@oneuptime/common 11.5.3 → 11.5.5

package/build/dist/Server/API/AIAgentDataAPI.js

@@ -1,19 +1,30 @@
 import AIAgentService from "../Services/AIAgentService";
-import LlmProviderService from "../Services/LlmProviderService";
 import TelemetryExceptionService from "../Services/TelemetryExceptionService";
 import ServiceService from "../Services/ServiceService";
-import ServiceCodeRepositoryService from "../Services/ServiceCodeRepositoryService";
 import CodeRepositoryService from "../Services/CodeRepositoryService";
 import AIAgentTaskPullRequestService from "../Services/AIAgentTaskPullRequestService";
-import AIAgentTaskService from "../Services/AIAgentTaskService";
+import AIRunService from "../Services/AIRunService";
+import AIRunEventService from "../Services/AIRunEventService";
+import IncidentService from "../Services/IncidentService";
+import AlertService from "../Services/AlertService";
+import IncidentFeedService from "../Services/IncidentFeedService";
+import AlertFeedService from "../Services/AlertFeedService";
 import Express from "../Utils/Express";
 import Response from "../Utils/Response";
 import AIAgentTaskPullRequest from "../../Models/DatabaseModels/AIAgentTaskPullRequest";
+import { IncidentFeedEventType, } from "../../Models/DatabaseModels/IncidentFeed";
+import { AlertFeedEventType, } from "../../Models/DatabaseModels/AlertFeed";
+import AIRunEventType from "../../Types/AI/AIRunEventType";
+import AIRunType from "../../Types/AI/AIRunType";
+import { CodeFixContextKind, CodeFixTaskTypeHelper, } from "../../Types/AI/CodeFixTaskType";
+import SpanTreeAnalyzer from "../Utils/AI/PerfEvidence/SpanTreeAnalyzer";
+import OpenPullRequestCap from "../Utils/AI/CodeFix/OpenPullRequestCap";
+import CodeFixAgentCompletion from "../Utils/AI/CodeFix/CodeFixAgentCompletion";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import GitHubUtil from "../Utils/CodeRepository/GitHub/GitHub";
 import CodeRepositoryType from "../../Types/CodeRepository/CodeRepositoryType";
-import LIMIT_MAX from "../../Types/Database/LimitMax";
 import URL from "../../Types/API/URL";
 import PullRequestState from "../../Types/CodeRepository/PullRequestState";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
@@ -26,41 +37,53 @@ export default class AIAgentDataAPI {
         return this.router;
     }
     initRoutes() {
-        // Get LLM configuration for a project
-        this.router.post("/ai-agent-data/get-llm-config", async (req, res, next) => {
+        /*
+         * Server-mediated LLM completion for the in-house code-fix agent (B4
+         * Tier 0, Internal/Roadmap/CodeFixSandboxDesign.md). One call = one
+         * completion of the worker's tool loop, executed through
+         * AIService.executeWithLogging: metered, LlmLog-linked to the run,
+         * inside the G4 daily budget, and under per-run loop budgets (max
+         * completion calls / output tokens) enforced server-side. The worker
+         * never receives a provider secret on this path.
