@oneuptime/common 14.0.8 → 14.0.10

package/build/dist/Server/Utils/AI/ResourceAccess/InfrastructureInvestigationToolkit.js

@@ -0,0 +1,330 @@
+import ObjectID from "../../../../Types/ObjectID";
+import RunnerJobOrigin from "../../../../Types/Runbook/RunnerJobOrigin";
+import { AI_RESOURCE_TYPE_INFO, ALL_AI_RESOURCE_TYPES, isAiResourceType, } from "../../../../Types/ResourceAiAgent/AiResourceType";
+import { DEFAULT_RESOURCE_COMMAND_TIMEOUT_MS, MAX_RESOURCE_COMMANDS_PER_INVESTIGATION, MAX_RESOURCE_COMMAND_TIMEOUT_MS, ResourceCommandTier, } from "../../../../Types/ResourceAiAgent/ResourceAiAccess";
+import ResourceCommandPolicy from "../../../../Utils/AiRemediation/Resource/ResourceCommandPolicy";
+import { redactResourceCommandOutput } from "../../../../Utils/AiRemediation/Resource/ResourceOutputRedactor";
+import KubectlWaitBudget, { MIN_KUBECTL_TIMEOUT_MS, } from "../../../../Utils/AiRemediation/KubectlWaitBudget";
+import { describeResourceNoun } from "../../../Services/ResourceAiAccessService";
+import { ToolArgs } from "../Toolbox/ToolTypes";
+import ResourceCommandJobRunner, { RESOURCE_COMMAND_CLAIM_TIMEOUT_MS, RESOURCE_COMMAND_OUTPUT_TRUNCATED_SUFFIX, ResourceCommandRunState, } from "./ResourceCommandJobRunner";
+import { INFRASTRUCTURE_RESULT_UNKNOWN_EVENT_PREFIX, LIST_INFRASTRUCTURE_ACCESS_TOOL_NAME, RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME, } from "./ResourceAccessToolNames";
+import ResourceAccessContext, { describeResource, } from "./ResourceAccessContext";
+// A reason that already ends a sentence.
+const SENTENCE_END_PATTERN = /[.!?]$/;
+export default class InfrastructureInvestigationToolkit {
+    constructor(options) {
+        this.commandsRun = 0;
+        // Agents (by id) that left a command unclaimed in this run.
+        this.unreachableAgents = new Map();
+        this.options = options;
+    }
+    getReadyResources() {
+        return this.options.resources.filter((resource) => {
+            const isReady = this.options.readinessCheck === "remediation"
+                ? resource.isRemediationReady
+                : resource.isInvestigationReady;
+            return (isReady &&
+                isAiResourceType(resource.resourceType) &&
+                resource.agent !== null &&
+                Boolean(resource.agent.agentId));
+        });
+    }
+    getCommandsRun() {
+        return this.commandsRun;
+    }
+    // Whether this resource's agent tripped the breaker.
+    isResourceUnreachable(resourceId) {
+        const resource = this.options.resources.find((candidate) => {
+            return candidate.resourceId === resourceId;
+        });
+        return Boolean((resource === null || resource === void 0 ? void 0 : resource.agent) && this.unreachableAgents.has(resource.agent.agentId));
+    }
+    /*
+     * No ready resource, no tools: the model is told in its context why each
+     * resource is unreachable, and a tool that always fails would only burn
+     * its budget.
+     */
+    buildTools() {
+        if (this.getReadyResources().length === 0) {
+            return [];
+        }
+        return [this.buildListAccessTool(), this.buildRunCommandTool()];
+    }
+    // One line per ready resource: what it is, its id, and its programs.
+    describeReadyResources() {
+        return this.getReadyResources()
+            .map((resource) => {
+            const info = AI_RESOURCE_TYPE_INFO[resource.resourceType];
+            return `- ${describeResource(resource)} — resourceId: ${resource.resourceId} — programs: ${info.programs.join(", ")}`;
+        })
+            .join("\n");
+    }
+    /*
+     * The read-command cheat-sheet of every tool policy the ready resources
+     * use, once per policy (a Docker host and a Podman host share one).
+     */
+    describeReadCommandGuides() {
+        const presentTypes = ALL_AI_RESOURCE_TYPES.filter((type) => {
+            return this.getReadyResources().some((resource) => {
+                return resource.resourceType === type;
+            });
+        });
+        const byPolicy = new Map();
+        for (const type of presentTypes) {
+            const policyName = ResourceCommandPolicy.getToolPolicy(type).name;
+            byPolicy.set(policyName, [...(byPolicy.get(policyName) || []), type]);
+        }
+        const sections = [];
+        for (const types of byPolicy.values()) {
+            const heading = types
+                .map((type) => {
+                return AI_RESOURCE_TYPE_INFO[type].displayName;
+            })
+                .join(" / ");
+            sections.push(`${heading} — read-only commands:\n${ResourceCommandPolicy.getReadCommandGuide(types[0])}`);
+        }
+        return sections.join("\n\n");
+    }
+    buildListAccessTool() {
+        return {
+            definition: {
+                name: LIST_INFRASTRUCTURE_ACCESS_TOOL_NAME,
+                description: `List the infrastructure resources (Docker and Podman hosts, Docker Swarm, Proxmox, VMware and Ceph clusters, database servers, hosts) linked to this signal that OneUptime AI may inspect with read-only commands through their AI agents, with their resourceId and the programs each one runs. Call this once before ${RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME} if you are unsure which resource to target.`,
+                inputSchema: { type: "object", properties: {} },
+            },
+            execute: async () => {
+                const ready = this.getReadyResources();
+                const text = ready
+                    .map((resource) => {
+                    const info = AI_RESOURCE_TYPE_INFO[resource.resourceType];
+                    return `- resourceId: ${resource.resourceId} — ${describeResource(resource)} — ${this.isResourceUnreachable(resource.resourceId)
+                        ? `UNREACHABLE for the rest of this investigation: its ${info.agentDisplayName} did not pick up an earlier command. Do not call ${RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME} on it again.`
+                        : `read-only commands via its ${info.agentDisplayName} (programs: ${info.programs.join(", ")})`}`;
+                })
+                    .join("\n");
+                return {
+                    success: true,
+                    textForLlm: text,
+                    result: {
+                        dataForLlm: text,
+                        rowCount: ready.length,
+                        citationLabel: "Infrastructure OneUptime AI can inspect",
+                        redactionCount: 0,
+                        isTruncated: false,
+                    },
+                };
+            },
+        };
+    }
+    buildRunCommandTool() {
+        var _a;
+        const maxCommands = (_a = this.options.maxCommands) !== null && _a !== void 0 ? _a : MAX_RESOURCE_COMMANDS_PER_INVESTIGATION;
+        return {
+            definition: {
+                name: RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME,
