@oneuptime/common 11.7.4 → 12.0.0

package/Tests/Server/Utils/AI/CodeFix/CodeFixAgentAuth.test.ts

@@ -0,0 +1,257 @@
+import CodeFixAgentAuth, {
+  CodeFixAgentIdentity,
+  CodeFixAgentSource,
+} from "../../../../../Server/Utils/AI/CodeFix/CodeFixAgentAuth";
+import AIAgentService from "../../../../../Server/Services/AIAgentService";
+import RunnerService from "../../../../../Server/Services/RunnerService";
+import AIAgent from "../../../../../Models/DatabaseModels/AIAgent";
+import Runner from "../../../../../Models/DatabaseModels/Runner";
+import ObjectID from "../../../../../Types/ObjectID";
+import { describe, expect, test, afterEach } from "@jest/globals";
+
+/*
+ * CodeFixAgentAuth resolves the aiAgentId/aiAgentKey pair carried by every
+ * code-fix protocol request. It checks the AIAgent registry first, then falls
+ * back to the Runner registry (the unified OneUptime Runner) — but the
+ * Runner path only authenticates when canRunCodeFixTasks === true. These
+ * tests lock in that server-side capability enforcement plus the
+ * project-scoping rules of deniesAccessToProject.
+ */
+
+type AIAgentFindSpy = jest.SpiedFunction<typeof AIAgentService.findOneBy>;
+type RunnerFindSpy = jest.SpiedFunction<typeof RunnerService.findOneBy>;
+
+const agentId: ObjectID = ObjectID.generate();
+const agentKey: string = "secret-agent-key";
+const projectId: ObjectID = ObjectID.generate();
+
+function mockAIAgentLookup(result: AIAgent | null): AIAgentFindSpy {
+  return jest.spyOn(AIAgentService, "findOneBy").mockResolvedValue(result);
+}
+
+function mockRunnerLookup(result: Runner | null): RunnerFindSpy {
+  return jest.spyOn(RunnerService, "findOneBy").mockResolvedValue(result);
+}
+
+function fakeAIAgent(): AIAgent {
+  return {
+    id: agentId,
+    projectId: projectId,
+  } as unknown as AIAgent;
+}
+
+function fakeRunner(
+  overrides: { canRunCodeFixTasks?: boolean | undefined } = {},
+): Runner {
+  return {
+    id: agentId,
+    projectId: projectId,
+    canRunCodeFixTasks: true,
+    ...overrides,
+  } as unknown as Runner;
+}
+
+describe("CodeFixAgentAuth.resolveAgentIdentity", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("returns null when aiAgentId is missing without querying either registry", async () => {
+    const aiAgentSpy: AIAgentFindSpy = mockAIAgentLookup(null);
+    const runnerSpy: RunnerFindSpy = mockRunnerLookup(null);
+
+    const identity: CodeFixAgentIdentity | null =
+      await CodeFixAgentAuth.resolveAgentIdentity({
+        aiAgentKey: agentKey,
+      });
+
+    expect(identity).toBeNull();
+    expect(aiAgentSpy).not.toHaveBeenCalled();
+    expect(runnerSpy).not.toHaveBeenCalled();
+  });
+
+  test("returns null when aiAgentKey is missing without querying either registry", async () => {
+    const aiAgentSpy: AIAgentFindSpy = mockAIAgentLookup(null);
+    const runnerSpy: RunnerFindSpy = mockRunnerLookup(null);
+
+    const identity: CodeFixAgentIdentity | null =
+      await CodeFixAgentAuth.resolveAgentIdentity({
+        aiAgentId: agentId.toString(),
+      });
+
+    expect(identity).toBeNull();
+    expect(aiAgentSpy).not.toHaveBeenCalled();
+    expect(runnerSpy).not.toHaveBeenCalled();
+  });
+
+  test("returns null for a malformed aiAgentId and does not throw", async () => {
+    mockAIAgentLookup(null);
+    mockRunnerLookup(null);
+
+    const identity: CodeFixAgentIdentity | null =
+      await CodeFixAgentAuth.resolveAgentIdentity({
+        aiAgentId: "definitely-not-an-object-id",
+        aiAgentKey: agentKey,
+      });
+
+    expect(identity).toBeNull();
+  });
+
+  test("an AIAgent match wins: returns AIAgent source and never queries RunnerService", async () => {
+    const aiAgentSpy: AIAgentFindSpy = mockAIAgentLookup(fakeAIAgent());
+    const runnerSpy: RunnerFindSpy = mockRunnerLookup(fakeRunner());
+
+    const identity: CodeFixAgentIdentity | null =
+      await CodeFixAgentAuth.resolveAgentIdentity({
+        aiAgentId: agentId.toString(),
+        aiAgentKey: agentKey,
+      });
+
+    expect(identity).not.toBeNull();
+    expect(identity!.source).toBe(CodeFixAgentSource.AIAgent);
+    expect(identity!.id.toString()).toBe(agentId.toString());
+    expect(identity!.projectId!.toString()).toBe(projectId.toString());
+
+    expect(aiAgentSpy).toHaveBeenCalledTimes(1);
+    expect(aiAgentSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        query: {
