"><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li>
<li><a
href="cd770b059b"><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="ea2ad7b21a"><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="0716e31534"><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li>
<li><a
href="43c68c8b43"><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li>
<li><a
href="308b279b3f"><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li>
<li><a
href="53fa0731b2"><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li>
<li><a
href="5f2a6a843d"><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#### Description
- Bump `google.golang.org/grpc` to v1.83.2 and the opentelemetry-go core
and trace exporter modules to v1.45.0. This fixes the open Dependabot
alerts for these modules.
- Take the resource schema URL from `sdkresource.Default()`. From
v1.44.0, the SDK uses semconv 1.41.0. With the pinned 1.40.0 URL, the
resource merge fails and the server does not start.
- Keep the otel log modules at their current versions. Their v0.21.0 API
breaks `otelzap` v0.13.0 and the log exporters that
`signoz-otel-collector` v0.144.6 uses.
- Replaces #12828, #12900, #12902, #12903 and #12904.
<!--A few plain bullets saying what changed and why, for a reviewer
skimming it - not a wall of text, not a restatement of the diff, not
generated boilerplate.-->
#### Description
`max_over_time` expects a range vector as input, which is `labels ->
[(timestamp,value),...]`. it turns each entry into
`labelsWith__name__removed -> maxOfAllValues`.
However, if two entries have `labelsWith__name__removed` as the same,
then `max_over_time` throws an error. For eg if the input is:
1. {"host":"a", "__name__": "transpiled_1"} -> ....
2. {"host":"a", "__name__": "transpiled_2"} -> ....
then `max_over_time` will break.
Currently, `executeHybrid` in
`pkg/prometheus/clickhouseprometheusv2/transpiler_exec.go` always puts
in the `__name__` label as `signoz_transpiled_*`, which can lead to the
above scenario.
Removing this `__name__` label fixes that issue. Also, nothing ever
needs this label. When the engine asks for `signoz_transpiled_0`, our
storage finds the data with a map lookup on that name and returns it.
The series' own labels play no part in the lookup.
After this change, no synthetic `__name__` exists anymore. So, the code
that stripped it after the engine ran, and `mergeMatrixByLabelset`,
which re-merged the rows those names had split, are deleted. The
engine's own merging handles this now.
<!--Reference issues using `Closes #issue-number` to enable automatic
closure on merge. -->
#### Issues closed by this PR
Closes https://github.com/SigNoz/pulse-pod/issues/508
<!--If applicable, include screenshots or screen recordings that clearly
show the behavior before the change and the result after the change. -->
#### Screenshots / Screen Recordings
<!--Anything reviewers should keep in mind while reviewing -->
#### Additional Information
<!--Please delete paragraphs that you did not use before submitting.-->
---------
Co-authored-by: Srikanth Chekuri <srikanth.chekuri92@gmail.com>
#### Description
- Submitting a weak password on the reset page returned the backend
`invalid_password` error, and the pane stayed up after the password was
fixed, replaying its shake while typing.
- The mismatch flag was imperative state set on blur, so it went stale
when a field was cleared; toggling it remounted the API error pane.
- Validation is now derived from watched form values, the same way
SignUp does it, and the mutation is reset on edit so the API error
clears as soon as either field changes.
- Added tests for both cases.
#### Issues closed by this PR
ClosesSigNoz/keystone-pod#144
#### Screenshots / Screen Recordings
https://github.com/user-attachments/assets/48dcfa17-9fbc-47bc-83c5-75b0bb46ced0
#### Description
Server counterpart to SigNoz/signoz-otel-collector#891, which makes the
collector write each log body to both the legacy `body` column and
`body_v2` while a `json_body_dual_ingestion` flag is on.
- Adds the `json_body_dual_ingestion` feature flag (experimental, off by
default).
- Normalize is placed by read mode, so user pipelines always see the
body the explorer shows. With `use_json_body` on it stays ahead of user
pipelines. With dual ingestion alone, reads are still on the legacy
`body`, so it runs after them and only feeds `body_v2`.
- Whenever dual ingestion is on, the operator carries
`json_body_dual_ingestion: true` so it stashes the original body for the
exporter to restore. Running last under dual makes that stash the
post-pipeline body, exactly what legacy ingestion stores today.
- The pipeline preview follows the same rule and normalizes only under
`use_json_body`.
Design notes: [Normalize Operator and
Pipelines](https://app.notion.com/p/signoz/Normalize-Operator-and-Pipelines-3d7fcc6bcd19802396b9e8e817e30381),
[Dual JSON body
ingestion](https://app.notion.com/p/signoz/Dual-JSON-body-ingestion-3c6fcc6bcd198049963bce6ce2648af8)
#### Additional Information
- Collectors must run a build containing
SigNoz/signoz-otel-collector#891 before this flag is turned on. Verified
locally against v0.144.9: an older collector does not reject the unknown
operator key, it silently ignores it (operator configs are decoded with
`confmap.WithIgnoreUnused()`), runs normalize, and writes the normalized
body into the legacy `body` column until it is upgraded. No collector
release includes #891 yet.
- The exporter's own `json_body_dual_ingestion` key is collector deploy
config and is flipped together with this flag; the server does not set
it.
- Toggling either flag does not bump the pipeline config version, so
connected agents need a new pipeline save to pick up the operator or its
position. Same caveat as `use_json_body` today.
- Under dual, normalize is last among the SigNoz pipelines; custom
collector processors placed after them still see the normalized map.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
#### Description
Phase 2 of #6143: semantic-convention families resolve on logs and
metrics, behind the `resolve_semconv_families` flag (default off), on
the storage contract of #12802.
- Registry: each member carries the scope of its own rename edges, so a
fan-out keeps one membership per target and an ambiguous name stays
literal.
- Logs and metrics families need no family code of their own. The gate
applies to every signal, and `LogicalRead` merges members through each
storage's `Read`.
