fix(security): rebase the gascity SSO patch onto @hyperdx/app@2.42.0; stop the proxy secret leaking to logs and the ClickHouse proxy

.claude/skills/data-source-icons/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: data-source-icons
+description: Use the correct Tabler icon for each HyperDX data source kind (Log, Trace, Session, Metric, PromQL). Use whenever adding or changing an icon that represents a source kind or a signal type — source selectors, side panels, cross-source actions like "View Trace", tabs, badges, breadcrumbs, or anywhere a log/trace/session/metric is depicted.
+---
+
+# Data source icons
+
+There is **one canonical icon per source kind**. The source of truth is
+`SOURCE_KIND_ICONS` in
+`packages/app/src/components/sourceSelectUtils.tsx`. Never invent a different
+icon for a source kind (e.g. don't use `IconTimeline` for a trace) — always
+match the table below so icons stay consistent across the app.
+
+## Canonical mapping
+
+| Source kind (`SourceKind`) | Tabler icon      | Meaning                       |
+| -------------------------- | ---------------- | ----------------------------- |
+| `Log`                      | `IconLogs`       | Logs                          |
+| `Trace`                    | `IconConnection` | Traces / spans                |
+| `Session`                  | `IconDeviceLaptop` | Session replay / client sessions |
+| `Metric`                   | `IconChartLine`  | Metrics                       |
+| `Promql`                   | `IconChartLine`  | PromQL metrics (same as Metric) |
+
+All imported from `@tabler/icons-react`.
+
+## Rules
+
+1. **Prefer the shared map.** When you need a source-kind icon in a context that
+   already has (or can accept) a `SourceKind`, use `SOURCE_KIND_ICONS[kind]`
+   from `sourceSelectUtils.tsx` rather than hardcoding an icon component.
+2. **If you must hardcode** (e.g. a fixed "View Trace" action that always points
+   at a trace), import the exact icon from the table above — for a trace that is
+   `IconConnection`, not `IconTimeline`/`IconRoute`/etc.
+3. **Sizing**: the shared map uses `size={16}`. Match the surrounding UI; small
+   inline buttons/badges commonly use `14`.
+4. **Adding a new source kind**: update `SOURCE_KIND_ICONS` first, then update
+   this table so the two never drift.
+
+## Examples
+
+Cross-source "View Trace" action (fixed target → hardcode the trace icon):
+
+```tsx
+import { IconConnection } from '@tabler/icons-react';
+
+<Button leftSection={<IconConnection size={14} />}>View Trace</Button>;
+```
+
+Dynamic, kind-driven icon (prefer the shared map):
+
+```tsx
+import { SOURCE_KIND_ICONS } from '@/components/sourceSelectUtils';
+
+<span>{SOURCE_KIND_ICONS[source.kind]}</span>;
+```

.claude/skills/naming-objects/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: naming-objects
+description:
+  Name user-created objects (dashboards, saved searches, tiles, alerts) with the
+  shared InlineNameInput. Use when adding or changing the place where a user
+  names or renames something, building an editor or page header that shows an
+  object's name, or when tempted to add a pencil edit button, a "Name" field in
+  a save modal, or a bordered name TextInput.
+---
+
+# Naming objects
+
+Read **`agent_docs/naming_objects.md`** before changing how something is named.
+It is the source of truth; this skill is the short version.
+
+## Quick rules
+
+1. Use `InlineNameInput` / `InlineNameInputControlled` from
+   `@/components/InlineNameInput/InlineNameInput`. Never build a separate
+   click-to-edit title, pencil button, or "Save name" button.
+2. **Saved object shown on its page** → `InlineNameInput` with `onCommit`. Enter
+   or blur saves immediately; Escape and empty names revert.
+3. **Draft in an editor** → `InlineNameInputControlled` with the form's
+   `control`. The name saves with the editor's save button.
+4. Sizes are `xs`, `sm`, `md` only. Page titles use `size="md"` with
+   `headingLevel={3}`. Editor headers use `size="sm"` (default). Compact rows
+   use `size="xs"`.
+5. Always set `aria-label` ("Dashboard name") and an "Untitled …" placeholder in
+   sentence case ("Untitled tile").
+6. Don't ask for a name inside a save modal. Name inline, then save.
+7. In tests, assert the name with `toHaveValue`. In E2E, `fill()` then press
+   Enter.
+
+## Workflow
+
+1. Read `agent_docs/naming_objects.md`.
+2. Look at the reference usages: `DBDashboardPage.tsx` (dashboard name) and
+   `DBSearchPage.tsx` (saved search name).
+3. Check the stories in Storybook under **Components/InlineNameInput**.
+4. Update E2E page objects that read the name as text.
+5. Run `yarn lint:fix` in the repo root.

