@oneuptime/common 12.0.4 → 12.0.5

package/Server/Services/AIService.ts

@@ -155,19 +155,32 @@ export const AI_REMEDIATION_EXECUTION_FEATURE: string =
  * (SQL `= ANY`, and an `.includes()` gate on the write path that no writer can
  * trip because no writer emits these strings any more).
  */
+const LEGACY_SENTINEL_INCIDENT_INVESTIGATION_FEATURE: string =
+  "Sentinel Incident Investigation";
+const LEGACY_SENTINEL_ALERT_INVESTIGATION_FEATURE: string =
+  "Sentinel Alert Investigation";
+const LEGACY_SENTINEL_INVESTIGATION_GRADING_FEATURE: string =
+  "Sentinel Investigation Grading";
+const LEGACY_SENTINEL_CONFIDENCE_CLASSIFICATION_FEATURE: string =
+  "Sentinel Confidence Classification";
+const LEGACY_SENTINEL_CODE_FIX_FEATURE: string = "Sentinel Code Fix";
+const LEGACY_SENTINEL_INSIGHT_TRIAGE_FEATURE: string =
+  "Sentinel Insight Triage";
+
 export const LEGACY_AUTONOMOUS_AI_FEATURES: Array<string> = [
-  "Sentinel Incident Investigation",
-  "Sentinel Alert Investigation",
-  "Sentinel Investigation Grading",
-  "Sentinel Confidence Classification",
-  "Sentinel Code Fix",
-  "Sentinel Insight Triage",
+  LEGACY_SENTINEL_INCIDENT_INVESTIGATION_FEATURE,
+  LEGACY_SENTINEL_ALERT_INVESTIGATION_FEATURE,
+  LEGACY_SENTINEL_INVESTIGATION_GRADING_FEATURE,
+  LEGACY_SENTINEL_CONFIDENCE_CLASSIFICATION_FEATURE,
+  LEGACY_SENTINEL_CODE_FIX_FEATURE,
+  LEGACY_SENTINEL_INSIGHT_TRIAGE_FEATURE,
 ];
 
 /*
- * Features that run WITHOUT a human in the loop. The per-project daily token
- * budget (Project.aiDailyAutonomousTokenLimit, G4) applies only to these —
- * interactive chat and explicitly user-triggered AI are never budget-blocked.
+ * Features that run WITHOUT a human in the loop. Incident-linked and
+ * alert-linked calls use their respective daily token limits; subjectless
+ * calls use Project.aiDailyAutonomousTokenLimit. Interactive chat and
+ * explicitly user-triggered AI are never budget-blocked.
  * Auto-postmortem is deliberately excluded for now: it is one call per
  * resolved incident, not storm-shaped; include it when it moves to the queue.
  *
@@ -188,7 +201,7 @@ export const AUTONOMOUS_AI_FEATURES: Array<string> = [
    * user-triggered, but the tool loop then runs unattended for up to ~40
    * calls — storm-shaped enough that the daily budget must cover it. The
    * per-run loop budgets (CodeFixAgentCompletion) cap a single run; this
-   * daily pool caps all of them together.
+   * daily subject lane caps all of them together.
    */
   AI_CODE_FIX_FEATURE,
   /*
@@ -215,7 +228,7 @@ export const AUTONOMOUS_AI_FEATURES: Array<string> = [
   /*
    * Auto-remediation command composition/execution
    * (RemediationExecutionRunner). Same trigger shape as planning, with a
-   * larger per-run tool budget — the daily pool must cover it.
+   * larger per-run tool budget — the daily subject lane must cover it.
    */
   AI_REMEDIATION_EXECUTION_FEATURE,
   /*
@@ -226,6 +239,23 @@ export const AUTONOMOUS_AI_FEATURES: Array<string> = [
   ...LEGACY_AUTONOMOUS_AI_FEATURES,
 ];
 