+                description: `Run ONE read-only command on a linked infrastructure resource through its AI agent and get its output. The resources you may inspect:\n${this.describeReadyResources()}\n\nWhat each kind of resource accepts:\n\n${this.describeReadCommandGuides()}\n\nOne command per call, written as the program followed by its arguments — never a shell line: pipes, redirects, ;, &&, $( ) and sudo are refused. Anything that changes a resource is refused here — this is an investigation — and so is anything that would read credentials; credential-looking values (passwords, tokens, keys, connection strings) are redacted from every output before you see it, so do not spend commands on them. Keep output small (limit lines and tails). At most ${maxCommands} commands per investigation.`,
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        resourceId: {
+                            type: "string",
+                            description: `The resourceId of the linked resource to inspect (from the context or ${LIST_INFRASTRUCTURE_ACCESS_TOOL_NAME}).`,
+                        },
+                        command: {
+                            type: "string",
+                            description: 'The command, starting with one of the resource\'s programs, e.g. "docker ps -a", "docker logs --tail 100 web", "systemctl status nginx --no-pager", "pvesh get /cluster/resources", "ceph health detail" or "db sessions --limit 20". One line, no shell operators.',
+                        },
+                        rationale: {
+                            type: "string",
+                            description: "One sentence on what you expect this command to tell you — shown to humans on the timeline.",
+                        },
+                        timeoutInMs: {
+                            type: "number",
+                            description: `Timeout in milliseconds (default ${DEFAULT_RESOURCE_COMMAND_TIMEOUT_MS}, max ${MAX_RESOURCE_COMMAND_TIMEOUT_MS}). Shortened automatically when the investigation's time budget is nearly spent.`,
+                        },
+                    },
+                    required: ["resourceId", "command", "rationale"],
+                },
+            },
+            execute: async (args) => {
+                return this.runCommand(args, maxCommands);
+            },
+        };
+    }
+    async runCommand(args, maxCommands) {
+        var _a, _b;
+        if (this.commandsRun >= maxCommands) {
+            return this.failure(`The per-investigation infrastructure command budget (${maxCommands} commands) is spent. Finish your analysis with what you have.`);
+        }
+        const resourceIdRaw = ToolArgs.getString(args, "resourceId");
+        const resource = this.getReadyResources().find((candidate) => {
+            return (Boolean(resourceIdRaw) &&
+                candidate.resourceId.toLowerCase() === resourceIdRaw.toLowerCase());
+        });
+        if (!resource || !resource.agent) {
+            return this.failure(`resourceId is not one of the resources OneUptime AI may inspect for this signal. Use ${LIST_INFRASTRUCTURE_ACCESS_TOOL_NAME}.`);
+        }
+        const info = AI_RESOURCE_TYPE_INFO[resource.resourceType];
+        const label = describeResource(resource);
+        const command = ToolArgs.getString(args, "command") || "";
+        if (!command) {
+            return this.failure("command is required.");
+        }
+        const policy = ResourceCommandPolicy.evaluateCommand({
+            resourceType: resource.resourceType,
+            command,
+        });
+        if (policy.tier === ResourceCommandTier.Denied) {
+            return this.failure(`Refused by the ${info.displayName} command policy: ${policy.reason}. Nothing was run. What ${label} accepts:\n${ResourceCommandPolicy.getReadCommandGuide(resource.resourceType)}`, `Refused by the ${info.displayName} command policy on ${label}. Nothing was run.`);
+        }
+        if (policy.tier !== ResourceCommandTier.Read) {
+            return this.failure(`"${policy.displayCommand}" would change ${label} (${policy.tier}) and this is a read-only investigation, so it was NOT run. If a change is the fix, put it in your Suggested next steps for a human. Read-only commands for it:\n${ResourceCommandPolicy.getReadCommandGuide(resource.resourceType)}`, `"${policy.displayCommand}" would change ${label} and this is a read-only investigation, so it was not run.`);
+        }
+        /*
+         * The breaker: checked before the budget is planned, a command is spent
+         * or anything is enqueued, so a dead agent costs one claim window per
+         * run rather than one per command.
+         */
+        const tripped = this.unreachableAgents.get(resource.agent.agentId);
+        if (tripped !== undefined) {
+            return this.failure(`The ${info.agentDisplayName} of ${label} did not pick up an earlier command within ${InfrastructureInvestigationToolkit.describeSeconds(tripped.claimWindowMs)}, so the ${describeResourceNoun(resource.resourceType)} is treated as unreachable for the rest of this investigation. Nothing was run. Do not call ${RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME} on it again: continue with OneUptime telemetry and say in **${ResourceAccessContext.REPORT_SECTION_HEADING}** that its ${info.agentDisplayName} did not respond.`, `No command was run on ${label}: its ${info.agentDisplayName} did not pick up an earlier command, so it was unreachable for the rest of this investigation.`);
+        }
+        const requestedTimeoutInMs = ToolArgs.getNumber(args, "timeoutInMs", {
+            defaultValue: DEFAULT_RESOURCE_COMMAND_TIMEOUT_MS,
+            min: MIN_KUBECTL_TIMEOUT_MS,
+            max: MAX_RESOURCE_COMMAND_TIMEOUT_MS,
+        });
+        /*
+         * Planned before the command counts against the budget or anything is
+         * enqueued: a command the run's wall clock can no longer hold is
+         * refused outright rather than started and abandoned.
+         */
+        const budget = KubectlWaitBudget.plan({
+            requestedTimeoutInMs,
+            maxClaimTimeoutInMs: RESOURCE_COMMAND_CLAIM_TIMEOUT_MS,
+            deadlineAtMs: this.options.runDeadlineAtMs,
+        });
+        if (!budget.ok) {
+            return this.failure(`Not enough time is left in this investigation's budget to run another infrastructure command (about ${InfrastructureInvestigationToolkit.describeSeconds(budget.refusal.remainingBudgetMs)} remain; a command needs at least ${InfrastructureInvestigationToolkit.describeSeconds(budget.refusal.minimumBudgetMs)} including the wait for the agent). Nothing was run. Finish your analysis with what you have.`);
+        }
+        /*
+         * Counted once a job is enqueued, whether or not the agent then runs
+         * it: the per-investigation cap bounds the agent work this run can ask
+         * for, not the commands that happened to succeed.
