@oneuptime/common 14.0.8 → 14.0.10

package/Server/Infrastructure/Postgres/SchemaMigrations/1796300000000-AddResourceAiAgents.ts

@@ -0,0 +1,423 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Resource AI agents: OneUptime AI access to Docker and Podman hosts, Docker
+ * Swarm, Proxmox and Ceph clusters, VMware vCenters, database servers and
+ * hosts, through the AI agent installed next to each one — the same
+ * strategy as the Kubernetes AI agent, whose tables this does not touch.
+ *
+ * Schema only (generated):
+ *   - ResourceAiAgent: one row per resource for its AI agent (its own
+ *     identity, never a Runner). Polymorphic: keyed by (resourceType,
+ *     resourceId) with NO foreign key on resourceId, which points into a
+ *     different table for every resource type; unique per live resource;
+ *     cascades with its project.
+ *   - RunnerJob.targetResourceAiAgentId: the agent an AI resource command
+ *     (step type ResourceCommand) is targeted at (SET NULL when the agent
+ *     row goes), and RunnerJob.resourceType / resourceId: the resource it
+ *     ran against, for the resource's AI page.
+ *   - AutoRemediationSuggestion.resourceType / resourceId: the resource
+ *     whose AI remediation mode produced a suggestion (no rule).
+ *   - The AI access columns of DockerHost, PodmanHost, CephCluster,
+ *     ProxmoxCluster, DockerSwarmCluster, VMwareVCenter, Host and
+ *     DatabaseServer: isAiInvestigationEnabled (default false),
+ *     aiRemediationMode (default Disabled), aiCommandAllowlist and the
+ *     server-written aiAccessLastVerifiedAt, aiAccessLastError and
+ *     aiAccessConfiguredAt.
+ *
+ * No data is rewritten: every existing resource starts with AI switched
+ * off, exactly like a new one. down() reverses the schema.
+ */
+export class AddResourceAiAgents1796300000000 implements MigrationInterface {
+  public name: string = "AddResourceAiAgents1796300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "ResourceAiAgent" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "resourceType" character varying(100) NOT NULL, "resourceId" uuid NOT NULL, "resourceIdentifier" character varying(500), "keyHash" character varying(100), "agentVersion" character varying(100), "posture" jsonb, "lastAliveAt" TIMESTAMP WITH TIME ZONE, "connectionStatus" character varying(100) NOT NULL DEFAULT 'disconnected', "lastRegisteredAt" TIMESTAMP WITH TIME ZONE, "registeredWithIngestionKeyId" uuid, "lastRefusedRegistrationAt" TIMESTAMP WITH TIME ZONE, "lastRefusedRegistrationReason" character varying(100), CONSTRAINT "PK_b24310cc7f12a4385d678d49eea" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_e61bd0e258b87311cc21cbaa95" ON "ResourceAiAgent" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_06d7eb39aceb586c3c5565882b" ON "ResourceAiAgent" ("resourceType") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_b5a1c152c918d42ef96c6a9a1c" ON "ResourceAiAgent" ("resourceId") `,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_ResourceAiAgent_projectId_resourceType_resourceId" ON "ResourceAiAgent" ("projectId", "resourceType", "resourceId") WHERE "deletedAt" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "aiCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD "resourceType" character varying(100)`,
+    );
+    await queryRunner.query(`ALTER TABLE "RunnerJob" ADD "resourceId" uuid`);
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD "targetResourceAiAgentId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" ADD "resourceType" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" ADD "resourceId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_78a02785a95c03f9c7d542f21d" ON "RunnerJob" ("resourceType") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_223854e59d60c3d9ece3cce60a" ON "RunnerJob" ("resourceId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_82b8db95070bbd7b3bbe3fb850" ON "RunnerJob" ("targetResourceAiAgentId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_ebdb04eb0e2b9cbdc7d0b664ff" ON "AutoRemediationSuggestion" ("resourceType") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_2ecbd56658be5035f3bdfe6937" ON "AutoRemediationSuggestion" ("resourceId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ResourceAiAgent" ADD CONSTRAINT "FK_e61bd0e258b87311cc21cbaa95b" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD CONSTRAINT "FK_82b8db95070bbd7b3bbe3fb8509" FOREIGN KEY ("targetResourceAiAgentId") REFERENCES "ResourceAiAgent"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP CONSTRAINT "FK_82b8db95070bbd7b3bbe3fb8509"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ResourceAiAgent" DROP CONSTRAINT "FK_e61bd0e258b87311cc21cbaa95b"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_2ecbd56658be5035f3bdfe6937"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_ebdb04eb0e2b9cbdc7d0b664ff"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_82b8db95070bbd7b3bbe3fb850"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_223854e59d60c3d9ece3cce60a"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_78a02785a95c03f9c7d542f21d"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" DROP COLUMN "resourceId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" DROP COLUMN "resourceType"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP COLUMN "targetResourceAiAgentId"`,
+    );
+    await queryRunner.query(`ALTER TABLE "RunnerJob" DROP COLUMN "resourceId"`);
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP COLUMN "resourceType"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DatabaseServer" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Host" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "VMwareVCenter" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerSwarmCluster" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxCluster" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CephCluster" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanHost" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "aiCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DockerHost" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_ResourceAiAgent_projectId_resourceType_resourceId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_b5a1c152c918d42ef96c6a9a1c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_06d7eb39aceb586c3c5565882b"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_e61bd0e258b87311cc21cbaa95"`,
+    );
+    await queryRunner.query(`DROP TABLE "ResourceAiAgent"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -20,6 +20,10 @@ import { AddStatusPageSubscriberUnsubscribeToken1795600000000 } from "./17956000
 import { AddStatusPageSubscriberIsAddedByTeam1795700000000 } from "./1795700000000-AddStatusPageSubscriberIsAddedByTeam";
 import { AddIncidentCustomFieldCreateAndNotificationSettings1795800000000 } from "./1795800000000-AddIncidentCustomFieldCreateAndNotificationSettings";
 import { AddSubscriberNotificationClaimedAt1795900000000 } from "./1795900000000-AddSubscriberNotificationClaimedAt";
+import { AddTeamComplianceRuleScope1796000000000 } from "./1796000000000-AddTeamComplianceRuleScope";
+import { AddKubernetesAiAgentAndAiDefaults1796100000000 } from "./1796100000000-AddKubernetesAiAgentAndAiDefaults";
+import { AddProxmoxResourceNativePushColumns1796200000000 } from "./1796200000000-AddProxmoxResourceNativePushColumns";
+import { AddResourceAiAgents1796300000000 } from "./1796300000000-AddResourceAiAgents";
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
@@ -1240,4 +1244,8 @@ export default [
   AddStatusPageSubscriberIsAddedByTeam1795700000000,
   AddIncidentCustomFieldCreateAndNotificationSettings1795800000000,
   AddSubscriberNotificationClaimedAt1795900000000,
+  AddTeamComplianceRuleScope1796000000000,
+  AddKubernetesAiAgentAndAiDefaults1796100000000,
+  AddProxmoxResourceNativePushColumns1796200000000,
+  AddResourceAiAgents1796300000000,
 ];

