@oneuptime/common 14.0.1 → 14.0.2

package/Tests/Types/Monitor/DatabaseMonitor/SqlServerPlatform.test.ts

@@ -0,0 +1,144 @@
+import SqlServerPlatformUtil, {
+  AZURE_SQL_DATABASE_MONITORING_GRANT,
+  AZURE_SQL_DATABASE_MONITORING_REMEDIATION,
+  AZURE_SQL_DATABASE_SERVER_STATE_READER_GRANT,
+  SQL_SERVER_MONITORING_GRANT,
+  SQL_SERVER_MONITORING_REMEDIATION,
+  SqlServerEngineEdition,
+} from "../../../../Types/Monitor/DatabaseMonitor/SqlServerPlatform";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * https://github.com/OneUptime/oneuptime/issues/3913
+ *
+ * The reporter's SQL Server was an Azure SQL Database - ProductVersion
+ * 12.0.2000.8, no sys.dm_hadr_database_replica_states - where the grant the
+ * monitor would have suggested, VIEW SERVER STATE, cannot be granted at all.
+ * These pin how the platform is told apart and which grant each one gets.
+ */
+
+describe("SqlServerEngineEdition", () => {
+  test("carries Microsoft's documented SERVERPROPERTY('EngineEdition') values", () => {
+    expect(SqlServerEngineEdition.AzureSqlDatabase).toBe(5);
+    expect(SqlServerEngineEdition.AzureSqlManagedInstance).toBe(8);
+    expect(SqlServerEngineEdition.AzureSqlEdge).toBe(9);
+  });
+});
+
+describe("SqlServerPlatformUtil.isAzureSqlDatabase", () => {
+  test("is true only for edition 5", () => {
+    expect(SqlServerPlatformUtil.isAzureSqlDatabase(5)).toBe(true);
+
+    /*
+     * Managed Instance and Edge DO have server-level permissions, so they
+     * take the SQL Server grant; so does anything unknown.
+     */
+    for (const edition of [1, 2, 3, 4, 6, 8, 9, 11, 12, 0, -5, 5.5]) {
+      expect({
+        edition,
+        isAzureSqlDatabase: SqlServerPlatformUtil.isAzureSqlDatabase(edition),
+      }).toEqual({ edition, isAzureSqlDatabase: false });
+    }
+  });
+
+  test("an edition that was never read is not Azure SQL Database", () => {
+    expect(SqlServerPlatformUtil.isAzureSqlDatabase(null)).toBe(false);
+    expect(SqlServerPlatformUtil.isAzureSqlDatabase(undefined)).toBe(false);
+  });
+});
+
+describe("SqlServerPlatformUtil.getPlatformName", () => {
+  test.each([
+    [5, "Azure SQL Database"],
+    [8, "Azure SQL Managed Instance"],
+    [9, "Azure SQL Edge"],
+    [2, "SQL Server"],
+    [3, "SQL Server"],
+    [4, "SQL Server"],
+    [null, "SQL Server"],
+    [undefined, "SQL Server"],
+  ])(
+    "names edition %p as %s",
+    (edition: number | null | undefined, name: string) => {
+      expect(SqlServerPlatformUtil.getPlatformName(edition)).toBe(name);
+    },
+  );
+});
+
+const STATEMENT_KEYWORD: RegExp = /GRANT|ALTER/;
+
+describe("SQL Server monitoring grants", () => {
+  test("SQL Server and Managed Instance get the server-level grant", () => {
+    expect(SQL_SERVER_MONITORING_GRANT).toBe(
+      "GRANT VIEW SERVER STATE TO [<monitoring_login>];",
+    );
+  });
+
+  test("the SQL Server remediation says to run it in master, where alone it works", () => {
+    /*
+     * Run from any other database, a server-scope GRANT fails with Msg 4621
+     * "Permissions at the server scope can only be granted when the current
+     * database is master" (verified on 2017 and 2022) - and the operator
+     * reading a collection issue is usually connected to the monitored one.
+     */
+    expect(SQL_SERVER_MONITORING_REMEDIATION).toBe(
+      "GRANT VIEW SERVER STATE TO [<monitoring_login>]; -- run in master",
+    );
+    expect(
+      SQL_SERVER_MONITORING_REMEDIATION.startsWith(SQL_SERVER_MONITORING_GRANT),
+    ).toBe(true);
+  });
+
+  test("Azure SQL Database gets the database-level grant, for a database USER", () => {
+    expect(AZURE_SQL_DATABASE_MONITORING_GRANT).toBe(
+      "GRANT VIEW DATABASE STATE TO [<monitoring_user>];",
+    );
+  });
+
+  test("the Basic/S0/S1/elastic pool fallback is the server role, for a LOGIN, in master", () => {
+    expect(AZURE_SQL_DATABASE_SERVER_STATE_READER_GRANT).toBe(
+      "ALTER SERVER ROLE ##MS_ServerStateReader## ADD MEMBER [<monitoring_login>];",
+    );
+  });
+
+  test("the Azure remediation puts each statement on its own line, under a line saying where it runs", () => {
+    expect(AZURE_SQL_DATABASE_MONITORING_REMEDIATION.split("\n")).toEqual([
+      "-- In the monitored database:",
+      AZURE_SQL_DATABASE_MONITORING_GRANT,
+      "-- Basic, S0, S1, elastic pools, or if that is not enough: in master, for the login:",
+      AZURE_SQL_DATABASE_SERVER_STATE_READER_GRANT,
+    ]);
+  });
+
+  test("no statement of a remediation hides inside a comment", () => {
+    /*
+     * The summary renders a remediation as copyable code. A statement that
+     * trails a `--` on the same line is a comment, and copying it runs
+     * nothing - which is how the Azure fallback used to be written.
+     */
+    for (const remediation of [
+      SQL_SERVER_MONITORING_REMEDIATION,
+      AZURE_SQL_DATABASE_MONITORING_REMEDIATION,
+    ]) {
+      for (const line of remediation.split("\n")) {
+        const comment: string = line.includes("--")
+          ? line.slice(line.indexOf("--"))
+          : "";
+
+        expect({
+          line,
+          commentHidesAStatement: STATEMENT_KEYWORD.test(comment),
+        }).toEqual({ line, commentHidesAStatement: false });
+      }
+    }
+  });
+
+  test("the Azure remediation never suggests a server-level permission Azure SQL Database does not have", () => {
+    expect(AZURE_SQL_DATABASE_MONITORING_REMEDIATION).not.toContain(
+      "VIEW SERVER STATE",
+    );
+    expect(AZURE_SQL_DATABASE_MONITORING_REMEDIATION).not.toMatch(
+      /GRANT VIEW SERVER/,
+    );
+  });
+});

