feat: Laminar Agent LAM-1335

[kolbeyang]

Note

Medium Risk
Adds a new AI agent API that can execute arbitrary SELECT SQL and fetch trace context, and rewires core trace/signal UX to integrate it; this touches data-access paths and navigation behavior. Also removes the existing per-trace chat persistence endpoints, so regressions in trace-assistant workflows are possible.

Overview
Introduces a new Laminar Agent experience: a project-wide chat panel (collapsed button, floating drawer, or side-by-side resizable panel) that persists messages across remounts and can deep-link to spans via clickable <span .../> references.

Adds POST /api/projects/[projectId]/agent which streams model responses using a new getGlobalAgentSystemPrompt and exposes two tools: compactTraceContext (trace structure via getTraceStructureAsString) and executeSql (runs SELECT queries with 100-row truncation). The previous trace-scoped chat API routes and server-side message storage/streaming logic are removed.

Signals/trace UI is updated to integrate the agent: signal event drawers now load a single event via a new GET /signals/[id]/events/[eventId], event selection is driven by the eventId query param (with table auto-scroll to the focused row), and trace view gets a new signals dropdown that can prefill the agent to explain a specific signal on a trace.

^{Written by Cursor Bugbot for commit b3db65d. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

Bugbot Autofix prepared fixes for all 3 issues found in the latest run.

• ✅ Fixed: SQL injection via string interpolation of URL params
  • I added UUID validation for signalId and eventId in the route and return HTTP 400 for invalid identifiers before building the SQL query.
• ✅ Fixed: Trace ID click unconditionally opens agent, breaks non-AI flow
  • I restored trace URL synchronization on trace-ID click and gated Laminar Agent opening/prefill logic behind the LAMINAR_AGENT feature flag.
• ✅ Fixed: Event panel renders behind trace view simultaneously
  • I restored the !traceId condition for rendering the event drawer so event and trace panels are mutually exclusive.

Or push these changes by commenting:

@cursor push 0be0ab07fe

Preview (0be0ab07fe)

diff --git a/frontend/app/api/projects/[projectId]/signals/[id]/events/[eventId]/route.ts b/frontend/app/api/projects/[projectId]/signals/[id]/events/[eventId]/route.ts
--- a/frontend/app/api/projects/[projectId]/signals/[id]/events/[eventId]/route.ts
+++ b/frontend/app/api/projects/[projectId]/signals/[id]/events/[eventId]/route.ts
@@ -1,14 +1,25 @@
 import { type NextRequest } from "next/server";
+import { z } from "zod/v4";
 
 import { executeQuery } from "@/lib/actions/sql";
 import { type EventRow } from "@/lib/events/types";
 
+const RouteParamsSchema = z.object({
+  signalId: z.string().uuid(),
+  eventId: z.string().uuid(),
+});
+
 export async function GET(
   _req: NextRequest,
   props: { params: Promise<{ projectId: string; id: string; eventId: string }> }
 ): Promise<Response> {
   const { projectId, id: signalId, eventId } = await props.params;
+  const parsedParams = RouteParamsSchema.safeParse({ signalId, eventId });
 
+  if (!parsedParams.success) {
+    return Response.json({ error: "Invalid signal or event identifier." }, { status: 400 });
+  }
+
   try {
     const query = `
       SELECT id, signal_id as signalId, trace_id as traceId, payload, timestamp

diff --git a/frontend/components/signal/events-table/columns.tsx b/frontend/components/signal/events-table/columns.tsx
--- a/frontend/components/signal/events-table/columns.tsx
+++ b/frontend/components/signal/events-table/columns.tsx
@@ -140,52 +140,62 @@
   },
 ];
 
