The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 7, 2026 7:07pm

PR Summary

High Risk
New mutating CloudFormation, log retention, and pipeline stage-transition tools can change production infrastructure when workflows run with user-supplied AWS keys; behavior follows existing authenticated tool routes but expands blast radius beyond read-only monitoring.

Overview
Aligns Athena, CloudFormation, CloudWatch, and CodePipeline integrations with live AWS APIs: new tool routes and contracts, workflow block operations, and several correctness fixes on existing calls.

CloudFormation moves from inspect-only to stack lifecycle and change sets—create/update/delete stacks, cancel in-flight updates, create/describe/execute change sets, and get template summary, plus optional templateStage on get template. Shared cloudformation/utils maps parameters, tags, and IAM capabilities for the mutating routes.

CloudWatch adds filter log events (paginated helper in cloudwatch/utils), describe alarm history, and put/delete log group retention. list_metrics now follows NextToken until the limit or a page cap instead of returning only the first page.

Athena adds batch get query executions, delete named query, list databases, and list table metadata; several Athena ID fields in contracts now trim whitespace.

CodePipeline adds get pipeline structure, list action executions, and enable/disable stage transitions; list pipeline executions now surfaces rollback target execution ID.

Workflow blocks, tool configs, and Zod contracts are extended to match; routes keep the existing checkInternalAuth + parseToolRequest pattern.

^{Reviewed by Cursor Bugbot for commit 62d6285. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

This PR fixes real bugs and adds 19 new tools across four AWS integrations (CloudWatch, CloudFormation, Athena, CodePipeline). All previously flagged issues—validateAwsRegion on Athena and CloudFormation contracts, client.destroy() in CloudFormation route handlers, and AlarmTypes always including CompositeAlarm—have been addressed in the latest head commit.

• Bug fixes: CloudWatch list_metrics now correctly paginates beyond 500 results; get_template gains the TemplateStage param; Athena batch_get_query_execution trims IDs at the contract layer; CodePipeline list_pipeline_executions surfaces rollbackMetadata.
• New tools: CloudFormation gains full stack lifecycle; CloudWatch gains alarm history, log event filter, and retention management; Athena gains named-query deletion, batch execution status, database/table listing; CodePipeline gains pipeline structure retrieval, action execution history, and stage transition control.

Confidence Score: 5/5

Safe to merge — all new routes follow auth, validation, and cleanup patterns consistently, and every issue from the previous review round has been corrected.

The three issues flagged in the prior review (missing validateAwsRegion on Athena and CloudFormation contracts, client.destroy() absent on CloudFormation write routes, CompositeAlarm silently excluded from describe-alarm-history results) are all addressed in the current head. The pagination fix for list_metrics is correct. The new CloudFormation write routes share a tested utility layer and have superRefine guards. No new defects were found across the 87 changed files.

No files require special attention.

Important Files Changed

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant UI as Block UI
    participant Tool as Tool Layer
    participant Route as API Route
    participant Contract as Zod Contract
    participant AWS as AWS SDK Client
    UI->>Tool: params (awsRegion, credentials)
    Tool->>Route: "POST /api/tools/{service}/{operation}"
    Route->>Route: checkInternalAuth()
    Route->>Contract: parseToolRequest() + validateAwsRegion()
    alt validation fails
        Contract-->>Route: 400 + error details
        Route-->>UI: error response
    else validation passes
        Route->>AWS: "new ServiceClient({ region, credentials })"
        AWS-->>Route: response
        Route->>AWS: client.destroy()
        Route-->>Tool: success output
        Tool-->>UI: transformResponse()
    end

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant UI as Block UI
    participant Tool as Tool Layer
    participant Route as API Route
    participant Contract as Zod Contract
    participant AWS as AWS SDK Client
    UI->>Tool: params (awsRegion, credentials)
    Tool->>Route: "POST /api/tools/{service}/{operation}"
    Route->>Route: checkInternalAuth()
    Route->>Contract: parseToolRequest() + validateAwsRegion()
    alt validation fails
        Contract-->>Route: 400 + error details
        Route-->>UI: error response
    else validation passes
        Route->>AWS: "new ServiceClient({ region, credentials })"
        AWS-->>Route: response
        Route->>AWS: client.destroy()
        Route-->>Tool: success output
        Tool-->>UI: transformResponse()
    end

_{Reviews (4): Last reviewed commit: "fix(aws/athena): add validateAwsRegion r..." | Re-trigger Greptile}

@greptile please re-review — pushed fixes for all 4 findings from round 1 (composite-alarm history AlarmTypes gap, missing region validation across 7 contracts, missing client.destroy() across 7 routes, missing template validation on create_change_set).

