@oneuptime/common 12.0.3 → 12.0.5

package/Server/Infrastructure/Postgres/SchemaMigrations/1786101798351-MigrationName.ts

@@ -0,0 +1,89 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1786101798351 implements MigrationInterface {
+  public name = "MigrationName1786101798351";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableIncidentInstrumentationFixTasks" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAlertInstrumentationFixTasks" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAutomaticIncidentCodeFixes" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAutomaticAlertCodeFixes" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "incidentAiDailyAutonomousTokenLimit" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "alertAiDailyAutonomousTokenLimit" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "incidentAiDailyFixTaskLimit" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "alertAiDailyFixTaskLimit" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "incidentAiMaxConcurrentInvestigations" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "alertAiMaxConcurrentInvestigations" integer`,
+    );
+    await queryRunner.query(
+      `UPDATE "Project" SET "enableIncidentInstrumentationFixTasks" = "enableInstrumentationFixTasks", "enableAlertInstrumentationFixTasks" = "enableInstrumentationFixTasks", "enableAutomaticIncidentCodeFixes" = "enableAutomaticCodeFixes", "enableAutomaticAlertCodeFixes" = "enableAutomaticCodeFixes", "incidentAiDailyAutonomousTokenLimit" = "aiDailyAutonomousTokenLimit", "alertAiDailyAutonomousTokenLimit" = "aiDailyAutonomousTokenLimit", "incidentAiDailyFixTaskLimit" = "aiDailyFixTaskLimit", "alertAiDailyFixTaskLimit" = "aiDailyFixTaskLimit", "incidentAiMaxConcurrentInvestigations" = "aiMaxConcurrentInvestigations", "alertAiMaxConcurrentInvestigations" = "aiMaxConcurrentInvestigations"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableInstrumentationFixTasks"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAutomaticCodeFixes"`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAutomaticCodeFixes" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableInstrumentationFixTasks" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `UPDATE "Project" SET "enableInstrumentationFixTasks" = "enableIncidentInstrumentationFixTasks" OR "enableAlertInstrumentationFixTasks", "enableAutomaticCodeFixes" = "enableAutomaticIncidentCodeFixes" OR "enableAutomaticAlertCodeFixes"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "alertAiMaxConcurrentInvestigations"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "incidentAiMaxConcurrentInvestigations"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "alertAiDailyFixTaskLimit"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "incidentAiDailyFixTaskLimit"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "alertAiDailyAutonomousTokenLimit"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "incidentAiDailyAutonomousTokenLimit"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAutomaticAlertCodeFixes"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAutomaticIncidentCodeFixes"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAlertInstrumentationFixTasks"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableIncidentInstrumentationFixTasks"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786105470826-MigrationName.ts

@@ -0,0 +1,27 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1786105470826 implements MigrationInterface {
+  public name = "MigrationName1786105470826";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "IncidentFeed" ADD "aiRunId" uuid`);
+    await queryRunner.query(`ALTER TABLE "AlertFeed" ADD "aiRunId" uuid`);
+    await queryRunner.query(
+      `CREATE INDEX "IDX_bae064a2cf9282fc2cca934d78" ON "IncidentFeed" ("incidentId", "aiRunId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_7da528b06c0ae8b2f1b6c9c848" ON "AlertFeed" ("alertId", "aiRunId") `,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_7da528b06c0ae8b2f1b6c9c848"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_bae064a2cf9282fc2cca934d78"`,
+    );
+    await queryRunner.query(`ALTER TABLE "AlertFeed" DROP COLUMN "aiRunId"`);
+    await queryRunner.query(`ALTER TABLE "IncidentFeed" DROP COLUMN "aiRunId"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786200000000-RestoreDroppedUniqueIndexes.ts

