feat(webapp): query boundary pinned end-to-end and a capped query retry

[kathiekiwi]

What & why

The agent's query tool is read-only, but that was true by three separate facts and only one of them had a test. This proves the boundary holds by contract rather than by prompt, and stops a broken query from burning a whole agent turn.

Two small guards, the rest is tests. TRI-11165.

Stack

Stacked on #4548 (watch-mode keepalive). Merge that first.

What's inside

• A route-level read-only test (apps/webapp/test/queryRouteReadOnly.test.ts) that drives api.v1.query with a real signed environment JWT: a multi-statement write and a mutating statement are both refused before anything reaches ClickHouse, and a plain read passes so the seam stays live.
• readonly=1 made non-overridable in queryService.server.ts — caller clickhouseSettings were spread after the defaults and could clear it.
• A per-turn query-retry cap in the agent's run_query tool (internal-packages/dashboard-agent/src/tool-api.ts): three consecutive failures returns a terminal "stop and answer with what you have".

Key decisions

• The read-only guarantee is grammar-level, not filtered. TRQL has no write statements — they don't parse — ClickHouse runs with readonly=1, and the org/project/env scoping is injected server-side from the credential. The request body can't widen scope or turn a read into a write.
• The deny test runs through the route, not the parser. A parser-only test would stay green if a refactor routed agent SQL around the compiler; driving the real route with a signed JWT pins the boundary end-to-end, and the deliberate positive read keeps the assertion honest.
• The retry cap lives per turn, not in the prompt. A failed query hands the model the database error to fix, and usually it does — but the only other limit was the turn's 10 steps, so one query the model couldn't fix could eat the whole turn and leave the user with no answer. The tool set is built per turn, so the counter caps consecutive failures; a success resets it. The retry instruction rides the error text, so the prompt prefix is unchanged.

Testing

• queryRouteReadOnly.test.ts — write statements → 400, ClickHouse never called; a read passes.
• tool-query-retry-cap.test.ts — terminal at the third consecutive failure, counter resets on a success.
• The load-bearing guards were control-broken first (readonly override re-enabled; cap removed) and the tests went red.

[changeset-bot]

⚠️ No Changeset found

Latest commit: dd22919

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 83d9e33f-9b5b-4c37-91a1-f383b5a4e006

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The webapp now rejects mutating query statements and enforces readonly: "1" after merging caller settings. Integration tests cover authenticated reads, rejected writes, and setting overrides. The dashboard agent now tracks consecutive run_query failures per turn, stops after three failures, and resets the counter after a successful query. Tests cover the failure cap and reset behavior.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the two main changes: enforcing the query boundary and capping consecutive query retries.
Description check	✅ Passed	The description explains the motivation, implementation, key decisions, testing, and linked issue, with only non-critical template sections omitted.

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/query-safety-tri-11165

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@bf6a051

trigger.dev

npm i https://pkg.pr.new/trigger.dev@bf6a051

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@bf6a051

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@bf6a051

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@bf6a051

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@bf6a051

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@bf6a051

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@bf6a051

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@bf6a051

commit: bf6a051

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

🔍 Forced readonly does not change the settings key order sent to ClickHouse

readonly: "1" is written last in the object literal, but getDefaultClickhouseSettings() (apps/webapp/app/services/queryService.server.ts:62) already defines readonly, so JavaScript keeps the key at its original insertion position and only overwrites the value. The serialized settings therefore still emit readonly before use_query_cache/query_cache_ttl (spread at apps/webapp/app/services/queryService.server.ts:381-383). ClickHouse applies HTTP settings in the order received and rejects changes once readonly=1 is in effect, so if the query-cache path works today it means ClickHouse tolerates the ordering here — worth confirming against a real query-cache-enabled table (e.g. one with queryCache in querySchemas) so the hardening does not silently rely on ordering luck. Note this ordering pre-dates the PR; the new line only makes caller overrides ineffective (no current caller overrides readonly, verified by searching clickhouseSettings usages in apps/webapp/app).

---

Was this helpful? React with 👍 or 👎 to provide feedback.