@oneuptime/common 12.0.5 → 12.0.7

package/Server/Types/Workflow/Components/BaseModel/UpdateOneBaseModel.ts

@@ -12,6 +12,8 @@ import ComponentMetadata, {
 } from "../../../../../Types/Workflow/Component";
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
+import { applyTenantColumn, normalizeModelKeys } from "./ModelArguments";
+import logComponentError from "./LogComponentError";
 
 export default class UpdateOneBaseModel<
   TBaseModel extends BaseModel,
@@ -90,11 +92,14 @@ export default class UpdateOneBaseModel<
         );
       }
 
-      if (this.modelService.getModel().getTenantColumn()) {
-        (args["data"] as JSONObject)[
-          this.modelService.getModel().getTenantColumn() as string
-        ] = options.projectId;
-      }
+      args["data"] = applyTenantColumn(
+        normalizeModelKeys(
+          args["data"] as JSONObject,
+          this.modelService.getModel(),
+        ),
+        this.modelService.getModel(),
+        options.projectId,
+      );
 
       if (!args["query"]) {
         throw options.onError(new BadDataException("Query is undefined."));
@@ -110,22 +115,26 @@ export default class UpdateOneBaseModel<
         );
       }
 
+      const query: Query<TBaseModel> = JSONFunctions.deserialize(
+        normalizeModelKeys(
+          args["query"] as JSONObject,
+          this.modelService.getModel(),
+        ),
+      ) as Query<TBaseModel>;
+
+      /*
+       * The tenant column goes on the deserialized query, not on args["query"]
+       * - JSONFunctions.deserialize returns a new object, so anything written
+       * to args after it runs never reaches the database.
+       */
       if (this.modelService.getModel().getTenantColumn()) {
-        (args["query"] as JSONObject)[
+        (query as JSONObject)[
           this.modelService.getModel().getTenantColumn() as string
         ] = options.projectId;
       }
 
-      let query: Query<TBaseModel> = args["query"] as Query<TBaseModel>;
-
-      if (query) {
-        query = JSONFunctions.deserialize(
-          args["query"] as JSONObject,
-        ) as Query<TBaseModel>;
-      }
-
-      await this.modelService.updateOneBy({
-        query: query || {},
+      const itemsUpdated: number = await this.modelService.updateOneBy({
+        query: query,
         data: args["data"] as QueryDeepPartialEntity<TBaseModel>,
         props: {
           isRoot: true,
@@ -133,13 +142,30 @@ export default class UpdateOneBaseModel<
         },
       });
 
+      /*
+       * A query that matches nothing is not an error, but reporting it as a
+       * bare success left builders with no way to tell "updated" from "found
+       * nothing to update".
+       */
+      options.log(
+        `Updated ${itemsUpdated} ${
+          this.modelService.getModel().singularName || "record"
+        }(s).`,
+      );
+
       return {
-        returnValues: {},
+        returnValues: {
+          "items-updated": itemsUpdated,
+        },
         executePort: successPort,
       };
     } catch (err: any) {
-      options.log("Error running component");
-      options.log(err.message ? err.message : JSON.stringify(err, null, 2));
+      logComponentError({
+        error: err,
+        model: this.modelService?.getModel() || null,
+        log: options.log,
+      });
+
       return {
         returnValues: {},
         executePort: errorPort,

package/Server/Types/Workflow/Components/Discord/SendMessageToChannel.ts

@@ -1,4 +1,7 @@
 import ComponentCode, { RunOptions, RunReturnType } from "../../ComponentCode";
+import IncomingWebhookUtils, {
+  DISCORD_WEBHOOK_DOMAINS,
+} from "../IncomingWebhookUtils";
 import HTTPErrorResponse from "../../../../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../../../../Types/API/HTTPResponse";
 import URL from "../../../../../Types/API/URL";
@@ -59,15 +62,12 @@ export default class SendMessageToChannel extends ComponentCode {
       throw options.onError(new BadDataException("Discord message not found"));
     }
 