@@ -0,0 +1,214 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Restores nine UNIQUE indexes that autogenerated migrations deleted, and that
+ * no migration ever put back.
+ *
+ * HOW THEY WENT MISSING
+ *
+ * TypeORM's schema builder matches database indexes to entity metadata BY NAME
+ * (RdbmsSchemaBuilder.dropOldIndices) and drops every index it cannot find a
+ * match for. A hand-named index created only in a migration is invisible to
+ * entity metadata, so the next `migration:generate` emits a DROP for it, mixed
+ * in with whatever change was actually intended.
+ *
+ * Found by auditing every hand-named index ever created in a migration up()
+ * against a database with all 504 registered migrations applied. 308 such
+ * indexes exist; 302 are absent from the migrated schema. Almost all of those
+ * are benign — TypeORM re-created an equivalent plain index under its own
+ * canonical IDX_<hash> name. The ten that were NOT benign carried a UNIQUE,
+ * partial, or expression definition that TypeORM cannot express and therefore
+ * never re-created. One of the ten (the Service LOWER(name) index) was restored
+ * separately in migration 1786100000000. This handles the other nine.
+ *
+ * Each one is a lost integrity guarantee, not just a lost index:
+ *
+ *   slug uniqueness  CephCluster, DockerHost, IoTFleet, KubernetesCluster,
+ *                    NetworkDevice, ProxmoxCluster — the slug is the public URL
+ *                    identifier for the resource. These six tables currently
+ *                    have NO index on slug at all, so slug lookups are also
+ *                    sequential scans.
+ *   SSO/OIDC binding GlobalOIDCProject, GlobalSSOProject — one mapping row per
+ *                    (provider, project). Duplicates make a project's identity
+ *                    binding ambiguous.
+ *   interface ids    NetworkInterface — a device cannot have two live
+ *                    interfaces at the same SNMP ifIndex. App-level
+ *                    @UniqueColumnBy does a find-then-insert, which races under
+ *                    concurrency exactly as it did for Service before migration
+ *                    1778100000000 added a DB constraint.
+ *
+ * PARTIAL, WHERE THE ORIGINALS MOSTLY WERE NOT
+ *
+ * Only IDX_network_interface_device_ifindex was originally partial. The other
+ * eight were unqualified UNIQUE indexes, and they are restored here as partial
+ * on `deletedAt IS NULL`. This is a deliberate change, for three reasons:
+ *
+ *   1. It matches how the data is actually read. Every query the app issues
+ *      carries `deletedAt IS NULL` (DatabaseService adds it to every read that
+ *      is not explicitly withDeleted), so nothing loses index coverage.
+ *   2. An unqualified unique index lets a soft-deleted row hold a slug
+ *      hostage forever — delete a cluster and you can never create another one
+ *      that slugifies the same way. That is a bug, and restoring it verbatim
+ *      would restore the bug with it.
+ *   3. It makes the repair below non-destructive: a duplicate can be taken out
+ *      of the index by soft-deleting it rather than by hard-deleting a row.
+ *
+ * REPAIR BEFORE CREATE
+ *
+ * A UNIQUE index cannot be created over existing duplicates, and a migration
+ * that can fail on real data is a migration that blocks a deploy. Each index is
+ * therefore preceded by a repair step that is deterministic (oldest row always
+ * wins: createdAt, then _id) and non-destructive:
+ *
+ *   - slugs are RENAMED, not deleted. The losing row keeps all its data and
+ *     gets a discriminator appended. Slugs already end in a random 10-digit
+ *     suffix (see Common/Utils/Slug.ts), so collisions should not exist at all;
+ *     this is a guard, not an expected path.
+ *   - duplicate mapping / interface rows are SOFT-deleted, which removes them
+ *     from a partial index without destroying anything. Nothing is hard-deleted
+ *     and no foreign key is touched, so no cascade can fire.
+ *
+ * Every statement is idempotent: the repairs are no-ops when there are no
+ * duplicates, and each CREATE uses IF NOT EXISTS so an index built by hand
+ * ahead of the deploy does not fail the migration.
+ *
+ * NOT CONCURRENT
+ *
+ * DataSourceOptions sets no `migrationsTransactionMode`, so TypeORM defaults to
+ * "all" and runs every migration inside one transaction. CREATE INDEX
+ * CONCURRENTLY cannot run inside a transaction block and would abort the run.
+ * These tables are small (infrastructure inventory, not telemetry), so the
+ * brief SHARE lock is not a concern.
+ *
+ * HAND-WRITTEN
+ *
+ * AGENTS.md requires migrations to come from generate-postgres-migration. It
+ * cannot produce this one: @Index() can express neither a partial index nor the
+ * repair steps. The entities declare each index with `synchronize: false` so
+ * the generator leaves them alone from here on.
+ */
+
+interface SlugTable {
+  table: string;
+  indexName: string;
+}
+
+const SLUG_TABLES: Array<SlugTable> = [
+  { table: "CephCluster", indexName: "IDX_ceph_cluster_slug" },
+  { table: "DockerHost", indexName: "IDX_docker_host_slug" },
+  { table: "IoTFleet", indexName: "IDX_iot_fleet_slug" },
+  { table: "KubernetesCluster", indexName: "IDX_kubernetes_cluster_slug" },
+  { table: "NetworkDevice", indexName: "IDX_network_device_slug" },
+  { table: "ProxmoxCluster", indexName: "IDX_proxmox_cluster_slug" },
+];
+
+interface PairIndex {
+  table: string;
+  indexName: string;
+  columns: Array<string>;
+}
+
+const PAIR_INDEXES: Array<PairIndex> = [
+  {
+    table: "GlobalOIDCProject",
+    indexName: "IDX_GlobalOIDCProject_globalOidcId_projectId",
+    columns: ["globalOidcId", "projectId"],
+  },
+  {
+    table: "GlobalSSOProject",
+    indexName: "IDX_GlobalSSOProject_globalSsoId_projectId",
+    columns: ["globalSsoId", "projectId"],
+  },
+  {
+    table: "NetworkInterface",
+    indexName: "IDX_network_interface_device_ifindex",
+    columns: ["networkDeviceId", "interfaceIndex"],
+  },
+];
+
+export class RestoreDroppedUniqueIndexes1786200000000
+  implements MigrationInterface
+{
+  public name: string = "RestoreDroppedUniqueIndexes1786200000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Slug tables: rename the losers rather than removing them. Oldest row
+     * keeps the slug; every other live row with the same slug gets the first
+     * eight characters of its own _id appended, which is unique by
+     * construction and keeps the slug URL-safe.
+     */
+    for (const { table, indexName } of SLUG_TABLES) {
+      await queryRunner.query(`
+        WITH ranked AS (
+          SELECT _id,
+                 ROW_NUMBER() OVER (
+                   PARTITION BY "slug"
+                   ORDER BY "createdAt" ASC, _id ASC
+                 ) AS rn
+          FROM "${table}"
+          WHERE "deletedAt" IS NULL AND "slug" IS NOT NULL
+        )
+        UPDATE "${table}" t
+        SET "slug" = t."slug" || '-' || LEFT(t._id::text, 8)
+        FROM ranked r
+        WHERE t._id = r._id AND r.rn > 1;
+      `);
+
+      await queryRunner.query(
+        `CREATE UNIQUE INDEX IF NOT EXISTS "${indexName}" ON "${table}" ("slug") WHERE "deletedAt" IS NULL`,
+      );
+    }
+
+    /*
+     * Composite tables: soft-delete the losers. The index is partial on
+     * `deletedAt IS NULL`, so stamping deletedAt removes the row from the
+     * index while leaving every column intact and every foreign key valid.
+     */
+    for (const { table, indexName, columns } of PAIR_INDEXES) {
+      const partitionBy: string = columns
+        .map((column: string): string => {
+          return `"${column}"`;
+        })
+        .join(", ");
+
+      const notNull: string = columns
+        .map((column: string): string => {
+          return `"${column}" IS NOT NULL`;
+        })
+        .join(" AND ");
+
+      await queryRunner.query(`
+        WITH ranked AS (
+          SELECT _id,
+                 ROW_NUMBER() OVER (
+                   PARTITION BY ${partitionBy}
+                   ORDER BY "createdAt" ASC, _id ASC
+                 ) AS rn
+          FROM "${table}"
+          WHERE "deletedAt" IS NULL AND ${notNull}
+        )
+        UPDATE "${table}" t
+        SET "deletedAt" = CURRENT_TIMESTAMP
+        FROM ranked r
+        WHERE t._id = r._id AND r.rn > 1;
+      `);
+
+      await queryRunner.query(
+        `CREATE UNIQUE INDEX IF NOT EXISTS "${indexName}" ON "${table}" (${partitionBy}) WHERE "deletedAt" IS NULL`,
+      );
+    }
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Only the indexes are reversible. The repair is not: a renamed slug and a
+     * soft-deleted duplicate cannot be distinguished afterwards from one the
+     * application produced, and guessing would corrupt live data. Dropping the
+     * indexes is enough to restore the previous schema shape.
+     */
+    for (const { indexName } of [...SLUG_TABLES, ...PAIR_INDEXES]) {
+      await queryRunner.query(`DROP INDEX IF EXISTS "public"."${indexName}"`);
+    }
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786300000000-QuarantineUnboundGitHubInstallations.ts