+         *
+         * Request:  { aiAgentId, aiAgentKey, taskId, messages, tools?, maxTokens? }
+         * Response: { message: { role: "assistant", content, toolCalls },
+         *             stopReason: "stop" | "tool_use",
+         *             budget: { completionCallsUsed, maxCompletionCalls,
+         *                       outputTokensUsed, maxOutputTokens } }
+         */
+        this.router.post("/ai-agent-data/llm-completion", async (req, res, next) => {
             try {
                 const data = req.body;
                 // Validate AI Agent credentials
                 const aiAgent = await this.validateAIAgent(data);
-                if (!aiAgent) {
+                if (!aiAgent || !aiAgent.id) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid AI Agent ID or AI Agent Key"));
                 }
-                // Get project ID
-                if (!data["projectId"]) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("projectId is required"));
-                }
-                const projectId = new ObjectID(data["projectId"]);
-                // Check if this is a Project AI Agent (has a projectId)
-                const isProjectAIAgent = aiAgent.projectId !== null && aiAgent.projectId !== undefined;
-                // Get LLM provider for the project
-                const llmProvider = await LlmProviderService.getLLMProviderForProject(projectId);
-                if (!llmProvider) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("No LLM provider configured for this project"));
-                }
-                /*
-                 * Security check: Project AI Agents cannot access Global LLM Providers
-                 * Only Global AI Agents (projectId is null) can access Global LLM Providers
-                 */
-                const isGlobalLLMProvider = llmProvider.isGlobalLlm === true;
-                if (isProjectAIAgent && isGlobalLLMProvider) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Project AI Agents cannot access Global LLM Providers. Please configure a project-specific LLM Provider."));
+                if (!data["taskId"]) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("taskId is required"));
                 }
-                logger.debug(`LLM config fetched for project ${projectId.toString()}: ${llmProvider.llmType}`, getLogAttributesFromRequest(req));
+                const taskId = new ObjectID(data["taskId"]);
+                const messages = this.parseCompletionMessages(data["messages"]);
+                const tools = this.parseCompletionTools(data["tools"]);
+                const maxTokens = typeof data["maxTokens"] === "number" && data["maxTokens"] > 0
+                    ? data["maxTokens"]
+                    : undefined;
+                const result = await CodeFixAgentCompletion.execute({
+                    aiAgentId: aiAgent.id,
+                    aiRunId: taskId,
+                    messages,
+                    tools,
+                    maxTokens,
+                });
                 return Response.sendJsonObjectResponse(req, res, {
-                    llmType: llmProvider.llmType,
-                    apiKey: llmProvider.apiKey,
-                    baseUrl: llmProvider.baseUrl,
-                    modelName: llmProvider.modelName,
+                    message: {
+                        role: "assistant",
+                        content: result.content,
+                        toolCalls: result.toolCalls,
+                    },
+                    stopReason: result.stopReason,
+                    budget: result.budget,
                 });
             }
             catch (err) {
@@ -142,9 +165,14 @@ export default class AIAgentDataAPI {
                 next(err);
             }
         });
-        // Get code repositories linked to a service
+        /*
+         * Resolve the repository the exception's code lives in — AT RUNTIME
+         * (stack-trace path matching over the project's connected repos, with
+         * name-match and only-repository fallbacks). Replaces the old
+         * ServiceCodeRepository mapping-table lookup; the response keeps the
+         * `repositories` array shape the agent already consumes.
+         */
         this.router.post("/ai-agent-data/get-code-repositories", async (req, res, next) => {
-            var _a;
             try {
                 const data = req.body;
                 // Validate AI Agent credentials
@@ -152,63 +180,405 @@ export default class AIAgentDataAPI {
                 if (!aiAgent) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid AI Agent ID or AI Agent Key"));
                 }
-                // Get service ID (supports primaryEntityId plus legacy serviceId / telemetryServiceId from older agents)
-                const serviceIdParam = data["primaryEntityId"] ||
-                    data["serviceId"] ||
-                    data["telemetryServiceId"];
-                if (!serviceIdParam) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("primaryEntityId is required"));
-                }
-                const primaryEntityId = new ObjectID(serviceIdParam);
-                // Find CodeRepositories linked to this Service
-                const repositories = [];
-                const serviceCodeRepositories = await ServiceCodeRepositoryService.findBy({
-                    query: {
-                        serviceId: primaryEntityId,
-                    },
+                if (!data["exceptionId"]) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("exceptionId is required (agents older than the runtime-resolution change must be upgraded)"));
+                }
+                const exceptionId = new ObjectID(data["exceptionId"]);
+                const exception = await TelemetryExceptionService.findOneById({
+                    id: exceptionId,
                     select: {
-                        codeRepositoryId: true,
-                        servicePathInRepository: true,
-                        codeRepository: {
-                            _id: true,
+                        _id: true,
+                        projectId: true,
+                        stackTrace: true,
+                        primaryEntityId: true,
+                    },
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                if (!exception || !exception.projectId) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("Exception not found"));
+                }
+                // Service name feeds the name-match fallback when there is one.