package/Tests/Types/Monitor/MonitorStepExceptionMonitor.test.ts

@@ -17,6 +17,7 @@ describe("MonitorStepExceptionMonitorUtil", () => {
 
       expect(def.telemetryServiceIds).toEqual([]);
       expect(def.entityKeys).toEqual([]);
+      expect(def.environments).toEqual([]);
       expect(def.exceptionTypes).toEqual([]);
       expect(def.message).toBe("");
       expect(def.includeResolved).toBe(false);
@@ -25,6 +26,63 @@ describe("MonitorStepExceptionMonitorUtil", () => {
     });
   });
 
+  describe("normalizeEnvironments", () => {
+    test("keeps a list of environments in order", () => {
+      expect(
+        MonitorStepExceptionMonitorUtil.normalizeEnvironments([
+          "production",
+          "staging",
+        ]),
+      ).toEqual(["production", "staging"]);
+    });
+
+    test("trims values and drops blanks and duplicates", () => {
+      expect(
+        MonitorStepExceptionMonitorUtil.normalizeEnvironments([
+          " production ",
+          "",
+          "   ",
+          "production",
+          "staging",
+        ]),
+      ).toEqual(["production", "staging"]);
+    });
+
+    test("keeps case, because matching is exact like the Explorer", () => {
+      expect(
+        MonitorStepExceptionMonitorUtil.normalizeEnvironments([
+          "production",
+          "Production",
+        ]),
+      ).toEqual(["production", "Production"]);
+    });
+
+    test("wraps a single environment sent as a bare string", () => {
+      expect(
+        MonitorStepExceptionMonitorUtil.normalizeEnvironments("production"),
+      ).toEqual(["production"]);
+    });
+
+    test("returns an empty list for missing or malformed values", () => {
+      for (const value of [undefined, null, "", 42, true, {}, [1, null, {}]]) {
+        expect(
+          MonitorStepExceptionMonitorUtil.normalizeEnvironments(value),
+        ).toEqual([]);
+      }
+    });
+
+    test("drops non-string entries but keeps the strings around them", () => {
+      expect(
+        MonitorStepExceptionMonitorUtil.normalizeEnvironments([
+          "production",
+          7,
+          null,
+          "staging",
+        ]),
+      ).toEqual(["production", "staging"]);
+    });
+  });
+
   describe("toAnalyticsQuery", () => {
     test("builds no filters for the empty default when the time window is off", () => {
       const query: Query<ExceptionInstance> =
@@ -84,6 +142,60 @@ describe("MonitorStepExceptionMonitorUtil", () => {
       ).toBeUndefined();
     });
 
