fix(kb): fix Linear connector GraphQL type errors and tag slot reuse

[waleedlatif1]

Re-opening of #3919 — originally merged into staging but lost when the branch was accidentally deleted and recreated from main.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 4, 2026 11:43pm

[cursor]

PR Summary

High Risk
High risk because it introduces new AWS CloudWatch APIs that accept AWS credentials and adds new billing/usage accounting paths for knowledge-base embeddings, both of which can impact security and user charges if incorrect.

Overview
Adds a full AWS CloudWatch integration: new internal API routes to query Log Insights, list log groups/streams, fetch log events, list metrics, get metric statistics, and describe alarms; plus matching tool configs, types, selector support for log group/stream pickers, a new CloudWatch block, and a CloudWatchIcon.

Tightens KB connector behavior by gating “Live” (5‑minute) sync behind Max/Enterprise via new hasLiveSyncAccess() checks in connector create/update, and improves tag-slot assignment by reusing existing slots when tag displayName+fieldType match (only creating truly new tag definitions).

Updates embeddings generation to return { embeddings, totalTokens, isBYOK, modelName }, propagates this through callers/tests, and records/bills non-BYOK KB embedding token usage (new usage-log source knowledge-base + migration).

Adds PostHog instrumentation for folder create/delete, schedule create/delete, KB document delete, workflow import/export, logs filter usage, task message sent (now includes workspace_id), and search result selection; removes the task_marked_read event and stops emitting it.

^{Reviewed by Cursor Bugbot for commit 8b7d5f5. Configure here.}

[greptile-apps]

Greptile Summary

This PR re-introduces changes from #3919, delivering two bug fixes and one new integration: (1) the Linear KB connector now builds GraphQL queries dynamically so null/empty filters are never sent as typed variables, preventing Linear API type errors; (2) the connector-creation flow now reuses existing tag-definition slots when a matching displayName+fieldType entry already exists in the knowledge base, preventing unnecessary slot exhaustion; (3) a full AWS CloudWatch integration is added (tools, block, API routes, selectors).

Key changes:

• connectors/linear/linear.ts: buildIssuesQuery constructs varDefs and filterClauses only for non-empty values, fixing GraphQL type errors caused by declaring e.g. $teamId: ID! then passing null
• app/api/knowledge/[id]/connectors/route.ts: Tag-slot allocation now first checks existingByName to reuse occupied slots before calling allocateTagSlots for genuinely new definitions
• packages/db/migrations/0185_new_gravity.sql: Additive enum migration adding 'knowledge-base' to usage_log_source
• CloudWatch integration: 7 operations via 7 API routes and a unified block; describe-log-groups and describe-log-streams routes correctly use checkSessionOrInternalAuth to support both the UI selector and tool-executor call paths
• Two route files have an import statement placed after a const declaration, which violates the project's import-ordering convention

Confidence Score: 5/5

Safe to merge — all P0/P1 concerns are absent; only minor import-ordering style issues remain

The Linear GraphQL fix is correct (dynamic query building avoids null typed variables), the tag-slot reuse logic is sound (deduplication by displayName+fieldType before allocating fresh slots), the DB migration is additive, and the CloudWatch integration follows established patterns with correct auth split between session+internal routes (selectors) and internal-only routes (tool execution). The only findings are two P2 import-order style violations.

apps/sim/app/api/tools/cloudwatch/query-logs/route.ts and describe-log-streams/route.ts — import ordering only