+          _id: agentId.toString(),
+          key: agentKey,
+        },
+        props: { isRoot: true },
+      }),
+    );
+    expect(runnerSpy).not.toHaveBeenCalled();
+  });
+
+  test("falls back to a Runner with canRunCodeFixTasks true and selects the capability column", async () => {
+    mockAIAgentLookup(null);
+    const runnerSpy: RunnerFindSpy = mockRunnerLookup(fakeRunner());
+
+    const identity: CodeFixAgentIdentity | null =
+      await CodeFixAgentAuth.resolveAgentIdentity({
+        aiAgentId: agentId.toString(),
+        aiAgentKey: agentKey,
+      });
+
+    expect(identity).not.toBeNull();
+    expect(identity!.source).toBe(CodeFixAgentSource.Runner);
+    expect(identity!.id.toString()).toBe(agentId.toString());
+    expect(identity!.projectId!.toString()).toBe(projectId.toString());
+
+    expect(runnerSpy).toHaveBeenCalledTimes(1);
+    expect(runnerSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        query: {
+          _id: agentId.toString(),
+          key: agentKey,
+        },
+        select: expect.objectContaining({
+          canRunCodeFixTasks: true,
+        }),
+        props: { isRoot: true },
+      }),
+    );
+  });
+
+  test("SERVER-SIDE CAPABILITY ENFORCEMENT: a Runner with canRunCodeFixTasks false is rejected", async () => {
+    mockAIAgentLookup(null);
+    mockRunnerLookup(fakeRunner({ canRunCodeFixTasks: false }));
+
+    const identity: CodeFixAgentIdentity | null =
+      await CodeFixAgentAuth.resolveAgentIdentity({
+        aiAgentId: agentId.toString(),
+        aiAgentKey: agentKey,
+      });
+
+    expect(identity).toBeNull();
+  });
+
+  test("SERVER-SIDE CAPABILITY ENFORCEMENT: a Runner with canRunCodeFixTasks undefined is rejected", async () => {
+    mockAIAgentLookup(null);
+    mockRunnerLookup(fakeRunner({ canRunCodeFixTasks: undefined }));
+
+    const identity: CodeFixAgentIdentity | null =
+      await CodeFixAgentAuth.resolveAgentIdentity({
+        aiAgentId: agentId.toString(),
+        aiAgentKey: agentKey,
+      });
+
+    expect(identity).toBeNull();
+  });
+
+  test("returns null when neither registry matches", async () => {
+    const aiAgentSpy: AIAgentFindSpy = mockAIAgentLookup(null);
+    const runnerSpy: RunnerFindSpy = mockRunnerLookup(null);
+
+    const identity: CodeFixAgentIdentity | null =
+      await CodeFixAgentAuth.resolveAgentIdentity({
+        aiAgentId: agentId.toString(),
+        aiAgentKey: agentKey,
+      });
+
+    expect(identity).toBeNull();
+    expect(aiAgentSpy).toHaveBeenCalledTimes(1);
+    expect(runnerSpy).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("CodeFixAgentAuth.deniesAccessToProject", () => {
+  function identityWithProject(
+    identityProjectId: ObjectID | undefined,
+  ): CodeFixAgentIdentity {
+    return {
+      id: agentId,
+      projectId: identityProjectId,
+      source: CodeFixAgentSource.AIAgent,
+    };
+  }
+
+  test("a global identity (no projectId) never denies", () => {
+    const globalIdentity: CodeFixAgentIdentity = identityWithProject(undefined);
+
+    expect(
+      CodeFixAgentAuth.deniesAccessToProject(
+        globalIdentity,
+        ObjectID.generate(),
+      ),
+    ).toBe(false);
+    expect(
+      CodeFixAgentAuth.deniesAccessToProject(globalIdentity, undefined),
+    ).toBe(false);
+  });
+
+  test("a project-scoped identity denies a different projectId", () => {
+    const identity: CodeFixAgentIdentity = identityWithProject(projectId);
+
+    expect(
+      CodeFixAgentAuth.deniesAccessToProject(identity, ObjectID.generate()),
+    ).toBe(true);
+  });
+
+  test("a project-scoped identity allows an equal projectId compared by value, not instance", () => {
+    const identity: CodeFixAgentIdentity = identityWithProject(
+      new ObjectID(projectId.toString()),
+    );
+    const sameValueDifferentInstance: ObjectID = new ObjectID(
+      projectId.toString(),
+    );
+
+    expect(identity.projectId).not.toBe(sameValueDifferentInstance);
+    expect(
+      CodeFixAgentAuth.deniesAccessToProject(
+        identity,
+        sameValueDifferentInstance,
+      ),
+    ).toBe(false);
+  });
+
+  test("a project-scoped identity denies when the resource projectId is undefined", () => {
+    const identity: CodeFixAgentIdentity = identityWithProject(projectId);
+
+    expect(CodeFixAgentAuth.deniesAccessToProject(identity, undefined)).toBe(
+      true,
+    );
+  });
+});

