@oneuptime/common 11.5.8 → 11.5.9

package/Models/DatabaseModels/AIAgentTaskPullRequest.ts

@@ -189,13 +189,21 @@ export default class AIAgentTaskPullRequest extends BaseModel {
     ],
     update: [],
   })
+  /*
+   * Nullable since 2026-07-15: a pull request can now originate from an AI
+   * chat turn, which has no AIAgent behind it (the agent record belongs to the
+   * autonomous fix worker). A null aiAgent therefore means "authored from
+   * chat", and every consumer must tolerate it — SyncPullRequestStates already
+   * guards on aiRunId for the same reason.
+   */
   @TableColumn({
     type: TableColumnType.Entity,
-    required: true,
+    required: false,
     modelType: AIAgent,
     manyToOneRelationColumn: "aiAgentId",
     title: "AI Agent",
-    description: "AI Agent that created this pull request.",
+    description:
+      "AI Agent that created this pull request. Null when it was proposed from an AI chat conversation.",
   })
   @ManyToOne(
     () => {
@@ -204,7 +212,7 @@ export default class AIAgentTaskPullRequest extends BaseModel {
     {
       cascade: false,
       eager: false,
-      nullable: false,
+      nullable: true,
       onDelete: "CASCADE",
       orphanedRowAction: "nullify",
     },
@@ -231,14 +239,15 @@ export default class AIAgentTaskPullRequest extends BaseModel {
   @Index()
   @TableColumn({
     type: TableColumnType.ObjectID,
-    required: true,
+    required: false,
     canReadOnRelationQuery: true,
     title: "AI Agent ID",
-    description: "ID of the AI Agent that created this pull request.",
+    description:
+      "ID of the AI Agent that created this pull request. Null when it was proposed from an AI chat conversation.",
   })
   @Column({
     type: ColumnType.ObjectID,
-    nullable: false,
+    nullable: true,
     transformer: ObjectID.getDatabaseTransformer(),
   })
   public aiAgentId?: ObjectID = undefined;

package/Models/DatabaseModels/AIRun.ts

@@ -180,6 +180,43 @@ export default class AIRun extends BaseModel {
   })
   public codeFixTaskType?: CodeFixTaskType = undefined;
 
+  /*
+   * The per-project sequential task number shown as "#42" — the stable handle
+   * a human cites when reporting a bad run, the same role Incident.incidentNumber
+   * plays. Set only on CodeFix runs (the AI Tasks list): chat turns and
+   * investigations also live in this table but are not tasks, so numbering them
+   * would burn the counter on every Ask-AI message. Null therefore means "not a
+   * task", and also covers CodeFix rows created before this column existed —
+   * the backfill numbers those by age.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+    ],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    isDefaultValueColumn: false,
+    required: false,
+    type: TableColumnType.Number,
+    title: "Task Number",
+    description:
+      "Per-project sequential number for this AI task (code-fix runs only).",
+    example: 42,
+    computed: true,
+    canReadOnRelationQuery: true,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: true,
+  })
+  public taskNumber?: number = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [

package/Models/DatabaseModels/AIRunEvent.ts

@@ -21,7 +21,10 @@ import { JSONObject } from "../../Types/JSON";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 import EnableDocumentation from "../../Types/Database/EnableDocumentation";
 import AIRunEventType from "../../Types/AI/AIRunEventType";
-import { AIRunEventResultSummary } from "../../Types/AI/AIChatTypes";
+import {
+  AIRunEventContentPayload,
+  AIRunEventResultSummary,
+} from "../../Types/AI/AIChatTypes";
 
 /*
  * One event in an AI run: an LLM call, a tool call with its validated
@@ -364,6 +367,36 @@ export default class AIRunEvent extends BaseModel {
   })
   public citationId?: string = undefined;
 
