@oneuptime/common 13.0.0 → 13.0.3

package/Server/Services/WorkflowVariableService.ts

@@ -1,9 +1,212 @@
 import DatabaseService from "./DatabaseService";
+import { OnUpdate } from "../Types/Database/Hooks";
+import QueryHelper from "../Types/Database/QueryHelper";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import Typeof from "../../Types/Typeof";
 import Model from "../../Models/DatabaseModels/WorkflowVariable";
 
+/*
+ * isSecret is declared `string` over a genuinely boolean column, so the value
+ * that comes back is `true` from Postgres and can be the string "true" from a
+ * request body. Read exactly the way RunWorkflow.getSecretWorkflowVariableValues
+ * reads it, so what this service calls secret and what the run logs redact can
+ * never disagree.
+ */
+function isSecretValue(value: unknown): boolean {
+  return value === true || value === "true";
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  /*
+   * @UniqueColumnBy(["workflowId", "projectId"]) on `name` is enforced by
+   * DatabaseService.checkUniqueColumnBy, which runs on create only - and there
+   * is no unique index on WorkflowVariable to catch what it misses. That was
+   * harmless while the dashboard offered no way to edit a variable. Now that it
+   * does, a rename is the one write that can put two rows with the same name in
+   * the same scope, and RunWorkflow.getVariables builds
+   * `storageMap.local.variables[variable.name] = variable.content` - a plain
+   * dictionary - so the second row would silently overwrite the first and
+   * {{local.variables.X}} would resolve to whichever the query happened to
+   * return last. Nothing would look broken; the workflow would just quietly run
+   * on the wrong value.
+   *
+   * Two things this cannot close, both shared with the create-side guard it
+   * mirrors: DatabaseService._updateBy skips every hook when props.ignoreHooks
+   * is set, and check-then-write is not atomic, so two concurrent renames onto
+   * the same free name can still both land. Closing either properly means a
+   * unique index on (projectId, workflowId, LOWER(name)), which needs a dedupe
+   * migration first because the racy create-side check may already have let
+   * duplicates through.
+   */
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    const rawName: unknown = updateBy.data.name;
+
+    /*
+     * Only an update that does not carry the column at all is exempt. An
+     * explicitly blank name is still a write to `name` - the column is
+     * nullable: false but the empty string satisfies that, and update does not
+     * re-run the required check - so two rows blanked in the same scope would
+     * both become "" and collide like any other duplicate. Let it through to
+     * the lookup rather than treating it as "no rename".
+     */
+    const isRename: boolean = rawName !== undefined && rawName !== null;
+
+    /*
+     * sanitizeUpdateData passes plain objects straight through, so `name` is
+     * whatever the request body said it was. Reject a non-string here rather
+     * than letting toLowerCase() throw a TypeError, which would surface as a
+     * 500 and a stack trace instead of a 400 naming the field.
+     */
+    if (isRename && typeof rawName !== Typeof.String) {
+      throw new BadDataException("Workflow variable name must be text.");
+    }
+
+    const newName: string = rawName as string;
+
+    /*
+     * Turning the secret flag OFF is the one direction that can expose
+     * something. isSecret decides whether RunWorkflow replaces this variable's
+     * value with [REDACTED] before a run log is persisted, and content itself
+     * is unreadable through the API - so a caller who may write a variable but
+     * may not read it could otherwise clear the flag, trigger a run, and read
+     * the value out of the log. Marking a variable secret stays freely
+     * available; unmarking one does not.
+     */
+    const isDeclassifying: boolean =
+      updateBy.data.isSecret !== undefined &&
+      updateBy.data.isSecret !== null &&
+      !isSecretValue(updateBy.data.isSecret);
+
+    if (!isRename && !isDeclassifying) {
+      return { updateBy, carryForward: null };
+    }
+
+    /*
+     * Read the rows this update will actually touch. Two things about this
+     * query matter.
+     *
+     * It is scoped to the caller's tenant here rather than relying on the
+     * permission layer, because _updateBy runs this hook BEFORE
+     * ModelPermission.checkUpdateQueryPermissions - which is what appends the
