feat: sync charts, OAuth device login, agent JSON mode, and public hygiene - #4
Merged
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Autofix Details
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Internal monorepo path in docs
- Replaced the internal monorepo file path with product-neutral wording about updating the OAuth client allowlist in Amplitude's backend configuration.
Or push these changes by commenting:
@cursor push bed6d983ca
Preview (bed6d983ca)
diff --git a/docs/cli.md b/docs/cli.md
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -83,8 +83,8 @@
Route-level scopes are defined on each OpenAPI operation (`x-required-scopes`).
When adding new CLI scopes, the Hydra device client allowlist must be updated
-out-of-band (client IDs in `server/packages/api-server/src/oauthConfig.ts`)
-before default login can request them.
+out-of-band in Amplitude's backend OAuth client configuration before default
+login can request them.
## Global flagsYou can send follow-ups to the cloud agent here.
Collaborator
Author
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Autofix Details
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Profile creation error omits flags
- Updated the loginBaseUrl usage error to list --region, --env, and --base-url as valid options for creating a profile.
Or push these changes by commenting:
@cursor push 9b65af7650
Preview (9b65af7650)
diff --git a/src/auth-commands.ts b/src/auth-commands.ts
--- a/src/auth-commands.ts
+++ b/src/auth-commands.ts
@@ -122,7 +122,9 @@
if (args.existing) {
return args.existing.base_url;
}
- throw usageError('Creating a profile requires --region <us|eu>.');
+ throw usageError(
+ 'Creating a profile requires --region <us|eu>, --env, or --base-url <url>.',
+ );
}
/**You can send follow-ups to the cloud agent here.
ekim-amplitude
changed the title
ekim-amplitude
changed the title
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 3 total unresolved issues (including 2 from previous reviews).
Autofix Details
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: OpenAPI leaks internal product names
- Removed Nova/Dash product names and internal type identifiers from the Chart definition and ChartType descriptions in both bundled OpenAPI files, replacing them with public-facing copy that still documents the unknown mapping behavior.
Or push these changes by commenting:
@cursor push da593148ef
Preview (da593148ef)
diff --git a/openapi/bundled/openapi.bundled.json b/openapi/bundled/openapi.bundled.json
--- a/openapi/bundled/openapi.bundled.json
+++ b/openapi/bundled/openapi.bundled.json
@@ -2370,13 +2370,13 @@
"definition": {
"type": "object",
"additionalProperties": true,
- "description": "Read-only chart definition. Returned only when `include_definition=true`\non GET chart. Shape is unstable and may change with Nova/Dash versions;\nnot intended for authoring.\n"
+ "description": "Read-only chart definition. Returned only when `include_definition=true`\non GET chart. Shape is unstable and may change over time; not intended\nfor authoring.\n"
}
}
},
"ChartType": {
"type": "string",
- "description": "Public chart type discriminator (snake_case). Maps from internal Dash types\n(e.g. `eventsSegmentation` → `event_segmentation`). All values may appear on\nlist/get; query returns `422` (`unsupported_chart_type`) for types outside\nthe v1 supported matrix.\n\nInternal-only or deprecated Dash types (e.g. `asql`, `eventsLog`) are not\nexposed on the public wire; those charts surface as `unknown`.\n\nNew chart types may be added over time. An internal type the adapter cannot\nmap is surfaced as `unknown` rather than failing the response, so the wire\nvalue is always one of the members below. Clients should treat `unknown` as\n\"a chart type this API version does not model yet\".\n",
+ "description": "Public chart type discriminator (snake_case). All values may appear on\nlist/get; query returns `422` (`unsupported_chart_type`) for types outside\nthe v1 supported matrix.\n\nUnsupported chart types surface as `unknown` on the public wire.\n\nNew chart types may be added over time. A chart type this API version does not\nrecognize is surfaced as `unknown` rather than failing the response, so the wire\nvalue is always one of the members below. Clients should treat `unknown` as\n\"a chart type this API version does not model yet\".\n",
"enum": [
"event_segmentation",
"sessions",
diff --git a/openapi/bundled/openapi.bundled.yaml b/openapi/bundled/openapi.bundled.yaml
--- a/openapi/bundled/openapi.bundled.yaml
+++ b/openapi/bundled/openapi.bundled.yaml
@@ -1833,23 +1833,21 @@
additionalProperties: true
description: |
Read-only chart definition. Returned only when `include_definition=true`
- on GET chart. Shape is unstable and may change with Nova/Dash versions;
- not intended for authoring.
