feat: UI improvements — analytics metrics, discard changes, SSO hints

[TerrifiedBug]

Summary

• Analytics reduction metric fix: Replace misleading single "Reduction" KPI (bytes-based, inflated by gzip) with two cards: "Events Reduced" (event-based, clamped at 0%) and "Bytes Saved" (relabeled, with tooltip). Added sortable "Events Reduced" column to per-pipeline table.
• Discard unsaved pipeline changes: Store node/edge snapshots in PipelineVersion on deploy. New discardChanges mutation restores pipeline to last deployed state. Discard button in toolbar with confirmation dialog. Both deployAgent and createVersion paths store snapshots. Rollback also restores nodes/edges and is now transactional.
• SSO hint in Add Member dialog: Conditional info alert when SCIM or OIDC group sync is enabled, telling admins that SSO users are managed by the identity provider.
• Earlier commits on branch: Layout save cache invalidation, service accounts tab, dashboard/fleet/profile UI polish, stale closure fixes.

Test plan

• Analytics page shows "Events Reduced" and "Bytes Saved" cards with correct color thresholds (green >50%, amber >10%, muted ≤10%)
• Per-pipeline table has sortable "Events Reduced" and renamed "Bytes Saved" columns
• Deploy a pipeline, make edits, save without deploying — "Discard" button appears in toolbar
• Clicking Discard shows confirmation dialog; confirming reverts to deployed state
• Discard fails gracefully on pipelines deployed before this change (no snapshot)
• Rollback from version history also restores node positions and edges
• With SCIM or OIDC group sync enabled, Add Member card shows SSO info hint
• With neither enabled, no hint is shown

[greptile-apps]

Greptile Summary

This PR delivers three feature areas: a refactored analytics KPI section (replacing the misleading byte-based "Reduction" card with separate "Events Reduced" and "Bytes Saved" cards), a "Discard unsaved changes" workflow that restores a deployed pipeline to its last deployed snapshot, and an SSO hint in the Add Member dialog. The discard path is well-implemented — markClean() is called before query invalidation, correctly bypassing the isDirty guard in loadGraph.

Key issues found:

• Rollback canvas not refreshed after version history rollback — rollbackMutation.onSuccess in VersionHistoryDialog only invalidates pipeline.versions; it never invalidates pipeline.get or calls markClean(). Every rollback via the Version History dialog leaves the canvas displaying the pre-rollback graph, while the DB has already been updated. This is the same class of issue that was fixed for discardChanges.
• Rollback is only partially atomic — The PR description claims rollback is "now transactional," but createVersion (which writes the new PipelineVersion record and updates pipeline.deployedAt) runs outside the $transaction block that restores nodes/edges. A transient DB failure between those two steps leaves the pipeline's live state and its version history permanently out of sync.

Confidence Score: 3/5

• Safe to merge analytics and SSO hint changes; the discard-changes flow is correct, but the rollback path has two bugs that will affect users.
• The analytics refactor and SSO hint are straightforward and low-risk. The discard-changes feature is well-implemented. However, the rollback path has two issues that will manifest in normal usage: the canvas isn't refreshed after a rollback (always reproducible), and the rollback isn't fully atomic (version history can become permanently inconsistent on DB error).
• src/components/pipeline/version-history-dialog.tsx and src/server/services/pipeline-version.ts need attention before merging.

Important Files Changed

Filename	Overview
src/server/services/pipeline-version.ts	Added snapshot columns to PipelineVersion and a new rollback path that restores nodes/edges from snapshots. Critical issue: createVersion is called outside the $transaction, so if it fails the pipeline's live state and version history are permanently inconsistent.
src/components/pipeline/version-history-dialog.tsx	Rollback mutation's onSuccess handler only invalidates the versions query; it never calls markClean() or invalidates pipeline.get, so the canvas displays stale pre-rollback nodes/edges after every rollback.
src/server/routers/pipeline.ts	New discardChanges mutation correctly validates pipeline state, fetches the latest snapshot, and restores nodes/edges inside a transaction. Uses EDITOR access + withAudit. Snapshot stored with encrypted configs as found in DB, consistent with existing read path.
src/server/services/deploy-agent.ts	Now captures nodesSnapshot/edgesSnapshot (encrypted DB configs) before calling createVersion, enabling discard/rollback of visual layout. No functional regressions found.
src/app/(dashboard)/pipelines/[id]/page.tsx	New discardMutation correctly calls markClean() before invalidating pipeline.get, so the isDirty guard in loadGraph is cleared and the canvas reloads with the restored state. Discard dialog and toolbar integration look correct.
src/app/(dashboard)/analytics/page.tsx	Replaces single byte-based Reduction KPI with Events Reduced (event-based, clamped ≥0%) and Bytes Saved (relabeled with tooltip). Adds sortable eventsReduced column. Logic is correct; color thresholds match the described spec.
prisma/migrations/20260308000000_add_pipeline_version_snapshots/migration.sql	Adds nullable nodesSnapshot/edgesSnapshot JSONB columns to PipelineVersion. Backward-compatible (nullable), no breaking change to existing rows.
src/components/flow/flow-toolbar.tsx	Adds Discard button alongside the Deploy/Undeploy buttons when hasChanges is true. Correctly gated by onDiscardChanges prop and the hasConfigChanges flag. No issues found.

