@oneuptime/common 11.7.4 → 12.0.0

package/Server/Infrastructure/Postgres/SchemaMigrations/1785800000000-AddRunbookCredential.ts

@@ -0,0 +1,84 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * RunbookCredential — the access an SSH or Kubernetes step uses.
+ *
+ * Shaped after RunbookSecret, including its RunbookAgent join table: a
+ * credential is usable only by the Runners it is explicitly assigned to.
+ * Constraint names are spelled out rather than hash-generated so this reads
+ * as what it is; TypeORM only requires them to be unique.
+ */
+export class AddRunbookCredential1785800000000 implements MigrationInterface {
+  public name = "AddRunbookCredential1785800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "RunbookCredential" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "description" character varying(500), "credentialType" character varying NOT NULL, "sshHostname" character varying(100), "sshPort" integer, "sshUsername" character varying(100), "sshPrivateKey" text, "sshPassphrase" text, "sshPassword" text, "kubernetesApiServerUrl" character varying(500), "kubernetesServiceAccountToken" text, "kubernetesCaCertificate" text, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_RunbookCredential" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_RunbookCredential_projectId" ON "RunbookCredential" ("projectId")`,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "RunbookCredentialRunbookAgent" ("runbookCredentialId" uuid NOT NULL, "runbookAgentId" uuid NOT NULL, CONSTRAINT "PK_RunbookCredentialRunbookAgent" PRIMARY KEY ("runbookCredentialId", "runbookAgentId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_RunbookCredentialRunbookAgent_credentialId" ON "RunbookCredentialRunbookAgent" ("runbookCredentialId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_RunbookCredentialRunbookAgent_agentId" ON "RunbookCredentialRunbookAgent" ("runbookAgentId")`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredential" ADD CONSTRAINT "FK_RunbookCredential_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredential" ADD CONSTRAINT "FK_RunbookCredential_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredential" ADD CONSTRAINT "FK_RunbookCredential_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredentialRunbookAgent" ADD CONSTRAINT "FK_RunbookCredentialRunbookAgent_credentialId" FOREIGN KEY ("runbookCredentialId") REFERENCES "RunbookCredential"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredentialRunbookAgent" ADD CONSTRAINT "FK_RunbookCredentialRunbookAgent_agentId" FOREIGN KEY ("runbookAgentId") REFERENCES "RunbookAgent"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+
+    /*
+     * Structured instructions for step types that are not a script. Nullable
+     * because every existing job is a script and has none.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" ADD "payload" jsonb`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" DROP COLUMN "payload"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredentialRunbookAgent" DROP CONSTRAINT "FK_RunbookCredentialRunbookAgent_agentId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredentialRunbookAgent" DROP CONSTRAINT "FK_RunbookCredentialRunbookAgent_credentialId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredential" DROP CONSTRAINT "FK_RunbookCredential_deletedByUserId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredential" DROP CONSTRAINT "FK_RunbookCredential_createdByUserId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredential" DROP CONSTRAINT "FK_RunbookCredential_projectId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "IDX_RunbookCredentialRunbookAgent_agentId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "IDX_RunbookCredentialRunbookAgent_credentialId"`,
+    );
+    await queryRunner.query(`DROP TABLE "RunbookCredentialRunbookAgent"`);
+    await queryRunner.query(`DROP INDEX "IDX_RunbookCredential_projectId"`);
+    await queryRunner.query(`DROP TABLE "RunbookCredential"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1785810000000-RenameRunbookAgentToRunner.ts

@@ -0,0 +1,152 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * The Runbook Agent and the AI Agent became one "Runner". The product,
+ * dashboard, docs and container were renamed at the time; the tables were not,
+ * which left the persistence layer describing a thing that no longer exists.
+ * This finishes it.
+ *
+ * The load-bearing part is not the ALTER TABLEs — it is the TeamPermission
+ * backfill at the end. Permissions are stored as literal strings, so renaming
+ * `CreateRunbookAgent` to `CreateRunner` in the enum silently revokes the
+ * grant from every team that holds it unless the rows move too. The
+ * ServiceCatalog → Service rename (1767966850199) renamed its permissions
+ * without migrating the rows; do not repeat that.
+ *
+ * Table and column renames preserve data and constraints — Postgres carries
+ * indexes, foreign keys and their names across a RENAME, so the old constraint
+ * names survive pointing at the new tables. That is cosmetically untidy and
+ * deliberately left alone: renaming a constraint is churn with no behavioural
+ * effect, and every extra statement here is another thing to get wrong against
+ * a live database.