+/*
+ * Before subject-lane accounting shipped, the main investigation calls did
+ * not persist incidentId/alertId (or aiRunId). Their feature label is the only
+ * durable lane signal left on those rows. Keep these lists so a deployment
+ * does not reset today's incident/alert spend or charge it to background work.
+ */
+const LEGACY_INCIDENT_LANE_FEATURES: Array<string> = [
+  AI_INCIDENT_INVESTIGATION_FEATURE,
+  AI_INVESTIGATION_GRADING_FEATURE,
+  LEGACY_SENTINEL_INCIDENT_INVESTIGATION_FEATURE,
+  LEGACY_SENTINEL_INVESTIGATION_GRADING_FEATURE,
+];
+const LEGACY_ALERT_LANE_FEATURES: Array<string> = [
+  AI_ALERT_INVESTIGATION_FEATURE,
+  LEGACY_SENTINEL_ALERT_INVESTIGATION_FEATURE,
+];
+
 export interface AutonomousBudgetStatus {
   exhausted: boolean;
   // null when the project has no limit configured.
@@ -237,10 +267,10 @@ export interface AILogRequest {
   projectId: ObjectID;
   userId?: ObjectID | undefined;
   feature: string; // e.g., "IncidentPostmortem", "IncidentNote"
-  incidentId?: ObjectID;
-  alertId?: ObjectID;
-  scheduledMaintenanceId?: ObjectID;
-  aiRunId?: ObjectID;
+  incidentId?: ObjectID | undefined;
+  alertId?: ObjectID | undefined;
+  scheduledMaintenanceId?: ObjectID | undefined;
+  aiRunId?: ObjectID | undefined;
   /*
    * When set, use this specific provider (validated against the project) rather
    * than the project default. Powers the in-chat provider/model switcher.
@@ -337,23 +367,40 @@ export class Service extends BaseService {
   }
 
   /*
-   * G4 daily budget: has this project consumed its daily autonomous-token
-   * allowance (UTC day)? Counts only AUTONOMOUS_AI_FEATURES tokens, so chat
-   * usage neither eats the autonomous budget nor is blocked by it.
+   * G4 daily budget: has this project consumed the selected subject lane's
+   * daily autonomous-token allowance (UTC day)? Counts only that lane's
+   * AUTONOMOUS_AI_FEATURES tokens, so chat usage neither eats the autonomous
+   * budget nor is blocked by it.
    */
   @CaptureSpan()
   public async getAutonomousDailyBudgetStatus(
     projectId: ObjectID,
+    subject?: {
+      incidentId?: ObjectID | undefined;
+      alertId?: ObjectID | undefined;
+    },
   ): Promise<AutonomousBudgetStatus> {
+    this.assertSingleSubject(subject);
+
     const project: Project | null = await ProjectService.findOneById({
       id: projectId,
-      select: { aiDailyAutonomousTokenLimit: true },
+      select: {
+        aiDailyAutonomousTokenLimit: true,
+        incidentAiDailyAutonomousTokenLimit: true,
+        alertAiDailyAutonomousTokenLimit: true,
+      },
       props: { isRoot: true },
     });
 
-    const limitInTokens: number | null =
+    let limitInTokens: number | null =
       project?.aiDailyAutonomousTokenLimit ?? null;
 
+    if (subject?.incidentId) {
+      limitInTokens = project?.incidentAiDailyAutonomousTokenLimit ?? null;
+    } else if (subject?.alertId) {
+      limitInTokens = project?.alertAiDailyAutonomousTokenLimit ?? null;
+    }
+
     if (limitInTokens === null) {
       return { exhausted: false, limitInTokens: null, usedTokensToday: 0 };
     }
@@ -374,6 +421,10 @@ export class Service extends BaseService {
           "UTC",
         ),
         features: AUTONOMOUS_AI_FEATURES,
+        incidentId: subject?.incidentId,
+        alertId: subject?.alertId,
+        legacyIncidentFeatures: LEGACY_INCIDENT_LANE_FEATURES,
+        legacyAlertFeatures: LEGACY_ALERT_LANE_FEATURES,
       },
     );
 
@@ -388,6 +439,8 @@ export class Service extends BaseService {
   public async executeWithLogging(
     request: AILogRequest,
   ): Promise<AILogResponse> {
+    this.assertSingleSubject(request);
+
     const startTime: Date = new Date();
 
