Merge branch 'main' into aaron/fix-loading-states

Author: knudtty

.changeset/heatmap-tooltip-portal.md

@@ -0,0 +1,6 @@
+---
+'@hyperdx/app': patch
+---
+
+fix: heatmap hover tooltip no longer adds scrollbars or shifts the tile; it now
+sits above the chart instead of inside it

.changeset/label-lookup-metric-name.md

@@ -0,0 +1,7 @@
+---
+'@hyperdx/api': patch
+'@hyperdx/common-utils': patch
+---
+
+perf: PromQL label lookups with `match[]` read only the matched metrics' tags
+rows when every selector names its metric

.changeset/mcp-directory-tool-metadata.md

@@ -0,0 +1,5 @@
+---
+'@hyperdx/api': patch
+---
+
+fix: give `clickstack_save_source`'s `highlightedRowAttributeExpressions` parameter a real type in the MCP tool schema (it rendered as an untyped `$ref`), and set `annotations.title` on every MCP tool

.changeset/mcp-install-command.md

@@ -0,0 +1,12 @@
+---
+'@hyperdx/cli': minor
+'@hyperdx/app': patch
+---
+
+feat: add `hdx mcp install` to connect AI agents without pasting a key
+
+`npx @hyperdx/cli mcp install` asks for a personal access key or an
+organization API key with hidden input, checks it, and adds the ClickStack MCP
+server to Claude Code, Codex, Cursor, and VS Code. Team Settings now leads with
+this command, so the key no longer has to go into a copied command or an agent
+chat. The per-agent snippets remain for setting up one agent by hand.

.changeset/org-api-keys.md

@@ -0,0 +1,7 @@
+---
+'@hyperdx/api': minor
+'@hyperdx/app': minor
+'@hyperdx/common-utils': minor
+---
+
+feat: Team members can create team-owned API keys with a description and expiry that keep working after their creator leaves.

.changeset/sources-separator-click-ui.md

@@ -0,0 +1,6 @@
+---
+'@hyperdx/app': patch
+---
+
+refactor: use the click-ui `Separator` instead of the Mantine `Divider` in the
+source form and the sources list.

.changeset/usage-stats-connection-password.md

@@ -0,0 +1,6 @@
+---
+'@hyperdx/api': patch
+---
+
+fix: usage stats job no longer fails ClickHouse auth on password-protected
+connections

MCP.md

@@ -38,21 +38,34 @@ The MCP server uses the **Streamable HTTP** transport with Bearer token
 authentication. In the examples below, replace `<your-hyperdx-url>` with your
 instance URL (e.g. `http://localhost:8080`).
 
+### Install with the CLI (recommended)
+
+This asks for a personal access key or an organization API key with hidden
+input, checks it, and adds the server to Claude Code, Codex, Cursor and VS Code.
+The key stays out of your shell history and agent chats.
+
+```bash
+npx @hyperdx/cli mcp install --app-url <your-hyperdx-url>
+```
+
 ### Claude Code
 
+`read -rs` waits for you to paste the key and press Enter, without echoing it,
+so the key isn't saved in your shell history:
+
 ```bash
-claude mcp add --transport http clickstack <your-hyperdx-url>/api/mcp \
-  --header "Authorization: Bearer <your-personal-access-key>"
+read -rs CLICKSTACK_ACCESS_KEY
+claude mcp add --scope user --transport http clickstack <your-hyperdx-url>/api/mcp \
+  --header "Authorization: Bearer $CLICKSTACK_ACCESS_KEY"
 ```
 
 ### Codex CLI
 
 The Codex CLI reads the bearer token from an environment variable rather than a
-`--header` flag. Export your personal access key, then register the server with
-`--bearer-token-env-var`:
+`--header` flag, so the variable must be set wherever Codex runs:
 
 ```bash
-export CLICKSTACK_ACCESS_KEY="<your-personal-access-key>"
+read -rs CLICKSTACK_ACCESS_KEY && export CLICKSTACK_ACCESS_KEY
 codex mcp add clickstack --url <your-hyperdx-url>/api/mcp \
   --bearer-token-env-var CLICKSTACK_ACCESS_KEY
 ```

knip.json

@@ -33,6 +33,9 @@
       "ignoreDependencies": ["@stryker-mutator/core"],
       "ignoreBinaries": ["stryker"]
     },
+    "packages/cli": {
+      "ignoreBinaries": ["claude"]
+    },
     "packages/hdx-eval": {
       "project": ["src/**/*.ts"],
       "ignoreDependencies": ["tsx"],

packages/api/openapi.json

@@ -8937,6 +8937,9 @@
           },
           "400": {
             "description": "User already exists"
+          },
+          "403": {
+            "description": "Org API keys can't invite people"
           }
         }
       }
@@ -8951,7 +8954,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Successfully retrieved invitations"
+            "description": "Successfully retrieved invitations. Invite links are left out for org API keys."
           }
         }
       }
@@ -9007,7 +9010,7 @@
             "description": "Successfully removed the member"
           },
           "400": {
-            "description": "Cannot remove yourself from the team"
+            "description": "Cannot remove yourself or the last team member"
           },
           "404": {
             "description": "Member not found"