- Remove UploadBundleRequest, UploadBundleResponse classes (ApiModels.cs)
- Remove UploadBundle API endpoint constant (Constants.cs)
- Remove GetBundleUploadUrlAsync method (BackendApiClient.cs) — no callers anywhere
- Fix HardwareInfo: Lenovo devices report the marketing model name in
Win32_ComputerSystemProduct.Version, not Win32_ComputerSystem.Model;
add Lenovo-specific WMI fallback for correct model string
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add /api/diagnostics/upload-url to anonymous routes in AuthenticationMiddleware so the
new device-cert-authenticated endpoint is not blocked by the JWT middleware
- Add DiagnosticsUploadResult value object to DiagnosticsPackageService carrying BlobName,
SasUrlPrefix (truncated, safe to log), and ErrorCode
- Change CreateAndUploadAsync return type to DiagnosticsUploadResult for richer error context
- Add BuildSasUrlPrefix helper to produce a safe truncated URL for event data
- Change UploadToBlobStorageAsync to return (bool success, string errorCode) tuple
- Update MonitoringService to populate sasUrl and errorCode in diagnostics_upload_failed
event data dict for visible timeline diagnostics
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Instead of inline banners on the settings page, expired or near-expiry
SAS URLs now fire a persistent warning/error notification to the bell icon.
The notification includes a direct "View" link to /settings#diagnostics.
NotificationContext: added optional href field to Notification; addNotification
signature extended with href parameter for both keyed and unkeyed paths.
Navbar: notifications with href render a "View" link that marks the
notification as read and navigates to the target anchor.
Settings: removed inline SAS warning banners; addNotification called on
config load when expiry <= 7 days (warning) or expired (error); diagnostics
section gets id="diagnostics" anchor for deep-linking.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Instead of delivering the long-lived SAS URL in the agent config response
(where it was cached on disk for the full enrollment period), the agent now
requests a short-lived URL via POST /api/diagnostics/upload-url just before
uploading — the URL is held in memory only and never written to config.
Backend: new GetDiagnosticsUploadUrlFunction with same cert/hardware
security validation as all other agent endpoints; GetAgentConfigFunction
now sends DiagnosticsUploadEnabled (bool) instead of the SAS URL;
ConfigVersion bumped to 6.
Agent: BackendApiClient.GetDiagnosticsUploadUrlAsync added;
DiagnosticsPackageService fetches URL on-demand via the API client;
AgentConfiguration.DiagnosticsBlobSasUrl replaced by DiagnosticsUploadEnabled.
UI: settings page parses SAS URL expiry (se= param) and shows expiry date
inline with colour coding; expired or near-expiry URLs trigger
error/warning notifications at the top of the page on load.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add missing globals.css overrides: text-purple-900, text-sky-900,
text-emerald-900, text-rose-900, bg-rose-50, border-rose-200,
divide-gray-100 (row dividers)
- Refactor SettingsGroup: split color prop into color + borderColor so
the outer border renders with an explicit dark-aware color class
- Add bg-white to SettingsRow and Danger Zone body so they pick up the
global .dark .bg-white override correctly
- Change default text in SettingsRow to text-gray-500 (already has dark
override) instead of text-gray-400
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Informs users that rules are being actively validated and changed,
occasional redeploys and inconsistent analysis results are expected.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove ANALYZE-ESP-002 (Security Policy Application Failure): too many
false positives, the pattern matched unrelated EnforcementState events
- Disable ANALYZE-CORR-001 (Slow Network) by default: download_progress
events don't reliably indicate slow network, needs rethinking
- Disable ANALYZE-APP-009 (App Download Stalled) by default: relies on
download_progress.status=failed which doesn't reflect actual stall
- Rename ANALYZE-APP-002 from "MSI Installation Error" to "App Installation
Error": broadens scope, removes CCM/SCCM log reference (Intune-only),
points to IME logs instead
- Also include Enabled in auto-update comparison so Enabled=false changes
propagate to existing tenants on next seed check
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GetRuleResultsFunction was ignoring the tenantId query parameter and
always using the tenant from the JWT token. As a result, a Galactic
Admin viewing another tenant's session would get 'No events found'
because the data was stored under the session's tenant, not the admin's.