     // Get LLM provider for the project (honoring an explicit per-chat choice).
@@ -503,10 +556,18 @@ export class Service extends BaseService {
      */
     if (AUTONOMOUS_AI_FEATURES.includes(request.feature)) {
       const budget: AutonomousBudgetStatus =
-        await this.getAutonomousDailyBudgetStatus(request.projectId);
+        await this.getAutonomousDailyBudgetStatus(request.projectId, {
+          incidentId: request.incidentId,
+          alertId: request.alertId,
+        });
 
       if (budget.exhausted) {
-        const budgetMessage: string = `Daily autonomous AI token budget exhausted (${budget.usedTokensToday.toLocaleString()} of ${budget.limitInTokens?.toLocaleString()} tokens used today). Autonomous AI requests resume tomorrow (UTC) — raise or unset the limit in the AI settings pages.`;
+        const settingsLocation: string = request.incidentId
+          ? "Incidents > Settings > AI"
+          : request.alertId
+            ? "Alerts > Settings > AI"
+            : "Project Settings > AI > AI Guardrails";
+        const budgetMessage: string = `Daily autonomous AI token budget exhausted (${budget.usedTokensToday.toLocaleString()} of ${budget.limitInTokens?.toLocaleString()} tokens used today). Autonomous AI requests resume tomorrow (UTC) — raise or unset the limit under ${settingsLocation}.`;
 
         logEntry.status = LlmLogStatus.BudgetExceeded;
         logEntry.statusMessage = budgetMessage.substring(0, 490);
@@ -658,6 +719,17 @@ export class Service extends BaseService {
     }
   }
 
+  private assertSingleSubject(subject?: {
+    incidentId?: ObjectID | undefined;
+    alertId?: ObjectID | undefined;
+  }): void {
+    if (subject?.incidentId && subject.alertId) {
+      throw new BadDataException(
+        "An AI request cannot belong to both an incident and an alert.",
+      );
+    }
+  }
+
   /*
    * Set gen_ai.* attributes (OpenTelemetry GenAI semantic conventions) on the
    * currently-active span. The @CaptureSpan()-wrapped caller owns that span, so

package/Server/Services/AlertFeedService.ts

@@ -84,6 +84,7 @@ export class Service extends DatabaseService<Model> {
     displayColor?: Color | undefined;
     userId?: ObjectID | undefined;
     postedAt?: Date | undefined;
+    aiRunId?: ObjectID | undefined;
     workspaceNotification?:
       | {
           notifyUserId?: ObjectID | undefined; // this is oneuptime user id.
@@ -126,6 +127,10 @@ export class Service extends DatabaseService<Model> {
       alertFeed.alertFeedEventType = data.alertFeedEventType;
       alertFeed.projectId = data.projectId;
 
+      if (data.aiRunId) {
+        alertFeed.aiRunId = data.aiRunId;
+      }
+
       if (!data.postedAt) {
         alertFeed.postedAt = OneUptimeDate.getCurrentDate();
       }

