@oneuptime/common 11.7.4 → 12.0.1

package/Models/DatabaseModels/{RunbookAgent.ts → Runner.ts}

@@ -31,26 +31,30 @@ import {
   ManyToOne,
 } from "typeorm";
 
-export enum RunbookAgentConnectionStatus {
+export enum RunnerConnectionStatus {
   Connected = "connected",
   Disconnected = "disconnected",
 }
 
 @EnableDocumentation()
 @TenantColumn("projectId")
-@CrudApiEndpoint(new Route("/runbook-agent"))
+@CrudApiEndpoint(new Route("/runner"))
 @AccessControlColumn("labels")
 @SlugifyColumn("name", "slug")
 @Entity({
-  name: "RunbookAgent",
+  name: "Runner",
 })
+/*
+ * The table name stays Runner (renaming it would churn every FK and
+ * index for a cosmetic gain); the product name is OneUptime Runner.
+ */
 @TableMetadata({
-  tableName: "RunbookAgent",
-  singularName: "Runbook Agent",
-  pluralName: "Runbook Agents",
+  tableName: "Runner",
+  singularName: "Runner",
+  pluralName: "Runners",
   icon: IconProp.Terminal,
   tableDescription:
-    "A self-hosted agent that executes Bash and JavaScript runbook steps in your own infrastructure and reports results back to OneUptime. Each step picks the agent that should run it.",
+    "A self-hosted OneUptime Runner: it executes runbook steps in your own infrastructure and, when the capability is enabled, works in your code repository to open AI fix pull requests. Runbook steps pick the Runner that should execute them.",
 })
 @TableAccessControl({
   create: [
@@ -59,7 +63,7 @@ export enum RunbookAgentConnectionStatus {
     Permission.ProjectMember,
     Permission.RunbookAdmin,
     Permission.RunbookMember,
-    Permission.CreateRunbookAgent,
+    Permission.CreateRunner,
   ],
   read: [
     Permission.ProjectOwner,
@@ -69,22 +73,22 @@ export enum RunbookAgentConnectionStatus {
     Permission.RunbookAdmin,
     Permission.RunbookMember,
     Permission.RunbookViewer,
-    Permission.ReadRunbookAgent,
+    Permission.ReadRunner,
   ],
   delete: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
     Permission.RunbookAdmin,
-    Permission.DeleteRunbookAgent,
+    Permission.DeleteRunner,
   ],
   update: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
     Permission.RunbookAdmin,
-    Permission.EditRunbookAgent,
+    Permission.EditRunner,
   ],
 })
-export default class RunbookAgent extends BaseModel {
+export default class Runner extends BaseModel {
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,
@@ -92,7 +96,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.CreateRunbookAgent,
+      Permission.CreateRunner,
     ],
     read: [
       Permission.ProjectOwner,
@@ -102,7 +106,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [],
   })
@@ -134,7 +138,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.CreateRunbookAgent,
+      Permission.CreateRunner,
     ],
     read: [
       Permission.ProjectOwner,
@@ -144,7 +148,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [],
   })
@@ -170,7 +174,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.CreateRunbookAgent,
+      Permission.CreateRunner,
     ],
     read: [
       Permission.ProjectOwner,
@@ -180,13 +184,13 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.RunbookAdmin,
-      Permission.EditRunbookAgent,
+      Permission.EditRunner,
     ],
   })
   @TableColumn({
@@ -212,7 +216,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.CreateRunbookAgent,
+      Permission.CreateRunner,
     ],
     read: [
       Permission.ProjectOwner,
@@ -222,13 +226,13 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.RunbookAdmin,
-      Permission.EditRunbookAgent,
+      Permission.EditRunner,
     ],
   })
   @TableColumn({
@@ -255,7 +259,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [],
   })
@@ -281,20 +285,27 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.CreateRunbookAgent,
+      Permission.CreateRunner,
     ],
+    /*
+     * This key IS the Runner's whole identity: presenting it to
+     * /runner-ingest/claim-next-job returns claimed work with every runbook
+     * secret and credential already substituted in. So reading it is
+     * equivalent to reading every secret assigned to that Runner, and it is
+     * held to the same bar as administering the Runner itself — Member and
+     * Viewer used to be able to read it, which made "Viewer" a path to the
+     * project's SSH keys and kubeconfigs.
+     */
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.RunbookAdmin,
-      Permission.RunbookMember,
-      Permission.RunbookViewer,
     ],
     update: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.RunbookAdmin,
-      Permission.EditRunbookAgent,
+      Permission.EditRunner,
     ],
   })
   @TableColumn({
@@ -303,7 +314,7 @@ export default class RunbookAgent extends BaseModel {
     type: TableColumnType.ShortText,
     title: "Agent Key",
     description:
-      "Secret key the agent presents on every request. Never share this key. Reset it to revoke the agent.",
+      "Secret key the agent presents on every request. Anyone who can read this key can claim work as this Runner and receive its secrets in plaintext. Never share it; reset it to revoke the agent.",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -319,7 +330,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.CreateRunbookAgent,
+      Permission.CreateRunner,
     ],
     read: [
       Permission.ProjectOwner,
@@ -329,16 +340,16 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [],
   })
   @TableColumn({
     required: false,
     type: TableColumnType.Version,
-    title: "Agent Version",
+    title: "Runner Version",
     description:
-      "Self-reported version of the agent binary. Updated on each heartbeat.",
+      "Self-reported version of the Runner binary. Updated on each heartbeat.",
   })
   @Column({
     nullable: true,
@@ -346,6 +357,16 @@ export default class RunbookAgent extends BaseModel {
     length: ColumnLength.Version,
     transformer: Version.getDatabaseTransformer(),
   })
+  /*
+   * The label reads "Runner Version", but the property — and therefore the
+   * column, the /api/runner field and the POST /heartbeat body key — stays
+   * agentVersion. Runners are customer-pulled containers on their own upgrade
+   * cadence, so an un-redeployed Runner keeps posting agentVersion long after
+   * the server ships. Renaming the key would fail silently: RunnerIngress only
+   * writes the column when the body carries a non-empty string, so the
+   * heartbeat would still return 200 and the Runner would still show as
+   * connected, with a version frozen at whatever it last reported.
+   */
   public agentVersion?: Version = undefined;
 