+ on GET chart. Shape is unstable and may change over time; not intended
+ for authoring.
ChartType:
type: string
description: |
- Public chart type discriminator (snake_case). Maps from internal Dash types
- (e.g. `eventsSegmentation` → `event_segmentation`). All values may appear on
+ Public chart type discriminator (snake_case). All values may appear on
list/get; query returns `422` (`unsupported_chart_type`) for types outside
the v1 supported matrix.
- Internal-only or deprecated Dash types (e.g. `asql`, `eventsLog`) are not
- exposed on the public wire; those charts surface as `unknown`.
+ Unsupported chart types surface as `unknown` on the public wire.
- New chart types may be added over time. An internal type the adapter cannot
- map is surfaced as `unknown` rather than failing the response, so the wire
- value is always one of the members below. Clients should treat `unknown` as
- "a chart type this API version does not model yet".
+ New chart types may be added over time. A chart type this API version does
+ not recognize is surfaced as `unknown` rather than failing the response, so
+ the wire value is always one of the members below. Clients should treat
+ `unknown` as "a chart type this API version does not model yet".
enum:
- event_segmentation
- sessionsYou can send follow-ups to the cloud agent here.
|
Bugbot Autofix prepared fixes for both issues found in the latest run.
Or push these changes by commenting: Preview (d4aa2c8719)diff --git a/docs/cli.md b/docs/cli.md
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -82,12 +82,6 @@
Route-level scopes are defined on each OpenAPI operation (`x-required-scopes`).
-When adding new CLI scopes, register them on the Hydra device-flow OAuth client
-for each target environment (for example `amplitude-developer-api-device-staging`
-on staging, `amplitude-developer-api-v0` on prod). This is an out-of-band Hydra
-admin change — coordinate with SecEng before shipping CLI changes that request
-new scopes by default.
-
## Global flags
| Flag / env | Purpose |
diff --git a/openapi/bundled/openapi.bundled.json b/openapi/bundled/openapi.bundled.json
--- a/openapi/bundled/openapi.bundled.json
+++ b/openapi/bundled/openapi.bundled.json
@@ -1414,7 +1414,7 @@
"tags": ["Analytics"],
"operationId": "queryChart",
"summary": "Query chart",
- "description": "Computes and returns normalized results for a saved chart. v1 supports\n`event_segmentation`, `sessions`, `funnels`, and `retention` chart types;\nother chart types return `422` with `error_code: unsupported_chart_type`.\nResults are DAC-filtered for the authenticated caller.\n\nThis POST computes a result and does not mutate state. It is therefore a\nread operation and does not require an `Idempotency-Key`.\n\nOmitting `time_range` uses the chart's saved range; if the chart has no\nsaved range, the server defaults to the last 30 days.\n\nQuery is synchronous with bounded defaults. Expensive queries may return\n`504` when exceeding the server timeout; async query jobs are planned for\na follow-up slice. Retryable responses (`429`, `502`, `504`) populate\n`retry_after_seconds` in the problem body when a delay is advised.\n",
+ "description": "Computes and returns normalized results for a saved chart. v1 supports\n`event_segmentation`, `sessions`, `funnels`, and `retention` chart types;\nother chart types return `422` with `error_code: unsupported_chart_type`.\nResults respect the authenticated caller's chart access permissions.\n\nThis POST computes a result and does not mutate state. It is therefore a\nread operation and does not require an `Idempotency-Key`.\n\nOmitting `time_range` uses the chart's saved range; if the chart has no\nsaved range, the server defaults to the last 30 days.\n\nQuery is synchronous with bounded defaults. Expensive queries may return\n`504` when exceeding the server timeout; async query jobs are planned for\na follow-up slice. Retryable responses (`429`, `502`, `504`) populate\n`retry_after_seconds` in the problem body when a delay is advised.\n",