-    if (!args["webhook-url"]) {
-      throw options.onError(
-        new BadDataException("Discord Webhook URL not found"),
-      );
-    }
-
-    args["webhook-url"] = URL.fromString(
-      args["webhook-url"]?.toString() as string,
-    );
+    args["webhook-url"] = IncomingWebhookUtils.getPinnedWebhookUrl({
+      args,
+      options,
+      allowedDomains: DISCORD_WEBHOOK_DOMAINS,
+      vendorName: "Discord",
+    });
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -78,6 +78,13 @@ export default class SendMessageToChannel extends ComponentCode {
         data: {
           content: args["text"] as string,
         },
+        /*
+         * The host is pinned above; following a redirect would hand the
+         * destination back to whoever controls that host.
+         */
+        options: {
+          doNotFollowRedirects: true,
+        },
       });
 
       if (apiResult instanceof HTTPErrorResponse) {

package/Server/Types/Workflow/Components/IncomingWebhookUtils.ts

@@ -0,0 +1,66 @@
+import { RunOptions } from "../ComponentCode";
+import URL from "../../../../Types/API/URL";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../../Types/JSON";
+import SSRFProtection from "../../../Utils/SSRFProtection";
+
+/*
+ * The Slack / Discord / Microsoft Teams workflow components each take a
+ * free-text "webhook-url" argument off the workflow graph, which any project
+ * member can author and which can additionally be templated from trigger data.
+ * They then POST to it from the API server - the same SSRF primitive that
+ * GHSA-v5xh-rw9h-77fv reported against the API components.
+ *
+ * These are chat webhooks, so unlike the generic API components there is a
+ * vendor host to pin to, and a pin is strictly better than a blocklist: it
+ * cannot be walked around with DNS rebinding, an alternate IP notation, or a
+ * redirect. Nothing legitimate is lost - a self-hosted OneUptime still posts to
+ * hooks.slack.com like everyone else.
+ */
+
+export const DISCORD_WEBHOOK_DOMAINS: Array<string> = [
+  "discord.com",
+  "discordapp.com",
+];
+
+export class IncomingWebhookUtils {
+  /*
+   * Reads the component's "webhook-url" argument, requires it to be on one of
+   * `allowedDomains`, and returns it parsed. Throws through options.onError so
+   * the workflow stops with a message the author can act on.
+   *
+   * Validates the RAW string: URL.fromString defaults an unrecognized scheme to
+   * https, so converting first would let "gopher://..." arrive looking clean.
+   */
+  public static getPinnedWebhookUrl(data: {
+    args: JSONObject;
+    options: RunOptions;
+    allowedDomains: Array<string>;
+    vendorName: string;
+  }): URL {
+    const rawUrl: unknown = data.args["webhook-url"];
+
+    if (!rawUrl) {
+      throw data.options.onError(
+        new BadDataException(`${data.vendorName} Webhook URL not found`),
+      );
+    }
+
+    if (
+      !SSRFProtection.isUrlOnAllowedDomain(
+        rawUrl.toString(),
+        data.allowedDomains,
+      )
+    ) {
+      throw data.options.onError(
+        new BadDataException(
+          `${data.vendorName} Webhook URL must be an https URL on ${data.allowedDomains.join(" or ")}.`,
+        ),
+      );
+    }
+
+    return URL.fromString(rawUrl.toString());
+  }
+}
+
+export default IncomingWebhookUtils;

package/Server/Types/Workflow/Components/MicrosoftTeams/SendMessageToChannel.ts

@@ -1,4 +1,6 @@
 import ComponentCode, { RunOptions, RunReturnType } from "../../ComponentCode";
+import IncomingWebhookUtils from "../IncomingWebhookUtils";
+import { MICROSOFT_TEAMS_WEBHOOK_DOMAINS } from "../../../../Utils/Workspace/MicrosoftTeams/MicrosoftTeams";
 import HTTPErrorResponse from "../../../../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../../../../Types/API/HTTPResponse";
 import URL from "../../../../../Types/API/URL";
@@ -60,15 +62,12 @@ export default class SendMessageToChannel extends ComponentCode {
       );
     }
 