- Metric-name families union the storage names in every `metric_name`
filter, and the querier reads type, temporality, and the reduced flag
across the family.
- Span-metrics labels: the metrics the processor emits, listed by name,
also read each family member with the `resource_` prefix. Requested
names are never rewritten.
- Values suggestions and related values cover every spelling of the
family.
- `deployment.environment.name` resolves on all three signals.
`db.system.name` stays off until a value-mapping reader exists.
#### Additional Information
- `pkg/semconv.Family` fields are now unexported, and `transition.go` is
removed. #12446 reads the old API and needs an update when stacked.
- A target that emits both names of a metric-name family double-counts
in `sum()` during the overlap window. Reading both names is the feature.
Pinned by a test.
- A family of metrics labels keeps the keyless contract of a single
label: no guard, no NULL group.
#### Description
- noz page, alert rules, home, exceptions and services now push their
count to the left of the strip. each page has its own `useXStripInfo`
hook that builds the config and publishes it.. same pattern trace
details already uses, five more times.
- the hook does the whole thing, so the page call is one line. noz and
home fetch or subscribe inside the hook so the page does not re-render
just to keep the strip current.. the rest pass values they already hold.
- alert rules and exceptions show "N of M".. first number is what is on
the page right now. both read the same two values the table hands its
own pagination, so the strip cannot disagree with the table. services,
home and noz are a plain count.
- services renders one of two tables on `use_span_metrics`, so the hook
is called from both.. the count text lives in one place either way.
- dashboards is left out for now, it already shows this on its own
strip.
#### Issues closed by this PR
Part of https://github.com/SigNoz/events-pod/issues/53
Part of https://github.com/SigNoz/events-pod/issues/55
#### Screenshots
Ai Assistant Bottom strip
<img width="3456" height="1968" alt="image"
src="https://github.com/user-attachments/assets/0042f71b-1b56-417a-8283-af9ba9596351"
/>
Alert rules
<img width="3452" height="1992" alt="image"
src="https://github.com/user-attachments/assets/a674de13-9841-4717-89ce-a656c9df646c"
/>
Exceptions
<img width="3456" height="1970" alt="image"
src="https://github.com/user-attachments/assets/6333ea6b-2342-46dc-985d-2855bebe4003"
/>
Services
<img width="3456" height="1996" alt="image"
src="https://github.com/user-attachments/assets/abe0c5cb-cfe3-48b6-9591-ee71e677a1a6"
/>
#### Additional Information
2026-10-01 19:30:00 +00:00
2011 changed files with 86442 additions and 29136 deletions
@@ -17,3 +17,4 @@ For the Python integration suite under `tests/`. Setup, running, and suite layou
- **snake_case parametrize ids.** `ids=["fill_gaps", "fill_zero"]`, not camelCase.
- **Name suite files with the two-digit prefix (`NN_*.py`).** `pyproject.toml` restricts collection to `[0-9][0-9]_*.py` (plus the bootstrap `setup.py` / `run.py`) — a file that doesn't match is silently never collected.
- **Always run pytest from `tests/`.** `--import-mode=importlib` is what allows same-basename files across suites (`querier/01_logs.py` vs `rawexportdata/01_logs.py`), but it disables pytest's implicit `sys.path` injection — `import fixtures` only resolves via `pythonpath = ["."]` from that rootdir.
- **After changing any `.py` file, run `make py-fmt` and `make py-lint`** from the repo root and fix what they report.
description: Shoot Storybook stories with sbshot at two git refs and produce a diff a reviewer can read. Use when asked for a visual diff, before/after screenshots, a screenshot comparison for a PR, or to prove a change did not alter screens it should not have.
---
# sbshot visual diffs
`npx -y github:SigNoz/sbshot` shoots Storybook stories and pixel-diffs two runs.
Use it. Do not hand-roll a Playwright screenshot loop or a canvas pixel-compare:
sbshot already handles story selection, themes, settling, retries, diffing,
tagging, a viewer and a static export, and its runs are the format the rest of
the team can open.
sbshot is not installed by any package. It is run through `npx`, so nothing it
knows travels into this repo on its own. This file is where that knowledge
lives.
## The shape of a run
```
capture <storybook> --name-run <ref> # once per git ref
diff <baseline> <after> # pairs them by relative path
tag <diff> <tag> <story-id>... # what the reviewer should look at
export <diff> --out <dir> # a static site, hostable
```
`<storybook>` is a running dev server (`http://localhost:6006`), a build
directory holding `index.json`, or a project directory with `.storybook/`. The
frontend has **no `build-storybook` script**, only `storybook dev -p 6006`, so
point `capture` at a dev server.
## Cover the change with stories first
**A diff can only show what a story renders.** A screen, state or variant with no
story is invisible to sbshot: it produces no pair, so it reads as "nothing
changed" rather than "never looked at". This is the failure mode that makes a
clean-looking diff worthless.
Before capturing, list the screens and states the change touches and check each
has a story. For anything missing, write it first — the `signoz-page-story`
skill covers how. New states reached only by an interaction need a `play`
function, or the capture shoots the page at rest and the state never appears.
Then confirm it worked: the two runs' story counts should differ by exactly the
stories the change adds. A new screen that produced no new story id is a screen
nobody is reviewing. Say the count in the summary, so a reader can tell coverage
from silence.
## Rules that are not optional
**One freshly started Storybook per ref.** Never start one server and switch git
branches under it. Vite's HMR reloads the page, but some modules do not
re-initialise, so the shot differs silently from a clean boot and the difference
looks like a real change. Settle time does not fix this and is not the variable.
Use one worktree and one port per ref, and stop each server before the next.
**Capture both themes: `--theme dark,light`.** Without it sbshot shoots the
story's own default and everything lands in a single `default/` folder, so every
regression in the other theme is invisible. Themes double the shot count, so
scope with `--stories` or `--title`, never by dropping a theme.