package/Tests/Server/Utils/AI/CodeFix/CodeFixAgentAvailability.test.ts

@@ -0,0 +1,236 @@
+import CodeFixAgentAvailability from "../../../../../Server/Utils/AI/CodeFix/CodeFixAgentAvailability";
+import AIAgentService from "../../../../../Server/Services/AIAgentService";
+import RunnerService from "../../../../../Server/Services/RunnerService";
+import AIAgent from "../../../../../Models/DatabaseModels/AIAgent";
+import Runner, {
+  RunnerConnectionStatus,
+} from "../../../../../Models/DatabaseModels/Runner";
+import ObjectID from "../../../../../Types/ObjectID";
+import OneUptimeDate from "../../../../../Types/Date";
+import { describe, expect, test, afterEach } from "@jest/globals";
+
+/*
+ * Who counts as an online code-fix agent for a project. Two kinds of agent
+ * pick up that work:
+ *
+ *   - an AIAgent row (in-cluster fleet / legacy per-project agents), and
+ *   - a customer-installed OneUptime Runner (Runner row) with
+ *     canRunCodeFixTasks enabled and a recent lastAlive heartbeat.
+ *
+ * The orphaned-run sweeper and readiness checks share this, so a project
+ * served only by a Runner must never be told "no agent online" — that is
+ * exactly the bug that used to fail queued runs out from under a Runner
+ * that was polling all along.
+ */
+
+describe("CodeFixAgentAvailability.getOnlineAgentForProject", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("a connected AIAgent wins and RunnerService is never consulted", async () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    const aiAgentSpy: jest.SpyInstance = jest
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue({
+        name: "cluster-fleet-agent",
+      } as unknown as AIAgent);
+
+    const runnerSpy: jest.SpyInstance = jest
+      .spyOn(RunnerService, "getOnlineCodeFixRunnerForProject")
+      .mockResolvedValue({
+        name: "should-not-be-consulted",
+      } as unknown as Runner);
+
+    const result: { name: string } | null =
+      await CodeFixAgentAvailability.getOnlineAgentForProject(projectId);
+
+    expect(result).toEqual({ name: "cluster-fleet-agent" });
+    expect(aiAgentSpy).toHaveBeenCalledTimes(1);
+    expect(aiAgentSpy).toHaveBeenCalledWith(projectId);
+    expect(runnerSpy).not.toHaveBeenCalled();
+  });
+
+  test("no AIAgent + an online Runner returns the Runner's name", async () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    jest
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue(null);
+
+    const runnerSpy: jest.SpyInstance = jest
+      .spyOn(RunnerService, "getOnlineCodeFixRunnerForProject")
+      .mockResolvedValue({
+        name: "warehouse-runner",
+      } as unknown as Runner);
+
+    const result: { name: string } | null =
+      await CodeFixAgentAvailability.getOnlineAgentForProject(projectId);
+
+    expect(result).toEqual({ name: "warehouse-runner" });
+    expect(runnerSpy).toHaveBeenCalledTimes(1);
+    expect(runnerSpy).toHaveBeenCalledWith(projectId);
+  });
+
+  test("no AIAgent + no online Runner returns null and hasOnlineAgentForProject is false", async () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    jest
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue(null);
+    jest
+      .spyOn(RunnerService, "getOnlineCodeFixRunnerForProject")
+      .mockResolvedValue(null);
+
+    expect(
+      await CodeFixAgentAvailability.getOnlineAgentForProject(projectId),
+    ).toBeNull();
+    expect(
+      await CodeFixAgentAvailability.hasOnlineAgentForProject(projectId),
+    ).toBe(false);
+  });
+
+  test("hasOnlineAgentForProject is true when any agent is online", async () => {
+    jest
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue({ name: "agent" } as unknown as AIAgent);
+
+    expect(
+      await CodeFixAgentAvailability.hasOnlineAgentForProject(
+        ObjectID.generate(),
+      ),
+    ).toBe(true);
+  });
+
+  test("an AIAgent with no name falls back to the 'AI agent' label", async () => {
+    jest
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue({} as unknown as AIAgent);
+
+    const result: { name: string } | null =
+      await CodeFixAgentAvailability.getOnlineAgentForProject(