+     * project clause. Reading unscoped-as-root would make this hook answer
+     * questions about another project's rows, and its refusal messages say
+     * whether a variable is global and whether a name is taken. A caller
+     * holding a variable id from a project they cannot see would get an oracle
+     * before any authorization ran.
+     *
+     * isRoot inside that scope is still right: the conflicting row may be one
+     * this caller cannot read - read access is label-gated - and a count that
+     * cannot see it reports zero and waves the duplicate through.
+     */
+    const tenantId: ObjectID | undefined = updateBy.props.tenantId;
+
+    const itemsBeingUpdated: Array<Model> = await this.findBy({
+      query: tenantId
+        ? { ...updateBy.query, projectId: tenantId }
+        : updateBy.query,
+      select: {
+        _id: true,
+        name: true,
+        isSecret: true,
+        projectId: true,
+        workflowId: true,
+      },
+      limit: LIMIT_PER_PROJECT,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (isDeclassifying) {
+      for (const item of itemsBeingUpdated) {
+        if (isSecretValue(item.isSecret)) {
+          throw new BadDataException(
+            `"${item.name}" is marked secret, and a secret variable cannot be un-marked. Its value is redacted from workflow run logs, and clearing the flag would publish that value to the logs of every later run. Delete the variable and create it again if it should no longer be secret.`,
+          );
+        }
+      }
+    }
+
+    if (!isRename) {
+      return { updateBy, carryForward: null };
+    }
+
+    /*
+     * Renaming two rows to one name is a conflict the database lookup below
+     * cannot see: neither collides with anything that exists yet, they collide
+     * with each other once both are written.
+     */
+    if (itemsBeingUpdated.length > 1) {
+      throw new BadDataException(
+        `Cannot rename ${itemsBeingUpdated.length} workflow variables to "${newName}" at once. Variable names must be unique.`,
+      );
+    }
+
+    for (const item of itemsBeingUpdated) {
+      /*
+       * A no-op rename must stay a no-op. Compared case-insensitively because
+       * that is how the uniqueness lookup compares, so "TOKEN" -> "token" is a
+       * change of casing on the same row and not a collision with itself.
+       */
+      if (item.name && item.name.toLowerCase() === newName.toLowerCase()) {
+        continue;
+      }
+
+      /*
+       * The scope is what makes the lookup mean anything. projectId comes back
+       * from the select above and is non-nullable on the table, so its absence
+       * means the select or the row is wrong - and a missing projectId would
+       * silently drop the clause and count this name across every project on
+       * the instance. Refuse rather than answer the wrong question.
+       */
+      if (!item.projectId) {
+        throw new BadDataException(
+          "This workflow variable cannot be renamed because it is not attached to a project.",
+        );
+      }
+
+      const conflictCount: number = (
+        await this.countBy({
+          query: {
+            name: QueryHelper.findWithSameText(newName),
+            projectId: item.projectId,
+            /*
+             * Global variables are the rows with a null workflowId, and they
+             * share a namespace of their own. Querying `workflowId: undefined`
+             * would drop the clause entirely and compare a global variable
+             * against every workflow-local one in the project.
+             */
+            workflowId: item.workflowId
+              ? item.workflowId
+              : QueryHelper.isNull(),
+            _id: QueryHelper.notEquals(item.id as ObjectID),
+          },
+          props: {
+            isRoot: true,
+          },
+        })
+      ).toNumber();
+
+      if (conflictCount > 0) {
+        throw new BadDataException(
+          item.workflowId
+            ? `A workflow variable named "${newName}" already exists on this workflow. Variable names must be unique within a workflow.`
+            : `A global variable named "${newName}" already exists in this project. Global variable names must be unique.`,
+        );
+      }
+    }
+
+    return { updateBy, carryForward: null };
+  }
 }
 export default new Service();

package/Server/Static/Brand/README.md

@@ -22,11 +22,16 @@ absolute path, or from server code via the `OneUptimeLogoUrl` constant -
 