+ */
+export class RenameRunbookAgentToRunner1785810000000
+  implements MigrationInterface
+{
+  public name = "RenameRunbookAgentToRunner1785810000000";
+
+  /*
+   * Permission strings that live in TeamPermission rows. Every entry is a
+   * grant somebody configured deliberately; losing one silently removes
+   * access that a person chose to give.
+   */
+  private static readonly PERMISSION_MAP: ReadonlyArray<[string, string]> = [
+    ["CreateRunbookAgent", "CreateRunner"],
+    ["DeleteRunbookAgent", "DeleteRunner"],
+    ["EditRunbookAgent", "EditRunner"],
+    ["ReadRunbookAgent", "ReadRunner"],
+    ["CreateRunbookAgentOwnerTeam", "CreateRunnerOwnerTeam"],
+    ["DeleteRunbookAgentOwnerTeam", "DeleteRunnerOwnerTeam"],
+    ["EditRunbookAgentOwnerTeam", "EditRunnerOwnerTeam"],
+    ["ReadRunbookAgentOwnerTeam", "ReadRunnerOwnerTeam"],
+    ["CreateRunbookAgentOwnerUser", "CreateRunnerOwnerUser"],
+    ["DeleteRunbookAgentOwnerUser", "DeleteRunnerOwnerUser"],
+    ["EditRunbookAgentOwnerUser", "EditRunnerOwnerUser"],
+    ["ReadRunbookAgentOwnerUser", "ReadRunnerOwnerUser"],
+  ];
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Columns first, while the tables still have the names their columns were
+     * described against — the same order the ServiceCatalog rename used.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" RENAME COLUMN "runbookAgentId" TO "runnerId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" RENAME COLUMN "runbookAgentId" TO "runnerId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentLabel" RENAME COLUMN "runbookAgentId" TO "runnerId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecretRunbookAgent" RENAME COLUMN "runbookAgentId" TO "runnerId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredentialRunbookAgent" RENAME COLUMN "runbookAgentId" TO "runnerId"`,
+    );
+
+    // Then the tables.
+    await queryRunner.query(`ALTER TABLE "RunbookAgent" RENAME TO "Runner"`);
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" RENAME TO "RunnerJob"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" RENAME TO "RunnerOwnerTeam"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" RENAME TO "RunnerOwnerUser"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentLabel" RENAME TO "RunnerLabel"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecretRunbookAgent" RENAME TO "RunbookSecretRunner"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredentialRunbookAgent" RENAME TO "RunbookCredentialRunner"`,
+    );
+
+    /*
+     * And the grants. Without this every team holding a Runbook Agent
+     * permission loses it the moment the new code reads the enum.
+     */
+    for (const [
+      legacy,
+      replacement,
+    ] of RenameRunbookAgentToRunner1785810000000.PERMISSION_MAP) {
+      await queryRunner.query(
+        `UPDATE "TeamPermission" SET "permission" = $1 WHERE "permission" = $2`,
+        [replacement, legacy],
+      );
+    }
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    for (const [
+      legacy,
+      replacement,
+    ] of RenameRunbookAgentToRunner1785810000000.PERMISSION_MAP) {
+      await queryRunner.query(
+        `UPDATE "TeamPermission" SET "permission" = $1 WHERE "permission" = $2`,
+        [legacy, replacement],
+      );
+    }
+
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredentialRunner" RENAME TO "RunbookCredentialRunbookAgent"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecretRunner" RENAME TO "RunbookSecretRunbookAgent"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerLabel" RENAME TO "RunbookAgentLabel"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerOwnerUser" RENAME TO "RunbookAgentOwnerUser"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerOwnerTeam" RENAME TO "RunbookAgentOwnerTeam"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" RENAME TO "RunbookAgentJob"`,
+    );
+    await queryRunner.query(`ALTER TABLE "Runner" RENAME TO "RunbookAgent"`);
+
+    await queryRunner.query(
+      `ALTER TABLE "RunbookCredentialRunbookAgent" RENAME COLUMN "runnerId" TO "runbookAgentId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecretRunbookAgent" RENAME COLUMN "runnerId" TO "runbookAgentId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentLabel" RENAME COLUMN "runnerId" TO "runbookAgentId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" RENAME COLUMN "runnerId" TO "runbookAgentId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" RENAME COLUMN "runnerId" TO "runbookAgentId"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1785860000000-SessionReplayDefaultToSensitiveInputMasking.ts

@@ -0,0 +1,81 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Retune the session replay defaults so a freshly created application
+ * produces a recording somebody can debug from.