**Baseline is the merge-base, not `origin/main`.**`git merge-base origin/main
<branch>`. Against a moved main, every commit main gained since the branch's base
shows up reversed, as though the branch reverted it.
**The percentage sorts the list, it does not tell you what matters.** A dialog
that dims the page scores high for a one-line change, and a whole new form
section can score low. Open the shots and say what changed on each screen. The
biggest number is usually the least interesting one.
**If you cannot explain a pair, assume the capture is at fault, not the code.**
Open it, crop both sides and compare them before calling it noise. A pixel count
and a good guess are not evidence.
## Noise, and the floor that proves it
The same story does not always render identically twice. Pairs often move for
reasons that have nothing to do with the change:
- a focus ring left on whatever a `play` function clicked last
- a scrollbar appearing, or its thumb resting a few pixels off
- a toast, tooltip or dialog caught mid-fade
- a text caret blinking, or a selection highlight
- an animation or spinner at a different frame
- relative timestamps ("2 days ago") crossing a boundary
- hover or active styling from where the pointer happened to rest
- a late-loading font or image shifting a line of text
Do not argue about these one at a time. **Measure them**: shoot the same commit
twice and diff those two runs against each other. Anything that moves there moved
for no reason, so it is noise.
```
capture <storybook> --name-run noise-a
capture <storybook> --name-run noise-b # same tree, its own fresh server
diff noise-a noise-b --name-diff noise
diff <baseline> <after> --noise noise # marks the movers flaky
```
**The noise run has to cover the same stories as the real diff.** Do not scope it
down to the few pairs that moved, however tempting that is. `--noise` marks a
pair flaky when the noise diff does not show it as unchanged, so every story the
noise run leaves out is marked flaky too, including the new screens the reviewer
is there to look at. Shooting two narrow runs and diffing those against each
other has the same problem. Either shoot the full set twice, or skip `--noise`
and explain the few movers by hand.
**`--noise` ignores how far a pair moved.** A pair is marked flaky when the
noise diff does not show it as unchanged, so a 70-pixel flicker in the noise run
hides a real 8% change in the real one. Compare the two numbers before trusting
the mark. When most of the flaky marks are hiding real changes, run the diff
without `--noise` and tag the genuinely noisy pairs by hand instead, so nothing
real is filtered out of the reviewer's view.
That is the trade: a second full capture costs about as long as the first, so on
a small diff it is often quicker to crop the two or three movers and say what
each one is. Use `--noise` when the diff is large, or when wiring `--fail-over`
into CI, where something has to decide without a person looking.
If a pair is flaky every run and the state it captures matters, fix the story
rather than living with it: blur what the `play` clicked, freeze the clock, or
assert the state instead of shooting it.
## Making it readable for a reviewer
A reviewer cannot open `localhost`, so `sbshot ui` is for you, not for them.
1.`tag` the pairs that matter, with `--note` saying why. The viewer filters by
tag, so the reviewer lands on the real changes instead of scrolling past
noise that scored higher.
2.`export <diff> --out <dir>`. It writes a static site carrying only the pairs
that are not identical, converted to WebP, so a large diff stays small.
3. Host it. A Claude artifact works: publish the export's files and give the
reviewer the link. `index.html` is reserved for the artifact's own page, so
publish sbshot's entry as `viewer.html` and link to
`viewer.html#/job/diff/<diff>`.
4. Put the link in the PR body under **Screenshots / Screen Recordings**.
Say the numbers plainly: how many screens changed, how many are new, how many are
pixel-identical, how many are flaky. The count of unchanged screens is often the
most useful claim in the diff, because it is the one a reviewer cannot check by
eye.
## Operational traps
- A full capture is hundreds of shots. Scope with `--title "Pages/Alerts"` or
`--stories "a,b,c"` (substring match on id or Title/Name, repeatable).
- **On macOS a capture can pin itself to one story at a time.** sbshot picks how
many to shoot at once by sampling free memory, and off Linux it reads
`os.freemem()`, which counts only truly free pages. macOS parks almost
everything in "inactive" instead, which is reclaimable on demand, so the
sampler can read ~100 MB on a 25 GB machine and shrink to one forever.
`--jobs` does not help: it is only an upper cap. Check `parallelism` in
`<run>/events.ndjson`; if it sits at 1 while `vm_stat` shows gigabytes
inactive, that is this. A 124-shot run takes about 90 minutes pinned and about
6 minutes at four at a time, so it is worth spotting before a long capture.
- A fresh worktree cannot build Storybook: `i18n-translations-hash.json` is
gitignored and generated. Run `node ./i18-generate-hash.cjs` in
`<worktree>/frontend`, and symlink `node_modules` from the main checkout.
-`pnpm test:storybook` starts its own server on 6006 and hangs silently if
something already holds that port. Free it first.
- ImageMagick on macOS may have no default font, so `--mode green-parallel` fails
with ``unable to read font `' ``. Map Helvetica to a real file in
`~/.config/ImageMagick/type.xml`.
- `sbshot link <dir> <name>` adds a run from elsewhere into the workspace, but it
symlinks. Keep the source directory alive until you have exported.
- The export directory is build output. Delete it when done, or gitignore it.
- Running the whole Storybook test suite locally fails broadly with
`page.goto: Timeout` from resource starvation. Scope it; CI is the real signal.
## Done means
- [ ] every screen and state the change touches has a story, written before capturing
- [ ] one capture per ref, each from its own freshly started Storybook
- [ ] `--theme dark,light` on every capture
- [ ] baseline is the merge-base
- [ ] noise either measured with a full second capture, or each mover explained by hand
- [ ] every non-flaky pair opened and explained, not inferred from its size
- [ ] the pairs that matter tagged, with a note
- [ ] exported and hosted, and the link in the PR body
description: Screenshot a set of SigNoz Storybook stories, then pixel-diff two runs to see what a CSS or component change did, with the changes tinted over the new shot. Use when asked to take story screenshots, capture a visual baseline, compare before/after of a style change, or find which pages a change affects.