 ## Contents
 
-| Path                          | Source                                              |
-| ----------------------------- | --------------------------------------------------- |
-| `oneuptime-logo.svg`          | `Common/UI/Images/logos/OneUptimeSVG/3-transparent.svg` |
-| `ou-wb.svg`, `hou-wb.svg`     | `Home/Static/img/`                                  |
-| `favicons/`                   | `Home/Static/img/favicons/`                         |
+| Path                      | Source                                                  |
+| ------------------------- | ------------------------------------------------------- |
+| `oneuptime-logo.svg`      | `Common/UI/Images/logos/OneUptimeSVG/3-transparent.svg` |
+| `ou-wb.svg`, `hou-wb.svg` | `Home/Static/img/`                                      |
+| `favicons/`               | `Home/Static/img/favicons/`                             |
+
+`favicons/oneuptime-up-v1.svg` is the cache-versioned browser-tab icon shared
+by the Dashboard, Admin Dashboard, and Home page. It keeps the white `Up.` mark
+on its own dark background so the lettering remains visible in both light and
+dark browser chrome.
 
 `Common/Tests/Server/Utils/VendorAssets.test.ts` asserts `oneuptime-logo.svg` is
 byte-identical to the copies under `Common/UI` and `Home/Static`, so a rebrand

package/Server/Static/Brand/favicons/oneuptime-up-v1.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 375 375">
+  <rect width="375" height="375" rx="72" fill="#121212" />
+  <g fill="#ffffff">
+    <path transform="translate(38.113376 240.972289)" d="M 80.90625 -116.609375 L 99.71875 -116.609375 L 99.71875 -43.421875 C 99.71875 -35.921875 98.644531 -29.113281 96.5 -23 C 94.363281 -16.882812 91.253906 -11.628906 87.171875 -7.234375 C 86.316406 -6.378906 85.429688 -5.578125 84.515625 -4.828125 C 83.609375 -4.078125 82.695312 -3.328125 81.78125 -2.578125 C 80.875 -1.828125 79.910156 -1.15625 78.890625 -0.5625 C 77.867188 0.03125 76.820312 0.59375 75.75 1.125 C 74.6875 1.664062 73.5625 2.148438 72.375 2.578125 C 66.800781 4.828125 60.582031 5.953125 53.71875 5.953125 C 39.457031 5.953125 28.253906 1.71875 20.109375 -6.75 C 12.066406 -15.226562 8.046875 -27.238281 8.046875 -42.78125 L 8.046875 -116.609375 L 31.359375 -116.609375 L 31.359375 -45.203125 C 31.359375 -35.222656 33.289062 -27.660156 37.15625 -22.515625 C 38.875 -20.160156 41.070312 -18.390625 43.75 -17.203125 C 46.425781 -16.023438 49.75 -15.4375 53.71875 -15.4375 C 61.550781 -15.4375 67.289062 -17.796875 70.9375 -22.515625 C 74.90625 -27.554688 76.890625 -35.117188 76.890625 -45.203125 L 76.890625 -116.609375 Z M 80.90625 -116.609375" />
+    <path transform="translate(145.87611 240.972289)" d="M 9.484375 -87.65625 C 11.628906 -87.65625 13.613281 -87.492188 15.4375 -87.171875 C 17.257812 -86.847656 19 -86.335938 20.65625 -85.640625 C 22.320312 -84.953125 23.851562 -84.070312 25.25 -83 C 26.644531 -81.925781 27.828125 -80.640625 28.796875 -79.140625 C 30.617188 -80.960938 32.707031 -82.566406 35.0625 -83.953125 C 35.707031 -84.390625 36.347656 -84.796875 36.984375 -85.171875 C 37.628906 -85.546875 38.328125 -85.890625 39.078125 -86.203125 C 39.835938 -86.523438 40.59375 -86.820312 41.34375 -87.09375 C 42.09375 -87.363281 42.84375 -87.660156 43.59375 -87.984375 C 45.300781 -88.515625 47.066406 -88.914062 48.890625 -89.1875 C 50.710938 -89.457031 52.59375 -89.59375 54.53125 -89.59375 C 59.882812 -89.59375 65.054688 -88.519531 70.046875 -86.375 C 75.035156 -84.226562 79.40625 -81.117188 83.15625 -77.046875 C 86.90625 -72.972656 89.851562 -68.039062 92 -62.25 C 92.75 -60.3125 93.363281 -58.269531 93.84375 -56.125 C 94.332031 -53.988281 94.707031 -51.789062 94.96875 -49.53125 C 95.238281 -47.28125 95.375 -44.976562 95.375 -42.625 C 95.375 -35.550781 94.300781 -29.007812 92.15625 -23 C 91.09375 -20.101562 89.835938 -17.367188 88.390625 -14.796875 C 86.941406 -12.222656 85.25 -9.863281 83.3125 -7.71875 C 82.675781 -6.863281 81.953125 -6.0625 81.140625 -5.3125 C 80.335938 -4.5625 79.503906 -3.8125 78.640625 -3.0625 C 77.785156 -2.3125 76.929688 -1.613281 76.078125 -0.96875 C 75.222656 -0.320312 74.3125 0.265625 73.34375 0.796875 C 72.375 1.335938 71.410156 1.820312 70.453125 2.25 C 67.984375 3.539062 65.4375 4.476562 62.8125 5.0625 C 60.1875 5.65625 57.53125 5.953125 54.84375 5.953125 C 49.164062 5.953125 43.96875 4.828125 39.25 2.578125 C 37.53125 1.828125 35.921875 0.96875 34.421875 0 L 34.421875 39.40625 L 11.90625 39.40625 L 11.90625 -62.25 C 11.90625 -64.71875 11.472656 -66.328125 10.609375 -67.078125 C 9.648438 -67.929688 8.257812 -68.359375 6.4375 -68.359375 L 1.125 -68.359375 L 2.578125 -73.5 L 5.625 -84.765625 L 6.4375 -87.65625 Z M 72.546875 -42.140625 C 72.546875 -44.390625 72.382812 -46.476562 72.0625 -48.40625 C 71.738281 -50.34375 71.28125 -52.140625 70.6875 -53.796875 C 70.101562 -55.460938 69.429688 -56.992188 68.671875 -58.390625 C 67.921875 -59.785156 67.066406 -61.070312 66.109375 -62.25 C 64.179688 -64.5 61.957031 -66.1875 59.4375 -67.3125 C 56.914062 -68.4375 54.207031 -69 51.3125 -69 C 49.375 -69 47.546875 -68.753906 45.828125 -68.265625 C 44.117188 -67.785156 42.515625 -67.066406 41.015625 -66.109375 C 38.222656 -64.390625 36.023438 -62.566406 34.421875 -60.640625 L 34.421875 -22.515625 C 36.671875 -20.484375 39.132812 -18.769531 41.8125 -17.375 C 44.820312 -15.757812 48.203125 -14.953125 51.953125 -14.953125 C 54.953125 -14.953125 57.6875 -15.546875 60.15625 -16.734375 C 62.625 -18.015625 64.769531 -19.78125 66.59375 -22.03125 C 67.550781 -23.21875 68.378906 -24.503906 69.078125 -25.890625 C 69.773438 -27.285156 70.390625 -28.84375 70.921875 -30.5625 C 71.460938 -32.28125 71.867188 -34.101562 72.140625 -36.03125 C 72.410156 -37.957031 72.546875 -39.992188 72.546875 -42.140625 Z M 72.546875 -42.140625" />
+  </g>
+  <rect x="260.886719" y="159.507812" width="75.75" height="75.75" rx="4.925" fill="#7ed957" />
+</svg>

package/Server/Types/Billing/MeteredPlan/ActiveMonitoringMeteredPlan.ts

@@ -9,6 +9,9 @@ import ObjectID from "../../../../Types/ObjectID";
 import PositiveNumber from "../../../../Types/PositiveNumber";
 import Project from "../../../../Models/DatabaseModels/Project";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+import PayAsYouGoBillingService, {
+  LiveUsageAuthorization,
+} from "../../../Services/PayAsYouGoBillingService";
 
 export default class ActiveMonitoringMeteredPlan extends ServerMeteredPlan {
   @CaptureSpan()
@@ -44,6 +47,19 @@ export default class ActiveMonitoringMeteredPlan extends ServerMeteredPlan {
       },
     });
 