.claude/skills/page-layout/SKILL.md

@@ -40,5 +40,5 @@ import { PageLayout } from '@/components/PageLayout';
 | List page | `AlertsPage.tsx` | `PageHeader` + `title` + `Container` (no inputs in header) |
 | Tool page with inputs + hierarchy | `KubernetesDashboardPage.tsx`, `ClickhousePage.tsx` | `PageLayout` **without** `title`; **`breadcrumbs`** + `leading` + `actions` in one sticky header |
 | Tool page (top-level) | `DBServiceMapPage.tsx` | `PageLayout` **without** `title`; `leading` / `actions` only; no duplicate breadcrumb unless you add a real hierarchy |
-| Custom toolbar | `SessionsPage.tsx` | `PageLayout` + `header` = custom `PageHeader` `children` (single-row inputs, no `title`) |
+| Custom toolbar | `SessionsPage.tsx` | `PageLayout` + `header` = custom `PageHeader` `children` with `growing` (single-row inputs, no `title`) |
 | Custom title | `TeamPage.tsx` | `PageHeader` with `children` only |

.config/wt.toml

@@ -5,11 +5,9 @@
 # hooks that run when creating/switching/removing worktrees via `wt`.
 
 # ---------------------------------------------------------------------------
-# pre-start: blocking — symlink node_modules from primary worktree for
-# instant dependency access. If the branch needs different deps:
-#   rm node_modules && yarn install
+# pre-start: install dependencies so app is ready to run
 # ---------------------------------------------------------------------------
-pre-start = "ln -sf {{ primary_worktree_path }}/node_modules {{ worktree_path }}/node_modules"
+pre-start = "yarn install"
 
 # ---------------------------------------------------------------------------
 # post-start: background tasks

.cursor/rules/ui-sentence-case.mdc

@@ -0,0 +1,37 @@
+---
+description: Enforce sentence case (not Title Case) for user-facing UI text in the app
+globs: packages/app/src/**/*.tsx
+alwaysApply: false
+---
+
+# UI text: sentence case
+
+All user-facing text uses **sentence case** — capitalize only the **first word**
+and any proper nouns/acronyms. Never use Title Case. Applies to labels, buttons,
+tab/menu items, headings, modal/section titles, placeholders, tooltips, table
+column headers, empty states, and toast copy.
+
+```tsx
+// ❌ BAD — Title Case
+<Text>Data Source</Text>
+<TextInput label="Chart Name" />
+<Button>Add Series</Button>
+<Menu.Item>Delete Dashboard</Menu.Item>
+
+// ✅ GOOD — sentence case
+<Text>Data source</Text>
+<TextInput label="Chart name" />
+<Button>Add series</Button>
+<Menu.Item>Delete dashboard</Menu.Item>
+```
+
+**Preserve proper nouns, product names, and acronyms** wherever they appear —
+sentence case only touches the surrounding words: HyperDX, ClickHouse,
+ClickStack, OpenTelemetry/OTel, Lucene, SQL, PromQL, MongoDB, Kubernetes, JSON,
+CSV, URL, ID, API, MCP, CPU, P95. E.g. `Search your events w/ Lucene`,
+`Edit SQL`, `View in ClickHouse`.
+
+Only sentence-case **static UI chrome**. Render dynamic/user data (column names,
+tag values, log/trace content, user-typed source/dashboard names) verbatim.
+
+Source of truth: `agent_docs/code_style.md` → "UI text: use sentence case".