Now follows the same pattern as GetSessionEventsFunction:
- Read tenantId from query parameter (sent by the frontend as effectiveTenantId)
- Fall back to JWT tenant if not provided
- Allow cross-tenant access only for Galactic Admins (403 otherwise)
- Use the effective tenant ID for all storage calls and rule engine runs
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Previously, AnalyzeSessionAsync always loaded existing results and
skipped rules already evaluated (deduplication check). The reanalyze
flag from the API endpoint was never passed through, so clicking
"Analyze Now" only returned cached results.
Fix:
- Add `reanalyze` parameter to `AnalyzeSessionAsync`; when true, skip
deduplication so all active rules evaluate against the full event stream
- In GetRuleResultsFunction, pass reanalyze=true and delete stale stored
results before writing the fresh evaluation output
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- RuleCondition interface gains 6 optional fields:
correlateEventType, joinField, timeWindowSeconds,
eventAFilterField, eventAFilterOperator, eventAFilterValue
- SOURCES constant adds event_correlation
- Condition editor renders extra fields when source=event_correlation:
Event B type, join field, time window, Event A filter row
(shown in indigo-tinted card with a correlation badge)
- Form/JSON tab toggle added to both create and edit forms:
Form view: the existing structured editor
JSON view: full rule JSON in a resizable monospace textarea,
with Apply JSON button to sync back to form and inline error display
- handleCreateRule/handleSaveEdit accept optional formOverride so
JSON-mode save bypasses React state async timing
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces the hardcoded app_state_regression source with a generic
event_correlation source that allows correlating any two event types
by a shared field (e.g. appId), with optional time windows and filters
on both events — all configurable via JSON without backend code changes.
RuleCondition gains 5 new nullable properties:
- CorrelateEventType: second event type (Event B)
- JoinField: field to match across both events (e.g. "appId")
- TimeWindowSeconds: max time between Event A and B
- EventAFilterField/Operator/Value: optional filter on Event A
ANALYZE-APP-010 migrated to use event_correlation source.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The previous rule incorrectly matched any app_install_completed event
against any app_install_failed event without correlating by appId.
Changes:
- RuleEngine: add app_state_regression source that finds apps where
app_install_completed is followed by app_install_failed for the same
appId, with optional DataField filter on the failed event; returns
appId, appName, both event details and errorDetail as evidence
- AnalyzeRule: document new app_state_regression source in comment
- ANALYZE-APP-010: rewrite to use single app_state_regression condition
(IME-ERROR-REPORT filter) + enrollment_complete check; evidence now
contains the exact app name and id that regressed
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
New built-in correlation rule that warns when an app transitions from
app_install_completed back to app_install_failed (IME-ERROR-REPORT)
while enrollment itself completes successfully. Includes remediation
steps for investigating EnforcementState changes and detection failures.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove newRuleResults from "newevents" broadcast (never used by list views, saves 3-15KB)
- Replace full SessionSummary with sessionUpdate delta DTO in "newevents" (only mutable fields)
- Strip redundant sessionId/tenantId from individual events and rule results in "eventStream"
- Fix event name casing inconsistency: "eventstream" → "eventStream" in frontend listeners
- Frontend handlers updated to merge delta updates with backward compatibility fallback
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The manifest (platform-stats.json) was fetched with force-cache, causing
the browser to serve stale data even after a new daily stats file was
published. Switch manifest fetch to no-store so it is always fresh.
The versioned payload file (platform-stats.YYYY-MM-DD.json) keeps
force-cache since its filename is date-stamped and never changes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sends a Telegram message to @AutopilotMonitor-PrivatePreview whenever
a new tenant signs up. The bot webhook URL is stored in the new
PreviewConfig table (PartitionKey=TelegramBot, RowKey=config,
WebhookUrl=<url>) — same lifecycle as PreviewWhitelist, easy to remove
after GA. Notification is fire-and-forget and non-fatal.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace verbose README with a concise overview and link to the
official documentation at autopilotmonitor.com/docs. Remove
CONTRIBUTING.md, QUICKSTART.md, docs/architecture.md, and
docs/getting-started.md as the website docs supersede them.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When a Galactic Admin approves a tenant for Private Preview, the user
who originally signed up (stored in TenantConfiguration.UpdatedBy) is
automatically added as TenantAdmin. This avoids manual admin assignment
after approval. Also fixes GitHub repository link in the portal footer.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Oliver Kieselbach