---
# Storybook visual diff
Two scripts under `frontend/scripts`:
-`story-shots.mjs` — screenshots stories off a running Storybook dev server.
-`story-shots-diff.mjs` — pixel-diffs two runs and paints what moved.
Output goes to `frontend/.story-shots/` (gitignored), one directory per run.
## 0. Settle what is being compared, first
A diff is only worth taking when the two runs straddle something. Run twice over
the same tree and the answer is zero, or the noise floor: true, and useless.
So before starting a server, pin down four things. Whatever the prompt already
says, take it and do not ask again; ask only for what is genuinely missing, in
**one**`AskUserQuestion` call.
| To settle | Ask | Options |
| --- | --- | --- |
| Job | "What should this run produce?" | shoot only · baseline for a change you are about to make · compare against a change already in the working tree · compare this branch against another (`main` by default, or one the user names) · compare two configurations of the same story (`--args`, clock, width) · noise floor (same tree twice) |
| Scope | "Which stories?" | offer 2-3 concrete selections read off `index.json` (a page, a `--title` prefix, everything), never open-ended |
| Themes | "Which themes?" | dark · dark + light |
| Read-out | "How should the diff read?" | `green` (changed pixels over the after shot) · `green-parallel` (before \| after \| diff, side by side) · `red` · `red-parallel` · `none` (keep both runs, do not diff) |
Skip a row when the prompt answers it, and skip the whole call when the prompt
answers all of it ("shoot the pods tooltips in both themes" needs no question).
Skip Read-out too whenever the job is *shoot only*, and take `none` for what it
says: shoot both sides, report both paths, run no comparison. When the prompt
says nothing at all, ask; a silent guess here burns ~6 min per sweep on the
wrong stories.
The job decides which loop below to run:
| Job | Loop |
| --- | --- |
| **shoot only** | §1, §2, stop. Report the paths. No diff, no second run. |
| **baseline first** | the full loop, stopping after step 2 to hand the change back. The user makes it, then continue at step 4. |
| **change already in the tree** | the tree *is* the after state. `git stash` (or check out the base commit) to shoot the before, restore, shoot the after. Confirm the working tree is clean enough to stash before touching it, and restore it even if a capture fails. |
| **branch vs branch** | shoot the current branch, then `git switch <base>` in place (stash first if the tree is dirty), restart the dev server, shoot again, switch back and unstash. Restart matters: HMR does not survive a whole-branch swap cleanly. Get the tree back to where it started even if a capture fails. |
| **noise floor** | two runs, same tree, diff. The number is the harness's floor, not a finding. |
| **config vs config** | same tree, two runs that differ only in flags: `--args`, `--clock`, `--width`, `--theme`, `--motion`. Filenames stay identical, so the pairs line up and the caption names what changed. |
## The loop
1. Capture the baseline **before touching anything**.
2. Capture it a second time and diff the two. That is the noise floor: anything
it reports is what the harness cannot hold still, and no conclusion about the
change may rest on those stories. Cheap on a handful of stories, ~6 min per
32, so on a wide sweep run it over the two or three stories the change is
aimed at instead of all of them.
3. Make the change.
4. Capture again into a third directory.
5. Diff, then read the tinted shot of the largest movers to judge the change.
## 1. One dev server, on a free port
`storybook dev` keys its Vite dep cache off the config dir, so two servers on the
same `-c` serve mismatched prebundles and every story dies with `Invalid hook
call`. Check what is already up first — port 6006 is often another repo's
Storybook, and its `index.json` then indexes the wrong stories:
```bash
for port in 6006 6007;do
curl -s -m 2"http://localhost:$port/index.json"| head -c 60&&echo" <- $port"
done
```
Start the SigNoz one on a free port, from the repo's own binary so no package
manager shim is in the way:
```bash
cd frontend
nohup ./node_modules/.bin/storybook dev -p 6007 --no-open --quiet \
> "${TMPDIR:-/tmp}/signoz-storybook.log" 2>&1&
```
It is ready when `curl -s localhost:6007/index.json` returns JSON whose
`entries` hold SigNoz story ids.
## 2. Capture
Playwright is not a frontend dependency. The script finds it in `tests/e2e`
(`pnpm -C tests/e2e install`, `@playwright/test` is enough) or in a global
install, and launches Playwright's own chromium, falling back to an installed
Chrome. Two escape hatches when that is not what a machine has:
```bash
exportPLAYWRIGHT_MODULE=/path/to/playwright # a different install
exportCHROME_PATH=/path/to/chrome # a specific browser binary
```
Then pick the stories. `--list` prints the selection without shooting anything:
| `--stories <match>` | id or `Title/Name` substring, repeatable or comma-separated. Omit for every story. |
| `--title <prefix>` | only titles starting with the prefix (`Pages/`, `Components/`) |
| `--name <match>` | only story names containing the match |
| `--theme dark,light` | one pass per theme; omit for the story's own default (dark) |
| `--args <k:v;k2:v2>` | arg overrides, Storybook's own `?args=` syntax, repeatable. A dotted value is dropped by Storybook itself, so map it to a slug inside the story's mocks |
| `--port` | dev server port, or `$SB_PORT` |
| `--width <px>` | the only fixed dimension, default 1680 |
| `--height <px>` | shortest the viewport may be, default 1200 |
| `--max-height <px>` | tallest it may grow to, default 8000 |
| `--grow <what>` | `scrollers` (default) grows the viewport until the page's own scrollers fit, `document` only follows the document height, `none` keeps `--height` |
| `--settle <ms>` | wait after the page goes quiet, default 1500 |
| `--clock <iso\|live>` | wall clock the page reads, passed to the preview as `?storyClock`; `live` unfreezes it |
| `--motion` | keep animations and transitions running (sets the `motion` global to `live`) |
| `--ignore <selector>` | hide matching elements, on top of `[data-shot-ignore]` and `[data-chromatic="ignore"]` |
| `--flat` | write `<out>/<id>.png`, no theme directory |
| `--no-caption` | leave the caption band off the shots |
| `--list` | print the matched stories and exit |
Files land at `<out>/<theme>/<story-id>.png`, next to a `shots.json` recording
what each shot is (id, title, name, theme, `ok`/`busy`, the caption's height in
rows) and how the run was configured (args, clock, width, height, grow, motion,
settle, ignore). Keep the flags identical between the two runs or the diff pairs
nothing.