-const staticColumnsAfterPayload: ColumnDef<EventRow>[] = [
-  {
-    accessorKey: "id",
-    cell: (row) => <Mono>{String(row.getValue())}</Mono>,
-    header: "ID",
-    size: 100,
-    id: "id",
-  },
-  {
-    accessorKey: "traceId",
-    header: "Trace ID",
-    cell: (row) => {
-      const traceId = String(row.getValue());
-      const event = row.row.original;
-      return (
-        <div className="flex items-center gap-1 min-w-0">
-          <button
-            className="font-mono text-xs min-w-0 truncate"
-            onClick={(e: MouseEvent) => {
-              e.stopPropagation();
-              // Open trace panel via signal store
-              const agentState = laminarAgentStore.getState();
-              const signalStore = agentState.refs.signal;
-              if (signalStore) {
-                signalStore.getState().setTraceId(traceId);
-              }
-              // Open Laminar Agent in side-by-side view with prefilled prompt
-              agentState.setViewMode("floating");
-              agentState.setPrefillInput(
-                `Show me the payload of this signal event ${event.id} formatted in a table, explain why it was detected on this trace ${traceId}, and detail which spans are relevant and why`
-              );
-            }}
-          >
-            {traceId}
-          </button>
-          <CopyTooltip value={traceId} className="">
-            <Copy className="size-3" />
-          </CopyTooltip>
-        </div>
-      );
+type BuildEventsColumnsOptions = {
+  onTraceIdClick?: (traceId: string) => void;
+  aiEnabled?: boolean;
+};
+
+function getStaticColumnsAfterPayload({
+  onTraceIdClick,
+  aiEnabled = false,
+}: BuildEventsColumnsOptions): ColumnDef<EventRow>[] {
+  return [
+    {
+      accessorKey: "id",
+      cell: (row) => <Mono>{String(row.getValue())}</Mono>,
+      header: "ID",
+      size: 100,
+      id: "id",
     },
-    size: 180,
-    id: "traceId",
-  },
-];
+    {
+      accessorKey: "traceId",
+      header: "Trace ID",
+      cell: (row) => {
+        const traceId = String(row.getValue());
+        const event = row.row.original;
+        return (
+          <div className="flex items-center gap-1 min-w-0">
+            <button
+              className="font-mono text-xs min-w-0 truncate"
+              onClick={(e: MouseEvent) => {
+                e.stopPropagation();
+                onTraceIdClick?.(traceId);
 
+                if (!aiEnabled) {
+                  return;
+                }
+
+                const agentState = laminarAgentStore.getState();
+                agentState.setViewMode("floating");
+                agentState.setPrefillInput(
+                  `Show me the payload of this signal event ${event.id} formatted in a table, explain why it was detected on this trace ${traceId}, and detail which spans are relevant and why`
+                );
+              }}
+            >
+              {traceId}
+            </button>
+            <CopyTooltip value={traceId} className="">
+              <Copy className="size-3" />
+            </CopyTooltip>
+          </div>
+        );
+      },
+      size: 180,
+      id: "traceId",
+    },
+  ];
+}
+
 const staticFilters: ColumnFilter[] = [
   {
     name: "ID",
@@ -204,7 +214,10 @@
   },
 ];
 
-export function buildEventsColumns(schemaFields: SchemaField[]): {
+export function buildEventsColumns(
+  schemaFields: SchemaField[],
+  options: BuildEventsColumnsOptions = {}
+): {
   columns: ColumnDef<EventRow>[];
   columnOrder: string[];
   filters: ColumnFilter[];
@@ -213,7 +226,7 @@
   const payloadColumns = validFields.map(createPayloadColumnDef);
   const payloadFilters = validFields.map(createPayloadFilter);
 
-  const columns = [...staticColumnsBeforePayload, ...payloadColumns, ...staticColumnsAfterPayload];
+  const columns = [...staticColumnsBeforePayload, ...payloadColumns, ...getStaticColumnsAfterPayload(options)];
 
   const columnOrder = ["timestamp", "traceId", ...validFields.map((f) => `payload:${f.name}`), "id"];
 