+    test("filters by a single environment", () => {
+      const query: Query<ExceptionInstance> =
+        MonitorStepExceptionMonitorUtil.toAnalyticsQuery({
+          ...MonitorStepExceptionMonitorUtil.getDefault(),
+          environments: ["production"],
+          lastXSecondsOfExceptions: 0,
+        });
+
+      expect(query.environment).toBeInstanceOf(Includes);
+      expect((query.environment as Includes).values).toEqual(["production"]);
+    });
+
+    test("filters by any of several environments", () => {
+      const query: Query<ExceptionInstance> =
+        MonitorStepExceptionMonitorUtil.toAnalyticsQuery({
+          ...MonitorStepExceptionMonitorUtil.getDefault(),
+          environments: ["production", "staging"],
+          lastXSecondsOfExceptions: 0,
+        });
+
+      expect(query.environment).toBeInstanceOf(Includes);
+      expect((query.environment as Includes).values).toEqual([
+        "production",
+        "staging",
+      ]);
+    });
+
+    test("omits the environment filter when none is selected", () => {
+      for (const environments of [[], undefined, ["", "  "]]) {
+        expect(
+          MonitorStepExceptionMonitorUtil.toAnalyticsQuery({
+            ...MonitorStepExceptionMonitorUtil.getDefault(),
+            environments: environments,
+            lastXSecondsOfExceptions: 0,
+          }),
+        ).toEqual({});
+      }
+    });
+
+    test("normalizes environments on a step stored without fromJSON", () => {
+      /*
+       * MonitorStep.fromJSON keeps exceptionMonitor as raw JSON, so an API
+       * caller's shape reaches this function unchanged.
+       */
+      const query: Query<ExceptionInstance> =
+        MonitorStepExceptionMonitorUtil.toAnalyticsQuery({
+          ...MonitorStepExceptionMonitorUtil.getDefault(),
+          environments: "production" as unknown as Array<string>,
+          lastXSecondsOfExceptions: 0,
+        });
+
+      expect((query.environment as Includes).values).toEqual(["production"]);
+    });
+
     test("filters by exception type when provided", () => {
       const query: Query<ExceptionInstance> =
         MonitorStepExceptionMonitorUtil.toAnalyticsQuery({
@@ -179,6 +291,7 @@ describe("MonitorStepExceptionMonitorUtil", () => {
         MonitorStepExceptionMonitorUtil.toAnalyticsQuery({
           telemetryServiceIds: [ObjectID.generate()],
           entityKeys: ["host-1"],
+          environments: ["production"],
           exceptionTypes: ["TypeError"],
           message: "boom",
           includeResolved: false,
@@ -188,6 +301,7 @@ describe("MonitorStepExceptionMonitorUtil", () => {
 
       expect(query.primaryEntityId).toBeDefined();
       expect(query.entityKeys).toBeDefined();
+      expect(query.environment).toBeDefined();
       expect(query.exceptionType).toBeDefined();
       expect(query.message).toBeDefined();
       expect(query.time).toBeDefined();
@@ -201,6 +315,7 @@ describe("MonitorStepExceptionMonitorUtil", () => {
 
       expect(monitor.telemetryServiceIds).toEqual([]);
       expect(monitor.entityKeys).toEqual([]);
+      expect(monitor.environments).toEqual([]);
       expect(monitor.exceptionTypes).toEqual([]);
       expect(monitor.message).toBe("");
       expect(monitor.includeResolved).toBe(false);
@@ -208,6 +323,20 @@ describe("MonitorStepExceptionMonitorUtil", () => {
       expect(monitor.lastXSecondsOfExceptions).toBe(60);
     });
 