Sequence Diagram

sequenceDiagram
    participant U as User
    participant FE as Pipeline Editor
    participant QC as React Query Cache
    participant API as tRPC / Server
    participant DB as PostgreSQL

    Note over U,DB: Deploy path (stores snapshot)
    U->>FE: Click Deploy
    FE->>API: deploy.agent(pipelineId)
    API->>DB: createVersion(yaml, nodesSnapshot, edgesSnapshot)
    DB-->>API: PipelineVersion (with snapshot)
    API-->>FE: { versionId, versionNumber }

    Note over U,DB: Discard Changes path (fixed in this PR)
    U->>FE: Click Discard
    FE->>API: pipeline.discardChanges(pipelineId)
    API->>DB: $transaction: restore nodes/edges from snapshot
    DB-->>API: OK
    API-->>FE: { discarded: true }
    FE->>FE: markClean()
    FE->>QC: invalidate pipeline.get
    QC->>API: pipeline.get(pipelineId)
    API-->>QC: restored nodes/edges
    QC-->>FE: loadGraph() (isDirty=false → guard bypassed)

    Note over U,DB: Rollback path (bug: missing invalidation)
    U->>FE: Open Version History → Rollback to vN
    FE->>API: pipeline.rollback(pipelineId, versionId)
    API->>DB: $transaction: restore nodes/edges from snapshot
    DB-->>API: OK (transaction committed)
    API->>DB: createVersion(...) ← OUTSIDE transaction
    DB-->>API: new PipelineVersion
    API-->>FE: newVersion
    FE->>QC: invalidate pipeline.versions only
    Note over FE,QC: pipeline.get NOT invalidated<br/>markClean() NOT called<br/>Canvas shows stale pre-rollback state

Loading

Comments Outside Diff (1)

1. src/components/pipeline/version-history-dialog.tsx, line 73-86 (link)

   Rollback doesn't refresh the pipeline editor canvas

   rollbackMutation.onSuccess only invalidates trpc.pipeline.versions but never invalidates trpc.pipeline.get. After a successful rollback the DB correctly holds the restored nodes/edges, but pipeline.get remains cached with the pre-rollback graph and the canvas never re-renders.

   There's a second compounding issue: markClean() is never called here. The useEffect on the pipeline page that invokes loadGraph is guarded by if (hasLoadedRef.current && useFlowStore.getState().isDirty) return;. If the user had unsaved edits open at rollback time, isDirty stays true even after pipeline.get is refetched, so loadGraph is blocked regardless.

   The fix mirrors what discardMutation.onSuccess does — call markClean() first, then invalidate both pipeline.versions and pipeline.get. Without this, the toast reports a successful rollback but the canvas continues displaying the pre-rollback graph.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: src/components/pipeline/version-history-dialog.tsx
   Line: 73-86
   
   Comment:
   **Rollback doesn't refresh the pipeline editor canvas**
   
   `rollbackMutation.onSuccess` only invalidates `trpc.pipeline.versions` but never invalidates `trpc.pipeline.get`. After a successful rollback the DB correctly holds the restored nodes/edges, but `pipeline.get` remains cached with the pre-rollback graph and the canvas never re-renders.
   
   There's a second compounding issue: `markClean()` is never called here. The `useEffect` on the pipeline page that invokes `loadGraph` is guarded by `if (hasLoadedRef.current && useFlowStore.getState().isDirty) return;`. If the user had unsaved edits open at rollback time, `isDirty` stays `true` even after `pipeline.get` is refetched, so `loadGraph` is blocked regardless.
   
   The fix mirrors what `discardMutation.onSuccess` does — call `markClean()` first, then invalidate both `pipeline.versions` **and** `pipeline.get`. Without this, the toast reports a successful rollback but the canvas continues displaying the pre-rollback graph.
   
   How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: d0d323f}

[TerrifiedBug]

@greptile review