-    if (!args["webhook-url"]) {
-      throw options.onError(
-        new BadDataException("Microsoft teams Webhook URL not found"),
-      );
-    }
-
-    args["webhook-url"] = URL.fromString(
-      args["webhook-url"]?.toString() as string,
-    );
+    args["webhook-url"] = IncomingWebhookUtils.getPinnedWebhookUrl({
+      args,
+      options,
+      allowedDomains: MICROSOFT_TEAMS_WEBHOOK_DOMAINS,
+      vendorName: "Microsoft Teams",
+    });
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -100,6 +99,13 @@ export default class SendMessageToChannel extends ComponentCode {
             },
           ],
         },
+        /*
+         * The host is pinned above; following a redirect would hand the
+         * destination back to whoever controls that host.
+         */
+        options: {
+          doNotFollowRedirects: true,
+        },
       });
 
       if (apiResult instanceof HTTPErrorResponse) {

package/Server/Types/Workflow/Components/Slack/SendMessageToChannel.ts

@@ -65,6 +65,23 @@ export default class SendMessageToChannel extends ComponentCode {
       );
     }
 
+    /*
+     * Pin the target to Slack's own incoming-webhook endpoint. Without this the
+     * component POSTs from the API server to any URL a workflow author types -
+     * the SSRF reported as GHSA-v5xh-rw9h-77fv against the API components.
+     */
+    if (
+      !SlackUtil.isValidSlackIncomingWebhookUrl(
+        args["webhook-url"]?.toString() as string,
+      )
+    ) {
+      throw options.onError(
+        new BadDataException(
+          "Slack Webhook URL must start with https://hooks.slack.com/services/",
+        ),
+      );
+    }
+
     args["webhook-url"] = URL.fromString(
       args["webhook-url"]?.toString() as string,
     );

package/Server/Utils/AI/Chat/ObservabilityChatPrompt.ts

@@ -148,7 +148,7 @@ If the project has connected code repositories you can read their source, which
 
 ## Changing the code
 
-You can propose code changes. open_code_pull_request is the right tool almost always: it opens a DRAFT pull request off the default branch for a human to review. commit_code_to_branch is only for when the user names an existing branch to commit onto.
+You can propose code changes. open_code_pull_request is the right tool almost always: it opens a pull request off the default branch, ready for review, for a human to review and merge. commit_code_to_branch is only for when the user names an existing branch to commit onto.
 
 - ALWAYS read_code_file the exact file first. \`content\` replaces the file's ENTIRE contents, so writing from memory or from a guess destroys code you never read. If you have not read it in this conversation, read it now.
 - Never write to the default branch. The tools refuse it, and so should you — if the user asks you to commit straight to main/master, explain that changes go through a reviewable pull request.

package/Server/Utils/AI/CodeFix/CodeAgentWorkspaceGuard.ts

@@ -13,6 +13,88 @@ import path from "path";
 // Max characters a single tool result may feed back into the model.
 export const MAX_TOOL_OUTPUT_CHARS: number = 20_000;
 