+    /*
+     * This runs on every monitor create and delete, so each live check here
+     * is a payment-provider read on a request path. Check once, and hand the
+     * answer to the usage write instead of letting it read the same payment
+     * setup again a moment later.
+     */
+    const liveAuthorization: LiveUsageAuthorization | null =
+      await PayAsYouGoBillingService.authorizeUsageNow(projectId);
+
+    if (!liveAuthorization) {
+      return;
+    }
+
     // update this count in project as well.
     const project: Project | null = await ProjectService.findOneById({
       id: projectId,
@@ -67,6 +83,7 @@ export default class ActiveMonitoringMeteredPlan extends ServerMeteredPlan {
           (project.paymentProviderMeteredSubscriptionId as string),
         this,
         count.toNumber(),
+        { liveAuthorization: liveAuthorization },
       );
     }
   }

package/Server/Types/Billing/MeteredPlan/TelemetryMeteredPlan.ts

@@ -8,6 +8,9 @@ import ObjectID from "../../../../Types/ObjectID";
 import Project from "../../../../Models/DatabaseModels/Project";
 import TelemetryUsageBilling from "../../../../Models/DatabaseModels/TelemetryUsageBilling";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+import PayAsYouGoBillingService, {
+  LiveUsageAuthorization,
+} from "../../../Services/PayAsYouGoBillingService";
 
 export default class TelemetryMeteredPlan extends ServerMeteredPlan {
   private _productType!: ProductType;
@@ -54,11 +57,37 @@ export default class TelemetryMeteredPlan extends ServerMeteredPlan {
       meteredPlanSubscriptionId?: string | undefined;
     },
   ): Promise<void> {
-    // get all unreported logs
+    /*
+     * One live read of the payment setup for the whole report. Staging and the
+     * usage write each used to repeat it seconds later, for every product type
+     * of every project in the billing pass; they are handed this one instead,
+     * and still check live when it is not for this project or has aged out.
+     */
+    const liveAuthorization: LiveUsageAuthorization | null =
+      await PayAsYouGoBillingService.authorizeUsageNow(projectId);
+
+    if (!liveAuthorization) {
+      await TelemetryUsageBillingService.waiveUnreportedUsageBilling({
+        projectId: projectId,
+        productType: this.productType,
+      });
+      return;
+    }
+
+    const billingStartsAt: Date | undefined =
+      await PayAsYouGoBillingService.getTelemetryBillingStartDate(projectId);
+    if (billingStartsAt) {
+      await TelemetryUsageBillingService.waiveUnreportedUsageBilling({
+        projectId: projectId,
+        productType: this.productType,
+        before: billingStartsAt,
+      });
+    }
 
     await TelemetryUsageBillingService.stageTelemetryUsageForProject({
       projectId: projectId,
       productType: this.productType,
+      liveAuthorization: liveAuthorization,
     });
 
     const usageBillings: Array<TelemetryUsageBilling> =
@@ -119,6 +148,7 @@ export default class TelemetryMeteredPlan extends ServerMeteredPlan {
           (project.paymentProviderMeteredSubscriptionId as string),
         this,
         totalCostInCents,
+        { liveAuthorization: liveAuthorization },
       );
 
       for (const usageBilling of usageBillings) {

package/Server/Types/Database/QueryHelper.ts

@@ -1,6 +1,7 @@
 import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import Dictionary from "../../../Types/Dictionary";
 import { JSONObject } from "../../../Types/JSON";
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
 import ObjectID from "../../../Types/ObjectID";
 import Text from "../../../Types/Text";
 import Typeof from "../../../Types/Typeof";
@@ -13,6 +14,33 @@ import buildJSONColumnQuery, { JSONColumnQuery } from "./JSONColumnQuery";
 export type { FindOperator };
 