package/Server/Services/AnalyticsDatabaseService.ts

@@ -34,6 +34,7 @@ import {
   TimeoutOverflowMode,
 } from "../Utils/AnalyticsDatabase/QuerySettingsHelper";
 import {
+  getDistributedDdlTaskTimeoutSeconds,
   getStorageTableName,
   onClusterClause,
 } from "../Utils/AnalyticsDatabase/ClusterConfig";
@@ -137,6 +138,34 @@ export const MigrationExecuteOptions: ClickhouseExecuteOptions = {
      * migration pool's 30-minute idle ceiling.
      */
     http_headers_progress_interval_ms: "10000",
+    /*
+     * ON CLUSTER DDL is queued in Keeper and executed by each host's DDLWorker
+     * sequentially, so on a busy or backlogged cluster a host can be healthy
+     * yet not reach the task within the wait window. The server default output
+     * mode (`throw`) turns that into TIMEOUT_EXCEEDED (code 159) and aborts
+     * the whole migrate run — even though the task stays queued and the hosts
+     * execute it in the background (until the DDL queue evicts it:
+     * task_max_lifetime, one week, or falling more than max_tasks_in_queue
+     * entries behind). `null_status_on_timeout` returns NULL for the hosts
+     * that haven't finished yet instead of throwing, while a real DDL failure
+     * on any host that did run it within the window still throws. Safe because
+     * every schema statement here is idempotent (IF NOT EXISTS / OR REPLACE)
+     * and, with the default `distributed_ddl.pool_size = 1`, later DDL queues
+     * strictly behind earlier DDL on each host. Migrate.ts additionally warns
+     * at end of run when the DDL queue still has unfinished tasks. Note these
+     * options are also reused by runtime ALTER ... DELETE mutations (session
+     * erasure / pin materialization); timeout-as-success is acceptable there
+     * too since a mutation is durable once enqueued. Requires ClickHouse >=
+     * 21.4 (older servers reject the setting as unknown).
+     */
+    distributed_ddl_output_mode: "null_status_on_timeout",
+    /*
+     * Int64 settings are typed as strings by @clickhouse/client. Read at
+     * module load; env is static for the life of the process. The migration
+     * pool's socket-idle ceiling scales with this value (ClickhouseConfig.ts)
+     * so a raised wait isn't killed client-side.
+     */
+    distributed_ddl_task_timeout: String(getDistributedDdlTaskTimeoutSeconds()),
   },
 };
 

package/Server/Services/DatabaseService.ts

@@ -334,7 +334,8 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
    * generated — session refresh tokens and the like. They keep the fast
    * SHA-256 hash, which is the right tool for them: there is nothing to guess,
    * and they have to stay searchable by hash because that is how they are
-   * looked up.
+   * looked up. Every human-chosen credential, including dashboard and status
+   * page master passwords, declares a salt column and takes the scrypt path.
    *
    * The salt is written onto the SAME payload as the hash, so the pair can
    * never be persisted out of step with each other.
@@ -468,6 +469,10 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
             }),
             [saltColumnName]: newSalt,
           } as unknown as PartialEntity<TBaseModel>,
+          expectedData: {
+            [data.columnName]: storedHash,
+            [saltColumnName]: salt,
+          } as unknown as PartialEntity<TBaseModel>,
           skipUpdateDateColumn: true,
         });
       } catch (err) {
@@ -2502,6 +2507,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
   public async updateColumnsByIdWithoutHooks(input: {
     id: ObjectID;
     data: PartialEntity<TBaseModel>;
+    /*
+     * Optional compare-and-set guard. Every supplied property is added to
+     * the WHERE clause with null-safe equality, so the update is skipped if
+     * another writer changed the row after the caller read it. Password-hash
+     * upgrades use this to avoid overwriting a concurrently changed
+     * credential with a re-hash of the old password.
+     */
+    expectedData?: PartialEntity<TBaseModel>;
     /*
      * Leave `updatedAt` untouched. For passive bookkeeping writes (liveness
      * timestamps, ingest health markers) where consumers key change
@@ -2576,9 +2589,37 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       metadata.primaryColumns[0]?.databaseName || "_id";
     params.push(input.id.toString());
 
+    const whereClauses: Array<string> = [
+      `"${primaryColumnName}" = $${params.length}`,
+    ];
+
+    for (const [propertyName, value] of Object.entries(
+      (input.expectedData || {}) as ObjectLiteral,
+    )) {
+      const column: ColumnMetadata | undefined =
+        metadata.findColumnWithPropertyName(propertyName);
+
+      if (!column) {
+        throw new BadDataException(
+          `updateColumnsByIdWithoutHooks: unknown expected column "${propertyName}" on "${metadata.tableName}"`,
+        );
+      }
+
+      if (typeof value === "function") {
+        throw new BadDataException(
+          `updateColumnsByIdWithoutHooks: SQL-expression expected values are not supported (column "${propertyName}"); pass a literal value.`,
+        );
+      }
+
+      params.push(driver.preparePersistentValue(value, column));
+      whereClauses.push(
+        `"${column.databaseName}" IS NOT DISTINCT FROM $${params.length}`,
+      );
+    }
+
     const sql: string = `UPDATE "${metadata.tableName}" SET ${setClauses.join(
       ", ",
-    )} WHERE "${primaryColumnName}" = $${params.length}`;
+    )} WHERE ${whereClauses.join(" AND ")}`;
 
