@oneuptime/common 12.0.3 → 12.0.5

package/Server/API/AIAgentDataAPI.ts

@@ -7,8 +7,7 @@ import AIRunService from "../Services/AIRunService";
 import AIRunEventService from "../Services/AIRunEventService";
 import IncidentService from "../Services/IncidentService";
 import AlertService from "../Services/AlertService";
-import IncidentFeedService from "../Services/IncidentFeedService";
-import AlertFeedService from "../Services/AlertFeedService";
+import PostedRootCause from "../Utils/AI/SRE/PostedRootCause";
 import Express, {
   ExpressRequest,
   ExpressResponse,
@@ -27,12 +26,6 @@ import AIAgentTaskPullRequest from "../../Models/DatabaseModels/AIAgentTaskPullR
 import AIRun from "../../Models/DatabaseModels/AIRun";
 import Incident from "../../Models/DatabaseModels/Incident";
 import Alert from "../../Models/DatabaseModels/Alert";
-import IncidentFeed, {
-  IncidentFeedEventType,
-} from "../../Models/DatabaseModels/IncidentFeed";
-import AlertFeed, {
-  AlertFeedEventType,
-} from "../../Models/DatabaseModels/AlertFeed";
 import AIRunEventType from "../../Types/AI/AIRunEventType";
 import AIRunType from "../../Types/AI/AIRunType";
 import FixVerificationStatus from "../../Types/AI/FixVerificationStatus";
@@ -41,7 +34,9 @@ import CodeFixTaskType, {
   CodeFixTaskTypeHelper,
 } from "../../Types/AI/CodeFixTaskType";
 import CodeFixTaskContext, {
+  getInvestigationCodeFixTaskSnapshot,
   ImplicatedSpan,
+  InvestigationCodeFixTaskSnapshot,
   PerformanceCodeLocation,
   PerformanceFinding,
 } from "../../Types/AI/CodeFixTaskContext";
@@ -62,13 +57,13 @@ import {
   LLMToolCall,
   LLMToolDefinition,
 } from "../Utils/LLM/LLMService";
-import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import BadDataException from "../../Types/Exception/BadDataException";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
 import GitHubUtil, {
   GitHubInstallationToken,
 } from "../Utils/CodeRepository/GitHub/GitHub";
+import GitHubInstallationBinding from "../Utils/CodeRepository/GitHub/GitHubInstallationBinding";
 import CodeRepositoryType from "../../Types/CodeRepository/CodeRepositoryType";
 import URL from "../../Types/API/URL";
 import PullRequestState from "../../Types/CodeRepository/PullRequestState";
@@ -495,14 +490,12 @@ export default class AIAgentDataAPI {
      * The route name predates the newer recipes and is kept for agent
      * compatibility. Two context kinds are served:
      *
-     *  - Incident/alert-subject recipes (ImproveInstrumentation,
-     *    FixFromIncident): the investigation's posted analysis + subject
-     *    metadata + the repository resolved without a stack trace. The
-     *    analysis text comes from the subject's latest RootCause feed item:
-     *    the AI's postAnalysis is the only writer of RootCause feed
-     *    events, it writes them for BOTH subjects and BOTH confidence
-     *    outcomes (quiet mode only mutes the workspace ping), so the feed
-     *    item IS the investigation run's persisted output.
+     *  - Incident/alert-subject recipes: subject metadata + the repository
+     *    resolved without a stack trace. ImproveInstrumentation reads the
+     *    subject's latest RootCause feed item. FixFromIncident instead reads
+     *    the immutable investigation snapshot captured in AIRun.taskContext;
+     *    a later re-investigation must never replace the Recommended analysis
+     *    that authorized a code-fix task.
      *
      *  - Trace-evidence recipes (FixPerformance): the deterministic
      *    span-tree findings stored on AIRun.taskContext at trigger time
@@ -580,6 +573,10 @@ export default class AIAgentDataAPI {
             CodeFixTaskTypeHelper.fromDatabaseValue(run.codeFixTaskType);
           const contextKind: CodeFixContextKind =
             CodeFixTaskTypeHelper.getContextKind(taskType);
+          const investigationSnapshot: InvestigationCodeFixTaskSnapshot | null =
+            taskType === CodeFixTaskType.FixFromIncident
+              ? getInvestigationCodeFixTaskSnapshot(run.taskContext)
+              : null;
 
           if (
             run.runType !== AIRunType.CodeFix ||
@@ -594,6 +591,25 @@ export default class AIAgentDataAPI {
             );
           }
 
