patrickbrandao · Nov 10, 2026 · Nov 10, 2026 · Nov 10, 2026
diff --git a/Dockerfile.heroku b/Dockerfile.heroku
@@ -1,3 +1,3 @@
 # Community-maintained template, not tested in CI.
 # Thinker: https://github.com/patrickbrandao/thinker
-FROM docker.io/tmsoftbrasil/thinker:0.32
+FROM docker.io/tmsoftbrasil/thinker:0.33
diff --git a/deploy/aws/TUTORIAL.md b/deploy/aws/TUTORIAL.md
@@ -39,7 +39,7 @@ The deploy script exposes the common settings as environment variables:
 STACK_NAME=thinker \
 SERVICE_NAME=thinker \
 AWS_REGION=us-east-1 \
-IMAGE_URL=docker.io/tmsoftbrasil/thinker:0.32 \
+IMAGE_URL=docker.io/tmsoftbrasil/thinker:0.33 \
 DATABASE_INSTANCE_CLASS=db.t4g.micro \
 DESIRED_COUNT=1 \
 ./deploy/aws/deploy.sh

diff --git a/deploy/aws/deploy.sh b/deploy/aws/deploy.sh
@@ -5,7 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 STACK_NAME="${STACK_NAME:-thinker}"
 SERVICE_NAME="${SERVICE_NAME:-thinker}"
-IMAGE_URL="${IMAGE_URL:-docker.io/tmsoftbrasil/thinker:0.32}"
+IMAGE_URL="${IMAGE_URL:-docker.io/tmsoftbrasil/thinker:0.33}"
 DESIRED_COUNT="${DESIRED_COUNT:-1}"
 DATABASE_INSTANCE_CLASS="${DATABASE_INSTANCE_CLASS:-db.t4g.micro}"
 DATABASE_DELETION_PROTECTION="${DATABASE_DELETION_PROTECTION:-false}"

diff --git a/deploy/aws/thinker.yaml b/deploy/aws/thinker.yaml
@@ -14,7 +14,7 @@ Parameters:
     ConstraintDescription: Use up to 40 lowercase letters, numbers, and hyphens, starting with a letter.
   ImageUrl:
     Type: String
-    Default: docker.io/tmsoftbrasil/thinker:0.32
+    Default: docker.io/tmsoftbrasil/thinker:0.33
     Description: Thinker container image to deploy.
   ContainerPort:
     Type: Number

diff --git a/deploy/coolify/TUTORIAL.md b/deploy/coolify/TUTORIAL.md
@@ -38,7 +38,7 @@ curl -sSf https://<your-coolify-domain>/api/v1/health
 
 ## What Gets Provisioned
 
-- Thinker Docker image `tmsoftbrasil/thinker:0.32`.
+- Thinker Docker image `tmsoftbrasil/thinker:0.33`.
 - PostgreSQL 18 container.
 - Persistent Docker volume for PostgreSQL data.
 - Persistent Docker volume for compressed request recordings at `/data/request-recordings`.

diff --git a/deploy/coolify/docker-compose.yml b/deploy/coolify/docker-compose.yml
@@ -2,7 +2,7 @@
 # Thinker: https://github.com/patrickbrandao/thinker
 services:
   thinker:
-    image: tmsoftbrasil/thinker:0.32
+    image: tmsoftbrasil/thinker:0.33
     restart: unless-stopped
     stop_grace_period: 30s
     environment:

diff --git a/deploy/easypanel/TUTORIAL.md b/deploy/easypanel/TUTORIAL.md
@@ -21,7 +21,7 @@ If Thinker is available in your Easypanel template catalog:
 1. Open your Easypanel project.
 2. Choose **Templates**.
 3. Search for **Thinker**.
-4. Keep the default image `tmsoftbrasil/thinker:0.32` unless you need to pin another version.
+4. Keep the default image `tmsoftbrasil/thinker:0.33` unless you need to pin another version.
 5. Deploy the template.
 
 The template provisions Thinker, PostgreSQL, a persistent request-recording volume, generated secrets, and a domain proxy on port `2099`.
@@ -43,7 +43,7 @@ Create the Thinker app service:
 1. Click **Create Service**.
 2. Choose **App**.
 3. Set source type to **Docker image**.
-4. Use image `tmsoftbrasil/thinker:0.32`.
+4. Use image `tmsoftbrasil/thinker:0.33`.
 5. Set the proxy port to `2099`.
 6. Add your domain and mark it as the primary domain.
 