+    test("reads environments supplied through the API", () => {
+      expect(
+        MonitorStepExceptionMonitorUtil.fromJSON({
+          environments: ["production", " staging ", ""],
+        }).environments,
+      ).toEqual(["production", "staging"]);
+
+      expect(
+        MonitorStepExceptionMonitorUtil.fromJSON({
+          environments: "production",
+        }).environments,
+      ).toEqual(["production"]);
+    });
+
     test("coerces the include flags to booleans", () => {
       const monitor: MonitorStepExceptionMonitor =
         MonitorStepExceptionMonitorUtil.fromJSON({
@@ -245,10 +374,40 @@ describe("MonitorStepExceptionMonitorUtil", () => {
       expect(json["entityKeys"]).toEqual([]);
     });
 
+    test("normalizes an undefined environments to an empty array", () => {
+      const json: JSONObject = MonitorStepExceptionMonitorUtil.toJSON({
+        ...MonitorStepExceptionMonitorUtil.getDefault(),
+        environments: undefined,
+      });
+
+      expect(json["environments"]).toEqual([]);
+    });
+
+    test("a monitor saved before environments existed stays unfiltered", () => {
+      const legacy: JSONObject = {
+        telemetryServiceIds: [],
+        entityKeys: [],
+        exceptionTypes: ["TypeError"],
+        message: "",
+        includeResolved: false,
+        includeArchived: false,
+        lastXSecondsOfExceptions: 60,
+      };
+
+      const monitor: MonitorStepExceptionMonitor =
+        MonitorStepExceptionMonitorUtil.fromJSON(legacy);
+
+      expect(monitor.environments).toEqual([]);
+      expect(
+        MonitorStepExceptionMonitorUtil.toAnalyticsQuery(monitor).environment,
+      ).toBeUndefined();
+    });
+
     test("round-trips a fully populated monitor", () => {
       const original: MonitorStepExceptionMonitor = {
         telemetryServiceIds: [ObjectID.generate()],
         entityKeys: ["host-1"],
+        environments: ["production", "staging"],
         exceptionTypes: ["TypeError"],
         message: "boom",
         includeResolved: true,
@@ -262,6 +421,7 @@ describe("MonitorStepExceptionMonitorUtil", () => {
         );
 
       expect(roundTripped.entityKeys).toEqual(original.entityKeys);
+      expect(roundTripped.environments).toEqual(original.environments);
       expect(roundTripped.exceptionTypes).toEqual(original.exceptionTypes);
       expect(roundTripped.message).toBe(original.message);
       expect(roundTripped.includeResolved).toBe(original.includeResolved);

package/Tests/Types/Monitor/Recommendation/MonitorRecommendationCoverage.test.ts

@@ -898,4 +898,57 @@ describe("MonitorRecommendationUtil.getCoveredRecommendationMonitorIds", () => {
 
     expect(covered.size).toBe(0);
   });
+
+  it("does not let an environment-scoped exception monitor cover the every-environment recommendation", () => {
+    const args: MonitorRecommendationArgs = buildArgs();
+
+    const serviceRecommendations: Array<MonitorRecommendation> =
+      MonitorRecommendationCatalog.getRecommendations(
+        MonitorRecommendationResourceType.Service,
+      );
+
+    const unhandledExceptions: MonitorRecommendation | undefined =
+      serviceRecommendations.find((recommendation: MonitorRecommendation) => {
+        return recommendation.templateId === "service-unhandled-exceptions";
+      });
+
+    expect(unhandledExceptions).toBeDefined();
+
+    const buildExceptionMonitor: (
+      environments: Array<string> | undefined,
+    ) => ExistingRecommendationMonitor = (
+      environments: Array<string> | undefined,
+    ): ExistingRecommendationMonitor => {
+      const monitor: ExistingRecommendationMonitor = buildMonitorFor(
+        [unhandledExceptions!],
+        args,
+      );
+      const step: MonitorStep = monitor.monitorSteps[0]!;
+
+      step.setExceptionMonitor({
+        ...step.data!.exceptionMonitor!,
+        environments: environments,
+      });
+
+      return monitor;
+    };
+
+    for (const environments of [undefined, []]) {
+      expect(
+        MonitorRecommendationUtil.getCoveredRecommendationMonitorIds({
+          recommendations: [unhandledExceptions!],
+          existingMonitors: [buildExceptionMonitor(environments)],
+          args: args,
+        }).size,
+      ).toBe(1);
+    }
+
+    expect(
+      MonitorRecommendationUtil.getCoveredRecommendationMonitorIds({
+        recommendations: [unhandledExceptions!],
+        existingMonitors: [buildExceptionMonitor(["production"])],
+        args: args,
+      }).size,
+    ).toBe(0);
+  });
 });