+         */
+        this.commandsRun++;
+        let outcome;
+        try {
+            outcome = await ResourceCommandJobRunner.run({
+                projectId: this.options.projectId,
+                aiRunId: this.options.aiRunId,
+                origin: RunnerJobOrigin.AiInvestigation,
+                resourceType: resource.resourceType,
+                resourceId: new ObjectID(resource.resourceId),
+                targetResourceAiAgentId: new ObjectID(resource.agent.agentId),
+                /*
+                 * The command exactly as evaluated above: the chokepoint and the
+                 * agent evaluate the same text, so all three verdicts agree.
+                 */
+                command,
+                stepId: `ai-investigation-resource-${this.commandsRun}`,
+                timeoutInMs: budget.plan.timeoutInMs,
+                claimTimeoutInMs: budget.plan.claimTimeoutInMs,
+            });
+        }
+        catch (error) {
+            const message = redactResourceCommandOutput({
+                resourceType: resource.resourceType,
+                program: policy.program,
+                text: error instanceof Error ? error.message : String(error),
+            }).trim();
+            return this.failure(`The command could not be run on ${label}: ${message} Continue with OneUptime telemetry and mention this in your report.`, `No command was run on ${label}: it was refused before it reached the ${info.agentDisplayName}.`);
+        }
+        if (outcome.claimTimedOut === true) {
+            this.unreachableAgents.set(resource.agent.agentId, {
+                claimWindowMs: budget.plan.claimTimeoutInMs,
+            });
+            return this.failure(`The command was NOT run on ${label}: its ${info.agentDisplayName} did not pick up "${outcome.displayCommand}" within ${InfrastructureInvestigationToolkit.describeSeconds(budget.plan.claimTimeoutInMs)} (it may be offline, restarting or busy). The ${describeResourceNoun(resource.resourceType)} is treated as unreachable for the rest of this investigation — do not call ${RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME} on it again. Continue with OneUptime telemetry and say in **${ResourceAccessContext.REPORT_SECTION_HEADING}** that its ${info.agentDisplayName} did not respond.`, `No command was run on ${label}: the ${info.agentDisplayName} did not pick up the command in time.`);
+        }
+        /*
+         * The agent took the command and no result came back: it may have run
+         * or not. There is no output to cite, so it is a failed call — but it
+         * is never recorded as "did not run", and the panel counts it apart.
+         */
+        if (outcome.runState === ResourceCommandRunState.Unknown) {
+            const reason = InfrastructureInvestigationToolkit.toSentence(redactResourceCommandOutput({
+                resourceType: resource.resourceType,
+                program: policy.program,
+                text: outcome.errorMessage || "No result came back for this command.",
+            }));
+            return this.failure(`No result came back from ${label} for "${outcome.displayCommand}": ${reason} Nothing from this command is evidence. Continue with OneUptime telemetry and mention in **${ResourceAccessContext.REPORT_SECTION_HEADING}** that its ${info.agentDisplayName} stopped responding.`, `${INFRASTRUCTURE_RESULT_UNKNOWN_EVENT_PREFIX} the ${info.agentDisplayName} of ${label} took the command, but no result came back, so whether it ran is unknown.`);
+        }
+        /*
+         * Nothing reached the program, so there is nothing to cite: a refusal
+         * by the server or the agent, or a program that could not start. The
+         * model reads why; the persisted event carries only the category,
+         * because the agent's reason can name its configuration and every
+         * reader of the incident sees the event.
+         */
+        if (outcome.executed === false) {
+            const reason = InfrastructureInvestigationToolkit.toSentence(redactResourceCommandOutput({
+                resourceType: resource.resourceType,
+                program: policy.program,
+                text: outcome.errorMessage ||
+                    "The job ended without running the command.",
+            }));
+            return this.failure(`No result came back from ${label} for "${outcome.displayCommand}": ${reason} Nothing from this command is evidence. Continue with OneUptime telemetry and mention in **${ResourceAccessContext.REPORT_SECTION_HEADING}** that the command could not run.`, `No result came back from ${label}: the command was refused, or the ${info.agentDisplayName} did not run it.`);
+        }
+        const text = ResourceCommandJobRunner.describeForLlm({
+            outcome,
+            resourceType: resource.resourceType,
+        });
+        return {
+            success: true,
+            textForLlm: text,
+            result: {
+                dataForLlm: text,
+                rowCount: outcome.succeeded ? 1 : 0,
+                citationLabel: InfrastructureInvestigationToolkit.getCitationLabel({
+                    displayCommand: outcome.displayCommand,
+                    resource,
+                }),
+                redactionCount: (_a = outcome.redactionCount) !== null && _a !== void 0 ? _a : 0,
+                isTruncated: (_b = outcome.isTruncated) !== null && _b !== void 0 ? _b : outcome.output.endsWith(RESOURCE_COMMAND_OUTPUT_TRUNCATED_SUFFIX.trim()),
+            },
+        };
+    }
+    /*
+     * How a command that ran is cited: `docker ps -a` on Docker host "web-1".
+     * The report's evidence list and the panel show it as is.
+     */
+    static getCitationLabel(data) {
+        const displayName = isAiResourceType(data.resource.resourceType)
+            ? AI_RESOURCE_TYPE_INFO[data.resource.resourceType].displayName
+            : "resource";
+        return `\`${data.displayCommand}\` on ${displayName} "${data.resource.resourceName}"`;
+    }
+    // A redacted reason that ends a sentence.
+    static toSentence(text) {
+        const trimmed = text.trim();
+        return SENTENCE_END_PATTERN.test(trimmed) ? trimmed : `${trimmed}.`;
+    }
+    static describeSeconds(milliseconds) {
+        return `${Math.max(0, Math.round(milliseconds / 1000))}s`;
+    }
+    /*
+     * `errorMessage` is what the run's persisted event (and so every reader
+     * of the incident's investigation panel) carries; it defaults to the
+     * model's text, which is right for failures that name nothing beyond the
+     * command and the resource.