package/Server/Infrastructure/Semaphore.ts

@@ -21,6 +21,20 @@ export default class Semaphore {
     acquireTimeout?: number | undefined;
     acquireAttemptsLimit?: number | undefined;
     retryInterval?: number | undefined;
+    /*
+     * How often a held lock is re-asserted. redis-semaphore defaults to 80%
+     * of lockTimeout, which is also how long `mutex.isAcquired` can go on
+     * reading true after the lock was lost (a Valkey restart, an eviction):
+     * it only changes when a refresh fails. A holder that polls isAcquired
+     * between steps wants this well under lockTimeout.
+     */
+    refreshInterval?: number | undefined;
+    /*
+     * Called when a refresh finds the lock gone. By default redis-semaphore
+     * throws from its refresh timer, which nothing can catch and which ends
+     * up as an unhandled rejection; a long-running holder should pass one.
+     */
+    onLockLost?: ((err: Error) => void) | undefined;
   }): Promise<SemaphoreMutex> {
     if (!data.lockTimeout) {
       data.lockTimeout = 5000;
@@ -52,6 +66,14 @@ export default class Semaphore {
       lockOptions.retryInterval = data.retryInterval;
     }
 
+    if (data.refreshInterval) {
+      lockOptions.refreshInterval = data.refreshInterval;
+    }
+
+    if (data.onLockLost) {
+      lockOptions.onLockLost = data.onLockLost;
+    }
+
     const mutex: SemaphoreMutex = new Mutex(
       client,
       data.namespace + "-" + key,

package/Server/Middleware/TelemetryIngest.ts

@@ -14,6 +14,7 @@ import TelemetryIngestionKeyPolicy, {
 import TelemetryIngestionKeyType from "../../Types/Telemetry/TelemetryIngestionKeyType";
 import TelemetryIngestSurface, {
   BROWSER_ALLOWED_INGEST_SURFACES,
+  IDENTITY_REGISTRATION_SURFACES,
   getIngestSurfaceReadableName,
 } from "../../Types/Telemetry/TelemetryIngestSurface";
 import OriginAllowList from "../../Utils/Telemetry/OriginAllowList";
@@ -72,14 +73,41 @@ const COUNTER_UNAVAILABLE_LOG_INTERVAL_MS: number = 60 * 1000;
 const UNNAMED_SURFACE_READABLE_NAME: string = "this ingest endpoint";
 