+                const service = exception.primaryEntityId
+                    ? await ServiceService.findOneById({
+                        id: exception.primaryEntityId,
+                        select: {
                             name: true,
-                            repositoryHostedAt: true,
-                            organizationName: true,
-                            repositoryName: true,
-                            mainBranchName: true,
-                            gitHubAppInstallationId: true,
                         },
+                        props: {
+                            isRoot: true,
+                        },
+                    })
+                    : null;
+                const resolution = await CodeRepositoryService.resolveRepositoryForException({
+                    projectId: exception.projectId,
+                    stackTrace: exception.stackTrace || null,
+                    serviceName: (service === null || service === void 0 ? void 0 : service.name) || null,
+                });
+                if (!resolution) {
+                    logger.debug(`No repository resolved for exception ${exceptionId.toString()}`, getLogAttributesFromRequest(req));
+                    return Response.sendJsonObjectResponse(req, res, {
+                        repositories: [],
+                        resolutionError: "Could not resolve a repository for this exception: no connected repository contains the files in its stack trace, no repository name matches the service, and the project has more than one repository. Connect the right repository via the GitHub App.",
+                    });
+                }
+                const repository = await CodeRepositoryService.findOneById({
+                    id: new ObjectID(resolution.codeRepositoryId),
+                    select: {
+                        _id: true,
+                        name: true,
+                        repositoryHostedAt: true,
+                        organizationName: true,
+                        repositoryName: true,
+                        mainBranchName: true,
+                        gitHubAppInstallationId: true,
+                    },
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                if (!repository) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("Resolved repository no longer exists"));
+                }
+                logger.debug(`Resolved repository ${resolution.organizationName}/${resolution.repositoryName} for exception ${exceptionId.toString()} via ${resolution.method}: ${resolution.evidence}`, getLogAttributesFromRequest(req));
+                return Response.sendJsonObjectResponse(req, res, {
+                    repositories: [
+                        {
+                            id: repository.id.toString(),
+                            name: repository.name || "",
+                            repositoryHostedAt: repository.repositoryHostedAt || "",
+                            organizationName: repository.organizationName || "",
+                            repositoryName: repository.repositoryName || "",
+                            mainBranchName: repository.mainBranchName || "main",
+                            servicePathInRepository: resolution.servicePathInRepository,
+                            gitHubAppInstallationId: repository.gitHubAppInstallationId || null,
+                            resolutionMethod: resolution.method,
+                            resolutionEvidence: resolution.evidence,
+                        },
+                    ],
+                });
+            }
+            catch (err) {
+                next(err);
+            }
+        });
+        /*
+         * Context for every non-exception recipe, keyed by the run id `taskId`
+         * (the id get-pending-task returned) — these runs have NO telemetry
+         * exception, so the exception-shaped endpoints above cannot serve them.
+         * The route name predates the newer recipes and is kept for agent
+         * compatibility. Two context kinds are served:
+         *
+         *  - Incident/alert-subject recipes (ImproveInstrumentation,
+         *    FixFromIncident): the investigation's posted analysis + subject
+         *    metadata + the repository resolved without a stack trace. The
+         *    analysis text comes from the subject's latest RootCause feed item:
+         *    the AI's postAnalysis is the only writer of RootCause feed
+         *    events, it writes them for BOTH subjects and BOTH confidence
+         *    outcomes (quiet mode only mutes the workspace ping), so the feed
+         *    item IS the investigation run's persisted output.
+         *
+         *  - Trace-evidence recipes (FixPerformance): the deterministic
+         *    span-tree findings stored on AIRun.taskContext at trigger time
+         *    (subjectType "trace"; the rendered evidence rides in
+         *    analysisMarkdown so the worker pipeline stays shared). Repository
+         *    resolution here TRIES the stack-trace path matcher first, fed by a
+         *    synthetic trace built from the implicated spans' code.*
+         *    attributes, before the name-match / only-repository fallbacks.