@@ -0,0 +1,69 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * GHSA-xx95-gmcf-7q86 — data-side remediation.
+ *
+ * The code fix closes every way to write an installation ID that a project
+ * does not own, and re-derives the binding from Project.gitHubAppInstallationId
+ * before minting a token. Neither reaches rows that are ALREADY in the
+ * database. Before the fix a caller could put any installation ID on a
+ * CodeRepository row in a project they owned, and several code paths (the AI
+ * chat read/write tools, the pull-request sync worker) mint from that column
+ * directly. So any such row left in place stays a live cross-tenant token.
+ *
+ * This migration NULLs the installation ID on every repository row that
+ * contradicts its own project. That is decidable and safe: the project's own
+ * binding is the authority, so a row disagreeing with it was either poisoned
+ * or is stale after a reinstall. Nothing is deleted — the repository row keeps
+ * its name, commands and history, and reconnecting the GitHub App repopulates
+ * the ID through the verified callback.
+ *
+ * Hand-written on purpose: this changes no schema, so the entity-diff
+ * generator (npm run generate-postgres-migration) produces nothing for it, and
+ * the schema-drift check is unaffected.
+ *
+ * WHAT THIS MIGRATION DELIBERATELY DOES NOT DO
+ *
+ * It does not clear Project.gitHubAppInstallationId. Every one of those was
+ * written by the old, unverified callback, but they are overwhelmingly
+ * legitimate and nulling them would disconnect every existing GitHub
+ * integration. There is also no way in SQL to tell a forged binding from a
+ * real one.
+ *
+ * Operators who want to audit for the callback-forgery path should look for
+ * one installation bound to several projects, which is the fingerprint (it is
+ * legal — an org can connect one installation to several projects — so review
+ * the results, do not delete them):
+ *
+ *   SELECT "gitHubAppInstallationId", count(*), array_agg("_id")
+ *   FROM "Project"
+ *   WHERE "gitHubAppInstallationId" IS NOT NULL AND "deletedAt" IS NULL
+ *   GROUP BY "gitHubAppInstallationId" HAVING count(*) > 1;
+ */
+export class QuarantineUnboundGitHubInstallations1786300000000
+  implements MigrationInterface
+{
+  public name = "QuarantineUnboundGitHubInstallations1786300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      UPDATE "CodeRepository" AS cr
+      SET "gitHubAppInstallationId" = NULL
+      FROM "Project" AS p
+      WHERE cr."projectId" = p."_id"
+        AND cr."gitHubAppInstallationId" IS NOT NULL
+        AND (
+          p."gitHubAppInstallationId" IS NULL
+          OR p."gitHubAppInstallationId" <> cr."gitHubAppInstallationId"
+        )
+    `);
+  }
+
+  public async down(): Promise<void> {
+    /*
+     * Not reversible, and must not be. The quarantined values are exactly the
+     * bindings that could not be justified; restoring them would restore the
+     * vulnerability, and the rows carry no record of what was cleared.
+     */
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786400000000-AddMasterPasswordSalt.ts