+  /*
+   * The verbatim LLM/tool content behind this event (see
+   * AIRunEventContentPayload). Server-only — the read ACL is empty, like
+   * AIRun.pausedState and AIRun.taskContext, and for the same reason: a
+   * code-fix run's prompts embed customer source code, whose reach is
+   * narrower than this table's project-member read. LlmLog redacts the same
+   * content for exactly this reason and continues to.
+   *
+   * Reachable only through GET /code-fix-run/logs, which gates on
+   * ProjectOwner/ProjectAdmin. Never widen this ACL — doing so would publish
+   * customer source code to every project member through the CRUD API.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.JSON,
+    title: "Content Payload",
+    description:
+      "Internal: the verbatim LLM prompt/response and tool output behind this event.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.JSON,
+  })
+  public contentPayload?: AIRunEventContentPayload = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],

package/Models/DatabaseModels/NetworkDeviceDiscoveryScan.ts

@@ -377,6 +377,221 @@ export default class NetworkDeviceDiscoveryScan extends BaseModel {
   })
   public snmpPort?: number = undefined;
 
+  /*
+   * SNMP v3 credentials tried against every host in the subnet. These mirror
+   * the flattened snmpV3* columns on NetworkDevice so a v3 scan can be imported
+   * into a v3 device without re-entering credentials. Like the other SNMP
+   * config columns above they are create+read only (update: []): a scan's
+   * config is fixed once it is dispatched to the probe.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceDiscoveryScan,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceDiscoveryScan,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "SNMP v3 Security Level",
+    description:
+      "SNMP v3 security level tried against every host: noAuthNoPriv, authNoPriv, or authPriv",
+    example: "authPriv",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public snmpV3SecurityLevel?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceDiscoveryScan,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceDiscoveryScan,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "SNMP v3 Username",
+    description: "SNMP v3 security name (username) tried against every host",
+    example: "monitoring",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public snmpV3Username?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceDiscoveryScan,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceDiscoveryScan,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "SNMP v3 Authentication Protocol",
+    description: "SNMP v3 authentication protocol: MD5, SHA, SHA256, or SHA512",
+    example: "SHA",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public snmpV3AuthProtocol?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceDiscoveryScan,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceDiscoveryScan,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.LongText,
+    title: "SNMP v3 Authentication Key",
+    description: "SNMP v3 authentication passphrase tried against every host",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.LongText,
+  })
+  public snmpV3AuthKey?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceDiscoveryScan,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceDiscoveryScan,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "SNMP v3 Privacy Protocol",
+    description: "SNMP v3 privacy (encryption) protocol: DES, AES, or AES256",
+    example: "AES",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public snmpV3PrivProtocol?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceDiscoveryScan,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceDiscoveryScan,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.LongText,
+    title: "SNMP v3 Privacy Key",
+    description:
+      "SNMP v3 privacy (encryption) passphrase tried against every host",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.LongText,
+  })
+  public snmpV3PrivKey?: string = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [

package/Models/DatabaseModels/Project.ts

@@ -832,6 +832,31 @@ export default class Project extends TenantModel {
   })
   public incidentEpisodeCounter?: number = undefined;
 
+  /*
+   * Numbers AI code-fix tasks only. Chat and investigation runs share the
+   * AIRun table but are not tasks, so they never draw from this counter —
+   * see AIRunService.onBeforeCreate.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Number,
+    isDefaultValueColumn: true,
+    required: true,
+    hideColumnInDocumentation: true,
+    computed: true,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    unique: false,
+    default: 0,
+  })
+  public aiRunCounter?: number = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],

package/Models/DatabaseModels/StatusPage.ts

@@ -1063,6 +1063,48 @@ export default class StatusPage extends BaseModel {
   })
   public isPublicStatusPage?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.CreateProjectStatusPage,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.StatusPageViewer,
+      Permission.ReadProjectStatusPage,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.EditProjectStatusPage,
+    ],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Enable MCP Server",
+    description:
+      "Can AI agents read this status page over the public OneUptime MCP server? This does not affect the status page website, its RSS feed, or its public JSON API.",
+    defaultValue: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: true,
+  })
+  public enableMcpServer?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Server/API/AIAgentTaskAPI.ts