     await repository.manager.query(sql, params);
   }

package/Server/Services/IncidentFeedService.ts

@@ -84,6 +84,7 @@ export class Service extends DatabaseService<IncidentFeed> {
     displayColor?: Color | undefined;
     userId?: ObjectID | undefined;
     postedAt?: Date | undefined;
+    aiRunId?: ObjectID | undefined;
     // send notifificatin to slack and teams. This is optional
     workspaceNotification?:
       | {
@@ -131,6 +132,10 @@ export class Service extends DatabaseService<IncidentFeed> {
       incidentFeed.incidentFeedEventType = data.incidentFeedEventType;
       incidentFeed.projectId = data.projectId;
 
+      if (data.aiRunId) {
+        incidentFeed.aiRunId = data.aiRunId;
+      }
+
       if (!data.postedAt) {
         incidentFeed.postedAt = OneUptimeDate.getCurrentDate();
       }

package/Server/Services/LlmLogService.ts

@@ -2,6 +2,7 @@ import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/LlmLog";
 import { IsBillingEnabled } from "../EnvironmentConfig";
 import ObjectID from "../../Types/ObjectID";
+import BadDataException from "../../Types/Exception/BadDataException";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
 export class Service extends DatabaseService<Model> {
@@ -22,15 +23,58 @@ export class Service extends DatabaseService<Model> {
     projectId: ObjectID;
     since: Date;
     features: Array<string>;
+    /*
+     * Subject ids select a lane, not one particular subject: passing an
+     * incident id counts every incident-associated log for the project, and
+     * passing an alert id counts every alert-associated log. With neither id,
+     * only genuinely subjectless work is counted. The caller already has the
+     * concrete id, so using it as the discriminator keeps this API aligned
+     * with AIService's request shape without introducing a second subject enum.
+     */
+    incidentId?: ObjectID | undefined;
+    alertId?: ObjectID | undefined;
+    /*
+     * Feature-only fallbacks for rows written before subject identity was
+     * propagated. Shared features are recovered through aiRunId below.
+     */
+    legacyIncidentFeatures?: Array<string> | undefined;
+    legacyAlertFeatures?: Array<string> | undefined;
   }): Promise<number> {
+    if (data.incidentId && data.alertId) {
+      throw new BadDataException(
+        "An LLM usage query cannot select both the incident and alert lanes.",
+      );
+    }
+
     if (data.features.length === 0) {
       return 0;
     }
 
+    const legacyIncidentFeatures: Array<string> =
+      data.legacyIncidentFeatures || [];
+    const legacyAlertFeatures: Array<string> = data.legacyAlertFeatures || [];
+
+    const incidentRunMembership: string = `EXISTS (SELECT 1 FROM "AIRun" AS "run" WHERE "run"."_id" = "log"."aiRunId" AND "run"."triggeredByIncidentId" IS NOT NULL AND "run"."triggeredByAlertId" IS NULL)`;
+    const alertRunMembership: string = `EXISTS (SELECT 1 FROM "AIRun" AS "run" WHERE "run"."_id" = "log"."aiRunId" AND "run"."triggeredByIncidentId" IS NULL AND "run"."triggeredByAlertId" IS NOT NULL)`;
+
+    let subjectClause: string = `AND "log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND NOT ("log"."feature" = ANY($4)) AND NOT ("log"."feature" = ANY($5)) AND NOT (${incidentRunMembership}) AND NOT (${alertRunMembership})`;
+
+    if (data.incidentId) {
+      subjectClause = `AND (("log"."incidentId" IS NOT NULL AND "log"."alertId" IS NULL) OR ("log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND (("log"."feature" = ANY($4)) OR ${incidentRunMembership})))`;
+    } else if (data.alertId) {
+      subjectClause = `AND (("log"."incidentId" IS NULL AND "log"."alertId" IS NOT NULL) OR ("log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND (("log"."feature" = ANY($5)) OR ${alertRunMembership})))`;
+    }
+
     const rows: Array<{ total: string | number | null }> =
       await this.getRepository().manager.query(
-        `SELECT COALESCE(SUM("totalTokens"), 0) AS "total" FROM "LlmLog" WHERE "projectId" = $1 AND "createdAt" >= $2 AND "feature" = ANY($3) AND "deletedAt" IS NULL`,
-        [data.projectId.toString(), data.since, data.features],
+        `SELECT COALESCE(SUM("log"."totalTokens"), 0) AS "total" FROM "LlmLog" AS "log" WHERE "log"."projectId" = $1 AND "log"."createdAt" >= $2 AND "log"."feature" = ANY($3) ${subjectClause} AND "log"."deletedAt" IS NULL`,
+        [
+          data.projectId.toString(),
+          data.since,
+          data.features,
+          legacyIncidentFeatures,
+          legacyAlertFeatures,
+        ],
       );
 