package/Tests/Types/Runbook/RunbookStepType.test.ts

@@ -10,10 +10,10 @@ import { describe, expect, test } from "@jest/globals";
  * Contract under test — the one list that decides where a runbook step runs.
  *
  * Every step type is in exactly one of two lanes: it executes on a Runner
- * inside the customer's network (JavaScript, Bash, SSH, Kubernetes), or it
- * executes on the OneUptime Worker (Manual, HttpRequest, AI). The lane is not
- * a preference — a Runner has no implementation for an AI step, and the
- * Worker has no route to a customer's SSH host.
+ * inside the customer's network (JavaScript, Bash, SSH, Kubernetes, Kubectl),
+ * or it executes on the OneUptime Worker (Manual, HttpRequest, AI). The lane
+ * is not a preference — a Runner has no implementation for an AI step, and
+ * the Worker has no route to a customer's SSH host or cluster.
  *
  * Getting the lane wrong is not a graceful failure. Classifying a Worker type
  * as Runner work enqueues a RunnerJob a Runner will claim and cannot
@@ -42,7 +42,16 @@ describe("RunbookStepType enum", () => {
      * partition tests below exist to prevent.
      */
     expect(Object.values(RunbookStepType).sort()).toEqual(
-      ["AI", "Bash", "HttpRequest", "JavaScript", "Kubernetes", "Manual", "SSH"]
+      [
+        "AI",
+        "Bash",
+        "HttpRequest",
+        "JavaScript",
+        "Kubernetes",
+        "Kubectl",
+        "Manual",
+        "SSH",
+      ]
         .slice()
         .sort(),
     );
@@ -61,11 +70,22 @@ describe("RunbookStepType enum", () => {
     expect(RunbookStepType.AI).toBe("AI");
     expect(RunbookStepType.SSH).toBe("SSH");
     expect(RunbookStepType.Kubernetes).toBe("Kubernetes");
+    expect(RunbookStepType.Kubectl).toBe("Kubectl");
+  });
+
+  test("Kubectl and Kubernetes are distinct members — one is not an alias of the other", () => {
+    /*
+     * Kubernetes is the structured runbook step (restart/scale + credential);
+     * Kubectl is the AI-only single-argv step tiered by KubectlPolicy. The
+     * Runner routes them to different executors, so they must never collapse
+     * into one value.
+     */
+    expect(RunbookStepType.Kubectl).not.toBe(RunbookStepType.Kubernetes);
   });
 });
 
 describe("RUNNER_EXECUTED_STEP_TYPES", () => {
-  test("contains exactly JavaScript, Bash, SSH and Kubernetes", () => {
+  test("contains exactly JavaScript, Bash, SSH, Kubernetes and Kubectl", () => {
     /*
      * Pinned as an exact list, order included. This array is the whole
      * definition of "work a Runner may be handed" — a silent addition would
@@ -76,16 +96,31 @@ describe("RUNNER_EXECUTED_STEP_TYPES", () => {
       RunbookStepType.Bash,
       RunbookStepType.SSH,
       RunbookStepType.Kubernetes,
+      RunbookStepType.Kubectl,
     ]);
   });
 
-  test("has exactly four entries and no duplicates", () => {
-    expect(RUNNER_EXECUTED_STEP_TYPES).toHaveLength(4);
+  test("has exactly five entries and no duplicates", () => {
+    expect(RUNNER_EXECUTED_STEP_TYPES).toHaveLength(5);
     expect(new Set(RUNNER_EXECUTED_STEP_TYPES).size).toBe(
       RUNNER_EXECUTED_STEP_TYPES.length,
     );
   });
 