@@ -97,7 +97,7 @@ Before publishing a template, smoke test the full first-run flow:
 
 ## What Gets Provisioned
 
-- Thinker Docker image `tmsoftbrasil/thinker:0.32`.
+- Thinker Docker image `tmsoftbrasil/thinker:0.33`.
 - PostgreSQL service.
 - Generated or manually configured session and encryption secrets.
 - HTTPS domain proxy to Thinker port `2099`.

diff --git a/deploy/easypanel/template/README.md b/deploy/easypanel/template/README.md
@@ -15,7 +15,7 @@ templates/thinker/meta.yaml
 
 The template provisions:
 
-- Thinker app service from `tmsoftbrasil/thinker:0.32`.
+- Thinker app service from `tmsoftbrasil/thinker:0.33`.
 - PostgreSQL 18 service.
 - Persistent app volume for compressed request recordings.
 - Generated database password, Better Auth secret, and Thinker encryption key.

diff --git a/deploy/easypanel/template/meta.yaml b/deploy/easypanel/template/meta.yaml
@@ -37,7 +37,7 @@ schema:
     appServiceImage:
       type: string
       title: App Service Image
-      default: tmsoftbrasil/thinker:0.32
+      default: tmsoftbrasil/thinker:0.33
     databaseServiceName:
       type: string
       title: Database Service Name

diff --git a/deploy/fly/TUTORIAL.md b/deploy/fly/TUTORIAL.md
@@ -34,7 +34,7 @@ Environment variables:
 - `FLY_ORG`: Fly organization. Defaults to `personal`.
 - `FLY_RECORDING_BUCKET_NAME`: private Tigris bucket name. Defaults to `<app-name>-recordings`. Keep the same value on reruns; changing an attached bucket requires a manual recording migration.
 
-The script uses [`fly.toml`](fly.toml) as a template and deploys `docker.io/tmsoftbrasil/thinker:0.32`. It creates a private Tigris bucket and lets Fly stage the bucket's `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` secrets on the app; Thinker uses those credentials with the bucket name, Tigris endpoint, and `auto` region from `fly.toml`. Re-running the script keeps that bucket and the existing `BETTER_AUTH_SECRET` and `THINKER_ENCRYPTION_KEY` values; rotate those secrets manually only if you intend to invalidate sessions and encrypted provider credentials.
+The script uses [`fly.toml`](fly.toml) as a template and deploys `docker.io/tmsoftbrasil/thinker:0.33`. It creates a private Tigris bucket and lets Fly stage the bucket's `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` secrets on the app; Thinker uses those credentials with the bucket name, Tigris endpoint, and `auto` region from `fly.toml`. Re-running the script keeps that bucket and the existing `BETTER_AUTH_SECRET` and `THINKER_ENCRYPTION_KEY` values; rotate those secrets manually only if you intend to invalidate sessions and encrypted provider credentials.
 
 ## Manual Deploy
 
@@ -112,7 +112,7 @@ fly logs --app <your-fly-app>
 
 ## What Gets Provisioned
 
-- Fly app running `docker.io/tmsoftbrasil/thinker:0.32`.
+- Fly app running `docker.io/tmsoftbrasil/thinker:0.33`.
 - Fly Postgres app.
 - Private Tigris S3-compatible bucket for compressed request recordings.
 - `DATABASE_URL` secret from `fly postgres attach`.

diff --git a/deploy/fly/fly.toml b/deploy/fly/fly.toml
@@ -12,7 +12,7 @@ kill_signal = "SIGINT"
 kill_timeout = "30s"
 
 [build]
-  image = "docker.io/tmsoftbrasil/thinker:0.32"
+  image = "docker.io/tmsoftbrasil/thinker:0.33"
 