     return Number(rows[0]?.total || 0);

package/Server/Utils/AI/Chat/ObservabilityAssistant.ts

@@ -59,6 +59,9 @@ export interface ObservabilityAssistantStep {
 export interface ObservabilityAssistantRequest {
   projectId: ObjectID;
   userId?: ObjectID | undefined;
+  incidentId?: ObjectID | undefined;
+  alertId?: ObjectID | undefined;
+  aiRunId?: ObjectID | undefined;
   // The requesting user's real permission props — tools run under these.
   props: DatabaseCommonInteractionProps;
   question: string;
@@ -230,6 +233,9 @@ export default class ObservabilityAssistant {
       const response: AILogResponse = await AIService.executeWithLogging({
         projectId: request.projectId,
         userId: request.userId,
+        incidentId: request.incidentId,
+        alertId: request.alertId,
+        aiRunId: request.aiRunId,
         llmProviderId: request.llmProviderId,
         feature: request.feature,
         messages: messages,

package/Server/Utils/AI/CodeFix/CodeFixAgentCompletion.ts

@@ -130,6 +130,8 @@ export default class CodeFixAgentCompletion {
         runType: true,
         status: true,
         aiAgentId: true,
+        triggeredByIncidentId: true,
+        triggeredByAlertId: true,
       },
       props: {
         isRoot: true,
@@ -198,6 +200,8 @@ export default class CodeFixAgentCompletion {
       projectId: run.projectId,
       feature: AI_CODE_FIX_FEATURE,
       aiRunId: request.aiRunId,
+      incidentId: run.triggeredByIncidentId,
+      alertId: run.triggeredByAlertId,
       llmProviderId: llmProvider.id,
       messages: request.messages,
       tools: request.tools,

package/Server/Utils/AI/CodeFix/CodeFixReadiness.ts

@@ -102,9 +102,12 @@ export default class CodeFixReadiness {
      * self-hosted too, where a project-owned provider makes the balance gate
      * moot and this becomes the ONLY thing that can kill a run.
      *
-     * A limit of 0 is a documented kill-switch ("pause AI entirely"), i.e.
-     * durable config — so without this a paused project would read "ready"
-     * forever while every run died at its first completion call.
+     * These readiness surfaces create subjectless exception/general tasks, so
+     * they use the "Other AI Workload" token lane. Incident/alert fix paths
+     * enforce their own lane when they are triggered and on every completion.
+     * A limit of 0 is a documented kill-switch for this lane, so without this
+     * a paused project would read "ready" forever while every subjectless run
+     * died at its first completion call.
      */
     const budget: AutonomousBudgetStatus =
       await AIService.getAutonomousDailyBudgetStatus(params.projectId);
@@ -116,8 +119,8 @@ export default class CodeFixReadiness {
         title: "LLM provider",
         detail:
           budget.limitInTokens !== null && budget.limitInTokens <= 0
-            ? "AI is paused for this project: the daily autonomous AI token limit is set to 0. Raise or unset it in the AI settings pages to let fix tasks run."
-            : `The daily autonomous AI token budget is exhausted (${budget.usedTokensToday.toLocaleString()} of ${budget.limitInTokens?.toLocaleString()} tokens used today). Fix tasks resume tomorrow (UTC) — raise or unset the limit in the AI settings pages.`,
+            ? "Other autonomous AI work is paused for this project: the daily background AI token limit is set to 0. Raise or unset it under Project Settings > AI > AI Guardrails to let subjectless fix tasks run."
+            : `The daily background AI token budget is exhausted (${budget.usedTokensToday.toLocaleString()} of ${budget.limitInTokens?.toLocaleString()} tokens used today). Subjectless fix tasks resume tomorrow (UTC) — raise or unset the limit under Project Settings > AI > AI Guardrails.`,
       };
     }
 

