Feat/sso role team mapping docs - #365

Sampling rate and the per-event switches are independent controls, but the
FAQ only covered sampling and stopped at "not possible". Document the
combination that gets closest to errors-only: full session sampling plus
disabling non-error event collection.

Warn against `trackResources: false`, which is the intuitive move and the
wrong one: browser RUM reports HTTP failures as resource events, not error
events, so disabling resource collection hides API failures entirely. Show
a `beforeSend` filter that keeps failed requests instead, and list the
remaining costs: view events cannot be disabled, error evidence loses the
user action trail, and traced requests are still reported.

docs(monitors): add Entity Tree guide

…ly-faq

docs(rum): expand the errors-only sampling FAQ

Native crash symbolication is now available, so the pages that said it was
unsupported were wrong. Adds an upload section covering the part that costs
support round trips: symbols match on the module id alone, so --service and
--release-version only label the upload — the opposite of how source maps
behave. Also notes that most frames land in Electron's own binaries, so its
official symbol bundle has to be uploaded too, and that every Electron
upgrade invalidates the previous set silently.

…ping

Two things the pages promised but never stated.

The Session Replay instructions tell you to set sessionReplayDirectUpload
without saying which version has it. It landed in browser-rum 0.0.7, and the
Browser SDK drops options it does not recognize, so on anything earlier the
configuration reads as correct and records nothing at all.

The minidump field table was also missing error.fingerprint and
error.meta.exception_codes, and never explained that native crashes group per
crash site — including the trade-off that a new build reopens issues, since
the fingerprint keys on a module offset.

The docs site restructure moved all pages out of the old flat
/{lang}/flashduty/<slug> structure into sectioned paths (on-call/,
compliance/, monitors/, rum/, ...), leaving every legacy URL to 404.

Add 335 redirects mapping each legacy path still referenced by product
UIs, emails and published content to its new location; every
destination was verified live (HTTP 200) before inclusion.

fix: add redirects for legacy /{lang}/flashduty/* paths (335 URLs)

docs(rum): add Electron SDK integration docs (zh + en)

…uide

docs(rum): simplify Electron SDK guides

Review of request schemas across on-call, monitors, rum, platform, and
safari against backend validation and handler logic:

- fill in missing field descriptions (rule field updates, member reset
  payloads, silence/inhibit/escalation rule filters, and similar)
- explain enum values and add missing enum members (RUM app types,
  issue suspected causes, updatable rule field names)
- point ID fields at the list endpoints that yield them
- correct inaccurate descriptions: cron_pattern is 6-field with seconds
  and supports @every; team upsert emails/phones match existing members
  only; folder_id 0 is invalid; incident create assigned_to is optional,
  combinable, and its type is server-derived
- sync consolidated openapi.zh/en.json with the per-module specs

…0260811

docs(api): enrich request parameter descriptions

…rements

- Fix the six webhook FAQ pages (alert-webhook, incident-webhook,
  custom-actions, zh + en) that rendered the raw `{ip_whitelist}`
  string instead of the actual trusted source IP list.
- Add a network access requirements section to the SSO configuration
  page (zh + en) clarifying which protocols require the identity
  provider to be reachable from Flashduty's servers: SAML 2.0 does
  not, OIDC and CAS do, LDAP only applies to private deployments.
  Includes the egress IPs to allow through a firewall and recommends
  SAML 2.0 for identity providers that cannot be exposed at all.

The SSO network requirements section and the webhook FAQ IP whitelist
answers previously listed Flashduty's egress IPs without qualification.
Those IPs belong to the SaaS (public cloud) service only. In a private
(on-premises) deployment, Flashduty runs inside the customer's own
network and its egress address depends on that deployment, not on the
addresses listed here.

Added a short note to the SSO configuration page (zh + en) and a
caveat to the webhook FAQ answers (zh + en) making this explicit, so
private-deployment customers don't apply the SaaS IP list to their
own firewall.

These three webhook pages (zh + en) are also published as the embedded
integration documentation inside the Flashduty console, where the
renderer substitutes {ip_whitelist} with the egress address of the
running deployment. A private deployment egresses from its own network,
so replacing the placeholder with the public-cloud address list here
would show those customers addresses that do not apply to them.

Restores the placeholder. The public-cloud address list stays on the SSO
configuration page, which is not embedded in the console and where the
list is already scoped to the SaaS service.