 export default class QueryHelper {
+  /** Read a boolean whose criteria-backed `true` state is encoded as null. */
+  @CaptureSpan()
+  public static booleanForCriteriaBackedRule(
+    criteriaColumnName: string,
+    value: boolean,
+  ): FindWhereProperty<any> {
+    if (criteriaColumnName.match(/^[A-Za-z_][A-Za-z0-9_]*$/) === null) {
+      throw new Error("Criteria column name must be a plain identifier.");
+    }
+
+    const rid: string = Text.generateRandomText(10);
+
+    return Raw(
+      (alias: string) => {
+        const separatorIndex: number = alias.lastIndexOf(".");
+        const qualifier: string =
+          separatorIndex >= 0 ? alias.slice(0, separatorIndex + 1) : "";
+        const criteriaAlias: string = `${qualifier}"${criteriaColumnName}"`;
+
+        return `((CASE WHEN ${criteriaAlias} IS NULL THEN COALESCE(${alias}, false) ELSE ${alias} IS NULL END) = :${rid})`;
+      },
+      {
+        [rid]: value,
+      },
+    );
+  }
+
   @CaptureSpan()
   public static modulo(
     moduloBy: number,
@@ -778,6 +806,66 @@ export default class QueryHelper {
     }, jsonQuery.parameters);
   }
 
+  /**
+   * Matches a jsonb document whose named array contains an object with a
+   * particular discriminator and whose second named property contains any of
+   * the supplied values.
+   *
+   * For example, rule criteria store filters as:
+   * `{ filters: [{ field: "monitorLabels", value: ["label-id"] }] }`.
+   * Keeping every key, discriminator, and value in the parameter bag makes
+   * this helper safe for other jsonb documents too. The CASE expressions make
+   * malformed legacy json harmless instead of letting
+   * `jsonb_array_elements*` abort the entire query.
+   */
+  @CaptureSpan()
+  public static jsonArrayObjectsContainAnyArrayValue(data: {
+    arrayKey: string;
+    discriminatorKey: string;
+    discriminatorValue: string;
+    valueArrayKey: string;
+    values: Array<string | ObjectID>;
+  }): FindWhereProperty<any> {
+    const values: Array<string> = Array.from(
+      new Set(
+        data.values.map((value: string | ObjectID): string => {
+          return value.toString();
+        }),
+      ),
+    );
+
+    if (values.length === 0) {
+      return Raw(() => {
+        return "TRUE = FALSE";
+      }, {});
+    }
+
+    if (values.length > LIMIT_MAX) {
+      throw new Error(
+        `JSON array value filters cannot bind more than ${LIMIT_MAX} unique values.`,
+      );
+    }
+
+    const arrayKeyParameter: string = Text.generateRandomText(10);
+    const discriminatorKeyParameter: string = Text.generateRandomText(10);
+    const discriminatorValueParameter: string = Text.generateRandomText(10);
+    const valueArrayKeyParameter: string = Text.generateRandomText(10);
+    const valuesParameter: string = Text.generateRandomText(10);
+
+    return Raw(
+      (alias: string): string => {
+        return `(EXISTS (SELECT 1 FROM jsonb_array_elements(CASE WHEN jsonb_typeof(${alias} -> :${arrayKeyParameter}) = 'array' THEN ${alias} -> :${arrayKeyParameter} ELSE '[]'::jsonb END) AS json_array_item(item) WHERE json_array_item.item ->> :${discriminatorKeyParameter} = :${discriminatorValueParameter} AND EXISTS (SELECT 1 FROM jsonb_array_elements_text(CASE WHEN jsonb_typeof(json_array_item.item -> :${valueArrayKeyParameter}) = 'array' THEN json_array_item.item -> :${valueArrayKeyParameter} ELSE '[]'::jsonb END) AS json_array_value(value) WHERE json_array_value.value = ANY(CAST(:${valuesParameter} AS text[])))))`;
+      },
+      {
+        [arrayKeyParameter]: data.arrayKey,
+        [discriminatorKeyParameter]: data.discriminatorKey,
+        [discriminatorValueParameter]: data.discriminatorValue,
+        [valueArrayKeyParameter]: data.valueArrayKey,
+        [valuesParameter]: values,
+      },
+    );
+  }
+
   @CaptureSpan()
   public static lessThan<T extends number | Date>(
     value: T,