@@ -0,0 +1,40 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+type ScryptHashExistsResult = {
+  exists: boolean;
+};
+
+export class AddMasterPasswordSalt1786400000000 implements MigrationInterface {
+  public name = "AddMasterPasswordSalt1786400000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" ADD "masterPasswordSalt" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Dashboard" ADD "masterPasswordSalt" character varying(100)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    const [dashboardResult] = (await queryRunner.query(
+      `SELECT EXISTS (SELECT 1 FROM "Dashboard" WHERE "masterPassword" LIKE 'scrypt$%') AS "exists"`,
+    )) as Array<ScryptHashExistsResult>;
+    const [statusPageResult] = (await queryRunner.query(
+      `SELECT EXISTS (SELECT 1 FROM "StatusPage" WHERE "masterPassword" LIKE 'scrypt$%') AS "exists"`,
+    )) as Array<ScryptHashExistsResult>;
+
+    if (dashboardResult?.exists || statusPageResult?.exists) {
+      throw new Error(
+        "Cannot remove master-password salt columns while scrypt master-password hashes exist.",
+      );
+    }
+
+    await queryRunner.query(
+      `ALTER TABLE "Dashboard" DROP COLUMN "masterPasswordSalt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" DROP COLUMN "masterPasswordSalt"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786500000000-AddInvestigationCodeFixRecommendation.ts