   @ColumnAccessControl({
@@ -358,7 +379,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [],
   })
@@ -382,7 +403,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.CreateRunbookAgent,
+      Permission.CreateRunner,
     ],
     read: [
       Permission.ProjectOwner,
@@ -392,7 +413,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [],
   })
@@ -408,7 +429,146 @@ export default class RunbookAgent extends BaseModel {
     nullable: true,
     unique: false,
   })
-  public connectionStatus?: RunbookAgentConnectionStatus = undefined;
+  public connectionStatus?: RunnerConnectionStatus = undefined;
+
+  /*
+   * Capabilities this Runner is allowed to serve. They mirror the
+   * ONEUPTIME_RUNNER_ENABLE_* toggles the container runs with: the
+   * container decides what it polls for, and these columns tell the
+   * dashboard what to expect (and let an operator revoke a capability
+   * centrally without touching the host).
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.RunbookAdmin,
+      Permission.RunbookMember,
+      Permission.CreateRunner,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.RunbookAdmin,
+      Permission.RunbookMember,
+      Permission.RunbookViewer,
+      Permission.ReadRunner,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.RunbookAdmin,
+      Permission.EditRunner,
+    ],
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.Boolean,
+    title: "Runs Runbooks",
+    description:
+      "Whether this Runner executes runbook steps. On by default — this is why most Runners are installed.",
+    defaultValue: true,
+    isDefaultValueColumn: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: false,
+    default: true,
+  })
+  public canRunRunbooks?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.RunbookAdmin,
+      Permission.RunbookMember,
+      Permission.CreateRunner,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.RunbookAdmin,
+      Permission.RunbookMember,
+      Permission.RunbookViewer,
+      Permission.ReadRunner,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.RunbookAdmin,
+      Permission.EditRunner,
+    ],
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.Boolean,
+    title: "Runs AI Code Fixes",
+    description:
+      "Whether this Runner works in your code repository to open AI fix pull requests. Off by default; it requires a connected code repository.",
+    defaultValue: false,
+    isDefaultValueColumn: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: false,
+    default: false,
+  })
+  public canRunCodeFixTasks?: boolean = undefined;
+
+  /*
+   * Opt-in consent for AI-composed remediation commands: with this off, the
+   * server never serves this Runner an AiRemediation-origin job, no matter
+   * what the project or rule configuration says. The operator who runs the
+   * host decides whether an AI may execute commands on it.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.RunbookAdmin,
+      Permission.RunbookMember,
+      Permission.CreateRunner,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.RunbookAdmin,
+      Permission.RunbookMember,
+      Permission.RunbookViewer,
+      Permission.ReadRunner,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.RunbookAdmin,
+      Permission.EditRunner,
+    ],
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.Boolean,
+    title: "Runs AI Remediation Commands",
+    description:
+      "Whether AI auto-remediation may execute commands on this Runner. Off by default. Commands are policy-checked and either match an operator allowlist or require one-click human approval.",
+    defaultValue: false,
+    isDefaultValueColumn: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: false,
+    default: false,
+  })
+  public canRunAiCommands?: boolean = undefined;
 
   @ColumnAccessControl({
     create: [],
@@ -420,7 +580,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [],
   })
@@ -444,7 +604,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.CreateRunbookAgent,
+      Permission.CreateRunner,
     ],
     read: [
       Permission.ProjectOwner,
@@ -454,7 +614,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [],
   })
@@ -487,7 +647,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.CreateRunbookAgent,
+      Permission.CreateRunner,
     ],
     read: [
       Permission.ProjectOwner,
@@ -497,7 +657,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [],
   })
@@ -567,7 +727,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.CreateRunbookAgent,
+      Permission.CreateRunner,
     ],
     read: [
       Permission.ProjectOwner,
@@ -577,7 +737,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.RunbookAdmin,
       Permission.RunbookMember,
       Permission.RunbookViewer,
-      Permission.ReadRunbookAgent,
+      Permission.ReadRunner,
     ],
     update: [
       Permission.ProjectOwner,
@@ -585,7 +745,7 @@ export default class RunbookAgent extends BaseModel {
       Permission.ProjectMember,
       Permission.RunbookAdmin,
       Permission.RunbookMember,
-      Permission.EditRunbookAgent,
+      Permission.EditRunner,
     ],
   })
   @TableColumn({
@@ -603,13 +763,13 @@ export default class RunbookAgent extends BaseModel {
     { eager: false },
   )
   @JoinTable({
-    name: "RunbookAgentLabel",
+    name: "RunnerLabel",
     inverseJoinColumn: {
       name: "labelId",
       referencedColumnName: "_id",
     },
     joinColumn: {
-      name: "runbookAgentId",
+      name: "runnerId",
       referencedColumnName: "_id",
     },
   })