+         */
+        this.router.post("/ai-agent-data/get-instrumentation-task-details", async (req, res, next) => {
+            var _a;
+            try {
+                const data = req.body;
+                // Validate AI Agent credentials
+                const aiAgent = await this.validateAIAgent(data);
+                if (!aiAgent) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("Invalid AI Agent ID or AI Agent Key"));
+                }
+                if (!data["taskId"]) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("taskId is required"));
+                }
+                const taskId = new ObjectID(data["taskId"]);
+                const run = await AIRunService.findOneById({
+                    id: taskId,
+                    select: {
+                        _id: true,
+                        projectId: true,
+                        runType: true,
+                        codeFixTaskType: true,
+                        triggeredByIncidentId: true,
+                        triggeredByAlertId: true,
+                        taskContext: true,
                     },
-                    skip: 0,
-                    limit: LIMIT_MAX,
                     props: {
                         isRoot: true,
                     },
                 });
-                for (const scr of serviceCodeRepositories) {
-                    if (scr.codeRepository) {
-                        // Check if we already have this repository
-                        const existingRepo = repositories.some((r) => {
-                            var _a, _b;
-                            return r.id === ((_b = (_a = scr.codeRepository) === null || _a === void 0 ? void 0 : _a._id) === null || _b === void 0 ? void 0 : _b.toString());
-                        });
-                        if (!existingRepo) {
-                            repositories.push({
-                                id: ((_a = scr.codeRepository._id) === null || _a === void 0 ? void 0 : _a.toString()) || "",
-                                name: scr.codeRepository.name || "",
-                                repositoryHostedAt: scr.codeRepository.repositoryHostedAt || "",
-                                organizationName: scr.codeRepository.organizationName || "",
-                                repositoryName: scr.codeRepository.repositoryName || "",
-                                mainBranchName: scr.codeRepository.mainBranchName || "main",
-                                servicePathInRepository: scr.servicePathInRepository || null,
-                                gitHubAppInstallationId: scr.codeRepository.gitHubAppInstallationId || null,
-                            });
+                if (!run || !run.projectId) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("Task not found"));
+                }
+                /*
+                 * Any non-exception recipe is served here — the same context-kind
+                 * grouping the claim guard uses.
+                 */
+                const taskType = CodeFixTaskTypeHelper.fromDatabaseValue(run.codeFixTaskType);
+                const contextKind = CodeFixTaskTypeHelper.getContextKind(taskType);
+                if (run.runType !== AIRunType.CodeFix ||
+                    contextKind === CodeFixContextKind.TelemetryException) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("Task is not an incident/alert-subject or trace-evidence code-fix run (ImproveInstrumentation, FixFromIncident or FixPerformance)"));
+                }
+                /*
+                 * Trace-evidence recipes (FixPerformance): everything the worker
+                 * needs was captured into taskContext at trigger time — the spans
+                 * themselves may already be past ClickHouse retention.
+                 */
+                if (contextKind === CodeFixContextKind.TaskContext) {
+                    const taskContext = run.taskContext;
+                    const findings = (taskContext === null || taskContext === void 0 ? void 0 : taskContext.performanceFindings) || [];
+                    if (!(taskContext === null || taskContext === void 0 ? void 0 : taskContext.traceId) || findings.length === 0) {
+                        return Response.sendErrorResponse(req, res, new BadDataException("This performance-fix task has no stored trace evidence — the task has nothing to work from."));
+                    }
+                    // Deduped name+duration summary of every implicated span.
+                    const spanSummaries = [];
+                    const seenSpanIds = new Set();
+                    for (const finding of findings) {
+                        for (const implicated of finding.implicatedSpans) {
+                            if (!seenSpanIds.has(implicated.spanId)) {
+                                seenSpanIds.add(implicated.spanId);
+                                spanSummaries.push(implicated);
+                            }
                         }
                     }
+                    /*
+                     * Repository resolution: the implicated spans' code.*
+                     * attributes (when the instrumentation stamps them) become a
+                     * synthetic stack trace for the path matcher — each line is
+                     * shaped so extractCandidatePathsFromStackTrace parses it.
+                     * Without code attributes this degrades to the name-match /
+                     * only-repository fallbacks, exactly like the subject recipes.