.env

@@ -8,8 +8,8 @@ NEXT_ALL_IN_ONE_IMAGE_NAME_DOCKERHUB=clickhouse/clickstack-all-in-one
 ALL_IN_ONE_IMAGE_NAME_DOCKERHUB=hyperdx/hyperdx-all-in-one
 NEXT_OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB=clickhouse/clickstack-otel-collector
 OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB=hyperdx/hyperdx-otel-collector
-CODE_VERSION=2.28.0
-IMAGE_VERSION_SUB_TAG=.28.0
+CODE_VERSION=2.42.0
+IMAGE_VERSION_SUB_TAG=.42.0
 IMAGE_VERSION=2
 IMAGE_NIGHTLY_TAG=2-nightly
 IMAGE_LATEST_TAG=latest
@@ -27,6 +27,16 @@ HYPERDX_APP_URL=http://localhost
 HYPERDX_LOG_LEVEL=debug
 HYPERDX_OPAMP_PORT=${HYPERDX_OPAMP_PORT:-4320}
 HYPERDX_BASE_PATH=
+# Comma-separated hostnames or exact IP literals that may receive webhooks.
+# Domain entries also permit their subdomains; IP entries are exact matches.
+WEBHOOK_HOSTNAME_ALLOWLIST=
+# 32-byte key (base64 or hex) that encrypts stored Slack and OAuth tokens.
+# Generate with `openssl rand -base64 32`. Unset means plain text.
+TOKEN_ENCRYPTION_KEY=
+
+# Generate once with openssl rand -hex 32; reuse across restarts and replicas.
+# Configure in .env.local with docker compose --env-file .env --env-file .env.local up -d.
+# EXPRESS_SESSION_SECRET=
 
 # Docker service ports (overridden by scripts/dev-env.sh for isolation)
 HDX_DEV_MONGO_PORT=27017
@@ -41,8 +51,8 @@ HDX_DEV_OTEL_JSON_HTTP_PORT=14318
 # Otel Collector version (used as Docker build arg for image tags and component versions)
 # When bumping, look up the core version from the upstream manifest:
 # https://github.com/open-telemetry/opentelemetry-collector-releases/blob/main/distributions/otelcol-contrib/manifest.yaml
-OTEL_COLLECTOR_VERSION=0.149.0
-OTEL_COLLECTOR_CORE_VERSION=1.55.0
+OTEL_COLLECTOR_VERSION=0.155.0
+OTEL_COLLECTOR_CORE_VERSION=1.61.0
 
 # Otel/Clickhouse config
 HYPERDX_OTEL_EXPORTER_CLICKHOUSE_DATABASE=default

.github/ISSUE_TEMPLATE/bug-report.md

@@ -0,0 +1,63 @@
+---
+name: Bug report
+about: Something in HyperDX is broken or behaving unexpectedly
+title: ''
+labels: bug, Needs Feedback
+---
+
+**What happened?**
+
+<!-- What you saw, and what you expected instead. -->
+
+**Steps to reproduce**
+
+<!--
+Please check whether this reproduces on https://play.hyperdx.io (demo data) and
+paste the URL if it does. If you're working from the repo, `yarn app:dev:local`
+plus onboarding → "Connect to Demo Server" gives you the same data locally. If
+it only happens with your own data, include the table schema
+(`SHOW CREATE TABLE ...`) and source settings.
+See https://github.com/hyperdxio/hyperdx/blob/main/CONTRIBUTING.md#reproducing-issues-and-prs
+-->
+
+**Reproduces on play.hyperdx.io?** <!-- yes (link) / no / didn't try -->
+
+1.
+2.
+3.
+
+**How are you running HyperDX?**
+
+<!--
+The all-in-one Docker image, Docker Compose, Helm, ClickHouse Cloud, or a local
+dev stack — and which version or image tag. If you brought your own ClickHouse,
+say which version.
+-->
+
+**Where does it show up?**
+
+<!--
+The UI (which page, and which browser), the API, the OpenTelemetry collector, or
+the CLI. A screenshot or a short video helps a lot for UI bugs.
+-->
+
+**Debug info**
+
+<!--
+For UI bugs, please include this — it saves a lot of back-and-forth. Open the
+Help menu (bottom-left of the app) and click "Copy debug info", then paste the
+block below. It captures versions, deployment mode, browser, and session id; no
+API keys or query params are included. Skip it if you're only hitting the
+collector or CLI (write N/A).
+-->
+
+```
+(paste Help → Copy debug info here)
+```
+
+**Logs**
+
+<!--
+Anything relevant from the browser console, the API container, or the collector.
+Please redact API keys and connection strings.
+-->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,13 @@
+# Blank issues are disabled so every issue starts from a template and picks up
+# the `Needs Feedback` label. Use the templates or the links below.
+blank_issues_enabled: false
+contact_links:
+  - name: Questions & help
+    url: https://discord.gg/FErRRKU78j
+    about:
+      For usage questions, setup help, and general discussion, ask on Discord.
+  - name: First-time contributor?
+    url: https://github.com/hyperdxio/hyperdx/blob/main/CONTRIBUTING.md#getting-vouched
+    about:
+      No need to open an issue to get vouched. Open your pull request and a
+      maintainer vouches from there.