 [env]
   PORT = "2099"

diff --git a/deploy/gcp/deploystack.json b/deploy/gcp/deploystack.json
@@ -26,7 +26,7 @@
       "name": "image_url",
       "prompt": "Thinker image",
       "type": "string",
-      "default": "docker.io/tmsoftbrasil/thinker:0.32"
+      "default": "docker.io/tmsoftbrasil/thinker:0.33"
     },
     {
       "name": "database_tier",

diff --git a/deploy/gcp/variables.tf b/deploy/gcp/variables.tf
@@ -23,7 +23,7 @@ variable "service_name" {
 variable "image_url" {
   description = "Thinker container image to deploy."
   type        = string
-  default     = "docker.io/tmsoftbrasil/thinker:0.32"
+  default     = "docker.io/tmsoftbrasil/thinker:0.33"
 }
 
 variable "database_tier" {

diff --git a/deploy/koyeb/TUTORIAL.md b/deploy/koyeb/TUTORIAL.md
@@ -33,7 +33,7 @@ openssl rand -hex 32
 Open the Koyeb deploy link:
 
 ```text
-https://app.koyeb.com/deploy?type=docker&image=docker.io%2Ftmsoftbrasil%2Fthinker%3A0.32&name=thinker&service_type=web&ports=2099%3Bhttp%3B%2F&env%5BPORT%5D=2099&env%5BDATABASE_URL%5D=postgres%3A%2F%2FUSER%3APASSWORD%40HOST%2FDB%3Fsslmode%3Drequire&env%5BBETTER_AUTH_SECRET%5D=replace-with-openssl-rand-hex-32&env%5BTHINKER_ENCRYPTION_KEY%5D=replace-with-different-openssl-rand-hex-32&env%5BBETTER_AUTH_URL%5D=https%3A%2F%2F%7B%7B+KOYEB_PUBLIC_DOMAIN+%7D%7D&env%5BBIND_ADDRESS%5D=0.0.0.0&env%5BDB_POOL_MAX%5D=8&env%5BAUTH_DB_POOL_MAX%5D=4&env%5BTHINKER_RECORDING_STORAGE%5D=s3&env%5BTHINKER_RECORDING_S3_BUCKET%5D=replace-with-private-bucket&env%5BTHINKER_RECORDING_S3_ENDPOINT%5D=https%3A%2F%2Fs3.example.com&env%5BTHINKER_RECORDING_S3_REGION%5D=us-east-1&env%5BTHINKER_RECORDING_S3_ACCESS_KEY_ID%5D=replace-with-limited-access-key&env%5BTHINKER_RECORDING_S3_SECRET_ACCESS_KEY%5D=replace-with-secret-key&env%5BTHINKER_RECORDING_S3_FORCE_PATH_STYLE%5D=false
+https://app.koyeb.com/deploy?type=docker&image=docker.io%2Ftmsoftbrasil%2Fthinker%3A0.33&name=thinker&service_type=web&ports=2099%3Bhttp%3B%2F&env%5BPORT%5D=2099&env%5BDATABASE_URL%5D=postgres%3A%2F%2FUSER%3APASSWORD%40HOST%2FDB%3Fsslmode%3Drequire&env%5BBETTER_AUTH_SECRET%5D=replace-with-openssl-rand-hex-32&env%5BTHINKER_ENCRYPTION_KEY%5D=replace-with-different-openssl-rand-hex-32&env%5BBETTER_AUTH_URL%5D=https%3A%2F%2F%7B%7B+KOYEB_PUBLIC_DOMAIN+%7D%7D&env%5BBIND_ADDRESS%5D=0.0.0.0&env%5BDB_POOL_MAX%5D=8&env%5BAUTH_DB_POOL_MAX%5D=4&env%5BTHINKER_RECORDING_STORAGE%5D=s3&env%5BTHINKER_RECORDING_S3_BUCKET%5D=replace-with-private-bucket&env%5BTHINKER_RECORDING_S3_ENDPOINT%5D=https%3A%2F%2Fs3.example.com&env%5BTHINKER_RECORDING_S3_REGION%5D=us-east-1&env%5BTHINKER_RECORDING_S3_ACCESS_KEY_ID%5D=replace-with-limited-access-key&env%5BTHINKER_RECORDING_S3_SECRET_ACCESS_KEY%5D=replace-with-secret-key&env%5BTHINKER_RECORDING_S3_FORCE_PATH_STYLE%5D=false
 ```
 
 In the deploy form:
@@ -45,7 +45,7 @@ In the deploy form:
 - Leave `BETTER_AUTH_URL` as `https://{{ KOYEB_PUBLIC_DOMAIN }}`.
 - Leave `PORT`, `BIND_ADDRESS`, `DB_POOL_MAX`, `AUTH_DB_POOL_MAX`, and `THINKER_RECORDING_STORAGE=s3` unchanged for a single-instance deploy. Set `THINKER_RECORDING_S3_FORCE_PATH_STYLE=true` only if your object-storage provider requires path-style URLs.
 