+                     */
+                    const codeLocations = taskContext.codeLocations || [];
+                    const syntheticStackTrace = codeLocations.length > 0
+                        ? codeLocations
+                            .map((location) => {
+                            var _a;
+                            return `    at ${location.functionName ? `${location.functionName} ` : ""}(${location.filePath}:${(_a = location.lineNumber) !== null && _a !== void 0 ? _a : 1})`;
+                        })
+                            .join("\n")
+                        : null;
+                    const serviceName = taskContext.serviceName || null;
+                    const resolution = await CodeRepositoryService.resolveRepositoryForException({
+                        projectId: run.projectId,
+                        stackTrace: syntheticStackTrace,
+                        serviceName,
+                    });
+                    const repository = resolution
+                        ? await CodeRepositoryService.findOneById({
+                            id: new ObjectID(resolution.codeRepositoryId),
+                            select: {
+                                _id: true,
+                                name: true,
+                                repositoryHostedAt: true,
+                                organizationName: true,
+                                repositoryName: true,
+                                mainBranchName: true,
+                                gitHubAppInstallationId: true,
+                            },
+                            props: {
+                                isRoot: true,
+                            },
+                        })
+                        : null;
+                    /*
+                     * The rendered evidence rides in analysisMarkdown and the top
+                     * finding's headline in subjectTitle, so the shared
+                     * SubjectPullRequestTaskHandler pipeline needs no special
+                     * casing — the structured findings travel alongside.
+                     */
+                    const basePayload = {
+                        subjectType: "trace",
+                        subjectTitle: findings[0].headline,
+                        analysisMarkdown: SpanTreeAnalyzer.renderFindingsMarkdown(findings),
+                        serviceName,
+                        projectId: run.projectId.toString(),
+                        traceId: taskContext.traceId,
+                        findings: findings,
+                        spanSummaries: spanSummaries,
+                    };
+                    if (!resolution || !repository) {
+                        logger.debug(`No repository resolved for ${taskType} task ${taskId.toString()}`, getLogAttributesFromRequest(req));
+                        return Response.sendJsonObjectResponse(req, res, Object.assign(Object.assign({}, basePayload), { repositories: [], resolutionError: "Could not resolve a repository for this performance-fix task: the trace's spans carried no matching code file paths, no connected repository name matches the affected service, and the project has more than one repository. Connect the right repository via the GitHub App, or rename one to match the service." }));
+                    }
+                    logger.debug(`Resolved repository ${resolution.organizationName}/${resolution.repositoryName} for ${taskType} task ${taskId.toString()} via ${resolution.method}: ${resolution.evidence}`, getLogAttributesFromRequest(req));
+                    return Response.sendJsonObjectResponse(req, res, Object.assign(Object.assign({}, basePayload), { repositories: [
+                            {
+                                id: repository.id.toString(),
+                                name: repository.name || "",
+                                repositoryHostedAt: repository.repositoryHostedAt || "",
+                                organizationName: repository.organizationName || "",
+                                repositoryName: repository.repositoryName || "",
+                                mainBranchName: repository.mainBranchName || "main",
+                                servicePathInRepository: resolution.servicePathInRepository,
+                                gitHubAppInstallationId: repository.gitHubAppInstallationId || null,
+                                resolutionMethod: resolution.method,
+                                resolutionEvidence: resolution.evidence,
+                            },
+                        ] }));
+                }
+                if (!run.triggeredByIncidentId && !run.triggeredByAlertId) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("This task has no incident or alert subject"));
+                }
+                const subjectType = run.triggeredByIncidentId
+                    ? "incident"
+                    : "alert";
+                let subjectTitle = "";
+                /*
+                 * Best-effort service attribution from the subject's monitors —
+                 * it only feeds the repository name-match fallback, so null is
+                 * fine when the subject has no monitor.