+          /*
+           * FixFromIncident authorization covered one exact Recommended
+           * investigation. Never substitute the subject's current RootCause:
+           * a re-investigation may have posted a different, non-code analysis
+           * while this task waited in the queue.
+           */
+          if (
+            taskType === CodeFixTaskType.FixFromIncident &&
+            !investigationSnapshot
+          ) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "This fix-from-incident task has no complete pinned investigation analysis snapshot — it cannot be executed safely.",
+              ),
+            );
+          }
+
           /*
            * Service-scoped instrumentation recipes (ImproveLogging /
            * ImproveTracing): the context is just the service — resolve the
@@ -863,7 +879,8 @@ export default class AIAgentDataAPI {
            * fine when the subject has no monitor.
            */
           let serviceName: string | null = null;
-          let analysisMarkdown: string | null = null;
+          let analysisMarkdown: string | null =
+            investigationSnapshot?.investigationAnalysisMarkdown || null;
 
           if (run.triggeredByIncidentId) {
             const incident: Incident | null = await IncidentService.findOneById(
@@ -899,24 +916,11 @@ export default class AIAgentDataAPI {
                 })
                 .filter(Boolean)[0] || null;
 
-            const feedItem: IncidentFeed | null =
-              await IncidentFeedService.findOneBy({
-                query: {
-                  incidentId: run.triggeredByIncidentId,
-                  incidentFeedEventType: IncidentFeedEventType.RootCause,
-                },
-                select: {
-                  feedInfoInMarkdown: true,
-                },
-                sort: {
-                  createdAt: SortOrder.Descending,
-                },
-                props: {
-                  isRoot: true,
-                },
-              });
-
-            analysisMarkdown = feedItem?.feedInfoInMarkdown || null;
+            if (taskType !== CodeFixTaskType.FixFromIncident) {
+              analysisMarkdown = await PostedRootCause.getForIncident(
+                run.triggeredByIncidentId,
+              );
+            }
           } else {
             const alert: Alert | null = await AlertService.findOneById({
               id: run.triggeredByAlertId!,
@@ -944,25 +948,11 @@ export default class AIAgentDataAPI {
             subjectTitle = alert.title || "Untitled alert";
             serviceName = alert.monitor?.name || null;
 
-            const feedItem: AlertFeed | null = await AlertFeedService.findOneBy(
-              {
-                query: {
-                  alertId: run.triggeredByAlertId!,
-                  alertFeedEventType: AlertFeedEventType.RootCause,
-                },
-                select: {
-                  feedInfoInMarkdown: true,
-                },
-                sort: {
-                  createdAt: SortOrder.Descending,
-                },
-                props: {
-                  isRoot: true,
-                },
-              },
-            );
-
-            analysisMarkdown = feedItem?.feedInfoInMarkdown || null;
+            if (taskType !== CodeFixTaskType.FixFromIncident) {
+              analysisMarkdown = await PostedRootCause.getForAlert(
+                run.triggeredByAlertId!,
+              );
+            }
           }
 
           if (!analysisMarkdown) {
@@ -1166,6 +1156,36 @@ export default class AIAgentDataAPI {
             );
           }
 
+          /*
+           * The project check above proves the ROW is in the agent's project.
+           * It does not prove the INSTALLATION is — and those are different
+           * questions, because the row's installation ID is just a number
+           * stored on a record. Someone who could get an arbitrary
+           * installation ID onto a row in a project they own would otherwise
+           * pass every check to this point and be handed a live `ghs_` token
+           * for another tenant's repositories. So re-derive the binding from
+           * the project itself, right before minting.
+           */
+          if (
+            !codeRepository.projectId ||
+            !(await GitHubInstallationBinding.isInstallationBoundToProject({
+              projectId: codeRepository.projectId,
+              installationId: codeRepository.gitHubAppInstallationId,
+            }))
+          ) {
+            logger.error(
+              `Refusing to mint a GitHub token for code repository ${codeRepositoryId.toString()}: installation ${codeRepository.gitHubAppInstallationId} is not bound to project ${codeRepository.projectId?.toString()}.`,
+            );
+
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "This repository's GitHub App installation is not connected to its project. Please reconnect the GitHub App from Project Settings.",
+              ),
+            );
+          }
+
           /*
            * G11 guardrail: per-repo open-PR cap, enforced HERE because the
            * token is the agent's only way to clone and push — a repo at its