@@ -0,0 +1,26 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with `npm run generate-postgres-migration` after adding
+ * AIRun.codeFixRecommendation. Existing rows fail closed as NotRecommended;
+ * incident/alert investigations move to Pending only in their atomic
+ * Completed transition, then settle through structured post-analysis
+ * classification.
+ */
+export class AddInvestigationCodeFixRecommendation1786500000000
+  implements MigrationInterface
+{
+  public name = "AddInvestigationCodeFixRecommendation1786500000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "AIRun" ADD "codeFixRecommendation" character varying(100) NOT NULL DEFAULT 'NotRecommended'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "AIRun" DROP COLUMN "codeFixRecommendation"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -499,6 +499,16 @@ import { AddStatusPageReportPeriod1785930709405 } from "./1785930709405-AddStatu
 import { AddIncidentInvestigationGating1785790000000 } from "./1785790000000-AddIncidentInvestigationGating";
 import { AddRemediationVerification1785768089408 } from "./1785768089408-AddRemediationVerification";
 import { AddStatusPageMonitorRule1786005052769 } from "./1786005052769-AddStatusPageMonitorRule";
+import { AddPerUserPasswordSalt1786018109307 } from "./1786018109307-AddPerUserPasswordSalt";
+import { WidenHashedStringColumnsForScrypt1786023262402 } from "./1786023262402-WidenHashedStringColumnsForScrypt";
+import { AddTimeRangeToLogSavedView1786096660558 } from "./1786096660558-AddTimeRangeToLogSavedView";
+import { RestoreServiceLowerNameIndex1786100000000 } from "./1786100000000-RestoreServiceLowerNameIndex";
+import { MigrationName1786101798351 } from "./1786101798351-MigrationName";
+import { MigrationName1786105470826 } from "./1786105470826-MigrationName";
+import { RestoreDroppedUniqueIndexes1786200000000 } from "./1786200000000-RestoreDroppedUniqueIndexes";
+import { QuarantineUnboundGitHubInstallations1786300000000 } from "./1786300000000-QuarantineUnboundGitHubInstallations";
+import { AddMasterPasswordSalt1786400000000 } from "./1786400000000-AddMasterPasswordSalt";
+import { AddInvestigationCodeFixRecommendation1786500000000 } from "./1786500000000-AddInvestigationCodeFixRecommendation";
 
 export default [
   InitialMigration,
@@ -1002,4 +1012,14 @@ export default [
   WidenInventoryResourceNameColumns1785930000000,
   AddStatusPageReportPeriod1785930709405,
   AddStatusPageMonitorRule1786005052769,
+  AddPerUserPasswordSalt1786018109307,
+  WidenHashedStringColumnsForScrypt1786023262402,
+  AddTimeRangeToLogSavedView1786096660558,
+  RestoreServiceLowerNameIndex1786100000000,
+  RestoreDroppedUniqueIndexes1786200000000,
+  QuarantineUnboundGitHubInstallations1786300000000,
+  MigrationName1786101798351,
+  AddMasterPasswordSalt1786400000000,
+  MigrationName1786105470826,
+  AddInvestigationCodeFixRecommendation1786500000000,
 ];