Important Files Changed

Filename	Overview
apps/sim/connectors/linear/linear.ts	Fixes GraphQL type errors by dynamically building queries with only non-null filter variables; adds mapTags and tagDefinitions for 5 Linear metadata fields
apps/sim/app/api/knowledge/[id]/connectors/route.ts	Adds tag-slot reuse: existing slots are reclaimed for matching (displayName+fieldType) definitions before allocating new ones via allocateTagSlots
packages/db/migrations/0185_new_gravity.sql	Additive enum migration — adds 'knowledge-base' to usage_log_source; safe and non-destructive
apps/sim/blocks/blocks/cloudwatch.ts	New CloudWatch block with 7 operations and basic/advanced mode selectors for log groups and streams
apps/sim/app/api/tools/cloudwatch/query-logs/route.ts	New Log Insights query route using checkInternalAuth; import placed after const declaration (style violation)
apps/sim/app/api/tools/cloudwatch/describe-log-streams/route.ts	New describe-log-streams route using checkSessionOrInternalAuth; import placed after const declaration (style violation)
apps/sim/app/api/tools/cloudwatch/describe-log-groups/route.ts	New describe-log-groups route using checkSessionOrInternalAuth, correctly supporting both UI selector (session) and tool executor (internal) call paths
apps/sim/app/api/tools/cloudwatch/utils.ts	Shared CloudWatch utilities for client creation, query polling with timeout fallback, and log stream/event fetching
apps/sim/lib/workflows/subblocks/context.ts	Adds awsAccessKeyId, awsSecretAccessKey, awsRegion, and logGroupName to SELECTOR_CONTEXT_FIELDS for cascading CloudWatch selectors
apps/sim/hooks/selectors/types.ts	Adds cloudwatch.logGroups, cloudwatch.logStreams selector keys and AWS credential/log-group context fields

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph Linear Connector Fix
        A[buildIssuesQuery] --> B{teamId set?}
        B -- yes --> C[add $teamId: ID! var + filter clause]
        B -- no --> D[skip]
        A --> E{projectId set?}
        E -- yes --> F[add $projectId: ID! var + filter clause]
        E -- no --> G[skip]
        A --> H{stateFilter set?}
        H -- yes --> I[add $stateFilter: String! var + filter clause]
        H -- no --> J[skip]
        C & F & I --> K[Execute GraphQL with only declared vars]
    end

    subgraph Tag Slot Reuse
        L[POST /connectors] --> M[Fetch existing tag defs for KB]
        M --> N{displayName + fieldType match?}
        N -- yes --> O[Reuse existing slot]
        N -- no --> P[Push to defsNeedingSlots]
        P --> Q[allocateTagSlots from unused pool]
        O & Q --> R[Store tagSlotMapping in sourceConfig]
    end

    subgraph CloudWatch Auth Split
        S[describe-log-groups
describe-log-streams] --> T[checkSessionOrInternalAuth]
        T --> U[Browser selector OR Executor]
        V[query-logs
get-log-events
get-metric-statistics
list-metrics
describe-alarms] --> W[checkInternalAuth]
        W --> X[Executor only]
    end

Loading

_{Reviews (1): Last reviewed commit: "fix(kb): enable search on connector sele..." | Re-trigger Greptile}

[greptile-apps]

Import after const declaration

The import on line 9 appears after the const logger statement on line 7. Per the project's import-order convention, all imports must come before any non-import statements. TypeScript hoists the import at runtime so this won't crash, but it will fail ESLint's import/first rule and is inconsistent with every other route in the codebase.

Suggested change

	const logger = createLogger('CloudWatchQueryLogs')
	import { createCloudWatchLogsClient, pollQueryResults } from '@/app/api/tools/cloudwatch/utils'
	import { StartQueryCommand } from '@aws-sdk/client-cloudwatch-logs'
	import { createLogger } from '@sim/logger'
	import { type NextRequest, NextResponse } from 'next/server'
	import { z } from 'zod'
	import { checkInternalAuth } from '@/lib/auth/hybrid'
	import { createCloudWatchLogsClient, pollQueryResults } from '@/app/api/tools/cloudwatch/utils'
	const logger = createLogger('CloudWatchQueryLogs')

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

[greptile-apps]

Import after const declaration

Same pattern as query-logs/route.ts: the import on line 9 appears after the const logger declaration on line 6. All imports should precede any executable statements.

Suggested change

	const logger = createLogger('CloudWatchDescribeLogStreams')
	import { createCloudWatchLogsClient, describeLogStreams } from '@/app/api/tools/cloudwatch/utils'
	import { createLogger } from '@sim/logger'
	import { type NextRequest, NextResponse } from 'next/server'
	import { z } from 'zod'
	import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
	import { createCloudWatchLogsClient, describeLogStreams } from '@/app/api/tools/cloudwatch/utils'
	const logger = createLogger('CloudWatchDescribeLogStreams')