"x-required-scopes": ["read:analytics"],
"requestBody": {
"required": false,
@@ -2370,13 +2370,13 @@
"definition": {
"type": "object",
"additionalProperties": true,
- "description": "Read-only chart definition. Returned only when `include_definition=true`\non GET chart. Shape is unstable and may change with Nova/Dash versions;\nnot intended for authoring.\n"
+ "description": "Read-only chart definition. Returned only when `include_definition=true`\non GET chart. Shape is unstable and may change between API versions;\nnot intended for authoring.\n"
}
}
},
"ChartType": {
"type": "string",
- "description": "Public chart type discriminator (snake_case). Maps from internal Dash types\n(e.g. `eventsSegmentation` → `event_segmentation`). All values may appear on\nlist/get; query returns `422` (`unsupported_chart_type`) for types outside\nthe v1 supported matrix.\n\nInternal-only or deprecated Dash types (e.g. `asql`, `eventsLog`) are not\nexposed on the public wire; those charts surface as `unknown`.\n\nNew chart types may be added over time. An internal type the adapter cannot\nmap is surfaced as `unknown` rather than failing the response, so the wire\nvalue is always one of the members below. Clients should treat `unknown` as\n\"a chart type this API version does not model yet\".\n",
+ "description": "Public chart type discriminator (snake_case). All values may appear on\nlist/get; query returns `422` (`unsupported_chart_type`) for types outside\nthe v1 supported matrix.\n\nCharts whose type is not modeled in this API version surface as `unknown`\nrather than failing the response.\n\nNew chart types may be added over time. Clients should treat `unknown` as\n\"a chart type this API version does not model yet\".\n",
"enum": [
"event_segmentation",
"sessions",
@@ -2396,7 +2396,7 @@
},
"ChartQueryRequest": {
"type": "object",
- "description": "v1 query parameters. Filter and group-by overrides are intentionally omitted\nuntil Tier 2 allowlist validation is defined.\n",
+ "description": "v1 query parameters. Filter and group-by overrides are intentionally omitted\nuntil override validation is supported in a future version.\n",
"properties": {
"time_range": {
"$ref": "#/components/schemas/TimeRange"
diff --git a/openapi/bundled/openapi.bundled.yaml b/openapi/bundled/openapi.bundled.yaml
--- a/openapi/bundled/openapi.bundled.yaml
+++ b/openapi/bundled/openapi.bundled.yaml
@@ -1028,7 +1028,7 @@
Computes and returns normalized results for a saved chart. v1 supports
`event_segmentation`, `sessions`, `funnels`, and `retention` chart types;
other chart types return `422` with `error_code: unsupported_chart_type`.
- Results are DAC-filtered for the authenticated caller.
+ Results respect the authenticated caller's chart access permissions.
This POST computes a result and does not mutate state. It is therefore a
read operation and does not require an `Idempotency-Key`.
@@ -1833,22 +1833,19 @@
additionalProperties: true
description: |
Read-only chart definition. Returned only when `include_definition=true`
- on GET chart. Shape is unstable and may change with Nova/Dash versions;
+ on GET chart. Shape is unstable and may change between API versions;
not intended for authoring.
ChartType:
type: string
description: |
- Public chart type discriminator (snake_case). Maps from internal Dash types
- (e.g. `eventsSegmentation` → `event_segmentation`). All values may appear on
+ Public chart type discriminator (snake_case). All values may appear on
list/get; query returns `422` (`unsupported_chart_type`) for types outside
the v1 supported matrix.
- Internal-only or deprecated Dash types (e.g. `asql`, `eventsLog`) are not
- exposed on the public wire; those charts surface as `unknown`.
+ Charts whose type is not modeled in this API version surface as `unknown`
+ rather than failing the response.