package/Server/Services/AIRunService.ts

@@ -3,12 +3,17 @@ import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import AIRunStatus from "../../Types/AI/AIRunStatus";
 import AIRunType from "../../Types/AI/AIRunType";
+import AIRunCodeFixRecommendation from "../../Types/AI/AIRunCodeFixRecommendation";
 import AIRunHumanVerdict from "../../Types/AI/AIRunHumanVerdict";
 import BadDataException from "../../Types/Exception/BadDataException";
 import CodeFixTaskType, {
   CodeFixContextKind,
   CodeFixTaskTypeHelper,
 } from "../../Types/AI/CodeFixTaskType";
+import {
+  getInvestigationCodeFixTaskSnapshot,
+  InvestigationCodeFixTaskContext,
+} from "../../Types/AI/CodeFixTaskContext";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import QueryHelper from "../Types/Database/QueryHelper";
 import CountBy from "../Types/Database/CountBy";
@@ -40,6 +45,7 @@ export interface AIRunTransitionSet {
   llmCallCount?: number | undefined;
   toolCallCount?: number | undefined;
   totalTokens?: number | undefined;
+  codeFixRecommendation?: AIRunCodeFixRecommendation | undefined;
   // The claiming agent's id as a string (ObjectID.toString()) — see above.
   aiAgentId?: string | undefined;
 }
@@ -52,8 +58,8 @@ export class Service extends DatabaseService<Model> {
   /*
    * A genuinely atomic status transition: one conditional UPDATE whose WHERE
    * carries the expected current status (and optionally the expected
-   * attemptCount). Returns the number of rows changed — 0 means another
-   * actor won the race.
+   * attemptCount / heartbeat snapshot). Returns the number of rows changed —
+   * 0 means another actor won the race or refreshed the heartbeat.
    *
    * This exists because updateOneBy is SELECT-then-save: two concurrent
    * callers can both observe the precondition and both write, so it cannot
@@ -65,6 +71,7 @@ export class Service extends DatabaseService<Model> {
     aiRunId: ObjectID;
     fromStatus: AIRunStatus;
     expectedAttemptCount?: number | undefined;
+    expectedLastHeartbeatAt?: Date | undefined;
     set: AIRunTransitionSet;
   }): Promise<number> {
     const queryBuilder: UpdateQueryBuilder<Model> = this.getRepository()
@@ -81,11 +88,57 @@ export class Service extends DatabaseService<Model> {
       });
     }
 
+    if (data.expectedLastHeartbeatAt !== undefined) {
+      queryBuilder.andWhere('"lastHeartbeatAt" = :expectedLastHeartbeatAt', {
+        expectedLastHeartbeatAt: data.expectedLastHeartbeatAt,
+      });
+    }
+
     const result: UpdateResult = await queryBuilder.execute();
 