package/Server/API/AIInvestigationAPI.ts

@@ -16,6 +16,8 @@ import Query from "../../Types/BaseDatabase/Query";
 import { JSONArray, JSONObject } from "../../Types/JSON";
 import AIRunType from "../../Types/AI/AIRunType";
 import AIRunHumanVerdict from "../../Types/AI/AIRunHumanVerdict";
+import AIRunStatus from "../../Types/AI/AIRunStatus";
+import AIRunEventType from "../../Types/AI/AIRunEventType";
 import AIRun from "../../Models/DatabaseModels/AIRun";
 import AIRunEvent from "../../Models/DatabaseModels/AIRunEvent";
 import Incident from "../../Models/DatabaseModels/Incident";
@@ -32,6 +34,7 @@ import SpanService from "../Services/SpanService";
 import FixFromIncidentTaskTrigger from "../Utils/AI/SRE/FixFromIncidentTaskTrigger";
 import FixPerformanceTaskTrigger from "../Utils/AI/SRE/FixPerformanceTaskTrigger";
 import TelemetryImprovementTaskTrigger from "../Utils/AI/SRE/TelemetryImprovementTaskTrigger";
+import PostedRootCause from "../Utils/AI/SRE/PostedRootCause";
 import CodeFixTaskType from "../../Types/AI/CodeFixTaskType";
 import { AnalyzableSpan } from "../Utils/AI/PerfEvidence/SpanTreeAnalyzer";
 
@@ -47,6 +50,100 @@ const MAX_ANALYZED_TRACE_SPANS: number = 500;
 
 const MAX_EVENTS: number = 500;
 