+                 */
+                let serviceName = null;
+                let analysisMarkdown = null;
+                if (run.triggeredByIncidentId) {
+                    const incident = await IncidentService.findOneById({
+                        id: run.triggeredByIncidentId,
+                        select: {
+                            title: true,
+                            monitors: {
+                                name: true,
+                            },
+                        },
+                        props: {
+                            isRoot: true,
+                        },
+                    });
+                    if (!incident) {
+                        return Response.sendErrorResponse(req, res, new BadDataException("The incident this task was created for no longer exists"));
+                    }
+                    subjectTitle = incident.title || "Untitled incident";
+                    serviceName =
+                        (incident.monitors || [])
+                            .map((monitor) => {
+                            return monitor.name || "";
+                        })
+                            .filter(Boolean)[0] || null;
+                    const feedItem = await IncidentFeedService.findOneBy({
+                        query: {
+                            incidentId: run.triggeredByIncidentId,
+                            incidentFeedEventType: IncidentFeedEventType.RootCause,
+                        },
+                        select: {
+                            feedInfoInMarkdown: true,
+                        },
+                        sort: {
+                            createdAt: SortOrder.Descending,
+                        },
+                        props: {
+                            isRoot: true,
+                        },
+                    });
+                    analysisMarkdown = (feedItem === null || feedItem === void 0 ? void 0 : feedItem.feedInfoInMarkdown) || null;
+                }
+                else {
+                    const alert = await AlertService.findOneById({
+                        id: run.triggeredByAlertId,
+                        select: {
+                            title: true,
+                            monitor: {
+                                name: true,
+                            },
+                        },
+                        props: {
+                            isRoot: true,
+                        },
+                    });
+                    if (!alert) {
+                        return Response.sendErrorResponse(req, res, new BadDataException("The alert this task was created for no longer exists"));
+                    }
+                    subjectTitle = alert.title || "Untitled alert";
+                    serviceName = ((_a = alert.monitor) === null || _a === void 0 ? void 0 : _a.name) || null;
+                    const feedItem = await AlertFeedService.findOneBy({
+                        query: {
+                            alertId: run.triggeredByAlertId,
+                            alertFeedEventType: AlertFeedEventType.RootCause,
+                        },
+                        select: {
+                            feedInfoInMarkdown: true,
+                        },
+                        sort: {
+                            createdAt: SortOrder.Descending,
+                        },
+                        props: {
+                            isRoot: true,
+                        },
+                    });
+                    analysisMarkdown = (feedItem === null || feedItem === void 0 ? void 0 : feedItem.feedInfoInMarkdown) || null;
+                }
+                if (!analysisMarkdown) {
+                    return Response.sendErrorResponse(req, res, new BadDataException(`No posted investigation analysis found for this ${subjectType} — the task has nothing to work from (the analysis feed item may have been deleted).`));
                 }
-                logger.debug(`Found ${repositories.length} code repositories for service ${primaryEntityId.toString()}`, getLogAttributesFromRequest(req));
+                /*
+                 * Resolve the repository WITHOUT a stack trace — these tasks have
+                 * no exception, so only the name-match (against the subject's
+                 * monitor/service name) and only-repository fallbacks apply. When
+                 * nothing resolves the worker fails the run with this guidance.
+                 */
+                const resolution = await CodeRepositoryService.resolveRepositoryForException({
+                    projectId: run.projectId,
+                    stackTrace: null,
+                    serviceName,
+                });
+                const repository = resolution
+                    ? await CodeRepositoryService.findOneById({
+                        id: new ObjectID(resolution.codeRepositoryId),
+                        select: {
+                            _id: true,
+                            name: true,
+                            repositoryHostedAt: true,
+                            organizationName: true,
+                            repositoryName: true,
+                            mainBranchName: true,
+                            gitHubAppInstallationId: true,
+                        },
+                        props: {
+                            isRoot: true,
+                        },
+                    })
+                    : null;
+                if (!resolution || !repository) {
+                    logger.debug(`No repository resolved for ${taskType} task ${taskId.toString()}`, getLogAttributesFromRequest(req));
+                    return Response.sendJsonObjectResponse(req, res, {
+                        subjectType,
+                        subjectTitle,
+                        analysisMarkdown,
+                        serviceName,
+                        projectId: run.projectId.toString(),
+                        repositories: [],