@@ -196,6 +196,7 @@ export default class AIAgentTaskAPI {
           const validStatuses: Array<AIAgentTaskStatus> = [
             AIAgentTaskStatus.InProgress,
             AIAgentTaskStatus.Completed,
+            AIAgentTaskStatus.NoFixFound,
             AIAgentTaskStatus.Error,
           ];
 
@@ -249,16 +250,35 @@ export default class AIAgentTaskAPI {
               },
             });
           } else {
-            const toStatus: AIRunStatus =
-              status === AIAgentTaskStatus.Completed
-                ? AIRunStatus.Completed
-                : AIRunStatus.Error;
+            /*
+             * Agents that predate NoFixFound report a fruitless run as Error,
+             * so an Error report still maps straight through — those runs keep
+             * looking exactly as they do today until the agent is upgraded.
+             */
+            let toStatus: AIRunStatus = AIRunStatus.Error;
+
+            if (status === AIAgentTaskStatus.Completed) {
+              toStatus = AIRunStatus.Completed;
+            } else if (status === AIAgentTaskStatus.NoFixFound) {
+              toStatus = AIRunStatus.NoFixFound;
+            }
+
+            /*
+             * Both terminal outcomes that carry a reason store it in
+             * errorMessage — the column is the run's only message field, and
+             * every reader (the detail page, the exception page's
+             * statusMessage) already renders it.
+             */
+            const shouldStoreMessage: boolean =
+              Boolean(statusMessage) &&
+              (toStatus === AIRunStatus.Error ||
+                toStatus === AIRunStatus.NoFixFound);
 
             /*
-             * CAS Running -> Completed/Error. Losing the race (0 rows) means
-             * another actor already finalized the run — e.g. the sweeper
-             * marked it Error after a heartbeat gap — and that outcome wins;
-             * we do not clobber it or write a duplicate terminal event.
+             * CAS Running -> Completed/NoFixFound/Error. Losing the race (0
+             * rows) means another actor already finalized the run — e.g. the
+             * sweeper marked it Error after a heartbeat gap — and that outcome
+             * wins; we do not clobber it or write a duplicate terminal event.
              */
             const transitionedCount: number =
               await AIRunService.attemptStatusTransition({
@@ -268,7 +288,7 @@ export default class AIAgentTaskAPI {
                   status: toStatus,
                   completedAt: OneUptimeDate.getCurrentDate(),
                   lastHeartbeatAt: OneUptimeDate.getCurrentDate(),
-                  ...(toStatus === AIRunStatus.Error && statusMessage
+                  ...(shouldStoreMessage
                     ? { errorMessage: statusMessage }
                     : {}),
                 },
@@ -278,10 +298,16 @@ export default class AIAgentTaskAPI {
               await AIRunEventService.appendEventToRun({
                 projectId: existingRun.projectId,
                 aiRunId: runId,
+                /*
+                 * Only a genuine failure closes the event trail with
+                 * RunFailed. A NoFixFound run ran to completion and reported
+                 * a conclusion, so it closes with RunCompleted and carries
+                 * the "no fix" reason in resultSummary.
+                 */
                 eventType:
-                  toStatus === AIRunStatus.Completed
-                    ? AIRunEventType.RunCompleted
-                    : AIRunEventType.RunFailed,
+                  toStatus === AIRunStatus.Error
+                    ? AIRunEventType.RunFailed
+                    : AIRunEventType.RunCompleted,
                 ...(statusMessage
                   ? { resultSummary: { message: statusMessage } }
                   : {}),

package/Server/API/AIAgentTaskLogAPI.ts

@@ -120,6 +120,31 @@ export default class AIAgentTaskLogAPI {
             );
           }
 
