<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A
## What this does
The `/query-generator` page's osquery-SQL-generation step
([get-llm-generated-sql.js](website/api/controllers/query-generator/get-llm-generated-sql.js))
was on `claude-sonnet-4-6`, which is now one generation behind. This PR:
- Bumps that call to `claude-sonnet-5`. The schema-filtration step stays
on `claude-haiku-4-5`, which is already the latest Haiku release, so no
change needed there.
- Adds `effort` support to the shared [`ai.prompt`
helper](website/api/helpers/ai/prompt.js), forwarded as
`output_config.effort` on Anthropic requests, and sets it to `"low"` for
the SQL-generation call. Effort controls how much the model deliberates
(and how many tokens/how much latency that costs). `"low"` was chosen
because the Haiku pre-filtering step already narrows the osquery schema
down to relevant tables, so the Sonnet step isn't starting from scratch
and doesn't need to spend much effort re-deriving that context.
- Bumps `max_tokens` in the Anthropic branch of the helper from 4096 to
8192. Claude Sonnet 5 turns on adaptive thinking by default when the
`thinking` param is omitted (which this helper does), and `max_tokens`
is a hard cap on *total* output including thinking tokens — at 4096
there was a real risk of thinking tokens eating into the budget and
truncating the JSON response the SQL step needs to return.
- **Fixes a pre-existing bug found while making the above changes:** the
`sqlReport` call passed the system prompt as a bare object-shorthand key
named `systemPromptForQueryGeneration`, but the `ai.prompt` helper's
declared input is `systemPrompt`. Sails silently drops unrecognized keys
passed to `.with(...)`, so the "Return ONLY a raw JSON object..." system
prompt was never actually reaching the model for this call. This has
been broken since the query generator was switched to Anthropic
(`f7c20c4731`); the sibling `filteredTables` call above it was
unaffected since it passes `systemPrompt` positionally. Now fixed to
`systemPrompt: systemPromptForQueryGeneration`.
## Why
Claude Sonnet 5 follows structured/constrained instructions (don't alias
tables, use `LIKE` with wildcards, only reference documented columns,
etc.) more literally than 4.6, which should make the generated SQL more
reliable. It's priced the same or cheaper than 4.6 during the current
introductory period.
## Trade-offs called out for review
- Thinking being on by default adds some latency versus the old
(thinking-off) behavior on 4.6. This call is not currently streamed
(`sails.helpers.http.post`, single blocking call over a socket), so any
added thinking time is invisible wait time for the user rather than a
visible "thinking" indicator. `effort: "low"` should keep this modest,
but worth confirming with a manual QA pass on a few representative
questions before merging.
- Only the SQL-generation call was migrated. The schema-filtration call
also runs on an Anthropic model, but Haiku 4.5 doesn't support
`output_config.effort` (added `effort` is a no-op if passed to it), so
it was left as-is.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Improved AI-generated SQL responses with an updated language model.
* Added adaptive effort controls for supported AI requests.
* Increased response capacity to support more detailed generated
results.
* Improved handling of AI responses to provide more reliable results
when content includes different response formats.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
## Summary
Closes#41466
- Adds Anthropic Claude API support to the `prompt.js` AI helper,
detecting `claude-*` model names and routing to the Anthropic Messages
API (`https://api.anthropic.com/v1/messages`) with proper authentication
headers
- Switches both LLM calls in the query generator
(`get-llm-generated-sql.js`) from OpenAI models
(`gpt-4o-mini-2024-07-18` for schema filtration, `o3-mini-2025-01-31`
for SQL generation) to `claude-sonnet-4-6-20260218`
- Adds `anthropicSecret` config placeholder in `custom.js` (set via
`sails_custom__anthropicSecret` env var in production)
- Updates the query generator UI to reference "Anthropic" instead of
"OpenAI"
### Changes
| File | What changed |
|------|-------------|
| `website/api/helpers/ai/prompt.js` | Added Anthropic API branch
alongside existing OpenAI logic; system prompts use Anthropic's
top-level `system` parameter |
| `website/api/controllers/query-generator/get-llm-generated-sql.js` |
Both model references changed to `claude-sonnet-4-6-20260218` |
| `website/config/custom.js` | Added `anthropicSecret` config
placeholder |
| `website/views/pages/admin/query-generator.ejs` | Updated copy from
"OpenAI" to "Anthropic" |
### Deployment notes
The `sails_custom__anthropicSecret` environment variable must be set
with an Anthropic API key before deploying this change.
---
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773278374183489?thread_ts=1773271495.702919&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Related to: https://github.com/fleetdm/confidential/issues/9884
Changes:
- Updated the prompt in the `get-llm-generated-sql` action to include a
note about using wildcard characters when generating queries that use
the LIKE operator.
- Improved error handling in the `get-llm-generated-sql` action
Changes:
- Updated the has-query-generator-access policy to allow the policy to
be bypassed when a `sails.config.custom.enablePublicQueryGenerator`
value is set
- Updated the query generator to match the latest wireframes
- Updated `get-llm-generated-sql` to pass a system prompt to the schema
filtration prompt.
Changes:
- Updated the prompt helper to accept a new input: `systemPrompt`, if
provided and a supported baseModel is selected, the system prompt will
be included in the Open AI API request along with the prompt.
- Updated the models used by the query generator to improve the speed of
query generation.
Closes: #25465
Changes:
- Updated the query generator page to use socket requests to call the
`get-llm-generated-sql` action to bypass Heroku's 30-second request
timeout.
Changes:
- Updated the User model to have a new attribute: `canUseQueryGenerator`
a boolean attribute that will grant users access to the query generator
page on the website.
- Added a new policy: `has-query-generate-access`
- Moved the query generator page from the admin section of the website.
Note: before this change can be merged, the website's database will need
to be migrated to add the new column to the User table