+  test("places Kubectl last, right after the structured Kubernetes step", () => {
+    /*
+     * Kubectl was appended, not inserted: the order is part of the pinned
+     * contract above, and a Runner built before the lane existed must never
+     * find it ahead of the types it does implement.
+     */
+    expect(RUNNER_EXECUTED_STEP_TYPES.indexOf(RunbookStepType.Kubectl)).toBe(
+      RUNNER_EXECUTED_STEP_TYPES.length - 1,
+    );
+    expect(RUNNER_EXECUTED_STEP_TYPES.indexOf(RunbookStepType.Kubernetes)).toBe(
+      RUNNER_EXECUTED_STEP_TYPES.indexOf(RunbookStepType.Kubectl) - 1,
+    );
+  });
+
   test("every entry is a real member of the enum", () => {
     /*
      * The array is typed Array<RunbookStepType>, but the values reach the
@@ -110,6 +145,16 @@ describe("RUNNER_EXECUTED_STEP_TYPES", () => {
     expect(RUNNER_EXECUTED_STEP_TYPES).toContain(RunbookStepType.SSH);
     expect(RUNNER_EXECUTED_STEP_TYPES).toContain(RunbookStepType.Kubernetes);
   });
+
+  test("holds Kubectl — the only way an AI kubectl command reaches a cluster", () => {
+    /*
+     * The Worker never runs kubectl itself: every AI kubectl command, read
+     * or write, is a RunnerJob a cluster-bound Runner claims. Dropping
+     * Kubectl from this lane would make RunnerJobService refuse to enqueue
+     * it, and the cluster lane would silently do nothing.
+     */
+    expect(RUNNER_EXECUTED_STEP_TYPES).toContain(RunbookStepType.Kubectl);
+  });
 });
 
 describe("isRunnerExecutedStepType", () => {
@@ -118,6 +163,7 @@ describe("isRunnerExecutedStepType", () => {
     RunbookStepType.Bash,
     RunbookStepType.SSH,
     RunbookStepType.Kubernetes,
+    RunbookStepType.Kubectl,
   ])("%s runs on a Runner", (type: RunbookStepType) => {
     expect(isRunnerExecutedStepType(type)).toBe(true);
   });
@@ -223,6 +269,9 @@ describe("isRunnerExecutedStepType", () => {
       " SSH",
       "kubernetes",
       "KUBERNETES",
+      "kubectl",
+      "KUBECTL",
+      "Kubectl ",
       "bash",
       "JAVASCRIPT",
     ];
@@ -254,19 +303,41 @@ describe("isRunnerExecutedStepType", () => {
  * column: an empty string is falsy, so the required-column check rejected
  * every SSH and Kubernetes job at create() with "script is required". The rule
  * is per-type and cannot be written as column metadata, so it lives in
- * RunnerJobService.enqueue and reads this list.
+ * RunnerJobService.enqueue and reads this list. A Kubectl job is the same
+ * shape: an argv (never a shell line) plus the cluster and an optional
+ * credential, so it carries a payload too.
  */
 describe("PAYLOAD_CARRYING_STEP_TYPES", () => {
-  test("contains exactly SSH and Kubernetes", () => {
+  test("contains exactly SSH, Kubernetes and Kubectl", () => {
     expect(PAYLOAD_CARRYING_STEP_TYPES).toEqual([
       RunbookStepType.SSH,
       RunbookStepType.Kubernetes,
+      RunbookStepType.Kubectl,
     ]);
     expect(new Set(PAYLOAD_CARRYING_STEP_TYPES).size).toBe(
       PAYLOAD_CARRYING_STEP_TYPES.length,
     );
   });
 