These webhook pages are published twice: as documentation pages, and as
the embedded integration help inside the product, which substitutes
{ip_whitelist} with the egress address of the running deployment. On the
documentation site nothing performs that substitution, so readers saw the
placeholder itself and never got an answer. They also cannot resolve it
themselves the way they can resolve {api_host}, because the value is a
property of our service rather than of their environment.

Add the counterpart of removeHiddenBlocks to the package build: a
`{/* console: ... */}` block is an MDX comment, so the documentation site
renders nothing, while the package build unwraps it and the product still
receives the placeholder. Each FAQ answer now carries the public-cloud
address list for readers, inside the existing hide block so it does not
reach the product, and the placeholder for the product, inside the new
console block so it does not reach readers.

The address list is scoped to the SaaS service, since a private
deployment pushes from its own network.

The dual-renderer construct added for this FAQ changed the console output
even though it was only meant to change the docs site. Two causes:

- The hidden block sat between the two list items the console still sees,
  so removing it left a blank line there and turned a tight list loose.
  Each renderer now gets its own contiguous pair of items.
- `removeHiddenBlocks` and the `{/* console: */}` unwrap both left their
  indentation behind as a whitespace-only line. Both now consume their
  opening and closing lines whole. Blocks at column zero are unaffected.

Verified by building the console package from this branch and from its
base and diffing every page: no page's console content changes. On the
docs site the four addresses render and the placeholder does not.

Doc-review diff run since 2026-08-06 (24 findings: 4 high, 11 medium, 9 low):

- statuspage: new widgets.mdx (zh/en) for the embeddable status widget
  (badge/banner web component + public summary.json API), changelog
  entry 2026-08-11, markdown-table support note, comparison row
- monitors: entity-tree rule import (Prometheus/Operator YAML), batch
  enable/disable + bundle export, template variable reference,
  rule-update impact preview, Loki LogQL autocomplete tip
- on-call: escalation rule filter adds first-alert integration
  condition; alert source links to producing monit rule
- rum: Electron app type in app management, source mapping, UV basis
- ai-sre: folder upload for session attachments and knowledge packs,
  marketplace installs pinned to account scope (skills + MCP),
  attachment extension whitelist relaxation, new context-ref kinds,
  public artifact UGC disclaimer
- developer: cli detail-projection oversize now errors (288 -> 327
  ops); go-sdk service table adds ServiceMap, ErrorIngestionRules,
  IssuePresetSeverityRules, Resources, SessionReplay, Licenses
  (288/32 -> 327/38)

docs: fix IP whitelist placeholder and document SSO network requirements

docs: 状态页 Widget 文档 + changelog，修复 24 条文档漂移（doc-review 2026-08-11）

…ing-prereq

docs(rum): state the setTrackNetworkRequests prerequisite for HarmonyOS network tracking

Add OpenAPI operations for the app_key-callable knowledge pack and
knowledge file APIs under a new "AI SRE/Knowledge" tag:

- POST /safari/knowledge/pack/list, /get, /pack/ensure, /pack/update, /pack/delete
- POST /safari/knowledge/file/list, /file/get, /file/put

Each operation carries request/response schemas lifted from the
handlers, per-account rate limits from the gateway registry, a
Restrictions/Usage body, and real response examples captured from the
dev API. The 8 operations are merged into both safari.openapi.{en,zh}.json
and the consolidated openapi.{en,zh}.json (33 -> 41 AI SRE operations,
327 -> 335 total), the docs.json AI SRE nav gains a "Knowledge"/"知识"
subgroup, and both api-catalog pages get the matching table section.

Document POST /safari/knowledge/file/delete (knowledge-file-write-delete)
as the ninth knowledge operation, completing the app_key-callable
knowledge surface:

- FileDeleteRequest {pack_id, rel_path, force} -> FileDeleteResponse
  {warnings}, lifted from the handler.
- Restrictions: write-tier rate limits (20/s, 300/min per account),
  Knowledge Manage permission, audit-logged.
- Usage bullets cover idempotent deletes, the ReferenceExist/force
  behavior for still-referenced files, and the pack_id default.
- Response example is a real dev-API capture (temp file created via
  file/put, then deleted by the captured call).

docs.json gains the nav entry in both language subgroups; the catalogs
gain the table row and counts move to 42 AI SRE / 336 total.