diff --git a/frontend/components/signal/events-table/index.tsx b/frontend/components/signal/events-table/index.tsx
--- a/frontend/components/signal/events-table/index.tsx
+++ b/frontend/components/signal/events-table/index.tsx
@@ -20,8 +20,10 @@
 import ColumnsMenu from "@/components/ui/infinite-datatable/ui/columns-menu";
 import DataTableFilter, { DataTableFilterList } from "@/components/ui/infinite-datatable/ui/datatable-filter";
 import { TableCell, TableRow } from "@/components/ui/table.tsx";
+import { useFeatureFlags } from "@/contexts/feature-flags-context";
 import { UNCLUSTERED_ID } from "@/lib/actions/clusters";
 import { type EventRow } from "@/lib/events/types";
+import { Feature } from "@/lib/features/features";
 import { useToast } from "@/lib/hooks/use-toast";
 
 import { buildEventsColumns } from "./columns";
@@ -61,8 +63,11 @@
   const [clusterId] = useClusterId();
   const [eventId, setEventId] = useEventId();
   const signal = useSignalStoreContext((state) => state.signal);
+  const setTraceId = useSignalStoreContext((state) => state.setTraceId);
   const selectedClusterIds = useSignalStoreContext((state) => getFilterClusterIds(state, clusterId), shallow);
   const isUnclusteredFilter = clusterId === UNCLUSTERED_ID;
+  const featureFlags = useFeatureFlags();
+  const aiEnabled = featureFlags[Feature.LAMINAR_AGENT];
   const searchParams = useSearchParams();
   const pathName = usePathname();
   const router = useRouter();
@@ -73,8 +78,21 @@
   const filterRaw = searchParams.getAll("filter");
   const filter = useMemo(() => filterRaw, [JSON.stringify(filterRaw)]);
 
-  const { columns, filters } = useMemo(() => buildEventsColumns(signal.schemaFields), [signal.schemaFields]);
+  const handleTraceIdClick = useCallback(
+    (traceId: string) => {
+      setTraceId(traceId);
+      const params = new URLSearchParams(searchParams.toString());
+      params.set("traceId", traceId);
+      router.push(`${pathName}?${params.toString()}`);
+    },
+    [pathName, router, searchParams, setTraceId]
+  );
 
+  const { columns, filters } = useMemo(
+    () => buildEventsColumns(signal.schemaFields, { onTraceIdClick: handleTraceIdClick, aiEnabled }),
+    [signal.schemaFields, handleTraceIdClick, aiEnabled]
+  );
+
   const fetchEvents = useCallback(
     async (pageNumber: number) => {
       try {

diff --git a/frontend/components/signal/index.tsx b/frontend/components/signal/index.tsx
--- a/frontend/components/signal/index.tsx
+++ b/frontend/components/signal/index.tsx
@@ -133,7 +133,7 @@
       )}
 
       <AnimatePresence>
-        {eventId && (
+        {eventId && !traceId && (
           <motion.div
             key="event-drawer"
             initial={{ x: 400 }}

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[cursor]

SQL injection via string interpolation of URL params

High Severity

The signalId and eventId URL path parameters are directly interpolated into a raw SQL query string without any sanitization or parameterization. While these values come from URL path segments, a crafted request could include SQL injection payloads (e.g., values containing single quotes) that modify the query logic. The existing executeQuery function sends this string directly to the backend ClickHouse endpoint.

 

[cursor]

Trace ID click unconditionally opens agent, breaks non-AI flow

Medium Severity

Clicking a trace ID in the events table unconditionally calls agentState.setViewMode("floating") and setPrefillInput(...), regardless of whether the Laminar Agent feature is enabled. When the feature flag is off, the LaminarAgent component isn't rendered, so the user sees no visible response to the agent-related actions. Additionally, the old code updated the URL with the traceId param via router.push(...), but this URL synchronization was removed, so the trace view state is no longer bookmarkable or back-button compatible.

 

[cursor]

Event panel renders behind trace view simultaneously

Low Severity

The !traceId guard was removed from the event detail panel visibility condition. Previously {selectedEvent && !traceId && ( ensured the event panel hid when a trace view was open. Now {eventId && ( allows both panels to render simultaneously — the event panel at z-40 rendered behind the trace view at z-50. This wastes resources and can cause visual glitches during animations.