+                        resolutionError: "Could not resolve a repository for this task: no connected repository name matches the affected monitor/service and the project has more than one repository. Connect the right repository via the GitHub App, or rename one to match the service.",
+                    });
+                }
+                logger.debug(`Resolved repository ${resolution.organizationName}/${resolution.repositoryName} for ${taskType} task ${taskId.toString()} via ${resolution.method}: ${resolution.evidence}`, getLogAttributesFromRequest(req));
                 return Response.sendJsonObjectResponse(req, res, {
-                    repositories: repositories,
+                    subjectType,
+                    subjectTitle,
+                    analysisMarkdown,
+                    serviceName,
+                    projectId: run.projectId.toString(),
+                    repositories: [
+                        {
+                            id: repository.id.toString(),
+                            name: repository.name || "",
+                            repositoryHostedAt: repository.repositoryHostedAt || "",
+                            organizationName: repository.organizationName || "",
+                            repositoryName: repository.repositoryName || "",
+                            mainBranchName: repository.mainBranchName || "main",
+                            servicePathInRepository: resolution.servicePathInRepository,
+                            gitHubAppInstallationId: repository.gitHubAppInstallationId || null,
+                            resolutionMethod: resolution.method,
+                            resolutionEvidence: resolution.evidence,
+                        },
+                    ],
                 });
             }
             catch (err) {
@@ -217,6 +587,7 @@ export default class AIAgentDataAPI {
         });
         // Get access token for a code repository
         this.router.post("/ai-agent-data/get-repository-token", async (req, res, next) => {
+            var _a;
             try {
                 const data = req.body;
                 // Validate AI Agent credentials
@@ -238,6 +609,7 @@ export default class AIAgentDataAPI {
                         organizationName: true,
                         repositoryName: true,
                         gitHubAppInstallationId: true,
+                        maxOpenFixPullRequests: true,
                     },
                     props: {
                         isRoot: true,
@@ -254,6 +626,22 @@ export default class AIAgentDataAPI {
                 if (!codeRepository.gitHubAppInstallationId) {
                     return Response.sendErrorResponse(req, res, new BadDataException("No GitHub App installation ID found for this repository"));
                 }
+                /*
+                 * G11 guardrail: per-repo open-PR cap, enforced HERE because the
+                 * token is the agent's only way to clone and push — a repo at its
+                 * cap physically cannot receive another AI branch or PR. The
+                 * worker records this message as the run's failure guidance.
+                 */
+                const openPrCap = await OpenPullRequestCap.checkForRepository({
+                    codeRepositoryId,
+                    configuredLimit: (_a = codeRepository.maxOpenFixPullRequests) !== null && _a !== void 0 ? _a : null,
+                });
+                if (!openPrCap.allowed) {
+                    return Response.sendErrorResponse(req, res, new BadDataException(OpenPullRequestCap.describeRejection({
+                        decision: openPrCap,
+                        repositoryName: `${codeRepository.organizationName}/${codeRepository.repositoryName}`,
+                    })));
+                }
                 /*
                  * Generate GitHub installation access token with write permissions
                  * Required for AI Agent to push branches and create pull requests
@@ -311,8 +699,11 @@ export default class AIAgentDataAPI {
                 const description = data["description"];
                 const headRefName = data["headRefName"];
                 const baseRefName = data["baseRefName"];
-                // Get the task to get the project ID
-                const task = await AIAgentTaskService.findOneById({
+                /*
+                 * `taskId` carries the AIRun id of the code-fix run — get the run
+                 * for the project ID and so the PR can be recorded on its trail.
+                 */
+                const run = await AIRunService.findOneById({
                     id: taskId,
                     select: {
                         _id: true,
@@ -322,7 +713,7 @@ export default class AIAgentDataAPI {
                         isRoot: true,
                     },
                 });
-                if (!task) {
+                if (!run) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Task not found"));
                 }
                 // Get code repository for organization and repo name
@@ -339,10 +730,10 @@ export default class AIAgentDataAPI {
                 });
                 // Create the pull request record
                 const pullRequest = new AIAgentTaskPullRequest();
-                if (task.projectId) {
-                    pullRequest.projectId = task.projectId;
+                if (run.projectId) {
+                    pullRequest.projectId = run.projectId;
                 }
-                pullRequest.aiAgentTaskId = taskId;
+                pullRequest.aiRunId = taskId;
                 pullRequest.aiAgentId = aiAgent.id;
                 pullRequest.codeRepositoryId = codeRepositoryId;
                 pullRequest.pullRequestUrl = URL.fromString(pullRequestUrl);
@@ -375,7 +766,22 @@ export default class AIAgentDataAPI {
                         isRoot: true,
                     },
                 });
-                logger.debug(`Recorded pull request ${pullRequestUrl} for task ${taskId.toString()}`, getLogAttributesFromRequest(req));
+                /*
+                 * The pull request is the run's headline action — record it on
+                 * the run's glass-box trail so the activity feed shows it.