+        ObjectID.generate(),
+      );
+
+    expect(result).toEqual({ name: "AI agent" });
+  });
+
+  test("a Runner with no name falls back to the 'Runner' label", async () => {
+    jest
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue(null);
+    jest
+      .spyOn(RunnerService, "getOnlineCodeFixRunnerForProject")
+      .mockResolvedValue({} as unknown as Runner);
+
+    const result: { name: string } | null =
+      await CodeFixAgentAvailability.getOnlineAgentForProject(
+        ObjectID.generate(),
+      );
+
+    expect(result).toEqual({ name: "Runner" });
+  });
+});
+
+describe("RunnerService.getOnlineCodeFixRunnerForProject", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("queries only Runners with canRunCodeFixTasks: true in the given project — a Runner without the capability is never counted", async () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    const findBySpy: jest.SpyInstance = jest
+      .spyOn(RunnerService, "findBy")
+      .mockResolvedValue([]);
+
+    await RunnerService.getOnlineCodeFixRunnerForProject(projectId);
+
+    expect(findBySpy).toHaveBeenCalledTimes(1);
+    expect(findBySpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        query: expect.objectContaining({
+          projectId: projectId,
+          canRunCodeFixTasks: true,
+        }),
+      }),
+    );
+  });
+
+  test("a Runner returned by the query is online", async () => {
+    const runner: Runner = {
+      name: "fresh-runner",
+      lastAlive: OneUptimeDate.getSomeMinutesAgo(1),
+    } as unknown as Runner;
+
+    jest.spyOn(RunnerService, "findBy").mockResolvedValue([runner]);
+
+    const result: Runner | null =
+      await RunnerService.getOnlineCodeFixRunnerForProject(ObjectID.generate());
+
+    expect(result).toBe(runner);
+  });
+
+  /*
+   * The recency window is a QUERY predicate, never a post-filter on a sorted
+   * row. Sorting by lastAlive DESC and inspecting the first row looks
+   * equivalent but is not: Postgres orders NULLs FIRST on a DESC sort, so a
+   * Runner row created and never started would be picked ahead of one
+   * heartbeating right now, and the project would read as having no agent
+   * while its Runner was polling. Asserting the predicate is what stops that
+   * shape coming back.
+   */
+  test("the liveness window is enforced by the query, not by sorting rows", async () => {
+    const findBySpy: jest.SpyInstance = jest
+      .spyOn(RunnerService, "findBy")
+      .mockResolvedValue([]);
+
+    await RunnerService.getOnlineCodeFixRunnerForProject(ObjectID.generate());
+
+    const args: Record<string, unknown> = findBySpy.mock.calls[0]![0] as Record<
+      string,
+      unknown
+    >;
+
+    // A lastAlive predicate is present, so stale rows never leave the DB.
+    expect(
+      (args["query"] as Record<string, unknown>)["lastAlive"],
+    ).toBeDefined();
+
+    // And no lastAlive sort is relied upon.
+    expect(args["sort"]).toBeUndefined();
+  });
+
+  /*
+   * Liveness is judged on lastAlive ONLY, never connectionStatus: nothing
+   * ever flips a Runner's connectionStatus back to Disconnected, so a row
+   * that once connected would look Connected forever.
+   */
+  test("connectionStatus is not consulted — only lastAlive gates the query", async () => {
+    const findBySpy: jest.SpyInstance = jest
+      .spyOn(RunnerService, "findBy")
+      .mockResolvedValue([
+        {
+          name: "connected-forever-runner",
+          connectionStatus: RunnerConnectionStatus.Connected,
+        } as unknown as Runner,
+      ]);
+
+    await RunnerService.getOnlineCodeFixRunnerForProject(ObjectID.generate());
+
+    const query: Record<string, unknown> = (
+      findBySpy.mock.calls[0]![0] as Record<string, unknown>
+    )["query"] as Record<string, unknown>;
+
+    expect(query["connectionStatus"]).toBeUndefined();
+  });
+
+  test("empty result returns null", async () => {
+    jest.spyOn(RunnerService, "findBy").mockResolvedValue([]);
+
+    expect(
+      await RunnerService.getOnlineCodeFixRunnerForProject(ObjectID.generate()),
+    ).toBeNull();
+  });
+});