+ *
+ *   - masking mode: MaskAllText -> MaskSensitiveInputsOnly. The wireframe
+ *     mode is still available and is still the strictest; it is simply no
+ *     longer the starting point. Passwords and declared card /
+ *     one-time-code fields stay masked in every mode.
+ *   - capture user identity: off -> on. Support cannot find "the session
+ *     this named customer is complaining about" without it.
+ *   - capture country: off -> on. Country only; the end user's IP address
+ *     is never stored in either state.
+ *
+ * The origin allowlist is deliberately NOT touched here: an empty list
+ * already means "any origin" in SessionReplayGateCache.isOriginAllowed,
+ * so allow-all is already the behaviour for a new application. Only the
+ * copy describing it was wrong.
+ *
+ * On the backfill below. ALTER COLUMN SET DEFAULT only reaches rows
+ * inserted afterwards, so without it every application that already
+ * exists keeps the strict values and nothing observably changes for the
+ * installs that actually have traffic. The UPDATEs are therefore scoped
+ * to rows that still hold the PREVIOUS DEFAULT, which is the closest a
+ * migration can get to "was never configured" - the schema keeps no
+ * record of whether a value was chosen or inherited. An operator who
+ * deliberately selected MaskAllText, or deliberately left identity and
+ * country capture off, is moved to the new defaults by this and has to
+ * set them back.
+ *
+ * That is a privacy-affecting change applied without asking, so it is
+ * called out in the changelog rather than only here. It is acceptable at
+ * this point only because these columns are days old and no release has
+ * carried them yet; a later migration must not reuse this reasoning.
+ */
+export class SessionReplayDefaultToSensitiveInputMasking1785860000000
+  implements MigrationInterface
+{
+  public name = "SessionReplayDefaultToSensitiveInputMasking1785860000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ALTER COLUMN "sessionReplayMaskingMode" SET DEFAULT 'MaskSensitiveInputsOnly'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ALTER COLUMN "sessionReplayCaptureUserIdentity" SET DEFAULT true`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ALTER COLUMN "sessionReplayCaptureGeo" SET DEFAULT true`,
+    );
+
+    await queryRunner.query(
+      `UPDATE "RumApplication" SET "sessionReplayMaskingMode" = 'MaskSensitiveInputsOnly' WHERE "sessionReplayMaskingMode" = 'MaskAllText'`,
+    );
+    await queryRunner.query(
+      `UPDATE "RumApplication" SET "sessionReplayCaptureUserIdentity" = true WHERE "sessionReplayCaptureUserIdentity" = false`,
+    );
+    await queryRunner.query(
+      `UPDATE "RumApplication" SET "sessionReplayCaptureGeo" = true WHERE "sessionReplayCaptureGeo" = false`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Defaults only. The backfill is not reversed: MaskSensitiveInputsOnly
+     * rows are indistinguishable from ones an operator chose after this
+     * migration ran, and reverting them would mask a recording policy the
+     * operator may now be relying on.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ALTER COLUMN "sessionReplayCaptureGeo" SET DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ALTER COLUMN "sessionReplayCaptureUserIdentity" SET DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ALTER COLUMN "sessionReplayMaskingMode" SET DEFAULT 'MaskAllText'`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1785870000000-AddAiCommandRemediation.ts

@@ -0,0 +1,151 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * AI-composed remediation commands (auto-remediation Phase 3):
+ *
+ * - Project.enableAiCommandExecution — project-level opt-in (default off).
+ * - Runner.canRunAiCommands — per-Runner operator consent (default off).
+ * - RunnerJob.origin — discriminates runbook-step jobs from ad-hoc
+ *   AI-composed command jobs; runbookExecutionId becomes nullable because
+ *   AiRemediation-origin jobs have no parent runbook execution (they link
+ *   to an AI run + suggestion instead, via plain indexed uuid columns —
+ *   same pattern as AIRun's triggeredBy* columns, no FK on purpose so the
+ *   job survives as an audit record).
+ * - AutoRemediationRule.aiComposesCommands + commandAllowlist — the rule
+ *   mode and the operator-authored auto-execution allowlist.
+ * - AutoRemediationRuleRunner — which Runners a rule's AI may target.