package/Server/Utils/AI/Toolbox/SloTools.ts

@@ -78,14 +78,14 @@ function formatPercent(value: number | undefined | null): string {
 export const QuerySlosTool: ObservabilityTool = {
   name: "query_slos",
   description:
-    "List Service Level Objectives (SLOs) in this project: what each one measures (monitor uptime or a metric SLI), its target percentage, compliance window, attached monitors, and the latest persisted compliance status — current SLI %, error budget remaining and burn rate as computed by the platform at its last evaluation (this tool never recomputes compliance live). Pass sloId (an SLO ID from this tool's own list results) to get one SLO's full definition plus its burn-rate alert rules and their thresholds. Use query_alerts to see alerts those burn-rate rules fired, and query_monitors for the current status of an SLO's monitors.",
+    "List Service Level Objectives (SLOs) in this project: what each one measures (monitor uptime or a metric SLI), its target percentage, compliance window, attached monitors, and the latest persisted compliance status — current SLI %, error budget remaining and burn rate as computed by the platform at its last evaluation (this tool never recomputes compliance live). Pass sloId (an SLO ID from this tool's own list results) to get one SLO's full definition plus its burn-rate rules, their thresholds, and whether each raises an alert, declares an incident, or both. Use query_alerts to see alerts those burn-rate rules raised, query_incidents for the incidents they declared, and query_monitors for the current status of an SLO's monitors.",
   inputSchema: {
     type: "object",
     properties: {
       sloId: {
         type: "string",
         description:
-          "Get one SLO by its ID — includes the full definition (SLI type, downtime statuses, monitor labels, at-risk threshold, error budget seconds) and its burn-rate rules with thresholds and alert windows.",
+          "Get one SLO by its ID — includes the full definition (SLI type, downtime statuses, monitor labels, at-risk threshold, error budget seconds) and its burn-rate rules with thresholds, windows, and what each rule declares when it fires.",
       },
       sloStatus: {
         type: "string",
@@ -210,11 +210,18 @@ export const QuerySlosTool: ObservabilityTool = {
             shortWindowInMinutes: true,
             minimumSampleCount: true,
             refireSuppressionMinutes: true,
+            shouldCreateAlert: true,
             alertSeverity: {
               name: true,
             },
+            shouldCreateIncident: true,
+            incidentSeverity: {
+              name: true,
+            },
             lastAlertCreatedAt: true,
             lastAlertResolvedAt: true,
+            lastIncidentCreatedAt: true,
+            lastIncidentResolvedAt: true,
           },
           sort: {
             burnRateThreshold: SortOrder.Descending,
@@ -236,9 +243,19 @@ export const QuerySlosTool: ObservabilityTool = {
           shortWindowInMinutes: rule.shortWindowInMinutes,
           minimumSampleCount: rule.minimumSampleCount,
           refireSuppressionMinutes: rule.refireSuppressionMinutes,
+          /*
+           * Read with the model's own defaults so a rule written before
+           * incidents existed reports "creates an alert" rather than a blank
+           * the model would have to guess at.
+           */
+          createsAlert: rule.shouldCreateAlert !== false,
           alertSeverity: rule.alertSeverity?.name,
+          createsIncident: rule.shouldCreateIncident === true,
+          incidentSeverity: rule.incidentSeverity?.name,
           lastAlertCreatedAt: rule.lastAlertCreatedAt,
           lastAlertResolvedAt: rule.lastAlertResolvedAt,
+          lastIncidentCreatedAt: rule.lastIncidentCreatedAt,
+          lastIncidentResolvedAt: rule.lastIncidentResolvedAt,
         });
       }
 

package/Server/Utils/CodeRepository/GitHub/GitHub.ts

@@ -398,6 +398,13 @@ export default class GitHubUtil extends HostedCodeRepository {
       permissions?: {
         contents?: "read" | "write";
         pull_requests?: "read" | "write";
+        /*
+         * Issue READ/WRITE for the interactive app: GitHub routes pull
+         * request CONVERSATION comments through the issues API, so posting
+         * the app's acknowledgement on a pull request needs this scope just
+         * as much as answering a mention on an issue does.
+         */
+        issues?: "read" | "write";
         /*
          * Check-run READ access for the Tier 1 CI verification sweep. The
          * GitHub App must have the "Checks: Read-only" permission configured