package/Server/Utils/AI/CodeFix/FixRunBudget.ts

@@ -11,13 +11,10 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
 /*
  * Per-project daily fix-run budget (Preventive-lane X guardrail, G11).
  *
- * Every CodeFix AIRun — regardless of recipe or trigger — counts against
- * one per-project daily cap: `Project.aiDailyFixTaskLimit` fix runs per UTC
- * day (null/unset = the default below, 0 = fix tasks paused — the same
- * semantics as `aiDailyAutonomousTokenLimit`). The cap bounds the blast
- * radius of ANY runaway trigger: a click-happy user, a buggy automation, or
- * a future auto-created-fix fan-out can never open more than the budget's
- * worth of agent runs (and therefore PRs) in a day.
+ * Every CodeFix AIRun counts against the daily cap for its lane: incident,
+ * alert, or subjectless. Incident and alert runs use their independent
+ * settings; recipes with neither subject retain `Project.aiDailyFixTaskLimit`
+ * as a fallback. Null/unset means the default below and 0 pauses that lane.
  *
  * Enforced centrally at BOTH creation paths:
  *   - TelemetryExceptionService.createCodeFixRunForException (the
@@ -43,6 +40,13 @@ export interface FixRunBudgetDecision {
   runsToday: number;
 }
 
+export interface FixRunBudgetSubject {
+  incidentId?: ObjectID | undefined;
+  alertId?: ObjectID | undefined;
+}
+
+type FixRunBudgetLane = "incident" | "alert" | "other";
+
 export default class FixRunBudget {
   /*
    * The pure budget decision, separated from IO so it can be tested
@@ -85,14 +89,27 @@ export default class FixRunBudget {
   @CaptureSpan()
   public static async getBudgetStatus(
     projectId: ObjectID,
+    subject?: FixRunBudgetSubject | undefined,
   ): Promise<FixRunBudgetDecision> {
+    const lane: FixRunBudgetLane = this.getLane(subject);
+
     const project: Project | null = await ProjectService.findOneById({
       id: projectId,
-      select: { aiDailyFixTaskLimit: true },
+      select:
+        lane === "incident"
+          ? { incidentAiDailyFixTaskLimit: true }
+          : lane === "alert"
+            ? { alertAiDailyFixTaskLimit: true }
+            : { aiDailyFixTaskLimit: true },
       props: { isRoot: true },
     });
 
-    const configuredLimit: number | null = project?.aiDailyFixTaskLimit ?? null;
+    const configuredLimit: number | null =
+      lane === "incident"
+        ? project?.incidentAiDailyFixTaskLimit ?? null
+        : lane === "alert"
+          ? project?.alertAiDailyFixTaskLimit ?? null
+          : project?.aiDailyFixTaskLimit ?? null;
 
     // Paused short-circuits the count query (mirrors the token budget).
     const pausedCheck: FixRunBudgetDecision = this.evaluate({
@@ -109,6 +126,20 @@ export default class FixRunBudget {
         query: {
           projectId,
           runType: AIRunType.CodeFix,
+          ...(lane === "incident"
+            ? {
+                triggeredByIncidentId: QueryHelper.notNull(),
+                triggeredByAlertId: QueryHelper.isNull(),
+              }
+            : lane === "alert"
+              ? {
+                  triggeredByIncidentId: QueryHelper.isNull(),
+                  triggeredByAlertId: QueryHelper.notNull(),
+                }
+              : {
+                  triggeredByIncidentId: QueryHelper.isNull(),
+                  triggeredByAlertId: QueryHelper.isNull(),
+                }),
           createdAt: QueryHelper.greaterThanEqualTo(
             OneUptimeDate.getStartOfDay(OneUptimeDate.getCurrentDate(), "UTC"),
           ),
@@ -120,13 +151,51 @@ export default class FixRunBudget {
     return this.evaluate({ configuredLimit, runsToday });
   }
 