 /*
- * The ceiling a server key gets on the Kubernetes agent Runner registration
- * surface when its policy names none. Registration is a handful of calls
- * per agent pod lifetime (start-up, then heartbeats through the Runner's
- * own credential), so a leaked ingestion key hammering it is abuse, not
+ * The ceiling a server key gets on an identity registration surface
+ * (IDENTITY_REGISTRATION_SURFACES: the Kubernetes agent Runner, the
+ * Kubernetes AI agent and the resource AI agents) when its policy names
+ * none. Registration is a handful
+ * of calls per pod lifetime (start-up, then heartbeats through the minted
+ * identity's own key), so a leaked ingestion key hammering it is abuse, not
  * traffic - unlike OTLP ingest, where "no limit" is the historical contract
  * and must stay that way. An explicit per-key limit still wins.
  */
-export const DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE: number = 30;
+export const DEFAULT_IDENTITY_REGISTRATION_REQUESTS_PER_MINUTE: number = 30;
+
+// The name this ceiling shipped under, when only the Runner registered.
+export const DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE: number =
+  DEFAULT_IDENTITY_REGISTRATION_REQUESTS_PER_MINUTE;
+
+/*
+ * The refusal a service-pinned key gets on an identity registration surface.
+ * Worded for whichever identity the surface mints, and it never names the
+ * key, its pinned service or anything else about it. The Kubernetes
+ * surfaces keep their wording exactly; a resource AI agent (Docker, Proxmox,
+ * a database, a host, ...) is told about infrastructure instead.
+ */
+export const getPinnedKeyRegistrationRefusalMessage: (
+  surface: TelemetryIngestSurface,
+) => string = (surface: TelemetryIngestSurface): string => {
+  if (surface === TelemetryIngestSurface.ResourceAiAgent) {
+    return `This telemetry ingestion key is pinned to a single service, so it cannot be used for ${getIngestSurfaceReadableName(
+      surface,
+    )}: that grants access to your infrastructure, not to one service's telemetry. Use an unpinned server ingestion key for the AI agent.`;
+  }
+
+  return `This telemetry ingestion key is pinned to a single service, so it cannot be used for ${getIngestSurfaceReadableName(
+    surface,
+  )}: that grants access to a Kubernetes cluster, not to one service's telemetry. Use an unpinned server ingestion key for the Kubernetes agent.`;
+};
 
 type GetEffectiveRequestsPerMinuteLimitFunction = (
   policy: TelemetryIngestionKeyPolicy,
@@ -101,11 +129,14 @@ type GetEffectiveRequestsPerMinuteLimitFunction = (
  * with no ceiling is the thing we are trying to stop shipping: "the customer
  * did not configure a limit" cannot be allowed to mean "unlimited" there.
  *
- * The one surface-dependent case is Kubernetes agent Runner registration:
- * a server key with no configured limit is held to a conservative default
- * there (see DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE), because
- * that endpoint mints Runner identities rather than accepting telemetry.
- * Every other surface keeps the server-key contract above untouched.
+ * The one surface-dependent case is identity registration
+ * (IDENTITY_REGISTRATION_SURFACES: the Kubernetes agent Runner, the
+ * Kubernetes AI agent and the resource AI agents): a server key with no
+ * configured limit is held to a
+ * conservative default there (see
+ * DEFAULT_IDENTITY_REGISTRATION_REQUESTS_PER_MINUTE), because those
+ * endpoints mint identities rather than accepting telemetry. Every other
+ * surface keeps the server-key contract above untouched.
  */
 export const getEffectiveRequestsPerMinuteLimit: GetEffectiveRequestsPerMinuteLimitFunction =
   (
@@ -129,8 +160,8 @@ export const getEffectiveRequestsPerMinuteLimit: GetEffectiveRequestsPerMinuteLi
       return DEFAULT_BROWSER_KEY_REQUESTS_PER_MINUTE;
     }
 
-    if (surface === TelemetryIngestSurface.KubernetesAgentRunner) {
-      return DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE;
+    if (surface && IDENTITY_REGISTRATION_SURFACES.has(surface)) {
+      return DEFAULT_IDENTITY_REGISTRATION_REQUESTS_PER_MINUTE;
     }
 
     return null;
@@ -460,22 +491,24 @@ export default class TelemetryIngest {
       }
 
       /*
-       * Kubernetes agent Runner registration mints a Runner identity — the
-       * one every kubectl job for a cluster is targeted at — so it takes a
-       * project-wide server key. A key pinned to one service's name was
-       * scoped by its owner to that service's telemetry; it is refused here
+       * An identity registration surface (the Kubernetes agent Runner, the
+       * Kubernetes AI agent) mints the identity every kubectl job for a
+       * cluster is targeted at, so it takes a project-wide server key. A key
+       * pinned to one service's name was scoped by its owner to that
+       * service's telemetry; it is refused here, before the rate limiter,
        * rather than letting it stand up cluster access it was never meant
        * to reach.
        */
       if (
-        surface === TelemetryIngestSurface.KubernetesAgentRunner &&
+        surface &&
+        IDENTITY_REGISTRATION_SURFACES.has(surface) &&
         policy.pinnedServiceName
       ) {
         return Response.sendErrorResponse(
           req,
           res,
           new NotAuthorizedException(
-            "This telemetry ingestion key is pinned to a single service, so it cannot register the Kubernetes agent's in-cluster Runner. Use an unpinned server ingestion key for the Kubernetes agent.",
+            getPinnedKeyRegistrationRefusalMessage(surface),
           ),
         );
       }