+     */
+    failure(text, errorMessage) {
+        return {
+            success: false,
+            textForLlm: text,
+            errorMessage: errorMessage !== null && errorMessage !== void 0 ? errorMessage : text,
+        };
+    }
+}
+//# sourceMappingURL=InfrastructureInvestigationToolkit.js.map

package/build/dist/Server/Utils/AI/ResourceAccess/InfrastructureInvestigationToolkit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InfrastructureInvestigationToolkit.js","sourceRoot":"","sources":["../../../../../../Server/Utils/AI/ResourceAccess/InfrastructureInvestigationToolkit.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,4BAA4B,CAAC;AAElD,OAAO,eAAe,MAAM,2CAA2C,CAAC;AACxE,OAAuB,EACrB,qBAAqB,EACrB,qBAAqB,EAErB,gBAAgB,GACjB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,+BAA+B,EAE/B,mBAAmB,GACpB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,qBAAqB,MAAM,gEAAgE,CAAC;AAEnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AAC9G,OAAO,iBAAiB,EAAE,EAExB,sBAAsB,GACvB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,wBAAwB,EAAE,EAC/B,iCAAiC,EACjC,wCAAwC,EAExC,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0CAA0C,EAC1C,oCAAoC,EACpC,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AACnC,OAAO,qBAAqB,EAAE,EAC5B,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAmDjC,yCAAyC;AACzC,MAAM,oBAAoB,GAAW,QAAQ,CAAC;AAQ9C,MAAM,CAAC,OAAO,OAAO,kCAAkC;IASrD,YAAmB,OAAkD;QAP7D,gBAAW,GAAW,CAAC,CAAC;QAChC,4DAA4D;QACpD,sBAAiB,GAAkC,IAAI,GAAG,EAG/D,CAAC;QAGF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEM,iBAAiB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAClC,CAAC,QAAgC,EAAW,EAAE;YAC5C,MAAM,OAAO,GACX,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,aAAa;gBAC3C,CAAC,CAAC,QAAQ,CAAC,kBAAkB;gBAC7B,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAEpC,OAAO,CACL,OAAO;gBACP,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACvC,QAAQ,CAAC,KAAK,KAAK,IAAI;gBACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAChC,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAEM,cAAc;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,qDAAqD;IAC9C,qBAAqB,CAAC,UAAkB;QAC7C,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CACzB,CAAC,SAAiC,EAAW,EAAE;YAC7C,OAAO,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC;QAC7C,CAAC,CACF,CAAC;QAEJ,OAAO,OAAO,CACZ,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,KAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CACtE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,UAAU;QACf,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,qEAAqE;IAC7D,sBAAsB;QAC5B,OAAO,IAAI,CAAC,iBAAiB,EAAE;aAC5B,GAAG,CAAC,CAAC,QAAgC,EAAU,EAAE;YAChD,MAAM,IAAI,GACR,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAE/C,OAAO,KAAK,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,QAAQ,CAAC,UAAU,gBAAgB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAC3G,IAAI,CACL,EAAE,CAAC;QACN,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,yBAAyB;QAC/B,MAAM,YAAY,GAA0B,qBAAqB,CAAC,MAAM,CACtE,CAAC,IAAoB,EAAW,EAAE;YAChC,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAClC,CAAC,QAAgC,EAAW,EAAE;gBAC5C,OAAO,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC;YACxC,CAAC,CACF,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,QAAQ,GAAuC,IAAI,GAAG,EAGzD,CAAC;QAEJ,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,MAAM,UAAU,GAAW,qBAAqB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;YAC1E,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAkB,EAAE,CAAC;QAEnC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,OAAO,GAAW,KAAK;iBAC1B,GAAG,CAAC,CAAC,IAAoB,EAAU,EAAE;gBACpC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC;YACjD,CAAC,CAAC;iBACD,IAAI,CAAC,KAAK,CAAC,CAAC;YAEf,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,2BAA2B,qBAAqB,CAAC,mBAAmB,CAC5E,KAAK,CAAC,CAAC,CAAE,CACV,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAEO,mBAAmB;QACzB,OAAO;YACL,UAAU,EAAE;gBACV,IAAI,EAAE,oCAAoC;gBAC1C,WAAW,EAAE,0TAA0T,oCAAoC,8CAA8C;gBACzZ,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;aAChD;YACD,OAAO,EAAE,KAAK,IAA8B,EAAE;gBAC5C,MAAM,KAAK,GAAkC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAEtE,MAAM,IAAI,GAAW,KAAK;qBACvB,GAAG,CAAC,CAAC,QAAgC,EAAU,EAAE;oBAChD,MAAM,IAAI,GACR,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;oBAE/C,OAAO,iBAAiB,QAAQ,CAAC,UAAU,MAAM,gBAAgB,CAC/D,QAAQ,CACT,MACC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAC7C,CAAC,CAAC,uDAAuD,IAAI,CAAC,gBAAgB,oDAAoD,oCAAoC,eAAe;wBACrL,CAAC,CAAC,8BAA8B,IAAI,CAAC,gBAAgB,eAAe,IAAI,CAAC,QAAQ,CAAC,IAAI,CAClF,IAAI,CACL,GACP,EAAE,CAAC;gBACL,CAAC,CAAC;qBACD,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEd,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE;wBACN,UAAU,EAAE,IAAI;wBAChB,QAAQ,EAAE,KAAK,CAAC,MAAM;wBACtB,aAAa,EAAE,yCAAyC;wBACxD,cAAc,EAAE,CAAC;wBACjB,WAAW,EAAE,KAAK;qBACnB;iBACF,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC;IAEO,mBAAmB;;QACzB,MAAM,WAAW,GACf,MAAA,IAAI,CAAC,OAAO,CAAC,WAAW,mCAAI,uCAAuC,CAAC;QAEtE,OAAO;YACL,UAAU,EAAE;gBACV,IAAI,EAAE,oCAAoC;gBAC1C,WAAW,EAAE,0IAA0I,IAAI,CAAC,sBAAsB,EAAE,8CAA8C,IAAI,CAAC,yBAAyB,EAAE,qeAAqe,WAAW,8BAA8B;gBAChxB,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,UAAU,EAAE;4BACV,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,yEAAyE,oCAAoC,IAAI;yBAC/H;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,qQAAqQ;yBACxQ;wBACD,SAAS,EAAE;4BACT,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,6FAA6F;yBAChG;wBACD,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,oCAAoC,mCAAmC,SAAS,+BAA+B,kFAAkF;yBAC/M;qBACF;oBACD,QAAQ,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC;iBACjD;aACF;YACD,OAAO,EAAE,KAAK,EAAE,IAAgB,EAA4B,EAAE;gBAC5D,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC5C,CAAC;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAgB,EAChB,WAAmB;;QAEnB,IAAI,IAAI,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,OAAO,CACjB,wDAAwD,WAAW,+DAA+D,CACnI,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAuB,QAAQ,CAAC,SAAS,CAC1D,IAAI,EACJ,YAAY,CACb,CAAC;QACF,MAAM,QAAQ,GACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAC3B,CAAC,SAAiC,EAAW,EAAE;YAC7C,OAAO,CACL,OAAO,CAAC,aAAa,CAAC;gBACtB,SAAS,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,aAAc,CAAC,WAAW,EAAE,CACpE,CAAC;QACJ,CAAC,CACF,CAAC;QAEJ,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,OAAO,CACjB,wFAAwF,oCAAoC,GAAG,CAChI,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GACR,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAW,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAW,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QAElE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GACV,qBAAqB,CAAC,eAAe,CAAC;YACpC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,OAAO;SACR,CAAC,CAAC;QAEL,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,OAAO,CACjB,kBAAkB,IAAI,CAAC,WAAW,oBAAoB,MAAM,CAAC,MAAM,2BAA2B,KAAK,cAAc,qBAAqB,CAAC,mBAAmB,CACxJ,QAAQ,CAAC,YAAY,CACtB,EAAE,EACH,kBAAkB,IAAI,CAAC,WAAW,sBAAsB,KAAK,oBAAoB,CAClF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,OAAO,CACjB,IAAI,MAAM,CAAC,cAAc,kBAAkB,KAAK,KAAK,MAAM,CAAC,IAAI,oKAAoK,qBAAqB,CAAC,mBAAmB,CAC3Q,QAAQ,CAAC,YAAY,CACtB,EAAE,EACH,IAAI,MAAM,CAAC,cAAc,kBAAkB,KAAK,4DAA4D,CAC7G,CAAC;QACJ,CAAC;QAED;;;;WAIG;QACH,MAAM,OAAO,GAAiC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CACtE,QAAQ,CAAC,KAAK,CAAC,OAAO,CACvB,CAAC;QAEF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,OAAO,CACjB,OAAO,IAAI,CAAC,gBAAgB,OAAO,KAAK,8CAA8C,kCAAkC,CAAC,eAAe,CACtI,OAAO,CAAC,aAAa,CACtB,YAAY,oBAAoB,CAAC,QAAQ,CAAC,YAAY,CAAC,+FAA+F,oCAAoC,gEAAgE,qBAAqB,CAAC,sBAAsB,eAAe,IAAI,CAAC,gBAAgB,mBAAmB,EAC9V,yBAAyB,KAAK,SAAS,IAAI,CAAC,gBAAgB,gGAAgG,CAC7J,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAW,QAAQ,CAAC,SAAS,CACrD,IAAI,EACJ,aAAa,EACb;YACE,YAAY,EAAE,mCAAmC;YACjD,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,+BAA+B;SACrC,CACF,CAAC;QAEF;;;;WAIG;QACH,MAAM,MAAM,GAA4B,iBAAiB,CAAC,IAAI,CAAC;YAC7D,oBAAoB;YACpB,mBAAmB,EAAE,iCAAiC;YACtD,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;SAC3C,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CACjB,uGAAuG,kCAAkC,CAAC,eAAe,CACvJ,MAAM,CAAC,OAAO,CAAC,iBAAiB,CACjC,qCAAqC,kCAAkC,CAAC,eAAe,CACtF,MAAM,CAAC,OAAO,CAAC,eAAe,CAC/B,+FAA+F,CACjG,CAAC;QACJ,CAAC;QAED;;;;WAIG;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,OAAkC,CAAC;QAEvC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC;gBAC3C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;gBAC7B,MAAM,EAAE,eAAe,CAAC,eAAe;gBACvC,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,UAAU,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC7C,uBAAuB,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC7D;;;mBAGG;gBACH,OAAO;gBACP,MAAM,EAAE,6BAA6B,IAAI,CAAC,WAAW,EAAE;gBACvD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;aAC/C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,2BAA2B,CAAC;gBAClD,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC,IAAI,EAAE,CAAC;YAEV,OAAO,IAAI,CAAC,OAAO,CACjB,mCAAmC,KAAK,KAAK,OAAO,qEAAqE,EACzH,yBAAyB,KAAK,0CAA0C,IAAI,CAAC,gBAAgB,GAAG,CACjG,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE;gBACjD,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;aAC5C,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,OAAO,CACjB,8BAA8B,KAAK,SAAS,IAAI,CAAC,gBAAgB,qBAAqB,OAAO,CAAC,cAAc,YAAY,kCAAkC,CAAC,eAAe,CACxK,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAC7B,iDAAiD,oBAAoB,CACpE,QAAQ,CAAC,YAAY,CACtB,+EAA+E,oCAAoC,gEAAgE,qBAAqB,CAAC,sBAAsB,eAAe,IAAI,CAAC,gBAAgB,mBAAmB,EACvR,yBAAyB,KAAK,SAAS,IAAI,CAAC,gBAAgB,uCAAuC,CACpG,CAAC;QACJ,CAAC;QAED;;;;WAIG;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,uBAAuB,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,MAAM,GAAW,kCAAkC,CAAC,UAAU,CAClE,2BAA2B,CAAC;gBAC1B,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,OAAO,CAAC,YAAY,IAAI,uCAAuC;aACtE,CAAC,CACH,CAAC;YAEF,OAAO,IAAI,CAAC,OAAO,CACjB,4BAA4B,KAAK,SAAS,OAAO,CAAC,cAAc,MAAM,MAAM,8FAA8F,qBAAqB,CAAC,sBAAsB,eAAe,IAAI,CAAC,gBAAgB,sBAAsB,EAChR,GAAG,0CAA0C,QAAQ,IAAI,CAAC,gBAAgB,OAAO,KAAK,2EAA2E,CAClK,CAAC;QACJ,CAAC;QAED;;;;;;WAMG;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAW,kCAAkC,CAAC,UAAU,CAClE,2BAA2B,CAAC;gBAC1B,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EACF,OAAO,CAAC,YAAY;oBACpB,4CAA4C;aAC/C,CAAC,CACH,CAAC;YAEF,OAAO,IAAI,CAAC,OAAO,CACjB,4BAA4B,KAAK,SAAS,OAAO,CAAC,cAAc,MAAM,MAAM,8FAA8F,qBAAqB,CAAC,sBAAsB,oCAAoC,EAC1P,4BAA4B,KAAK,qCAAqC,IAAI,CAAC,gBAAgB,kBAAkB,CAC9G,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAW,wBAAwB,CAAC,cAAc,CAAC;YAC3D,OAAO;YACP,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,aAAa,EAAE,kCAAkC,CAAC,gBAAgB,CAAC;oBACjE,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,QAAQ;iBACT,CAAC;gBACF,cAAc,EAAE,MAAA,OAAO,CAAC,cAAc,mCAAI,CAAC;gBAC3C,WAAW,EACT,MAAA,OAAO,CAAC,WAAW,mCACnB,OAAO,CAAC,MAAM,CAAC,QAAQ,CACrB,wCAAwC,CAAC,IAAI,EAAE,CAChD;aACJ;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,gBAAgB,CAAC,IAG9B;QACC,MAAM,WAAW,GAAW,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YACtE,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,WAAW;YAC/D,CAAC,CAAC,UAAU,CAAC;QAEf,OAAO,KAAK,IAAI,CAAC,cAAc,SAAS,WAAW,KAAK,IAAI,CAAC,QAAQ,CAAC,YAAY,GAAG,CAAC;IACxF,CAAC;IAED,0CAA0C;IAClC,MAAM,CAAC,UAAU,CAAC,IAAY;QACpC,MAAM,OAAO,GAAW,IAAI,CAAC,IAAI,EAAE,CAAC;QAEpC,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;IACtE,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,YAAoB;QACjD,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACK,OAAO,CAAC,IAAY,EAAE,YAAqB;QACjD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAI,IAAI;SACnC,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/Utils/AI/ResourceAccess/ResourceAccessContext.js

@@ -0,0 +1,160 @@
+import { AI_RESOURCE_TYPE_INFO, isAiResourceType, } from "../../../../Types/ResourceAiAgent/AiResourceType";
+import { ResourceAiRemediationMode, } from "../../../../Types/ResourceAiAgent/ResourceAiAccess";
+import { describeResourceNoun, getResourceAiAgentPage, } from "../../../Services/ResourceAiAccessService";
+import { LIST_INFRASTRUCTURE_ACCESS_TOOL_NAME, RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME, } from "./ResourceAccessToolNames";
+/*
+ * The prompt-side view of infrastructure access — the resource-agnostic
+ * sibling of ClusterAccessContext, for the Docker and Podman hosts, Docker
+ * Swarm, Proxmox, VMware and Ceph clusters, database servers and hosts an
+ * incident or alert is linked to.
+ *
+ * Two audiences read this: the model, which needs to know which resources
+ * it may inspect and how; and, through the model's report, the on-call
+ * human, who needs to hear "I could not inspect the host, here is why — and
+ * here is what to install" in the report itself. Everything here is
+ * deterministic text derived from ResourceAiAccessStatus — never model
+ * output.
+ */
+// 'Docker host "web-1"', 'Host "web-2"' — how a resource is named in copy.
+export function describeResource(status) {
+    const info = isAiResourceType(status.resourceType)
+        ? AI_RESOURCE_TYPE_INFO[status.resourceType]
+        : null;
+    return `${info ? info.displayName : "Resource"} "${status.resourceName}"`;
+}
+// "the Docker AI agent" — who runs commands on this resource.
+export function describeResourceAgent(status) {
+    return isAiResourceType(status.resourceType)
+        ? `the ${AI_RESOURCE_TYPE_INFO[status.resourceType].agentDisplayName}`
+        : "the resource's AI agent";
+}
+// The gaps that stop an investigation from running commands on it.
+function getBlockingGaps(status) {
+    return status.gaps.filter((gap) => {
+        return gap.blocksInvestigation;
+    });
+}
+function findAgentMissingGap(status) {
+    return status.gaps.find((gap) => {
+        return gap.code === "ai_agent_not_connected";
+    });
+}
+class ResourceAccessContext {
+    /*
+     * Appended to the investigation persona whenever the subject is linked to
+     * at least one infrastructure resource, ready or not.
+     */
+    static buildPersonaAddendum(statuses) {
+        const ready = statuses.filter((status) => {
+            return status.isInvestigationReady;
+        });
+        const lines = [];
+        if (ready.length > 0) {
+            lines.push(`This signal is linked to infrastructure resource(s) OneUptime AI can inspect directly through their AI agents: ${ready
+                .map((status) => {
+                return describeResource(status);
+            })
+                .join(", ")}. Use ${RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME} for READ-ONLY inspection the way an on-call engineer would open a terminal on the box: list and inspect the failing containers or services and read their recent logs, check the resource's health, capacity and recent events. Each call runs ONE command (an argv — no shell, no pipes or redirects, no sudo) with the programs the tool lists for that resource. Prefer direct inspection over guessing from metrics when the two disagree. Every command that ran is cited like any other tool result; a command that could not run comes back as an error, is not evidence, and must never be described as inspected. A resource's agent can itself be down: if ${RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME} says an agent did not pick up a command, that resource is unreachable for the rest of this investigation — do not run commands on it again, continue with OneUptime telemetry, and say so in your report. Anything that changes a resource is refused, and credential-looking values (passwords, tokens, keys, connection strings) are redacted from every output before you see it — never ask for them and never treat a redaction marker as a finding.`);
+        }
+        const notReady = statuses.filter((status) => {
+            return !status.isInvestigationReady;
+        });
+        if (notReady.length > 0) {
+            lines.push(`This signal is linked to infrastructure resource(s) OneUptime AI CANNOT inspect directly: ${notReady
+                .map((status) => {
+                return `${describeResource(status)} (${ResourceAccessContext.describeWhyNotReady(status)})`;
+            })
+                .join(", ")}. Investigate them with OneUptime's own telemetry (metrics, logs, events, traces) and say plainly in your report that you could not inspect them directly. Do NOT invent command output.`);
+        }
+        lines.push(`Add a section **${ResourceAccessContext.REPORT_SECTION_HEADING}** before Suggested next steps: one or two sentences on what you inspected directly on each linked resource (or that you could not — no AI agent connected, the agent not responding, or AI investigation turned off for it — and that the human should check the resource's AI agent page (AI → AI agent), where the agent's install snippet is).`);
+        return lines.join("\n");
+    }
+    // The "# Infrastructure access" block of the context summary.
+    static buildContextSection(statuses) {
+        if (statuses.length === 0) {
+            return "";
+        }
+        const lines = ["", "# Infrastructure access"];
+        for (const status of statuses) {
+            const info = isAiResourceType(status.resourceType)
+                ? AI_RESOURCE_TYPE_INFO[status.resourceType]
+                : null;
+            if (status.isInvestigationReady && info) {
+                lines.push(`- ${describeResource(status)} (resourceId: ${status.resourceId}): READ access via ${RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME} through its ${info.agentDisplayName} (programs: ${info.programs.join(", ")}). Remediation: ${ResourceAccessContext.describeRemediationMode(status)}.`);
+                continue;
+            }
+            const reasons = getBlockingGaps(status).map((gap) => {
+                return gap.title;
+            });
+            // No agent at all: say what to install, in the status's own words.