+  private static getLane(
+    subject?: FixRunBudgetSubject | undefined,
+  ): FixRunBudgetLane {
+    if (subject?.incidentId && subject.alertId) {
+      throw new BadDataException(
+        "A fix task cannot belong to both an incident and an alert.",
+      );
+    }
+
+    if (subject?.incidentId) {
+      return "incident";
+    }
+
+    if (subject?.alertId) {
+      return "alert";
+    }
+
+    return "other";
+  }
+
   // Human-readable rejection naming the cap and the setting that controls it.
-  public static describeRejection(decision: FixRunBudgetDecision): string {
+  public static describeRejection(
+    decision: FixRunBudgetDecision,
+    subject?: FixRunBudgetSubject | undefined,
+  ): string {
+    const lane: FixRunBudgetLane = this.getLane(subject);
+    const settingTitle: string =
+      lane === "incident"
+        ? "Daily Incident AI Fix Task Limit"
+        : lane === "alert"
+          ? "Daily Alert AI Fix Task Limit"
+          : "Daily Other AI Fix Task Limit";
+    const settingsLocation: string =
+      lane === "incident"
+        ? "Incidents > Settings > AI"
+        : lane === "alert"
+          ? "Alerts > Settings > AI"
+          : "Project Settings > AI > AI Guardrails";
+    const laneLabel: string = lane === "other" ? "other AI" : `${lane} AI`;
+
     if (decision.paused) {
-      return `AI fix tasks are paused for this project — the "Daily AI Fix Task Limit" is set to 0. Raise or unset the limit in the AI settings pages (Settings > Incidents/Alerts > AI) to resume.`;
+      return `${laneLabel} fix tasks are paused for this project — the "${settingTitle}" is set to 0. Raise or unset it under ${settingsLocation} to resume.`;
     }
 
-    return `The project's daily AI fix task limit has been reached (${decision.runsToday} of ${decision.limit} fix tasks created today, UTC). New fix tasks can be created tomorrow — or raise the "Daily AI Fix Task Limit" in the AI settings pages (unset means the default of ${DEFAULT_DAILY_FIX_RUN_LIMIT}/day).`;
+    return `The project's ${laneLabel} fix task limit has been reached (${decision.runsToday} of ${decision.limit} fix tasks created today, UTC). New fix tasks can be created tomorrow — or raise the "${settingTitle}" under ${settingsLocation} (unset means the default of ${DEFAULT_DAILY_FIX_RUN_LIMIT}/day).`;
   }
 
   /*
@@ -135,14 +204,19 @@ export default class FixRunBudget {
    * a CodeFix AIRun row is written.
    */
   @CaptureSpan()
-  public static async assertWithinBudget(projectId: ObjectID): Promise<void> {
-    const decision: FixRunBudgetDecision =
-      await this.getBudgetStatus(projectId);
+  public static async assertWithinBudget(
+    projectId: ObjectID,
+    subject?: FixRunBudgetSubject | undefined,
+  ): Promise<void> {
+    const decision: FixRunBudgetDecision = await this.getBudgetStatus(
+      projectId,
+      subject,
+    );
 
     if (decision.allowed) {
       return;
     }
 
-    throw new BadDataException(this.describeRejection(decision));
+    throw new BadDataException(this.describeRejection(decision, subject));
   }
 }

package/Server/Utils/AI/Remediation/RemediationExecutionRunner.ts

@@ -321,6 +321,8 @@ export default class RemediationExecutionRunner {
       attemptCount,
       request: {
         feature: AI_REMEDIATION_EXECUTION_FEATURE,
+        incidentId: suggestion!.incidentId,
+        alertId: suggestion!.alertId,
         contextSummary,
         personaOverride:
           resolvedMode === "FullAuto" ? FULLAUTO_PERSONA : SUGGEST_PERSONA,