+/*
+ * `aiRunId` is the established dashboard API field. The investigation panel
+ * introduced the more explicit `investigationRunId` name while this feature
+ * was in flight, so accept either spelling without ever allowing two
+ * different ids in one request. Both names identify the exact displayed run.
+ */
+function getDisplayedInvestigationRunId(req: ExpressRequest): ObjectID {
+  const aiRunId: string =
+    typeof req.body["aiRunId"] === "string"
+      ? (req.body["aiRunId"] as string).trim()
+      : "";
+  const investigationRunId: string =
+    typeof req.body["investigationRunId"] === "string"
+      ? (req.body["investigationRunId"] as string).trim()
+      : "";
+
+  if (!aiRunId && !investigationRunId) {
+    throw new BadDataException("investigationRunId (or aiRunId) is required.");
+  }
+
+  if (aiRunId && investigationRunId && aiRunId !== investigationRunId) {
+    throw new BadDataException(
+      "aiRunId and investigationRunId must identify the same displayed investigation.",
+    );
+  }
+
+  const selectedRunId: string = investigationRunId || aiRunId;
+  ObjectID.validateUUID(selectedRunId);
+  return new ObjectID(selectedRunId);
+}
+
+/*
+ * The run wins its Running -> Completed transition before it performs the
+ * confidence check and posts the RootCause feed item. A final RunCompleted or
+ * RunFailed event is emitted when that finalization settles; failures from
+ * retried attempts precede a later RunStarted. This upper bound is a crash
+ * failsafe and deliberately leaves ample margin above the bounded confidence
+ * classification deadline plus feed publication.
+ */
+export const ANALYSIS_FINALIZATION_TIMEOUT_MS: number = 10 * 60 * 1000;
+// Database/application clocks can differ briefly around the Completed write.
+export const ANALYSIS_COMPLETION_CLOCK_SKEW_MS: number = 60 * 1000;
+
+export function isAnalysisPendingForRun(data: {
+  run: AIRun;
+  events: Array<AIRunEvent>;
+  analysisMarkdown: string | null;
+  currentDate?: Date | undefined;
+}): boolean {
+  if (
+    data.run.status !== AIRunStatus.Completed ||
+    data.analysisMarkdown ||
+    !data.run.completedAt
+  ) {
+    return false;
+  }
+
+  /*
+   * A retried run retains RunFailed from earlier attempts. Only a settlement
+   * event emitted after the latest RunStarted belongs to the attempt that won
+   * the Completed transition; an older failure must not stop report polling.
+   * sendLatestInvestigation supplies events in sequence order.
+   */
+  let latestRunStartedIndex: number = -1;
+  data.events.forEach((event: AIRunEvent, index: number): void => {
+    if (event.eventType === AIRunEventType.RunStarted) {
+      latestRunStartedIndex = index;
+    }
+  });
+
+  const hasFinalizationEvent: boolean = data.events.some(
+    (event: AIRunEvent, index: number): boolean => {
+      return (
+        index > latestRunStartedIndex &&
+        (event.eventType === AIRunEventType.RunCompleted ||
+          event.eventType === AIRunEventType.RunFailed)
+      );
+    },
+  );
+
+  if (hasFinalizationEvent) {
+    return false;
+  }
+
+  const currentDate: Date = data.currentDate || new Date();
+  const millisecondsSinceCompletion: number =
+    currentDate.getTime() - data.run.completedAt.getTime();
+
+  return (
+    millisecondsSinceCompletion >= -ANALYSIS_COMPLETION_CLOCK_SKEW_MS &&
+    millisecondsSinceCompletion < ANALYSIS_FINALIZATION_TIMEOUT_MS
+  );
+}
+
 /*
  * Returns the latest AI investigation (the AIRun + its ordered
  * AIRunEvents) for an incident or alert, so the dashboard can render a live
@@ -80,6 +177,10 @@ async function sendLatestInvestigation(
   req: ExpressRequest,
   res: ExpressResponse,
   runQuery: Query<AIRun>,
+  subject: {
+    incidentId?: ObjectID | undefined;
+    alertId?: ObjectID | undefined;
+  },
 ): Promise<void> {
   const runs: Array<AIRun> = await AIRunService.findBy({
     query: runQuery,
@@ -93,6 +194,7 @@ async function sendLatestInvestigation(
       toolCallCount: true,
       totalTokens: true,
       createdAt: true,
+      codeFixRecommendation: true,
       // Measurement layer: the panel renders verdict/grade state from these.
       humanVerdict: true,
       humanVerdictAt: true,
@@ -111,6 +213,8 @@ async function sendLatestInvestigation(
     Response.sendJsonObjectResponse(req, res, {
       run: null,
       events: [],
+      analysisMarkdown: null,
+      isAnalysisPending: false,
     });
     return;
   }
@@ -138,9 +242,32 @@ async function sendLatestInvestigation(
 
   const eventsJson: JSONArray = BaseModel.toJSONArray(events, AIRunEvent);
 
+  /*
+   * RootCause is the canonical persisted investigation result. The explicit
+   * aiRunId association is immune to application/database clock skew and to
+   * overlapping investigations posting out of order.
+   */
+  let analysisMarkdown: string | null = null;
+
+  if (run.status === AIRunStatus.Completed && run.completedAt) {
+    analysisMarkdown = await PostedRootCause.getForInvestigation({
+      ...subject,
+      aiRunId: run.id!,
+      runCompletedAt: run.completedAt,
+    });
+  }
+
+  const isAnalysisPending: boolean = isAnalysisPendingForRun({
+    run,
+    events,
+    analysisMarkdown,
+  });
+
   Response.sendJsonObjectResponse(req, res, {
     run: runJson || null,
     events: eventsJson,
+    analysisMarkdown,
+    isAnalysisPending,
   });
 }
 
@@ -178,10 +305,17 @@ router.post(
         );
       }
 
-      await sendLatestInvestigation(req, res, {
-        triggeredByIncidentId: incidentId,
-        runType: AIRunType.Investigation,
-      });
+      await sendLatestInvestigation(
+        req,
+        res,
+        {
+          triggeredByIncidentId: incidentId,
+          runType: AIRunType.Investigation,
+        },
+        {
+          incidentId,
+        },
+      );
       return;
     } catch (err) {
       next(err);
@@ -224,10 +358,17 @@ router.post(
         );
       }
 