+/*
+ * Max characters a single write_file may put on disk. A model that loops on
+ * a generation bug can otherwise fill the Runner's disk from inside a tool
+ * call, taking down every other capability on the host — and no legitimate
+ * source file a fix needs to write is anywhere near this size.
+ */
+export const MAX_WRITE_FILE_CHARS: number = 2_000_000;
+
+/*
+ * Git subcommands the code agent may not run.
+ *
+ * The pipeline owns the repository's git state: it cuts the branch, decides
+ * what to stage, writes the commit and pushes. It also computes "what did
+ * the agent change" from the working tree. A model that helpfully commits
+ * its own work, resets the tree, switches branches or pushes therefore does
+ * not just duplicate the pipeline — it destroys the pipeline's ability to
+ * see the change at all (a committed tree is a clean tree, so the run
+ * reports "no changes" and the fix is silently discarded), or it puts a
+ * branch on the customer's remote that no pull request points at.
+ *
+ * The system prompt already asks the model not to. This is the enforcement,
+ * because an instruction is not a control.
+ *
+ * Honest about what this is: a guard against a well-meaning model taking an
+ * obvious wrong turn, NOT a sandbox. Shell is too expressive to filter
+ * adversarially — the real containment boundary is that the workspace is
+ * ephemeral, the credential is never in it, and nothing merges without a
+ * human. Read-only git (log, diff, status, show, grep, blame) stays
+ * available because the agent genuinely needs it.
+ */
+const REFUSED_GIT_SUBCOMMANDS: Set<string> = new Set<string>([
+  "push",
+  "commit",
+  "reset",
+  "checkout",
+  "switch",
+  "restore",
+  "stash",
+  "clean",
+  "rebase",
+  "merge",
+  "cherry-pick",
+  "revert",
+  "am",
+  "apply",
+  "filter-branch",
+  "update-ref",
+  "remote",
+  "config",
+  "credential",
+  "gc",
+  "prune",
+]);
+
+/*
+ * Shell operators that start a new command. Splitting on these is what lets
+ * the guard see the `git push` in `npm test && git push`.
+ */
+const COMMAND_SEPARATORS: RegExp = /(?:&&|\|\||[;\n|&()`]|\$\()/;
+
+// A leading `VAR=value` assignment, which belongs to the command not to argv.
+const LEADING_ENV_ASSIGNMENT: RegExp = /^[A-Za-z_][A-Za-z0-9_]*=/;
+
+/*
+ * Options that take a separate value argument, so the subcommand is the
+ * token after next rather than the next token (`git -C sub push`).
+ */
+const GIT_OPTIONS_WITH_VALUE: Set<string> = new Set<string>([
+  "-C",
+  "-c",
+  "--git-dir",
+  "--work-tree",
+  "--namespace",
+  "--exec-path",
+]);
+
+export interface CommandGuardDecision {
+  allowed: boolean;
+  // Set when not allowed — the message handed back to the model.
+  reason: string | null;
+}
+
 export default class CodeAgentWorkspaceGuard {
   /*
    * Resolve a model-supplied path against the workspace root, refusing any
@@ -54,6 +136,95 @@ export default class CodeAgentWorkspaceGuard {
     return relative === "" ? "." : relative;
   }
 
+  /*
+   * Decide whether the agent may run a shell command.
+   *
+   * Only repository-state-mutating git is refused; everything else is
+   * allowed, because building and testing is the whole point of the tool.
+   * The refusal text names the reason so the model corrects course instead
+   * of retrying the same command.
+   */
+  public static evaluateCommand(command: string): CommandGuardDecision {
+    for (const segment of command.split(COMMAND_SEPARATORS)) {
+      const subcommand: string | null = this.gitSubcommandOf(segment);
+
+      if (subcommand && REFUSED_GIT_SUBCOMMANDS.has(subcommand)) {
+        return {
+          allowed: false,
+          reason:
+            `Refused: \`git ${subcommand}\` is not available to you. The surrounding ` +
+            `pipeline owns this repository's git state — it created the branch, and it ` +
+            `stages, commits and pushes your changes once you are done. Running git ` +
+            `yourself would hide your work from it. Edit files with write_file and ` +
+            `leave git alone; read-only git (status, diff, log, show, grep) is allowed.`,
+        };
+      }
+    }
+
+    return { allowed: true, reason: null };
+  }
+
+  /*
+   * The git subcommand a single shell segment invokes, or null when the
+   * segment does not invoke git. Skips leading environment assignments
+   * (`GIT_DIR=x git ...`) and git's own global options, including the ones
+   * that consume a following value.
+   */
+  private static gitSubcommandOf(segment: string): string | null {
+    const tokens: Array<string> = segment
+      .trim()
+      .split(/\s+/)
+      .filter((token: string) => {
+        return token.length > 0;
+      });
+
+    let index: number = 0;
+
+    // Leading VAR=value assignments belong to the command, not to argv.
+    while (
+      index < tokens.length &&
+      LEADING_ENV_ASSIGNMENT.test(tokens[index] as string)
+    ) {
+      index++;
+    }
+
+    const executable: string | undefined = tokens[index];
+
+    if (!executable) {
+      return null;
+    }
+
+    // Match `git`, `/usr/bin/git`, and `"git"` alike.
+    const executableName: string = executable
+      .replace(/^["']|["']$/g, "")
+      .split("/")
+      .pop() as string;
+
+    if (executableName !== "git") {
+      return null;
+    }
+
+    index++;
+
+    while (index < tokens.length) {
+      const token: string = tokens[index] as string;
+
+      if (!token.startsWith("-")) {
+        return token.toLowerCase();
+      }
+
+      // `--git-dir=x` carries its value; `--git-dir x` consumes the next token.
+      if (GIT_OPTIONS_WITH_VALUE.has(token)) {
+        index += 2;
+        continue;
+      }
+
+      index++;
+    }
+
+    return null;
+  }
+
   /*
    * Truncate a tool output to the model-context cap, appending an explicit
    * marker so the model knows the output is partial rather than complete.