     return result.affected || 0;
   }
 
+  /*
+   * Atomically settle the code-fix decision written as Pending by the
+   * winning investigation completion transition. The recommendation and
+   * immutable analysis snapshot are one database UPDATE guarded by both the
+   * run id and Pending state; a stale writer can never overwrite a decision
+   * another actor already settled.
+   */
+  @CaptureSpan()
+  public async finalizeInvestigationCodeFixRecommendation(
+    data:
+      | {
+          aiRunId: ObjectID;
+          recommendation: AIRunCodeFixRecommendation.Recommended;
+          taskContext: InvestigationCodeFixTaskContext;
+        }
+      | {
+          aiRunId: ObjectID;
+          recommendation: AIRunCodeFixRecommendation.NotRecommended;
+        },
+  ): Promise<number> {
+    const result: UpdateResult = await this.getRepository()
+      .createQueryBuilder()
+      .update(Model)
+      .set({
+        codeFixRecommendation: data.recommendation,
+        ...(data.recommendation === AIRunCodeFixRecommendation.Recommended
+          ? { taskContext: data.taskContext }
+          : {}),
+      } as QueryDeepPartialEntity<Model>)
+      .where('"_id" = :id', { id: data.aiRunId.toString() })
+      .andWhere('"status" = :status', { status: AIRunStatus.Completed })
+      .andWhere('"codeFixRecommendation" = :pending', {
+        pending: AIRunCodeFixRecommendation.Pending,
+      })
+      .andWhere('"deletedAt" IS NULL')
+      .execute();
+
+    return result.affected || 0;
+  }
+
   /*
    * Atomically claim the oldest Queued code-fix run for an external agent
    * worker (the /ai-agent-task/get-pending-task route). The Queued -> Running
@@ -193,10 +246,22 @@ export class Service extends DatabaseService<Model> {
           ? null
           : "Queued code-fix run has no telemetry exception to fix.";
       } else if (contextKind === CodeFixContextKind.IncidentOrAlertSubject) {
-        missingContextMessage =
-          run.triggeredByIncidentId || run.triggeredByAlertId
-            ? null
-            : "Queued code-fix run has no incident or alert subject.";
+        if (!run.triggeredByIncidentId && !run.triggeredByAlertId) {
+          missingContextMessage =
+            "Queued code-fix run has no incident or alert subject.";
+        } else if (
+          run.codeFixTaskType === CodeFixTaskType.FixFromIncident &&
+          !getInvestigationCodeFixTaskSnapshot(run.taskContext)
+        ) {
+          /*
+           * A subject alone is mutable context: a later investigation can post
+           * another RootCause before the worker starts. FixFromIncident must
+           * therefore carry the exact Recommended run + analysis it was
+           * authorized from. Contextless legacy rows fail closed.
+           */
+          missingContextMessage =
+            "Queued FixFromIncident run has no complete pinned investigation analysis snapshot.";
+        }
       } else if (
         run.codeFixTaskType === CodeFixTaskType.ImproveLogging ||
         run.codeFixTaskType === CodeFixTaskType.ImproveTracing
@@ -296,7 +361,7 @@ export class Service extends DatabaseService<Model> {
 
   /*
    * Measurement layer (Phase 2): record a human's one-click verdict
-   * (Confirmed / Rejected) on the LATEST COMPLETED investigation run for an
+   * (Confirmed / Rejected) on one exact COMPLETED investigation run for an
    * incident or alert. Overwriting an existing verdict is deliberate — a
    * user may change their mind; the verdict is per-run state, not an audit
    * trail. Throws when no completed investigation exists for the subject.
@@ -305,7 +370,9 @@ export class Service extends DatabaseService<Model> {
    * are system-authored, so the per-user privacy pin would hide them).
    */
   @CaptureSpan()
-  public async applyHumanVerdictToLatestInvestigation(data: {
+  public async applyHumanVerdictToInvestigation(data: {
+    aiRunId: ObjectID;
+    projectId: ObjectID;
     incidentId?: ObjectID | undefined;
     alertId?: ObjectID | undefined;
     verdict: AIRunHumanVerdict;
@@ -319,6 +386,8 @@ export class Service extends DatabaseService<Model> {
 
     const run: Model | null = await this.findOneBy({
       query: {
+        _id: data.aiRunId,
+        projectId: data.projectId,
         runType: AIRunType.Investigation,
         status: AIRunStatus.Completed,
         ...(data.incidentId
@@ -326,13 +395,12 @@ export class Service extends DatabaseService<Model> {
           : { triggeredByAlertId: data.alertId! }),
       },
       select: { _id: true },
-      sort: { createdAt: SortOrder.Descending },
       props: { isRoot: true },
     });
 
     if (!run || !run.id) {
       throw new BadDataException(
-        "No completed AI investigation exists for this subject yet — a verdict can only be recorded on a completed investigation.",
+        "The selected completed AI investigation does not exist for this subject — refresh the page before recording a verdict.",
       );
     }