+ * - AutoRemediationSuggestion.suggestionType + commandPlan — command-plan
+ *   suggestions carry the frozen plan and its execution results.
+ */
+export class AddAiCommandRemediation1785870000000
+  implements MigrationInterface
+{
+  public name = "AddAiCommandRemediation1785870000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAiCommandExecution" boolean NOT NULL DEFAULT false`,
+    );
+
+    await queryRunner.query(
+      `ALTER TABLE "Runner" ADD "canRunAiCommands" boolean NOT NULL DEFAULT false`,
+    );
+
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD "origin" character varying(100) NOT NULL DEFAULT 'Runbook'`,
+    );
+    await queryRunner.query(`ALTER TABLE "RunnerJob" ADD "aiRunId" uuid`);
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD "autoRemediationSuggestionId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ALTER COLUMN "runbookExecutionId" DROP NOT NULL`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_RunnerJob_origin" ON "RunnerJob" ("origin")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_RunnerJob_aiRunId" ON "RunnerJob" ("aiRunId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_RunnerJob_autoRemediationSuggestionId" ON "RunnerJob" ("autoRemediationSuggestionId")`,
+    );
+
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationRule" ADD "aiComposesCommands" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationRule" ADD "commandAllowlist" jsonb`,
+    );
+
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" ADD "suggestionType" character varying(100) NOT NULL DEFAULT 'Runbook'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" ADD "commandPlan" jsonb`,
+    );
+
+    /*
+     * Explicit constraint/index names — TypeORM only requires them to be
+     * unique, and named ones keep later migrations legible.
+     */
+    await queryRunner.query(
+      `CREATE TABLE "AutoRemediationRuleRunner" (
+        "autoRemediationRuleId" uuid NOT NULL,
+        "runnerId" uuid NOT NULL,
+        CONSTRAINT "PK_AutoRemediationRuleRunner" PRIMARY KEY ("autoRemediationRuleId", "runnerId")
+      )`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_AutoRemediationRuleRunner_ruleId" ON "AutoRemediationRuleRunner" ("autoRemediationRuleId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_AutoRemediationRuleRunner_runnerId" ON "AutoRemediationRuleRunner" ("runnerId")`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationRuleRunner" ADD CONSTRAINT "FK_AutoRemediationRuleRunner_ruleId" FOREIGN KEY ("autoRemediationRuleId") REFERENCES "AutoRemediationRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationRuleRunner" ADD CONSTRAINT "FK_AutoRemediationRuleRunner_runnerId" FOREIGN KEY ("runnerId") REFERENCES "Runner"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationRuleRunner" DROP CONSTRAINT "FK_AutoRemediationRuleRunner_runnerId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationRuleRunner" DROP CONSTRAINT "FK_AutoRemediationRuleRunner_ruleId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "IDX_AutoRemediationRuleRunner_runnerId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "IDX_AutoRemediationRuleRunner_ruleId"`,
+    );
+    await queryRunner.query(`DROP TABLE "AutoRemediationRuleRunner"`);
+
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" DROP COLUMN "commandPlan"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" DROP COLUMN "suggestionType"`,
+    );
+
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationRule" DROP COLUMN "commandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationRule" DROP COLUMN "aiComposesCommands"`,
+    );
+
+    await queryRunner.query(
+      `DROP INDEX "IDX_RunnerJob_autoRemediationSuggestionId"`,
+    );
+    await queryRunner.query(`DROP INDEX "IDX_RunnerJob_aiRunId"`);
+    await queryRunner.query(`DROP INDEX "IDX_RunnerJob_origin"`);
+    /*
+     * Any AiRemediation-origin rows (null runbookExecutionId) must go
+     * before the NOT NULL constraint can come back.
+     */
+    await queryRunner.query(
+      `DELETE FROM "RunnerJob" WHERE "runbookExecutionId" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ALTER COLUMN "runbookExecutionId" SET NOT NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP COLUMN "autoRemediationSuggestionId"`,
+    );
+    await queryRunner.query(`ALTER TABLE "RunnerJob" DROP COLUMN "aiRunId"`);
+    await queryRunner.query(`ALTER TABLE "RunnerJob" DROP COLUMN "origin"`);
+
+    await queryRunner.query(
+      `ALTER TABLE "Runner" DROP COLUMN "canRunAiCommands"`,
+    );
+
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAiCommandExecution"`,
+    );
+  }
+}