package/Tests/Server/Utils/AI/CodeFixReadiness.test.ts

@@ -1,6 +1,7 @@
 import CodeFixReadiness from "../../../../Server/Utils/AI/CodeFix/CodeFixReadiness";
 import SubjectCodeFixRun from "../../../../Server/Utils/AI/SRE/SubjectCodeFixRun";
 import AIAgentService from "../../../../Server/Services/AIAgentService";
+import RunnerService from "../../../../Server/Services/RunnerService";
 import AIService from "../../../../Server/Services/AIService";
 import LlmProviderService from "../../../../Server/Services/LlmProviderService";
 import ProjectService from "../../../../Server/Services/ProjectService";
@@ -253,11 +254,21 @@ describe("CodeFixReadiness.getLlmProviderCheck — daily autonomous token budget
 });
 
 describe("CodeFixReadiness.getAgentCheck", () => {
+  beforeEach(() => {
+    // Default: no Runner. Individual tests opt into one.
+    jest
+      .spyOn(RunnerService, "getOnlineCodeFixRunnerForProject")
+      .mockResolvedValue(null);
+  });
+
   afterEach(() => {
     jest.restoreAllMocks();
   });
 
   test("no agent for the project: not ready", async () => {
+    jest
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue(null);
     jest.spyOn(AIAgentService, "getAIAgentForProject").mockResolvedValue(null);
 
     const check: AIFixReadinessCheck = await CodeFixReadiness.getAgentCheck({
@@ -266,14 +277,16 @@ describe("CodeFixReadiness.getAgentCheck", () => {
 
     expect(check.id).toBe("agentAvailable");
     expect(check.ok).toBe(false);
-    expect(check.detail).toContain("No AI agent is available");
+    expect(check.detail).toContain("No agent is available");
   });
 
   test("an agent that exists but is not alive: not ready, and names it", async () => {
+    jest
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue(null);
     jest
       .spyOn(AIAgentService, "getAIAgentForProject")
       .mockResolvedValue({ name: "fix-worker" } as unknown as AIAgent);
-    jest.spyOn(AIAgentService, "isAgentAlive").mockReturnValue(false);
 
     const check: AIFixReadinessCheck = await CodeFixReadiness.getAgentCheck({
       projectId,
@@ -285,9 +298,8 @@ describe("CodeFixReadiness.getAgentCheck", () => {
 
   test("a live agent is ready and is named", async () => {
     jest
-      .spyOn(AIAgentService, "getAIAgentForProject")
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
       .mockResolvedValue({ name: "fix-worker" } as unknown as AIAgent);
-    jest.spyOn(AIAgentService, "isAgentAlive").mockReturnValue(true);
 
     const check: AIFixReadinessCheck = await CodeFixReadiness.getAgentCheck({
       projectId,
@@ -296,6 +308,27 @@ describe("CodeFixReadiness.getAgentCheck", () => {
     expect(check.ok).toBe(true);
     expect(check.title).toContain("fix-worker");
   });
+
+  /*
+   * A customer-installed Runner with the code-fix capability is the agent for
+   * most projects — readiness that only looked at the AIAgent table told them
+   * to go install an agent they were already running.
+   */
+  test("an online code-fix Runner satisfies the check and is named", async () => {
+    jest
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue(null);
+    jest
+      .spyOn(RunnerService, "getOnlineCodeFixRunnerForProject")
+      .mockResolvedValue({ name: "prod-runner" } as unknown as never);
+
+    const check: AIFixReadinessCheck = await CodeFixReadiness.getAgentCheck({
+      projectId,
+    });
+
+    expect(check.ok).toBe(true);
+    expect(check.title).toContain("prod-runner");
+  });
 });
 