+  test("places Kubectl last, after Kubernetes", () => {
+    expect(PAYLOAD_CARRYING_STEP_TYPES.indexOf(RunbookStepType.Kubectl)).toBe(
+      PAYLOAD_CARRYING_STEP_TYPES.length - 1,
+    );
+    expect(
+      PAYLOAD_CARRYING_STEP_TYPES.indexOf(RunbookStepType.Kubernetes),
+    ).toBe(PAYLOAD_CARRYING_STEP_TYPES.indexOf(RunbookStepType.Kubectl) - 1);
+  });
+
+  test("Kubectl never carries a script — an argv payload is the whole point", () => {
+    /*
+     * A kubectl command handed to a Runner as a shell line would reopen every
+     * shell-injection door the argv payload closes. Being payload-carrying
+     * is what makes RunnerJobService.enqueue accept an empty script for it.
+     */
+    expect(PAYLOAD_CARRYING_STEP_TYPES).toContain(RunbookStepType.Kubectl);
+    expect(isPayloadCarryingStepType(RunbookStepType.Kubectl)).toBe(true);
+  });
+
   test("every entry is also a Runner-executed type", () => {
     /*
      * A payload-carrying type that the Worker executes would be a
@@ -279,12 +350,13 @@ describe("PAYLOAD_CARRYING_STEP_TYPES", () => {
 });
 
 describe("isPayloadCarryingStepType", () => {
-  test.each([RunbookStepType.SSH, RunbookStepType.Kubernetes])(
-    "%s carries a payload rather than a script",
-    (type: RunbookStepType) => {
-      expect(isPayloadCarryingStepType(type)).toBe(true);
-    },
-  );
+  test.each([
+    RunbookStepType.SSH,
+    RunbookStepType.Kubernetes,
+    RunbookStepType.Kubectl,
+  ])("%s carries a payload rather than a script", (type: RunbookStepType) => {
+    expect(isPayloadCarryingStepType(type)).toBe(true);
+  });
 
   test.each([RunbookStepType.Bash, RunbookStepType.JavaScript])(
     "%s carries a script rather than a payload",
@@ -354,6 +426,9 @@ describe("isPayloadCarryingStepType", () => {
       "ssh",
       "SSH ",
       "kubernetes",
+      "kubectl",
+      "KUBECTL",
+      " Kubectl",
       "Docker",
       null,
       undefined,

package/Tests/Types/Runner/RunnerLiveStatus.test.ts

@@ -304,8 +304,15 @@ describe("the alive window is shared with the server", () => {
    * Guards the reason the UI stopped trusting the column at all: if someone
    * later adds a job that ages connectionStatus out, this test failing is the
    * prompt to revisit the derived status.
+   *
+   * Two writers are legitimate and neither is an ageing-out job: the
+   * onBeforeCreate default, and markDisconnected — the Runner's own explicit
+   * sign-off on a clean shutdown, which a kubernetes-agent registration reads
+   * to admit a replacement pod at once instead of waiting for the alive window
+   * to lapse. The dashboard keeps deriving liveness from lastAlive; a sign-off
+   * never ages anything out on its own.
    */
-  test("nothing in RunnerService writes connectionStatus back to Disconnected", () => {
+  test("only the create default and the Runner's own sign-off write connectionStatus to Disconnected", () => {
     const source: string = fs.readFileSync(RUNNER_SERVICE, "utf8");
 
     const disconnectedWrites: number = (
@@ -314,7 +321,11 @@ describe("the alive window is shared with the server", () => {
       ) || []
     ).length;
 
-    // Exactly one: the onBeforeCreate default. No ageing-out writer exists.
-    expect(disconnectedWrites).toBe(1);
+    // Exactly two: the onBeforeCreate default and markDisconnected.
+    expect(disconnectedWrites).toBe(2);
+    expect(source).toMatch(/public async markDisconnected\(/);
+
+    // Still no timer, cron or ageing-out job touches the column.
+    expect(source).not.toMatch(/setInterval|cron|ageOut|markStale/i);
   });
 });

package/Tests/Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog.test.ts

@@ -124,6 +124,21 @@ describe("SecurityEventConnectorCatalog - one definition per provider", () => {
 
     expect(new Set(paths).size).toBe(paths.length);
   });
+
+  /*
+   * The icon is a product's only mark beside its name in the Add connection
+   * picker and the Connections empty state. Three providers used to share
+   * one shield, which read as a mistake in a list of eight.
+   */
+  test("icons are unique so no two providers look alike in the picker or the empty state", () => {
+    const icons: Array<IconProp> = SecurityEventConnectorCatalog.map(
+      (definition: SecurityEventConnectorDefinition): IconProp => {
+        return definition.icon;
+      },
+    );
+
+    expect(new Set(icons).size).toBe(icons.length);
+  });
 });
 
 describe.each(DEFINITION_CASES)(