Every shot carries the caption band described below, so a single screenshot says
what it is on its own. `--no-caption` leaves it off, and so does a machine
without ImageMagick (with a warning). The band never changes the shot's width
(long text wraps rather than widening the canvas) and its height is recorded, so
the diff crops it back off and never reports one caption against another. Two
runs whose captions are different heights still diff to zero. A story that never held still for two
identical frames is logged `busy` instead of `ok` — treat its diff as suspect.
Dark alone is enough while iterating on the harness; add `light` for the run you
Prints `<changed pixels> <theme>/<story>.png`, largest first, and writes one
image per pair. Needs ImageMagick for PNG encode/decode (7's `magick`, or 6's
`convert`/`identify`/`montage`); the comparison itself is in the script.
| Flag | Meaning |
| --- | --- |
| `--mode green` | default. The after shot with the changed pixels painted over it, exactly the pixels that changed. What Chromatic shows. |
| `--mode green-parallel` | `previous \| current \| diff` in one image, each tile labelled above it, on a gutter inverted from the theme. The diff tile is the `green` one, so the after shot stays readable underneath. |
| `--mode red` | the after shot faded to 10%, changed pixels in red. A pixelmatch-style diff, easiest to read when the change is a thin edge. |
| `--mode red-parallel` | the same three tiles, with the `red` diff. Best when the change is a thin edge that the unfaded shot would swallow. |
| `--threshold <0..1>` | how far a pixel must move to count. Default 0.063, Chromatic's `diffThreshold`. |
| `--include-aa` | count antialiasing changes too. Off by default, as in Chromatic. |
| `--tint <#rrggbb>` | override the mode's colour. |
| `--no-caption` | drop the caption band. |
### The caption
Both scripts stamp a band on top of what they write: `story-shots.mjs` on each
shot, from the story and the run's own settings; `story-shots-diff.mjs` on each
diff, read out of the two runs' `shots.json`. It carries the story's
`Title/Name`, then its id, theme and `busy` flag, then the settings both runs
shared, each reading `key:value`. Whatever the two runs did **differently** goes
on the side it belongs to: under `previous` and `current` on the parallel tiles,
on two lines of the band otherwise. So a pair that differs only in `--args` says
so on its face, which is what makes several shots of one story tellable apart.
The shots' own bands are cropped off before comparing and before going into the
tiles, so nothing in the output is a diff of a caption. Type size follows the
image width, so it stays readable with the whole image viewed at fit-to-width;
the heading is set in an installed sans and the detail lines in a mono, falling
back to ImageMagick's default when neither is on the machine. Without a manifest
the band falls back to the file path, and a directory of captioned shots whose
`shots.json` is missing has nothing to crop by, so its captions do land in the
diff. Keep `shots.json` next to the shots.
### How the comparison works
Chromatic's own capture and diff run server-side — `chromatic-cli` uploads a
built Storybook and contains no capture or comparison code at all. What is public
is the parameter contract, and the numbers in it say what the comparison is:
`diffThreshold` defaults to `0.063` on a 0-1 scale, which is pixelmatch's
`threshold`, and `diffIncludeAntiAliasing` defaults to false, which is
pixelmatch's `includeAA: false`. So the script implements that comparison:
1. Both PNGs are read as raw RGBA through `magick … RGBA:-`.
2. Per pixel, the squared YIQ distance between the two colours (weights
`0.5053 / 0.299 / 0.1957`), compared against `35215 * threshold²` — 35215 is
the largest distance two 8-bit colours can have. Chroma is included, so a
colour swap at equal brightness still counts.
3. A pixel over the threshold is dropped when it is only antialiasing: it is the
darkest or lightest of its eight neighbours, and the other image has a pixel
around there doing the same job. This is what keeps a subpixel glyph edge from
reading as a change.
4. What survives is painted at full opacity, one output pixel per changed input
pixel. No dilation, no blobs — a one-pixel shift shows as a one-pixel line.
A pair whose shots are different sizes is compared over the overlap, and every
row and column that exists in only one of them counts as changed.
Pairing is by `<theme>/<story-id>.png`, so a story that exists on only one side
(new on the feature branch, renamed, retitled) has nothing to pair with and is
skipped silently. On a branch-vs-branch run, compare the two runs' file lists
before reading the numbers.
## What makes a shot reproducible
Most of it is in the preview, not in the script, so a Chromatic build in the
cloud shoots the same page: `.storybook/preview-head.html` freezes the clock,
and `settleForCapture` (the preview's `afterEach`, which runs after `play`)
parks the animations and snaps the bottom-pinned lists. The script drives the
rest:
- **Storybook's own render phase is the readiness signal.** It waits for
`window.__STORYBOOK_PREVIEW__.storyRenders[].phase === 'finished'`, which is
reached only after the loaders, the decorators and the story's `play` are done.
A DOM check cannot see a `play` still running. (Storybook 10 spells the final
phase `finished`, not `completed`.)
- **Network quiescence, not `networkidle`.** react-query retries and msw keep
requests going after load, and a few stories hang a request by design, so the
wait is "no request for 600ms", capped at 15s.