.github/ISSUE_TEMPLATE/feature-request.md

@@ -0,0 +1,29 @@
+---
+name: Feature request
+about: Suggest an idea or improvement for HyperDX
+title: ''
+labels: enhancement, Needs Feedback
+---
+
+**What are you trying to do?**
+
+<!-- The problem or use case, not just the solution. What's getting in your way today? -->
+
+**What would you like to see?**
+
+<!-- Your proposed change or behaviour. Rough is fine — we'll figure out the details together. -->
+
+**Alternatives you've considered**
+
+<!-- Workarounds you're using now, or other approaches you thought about. -->
+
+**Anything else?**
+
+<!-- Screenshots, mockups, links, or where in HyperDX this fits (UI, API, collector, CLI). -->
+
+---
+
+New issues start as `Needs Feedback` so we can discuss scope before anyone
+writes code. Once a maintainer swaps that for `Accepting PR`, the issue is ready
+to be picked up — see
+[CONTRIBUTING.md](https://github.com/hyperdxio/hyperdx/blob/main/CONTRIBUTING.md#from-issue-to-pull-request).

.github/VOUCHED.td

@@ -0,0 +1,89 @@
+# Vouched contributors for hyperdxio/hyperdx.
+#
+# Pull requests from GitHub users who are not in this list are closed
+# automatically by .github/workflows/vouch.yml. See CONTRIBUTING.md for how to
+# get vouched — it is deliberately easy.
+#
+# Org members and anyone else with write access are allowed regardless of this
+# list. The team is listed anyway so the file reads as a complete roster.
+#
+# Maintainers manage the list by commenting on any issue or PR:
+#   /vouch @user [reason]
+#   /denounce @user [reason]
+#   /unvouch @user
+#
+# Syntax (https://github.com/mitchellh/vouch):
+#   - One handle per line, without @, sorted alphabetically, lower case.
+#     Vouch lower-cases handles when it rewrites the file, and matching is
+#     case-insensitive, so seeding lower-case keeps bot edits to one line.
+#   - Denounce with a leading minus: -username [reason]
+#   - Optional platform prefix: github:username
+#
+# Seeded from the hyperdxio org plus every external contributor with two or
+# more merged pull requests as of August 2026.
+#
+# copilot is listed because vouch only auto-exempts logins ending in "[bot]".
+# GitHub's Copilot coding agent has the login "Copilot", so without an entry
+# its PRs would be closed.
+28hus
+adityapimpalkar
+alex-fedotyev
+alok87
+archat-hash
+arj22
+aryainguz
+bahltushar
+bilalatique
+brandon-pereira
+colehpage
+copilot
+dhable
+dkong16
+elizabetdev
+ernestii
+eugeneo17
+fallintoplace
+fleon
+gingerwizard
+gyancr7
+harshul1484
+hercynium FIPS fix for #3390
+jaggederest
+jeyrathnam
+jordan-simonovski
+juliojimenez
+jwhitaker-gridcog
+karl-power
+knudtty
+krishs01
+kyle-mally-ch
+leticiawebb
+lyhuang
+mark-omarov
+martincholuj
+mfa-g
+michael-anastasakis
+mikeshi42
+milansanjeev
+mkaesz
+motsc
+niladrix719
+peter-leonov-ch
+pttydou wants to improve FE type safety
+pulpdrew
+rawatprince
+rip21
+sanjams2
+shuvamk
+spencertorres
+squaredg
+teeohhem
+tommyzli
+tsushanth
+tyagiquamar
+tylerhannan
+vineethasok
+vinzee
+wrn14897
+zeynelkoca
+zlareb1