+                 */
+                if (run.projectId) {
+                    await AIRunEventService.appendEventToRun({
+                        projectId: run.projectId,
+                        aiRunId: taskId,
+                        eventType: AIRunEventType.ActionExecuted,
+                        toolName: "open_pull_request",
+                        resultSummary: {
+                            message: `Opened pull request: ${title} — ${pullRequestUrl}`,
+                        },
+                    });
+                }
+                logger.debug(`Recorded pull request ${pullRequestUrl} for run ${taskId.toString()}`, getLogAttributesFromRequest(req));
                 return Response.sendJsonObjectResponse(req, res, {
                     success: true,
                     pullRequestId: (_a = createdPullRequest._id) === null || _a === void 0 ? void 0 : _a.toString(),
@@ -386,6 +792,83 @@ export default class AIAgentDataAPI {
             }
         });
     }
+    /*
+     * Parse the completion request's messages into the LLMMessage shape —
+     * strict on structure (role whitelist, string content) so malformed
+     * worker payloads fail with a clear 4xx instead of a provider error.
+     */
+    parseCompletionMessages(raw) {
+        if (!Array.isArray(raw) || raw.length === 0) {
+            throw new BadDataException("messages must be a non-empty array");
+        }
+        const validRoles = ["system", "user", "assistant", "tool"];
+        return raw.map((entry, index) => {
+            if (!entry || typeof entry !== "object") {
+                throw new BadDataException(`messages[${index}] must be an object`);
+            }
+            const messageObject = entry;
+            const role = messageObject["role"];
+            if (!validRoles.includes(role)) {
+                throw new BadDataException(`messages[${index}].role must be one of: ${validRoles.join(", ")}`);
+            }
+            const message = {
+                role: role,
+                content: typeof messageObject["content"] === "string"
+                    ? messageObject["content"]
+                    : "",
+            };
+            if (Array.isArray(messageObject["toolCalls"])) {
+                message.toolCalls = messageObject["toolCalls"].map((toolCall, toolCallIndex) => {
+                    if (typeof toolCall["id"] !== "string" ||
+                        typeof toolCall["name"] !== "string") {
+                        throw new BadDataException(`messages[${index}].toolCalls[${toolCallIndex}] must carry string id and name`);
+                    }
+                    return {
+                        id: toolCall["id"],
+                        name: toolCall["name"],
+                        arguments: toolCall["arguments"] &&
+                            typeof toolCall["arguments"] === "object" &&
+                            !Array.isArray(toolCall["arguments"])
+                            ? toolCall["arguments"]
+                            : {},
+                    };
+                });
+            }
+            if (typeof messageObject["toolCallId"] === "string") {
+                message.toolCallId = messageObject["toolCallId"];
+            }
+            return message;
+        });
+    }
+    // Parse the completion request's tool definitions (optional).
+    parseCompletionTools(raw) {
+        if (raw === undefined || raw === null) {
+            return undefined;
+        }
+        if (!Array.isArray(raw)) {
+            throw new BadDataException("tools must be an array when provided");
+        }
+        if (raw.length === 0) {
+            return undefined;
+        }
+        return raw.map((entry, index) => {
+            if (!entry || typeof entry !== "object") {
+                throw new BadDataException(`tools[${index}] must be an object`);
+            }
+            const toolObject = entry;
+            if (typeof toolObject["name"] !== "string" ||
+                typeof toolObject["description"] !== "string" ||
+                !toolObject["inputSchema"] ||
+                typeof toolObject["inputSchema"] !== "object") {
+                throw new BadDataException(`tools[${index}] must carry string name, string description and an inputSchema object`);
+            }
+            return {
+                name: toolObject["name"],
+                description: toolObject["description"],
+                inputSchema: toolObject["inputSchema"],
+            };
+        });
+    }
     // Validate AI Agent credentials from request body
     async validateAIAgent(data) {
         if (!data["aiAgentId"] || !data["aiAgentKey"]) {