package/Server/Utils/AI/CodeFix/FixRunBudget.ts

@@ -185,9 +185,9 @@ export default class FixRunBudget {
           : "Daily Other AI Fix Task Limit";
     const settingsLocation: string =
       lane === "incident"
-        ? "Incidents > Settings > AI"
+        ? "Incidents > AI > Investigation"
         : lane === "alert"
-          ? "Alerts > Settings > AI"
+          ? "Alerts > AI > Investigation"
           : "Project Settings > AI > AI Guardrails";
     const laneLabel: string = lane === "other" ? "other AI" : `${lane} AI`;
 

package/Server/Utils/AI/SRE/AIInvestigationEngine.ts

@@ -17,6 +17,7 @@ import ProjectService from "../../../Services/ProjectService";
 import LlmProviderService from "../../../Services/LlmProviderService";
 import AIInvestigationQueue from "./InvestigationQueue";
 import AIConfidenceSignal, { ConfidenceSignal } from "./ConfidenceSignal";
+import InvestigationTldr from "./InvestigationTldr";
 import ObservabilityAssistant, {
   ObservabilityAssistantExtraTool,
   ObservabilityAssistantResult,
@@ -124,6 +125,13 @@ export interface InvestigationRequest {
    * remain NotRecommended throughout their lifecycle.
    */
   persistCodeFixRecommendation?: boolean | undefined;
+  /*
+   * Incident and alert RCA runs opt into the AI-written TL;DR that the
+   * dashboard panel shows above the report. Display-only and best-effort:
+   * a failed generation leaves the run without one and changes nothing else.
+   * Engine users with no panel (insight triage, remediation) omit it.
+   */
+  persistAnalysisTldr?: boolean | undefined;
   /*
    * Runs only after a Recommended decision and its exact analysis snapshot
    * have been durably committed. Incident/alert runners use this for the
@@ -407,17 +415,62 @@ export default class AIInvestigationEngine {
        * the WON Completed transition also means a falsely-requeued duplicate
        * attempt can never double-spend it.
        */
-      const confidence: ConfidenceSignal =
-        await AIConfidenceSignal.computeConfidenceSignal({
-          projectId,
-          aiRunId,
-          incidentId: request.incidentId,
-          alertId: request.alertId,
-          analysisMarkdown: analysis,
-          evidence: AIConfidenceSignal.evidenceFromCitations(
-            result.citations || [],
-          ),
-        });
+      /*
+       * The display-only TL;DR (see InvestigationTldr) runs CONCURRENTLY with
+       * the classification: both are post-loop calls over the same analysis,
+       * so serializing them would add their latencies to the delay before the
+       * RCA reaches the on-call engineer. Neither call throws — the TL;DR
+       * degrades to null and the report is published regardless.
+       */
+      const [confidence, analysisTldr]: [ConfidenceSignal, string | null] =
+        await Promise.all([
+          AIConfidenceSignal.computeConfidenceSignal({
+            projectId,
+            aiRunId,
+            incidentId: request.incidentId,
+            alertId: request.alertId,
+            analysisMarkdown: analysis,
+            evidence: AIConfidenceSignal.evidenceFromCitations(
+              result.citations || [],
+            ),
+          }),
+          request.persistAnalysisTldr === true
+            ? InvestigationTldr.generateTldr({
+                projectId,
+                aiRunId,
+                incidentId: request.incidentId,
+                alertId: request.alertId,
+                /*
+                 * Summarize the model's own analysis, not the branded form —
+                 * the branding wrapper is boilerplate plus an evidence list,
+                 * and a summary of it would waste the TL;DR on both.
+                 */
+                analysisMarkdown: analysis,
+              }).catch((error: unknown): null => {
+                /*
+                 * generateTldr is total by construction, but it sits in a
+                 * Promise.all inside the main try: a rejection would land in
+                 * the catch below AFTER the Completed transition was won, so
+                 * the run would be failed and the report never posted at all
+                 * — a cosmetic line of text destroying the whole RCA. Belt
+                 * and braces, because the blast radius is that asymmetric.
+                 */
+                logger.error(
+                  `AI: TL;DR generation threw for run ${aiRunId.toString()}; publishing the report without one: ${error}`,
+                );
+                return null;
+              })
+            : Promise.resolve(null),
+        ]);
+
+      /*
+       * Persist the TL;DR BEFORE the report is posted, so the panel can never
+       * render the report for a beat without its summary. Best-effort: a
+       * write failure is logged and the report still posts.
+       */
+      if (analysisTldr) {
+        await this.persistAnalysisTldr({ aiRunId, analysisTldr });
+      }
 