- **The clock is frozen** (`2026-06-15T12:00:00Z`), by the preview itself. Chart windows, `4 mins ago`
labels and trial countdowns all derive from `now`; a live clock alone moved
8000 pixels on the dashboards list and redrew every chart axis.
- **Animations are parked on their last frame** by `html.sb-still`, a
zero-length single iteration with `forwards` fill, plus `prefers-reduced-
motion`. The Motion toolbar item (`still` by default) turns it off. An infinite
spinner is otherwise caught at a random angle.
- **`document.fonts.ready`**, because text reflows when a face lands late.
- **Lists pinned to their bottom are snapped onto it**, once by the preview and
again by the script after the page goes quiet. A virtuoso list settles a
few pixels short of the end depending on the order its items were measured in.
- **Two identical frames in a row**, because what a page is still waiting on is
often not observable from outside it.
- **`[data-shot-ignore]`, `[data-chromatic="ignore"]` and `--ignore <selector>`**
hide a region that cannot be held still; Chromatic excludes the same attribute
from its comparison.
- **The width is the only fixed dimension.** Chromatic's `viewports` are widths;
the height follows the page. `src/styles.scss` pins `html, body, #root` to
`height: 100%; overflow: hidden`, so the document never outgrows the viewport
and its height says nothing: what overflows are the shell's inner scrollers.
`--grow scrollers`, the default, grows the viewport until the tallest in-flow
scroller fits, so nothing is cut off and no scrollbar is left in the shot (the
dashboards list goes to 2226px in one round). Popups are skipped — they are out
of the flow, and a tall dropdown would otherwise drag the shot to a height
nothing on the page needs. A page that sizes a panel in `vh` grows its own
content as the viewport grows, so no height ever fits it and the rounds only
chase — `.alert-chart-container` is `57vh`, which puts Create Alert's fixed
point at 4344px with an empty band on top. Those pages are shot at `--height`
with their own scrollbar, which is what they look like in a browser, and the
With all of that, 29 of the 32 page tooltip stories are byte-identical across
runs. The three that are not, and why:
| Story | Residual | Cause |
| --- | --- | --- |
| `kubernetes-pods--tooltips-in-options-panel` | ~13k px | 24 tooltips held open in an overlapping cluster; they portal to `body` in mount order, and the drawer's own tooltips mount before or after the list's depending on when their data lands, so overlapping tooltips stack differently. Panel geometry itself is stable. |
| `settings-role-editor--tooltips-in-json-editor` | ~2.5k px | monaco re-measures and lands one pixel off. |
| `traces-trace-details--tooltips` | ~800 px | same class, one row of the waterfall. |
Each is bimodal — two stable arrangements — so the same number reappears run
after run. Diff a story against itself before believing its number, and reach
for `--ignore` when a region cannot be settled.
## Gotchas
- **Zero pixels is a real answer.** A story whose tooltips are all short is
unaffected by a tooltip rule; it is not a broken capture.
- **The selector matters more than the rule.** A global rule on
`[data-slot='…']` only reaches design-system components. antd's own tooltips
(`.ant-tooltip-inner`, e.g. the Create Alert help popups) are untouched, which
is why some stories show no diff at all.
- **Global style overrides need `!important`.** `src/styles.scss` loads before
the design system injects its CSS-module styles at runtime, so a plain rule on
a `[data-slot='…']` element loses. A component-level `!important` of the same
specificity still wins over it — `PanelStatusPopover.module.scss` keeps its own
`max-width: 520px !important`.
- **A fresh context per story** is why a full sweep takes ~6 min for 32 stories.
Reusing one page loses the msw service worker re-registration race and stories
start failing after a few navigations.
- **Stories behind a hover, drawer or modal** only render what their `play`
reaches. If a state is missing from the shot, the story needs the `play`, not
All resources are registered in [pkg/types/coretypes/registry_resource.go](/pkg/types/coretypes/registry_resource.go) using constructors like `NewResourceMetaResource(KindDashboard)` or `NewResourceTelemetryResource(KindLogs)`.
### Telemetry resources and metaresources
Almost every feature resource is one of these two types, and they answer different questions.
- A **telemetry resource** (`logs`, `traces`, `metrics`, `meter-metrics`, `audit-logs`) is the data itself. It only supports `read`. Its selector is not an ID but the query: the route wires a `TelemetryResourceDef` whose extractor turns the caller's filter into `<query_type>/<key>/<value>` IDs, and the check ladders each one through `<query_type>/<key>/*`, `<query_type>/*` and `*`. A grant such as `builder_query/signoz.workspace.key.id/key-a` therefore decides which rows a role may read; a query that does not pin a granted key resolves to `<query_type>/*` and is denied for key-scoped roles. Managed roles hold `*`.
- A **metaresource** (`dashboard`, `rule`, `logs-field`, ...) is an object that describes or configures the system. It supports whichever of `create`, `read`, `update`, `delete` and `list` the resource declares, its selectors are object IDs or `*`, and routes wire a `BasicResourceDef`. It says nothing about rows: `dashboard:read` on `*` does not grant the telemetry a dashboard's panels query.
The metrics explorer uses both on one surface:
| Route | Resource | Why |
|---|---|---|
| `POST /api/v2/metrics/stats` | `metrics:read` (telemetry) | Returns sample and series counts, i.e. the data. The selector comes from `filter.expression`, so a role scoped to a workspace key sees only its own samples. |
| `GET /api/v2/metrics` | `metrics-field:list` (meta) | Lists metric names, types and units: the catalogue, not the samples. |
| `POST /api/v2/metrics/metadata` | `metrics-field:update` (meta) | Edits a metric's type, unit and description. |
The two are independent: a role holding `metrics-field``list` and `read` can browse the catalogue but cannot read a sample, and a role scoped to `builder_query/signoz.workspace.key.id/key-a` on `metrics` can query its samples but cannot list the catalogue.