-The button deploys `docker.io/tmsoftbrasil/thinker:0.32` and exposes port `2099` over HTTP.
+The button deploys `docker.io/tmsoftbrasil/thinker:0.33` and exposes port `2099` over HTTP.
 
 ## Open Thinker
 

diff --git a/design-system/registry/components.json b/design-system/registry/components.json
@@ -1099,7 +1099,8 @@
       ],
       "files": [
         "base.css",
-        "canvas.css"
+        "canvas.css",
+        "shell.css"
       ]
     },
     "is-selecting": {
@@ -2165,7 +2166,7 @@
       "prop": "display",
       "value": "inline-flex",
       "file": "shell.css",
-      "line": 1073
+      "line": 1080
     },
     {
       "selector": ".app.is-collapsed .user-trigger > svg",
@@ -2174,7 +2175,7 @@
       "prop": "display",
       "value": "inline-flex",
       "file": "shell.css",
-      "line": 1073
+      "line": 1080
     },
     {
       "selector": ".app.is-collapsed .user-trigger",
@@ -2183,21 +2184,21 @@
       "prop": "padding",
       "value": "6px 8px",
       "file": "shell.css",
-      "line": 1082
+      "line": 1089
     },
     {
       "selector": ".liquid-metal::after",
       "prop": "inset",
       "value": "-5px",
       "file": "shell.css",
-      "line": 1248
+      "line": 1255
     },
     {
       "selector": ".liquid-metal::after",
       "prop": "padding",
       "value": "5px",
       "file": "shell.css",
-      "line": 1249
+      "line": 1256
     }
   ],
   "ghostRules": [
@@ -2208,8 +2209,8 @@
       "prop": "display",
       "value": "revert",
       "file": "shell.css",
-      "line": 1066,
-      "losesTo": "shell.css:1073"
+      "line": 1073,
+      "losesTo": "shell.css:1080"
     },
     {
       "selector": ".app.is-collapsed .user-trigger > svg",
@@ -2218,8 +2219,8 @@
       "prop": "display",
       "value": "revert",
       "file": "shell.css",
-      "line": 1066,
-      "losesTo": "shell.css:1073"
+      "line": 1073,
+      "losesTo": "shell.css:1080"
     },
     {
       "selector": ".app.is-collapsed .user-trigger",
@@ -2228,24 +2229,24 @@
       "prop": "padding",
       "value": "0 10px",
       "file": "shell.css",
-      "line": 1078,
-      "losesTo": "shell.css:1082"
+      "line": 1085,
+      "losesTo": "shell.css:1089"
     },
     {
       "selector": ".liquid-metal::after",
       "prop": "inset",
       "value": "-2px",
       "file": "shell.css",
-      "line": 1204,
-      "losesTo": "shell.css:1248"
+      "line": 1211,
+      "losesTo": "shell.css:1255"
     },
     {
       "selector": ".liquid-metal::after",
       "prop": "padding",
       "value": "2px",
       "file": "shell.css",
-      "line": 1206,
-      "losesTo": "shell.css:1249"
+      "line": 1213,
+      "losesTo": "shell.css:1256"
     }
   ],
   "componentSheets": {

diff --git a/design-system/registry/llms.txt b/design-system/registry/llms.txt
@@ -177,7 +177,7 @@ is-ok (base.css): is-ok
 is-outline (base.css): is-outline
 is-pulse (base.css): is-pulse
 is-round (canvas.css): is-round
-is-selected (base.css, canvas.css): is-selected
+is-selected (base.css, canvas.css, shell.css): is-selected
 is-selecting (canvas.css): is-selecting
 is-sink (canvas.css): is-sink
 is-success (shell.css): is-success
@@ -324,18 +324,18 @@ Tabs: src/components/ui.tsx
 (empty until primitives exist)
 