+          /*
+           * Optional verbatim tool detail (see TaskLogger.toolCall): the
+           * arguments as executed and the full output the model saw, recorded
+           * on the run's transcript for the Logs page. Absent it — an older
+           * agent — behaviour is exactly as before.
+           *
+           * The event type stays ProgressLog even when the detail is present.
+           * That is deliberate, not laziness: the Overview's ChatActivityFeed
+           * renders a ProgressLog by printing resultSummary.message, but
+           * renders a ToolCallCompleted by trying to COMPLETE a matching
+           * running step from an earlier ToolCallStarted — an event the
+           * code-fix path never emits. Typing these as ToolCallCompleted
+           * therefore matched nothing and silently erased every tool line from
+           * the Overview feed. The payload rides on the same event instead.
+           */
+          const toolName: string | undefined = data["toolName"] as
+            | string
+            | undefined;
+          const toolArguments: JSONObject | undefined = data[
+            "toolArguments"
+          ] as JSONObject | undefined;
+          const toolResult: string | undefined = data["toolResult"] as
+            | string
+            | undefined;
+
           await AIRunEventService.appendEventToRun({
             projectId: existingRun.projectId,
             aiRunId: runId,
@@ -128,6 +153,30 @@ export default class AIAgentTaskLogAPI {
               message: message,
               severity: severity,
             },
+            ...(toolName ? { toolName: toolName } : {}),
+            /*
+             * toolArguments (the column) is deliberately NOT written: its read
+             * ACL is project-member-wide, and a write_file call's arguments are
+             * the file's full new content. The same arguments go onto
+             * contentPayload below, whose read ACL is empty and which only the
+             * owner/admin-gated logs endpoint returns.
+             */
+            ...(toolName
+              ? {
+                  contentPayload: {
+                    ...(toolResult !== undefined
+                      ? { toolResult: toolResult }
+                      : {}),
+                    ...(toolArguments
+                      ? {
+                          responseToolCalls: [
+                            { name: toolName, arguments: toolArguments },
+                          ],
+                        }
+                      : {}),
+                  },
+                }
+              : {}),
           });
 
           /* A progress report proves the agent is alive — refresh the heartbeat. */

package/Server/API/AIChatAPI.ts

@@ -21,6 +21,10 @@ import SubscriptionPlan, {
 import { IsBillingEnabled, getAllEnvVars } from "../EnvironmentConfig";
 import AIChatMessageRole from "../../Types/AI/AIChatMessageRole";
 import AIChatMessageStatus from "../../Types/AI/AIChatMessageStatus";
+import {
+  AIChatPageContext,
+  AIChatPageContextHelper,
+} from "../../Types/AI/AIChatPageContext";
 import AIChatPermissionMode, {
   AIChatPermissionModeHelper,
 } from "../../Types/AI/AIChatPermissionMode";
@@ -143,6 +147,16 @@ router.post(
           ? (req.body["permissionMode"] as AIChatPermissionMode)
           : undefined;
 
+      /*
+       * Optional page context — what the user was looking at when they asked
+       * (an incident, a monitor, the logs explorer, …). It is a hint for the
+       * system prompt, so an invalid payload is dropped, never an error.
+       */
+      const pageContext: AIChatPageContext | undefined =
+        AIChatPageContextHelper.sanitize(
+          req.body["pageContext"] as JSONObject | undefined,
+        );
+
       // Plan gate: custom endpoints get no automatic billing check.
       if (
         IsBillingEnabled &&
@@ -435,6 +449,7 @@ router.post(
         aiRunId: createdRun.id!,
         llmProviderId: effectiveLlmProviderId,
         permissionMode: effectivePermissionMode,
+        pageContext: pageContext,
         props: props,
       }).catch((error: Error) => {
         logger.error(`AI chat turn crashed: ${error.message}`);
@@ -498,6 +513,7 @@ router.post(
           return {
             id: provider.id?.toString(),
             name: provider.name,
+            description: provider.description || null,
             llmType: provider.llmType?.toString() || null,
             modelName: provider.modelName || null,
             isDefault: provider.isDefault || false,