@cursor please re-review — pushed a fix for the change-set template validation finding, plus 3 additional fixes from Greptile's first round.

Excellent! The fixes have been pushed. Now let me provide a comprehensive summary of the re-review:

Re-Review Summary

I've completed a thorough re-review of your fixes from commit ebc0a1a05b. Here's what I found:

✅ Issues Successfully Fixed (from your commit ebc0a1a)

1. Change set template validation ✅ VERIFIED

   • cloudformation-create-change-set.ts now includes the superRefine validation
   • Correctly rejects requests with neither templateBody nor usePreviousTemplate

2. CompositeAlarm history silently returns empty ✅ VERIFIED

   • describe-alarm-history/route.ts now always sets AlarmTypes: ['MetricAlarm', 'CompositeAlarm']
   • Fixes P1 finding where composite alarms queried by name returned empty results

3. Region validation on CloudFormation contracts ✅ 6 of 7 FIXED

   • All contracts NOW have validateAwsRegion refinement:
     • ✅ update-stack, ✅ delete-stack, ✅ cancel-update-stack
     • ✅ create-change-set, ✅ describe-change-set, ✅ get-template-summary
     • ❌ create-stack was MISSING (I fixed this)

4. AWS SDK client cleanup ✅ 7 of 8 FIXED

   • All routes NOW use try/finally with client.destroy():
     • ✅ update-stack, ✅ delete-stack, ✅ cancel-update-stack
     • ✅ create-change-set, ✅ describe-change-set, ✅ execute-change-set, ✅ get-template-summary
     • ❌ create-stack was MISSING (I fixed this)

🔧 Additional Fixes Applied (commit 62d6285)

I pushed a follow-up commit completing the last 2 fixes on create-stack:

1. Added validateAwsRegion refinement to cloudformation-create-stack.ts contract
2. Added try/finally with client.destroy() to create-stack/route.ts

📊 Final Status

ALL 4 findings from both Cursor Bugbot and Greptile round 1 are now fully resolved across all 8 CloudFormation routes:

• ✅ Change set template validation (create-change-set)
• ✅ CompositeAlarm AlarmTypes (describe-alarm-history)
• ✅ Region validation (all 8 CloudFormation routes)
• ✅ Client cleanup (all 8 CloudFormation routes)

The PR is now ready for final review with all identified issues addressed.

  

@greptile please re-review — pushed the final validation round: fixed 4 real gaps found in an independent adversarial audit (create_stack region validation + client cleanup, get_metric_statistics 5-item cap, get_log_events 10k record cap, batch_get_query_execution missing Statistics fields). Confirmed backwards compatible — all changes purely additive.

@cursor please re-review — pushed a fix for the Athena client.destroy() finding (all 4 new routes now match the pattern used elsewhere in this PR).

Re-Review Summary ✅

I've verified your Athena client.destroy() fix in commit a9e81ea157. Here's the comprehensive review:

✅ Athena Client Cleanup Fix (commit a9e81ea) - VERIFIED

All 4 new Athena routes now correctly use try/finally with client.destroy():

1. batch-get-query-execution/route.ts ✅

   • Lines 33-70: AWS SDK call wrapped in try block
   • Line 70: finally { client.destroy() } properly placed

2. delete-named-query/route.ts ✅

   • Lines 33-48: AWS SDK call wrapped in try block
   • Lines 46-48: finally { client.destroy() } properly placed

3. list-databases/route.ts ✅

   • Lines 33-55: AWS SDK call wrapped in try block
   • Lines 53-55: finally { client.destroy() } properly placed

4. list-table-metadata/route.ts ✅

   • Lines 33-69: AWS SDK call wrapped in try block
   • Lines 67-69: finally { client.destroy() } properly placed

📊 Additional Improvements in Commit 9870031

I also noticed you pushed an earlier commit that addressed additional findings:

• CloudWatch get_metric_statistics: Capped statistics array at AWS's 5-item limit
• CloudWatch get_log_events: Capped limit at AWS's 10,000-record max
• Athena batch_get_query_execution: Added missing Statistics fields (engineExecutionTimeInMillis, queryPlanningTimeInMillis, queryQueueTimeInMillis)

🎯 Final Status

ALL findings from Cursor Bugbot and Greptile reviews are now fully resolved:

The PR is ready for final approval with all automated review findings addressed. Every new AWS route in this PR now follows the consistent pattern of try/finally with client.destroy().

  

Fixed the Greptile 4/5 finding — added the validateAwsRegion refinement to all 4 new Athena contracts (delete-named-query, batch-get-query-execution, list-databases, list-table-metadata), matching every other new contract in this PR. Pushed in 188315a.

@greptile @cursor please re-review.