api-reference: document the 8 AI SRE knowledge endpoints

Document the symbol-upload host separately from RUM ingest:
browser.flashcat.cloud is ingest-only and 404s on /sourcemap/upload.
Pin the hvigor-plugin install to ^0.1.3, document
FLASHCAT_SOURCEMAP_INTAKE_URL for private deployments, and note the
legacy FLASHCAT_ENDPOINT fallback on 0.1.2.

fix(rum): HarmonyOS symbol upload uses ci.flashcat.cloud

docs: daily doc-review 2026-09-01 — heartbeat, AI SRE status page drafts, IM feedback + drift fixes

The doc-review merge left 09-02 unclosed, nesting the 09-01 entry and
everything after it; the rendered page dropped those entries.

fix(changelog): close the 2026-09-02 Update block before 2026-09-01

…enie pages

- move on-call/quickstart/comparison to on-call/comparison/vs-pagerduty (zh/en)
- add a new Flashduty vs Opsgenie comparison page (zh/en): sunset timeline,
  official JSM migration path, feature/pricing comparison, migration guidance
- redirect the previous quickstart/comparison URLs (and the legacy
  flashduty/comparison-to-alternatives URLs) to the new vs-pagerduty location
- register a Product Comparison nav group and update the home-page cards

On-call has no standalone cron-job heartbeat feature; credit Opsgenie
Heartbeats and point at the Monitors engine-lost alert instead.

docs(monitors): document unknown command policy and agent v0.3.0

docs(on-call): add Flashduty vs Opsgenie comparison; move vs PagerDuty to a dedicated section

docs(monit): define datasource diagnostic tools and host-only Agent APIs

…s-nav

docs(monit): add datasource tools invoke to the api nav

…t-host-tools

docs(monitors): 同步 Agent 主机诊断文档

docs(monitors): 默认下载 monit-agent v0.4.0

… tools/invoke restrictions, sync api-catalog

- 16 ZH ops (rum remote-config, safari artifact/sign, on-call schedule/by-person)
  carried responses.200.description "Success"; aligned to the 成功 convention.
- POST /monit/datasource/tools/invoke gained its ## Restrictions block. Limits
  (32/s, 2000/min per account) and permission class (Datasources Read, monit)
  come from live pgy_proxy.t_api id 18847 and pgy_account.t_permission_factor,
  matching fc-pgy 9c5494a / 6be0e3a - not constructed values.
- {en,zh}/openapi/api-catalog.mdx: +1 row, Monitors 39->40, total 353->354.
- docs.json untouched: no operation added or removed.
- lint_openapi.py: OK, 12 spec files, no violations.

… fixes

Findings (26): 3 high, 19 medium, 4 low — diff window 2026-09-04T08:13:40Z..2026-09-07.

- cli.mdx: safari artifacts command family, monit datasource-tools-invoke,
  datasource --alerting-enabled/--enabled, monit-agent host-only, insight --fields,
  16KiB output bound, status-page draft-create
- sso: new role-team-sync page (SAML2.0/OIDC/CAS claim-name sync) + docs.json + configure-sso links
- monitors: 10→15 datasource types, enabled/alerting_enabled split, datasource tools + Edge v0.71.0
- on-call: war-room chats excluded from group-chat pickers; analytics timezone row
- rum: adoption panel labels (采用情况)
- ai-sre: sessions task-panel third entry point
- api-catalog/go-sdk: tools-invoke row, client.Artifacts, DraftCreate, 5-type contract, Reason field,
  count refreshes (337→349/348/354)
- changelog: SSO sync + Monit datasource diagnostics entries

api-review daily audit 2026-09-07: zh 200 descriptions, tools/invoke restrictions, api-catalog sync

docs: doc-review 2026-09-07 — CLI/SSO/monitors/go-sdk/API 增量审计修复

Add a best-practices page (zh + en) covering ingest bandwidth
estimation: a three-step method (bandwidth -> events/s -> concurrent
users -> DAU), measured baseline parameters, the compression and
session replay switches, mobile vs web differences, reduction levers,
private-deployment link sizing, and calibration methods.

docs(rum): add bandwidth estimation and capacity planning guide

…g-docs

docs(sso): role and team mapping with new-member-only defaults

Merge latest main into the SSO docs feature line and resolve only SSO documentation conflicts.