 describe("CodeFixReadiness.getRepositoryConnectedCheck", () => {
@@ -358,8 +391,13 @@ describe("CodeFixReadiness.getProjectReadiness", () => {
       .spyOn(AIAgentService, "getAIAgentForProject")
       .mockResolvedValue({ name: "agent" } as unknown as AIAgent);
     jest
-      .spyOn(AIAgentService, "isAgentAlive")
-      .mockReturnValue(params.agentAlive);
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue(
+        params.agentAlive ? ({ name: "agent" } as unknown as AIAgent) : null,
+      );
+    jest
+      .spyOn(RunnerService, "getOnlineCodeFixRunnerForProject")
+      .mockResolvedValue(null);
   }
 
   test("all three gates satisfied: ready", async () => {

package/Tests/Server/Utils/AI/CodeFixRunQueue.test.ts

@@ -1,11 +1,12 @@
 import CodeFixRunQueue from "../../../../Server/Utils/AI/CodeFix/CodeFixRunQueue";
 import AIRunService from "../../../../Server/Services/AIRunService";
 import AIAgentService from "../../../../Server/Services/AIAgentService";
+import RunnerService from "../../../../Server/Services/RunnerService";
 import AIRun from "../../../../Models/DatabaseModels/AIRun";
 import AIAgent from "../../../../Models/DatabaseModels/AIAgent";
 import AIRunStatus from "../../../../Types/AI/AIRunStatus";
 import ObjectID from "../../../../Types/ObjectID";
-import { describe, expect, test, afterEach } from "@jest/globals";
+import { beforeEach, describe, expect, test, afterEach } from "@jest/globals";
 
 /*
  * Sweeper decisions for CodeFix AIRuns:
@@ -53,6 +54,18 @@ describe("CodeFixRunQueue.markStaleRunAsError", () => {
 });
 
 describe("CodeFixRunQueue.failOrphanedQueuedRuns", () => {
+  /*
+   * A project can be served by an AIAgent or by a customer-installed Runner
+   * with the code-fix capability. These tests exercise the AIAgent side, so
+   * the Runner lookup is stubbed to "none" — without it the fallback would
+   * reach a real database.
+   */
+  beforeEach(() => {
+    jest
+      .spyOn(RunnerService, "getOnlineCodeFixRunnerForProject")
+      .mockResolvedValue(null);
+  });
+
   afterEach(() => {
     jest.restoreAllMocks();
   });
@@ -131,4 +144,37 @@ describe("CodeFixRunQueue.failOrphanedQueuedRuns", () => {
 
     expect(aliveLookup).toHaveBeenCalledTimes(1);
   });
+
+  /*
+   * A project served only by a customer-installed Runner used to have its
+   * queued runs failed out from under a Runner that was polling all along,
+   * because only the AIAgent table counted as "an agent".
+   */
+  test("spares runs in a project whose only agent is a code-fix Runner", async () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    jest
+      .spyOn(AIRunService, "findBy")
+      .mockResolvedValue([
+        { id: ObjectID.generate(), projectId },
+      ] as unknown as Array<AIRun>);
+
+    jest
+      .spyOn(AIAgentService, "getConnectedAIAgentForProject")
+      .mockResolvedValue(null);
+    jest
+      .spyOn(RunnerService, "getOnlineCodeFixRunnerForProject")
+      .mockResolvedValue({
+        id: ObjectID.generate(),
+        name: "Prod Runner",
+      } as unknown as never);
+
+    const transition: jest.SpyInstance = jest
+      .spyOn(AIRunService, "attemptStatusTransition")
+      .mockResolvedValue(1);
+
+    await CodeFixRunQueue.failOrphanedQueuedRuns();
+
+    expect(transition).not.toHaveBeenCalled();
+  });
 });

package/Tests/Server/Utils/AI/CodeWriteTools.test.ts

@@ -28,8 +28,8 @@ import { describe, expect, test, afterEach, beforeEach } from "@jest/globals";
 /*
  * The chat agent reads telemetry an attacker can influence (a log line or an
  * exception message is whatever the monitored app threw) and can now turn it
- * into code. AISentinelVision.md's defense is structural: a human reviews
- * before anything merges.
+ * into code. The defense is structural: a human reviews before anything
+ * merges.
  *
  * That defense reduces to ONE invariant, and these tests exist to make it
  * impossible to regress silently: