@oneuptime/common 14.0.8 → 14.0.10

package/Tests/App/Dashboard/RunbookStepTypeMaps.test.ts

@@ -90,8 +90,9 @@ function keysIn(block: string): Array<string> {
 }
 
 describe("Runbook step-type maps", () => {
-  test("the enum has the kubectl member the maps must cover", () => {
+  test("the enum has the AI-only members the maps must cover", () => {
     expect(STEP_TYPES).toContain(RunbookStepType.Kubectl);
+    expect(STEP_TYPES).toContain(RunbookStepType.ResourceCommand);
   });
 
   for (const map of MAPS) {
@@ -129,23 +130,53 @@ describe("Runbook step-type maps", () => {
     expect(kubectlEntry).toMatch(/description:\s*\n?\s*"[^"]+"/);
   });
 
+  test("the resource command entries name it as an AI agent command", () => {
+    const executionView: string = readSource("ExecutionView.tsx");
+    const steps: string = readSource("Steps.tsx");
+
+    expect(
+      cutBlock(
+        executionView,
+        "const STEP_TYPE_LABEL: Record<RunbookStepType, string> = {",
+      ),
+    ).toContain('[RunbookStepType.ResourceCommand]: "AI agent command"');
+
+    const meta: string = cutBlock(
+      steps,
+      "const STEP_TYPE_META: Record<RunbookStepType, StepTypeMeta> = {",
+    );
+    const resourceEntry: string = meta.slice(
+      meta.indexOf("[RunbookStepType.ResourceCommand]"),
+    );
+
+    expect(resourceEntry).toContain('label: "Resource command"');
+    expect(resourceEntry).toContain('shortLabel: "AI agent"');
+    expect(resourceEntry).toContain("icon: IconProp.");
+    expect(resourceEntry).toMatch(/description:\s*\n?\s*"[^"]+"/);
+  });
+
   /*
-   * Kubectl steps are composed by OneUptime AI only (RunbookStepType says
-   * so): the editor must render one that exists but must not offer it as
-   * something to add. Every other type stays offered, so a new authored
-   * type cannot be forgotten by the picker.
+   * Kubectl and ResourceCommand steps are composed by OneUptime AI only
+   * (RunbookStepType says so): the editor must render one that exists but
+   * must not offer it as something to add. Every other type stays offered,
+   * so a new authored type cannot be forgotten by the picker.
    */
-  test("the step picker offers every step type except Kubectl", () => {
+  test("the step picker offers every step type except the AI-only ones", () => {
     const picker: string = cutBlock(
       readSource("Steps.tsx"),
       "const ALL_STEP_TYPES: RunbookStepType[] = [",
     );
     const offered: Array<string> = keysInList(picker);
+    const aiOnly: Array<RunbookStepType> = [
+      RunbookStepType.Kubectl,
+      RunbookStepType.ResourceCommand,
+    ];
 
     expect(offered).not.toContain(RunbookStepType.Kubectl);
+    expect(offered).not.toContain(RunbookStepType.ResourceCommand);
     expect([...offered].sort()).toEqual(
       STEP_TYPES.filter((type: RunbookStepType): boolean => {
-        return type !== RunbookStepType.Kubectl;
+        return !aiOnly.includes(type);
       }).sort(),
     );
   });

package/Tests/App/Dashboard/RunnerKubernetesAgentForm.test.tsx

@@ -559,7 +559,14 @@ describe("the Runner pages, rendered", () => {
     );
   }
 
-  async function clickRowAction(
+  /*
+   * A row's actions are one button and a ⋯ menu holding the rest
+   * (RowActions). On this table "View" is the button, so "Edit" is in the
+   * menu. The menu is portalled to document.body so the table's scroller
+   * cannot clip it, which is why it is found through `screen` and not
+   * inside the row - and why only one menu is ever open to find.
+   */
+  async function clickRowMenuAction(
     rowName: string,
     action: string,
   ): Promise<void> {
@@ -572,7 +579,16 @@ describe("the Runner pages, rendered", () => {
     if (!row) {
       throw new Error(`"${rowName}" is not in a table row.`);
     }
-    fireEvent.click(within(row).getByText(action));
+    const trigger: HTMLElement | null = within(row).queryByTestId(
+      "row-actions-more-button",
+    );
+    if (!trigger) {
+      throw new Error(`"${rowName}" has no ⋯ menu on its row.`);
+    }
+    fireEvent.click(trigger);
+    fireEvent.click(
+      within(screen.getByRole("menu")).getByRole("menuitem", { name: action }),
+    );
   }
 
   async function openDialog(firstField: string): Promise<HTMLElement> {
@@ -598,7 +614,7 @@ describe("the Runner pages, rendered", () => {
   test("the list page's edit form on an agent row leaves out the name; create and the next edit do not", async () => {
     openRunnersPage();
 
-    await clickRowAction("kubernetes-agent/prod-east", "Edit");
+    await clickRowMenuAction("kubernetes-agent/prod-east", "Edit");
     const editDialog: HTMLElement = await openDialog("Description");
     expect(hasFieldTitled(editDialog, "Name")).toBe(false);
     expect(editDialog).toHaveTextContent(AGENT_NOTE_START);
@@ -614,7 +630,7 @@ describe("the Runner pages, rendered", () => {
     await closeDialog(createDialog);
 
     // The next edit follows its own row: an ordinary Runner keeps its name.
-    await clickRowAction("bash-runner", "Edit");
+    await clickRowMenuAction("bash-runner", "Edit");
     const hostDialog: HTMLElement = await openDialog("Description");
     expect(hasFieldTitled(hostDialog, "Name")).toBe(true);
     expect(hostDialog).not.toHaveTextContent(AGENT_NOTE_START);

package/Tests/App/Dashboard/RunnerSupersededByAiAgentNote.test.tsx

@@ -0,0 +1,296 @@
+import "@testing-library/jest-dom";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { cleanup, render, screen } from "@testing-library/react";
+import React from "react";
+import { MemoryRouter } from "react-router-dom";
+import RunnerView from "../../../../App/FeatureSet/Dashboard/src/Pages/Settings/RunnerView";
+import {
+  KUBERNETES_AGENT_RUNNER_SUPERSEDED_NOTE,
+  NO_RUNNER_FORM_RESTRICTIONS,
+  RunnerFormRestrictions,
+  getKubernetesAgentRunnerFormNote,
+  getRunnerFormFields,
+  getRunnerFormRestrictions,
+  getRunnerTableFormFields,
+} from "../../../../App/FeatureSet/Dashboard/src/Pages/Settings/RunnerFormFields";
+import PageMap from "../../../../App/FeatureSet/Dashboard/src/Utils/PageMap";
+import RouteMap from "../../../../App/FeatureSet/Dashboard/src/Utils/RouteMap";
+import Runner from "../../../Models/DatabaseModels/Runner";
+import Route from "../../../Types/API/Route";
+import ListResult from "../../../Types/BaseDatabase/ListResult";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import Permission from "../../../Types/Permission";
+import Field from "../../../UI/Components/Forms/Types/Field";
+import Fields from "../../../UI/Components/Forms/Types/Fields";
+import ModelAPI from "../../../UI/Utils/ModelAPI/ModelAPI";
+import PermissionUtil from "../../../UI/Utils/Permission";
+import User from "../../../UI/Utils/User";
+import { goTo, PROJECT_ID } from "./SideMenuHarness";
+
+jest.mock("react-i18next", () => {
+  return {
+    useTranslation: () => {
+      return {
+        t: (value: string): string => {
+          return value;
+        },
+      };
+    },
+  };
+});
+
+/*
+ * The Kubernetes AI agent — its own identity, never a Runner row — replaced
+ * the in-cluster Runner the Kubernetes agent chart used to install, and the
+ * server refuses that legacy Runner's registration while the agent is
+ * online. The legacy rows keep their existing guards; their note now also
+ * says they are superseded, what to do (upgrade the chart), and when the row
+ * can go (once the AI agent is connected). Ordinary Runners say nothing of
+ * the sort.
+ */
+
+const WAIT_TIMEOUT: number = 20000;
+
+const AGENT_RUNNER_ID: string = "66666666-0000-4000-8000-0000000000a1";
+const HOST_RUNNER_ID: string = "66666666-0000-4000-8000-0000000000a2";
+const RENAMED_AGENT_RUNNER_ID: string = "66666666-0000-4000-8000-0000000000a3";
+
+const AGENT_POSTURE: JSONObject = {
+  kubernetes: {
+    inCluster: true,
+    allowWrites: false,
+    clusterIdentifier: "prod-east",
+  },
+};
+
+const PERMISSIONS: Array<Permission> = [
+  Permission.Public,
+  Permission.User,
+  Permission.CurrentUser,
+  Permission.ProjectAdmin,
+];
+
+function makeRunnerRow(
+  id: string,
+  name: string,
+  hostInfo?: JSONObject,
+): Runner {
+  return Object.assign(new Runner(), {
+    _id: id,
+    name,
+    description: "",
+    key: "runner-key",
+    canRunRunbooks: false,
+    canRunCodeFixTasks: false,
+    canRunAiCommands: true,
+    lastAlive: new Date("2026-09-23T10:00:00Z"),
+    ...(hostInfo ? { hostInfo } : {}),
+  });
+}
+
+const ROWS: Array<Runner> = [
+  makeRunnerRow(AGENT_RUNNER_ID, "kubernetes-agent/prod-east", AGENT_POSTURE),
+  makeRunnerRow(HOST_RUNNER_ID, "bash-runner"),
+  makeRunnerRow(RENAMED_AGENT_RUNNER_ID, "prod-east-kubectl", AGENT_POSTURE),
+];
+
+function rowById(id: string): Runner {
+  return ROWS.find((row: Runner): boolean => {
+    return String(row._id) === id;
+  })!;
+}
+
+describe("the superseded sentence", () => {
+  test("names the replacement, the step and when the row can go", () => {
+    expect(KUBERNETES_AGENT_RUNNER_SUPERSEDED_NOTE).toContain(
+      "superseded by the Kubernetes AI agent",
+    );
+    expect(KUBERNETES_AGENT_RUNNER_SUPERSEDED_NOTE).toContain(
+      "upgrade the Kubernetes agent chart",
+    );
+    expect(KUBERNETES_AGENT_RUNNER_SUPERSEDED_NOTE).toContain(
+      "this Runner can be deleted once the AI agent is connected",
+    );
+  });
+
+  test.each<[string, RunnerFormRestrictions]>([
+    [
+      "name and switches locked",
+      { isNameLocked: true, areShellCapabilitiesLocked: true },
+    ],
+    [
+      "switches locked (an agent by posture alone)",
+      { isNameLocked: false, areShellCapabilitiesLocked: true },
+    ],
+    [
+      "name locked only",
+      { isNameLocked: true, areShellCapabilitiesLocked: false },
+    ],
+  ])(
+    "ends every kubernetes-agent row's note: %s",
+    (_label: string, restrictions: RunnerFormRestrictions) => {
+      const note: string | null =
+        getKubernetesAgentRunnerFormNote(restrictions);
+
+      expect(note).not.toBeNull();
+      // The existing explanation is kept, first.
+      expect(note).toMatch(
+        /^This is the in-cluster Runner the Kubernetes agent chart installed\./,
+      );
+      expect(note).toContain("OneUptime refuses those changes");
+      expect(note!.endsWith(KUBERNETES_AGENT_RUNNER_SUPERSEDED_NOTE)).toBe(
+        true,
+      );
+    },
+  );
+
+  test("is not said about an ordinary Runner", () => {
+    expect(
+      getKubernetesAgentRunnerFormNote(NO_RUNNER_FORM_RESTRICTIONS),
+    ).toBeNull();
+    expect(
+      getKubernetesAgentRunnerFormNote(
+        getRunnerFormRestrictions(rowById(HOST_RUNNER_ID)),
+      ),
+    ).toBeNull();
+  });
+
+  test("reaches the edit forms of both Runner pages on a legacy row", () => {
+    for (const row of [
+      rowById(AGENT_RUNNER_ID),
+      rowById(RENAMED_AGENT_RUNNER_ID),
+    ]) {
+      const restrictions: RunnerFormRestrictions =
+        getRunnerFormRestrictions(row);
+
+      const detailForm: Fields<Runner> = getRunnerFormFields({
+        withSteps: false,
+        restrictions,
+      });
+      const listEditForm: Fields<Runner> = getRunnerTableFormFields(
+        restrictions,
+      ).filter((field: Field<Runner>): boolean => {
+        return !field.doNotShowWhenEditing;
+      });
+
+      for (const fields of [detailForm, listEditForm]) {
+        const described: Array<string> = fields
+          .map((field: Field<Runner>): string => {
+            return String(field.sectionDescription || "");
+          })
+          .filter((description: string): boolean => {
+            return description.length > 0;
+          });
+        expect(described.length).toBe(1);
+        expect(described[0]).toContain(KUBERNETES_AGENT_RUNNER_SUPERSEDED_NOTE);
+      }
+    }
+  });
+
+  test("never reaches the create form", () => {
+    const createForm: Fields<Runner> = getRunnerTableFormFields(
+      getRunnerFormRestrictions(rowById(AGENT_RUNNER_ID)),
+    ).filter((field: Field<Runner>): boolean => {
+      return !field.doNotShowWhenCreating;
+    });
+
+    for (const field of createForm) {
+      expect(String(field.sectionDescription || "")).not.toContain(
+        "superseded",
+      );
+    }
+  });
+});
+
+describe("the Runner detail page", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+    window.sessionStorage.clear();
+    jest.spyOn(User, "isMasterAdmin").mockReturnValue(false);
+    jest
+      .spyOn(PermissionUtil, "getAllPermissions")
+      .mockReturnValue(PERMISSIONS);
+    jest.spyOn(PermissionUtil, "getGlobalPermissions").mockReturnValue(null);
+    jest.spyOn(PermissionUtil, "getProjectPermissions").mockReturnValue({
+      projectId: new ObjectID(PROJECT_ID),
+      userId: ObjectID.generate(),
+      permissions: PERMISSIONS.map((permission: Permission) => {
+        return {
+          permission: permission,
+          labelIds: [],
+          _type: "UserPermission",
+        };
+      }),
+      _type: "UserTenantAccessPermission",
+    } as unknown as ReturnType<typeof PermissionUtil.getProjectPermissions>);
+
+    jest
+      .spyOn(ModelAPI, "getItem")
+      .mockImplementation(async (args: unknown): Promise<Runner | null> => {
+        return rowById(String((args as { id?: unknown }).id)) || null;
+      });
+    jest
+      .spyOn(ModelAPI, "getList")
+      .mockImplementation(async (): Promise<ListResult<Runner>> => {
+        return { data: [], count: 0, skip: 0, limit: 10 };
+      });
+    jest
+      .spyOn(ModelAPI, "count")
+      .mockImplementation(async (): Promise<number> => {
+        return 0;
+      });
+  });
+
+  afterEach(() => {
+    cleanup();
+    jest.restoreAllMocks();
+  });
+
+  function openRunnerView(runnerId: string): void {
+    const path: string = `/dashboard/${PROJECT_ID}/settings/runners/${runnerId}`;
+    goTo(path);
+    render(
+      <MemoryRouter initialEntries={[path]}>
+        <RunnerView
+          pageRoute={RouteMap[PageMap.SETTINGS_RUNNER_VIEW] as Route}
+          currentProject={null}
+          hasPaymentMethod={true}
+        />
+      </MemoryRouter>,
+    );
+  }
+
+  test("says a legacy kubernetes-agent Runner is superseded", async () => {
+    openRunnerView(AGENT_RUNNER_ID);
+
+    const note: HTMLElement = await screen.findByTestId(
+      "kubernetes-agent-runner-note",
+      {},
+      { timeout: WAIT_TIMEOUT },
+    );
+    expect(note).toHaveTextContent(
+      "This is the in-cluster Runner the Kubernetes agent chart installed.",
+    );
+    expect(note).toHaveTextContent(KUBERNETES_AGENT_RUNNER_SUPERSEDED_NOTE);
+  });
+
+  test("says nothing of the sort on an ordinary Runner", async () => {
+    openRunnerView(HOST_RUNNER_ID);
+
+    expect(
+      await screen.findByText("bash-runner", {}, { timeout: WAIT_TIMEOUT }),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByTestId("kubernetes-agent-runner-note"),
+    ).not.toBeInTheDocument();
+    expect(screen.queryByText(/superseded/)).not.toBeInTheDocument();
+  });
+});

package/Tests/App/Dashboard/SecurityEventConnectionsTable.test.tsx

@@ -156,6 +156,15 @@ const RESELLER_MESSAGE: string =
 const EMPTY_STATE_ID: string = "security-event-connections-empty-state";
 const NO_CREATE_REASON: string =
   "You do not have permission to create connections.";
+const NO_UPDATE_REASON: string =
+  "You do not have permission to update connections.";
+// The row actions a member without update permission finds locked.
+const WRITE_ACTIONS: Array<string> = [
+  "Test connection",
+  "Run now",
+  "Edit",
+  "Update credentials",
+];
 
 /*
  * The empty state's provider tiles in catalog order, written out so a
@@ -364,6 +373,46 @@ function row(name: string = "Acme Okta"): HTMLElement {
   return screen.getByTestId(name);
 }
 
+/*
+ * A row shows one action as its button and folds every other action into a
+ * ⋯ menu beside it. The button is View Error when the row has an error to
+ * read and Test connection when it does not, so Run now, Diagnostics, Edit
+ * and Update credentials are reached the way a person reaches them: open
+ * that row's menu, then pick the item. The menu is portalled to the body,
+ * so it is found on the screen rather than inside the row.
+ */
+function openRowMenu(current: HTMLElement): HTMLElement {
+  fireEvent.click(within(current).getByTestId("row-actions-more-button"));
+  return screen.getByRole("menu");
+}
+
+function clickRowMenuItem(current: HTMLElement, title: string): void {
+  fireEvent.click(
+    within(openRowMenu(current)).getByRole("menuitem", { name: title }),
+  );
+}
+
+function menuItemTitles(menu: HTMLElement): Array<string> {
+  return within(menu)
+    .getAllByRole("menuitem")
+    .map((item: HTMLElement): string => {
+      return item.textContent || "";
+    });
+}
+
+/*
+ * A locked menu item is aria-disabled rather than natively disabled, so it
+ * stays reachable from the keyboard, and the reason it is locked is its own
+ * accessible description whether or not the tooltip is showing. Every locked
+ * item gives the same reason, and jsdom never finishes a tooltip's exit
+ * transition, so the reason is read from the item rather than from whichever
+ * tooltip happens to be on the page.
+ */
+function expectLockedMenuItem(item: HTMLElement, reason: string): void {
+  expect(item).toHaveAttribute("aria-disabled", "true");
+  expect(item).toHaveAccessibleDescription(reason);
+}
+
 function postCall(index: number = 0): JSONObject {
   return jest.mocked(API.post).mock.calls[index]?.[0] as unknown as JSONObject;
 }
@@ -1043,39 +1092,99 @@ describe("SecurityEventConnectionsTable", () => {
     expect(row("Acme Okta")).not.toHaveTextContent("Alerts and detections");
   });
 
+  /*
+   * A row used to be a strip of six outlined buttons. It is now one button
+   * and a ⋯ menu: the error when there is one to read, otherwise Test
+   * connection, with every other action in the menu in the order the table
+   * lists them. Nothing here is destructive, so the menu has no red tail.
+   */
+  test.each([
+    { layout: "desktop", isMobile: false },
+    { layout: "mobile", isMobile: true },
+  ])(
+    "$layout rows show one action as a button and the rest in a ⋯ menu",
+    ({ isMobile }: { isMobile: boolean }): void => {
+      mockIsMobile = isMobile;
+      renderTable([
+        connection(),
+        connection({
+          _id: "44444444-4444-4444-8444-444444444444",
+          name: "Failing Okta",
+          lastError: "Okta System Log request failed (HTTP 401)",
+        }),
+      ]);
+
+      const healthy: HTMLElement = within(row()).getByTestId("row-actions");
+      expect(within(healthy).getAllByRole("button")).toEqual([
+        within(healthy).getByRole("button", { name: "Test connection" }),
+        within(healthy).getByRole("button", { name: "More actions" }),
+      ]);
+      const healthyMenu: HTMLElement = openRowMenu(row());
+      expect(menuItemTitles(healthyMenu)).toEqual([
+        "Run now",
+        "Diagnostics",
+        "Edit",
+        "Update credentials",
+      ]);
+      fireEvent.keyDown(
+        within(healthyMenu).getByRole("menuitem", { name: "Run now" }),
+        { key: "Escape" },
+      );
+      expect(screen.queryByRole("menu")).not.toBeInTheDocument();
+
+      const failing: HTMLElement = within(row("Failing Okta")).getByTestId(
+        "row-actions",
+      );
+      expect(within(failing).getAllByRole("button")).toEqual([
+        within(failing).getByRole("button", { name: "View Error" }),
+        within(failing).getByRole("button", { name: "More actions" }),
+      ]);
+      expect(menuItemTitles(openRowMenu(row("Failing Okta")))).toEqual([
+        "Test connection",
+        "Run now",
+        "Diagnostics",
+        "Edit",
+        "Update credentials",
+      ]);
+      // Opening a menu is not running anything in it.
+      expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
+      expect(API.post).not.toHaveBeenCalled();
+    },
+  );
+
   test("read-only members keep View Error and Diagnostics while every write action is locked", (): void => {
     jest.spyOn(PermissionGate, "check").mockReturnValue({
       isAllowed: false,
-      disabledReason: "You do not have permission to update connections.",
+      disabledReason: NO_UPDATE_REASON,
     });
     renderTable([
       connection({ lastError: "Okta System Log request failed (HTTP 401)" }),
     ]);
 
+    // The error is the row's one button, and reading it needs no permission.
     const current: HTMLElement = row();
-    for (const title of [
-      "Test connection",
-      "Run now",
-      "Edit",
-      "Update credentials",
-    ]) {
-      expect(
-        within(current).getByRole("button", { name: title }),
-      ).toBeDisabled();
-    }
     expect(
-      within(current).getByRole("button", { name: "Diagnostics" }),
+      within(current).getByRole("button", { name: "View Error" }),
     ).toBeEnabled();
+
+    const menu: HTMLElement = openRowMenu(current);
+    for (const title of WRITE_ACTIONS) {
+      const item: HTMLElement = within(menu).getByRole("menuitem", {
+        name: title,
+      });
+      expectLockedMenuItem(item, NO_UPDATE_REASON);
+      // Locked is inert: picking it opens nothing and sends nothing.
+      fireEvent.click(item);
+    }
+    expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
     expect(
-      within(current).getByRole("button", { name: "View Error" }),
+      within(menu).getByRole("menuitem", { name: "Diagnostics" }),
     ).toBeEnabled();
 
     const button: CardButtonSchema = tableProps().cardProps
       ?.buttons?.[0] as CardButtonSchema;
     expect(button.disabled).toBe(true);
-    expect(button.tooltip).toBe(
-      "You do not have permission to update connections.",
-    );
+    expect(button.tooltip).toBe(NO_UPDATE_REASON);
     expect(API.post).not.toHaveBeenCalled();
   });
 
@@ -1175,7 +1284,7 @@ describe("SecurityEventConnectionsTable", () => {
       );
     renderTable([connection()]);
 
-    fireEvent.click(within(row()).getByRole("button", { name: "Run now" }));
+    clickRowMenuItem(row(), "Run now");
 
     expect(
       await screen.findByRole("dialog", {
@@ -1198,7 +1307,7 @@ describe("SecurityEventConnectionsTable", () => {
   test("Diagnostics shows the same health wording and UTC times with a local-time title", async (): Promise<void> => {
     renderTable([connection()]);
 