-      await sendLatestInvestigation(req, res, {
-        triggeredByAlertId: alertId,
-        runType: AIRunType.Investigation,
-      });
+      await sendLatestInvestigation(
+        req,
+        res,
+        {
+          triggeredByAlertId: alertId,
+          runType: AIRunType.Investigation,
+        },
+        {
+          alertId,
+        },
+      );
       return;
     } catch (err) {
       next(err);
@@ -238,14 +379,16 @@ router.post(
 
 /*
  * Human verdict capture (Phase 2 measurement layer): one-click Confirm /
- * Reject on the investigation panel. Applies to the LATEST COMPLETED
- * investigation run for the subject; overwriting is allowed (a user may
+ * Reject on the investigation panel. Applies to the exact COMPLETED
+ * investigation run displayed to the user; overwriting is allowed (a user may
  * change their mind), and the request is rejected when no completed
  * investigation exists. The subject is access-checked under the USER's
  * permissions first (same idiom as the read routes above); the run itself is
  * written as root because investigation runs are system-authored.
  * Body: { subjectType: "incident" | "alert", subjectId,
- * verdict: "Confirmed" | "Rejected" }. Response: { runId, verdict }.
+ * aiRunId (or its investigationRunId alias), verdict: "Confirmed" |
+ * "Rejected" }. The run id binds the mutation to the analysis currently
+ * displayed. Response: { runId, verdict }.
  */
 router.post(
   "/ai-investigation/verdict",
@@ -278,6 +421,8 @@ router.post(
 
       const subjectId: ObjectID = new ObjectID(subjectIdString);
 
+      const investigationRunId: ObjectID = getDisplayedInvestigationRunId(req);
+
       const verdict: string | undefined = req.body["verdict"] as
         | string
         | undefined;
@@ -292,34 +437,42 @@ router.post(
       }
 
       // Access check under the USER's permissions (null when not allowed).
+      let projectId: ObjectID | undefined = undefined;
+
       if (subjectType === "incident") {
         const incident: Incident | null = await IncidentService.findOneById({
           id: subjectId,
-          select: { _id: true },
+          select: { _id: true, projectId: true },
           props,
         });
 
-        if (!incident) {
+        if (!incident || !incident.projectId) {
           throw new BadDataException(
             "Incident not found (or you do not have access to it).",
           );
         }
+
+        projectId = incident.projectId;
       } else {
         const alert: Alert | null = await AlertService.findOneById({
           id: subjectId,
-          select: { _id: true },
+          select: { _id: true, projectId: true },
           props,
         });
 
-        if (!alert) {
+        if (!alert || !alert.projectId) {
           throw new BadDataException(
             "Alert not found (or you do not have access to it).",
           );
         }
+
+        projectId = alert.projectId;
       }
 
       const result: { runId: ObjectID; verdict: AIRunHumanVerdict } =
-        await AIRunService.applyHumanVerdictToLatestInvestigation({
+        await AIRunService.applyHumanVerdictToInvestigation({
+          aiRunId: investigationRunId,
+          projectId,
           ...(subjectType === "incident"
             ? { incidentId: subjectId }
             : { alertId: subjectId }),
@@ -346,7 +499,9 @@ router.post(
  * access-checked under the USER's permissions first (same idiom as the read
  * routes above); the trigger's gates (completed investigation, GitHub-App
  * repository, per-subject dedupe) fail early with a clear message.
- * Body: { subjectType: "incident" | "alert", subjectId }. Response:
+ * Body: { subjectType: "incident" | "alert", subjectId,
+ * aiRunId (or its investigationRunId alias) }. The run id rejects stale
+ * clicks instead of silently switching to a newer analysis. Response:
  * { aiRunId } — the Queued CodeFix run the agent worker will claim.
  */
 router.post(
@@ -380,6 +535,8 @@ router.post(
 
       const subjectId: ObjectID = new ObjectID(subjectIdString);
 
+      const investigationRunId: ObjectID = getDisplayedInvestigationRunId(req);
+
       // Access check under the USER's permissions (null when not allowed).
       let projectId: ObjectID | undefined = undefined;
 
@@ -419,6 +576,7 @@ router.post(
           ...(subjectType === "incident"
             ? { incidentId: subjectId }
             : { alertId: subjectId }),
+          investigationRunId,
           userId: props.userId!,
         });