       /*
        * Build the posted form exactly once. The same immutable string is
@@ -579,6 +632,32 @@ export default class AIInvestigationEngine {
     }
   }
 
+  /*
+   * Store the display-only TL;DR on the run. Unlike the code-fix decision
+   * this authorizes nothing, so it is not retried: a failed write (or a run
+   * that is no longer Completed) simply leaves the panel showing the report
+   * with no summary above it.
+   */
+  private static async persistAnalysisTldr(data: {
+    aiRunId: ObjectID;
+    analysisTldr: string;
+  }): Promise<void> {
+    try {
+      const updatedCount: number =
+        await AIRunService.setInvestigationAnalysisTldr(data);
+
+      if (updatedCount === 0) {
+        logger.warn(
+          `AI: could not store the TL;DR for run ${data.aiRunId.toString()} — it was no longer Completed.`,
+        );
+      }
+    } catch (error) {
+      logger.error(
+        `AI: failed to store the TL;DR for run ${data.aiRunId.toString()}: ${error}`,
+      );
+    }
+  }
+
   /*
    * Resolve the recommendation exactly once. Pending is written by the
    * winning Completed CAS, so this conditional update cannot race a stale

package/Server/Utils/AI/SRE/AlertInvestigationRunner.ts

@@ -172,6 +172,7 @@ export default class AIAlertInvestigationRunner {
         alertId,
         contextSummary,
         persistCodeFixRecommendation: true,
+        persistAnalysisTldr: true,
         postAnalysis: async (postData: {
           analysisMarkdown: string;
           confidence: ConfidenceSignal;

package/Server/Utils/AI/SRE/FixFromIncidentTaskTrigger.ts

@@ -39,9 +39,9 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
  * same FixFromIncident task with no human click. Confidence alone is not
  * sufficient: operational and other non-code causes do not open PRs. Like its
  * InstrumentationTaskTrigger sibling it runs only after the Recommended
- * decision and snapshot are durable, and it never throws. The PR still opens as a
- * DRAFT and is always human-reviewed — the opt-in moves the human gate from
- * PR creation to PR review, never past it.
+ * decision and snapshot are durable, and it never throws. The PR opens ready
+ * for review and is always human-reviewed — the opt-in moves the human gate
+ * from PR creation to PR review, never past it.
  */
 
 export interface AutoFixTaskGateInput {

package/Server/Utils/AI/SRE/IncidentInvestigationRunner.ts

@@ -354,6 +354,7 @@ export default class AIIncidentInvestigationRunner {
         incidentId,
         contextSummary,
         persistCodeFixRecommendation: true,
+        persistAnalysisTldr: true,
         postAnalysis: async (postData: {
           analysisMarkdown: string;
           confidence: ConfidenceSignal;