hyperdxio/hyperdx @hyperdx/api@2.41.0

on GitHub

Minor Changes

• 76d33d7: The API no longer falls back to the public session secret hyperdx is cool 👋.
  If EXPRESS_SESSION_SECRET is unset, the API generates a random secret and
  reports it once at startup when authentication is enabled. Authenticated
  deployments that explicitly set the old public value also get a random secret
  and the same warning; the public value remains available only in the no-auth
  local demo. Set it to a random string (openssl rand -hex 32) in any deployment
  with authentication enabled — without it, restarting the API signs every user
  out, and replicas do not share sessions.

• d8b1cdf: feat: Attribute PromQL queries to the dashboard, tile or search that issued them, through both the prometheusQuery/prometheusQueryRange table functions and ClickHouse's Prometheus HTTP API

• ab70324: feat: attribute ClickHouse queries to the dashboard, tile, search or alert that
  issued them

  A row in system.query_log previously couldn't be attributed to the part of
  HyperDX that produced it. Now every query HyperDX runs has a small JSON
  log_comment, plus a query_id starting with hdx-.

  Attribute load after the fact:

  SELECT
      JSONExtractString(log_comment, 'surface') AS surface,
      JSONExtractString(log_comment, 'dashboard') AS dashboard,
      JSONExtractString(log_comment, 'tile') AS tile,
      count(),
      sum(read_rows)
  FROM system.query_log
  WHERE type = 'QueryFinish' AND log_comment != '' AND query_id like 'hdx-%'
  GROUP BY ALL
  ORDER BY sum(read_rows) DESC

  Or spot a query while it is still running, in system.processes, where the
  query_id names the surface with no JSON parsing needed.

  The payload records which part of the product asked (a dashboard, a search, an
  alert, an MCP tool, the chart explorer, session replay, field lookups, and so
  on), the dashboard and tile or saved search id, the source id, and on the server
  the trace id of the request. Field lookups and autocomplete are labelled too, so
  they can be told apart from a user's chart queries.

  The exception is queries that skip settings processing: the system.settings,
  server version and Cloud-detection probes, and the onboarding connection check.
  They get a query_id but an empty log_comment.

• 68082b6: feat: add stacked line (stacked area) time-series display type

Patch Changes

• 14003f0: feat: upgrade the AI SDK to v7 and trace AI calls with GenAI semantic conventions

  AI assistant calls now emit OpenTelemetry spans that follow the GenAI semantic conventions (invoke_agent / chat / execute_tool spans with gen_ai.* attributes) instead of the legacy ai.* span shape. Team and user attribution moves from ai.telemetry.metadata.* to hyperdx.team.id and user.id (plus gen_ai.conversation.id when a session is known). Saved searches, alerts or dashboards keyed on the old ai.* span names or attributes need updating.

• 07c9365: fix: cast FixedString columns before implicit hasToken search

  A bare search term against a FixedString column such as OTel TraceId compiled to
  hasToken(lower(TraceId), ...), which ClickHouse rejects. Those haystacks are now
  CAST to String first.

• 6873416: feat: Add a series mode to builder heatmaps

• 0b85553: fix: fall back to the Map key scan when the text index read fails

  getMapKeys returned an empty list whenever its mergeTreeTextIndex query
  failed, so the rollup and bounded mapKeys scan paths never ran. ClickHouse
  refuses mergeTreeTextIndex with ACCESS_DENIED on any table with a row
  policy, which left search autocomplete with no Map keys on those tables. A
  failed text index read now falls through to the next strategy. After a row
  policy denial it skips the key rollup table, which the policy doesn't cover,
  and reads keys only from the policy-filtered source table.

• c2e21cf: fix(mcp): return partial clickstack_describe_source results on timeout

  The describe deadline is raised from 10s to 30s to match the other MCP query
  tools. When it is hit, the tool now returns the schema and samples gathered so
  far, flagged partial with skippedStages, instead of failing outright. It
  only returns a timeout error if the column schema never loaded.

• cf5b831: perf(mcp): speed up clickstack_list_metrics and give the metric discovery
  tools a 30s budget

  clickstack_list_metrics now scans metric names only (about 9x fewer bytes read
  per kind), fetches unit and description just for the returned page, and scans
  kinds in parallel. When the time budget runs out it returns the kinds that
  finished, reports the rest in partialFailure, and returns a nextCursor that
  resumes at the timed-out kind instead of failing the whole call. It also no
  longer drops later kinds when one kind exactly fills a page.
  clickstack_list_metrics and clickstack_describe_metric now allow 30s instead
  of 10s, matching the other MCP query tools.

• 7aeb621: refactor(mcp): share wall-clock timeout handling across MCP tools via
  runWithTimeout, and source the 30s ClickHouse query cap from one constant.

• 6ea5f52: feat: only provision a default PromQL source when PromQL is enabled

  DEFAULT_SOURCES entries of kind promql are now skipped unless
  ENABLE_PROMQL=true, so a single sources list can include a PromQL source
  without creating it on deployments that have PromQL turned off.

• ff5befa: Support "Minimum auto granularity" on PromQL sources. It floors the step of charts on auto granularity, as it does for metric sources, and $__rate_interval now uses it as the source's scrape interval (still 15s when unset) instead of always assuming 15s. A granularity picked on a tile is never changed.

• 1be9de8: feat: Add a promql variable format that escapes based on single/multi-select

• 837c683: feat: Support series mode heatmap in API and MCP

• 0d2425d: feat: Allow configuring dashboard filters as single-select

• 1ce8b88: fix: rank Map keys by frequency when a text index serves key discovery

  The two mergeTreeTextIndex paths in getMapKeys grouped keys and applied
  LIMIT maxKeys with no ORDER BY, so on a column with more keys than the
  limit the filter sidebar showed an arbitrary subset. They now order by
  sum(cardinality) DESC, key, which keeps the most frequent keys, as the key
  rollup path already does with sum(count) DESC.

• e88cf3d: fix(mcp): time-limit the clickstack_trace_top_time_consuming_operations tool.
  Its queries now use the MCP request timeout and max_execution_time ceiling,
  which a source's querySettings can no longer override. A timeout returns
  guidance to shorten the window or narrow parentFilter instead of an "invalid
  SQL" hint, and the client-side Timeout error. now gets the timeout hint in
  every MCP tool. Sources with a multi-column timestampValueExpression
  (including a leading Date column such as EventDate, EventTime) now return
  correct breakdowns.

• Updated dependencies [07c9365]

• Updated dependencies [6873416]

• Updated dependencies [0b85553]

• Updated dependencies [0846f3b]

• Updated dependencies [e61461b]

• Updated dependencies [ff5befa]

• Updated dependencies [d8b1cdf]

• Updated dependencies [1be9de8]

• Updated dependencies [ab70324]

• Updated dependencies [0d2425d]

• Updated dependencies [68082b6]

• Updated dependencies [1ce8b88]

  • @hyperdx/common-utils@0.31.0