+            const notConnected = findAgentMissingGap(status);
+            lines.push(`- ${describeResource(status)} (resourceId: ${status.resourceId}): NO direct access — ${reasons.length > 0 ? reasons.join("; ") : "not configured"}.${notConnected ? ` ${notConnected.nextStep}` : ""} Investigate with OneUptime telemetry only.`);
+        }
+        return lines.join("\n");
+    }
+    /*
+     * The sentence the investigation panel shows humans when AI investigated
+     * a resource with OneUptime data only. Deterministic so it reads the same
+     * on every panel and never depends on the model remembering to say it.
+     */
+    static describeMissingAccessForHumans(status) {
+        const blocking = getBlockingGaps(status);
+        if (blocking.length === 0 && status.isInvestigationReady) {
+            return `OneUptime AI can run read-only commands on ${describeResource(status)} through ${describeResourceAgent(status)}.`;
+        }
+        const first = blocking[0];
+        if (!first) {
+            return `OneUptime AI could not run commands on ${describeResource(status)}.`;
+        }
+        return `OneUptime AI could not run commands on ${describeResource(status)}: ${first.title.charAt(0).toLowerCase()}${first.title.slice(1)}. ${first.nextStep}`;
+    }
+    /*
+     * Why a resource cannot be inspected, as a short clause for the persona:
+     * the first blocking gap, and what to install when no agent is there.
+     */
+    static describeWhyNotReady(status) {
+        const first = getBlockingGaps(status)[0];
+        if (!first) {
+            return "not configured";
+        }
+        const title = `${first.title.charAt(0).toLowerCase()}${first.title.slice(1)}`;
+        if (first.code === "ai_agent_not_connected" &&
+            isAiResourceType(status.resourceType)) {
+            const info = AI_RESOURCE_TYPE_INFO[status.resourceType];
+            return `${title} — the operator should install the ${info.agentDisplayName} (see ${getResourceAiAgentPage(status.resourceType)})`;
+        }
+        return title;
+    }
+    /*
+     * The resource's remediation mode in the words of the canonical
+     * ResourceAiRemediationMode comment (Types/ResourceAiAgent/
+     * ResourceAiAccess): what runs without a human, what is proposed
+     * instead, and what always asks.
+     */
+    static describeRemediationMode(status) {
+        const noun = isAiResourceType(status.resourceType)
+            ? describeResourceNoun(status.resourceType)
+            : "resource";
+        if (status.aiRemediationMode === ResourceAiRemediationMode.BypassApproval) {
+            return status.isRemediationReady
+                ? `Bypass approval (AI does not ask: every fix the ${noun}'s command policy allows, safe and riskier, runs without a human — except commands the policy says always need a human; destructive commands never run)`
+                : "Bypass approval, but not ready";
+        }
+        if (status.aiRemediationMode === ResourceAiRemediationMode.Automatic) {
+            return status.isRemediationReady
+                ? `Automatic (safe fixes run without a human, and so do riskier ones whose shape the ${noun}'s command allowlist names; any other riskier fix is proposed for one-click approval, commands the policy says always need a human always ask, and destructive commands never run)`
+                : "Automatic, but not ready";
+        }
+        if (status.aiRemediationMode === ResourceAiRemediationMode.RequireApproval) {
+            return status.isRemediationReady
+                ? "a human approves any fix before it runs"
+                : "requires approval, but not ready";
+        }
+        return "disabled — AI may only inspect";
+    }
+}
+ResourceAccessContext.REPORT_SECTION_HEADING = "Infrastructure access";
+export default ResourceAccessContext;
+// Re-exported for the callers that read them with the context.
+export { LIST_INFRASTRUCTURE_ACCESS_TOOL_NAME, RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME, };
+//# sourceMappingURL=ResourceAccessContext.js.map

package/build/dist/Server/Utils/AI/ResourceAccess/ResourceAccessContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceAccessContext.js","sourceRoot":"","sources":["../../../../../../Server/Utils/AI/ResourceAccess/ResourceAccessContext.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EAErB,gBAAgB,GACjB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAGL,yBAAyB,GAC1B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,oCAAoC,EACpC,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;;GAYG;AAEH,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,MAA8B;IAC7D,MAAM,IAAI,GAA8B,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;QAC3E,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IAET,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,YAAY,GAAG,CAAC;AAC5E,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB,CAAC,MAA8B;IAClE,OAAO,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;QAC1C,CAAC,CAAC,OAAO,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE;QACtE,CAAC,CAAC,yBAAyB,CAAC;AAChC,CAAC;AAED,mEAAmE;AACnE,SAAS,eAAe,CACtB,MAA8B;IAE9B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAwB,EAAW,EAAE;QAC9D,OAAO,GAAG,CAAC,mBAAmB,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA8B;IAE9B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAwB,EAAW,EAAE;QAC5D,OAAO,GAAG,CAAC,IAAI,KAAK,wBAAwB,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAqB,qBAAqB;IAIxC;;;OAGG;IACI,MAAM,CAAC,oBAAoB,CAChC,QAAuC;QAEvC,MAAM,KAAK,GAAkC,QAAQ,CAAC,MAAM,CAC1D,CAAC,MAA8B,EAAW,EAAE;YAC1C,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACrC,CAAC,CACF,CAAC;QAEF,MAAM,KAAK,GAAkB,EAAE,CAAC;QAEhC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CACR,kHAAkH,KAAK;iBACpH,GAAG,CAAC,CAAC,MAA8B,EAAU,EAAE;gBAC9C,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC,CAAC;iBACD,IAAI,CACH,IAAI,CACL,SAAS,oCAAoC,yoBAAyoB,oCAAoC,4bAA4b,CAC1pC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAkC,QAAQ,CAAC,MAAM,CAC7D,CAAC,MAA8B,EAAW,EAAE;YAC1C,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;QACtC,CAAC,CACF,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CACR,6FAA6F,QAAQ;iBAClG,GAAG,CAAC,CAAC,MAA8B,EAAU,EAAE;gBAC9C,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,qBAAqB,CAAC,mBAAmB,CAC9E,MAAM,CACP,GAAG,CAAC;YACP,CAAC,CAAC;iBACD,IAAI,CACH,IAAI,CACL,0LAA0L,CAC9L,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CACR,mBAAmB,qBAAqB,CAAC,sBAAsB,oVAAoV,CACpZ,CAAC;QAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,8DAA8D;IACvD,MAAM,CAAC,mBAAmB,CAC/B,QAAuC;QAEvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAkB,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAE7D,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,GAA8B,gBAAgB,CACtD,MAAM,CAAC,YAAY,CACpB;gBACC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC5C,CAAC,CAAC,IAAI,CAAC;YAET,IAAI,MAAM,CAAC,oBAAoB,IAAI,IAAI,EAAE,CAAC;gBACxC,KAAK,CAAC,IAAI,CACR,KAAK,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,MAAM,CAAC,UAAU,sBAAsB,oCAAoC,gBAAgB,IAAI,CAAC,gBAAgB,eAAe,IAAI,CAAC,QAAQ,CAAC,IAAI,CAC7L,IAAI,CACL,mBAAmB,qBAAqB,CAAC,uBAAuB,CAC/D,MAAM,CACP,GAAG,CACL,CAAC;gBACF,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAkB,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,CACxD,CAAC,GAAwB,EAAU,EAAE;gBACnC,OAAO,GAAG,CAAC,KAAK,CAAC;YACnB,CAAC,CACF,CAAC;YAEF,mEAAmE;YACnE,MAAM,YAAY,GAChB,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAE9B,KAAK,CAAC,IAAI,CACR,KAAK,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,MAAM,CAAC,UAAU,yBAC7D,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAC5C,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,6CAA6C,CACjG,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,8BAA8B,CAC1C,MAA8B;QAE9B,MAAM,QAAQ,GAA+B,eAAe,CAAC,MAAM,CAAC,CAAC;QAErE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACzD,OAAO,8CAA8C,gBAAgB,CACnE,MAAM,CACP,YAAY,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAoC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,0CAA0C,gBAAgB,CAC/D,MAAM,CACP,GAAG,CAAC;QACP,CAAC;QAED,OAAO,0CAA0C,gBAAgB,CAC/D,MAAM,CACP,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,mBAAmB,CAAC,MAA8B;QAC/D,MAAM,KAAK,GAAoC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,KAAK,GAAW,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAEtF,IACE,KAAK,CAAC,IAAI,KAAK,wBAAwB;YACvC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,EACrC,CAAC;YACD,MAAM,IAAI,GACR,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAE7C,OAAO,GAAG,KAAK,sCAAsC,IAAI,CAAC,gBAAgB,SAAS,sBAAsB,CACvG,MAAM,CAAC,YAAY,CACpB,GAAG,CAAC;QACP,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,uBAAuB,CACpC,MAA8B;QAE9B,MAAM,IAAI,GAAW,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC;YAC3C,CAAC,CAAC,UAAU,CAAC;QAEf,IAAI,MAAM,CAAC,iBAAiB,KAAK,yBAAyB,CAAC,cAAc,EAAE,CAAC;YAC1E,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,mDAAmD,IAAI,yJAAyJ;gBAClN,CAAC,CAAC,gCAAgC,CAAC;QACvC,CAAC;QAED,IAAI,MAAM,CAAC,iBAAiB,KAAK,yBAAyB,CAAC,SAAS,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,qFAAqF,IAAI,oLAAoL;gBAC/Q,CAAC,CAAC,0BAA0B,CAAC;QACjC,CAAC;QAED,IACE,MAAM,CAAC,iBAAiB,KAAK,yBAAyB,CAAC,eAAe,EACtE,CAAC;YACD,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,kCAAkC,CAAC;QACzC,CAAC;QAED,OAAO,gCAAgC,CAAC;IAC1C,CAAC;;AApMsB,4CAAsB,GAC3C,uBAAuB,CAAC;eAFP,qBAAqB;AAwM1C,+DAA+D;AAC/D,OAAO,EACL,oCAAoC,EACpC,oCAAoC,GACrC,CAAC"}

package/build/dist/Server/Utils/AI/ResourceAccess/ResourceAccessToolNames.js

@@ -0,0 +1,33 @@
+/*
+ * Names of the AI tools that reach an infrastructure resource (a Docker or
+ * Podman host, a Docker Swarm, Proxmox, VMware or Ceph cluster, a database
+ * server or a host) through its resource AI agent, shared with the
+ * dashboard so the investigation panel can count "infrastructure commands"
+ * from the run's events without importing server code.
+ *
+ * Deliberately dependency-free: the investigation engine, the toolkit, the
+ * report parser and the dashboard bundle all import it.
+ */
+export const RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME = "run_infrastructure_command";
+export const LIST_INFRASTRUCTURE_ACCESS_TOOL_NAME = "list_infrastructure_access";
+// Every tool that reaches a resource rather than the project's telemetry.
+export const INFRASTRUCTURE_TOOL_NAMES = [
+    RUN_INFRASTRUCTURE_COMMAND_TOOL_NAME,
+    LIST_INFRASTRUCTURE_ACCESS_TOOL_NAME,
+];
+export function isInfrastructureToolName(toolName) {
+    return INFRASTRUCTURE_TOOL_NAMES.includes(toolName || "");
+}
+/*
+ * How the run's persisted event starts for an infrastructure command an
+ * agent took whose result never came back — whether it ran is unknown, so
+ * it is never counted as "did not run". The server writes it
+ * (InfrastructureInvestigationToolkit) and the investigation panel reads it
+ * (Components/AI/ClusterToolFormat); this is the one definition both use.
+ */
+export const INFRASTRUCTURE_RESULT_UNKNOWN_EVENT_PREFIX = "infrastructure command result unknown:";
+export function isInfrastructureResultUnknownMessage(errorMessage) {
+    return (typeof errorMessage === "string" &&
+        errorMessage.startsWith(INFRASTRUCTURE_RESULT_UNKNOWN_EVENT_PREFIX));
+}
+//# sourceMappingURL=ResourceAccessToolNames.js.map

package/build/dist/Server/Utils/AI/ResourceAccess/ResourceAccessToolNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceAccessToolNames.js","sourceRoot":"","sources":["../../../../../../Server/Utils/AI/ResourceAccess/ResourceAccessToolNames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,4BAA4B,CAAC;AAC/B,MAAM,CAAC,MAAM,oCAAoC,GAC/C,4BAA4B,CAAC;AAE/B,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAA0B;IAC9D,oCAAoC;IACpC,oCAAoC;CACrC,CAAC;AAEF,MAAM,UAAU,wBAAwB,CACtC,QAAmC;IAEnC,OAAO,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0CAA0C,GACrD,wCAAwC,CAAC;AAE3C,MAAM,UAAU,oCAAoC,CAClD,YAAuC;IAEvC,OAAO,CACL,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,CAAC,UAAU,CAAC,0CAA0C,CAAC,CACpE,CAAC;AACJ,CAAC"}