 ## Canonical rules — same selector+property declared twice with different values; the winner renders (5)
-.app.is-collapsed .nav-action { display: inline-flex }  ← shell.css:1073  [@media (max-width: 900px)]
-.app.is-collapsed .user-trigger > svg { display: inline-flex }  ← shell.css:1073  [@media (max-width: 900px)]
-.app.is-collapsed .user-trigger { padding: 6px 8px }  ← shell.css:1082  [@media (max-width: 900px)]
-.liquid-metal::after { inset: -5px }  ← shell.css:1248
-.liquid-metal::after { padding: 5px }  ← shell.css:1249
+.app.is-collapsed .nav-action { display: inline-flex }  ← shell.css:1080  [@media (max-width: 900px)]
+.app.is-collapsed .user-trigger > svg { display: inline-flex }  ← shell.css:1080  [@media (max-width: 900px)]
+.app.is-collapsed .user-trigger { padding: 6px 8px }  ← shell.css:1089  [@media (max-width: 900px)]
+.liquid-metal::after { inset: -5px }  ← shell.css:1255
+.liquid-metal::after { padding: 5px }  ← shell.css:1256
 
 ## Ghost rules — declared but always losing; edit the canonical rule instead, delete these in the refactor project (5)
-.app.is-collapsed .nav-action { display: revert }  at shell.css:1066 loses to shell.css:1073
-.app.is-collapsed .user-trigger > svg { display: revert }  at shell.css:1066 loses to shell.css:1073
-.app.is-collapsed .user-trigger { padding: 0 10px }  at shell.css:1078 loses to shell.css:1082
-.liquid-metal::after { inset: -2px }  at shell.css:1204 loses to shell.css:1248
-.liquid-metal::after { padding: 2px }  at shell.css:1206 loses to shell.css:1249
+.app.is-collapsed .nav-action { display: revert }  at shell.css:1073 loses to shell.css:1080
+.app.is-collapsed .user-trigger > svg { display: revert }  at shell.css:1073 loses to shell.css:1080
+.app.is-collapsed .user-trigger { padding: 0 10px }  at shell.css:1085 loses to shell.css:1089
+.liquid-metal::after { inset: -2px }  at shell.css:1211 loses to shell.css:1255
+.liquid-metal::after { padding: 2px }  at shell.css:1213 loses to shell.css:1256
 
 ## Component-loaded sheets — imported by components, not index.css; they load after the global styles (2)
 canvas.css ← pages/Topology.tsx

diff --git a/docs/releases/0.33.0.md b/docs/releases/0.33.0.md
@@ -0,0 +1,9 @@
+# Thinker 0.33.0
+
+```bash
+docker pull tmsoftbrasil/thinker:0.33.0
+```
+
+## Mudanças
+
+- feat(dashboard): overview KPI cards drive the chart (cost and tokens as cards, View details, legends, k/m and plain-dollar axes), Observability nav section, request drawer stack and connection-scoped reliability
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/backend/src/analytics/controllers/reliability-analytics.controller.ts b/packages/backend/src/analytics/controllers/reliability-analytics.controller.ts
@@ -10,7 +10,14 @@ import { TenantCtx, TenantContext } from '../../common/decorators/tenant-context
 import { UserCacheInterceptor } from '../../common/interceptors/user-cache.interceptor';
 import { DASHBOARD_CACHE_TTL_MS } from '../../common/constants/cache.constants';
 
-class ReliabilityTimeseriesQueryDto extends RangeQueryDto {
+class ReliabilityScopedQueryDto extends RangeQueryDto {
+  /** Scopes to ONE provider connection (`tenant_providers.id`), terminal attribution. */
+  @IsOptional()
+  @IsString()
+  connection_id?: string;
+}
+
+class ReliabilityTimeseriesQueryDto extends ReliabilityScopedQueryDto {
   @IsOptional()
   @IsString()
   @IsIn([...RELIABILITY_TS_DIMENSIONS])
@@ -32,11 +39,12 @@ export class ReliabilityAnalyticsController {
   constructor(private readonly reliabilityStats: ReliabilityStatsService) {}
 
   @Get('stats')
-  async getStats(@Query() query: RangeQueryDto, @TenantCtx() ctx: TenantContext) {
+  async getStats(@Query() query: ReliabilityScopedQueryDto, @TenantCtx() ctx: TenantContext) {
     return this.reliabilityStats.getStats({
       tenantId: ctx.tenantId,
       range: query.range,
       agentName: query.agent_name,
+      connectionId: query.connection_id,
     });
   }
 
@@ -51,6 +59,7 @@ export class ReliabilityAnalyticsController {
       by: query.by,
       agentName: query.agent_name,
       failedOnly: query.failed_only === 'true',
+      connectionId: query.connection_id,
     });
   }