For a new route, ask what it returns. Rows or aggregates over them go on the signal's telemetry resource with an extractor; anything that names, describes or configures telemetry goes on a metaresource.
### Selector
A `Selector` identifies *which* instance(s) of a resource a check is about — a UUID, a role name, or the wildcard `*`. A `SelectorFunc` maps the extracted resource ID to selectors at request time. Two prebuilt ones cover most routes ([pkg/types/coretypes/selector.go](/pkg/types/coretypes/selector.go)):
@@ -142,6 +161,7 @@ Because both paths go through the same middleware and the same `ResourceDef` dec
## What should I remember?
- Declare authz in the registries ([pkg/types/coretypes](/pkg/types/coretypes)), not in migrations — tuples for new organizations are derived from code at bootstrap.
- Telemetry resources are the data: `read` only, selector derived from the query. Metaresources are objects about the data: CRUD and list, ID or wildcard selectors. A route that returns rows or aggregates is telemetry; one that names or configures them is meta, as `metrics` versus `metrics-field` shows.
- A new kind never needs an OpenFGA schema change; only a new type does, and then **both** [pkg/authz/openfgaschema/base.fga](/pkg/authz/openfgaschema/base.fga) and [ee/authz/openfgaschema/base.fga](/ee/authz/openfgaschema/base.fga) must be updated together.
- Prefer `CheckResources` + `ResourceDef` over the coarse `ViewAccess`/`EditAccess`/`AdminAccess` gates for new routes.
- Use `WildcardSelector` for `create`/`list`, `IDSelector` for instance operations, and a custom `SelectorFunc` when the request ID is not the FGA selector.
Where each source key in the shipped definitions under `pkg/modules/spanmapper/implspanmapper/fs/definitions/` comes from. A group runs on spans with an attribute key containing one of its condition substrings; sources are tried by priority and the first present wins; an existing target is never overwritten. Bump `version` on every change.
## gen_ai.llm
Condition: `model`, `llm.input_messages` (OpenInference sets `llm.model_name` from the response, so a failed call has no model key).
Condition: `tool.name` (OpenInference), `ai.toolCall.` (Vercel, Mastra), `tool_call_args`, `tool_response` (Google ADK), `tool_use_id` (Claude Code, opentelemetry-hooks). Not `tool_name`: Codex records it on the model call span.
Every integration under [signoz.io/docs/llm-observability](https://signoz.io/docs/llm-observability/) was checked by looking at the instrumentation its page installs and the keys that instrumentation writes.
- Most pages install OpenInference or OpenLLMetry, or an SDK that writes OTel GenAI semconv itself (OpenAI, OpenAI Agents, Pydantic AI, AutoGen, Microsoft Agent Framework, Semantic Kernel, Copilot Chat, LiteLLM, OpenRouter). Their keys are the rows above.
- Three write their own keys and have their own rows: Claude Code and Claude Agent SDK, Cursor through opentelemetry-hooks, vLLM (response model only).
- Codex cannot be priced by renaming: `model` sits on the sampling function spans, `gen_ai.usage.*` on the child `handle_responses` span, `conversation.id` on the `codex.sampling` phase span, never together on one span.
To check a new integration, capture a trace and look for a model, usage, tool or messages key that no row above lists.
## Left unmapped on purpose
LiteLLM `llm.openai.messages` and `llm.openai.choices` (debug echo of the parent span's messages, Python repr). Total tokens and vendor cost keys (no target; the pricing processor owns cost). `ai.response.msToFirstChunk` and `gen_ai.latency.time_to_first_token` (milliseconds and seconds under one target).
@@ -84,9 +84,9 @@ A storage answers four questions and nothing else:
| WhenAbsent | Absent row reads | Positive filter | Raw select | Multi-candidate column | Field keys |
|---|---|---|---|---|---|
| `AlwaysPresent` | a real value | no guard | no guard | no branch, ends the candidate list | table columns |
| `AbsentIsSentinel` | `''`, 0, false, and that is not a value | exists guard | exists guard | presence branch | map attributes, cast JSON paths, string families |
| `AbsentIsSentinel` | `''`, 0, false, and that is not a value | exists guard | exists guard | presence branch | map attributes, cast JSON paths, string families of such members |
| `AbsentIsNull` | NULL | no guard | no guard | presence branch | multi-era folds, body JSON paths, numeric families |
| `AbsentIsValue` | `''`, and that is the keyless contract | no guard | no guard | no presence branch | metrics labels, rule state history labels |
| `AbsentIsValue` | `''`, and that is the keyless contract | no guard | no guard | no presence branch | metrics labels, rule state history labels, and families of such members |
### The generic layer
@@ -109,7 +109,7 @@ The functions, from the outside in:
| `RejectsBodyFunction(traits, operator)` | Runs before resolution. A storage without body functions (`has`, `hasAny`, `hasAll`, `hasToken`, `search`) errors. The fingerprint side of a split skips the term, because the main query evaluates it. After resolution, `Condition` errors when `has`, `hasAny`, `hasAll`, or `hasToken` lands on a map-backed key (resource, attribute, scope), before the split can drop it. |
| `SharedCondition(...)` | The `Compile` of every storage without its own condition language: `LogicalRead`, the shared data-type collision cast, `OperatorCondition`, then the guard rule. |
| `OperatorCondition(...)` | The operator switch over an already cast read. A storage with its own cast policy composes with it. |
| `LogicalRead(...)` | The only place family expressions are built. A single-member field reads through its member. A family merges the member reads, current member first: `COALESCE(NULLIF(m1, ''), NULLIF(m2, ''), '')` for strings, `multiIf` with a NULL tail for numbers. It ORs the member presence tests. A row without any member reads what the tail of the merge reads. A member with a value map reads through `TransformRead`. `NOT EXISTS` is the read's `Absence`, the storage's own negated form. |
| `LogicalRead(...)` | The only place family expressions are built. A single-member field reads through its member. A family merges the member reads, current member first: `COALESCE(NULLIF(m1, ''), NULLIF(m2, ''), '')` for strings, `multiIf` with a NULL tail for numbers. It ORs the member presence tests. A row without any member reads what the tail of the merge reads. When every member reads its sentinel as a value, so does the family. A member with a value map reads through `TransformRead`. `NOT EXISTS` is the read's `Absence`, the storage's own negated form. |
├── drivers/ # the driver kit and one driver per feature
│ ├── kit.ts
│ └── routing.ts
├── fixtures/ # Playwright test fixtures (test.extend) only
│ └── auth.ts
├── helpers/ # function helpers + the constants they share with tests
@@ -112,6 +115,24 @@ These two folders look similar but mean different things:
Rule of thumb: if it's a `test.extend` fixture, put it in `fixtures/`. If it's a function you call explicitly (or a constant the function uses), put it in `helpers/`. If it's a static file the helpers read, put it in `testdata/`.