-    fireEvent.click(within(row()).getByRole("button", { name: "Diagnostics" }));
+    clickRowMenuItem(row(), "Diagnostics");
 
     const dialog: HTMLElement = await screen.findByRole("dialog", {
       name: "Connection diagnostics: Acme Okta",
@@ -1219,11 +1328,7 @@ describe("SecurityEventConnectionsTable", () => {
       .mockResolvedValue(googleConnection({ alertingOnly: false }));
     renderTable([googleConnection({ alertingOnly: false })]);
 
-    fireEvent.click(
-      within(row("Customer SecOps")).getByRole("button", {
-        name: "Diagnostics",
-      }),
-    );
+    clickRowMenuItem(row("Customer SecOps"), "Diagnostics");
     const dialog: HTMLElement = await screen.findByRole("dialog", {
       name: "Connection diagnostics: Customer SecOps",
     });
@@ -1247,7 +1352,7 @@ describe("SecurityEventConnectionsTable", () => {
   test("Diagnostics Test connection clears the previous checklist when a re-run fails", async (): Promise<void> => {
     renderTable([connection()]);
 
-    fireEvent.click(within(row()).getByRole("button", { name: "Diagnostics" }));
+    clickRowMenuItem(row(), "Diagnostics");
     const dialog: HTMLElement = await screen.findByRole("dialog", {
       name: "Connection diagnostics: Acme Okta",
     });
@@ -1289,7 +1394,7 @@ describe("SecurityEventConnectionsTable", () => {
   test("Edit and Update credentials open the form modal in the matching mode", async (): Promise<void> => {
     renderTable([connection()]);
 
-    fireEvent.click(within(row()).getByRole("button", { name: "Edit" }));
+    clickRowMenuItem(row(), "Edit");
     const edit: HTMLElement = await screen.findByRole("dialog", {
       name: "Edit connection: Acme Okta",
     });
@@ -1301,9 +1406,9 @@ describe("SecurityEventConnectionsTable", () => {
       expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
     });
 
-    fireEvent.click(
-      within(row()).getByRole("button", { name: "Update credentials" }),
-    );
+    // The menu closed behind the first pick; the second opens it again.
+    expect(screen.queryByRole("menu")).not.toBeInTheDocument();
+    clickRowMenuItem(row(), "Update credentials");
     const credentials: HTMLElement = await screen.findByRole("dialog", {
       name: "Update credentials: Acme Okta",
     });
@@ -1679,20 +1784,25 @@ describe("Last Error actions", () => {
     test("allows read-only members to view and copy errors while update actions remain disabled", async (): Promise<void> => {
       jest.spyOn(PermissionGate, "check").mockReturnValue({
         isAllowed: false,
-        disabledReason: "You do not have permission to update connections.",
+        disabledReason: NO_UPDATE_REASON,
       });
       const error: string =
         "Google SecOps alerts fetch failed (HTTP 403): permission denied";
       renderTable([errorConnection("Production", error)]);
 
-      for (const title of [
-        "Test connection",
-        "Run now",
-        "Edit",
-        "Update credentials",
-      ]) {
-        expect(screen.getByRole("button", { name: title })).toBeDisabled();
+      const menu: HTMLElement = openRowMenu(screen.getByTestId("Production"));
+      for (const title of WRITE_ACTIONS) {
+        expectLockedMenuItem(
+          within(menu).getByRole("menuitem", { name: title }),
+          NO_UPDATE_REASON,
+        );
       }
+      // Diagnostics is the one item left to focus; Escape leaves from there.
+      fireEvent.keyDown(
+        within(menu).getByRole("menuitem", { name: "Diagnostics" }),
+        { key: "Escape" },
+      );
+      expect(screen.queryByRole("menu")).not.toBeInTheDocument();
       expect(screen.getByRole("button", { name: "View Error" })).toBeEnabled();
 
       const dialog: HTMLElement = openError();