- New chart types may be added over time. An internal type the adapter cannot
- map is surfaced as `unknown` rather than failing the response, so the wire
- value is always one of the members below. Clients should treat `unknown` as
+ New chart types may be added over time. Clients should treat `unknown` as
"a chart type this API version does not model yet".
enum:
- event_segmentation
@@ -1869,7 +1866,7 @@
type: object
description: |
v1 query parameters. Filter and group-by overrides are intentionally omitted
- until Tier 2 allowlist validation is defined.
+ until override validation is supported in a future version.
properties:
time_range:
$ref: '#/components/schemas/TimeRange'You can send follow-ups to the cloud agent here. |
ekim-amplitude
force-pushed
the
sync/20260724
branch
from
July 27, 2026 15:18
26e1ff0 to
3462da6
Compare
ekim-amplitude
changed the title
Mirror monorepo developer-cli/ at 1b44da24869290a2a4f10ca3d4fbdc3228ada2e7. Includes: - MCP-472 charts commands and read:analytics in default OAuth scopes - BA-426/BA-444 agent device login (start/poll) and JSON output mode - MCP-431 external sync guards, public hygiene, no client-side telemetry (v1) - fastest-levenshtein dependency for CLI error hints Monorepo: 1b44da24869290a2a4f10ca3d4fbdc3228ada2e7 Checks: pnpm check:developer-cli-external-ready, sync --verify (415 tests) Co-authored-by: Cursor <cursoragent@cursor.com>
ekim-amplitude
force-pushed
the
sync/20260724
branch
from
July 29, 2026 16:17
3462da6 to
68f4422
Compare
ekim-amplitude
changed the title
ekim-amplitude
changed the title
|
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 68f4422. Configure here.
bird-m
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Single squashed sync of
developer-cli/from monorepoamplitude/javascript@1b44da248692(master).Brings
@amplitude/developer-cliup to date with charts, OAuth device-flow login, agent/JSON output mode, public-hygiene fixes, and removal of client-side telemetry for v1.Source
amplitude/javascript1b44da248692masterserver/packages/api-server/developer-cliWhat ships
Analytics & API surface (MCP-472)
amp charts list,get,queryread:analyticsAuth & agent workflow
amp auth login start/amp auth login pollwith pending-login store--profile(defaults todefault);--region us|eufor prod targeting--forcefor cross-region retargets; logout/list/status JSON paths--env/--base-url: hidden from help and usage errors but still functionalPublic hygiene & telemetry (MCP-431)
Amp-Device-Id, nostate.json, no opt-out env vars (security team decision)check:developer-cli-external-readybefore syncExternal-only
fastest-levenshteintopackage.json(monorepo dependency parity)Verification
Synced with
pnpm sync:developer-cli-external … --verifyafter internal merges through #138644.Release notes (draft)
Note
High Risk
Large auth and credential-resolution changes (split device flow, region targeting, pending store, profile defaults) are security-sensitive despite broad tests; new chart query paths also hit live analytics APIs.
Overview
Adds saved chart support via regenerated OpenAPI/manifest:
amp charts list,get, andquery(read:analytics), plus doc/smoke updates for the new surface.Reworks authentication for agents and scripts:
amp auth login start/pollwith a pending-login store, JSON{status,message,…}on stdout, exit 75 when still pending, and bounded polling via--timeout. Interactive login/PAT paths now default--profiletodefault, require--region us|eufor new profiles (docs de-emphasize--env/--base-url), support--forcefor cross-region retargets, and clear stranded pending logins on logout or completed auth.auth list/statusgain JSON output; status uses resolverCliErrorexit codes consistently.CLI ergonomics: global flags are split so auth-only flags are rejected on API commands; unknown options get “did you mean” hints (
fastest-levenshtein);AGENTS.mddocuments command-change guardrails. Default device-login scopes addread:analytics; EU PAT links useapp.eu.amplitude.com.Reviewed by Cursor Bugbot for commit 68f4422. Bugbot is set up for automated code reviews on this repo. Configure here.