### Drivers
New suites use a driver rather than loose helpers. A driver is a function that closes over the page and returns the feature's actions and locators. `drivers/kit.ts` turns it into a fixture, so a spec imports one module and never passes a `page` around:
-`driver(name, build)` adds a test-scoped fixture built on `authedPage`.
-`seeded(name, open, close)` adds a worker-scoped seed. `open` and `close` run on a throwaway admin page.
- A driver reuses helpers by calling them, never by reaching for another fixture.
-`drivers/` is AI-owned: coding agents generate and maintain it with the specs, and `.gitattributes` collapses it in diffs.
### Extended fixtures
For features needing complex setup (API-seeded data, ruler evaluation waits, cleanup), create domain-specific fixtures that extend `auth`. Group them in `fixtures/<domain>/`.
"message":"[dashboard-v2] Don't call patchDashboardV2/usePatchDashboardV2 directly — use useOptimisticPatch().patchAsync so spec edits update the react-query cache optimistically and reconcile on settle."
},
{
"name":"motion/react-client",
"message":"[motion] motion/react-client is for React Server Components only. Use 'motion/react' instead — it provides the same exports and works correctly in client-side SPAs."
}
]
}
@@ -580,14 +581,13 @@
}
},
{
// Dev-tooling CLIs: stdout is their output, and they carry ported pixel/heap
// algorithms that read worse when split up.
// TypeScript reports real redeclarations; this rule also flags `const X` + `type X` pairs.
@@ -25,6 +25,7 @@ You are operating within a constrained context window and strict system prompts.
- Never create barrel files.
- When writing new css, prefer CSS Modules
- Use ./docs/css-modules-guide.md as reference on how to write good CSS Modules.
- Before styling a `@signozhq/ui` component, check its props in `node_modules/@signozhq/ui/dist/<component>/*.d.ts` for `className`/`style` support; some omit them. Avoid overriding the component's CSS vars unless explicitly needed.
- When writing code that could need authorization checks, read ./src/lib/authz/README.md
3. FORCED VERIFICATION: Your internal tools mark file writes as successful even if the code does not compile. You are FORBIDDEN from reporting a task as complete until you have:
// The explicit queryKey always wins, matching the previous
// `{ ...query, queryKey }` spread where it was set last.
if(key==='queryKey'){
continue;
}
Object.defineProperty(result,key,{
enumerable: true,
configurable: true,
get:()=>(queryasRecord<string,unknown>)[key],
});
}
returnresult;
};
/**
* This endpoint lists the promoted paths of every JSON column, each annotated with its signal and context. The signal, context, promoted and indexes query parameters filter the listing.
* This endpoint promotes paths of JSON columns to their promoted columns. Each path names its promotion target with its signal and context, e.g. traces/attribute.
* This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.
* This endpoint creates a new alert rule from the stored definition of an existing one. The clone keeps every modeled field of the source, including its enabled/disabled state, and gets the source's name suffixed with " - Copy" (or a bumped " - Copy (n)" counter when the source is itself a copy). The clone is owned by the caller.
* Returns the gen_ai spans of a trace, model calls, tool calls and agent spans, in timestamp order. The messages a span carries are decoded into formattedInput and formattedOutput, with formatterWarnings holding what the converter could not resolve; a span without messages has both empty. Pass nextCursor as after or prevCursor as before to page, or spanId to open the page around a span.
* Returns the waterfall view of spans including all spans if total spans are under a limit, a max count otherwise. Aggregations are dropped compared to v3
* Returns the waterfall view of spans including all spans if total spans are under a limit, a max count otherwise. Aggregations are dropped compared to v3. A span carrying gen_ai input or output messages also has them decoded into formattedInput and formattedOutput, with formatterWarnings holding what the converter could not resolve.
// Badges fill their wrapper; the wrapper, as the flex item, owns the cap.
--badge-max-width:100%;
position:relative;
display:flex;
gap:4px;
align-items:center;
overflow:hidden;
max-width:100%;
width:100%;
>*{
flex-shrink:0;
max-width:180px;
}
}
.labelBadge{
cursor:default;
font-size:12px;
// Kept mounted so its width can still be measured.
.overflowed{
position:absolute;
visibility:hidden;
pointer-events:none;
}
--badge-display:inline;
max-width:180px;
text-overflow:ellipsis;
// The only visible label truncates instead of pushing `+N` out of view.
.labelColumn>.shrinkable{
flex-shrink:1;
min-width:0;
}
.overflowTrigger{
@@ -22,11 +34,6 @@
cursor:pointer;
}
.overflowBadge{
cursor:pointer;
font-size:12px;
}
.labelPopover{
display:flex;
flex-direction:column;
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.